chore(release): prepare for v0.6.0-rc.3

Code responsible for removing the file at the
destination has been removed which broke the
re-exporting of types. This commit reverts
that change, but also silences Windows errors
when removing the file.

.env.example

@@ -1,2 +1,2 @@
 PUBLIC_REGISTRY_URL= # url of the registry API, this must have a trailing slash and include the version
-                     # example: https://registry.pesde.daimond113.com/v0/
+                     # example: https://registry.pesde.daimond113.com/v1/

.git-blame-ignore-revs

@@ -0,0 +1,3 @@
+# .git-blame-ignore-revs
+# Enabled the `hard_tabs` option in rustfmt.toml
+0ceb2f6653b12e8261533ef528d78e3dde7ed757

.github/workflows/debug.yml

@@ -40,6 +40,11 @@ jobs:
             runs-on: ubuntu-latest
             artifact-name: pesde-debug-${{ needs.get-version.outputs.version }}-linux-x86_64
 
+          - job-name: linux-aarch64
+            target: aarch64-unknown-linux-gnu
+            runs-on: ubuntu-24.04-arm
+            artifact-name: pesde-debug-${{ needs.get-version.outputs.version }}-linux-aarch64
+
           - job-name: macos-x86_64
             target: x86_64-apple-darwin
             runs-on: macos-13
@@ -58,7 +63,7 @@ jobs:
       uses: actions/checkout@v4
 
     - name: Install Linux build dependencies
-      if: ${{ matrix.runs-on == 'ubuntu-latest' }}
+      if: ${{ startsWith(matrix.runs-on, 'ubuntu') }}
       run: |
         sudo apt-get update
         sudo apt-get install libdbus-1-dev pkg-config

.github/workflows/release.yaml

@@ -51,6 +51,11 @@ jobs:
             arch: x86_64
             target: x86_64-unknown-linux-gnu
 
+          - os: ubuntu-24.04-arm
+            host: linux
+            arch: aarch64
+            target: aarch64-unknown-linux-gnu
+
           - os: windows-latest
             host: windows
             arch: x86_64
@@ -96,11 +101,9 @@ jobs:
           if [ ${{ matrix.host }} = "windows" ]; then
             mv target/${{ matrix.target }}/release/${{ env.BIN_NAME }}.exe ${{ env.BIN_NAME }}.exe
             7z a ${{ env.ARCHIVE_NAME }}.zip ${{ env.BIN_NAME }}.exe
-            tar -czf ${{ env.ARCHIVE_NAME }}.tar.gz ${{ env.BIN_NAME }}.exe
           else
             mv target/${{ matrix.target }}/release/${{ env.BIN_NAME }} ${{ env.BIN_NAME }}
             zip -r ${{ env.ARCHIVE_NAME }}.zip ${{ env.BIN_NAME }}
-            tar -czf ${{ env.ARCHIVE_NAME }}.tar.gz ${{ env.BIN_NAME }}
           fi
 
       - name: Upload zip artifact
@@ -109,12 +112,6 @@ jobs:
           name: ${{ env.ARCHIVE_NAME }}.zip
           path: ${{ env.ARCHIVE_NAME }}.zip
 
-      - name: Upload tar.gz artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: ${{ env.ARCHIVE_NAME }}.tar.gz
-          path: ${{ env.ARCHIVE_NAME }}.tar.gz
-
   publish:
     name: Publish to crates.io
     runs-on: ubuntu-latest

.gitignore

@@ -5,3 +5,5 @@ cobertura.xml
 tarpaulin-report.html
 build_rs_cov.profraw
 registry/data
+data
+manifest.schema.json

CHANGELOG.md

@@ -5,6 +5,59 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.0-rc.3] - 2025-02-08
+### Fixed
+- Fix `self-upgrade` using the wrong path when doing a fresh download by @daimond113
+- Fix types not being re-exported by @daimond113
+
+## [0.6.0-rc.2] - 2025-02-07
+### Fixed
+- Colour deprecate output to match yank output by @daimond113
+- Fix zbus panic on Linux by @daimond113
+
+## [0.6.0-rc.1] - 2025-02-06
+### Added
+- Improve installation experience by @lukadev-0
+- Support using aliases of own dependencies for overrides by @daimond113
+- Support ignoring parse errors in Luau files by @daimond113
+- Add path dependencies by @daimond113
+- Inherit pesde-managed scripts from workspace root by @daimond113
+- Allow using binaries from workspace root in member packages by @daimond113
+- Add yanking & deprecating by @daimond113
+- Add engines as a form of managing runtimes by @daimond113
+- Modify existing installed packages instead of always reinstalling by @daimond113
+- Add `cas prune` command to remove unused CAS files & packages by @daimond113
+- Add `list` and `remove` commands to manage packages in the manifest by @daimond113
+
+### Fixed
+- Install dev packages in prod mode and remove them after use to allow them to be used in scripts by @daimond113
+- Fix infinite loop in the resolver in packages depending on themselves by @daimond113
+- Do Git operations inside spawn_blocking to avoid performance issues by @daimond113
+- Scope CAS package indices to the source by @daimond113
+- Do not copy `default.project.json` in workspace dependencies by @daimond113
+
+### Changed
+- Change handling of graphs to a flat structure by @daimond113
+- Store dependency over downloaded graphs in the lockfile by @daimond113
+- Improve linking process by @daimond113
+- Use a proper url encoding library to ensure compatibility with all characters by @daimond113
+- The `*` specifier now matches all versions, even prereleases by @daimond113
+- Switch CLI dependencies to ones used by other dependencies to optimize the binary size by @daimond113
+- Reorder the `help` command by @daimond113
+- Ignore submodules instead of failing when using Git dependencies with submodules by @daimond113
+- Exit with code 1 from invalid directory binary linkers by @daimond113
+
+### Removed
+- Remove old includes format compatibility by @daimond113
+- Remove data redundancy for workspace package references by @daimond113
+- Remove dependency checks from CLI in publish command in favor of registry checks by @daimond113
+
+### Performance
+- Use `Arc` for more efficient cloning of multiple structs by @daimond113
+- Avoid cloning where possible by @daimond113
+- Remove unnecessary mutex in Wally package download by @daimond113
+- Lazily format error messages by @daimond113
+
 ## [0.5.3] - 2024-12-30
 ### Added
 - Add meta field in index files to preserve compatibility with potential future changes by @daimond113
@@ -112,6 +165,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Asyncify dependency linking by @daimond113
 - Use `exec` in Unix bin linking to reduce the number of processes by @daimond113
 
+[0.6.0-rc.3]: https://github.com/daimond113/pesde/compare/v0.6.0-rc.2%2Bregistry.0.2.0-rc.1..v0.6.0-rc.3%2Bregistry.0.2.0-rc.1
+[0.6.0-rc.2]: https://github.com/daimond113/pesde/compare/v0.6.0-rc.1%2Bregistry.0.2.0-rc.1..v0.6.0-rc.2%2Bregistry.0.2.0-rc.1
+[0.6.0-rc.1]: https://github.com/daimond113/pesde/compare/v0.5.3%2Bregistry.0.1.2..v0.6.0-rc.1%2Bregistry.0.2.0-rc.1
 [0.5.3]: https://github.com/daimond113/pesde/compare/v0.5.2%2Bregistry.0.1.1..v0.5.3%2Bregistry.0.1.2
 [0.5.2]: https://github.com/daimond113/pesde/compare/v0.5.1%2Bregistry.0.1.0..v0.5.2%2Bregistry.0.1.1
 [0.5.1]: https://github.com/daimond113/pesde/compare/v0.5.0%2Bregistry.0.1.0..v0.5.1%2Bregistry.0.1.0

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "pesde"
-version = "0.5.3"
+version = "0.6.0-rc.3"
 edition = "2021"
 license = "MIT"
 authors = ["daimond113 <contact@daimond113.com>"]
@@ -10,28 +10,29 @@ repository = "https://github.com/pesde-pkg/pesde"
 include = ["src/**/*", "Cargo.toml", "Cargo.lock", "README.md", "LICENSE", "CHANGELOG.md"]
 
 [features]
+default = ["wally-compat", "patches"]
 bin = [
     "dep:clap",
     "dep:dirs",
     "dep:tracing-subscriber",
-    "reqwest/json",
     "dep:indicatif",
-    "dep:tracing-indicatif",
     "dep:inquire",
     "dep:toml_edit",
-    "dep:colored",
+    "dep:console",
     "dep:anyhow",
     "dep:keyring",
     "dep:open",
-    "gix/worktree-mutation",
+    "dep:paste",
     "dep:serde_json",
-    "dep:winreg",
+    "dep:windows-registry",
+    "dep:windows",
+    "gix/worktree-mutation",
     "fs-err/expose_original_error",
     "tokio/rt",
     "tokio/rt-multi-thread",
     "tokio/macros",
 ]
-wally-compat = ["dep:async_zip", "dep:serde_json"]
+wally-compat = ["dep:serde_json"]
 patches = ["dep:git2"]
 version-management = ["bin"]
 
@@ -44,50 +45,54 @@ required-features = ["bin"]
 uninlined_format_args = "warn"
 
 [dependencies]
-serde = { version = "1.0.216", features = ["derive"] }
+serde = { version = "1.0.217", features = ["derive"] }
 toml = "0.8.19"
-serde_with = "3.11.0"
+gix = { version = "0.70.0", default-features = false, features = ["blocking-http-transport-reqwest-rust-tls", "revparse-regex", "credentials", "parallel"] }
-gix = { version = "0.68.0", default-features = false, features = ["blocking-http-transport-reqwest-rust-tls", "revparse-regex", "credentials", "parallel"] }
 semver = { version = "1.0.24", features = ["serde"] }
-reqwest = { version = "0.12.9", default-features = false, features = ["rustls-tls"] }
+reqwest = { version = "0.12.12", default-features = false, features = ["rustls-tls", "stream", "json"] }
 tokio-tar = "0.3.1"
 async-compression = { version = "0.4.18", features = ["tokio", "gzip"] }
 pathdiff = "0.2.3"
 relative-path = { version = "1.9.3", features = ["serde"] }
 tracing = { version = "0.1.41", features = ["attributes"] }
-thiserror = "2.0.7"
+thiserror = "2.0.11"
-tokio = { version = "1.42.0", features = ["process"] }
+tokio = { version = "1.43.0", features = ["process", "macros"] }
 tokio-util = "0.7.13"
 async-stream = "0.3.6"
 futures = "0.3.31"
-full_moon = { version = "1.1.2", features = ["luau"] }
+full_moon = { version = "1.2.0", features = ["luau"] }
 url = { version = "2.5.4", features = ["serde"] }
-chrono = { version = "0.4.39", features = ["serde"] }
+jiff = { version = "0.1.28", default-features = false, features = ["serde", "std"] }
 sha2 = "0.10.8"
-tempfile = "3.14.0"
+tempfile = "3.15.0"
 wax = { version = "0.6.0", default-features = false }
 fs-err = { version = "3.0.0", features = ["tokio"] }
+urlencoding = "2.1.3"
+async_zip = { version = "0.0.17", features = ["tokio", "deflate", "deflate64", "tokio-fs"] }
 
 # TODO: remove this when gitoxide adds support for: committing, pushing, adding
-git2 = { version = "0.19.0", optional = true }
+git2 = { version = "0.20.0", optional = true }
 
-async_zip = { version = "0.0.17", features = ["tokio", "deflate", "deflate64", "tokio-fs"], optional = true }
+serde_json = { version = "1.0.136", optional = true }
-serde_json = { version = "1.0.133", optional = true }
 
-anyhow = { version = "1.0.94", optional = true }
+anyhow = { version = "1.0.95", optional = true }
-open = { version = "5.3.1", optional = true }
+open = { version = "5.3.2", optional = true }
-keyring = { version = "3.6.1", features = ["crypto-rust", "windows-native", "apple-native", "async-secret-service", "async-io"], optional = true }
+keyring = { version = "3.6.1", features = ["crypto-rust", "windows-native", "apple-native", "sync-secret-service"], optional = true }
-colored = { version = "2.1.0", optional = true }
+console = { version = "0.15.10", optional = true }
 toml_edit = { version = "0.22.22", optional = true }
-clap = { version = "4.5.23", features = ["derive"], optional = true }
+clap = { version = "4.5.26", features = ["derive"], optional = true }
-dirs = { version = "5.0.1", optional = true }
+dirs = { version = "6.0.0", optional = true }
 tracing-subscriber = { version = "0.3.19", features = ["env-filter"], optional = true }
 indicatif = { version = "0.17.9", optional = true }
-tracing-indicatif = { version = "0.3.8", optional = true }
+inquire = { version = "0.7.5", default-features = false, features = ["console", "one-liners"], optional = true }
-inquire = { version = "0.7.5", optional = true }
+paste = { version = "1.0.15", optional = true }
 
 [target.'cfg(target_os = "windows")'.dependencies]
-winreg = { version = "0.52.0", optional = true }
+windows-registry = { version = "0.4.0", optional = true }
+windows = { version = "0.59.0", features = ["Win32_Storage", "Win32_Storage_FileSystem", "Win32_Security"], optional = true }
+
+[dev-dependencies]
+schemars = { git = "https://github.com/daimond113/schemars", rev = "bc7c7d6", features = ["semver1", "url2"] }
 
 [workspace]
 resolver = "2"
@@ -96,11 +101,15 @@ members = ["registry"]
 [profile.dev.package.full_moon]
 opt-level = 3
 
+[profile.dev.package.miniz_oxide]
+opt-level = 3
+
 [profile.release]
 opt-level = "s"
 lto = true
 incremental = true
 codegen-units = 1
+panic = "abort"
 
 [profile.release.package.pesde-registry]
 # add debug symbols for Sentry stack traces

docs/package.json

@@ -10,20 +10,20 @@
     "astro": "astro"
   },
   "dependencies": {
-    "@astrojs/check": "^0.9.3",
+    "@astrojs/check": "0.9.4",
-    "@astrojs/starlight": "^0.28.2",
+    "@astrojs/starlight": "0.30.6",
-    "@astrojs/starlight-tailwind": "^2.0.3",
+    "@astrojs/starlight-tailwind": "3.0.0",
-    "@astrojs/tailwind": "^5.1.1",
+    "@astrojs/tailwind": "5.1.4",
-    "@fontsource-variable/nunito-sans": "^5.1.0",
+    "@fontsource-variable/nunito-sans": "^5.1.1",
-    "@shikijs/rehype": "^1.21.0",
+    "@shikijs/rehype": "^1.26.2",
-    "astro": "^4.15.9",
+    "astro": "5.1.5",
     "sharp": "^0.33.5",
-    "shiki": "^1.21.0",
+    "shiki": "^1.26.2",
-    "tailwindcss": "^3.4.13",
+    "tailwindcss": "^3.4.17",
-    "typescript": "^5.6.2"
+    "typescript": "^5.7.3"
   },
   "devDependencies": {
     "prettier-plugin-astro": "^0.14.1",
-    "prettier-plugin-tailwindcss": "^0.6.8"
+    "prettier-plugin-tailwindcss": "^0.6.9"
   }
 }

docs/src/components/SiteTitle.astro

@@ -3,12 +3,7 @@
 		href="https://pesde.daimond113.com/"
 		class="flex text-[var(--sl-color-text-accent)] hover:opacity-80"
 	>
-		<svg
+		<svg viewBox="0 0 56 28" class="h-7" fill="none" xmlns="http://www.w3.org/2000/svg">
-			viewBox="0 0 56 28"
-			class="h-7"
-			fill="none"
-			xmlns="http://www.w3.org/2000/svg"
-		>
 			<title>pesde</title>
 			<path
 				d="M0 28V26.3156H2.25652V12.2361H0.0635639V10.5517H4.44947L4.48125 11.9819L3.78205 12.3315C4.41769 11.6746 5.16986 11.1661 6.03857 10.8059C6.92846 10.4245 7.82895 10.2338 8.74003 10.2338C9.863 10.2338 10.88 10.4775 11.7911 10.9648C12.7234 11.4522 13.4544 12.1726 13.9841 13.126C14.5349 14.0795 14.8104 15.2448 14.8104 16.6221C14.8104 18.0416 14.5138 19.26 13.9205 20.277C13.3272 21.2728 12.5327 22.0356 11.5368 22.5653C10.5622 23.095 9.5028 23.3598 8.35865 23.3598C7.72301 23.3598 7.11916 23.2751 6.54708 23.1056C5.99619 22.9361 5.50887 22.7242 5.08511 22.4699C4.66135 22.1945 4.34353 21.8873 4.13165 21.5483L4.60838 21.4529L4.5766 26.3156H7.02381V28H0ZM7.94549 21.6118C9.19558 21.6118 10.2444 21.2092 11.0919 20.4041C11.9394 19.5778 12.3632 18.3807 12.3632 16.8127C12.3632 15.2872 11.9606 14.1113 11.1555 13.2849C10.3503 12.4586 9.3333 12.0454 8.1044 12.0454C7.72301 12.0454 7.26747 12.1196 6.73777 12.2679C6.20807 12.395 5.67837 12.6069 5.14867 12.9035C4.61898 13.2002 4.17403 13.5922 3.81383 14.0795L4.5766 12.7446L4.60838 20.7219L3.8774 19.7367C4.42828 20.3299 5.06392 20.7961 5.78431 21.1351C6.5047 21.4529 7.2251 21.6118 7.94549 21.6118Z"
@@ -27,8 +22,7 @@
 				fill="currentColor"></path>
 		</svg>
 	</a>
-	<span class="-mt-px ml-2.5 mr-2 text-xl text-[var(--sl-color-gray-5)]">/</span
+	<span class="-mt-px ml-2.5 mr-2 text-xl text-[var(--sl-color-gray-5)]">/</span>
-	>
 	<a
 		class="font-medium text-[var(--sl-color-gray-2)] no-underline hover:opacity-80 md:text-lg"
 		href="/">docs</a

docs/src/content/config.ts

@@ -1,6 +1,7 @@
 import { defineCollection } from "astro:content"
+import { docsLoader } from "@astrojs/starlight/loaders"
 import { docsSchema } from "@astrojs/starlight/schema"
 
 export const collections = {
-	docs: defineCollection({ schema: docsSchema() }),
+	docs: defineCollection({ loader: docsLoader(), schema: docsSchema() }),
 }

docs/src/content/docs/guides/binary-packages.mdx

@@ -42,6 +42,9 @@ hello
 # Hello, pesde! (pesde/hello@1.0.0, lune)
 ```
 
+Note that they are scoped to the nearest `pesde.toml` file. However, you can use
+binaries of the workspace root from member packages.
+
 ## Making a binary package
 
 To make a binary package you must use a target compatible with binary exports.

docs/src/content/docs/guides/dependencies.mdx

@@ -137,6 +137,24 @@ pesde add workspace:acme/bar
 	href="/guides/workspaces/"
 />
 
+## Path Dependencies
+
+Path dependencies are dependencies found anywhere available to the operating system.
+They are useful for local development, but are forbidden in published packages.
+
+The path must be absolute and point to a directory containing a `pesde.toml` file.
+
+```toml title="pesde.toml"
+[dependencies]
+foo = { path = "/home/user/foo" }
+```
+
+You can also add a path dependency by running the following command:
+
+```sh
+pesde add path:/home/user/foo
+```
+
 ## Peer Dependencies
 
 Peer dependencies are dependencies that are not installed automatically when

docs/src/content/docs/guides/overrides.mdx

@@ -32,6 +32,29 @@ foo = { name = "acme/foo", version = "^1.0.0" }
 
 Now, when you run `pesde install`, `bar` 2.0.0 will be used instead of 1.0.0.
 
+Overrides are also able to use aliases to share the specifier you use for your
+own dependencies:
+
+```toml title="pesde.toml"
+[dependencies]
+foo = { name = "acme/foo", version = "^1.0.0" }
+bar = { name = "acme/bar", version = "^2.0.0" }
+
+[overrides]
+"foo>bar" = "bar"
+```
+
+This is the same as if you had written:
+
+```toml title="pesde.toml"
+[dependencies]
+foo = { name = "acme/foo", version = "^1.0.0" }
+bar = { name = "acme/bar", version = "^2.0.0" }
+
+[overrides]
+"foo>bar" = { name = "acme/bar", version = "^2.0.0" }
+```
+
 You can learn more about the syntax for dependency overrides in the
 [reference](/reference/manifest#overrides).
 

docs/src/content/docs/guides/publishing.mdx

@@ -91,6 +91,13 @@ For example, you may publish a package that can be used in both Roblox and
 Luau environments by publishing two versions of the package, one for each
 environment.
 
+<Aside type="caution">
+
+Packages for different targets but on the same version must have
+the same description.
+
+</Aside>
+
 ## Documentation
 
 The `README.md` file in the root of the package will be displayed on the

docs/src/content/docs/guides/removing-packages.mdx

@@ -0,0 +1,56 @@
+---
+title: Removing Packages
+description: Learn how to remove packages from the registry.
+---
+
+pesde doesn't support removing packages from the registry. This is to ensure
+that the registry remains a reliable source of packages for everyone. However,
+pesde provides other mechanisms to handle packages that are no longer needed.
+
+## Yanking
+
+Yanking is limited to a specific version (and target) of a package. It is used
+to mark a version as broken or deprecated. Yanked versions are unavailable
+to download fresh, but they can still be installed if they are present in the
+lockfile of a project.
+
+To yank a package, you can use the `pesde yank` command:
+
+```sh
+pesde yank <PACKAGE>@<VERSION> <TARGET>
+```
+
+You can leave out the target if you want to yank all targets of the version:
+
+```sh
+pesde yank <PACKAGE>@<VERSION>
+```
+
+## Deprecating
+
+On the other hand, deprecating a package is used to mark a package as deprecated
+in the registry. This is useful when you want to discourage users from using
+a package, but don't want to break existing projects that depend on it. Unlike
+yanking, your package will still be able to be installed fresh. However, when it
+is installed, a warning will be shown to the user.
+
+To deprecate a package, you can use the `pesde deprecate` command:
+
+```sh
+pesde deprecate <PACKAGE> [REASON]
+```
+
+You must provide a non-empty reason when deprecating a package. This is to
+inform users why the package is deprecated. For example, if your package
+has been replaced by another package, you can provide a reason like:
+
+```sh
+pesde deprecate acme/old-package "This package has been replaced by acme/new-package."
+```
+
+## Other Options
+
+There are other situations in which you might want to remove a package from
+the registry. Please refer to the policies of the registry you are using for
+more information on how to handle these situations. The process for the official
+registry is described [here](/registry/policies/#package-removal).

docs/src/content/docs/guides/roblox.mdx

@@ -188,10 +188,13 @@ This will cause the `src` directory to be directly synced into Roblox.
 
 In pesde, you should not have a `default.project.json` file in your package.
 Instead, you are required to use the `build_files` field to specify a 1:1 match
-between Roblox and the file system. pesde forbids `default.project.json` to be
+between Roblox and the file system. These are given to the
-part of a published package, and regenerates it when installing a pesde git
+`roblox_sync_config_generator` script to generate the configuration for the sync
-dependency. This allows the consumer of your package to choose the sync tool
+tool the user is using. pesde forbids `default.project.json` to be part of a
-they want to use, instead of being constrained to only using Rojo.
+published package, as well as ignoring them from Git dependencies. This allows
+the consumer of your package to choose the sync tool they want to use, instead
+of being constrained to only using Rojo as well as preventing broken packages
+from being published (for example, if the project is configured as a DataModel).
 
 This has the effect that the structure of the files in the file system ends up
 being reflected inside Roblox.

docs/src/content/docs/guides/self-hosting-registries.mdx

@@ -23,7 +23,7 @@ the following content:
 api = "https://registry.acme.local/"
 
 # package download URL (optional)
-download = "{API_URL}/v0/packages/{PACKAGE}/{PACKAGE_VERSION}/{PACKAGE_TARGET}"
+download = "{API_URL}/v1/packages/{PACKAGE}/{PACKAGE_VERSION}/{PACKAGE_TARGET}/archive"
 
 # the client ID of the GitHub OAuth app (optional)
 github_oauth_client_id = "a1d648966fdfbdcd9295"
@@ -58,7 +58,7 @@ scripts_packages = ["pesde/scripts_rojo"]
   - `{PACKAGE_VERSION}`: The package version.
   - `{PACKAGE_TARGET}`: The package target.
 
-  Defaults to `{API_URL}/v0/packages/{PACKAGE}/{PACKAGE_VERSION}/{PACKAGE_TARGET}`.
+  Defaults to `{API_URL}/v1/packages/{PACKAGE}/{PACKAGE_VERSION}/{PACKAGE_TARGET}/archive`.
 
 - **github_oauth_client_id**: This is required if you use GitHub OAuth for
   authentication. See below for more information.
@@ -115,11 +115,11 @@ for this purpose.
   `GITHUB_USERNAME`. This is required.
 
 - **COMMITTER_GIT_NAME**: The name to use for the committer when updating the
-  index repository.\
+  index repository. This is required.\
   Example: `pesde index updater`
 
 - **COMMITTER_GIT_EMAIL**: The email to use for the committer when updating the
-  index repository.\
+  index repository. This is required.\
   Example: `pesde@localhost`
 
 - **DATA_DIR**: The directory where the registry stores miscellaneous data.

docs/src/content/docs/installation.mdx

@@ -5,22 +5,11 @@ description: Install pesde
 
 import { Aside, Steps, TabItem, Tabs } from "@astrojs/starlight/components"
 
-## Prerequisites
-
-pesde requires [Lune](https://lune-org.github.io/docs) to be installed on your
-system in order to function properly.
-
-You can follow the installation instructions in the
-[Lune documentation](https://lune-org.github.io/docs/getting-started/1-installation).
-
-## Installing pesde
-
 <Steps>
 
 1. Go to the [GitHub releases page](https://github.com/pesde-pkg/pesde/releases/latest).
 
-2. Download the corresponding archive for your operating system. You can choose
+2. Download the corresponding archive for your operating system.
-  whether to use the `.zip` or `.tar.gz` files.
 
 3. Extract the downloaded archive to a folder on your computer.
 
@@ -76,6 +65,7 @@ You can follow the installation instructions in the
       
       </TabItem>
     </Tabs>
+    <br />
 
   5. Verify that pesde is installed by running the following command:
 
@@ -92,8 +82,8 @@ You can follow the installation instructions in the
 It is not recommended to use toolchain managers (such as Rokit or Aftman) to
 install pesde. You can use `pesde self-upgrade` if you need to update pesde.
 
-If you need everyone to use the same version of pesde, you can use the
+If you need everyone to use a compatible version of pesde, you can use the
-`pesde_version` field in `pesde.toml` to specify the version of pesde to use
+`[engines.pesde]` field in `pesde.toml` to specify the version of pesde to use
 for the current project.
 
 </Aside>

docs/src/content/docs/quickstart.mdx

@@ -33,7 +33,7 @@ pesde init
 # what is the repository URL of this project?
 # what is the license of this project? MIT
 # what environment are you targeting for your package? luau
-# would you like to setup default Roblox compatibility scripts? No
+# would you like to setup Roblox compatibility scripts? No
 ```
 
 The command will create a `pesde.toml` file in the current folder. Go ahead

docs/src/content/docs/reference/cli.mdx

@@ -55,10 +55,83 @@ is printed.
 
 The default index is [`pesde-index`](https://github.com/pesde-pkg/index).
 
+## `pesde cas`
+
+Content-addressable storage (CAS) related commands.
+
+### `pesde cas prune`
+
+Removes unused CAS files and packages.
+
 ## `pesde init`
 
 Initializes a new pesde project in the current directory.
 
+## `pesde add`
+
+```sh
+pesde add <PACKAGE>
+```
+
+Adds a package to the dependencies of the current project.
+
+- `-i, --index <INDEX>`: The index in which to search for the package.
+- `-t, --target <TARGET>`: The target environment for the package.
+- `-a, --alias <ALIAS>`: The alias to use for the package, defaults to the
+  package name.
+- `-p, --peer`: Adds the package as a peer dependency.
+- `-d, --dev`: Adds the package as a dev dependency.
+
+The following formats are supported:
+
+```sh
+pesde add pesde/hello
+pesde add pesde/hello@1.2.3
+pesde add gh#acme/package#main
+pesde add https://git.acme.local/package.git#aeff6
+pesde add workspace:pesde/hello
+pesde add workspace:pesde/hello@1.2.3
+pesde add path:/home/user/package
+```
+
+## `pesde remove`
+
+```sh
+pesde remove <ALIAS>
+```
+
+Removes a package from the dependencies of the current project.
+
+## `pesde install`
+
+Installs dependencies for the current project.
+
+- `--locked`: Whether to error if the lockfile is out of date.
+- `--prod`: Whether to not linking dev dependencies.
+- `--network-concurrency <CONCURRENCY>`: The number of concurrent network
+  requests to make at most. Defaults to 16.
+- `--force`: Whether to force reinstall all packages even if they are already
+  installed (useful if there is any issue with the current installation).
+
+## `pesde update`
+
+Updates the dependencies of the current project.
+
+- `--no-install`: Whether to only update the lockfile without installing the
+  dependencies.
+- `--network-concurrency <CONCURRENCY>`: The number of concurrent network
+  requests to make at most. Defaults to 16.
+- `--force`: Whether to force reinstall all packages even if they are already
+  installed (useful if there is any issue with the current installation).
+
+## `pesde outdated`
+
+Lists outdated dependencies of the current project.
+
+## `pesde list`
+
+Lists the dependencies of the current project.
+
 ## `pesde run`
 
 Runs a script from the current project using Lune.
@@ -83,13 +156,6 @@ Arguments can be passed to the script by using `--` followed by the arguments.
 pesde run foo -- --arg1 --arg2
 ```
 
-## `pesde install`
-
-Installs dependencies for the current project.
-
-- `--locked`: Whether to error if the lockfile is out of date.
-- `--prod`: Whether to skip installing dev dependencies.
-
 ## `pesde publish`
 
 Publishes the current project to the pesde registry.
@@ -99,18 +165,26 @@ Publishes the current project to the pesde registry.
   publish it.
 - `-y, --yes`: Whether to skip the confirmation prompt.
 - `-i, --index`: Name of the index to publish to. Defaults to `default`.
+- `--no-verify`: Whether to skip syntax validation of the exports of the
+  package.
 
-## `pesde self-install`
+## `pesde yank`
 
-Performs the pesde installation process. This should be the first command run
+Yanks a version of a package from the registry.
-after downloading the pesde binary.
 
-## `pesde self-upgrade`
+- `--undo`: Whether to unyank the package.
+- `-i, --index`: Name of the index to yank from. Defaults to `default`.
 
-Upgrades the pesde binary to the latest version.
+## `pesde deprecate`
 
-- `--use-cached`: Whether to use the version displayed in the "upgrade available"
+```sh
-  message instead of checking for the latest version.
+pesde deprecate <PACKAGE> [REASON]
+```
+
+Deprecates a package in the registry. A non-empty reason must be provided.
+
+- `--undo`: Whether to undepricate the package.
+- `-i, --index`: Name of the index to deprecate from. Defaults to `default`.
 
 ## `pesde patch`
 
@@ -137,33 +211,6 @@ pesde patch-commit <PATH>
 
 Applies the changes made in the patching environment created by `pesde patch`.
 
-## `pesde add`
-
-```sh
-pesde add <PACKAGE>
-```
-
-Adds a package to the dependencies of the current project.
-
-- `-i, --index <INDEX>`: The index in which to search for the package.
-- `-t, --target <TARGET>`: The target environment for the package.
-- `-a, --alias <ALIAS>`: The alias to use for the package, defaults to the
-  package name.
-- `-p, --peer`: Adds the package as a peer dependency.
-- `-d, --dev`: Adds the package as a dev dependency.
-
-The following formats are supported:
-
-```sh
-pesde add pesde/hello
-pesde add gh#acme/package#main
-pesde add https://git.acme.local/package.git#aeff6
-```
-
-## `pesde update`
-
-Updates the dependencies of the current project.
-
 ## `pesde x`
 
 Runs a one-off binary package.
@@ -178,3 +225,15 @@ a pesde project.
 ```sh
 pesde x pesde/hello
 ```
+
+## `pesde self-install`
+
+Performs the pesde installation process. This should be the first command run
+after downloading the pesde binary.
+
+## `pesde self-upgrade`
+
+Upgrades the pesde binary to the latest version.
+
+- `--use-cached`: Whether to use the version displayed in the "upgrade available"
+  message instead of checking for the latest version.

docs/src/content/docs/reference/manifest.mdx

@@ -84,11 +84,6 @@ includes = [
 ]
 ```
 
-### `pesde_version`
-
-The version of pesde to use within this project. The `pesde` CLI will look at
-this field and run the correct version of pesde for this project.
-
 ### `workspace_members`
 
 A list of globs containing the members of this workspace.
@@ -273,10 +268,27 @@ version `1.0.0`, and the `bar` and `baz` dependencies of the `foo` package with
 version `2.0.0`.
 
 Each key in the overrides table is a comma-separated list of package paths. The
-path is a list of package names separated by `>`. For example, `foo>bar>baz`
+path is a list of aliases separated by `>`. For example, `foo>bar>baz`
 refers to the `baz` dependency of the `bar` package, which is a dependency of
 the `foo` package.
 
+The value of an override entry can be either a specifier or an alias. If it is an
+alias (a string), it will be equivalent to putting the specifier of the dependency
+under that alias. For example, the following two overrides are equivalent:
+
+```toml
+[dependencies]
+bar = { name = "acme/bar", version = "2.0.0" }
+
+[overrides]
+"foo>bar" = "bar"
+```
+
+```toml
+[overrides]
+"foo>bar" = { name = "acme/bar", version = "2.0.0" }
+```
+
 <LinkCard
 	title="Overrides"
 	description="Learn more about overriding and patching packages."
@@ -399,18 +411,19 @@ foo = { workspace = "acme/foo", version = "^" }
 	href="/guides/workspaces/#workspace-dependencies"
 />
 
-## `[peer_dependencies]`
+### Path
-
-The `[peer_dependencies]` section contains a list of peer dependencies for the
-package. These are dependencies that are required by the package, but are not
-installed automatically. Instead, they must be installed by the user of the
-package.
 
 ```toml
-[peer_dependencies]
+[dependencies]
-foo = { name = "acme/foo", version = "1.2.3" }
+foo = { path = "/home/user/foo" }
 ```
 
+**Path dependencies** contain the following fields:
+
+- `path`: The path to the package on the local filesystem.
+
+Path dependencies are forbidden in published packages.
+
 ## `[dev_dependencies]`
 
 The `[dev_dependencies]` section contains a list of development dependencies for
@@ -430,3 +443,31 @@ foo = { name = "acme/foo", version = "1.2.3" }
 	description="Learn more about specifying dependencies in pesde."
 	href="/guides/dependencies/"
 />
+
+## `[peer_dependencies]`
+
+The `[peer_dependencies]` section contains a list of peer dependencies for the
+package. These are dependencies that are required by the package, but are not
+installed automatically. Instead, they must be installed by the user of the
+package.
+
+```toml
+[peer_dependencies]
+foo = { name = "acme/foo", version = "1.2.3" }
+```
+
+## `[engines]`
+
+The `[engines]` section contains a list of engines that the package is compatible
+with.
+
+```toml
+[engines]
+pesde = "^0.6.0"
+lune = "^0.8.9"
+```
+
+Currently, the only engines that can be specified are `pesde` and `lune`.
+Additionally, the engines you declared in your project will be installed when
+you run `pesde install`. Then, a version of the engine that satisfies the
+specified version range will be used when you run the engine.

registry/CHANGELOG.md

@@ -5,18 +5,32 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [0.1.2]
+## [0.2.0-rc.1] - 2025-02-06
+### Added
+- Support deprecating and yanking packages by @daimond113
+- Add yanking & deprecating to registry by @daimond113
+- Log more information about configured auth & storage by @daimond113
+- Add individual endpoints for package data over using `Accept` header conditional returns by @daimond113
+- Set `Content-Length` header for FS storage backend by @daimond113
+
+### Performance
+- Switch to using a `RwLock` over a `Mutex` to store repository data by @daimond113
+- Asyncify blocking operations by @daimond113
+- Asyncify reading of package data of top search results by @daimond113
+
+## [0.1.2] - 2024-12-30
 ### Changed
 - Update to pesde lib API changes by @daimond113
 
 ## [0.1.1] - 2024-12-19
 ### Changed
-- Switch to traccing for logging by @daimond113
+- Switch to tracing for logging by @daimond113
 
 ## [0.1.0] - 2024-12-14
 ### Added
 - Rewrite registry for pesde v0.5.0 by @daimond113
 
+[0.2.0-rc.1]: https://github.com/daimond113/pesde/compare/v0.5.3%2Bregistry.0.1.2..v0.6.0-rc.1%2Bregistry.0.2.0-rc.1
 [0.1.2]: https://github.com/daimond113/pesde/compare/v0.5.2%2Bregistry.0.1.1..v0.5.3%2Bregistry.0.1.2
 [0.1.1]: https://github.com/daimond113/pesde/compare/v0.5.1%2Bregistry.0.1.0..v0.5.2%2Bregistry.0.1.1
 [0.1.0]: https://github.com/daimond113/pesde/compare/v0.4.7..v0.5.0%2Bregistry.0.1.0

registry/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "pesde-registry"
-version = "0.1.2"
+version = "0.2.0-rc.1"
 edition = "2021"
 repository = "https://github.com/pesde-pkg/index"
 publish = false
@@ -10,31 +10,32 @@ actix-web = "4.9.0"
 actix-cors = "0.7.0"
 actix-governor = "0.8.0"
 dotenvy = "0.15.7"
-thiserror = "2.0.7"
+thiserror = "2.0.11"
 tantivy = "0.22.0"
 semver = "1.0.24"
-chrono = { version = "0.4.39", features = ["serde"] }
+jiff = { version = "0.1.28", features = ["serde"] }
 futures = "0.3.31"
-tokio = "1.42.0"
+tokio = "1.43.0"
-tempfile = "3.14.0"
+tokio-util = "0.7.13"
+tempfile = "3.15.0"
 fs-err = { version = "3.0.0", features = ["tokio"] }
 async-stream = "0.3.6"
 
-git2 = "0.19.0"
+git2 = "0.20.0"
-gix = { version = "0.68.0", default-features = false, features = [
+gix = { version = "0.70.0", default-features = false, features = [
     "blocking-http-transport-reqwest-rust-tls",
     "credentials",
 ] }
 
-serde = "1.0.216"
+serde = "1.0.217"
-serde_json = "1.0.133"
+serde_json = "1.0.136"
 serde_yaml = "0.9.34"
 toml = "0.8.19"
-convert_case = "0.6.0"
+convert_case = "0.7.1"
 sha2 = "0.10.8"
 
-rusty-s3 = "0.5.0"
+rusty-s3 = "0.7.0"
-reqwest = { version = "0.12.9", features = ["json", "rustls-tls"] }
+reqwest = { version = "0.12.12", features = ["json", "rustls-tls"] }
 constant_time_eq = "0.3.1"
 
 tokio-tar = "0.3.1"
@@ -44,7 +45,7 @@ tracing = { version = "0.1.41", features = ["attributes"] }
 tracing-subscriber = { version = "0.3.19", features = ["env-filter"] }
 tracing-actix-web = "0.7.15"
 
-sentry = { version = "0.35.0", default-features = false, features = ["backtrace", "contexts", "debug-images", "panic", "reqwest", "rustls", "tracing"] }
+sentry = { version = "0.36.0", default-features = false, features = ["backtrace", "contexts", "debug-images", "panic", "reqwest", "rustls", "tracing"] }
-sentry-actix = "0.35.0"
+sentry-actix = "0.36.0"
 
-pesde = { path = "..", features = ["wally-compat"] }
+pesde = { path = "..", default-features = false, features = ["wally-compat"] }

registry/src/auth/github.rs

@@ -1,6 +1,6 @@
 use crate::{
-    auth::{get_token_from_req, AuthImpl, UserId},
+	auth::{get_token_from_req, AuthImpl, UserId},
-    error::ReqwestErrorExt,
+	error::ReqwestErrorExt,
 };
 use actix_web::{dev::ServiceRequest, Error as ActixError};
 use reqwest::StatusCode;
@@ -9,79 +9,79 @@ use std::fmt::Display;
 
 #[derive(Debug)]
 pub struct GitHubAuth {
-    pub reqwest_client: reqwest::Client,
+	pub reqwest_client: reqwest::Client,
-    pub client_id: String,
+	pub client_id: String,
-    pub client_secret: String,
+	pub client_secret: String,
 }
 
 #[derive(Debug, Serialize)]
 struct TokenRequestBody {
-    access_token: String,
+	access_token: String,
 }
 
 impl AuthImpl for GitHubAuth {
-    async fn for_write_request(&self, req: &ServiceRequest) -> Result<Option<UserId>, ActixError> {
+	async fn for_write_request(&self, req: &ServiceRequest) -> Result<Option<UserId>, ActixError> {
-        let token = match get_token_from_req(req) {
+		let token = match get_token_from_req(req) {
-            Some(token) => token,
+			Some(token) => token,
-            None => return Ok(None),
+			None => return Ok(None),
-        };
+		};
 
-        let response = match self
+		let response = match self
-            .reqwest_client
+			.reqwest_client
-            .post(format!(
+			.post(format!(
-                "https://api.github.com/applications/{}/token",
+				"https://api.github.com/applications/{}/token",
-                self.client_id
+				self.client_id
-            ))
+			))
-            .basic_auth(&self.client_id, Some(&self.client_secret))
+			.basic_auth(&self.client_id, Some(&self.client_secret))
-            .json(&TokenRequestBody {
+			.json(&TokenRequestBody {
-                access_token: token,
+				access_token: token,
-            })
+			})
-            .send()
+			.send()
-            .await
+			.await
-        {
+		{
-            Ok(response) => match response.error_for_status_ref() {
+			Ok(response) => match response.error_for_status_ref() {
-                Ok(_) => response,
+				Ok(_) => response,
-                Err(e) if e.status().is_some_and(|s| s == StatusCode::NOT_FOUND) => {
+				Err(e) if e.status().is_some_and(|s| s == StatusCode::NOT_FOUND) => {
-                    return Ok(None);
+					return Ok(None);
-                }
+				}
-                Err(_) => {
+				Err(_) => {
-                    tracing::error!(
+					tracing::error!(
-                        "failed to get user: {}",
+						"failed to get user: {}",
-                        response.into_error().await.unwrap_err()
+						response.into_error().await.unwrap_err()
-                    );
+					);
-                    return Ok(None);
+					return Ok(None);
-                }
+				}
-            },
+			},
-            Err(e) => {
+			Err(e) => {
-                tracing::error!("failed to get user: {e}");
+				tracing::error!("failed to get user: {e}");
-                return Ok(None);
+				return Ok(None);
-            }
+			}
-        };
+		};
 
-        let user_id = match response.json::<UserResponse>().await {
+		let user_id = match response.json::<UserResponse>().await {
-            Ok(resp) => resp.user.id,
+			Ok(resp) => resp.user.id,
-            Err(e) => {
+			Err(e) => {
-                tracing::error!("failed to get user: {e}");
+				tracing::error!("failed to get user: {e}");
-                return Ok(None);
+				return Ok(None);
-            }
+			}
-        };
+		};
 
-        Ok(Some(UserId(user_id)))
+		Ok(Some(UserId(user_id)))
-    }
+	}
 }
 
 impl Display for GitHubAuth {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+	fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(f, "GitHub")
+		write!(f, "GitHub (client id: {})", self.client_id)
-    }
+	}
 }
 
 #[derive(Debug, Deserialize)]
 struct User {
-    id: u64,
+	id: u64,
 }
 
 #[derive(Debug, Deserialize)]
 struct UserResponse {
-    user: User,
+	user: User,
 }

registry/src/auth/mod.rs

@@ -6,12 +6,12 @@ mod token;
 use crate::{benv, make_reqwest, AppState};
 use actix_governor::{KeyExtractor, SimpleKeyExtractionError};
 use actix_web::{
-    body::MessageBody,
+	body::MessageBody,
-    dev::{ServiceRequest, ServiceResponse},
+	dev::{ServiceRequest, ServiceResponse},
-    error::Error as ActixError,
+	error::Error as ActixError,
-    http::header::AUTHORIZATION,
+	http::header::AUTHORIZATION,
-    middleware::Next,
+	middleware::Next,
-    web, HttpMessage, HttpResponse,
+	web, HttpMessage, HttpResponse,
 };
 use pesde::source::pesde::IndexConfig;
 use sentry::add_breadcrumb;
@@ -22,178 +22,178 @@ use std::fmt::Display;
 pub struct UserId(pub u64);
 
 impl UserId {
-    // there isn't any account on GitHub that has the ID 0, so it should be safe to use it
+	// there isn't any account on GitHub that has the ID 0, so it should be safe to use it
-    pub const DEFAULT: UserId = UserId(0);
+	pub const DEFAULT: UserId = UserId(0);
 }
 
 #[derive(Debug, Clone)]
 pub struct UserIdExtractor;
 
 impl KeyExtractor for UserIdExtractor {
-    type Key = UserId;
+	type Key = UserId;
-    type KeyExtractionError = SimpleKeyExtractionError<&'static str>;
+	type KeyExtractionError = SimpleKeyExtractionError<&'static str>;
 
-    fn extract(&self, req: &ServiceRequest) -> Result<Self::Key, Self::KeyExtractionError> {
+	fn extract(&self, req: &ServiceRequest) -> Result<Self::Key, Self::KeyExtractionError> {
-        match req.extensions().get::<UserId>() {
+		match req.extensions().get::<UserId>() {
-            Some(user_id) => Ok(*user_id),
+			Some(user_id) => Ok(*user_id),
-            None => Err(SimpleKeyExtractionError::new("UserId not found")),
+			None => Err(SimpleKeyExtractionError::new("UserId not found")),
-        }
+		}
-    }
+	}
 }
 
 #[derive(Debug)]
 pub enum Auth {
-    GitHub(github::GitHubAuth),
+	GitHub(github::GitHubAuth),
-    None(none::NoneAuth),
+	None(none::NoneAuth),
-    Token(token::TokenAuth),
+	Token(token::TokenAuth),
-    RwToken(rw_token::RwTokenAuth),
+	RwToken(rw_token::RwTokenAuth),
 }
 
 pub trait AuthImpl: Display {
-    async fn for_write_request(&self, req: &ServiceRequest) -> Result<Option<UserId>, ActixError>;
+	async fn for_write_request(&self, req: &ServiceRequest) -> Result<Option<UserId>, ActixError>;
 
-    async fn for_read_request(&self, req: &ServiceRequest) -> Result<Option<UserId>, ActixError> {
+	async fn for_read_request(&self, req: &ServiceRequest) -> Result<Option<UserId>, ActixError> {
-        self.for_write_request(req).await
+		self.for_write_request(req).await
-    }
+	}
 
-    fn read_needs_auth(&self) -> bool {
+	fn read_needs_auth(&self) -> bool {
-        benv!("READ_NEEDS_AUTH").is_ok()
+		benv!("READ_NEEDS_AUTH").is_ok()
-    }
+	}
 }
 
 impl AuthImpl for Auth {
-    async fn for_write_request(&self, req: &ServiceRequest) -> Result<Option<UserId>, ActixError> {
+	async fn for_write_request(&self, req: &ServiceRequest) -> Result<Option<UserId>, ActixError> {
-        match self {
+		match self {
-            Auth::GitHub(github) => github.for_write_request(req).await,
+			Auth::GitHub(github) => github.for_write_request(req).await,
-            Auth::None(none) => none.for_write_request(req).await,
+			Auth::None(none) => none.for_write_request(req).await,
-            Auth::Token(token) => token.for_write_request(req).await,
+			Auth::Token(token) => token.for_write_request(req).await,
-            Auth::RwToken(rw_token) => rw_token.for_write_request(req).await,
+			Auth::RwToken(rw_token) => rw_token.for_write_request(req).await,
-        }
+		}
-    }
+	}
 
-    async fn for_read_request(&self, req: &ServiceRequest) -> Result<Option<UserId>, ActixError> {
+	async fn for_read_request(&self, req: &ServiceRequest) -> Result<Option<UserId>, ActixError> {
-        match self {
+		match self {
-            Auth::GitHub(github) => github.for_read_request(req).await,
+			Auth::GitHub(github) => github.for_read_request(req).await,
-            Auth::None(none) => none.for_write_request(req).await,
+			Auth::None(none) => none.for_write_request(req).await,
-            Auth::Token(token) => token.for_write_request(req).await,
+			Auth::Token(token) => token.for_write_request(req).await,
-            Auth::RwToken(rw_token) => rw_token.for_read_request(req).await,
+			Auth::RwToken(rw_token) => rw_token.for_read_request(req).await,
-        }
+		}
-    }
+	}
 
-    fn read_needs_auth(&self) -> bool {
+	fn read_needs_auth(&self) -> bool {
-        match self {
+		match self {
-            Auth::GitHub(github) => github.read_needs_auth(),
+			Auth::GitHub(github) => github.read_needs_auth(),
-            Auth::None(none) => none.read_needs_auth(),
+			Auth::None(none) => none.read_needs_auth(),
-            Auth::Token(token) => token.read_needs_auth(),
+			Auth::Token(token) => token.read_needs_auth(),
-            Auth::RwToken(rw_token) => rw_token.read_needs_auth(),
+			Auth::RwToken(rw_token) => rw_token.read_needs_auth(),
-        }
+		}
-    }
+	}
 }
 
 impl Display for Auth {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+	fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
+		match self {
-            Auth::GitHub(github) => write!(f, "{}", github),
+			Auth::GitHub(github) => write!(f, "{}", github),
-            Auth::None(none) => write!(f, "{}", none),
+			Auth::None(none) => write!(f, "{}", none),
-            Auth::Token(token) => write!(f, "{}", token),
+			Auth::Token(token) => write!(f, "{}", token),
-            Auth::RwToken(rw_token) => write!(f, "{}", rw_token),
+			Auth::RwToken(rw_token) => write!(f, "{}", rw_token),
-        }
+		}
-    }
+	}
 }
 
 pub async fn write_mw(
-    app_state: web::Data<AppState>,
+	app_state: web::Data<AppState>,
-    req: ServiceRequest,
+	req: ServiceRequest,
-    next: Next<impl MessageBody + 'static>,
+	next: Next<impl MessageBody + 'static>,
 ) -> Result<ServiceResponse<impl MessageBody>, ActixError> {
-    let user_id = match app_state.auth.for_write_request(&req).await? {
+	let user_id = match app_state.auth.for_write_request(&req).await? {
-        Some(user_id) => user_id,
+		Some(user_id) => user_id,
-        None => {
+		None => {
-            return Ok(req
+			return Ok(req
-                .into_response(HttpResponse::Unauthorized().finish())
+				.into_response(HttpResponse::Unauthorized().finish())
-                .map_into_right_body())
+				.map_into_right_body())
-        }
+		}
-    };
+	};
 
-    add_breadcrumb(sentry::Breadcrumb {
+	add_breadcrumb(sentry::Breadcrumb {
-        category: Some("auth".into()),
+		category: Some("auth".into()),
-        message: Some(format!("write request authorized as {}", user_id.0)),
+		message: Some(format!("write request authorized as {}", user_id.0)),
-        level: sentry::Level::Info,
+		level: sentry::Level::Info,
-        ..Default::default()
+		..Default::default()
-    });
+	});
 
-    req.extensions_mut().insert(user_id);
+	req.extensions_mut().insert(user_id);
 
-    next.call(req).await.map(|res| res.map_into_left_body())
+	next.call(req).await.map(|res| res.map_into_left_body())
 }
 
 pub async fn read_mw(
-    app_state: web::Data<AppState>,
+	app_state: web::Data<AppState>,
-    req: ServiceRequest,
+	req: ServiceRequest,
-    next: Next<impl MessageBody + 'static>,
+	next: Next<impl MessageBody + 'static>,
 ) -> Result<ServiceResponse<impl MessageBody>, ActixError> {
-    if app_state.auth.read_needs_auth() {
+	if app_state.auth.read_needs_auth() {
-        let user_id = match app_state.auth.for_read_request(&req).await? {
+		let user_id = match app_state.auth.for_read_request(&req).await? {
-            Some(user_id) => user_id,
+			Some(user_id) => user_id,
-            None => {
+			None => {
-                return Ok(req
+				return Ok(req
-                    .into_response(HttpResponse::Unauthorized().finish())
+					.into_response(HttpResponse::Unauthorized().finish())
-                    .map_into_right_body())
+					.map_into_right_body())
-            }
+			}
-        };
+		};
 
-        add_breadcrumb(sentry::Breadcrumb {
+		add_breadcrumb(sentry::Breadcrumb {
-            category: Some("auth".into()),
+			category: Some("auth".into()),
-            message: Some(format!("read request authorized as {}", user_id.0)),
+			message: Some(format!("read request authorized as {}", user_id.0)),
-            level: sentry::Level::Info,
+			level: sentry::Level::Info,
-            ..Default::default()
+			..Default::default()
-        });
+		});
 
-        req.extensions_mut().insert(Some(user_id));
+		req.extensions_mut().insert(Some(user_id));
-    } else {
+	} else {
-        req.extensions_mut().insert(None::<UserId>);
+		req.extensions_mut().insert(None::<UserId>);
-    }
+	}
 
-    next.call(req).await.map(|res| res.map_into_left_body())
+	next.call(req).await.map(|res| res.map_into_left_body())
 }
 
 pub fn get_auth_from_env(config: &IndexConfig) -> Auth {
-    if let Ok(token) = benv!("ACCESS_TOKEN") {
+	if let Ok(token) = benv!("ACCESS_TOKEN") {
-        Auth::Token(token::TokenAuth {
+		Auth::Token(token::TokenAuth {
-            token: *Sha256::digest(token.as_bytes()).as_ref(),
+			token: *Sha256::digest(token.as_bytes()).as_ref(),
-        })
+		})
-    } else if let Ok(client_secret) = benv!("GITHUB_CLIENT_SECRET") {
+	} else if let Ok(client_secret) = benv!("GITHUB_CLIENT_SECRET") {
-        Auth::GitHub(github::GitHubAuth {
+		Auth::GitHub(github::GitHubAuth {
-            reqwest_client: make_reqwest(),
+			reqwest_client: make_reqwest(),
-            client_id: config
+			client_id: config
-                .github_oauth_client_id
+				.github_oauth_client_id
-                .clone()
+				.clone()
-                .expect("index isn't configured for GitHub"),
+				.expect("index isn't configured for GitHub"),
-            client_secret,
+			client_secret,
-        })
+		})
-    } else if let Ok((r, w)) =
+	} else if let Ok((r, w)) =
-        benv!("READ_ACCESS_TOKEN").and_then(|r| benv!("WRITE_ACCESS_TOKEN").map(|w| (r, w)))
+		benv!("READ_ACCESS_TOKEN").and_then(|r| benv!("WRITE_ACCESS_TOKEN").map(|w| (r, w)))
-    {
+	{
-        Auth::RwToken(rw_token::RwTokenAuth {
+		Auth::RwToken(rw_token::RwTokenAuth {
-            read_token: *Sha256::digest(r.as_bytes()).as_ref(),
+			read_token: *Sha256::digest(r.as_bytes()).as_ref(),
-            write_token: *Sha256::digest(w.as_bytes()).as_ref(),
+			write_token: *Sha256::digest(w.as_bytes()).as_ref(),
-        })
+		})
-    } else {
+	} else {
-        Auth::None(none::NoneAuth)
+		Auth::None(none::NoneAuth)
-    }
+	}
 }
 
 pub fn get_token_from_req(req: &ServiceRequest) -> Option<String> {
-    let token = req
+	let token = req
-        .headers()
+		.headers()
-        .get(AUTHORIZATION)
+		.get(AUTHORIZATION)
-        .and_then(|token| token.to_str().ok())?;
+		.and_then(|token| token.to_str().ok())?;
 
-    let token = if token.to_lowercase().starts_with("bearer ") {
+	let token = if token.to_lowercase().starts_with("bearer ") {
-        token[7..].to_string()
+		token[7..].to_string()
-    } else {
+	} else {
-        token.to_string()
+		token.to_string()
-    };
+	};
 
-    Some(token)
+	Some(token)
 }

registry/src/auth/none.rs

@@ -6,13 +6,13 @@ use std::fmt::Display;
 pub struct NoneAuth;
 
 impl AuthImpl for NoneAuth {
-    async fn for_write_request(&self, _req: &ServiceRequest) -> Result<Option<UserId>, ActixError> {
+	async fn for_write_request(&self, _req: &ServiceRequest) -> Result<Option<UserId>, ActixError> {
-        Ok(Some(UserId::DEFAULT))
+		Ok(Some(UserId::DEFAULT))
-    }
+	}
 }
 
 impl Display for NoneAuth {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+	fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(f, "None")
+		write!(f, "None")
-    }
+	}
 }

registry/src/auth/rw_token.rs

@@ -6,48 +6,48 @@ use std::fmt::Display;
 
 #[derive(Debug)]
 pub struct RwTokenAuth {
-    pub read_token: [u8; 32],
+	pub read_token: [u8; 32],
-    pub write_token: [u8; 32],
+	pub write_token: [u8; 32],
 }
 
 impl AuthImpl for RwTokenAuth {
-    async fn for_write_request(&self, req: &ServiceRequest) -> Result<Option<UserId>, ActixError> {
+	async fn for_write_request(&self, req: &ServiceRequest) -> Result<Option<UserId>, ActixError> {
-        let token = match get_token_from_req(req) {
+		let token = match get_token_from_req(req) {
-            Some(token) => token,
+			Some(token) => token,
-            None => return Ok(None),
+			None => return Ok(None),
-        };
+		};
 
-        let token: [u8; 32] = Sha256::digest(token.as_bytes()).into();
+		let token: [u8; 32] = Sha256::digest(token.as_bytes()).into();
 
-        Ok(if constant_time_eq_32(&self.write_token, &token) {
+		Ok(if constant_time_eq_32(&self.write_token, &token) {
-            Some(UserId::DEFAULT)
+			Some(UserId::DEFAULT)
-        } else {
+		} else {
-            None
+			None
-        })
+		})
-    }
+	}
 
-    async fn for_read_request(&self, req: &ServiceRequest) -> Result<Option<UserId>, ActixError> {
+	async fn for_read_request(&self, req: &ServiceRequest) -> Result<Option<UserId>, ActixError> {
-        let token = match get_token_from_req(req) {
+		let token = match get_token_from_req(req) {
-            Some(token) => token,
+			Some(token) => token,
-            None => return Ok(None),
+			None => return Ok(None),
-        };
+		};
 
-        let token: [u8; 32] = Sha256::digest(token.as_bytes()).into();
+		let token: [u8; 32] = Sha256::digest(token.as_bytes()).into();
 
-        Ok(if constant_time_eq_32(&self.read_token, &token) {
+		Ok(if constant_time_eq_32(&self.read_token, &token) {
-            Some(UserId::DEFAULT)
+			Some(UserId::DEFAULT)
-        } else {
+		} else {
-            None
+			None
-        })
+		})
-    }
+	}
 
-    fn read_needs_auth(&self) -> bool {
+	fn read_needs_auth(&self) -> bool {
-        true
+		true
-    }
+	}
 }
 
 impl Display for RwTokenAuth {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+	fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(f, "RwToken")
+		write!(f, "RwToken")
-    }
+	}
 }

registry/src/auth/token.rs

@@ -6,29 +6,29 @@ use std::fmt::Display;
 
 #[derive(Debug)]
 pub struct TokenAuth {
-    // needs to be an SHA-256 hash
+	// needs to be an SHA-256 hash
-    pub token: [u8; 32],
+	pub token: [u8; 32],
 }
 
 impl AuthImpl for TokenAuth {
-    async fn for_write_request(&self, req: &ServiceRequest) -> Result<Option<UserId>, ActixError> {
+	async fn for_write_request(&self, req: &ServiceRequest) -> Result<Option<UserId>, ActixError> {
-        let token = match get_token_from_req(req) {
+		let token = match get_token_from_req(req) {
-            Some(token) => token,
+			Some(token) => token,
-            None => return Ok(None),
+			None => return Ok(None),
-        };
+		};
 
-        let token: [u8; 32] = Sha256::digest(token.as_bytes()).into();
+		let token: [u8; 32] = Sha256::digest(token.as_bytes()).into();
 
-        Ok(if constant_time_eq_32(&self.token, &token) {
+		Ok(if constant_time_eq_32(&self.token, &token) {
-            Some(UserId::DEFAULT)
+			Some(UserId::DEFAULT)
-        } else {
+		} else {
-            None
+			None
-        })
+		})
-    }
+	}
 }
 
 impl Display for TokenAuth {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+	fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(f, "Token")
+		write!(f, "Token")
-    }
+	}
 }

registry/src/endpoints/deprecate_version.rs

@@ -0,0 +1,76 @@
+use crate::{
+	auth::UserId,
+	error::{ErrorResponse, RegistryError},
+	git::push_changes,
+	package::{read_package, read_scope_info},
+	search::search_version_changed,
+	AppState,
+};
+use actix_web::{http::Method, web, HttpRequest, HttpResponse};
+use pesde::names::PackageName;
+use std::collections::HashMap;
+
+pub async fn deprecate_package_version(
+	request: HttpRequest,
+	app_state: web::Data<AppState>,
+	path: web::Path<PackageName>,
+	bytes: web::Bytes,
+	user_id: web::ReqData<UserId>,
+) -> Result<HttpResponse, RegistryError> {
+	let deprecated = request.method() != Method::DELETE;
+	let reason = if deprecated {
+		match String::from_utf8(bytes.to_vec()).map(|s| s.trim().to_string()) {
+			Ok(reason) if !reason.is_empty() => reason,
+			Err(e) => {
+				return Ok(HttpResponse::BadRequest().json(ErrorResponse {
+					error: format!("invalid utf-8: {e}"),
+				}))
+			}
+			_ => {
+				return Ok(HttpResponse::BadRequest().json(ErrorResponse {
+					error: "deprecating must have a non-empty reason".to_string(),
+				}))
+			}
+		}
+	} else {
+		String::new()
+	};
+	let name = path.into_inner();
+	let source = app_state.source.write().await;
+
+	let Some(scope_info) = read_scope_info(&app_state, name.scope(), &source).await? else {
+		return Ok(HttpResponse::NotFound().finish());
+	};
+
+	if !scope_info.owners.contains(&user_id.0) {
+		return Ok(HttpResponse::Forbidden().finish());
+	}
+
+	let Some(mut file) = read_package(&app_state, &name, &source).await? else {
+		return Ok(HttpResponse::NotFound().finish());
+	};
+
+	if file.meta.deprecated == reason {
+		return Ok(HttpResponse::Conflict().finish());
+	}
+
+	file.meta.deprecated = reason;
+
+	let file_string = toml::to_string(&file)?;
+
+	push_changes(
+		&app_state,
+		&source,
+		name.scope().to_string(),
+		HashMap::from([(name.name().to_string(), file_string.into_bytes())]),
+		format!("{}deprecate {name}", if deprecated { "" } else { "un" }),
+	)
+	.await?;
+
+	search_version_changed(&app_state, &name, &file);
+
+	Ok(HttpResponse::Ok().body(format!(
+		"{}deprecated {name}",
+		if deprecated { "" } else { "un" },
+	)))
+}

registry/src/endpoints/mod.rs

@@ -1,4 +1,9 @@
+pub mod deprecate_version;
+pub mod package_archive;
+pub mod package_doc;
+pub mod package_readme;
 pub mod package_version;
 pub mod package_versions;
 pub mod publish_version;
 pub mod search;
+pub mod yank_version;

registry/src/endpoints/package_archive.rs

@@ -0,0 +1,27 @@
+use actix_web::{web, HttpResponse};
+
+use crate::{
+	error::RegistryError,
+	package::read_package,
+	request_path::{resolve_version_and_target, AnyOrSpecificTarget, LatestOrSpecificVersion},
+	storage::StorageImpl,
+	AppState,
+};
+use pesde::names::PackageName;
+
+pub async fn get_package_archive(
+	app_state: web::Data<AppState>,
+	path: web::Path<(PackageName, LatestOrSpecificVersion, AnyOrSpecificTarget)>,
+) -> Result<HttpResponse, RegistryError> {
+	let (name, version, target) = path.into_inner();
+
+	let Some(file) = read_package(&app_state, &name, &*app_state.source.read().await).await? else {
+		return Ok(HttpResponse::NotFound().finish());
+	};
+
+	let Some(v_id) = resolve_version_and_target(&file, version, target) else {
+		return Ok(HttpResponse::NotFound().finish());
+	};
+
+	app_state.storage.get_package(&name, v_id).await
+}

registry/src/endpoints/package_doc.rs

@@ -0,0 +1,66 @@
+use crate::{
+	error::RegistryError,
+	package::read_package,
+	request_path::{resolve_version_and_target, AnyOrSpecificTarget, LatestOrSpecificVersion},
+	storage::StorageImpl,
+	AppState,
+};
+use actix_web::{web, HttpResponse};
+use pesde::{
+	names::PackageName,
+	source::{
+		ids::VersionId,
+		pesde::{DocEntryKind, IndexFile},
+	},
+};
+use serde::Deserialize;
+
+pub fn find_package_doc<'a>(
+	file: &'a IndexFile,
+	v_id: &VersionId,
+	doc_name: &str,
+) -> Option<&'a str> {
+	let mut queue = file.entries[v_id]
+		.docs
+		.iter()
+		.map(|doc| &doc.kind)
+		.collect::<Vec<_>>();
+	while let Some(doc) = queue.pop() {
+		match doc {
+			DocEntryKind::Page { name, hash } if name == doc_name => return Some(hash.as_str()),
+			DocEntryKind::Category { items, .. } => {
+				queue.extend(items.iter().map(|item| &item.kind))
+			}
+			_ => continue,
+		};
+	}
+
+	None
+}
+
+#[derive(Debug, Deserialize)]
+pub struct Query {
+	doc: String,
+}
+
+pub async fn get_package_doc(
+	app_state: web::Data<AppState>,
+	path: web::Path<(PackageName, LatestOrSpecificVersion, AnyOrSpecificTarget)>,
+	request_query: web::Query<Query>,
+) -> Result<HttpResponse, RegistryError> {
+	let (name, version, target) = path.into_inner();
+
+	let Some(file) = read_package(&app_state, &name, &*app_state.source.read().await).await? else {
+		return Ok(HttpResponse::NotFound().finish());
+	};
+
+	let Some(v_id) = resolve_version_and_target(&file, version, target) else {
+		return Ok(HttpResponse::NotFound().finish());
+	};
+
+	let Some(hash) = find_package_doc(&file, v_id, &request_query.doc) else {
+		return Ok(HttpResponse::NotFound().finish());
+	};
+
+	app_state.storage.get_doc(hash).await
+}

registry/src/endpoints/package_readme.rs

@@ -0,0 +1,27 @@
+use actix_web::{web, HttpResponse};
+
+use crate::{
+	error::RegistryError,
+	package::read_package,
+	request_path::{resolve_version_and_target, AnyOrSpecificTarget, LatestOrSpecificVersion},
+	storage::StorageImpl,
+	AppState,
+};
+use pesde::names::PackageName;
+
+pub async fn get_package_readme(
+	app_state: web::Data<AppState>,
+	path: web::Path<(PackageName, LatestOrSpecificVersion, AnyOrSpecificTarget)>,
+) -> Result<HttpResponse, RegistryError> {
+	let (name, version, target) = path.into_inner();
+
+	let Some(file) = read_package(&app_state, &name, &*app_state.source.read().await).await? else {
+		return Ok(HttpResponse::NotFound().finish());
+	};
+
+	let Some(v_id) = resolve_version_and_target(&file, version, target) else {
+		return Ok(HttpResponse::NotFound().finish());
+	};
+
+	app_state.storage.get_readme(&name, v_id).await
+}

registry/src/endpoints/package_version.rs

@@ -1,171 +1,79 @@
-use actix_web::{http::header::ACCEPT, web, HttpRequest, HttpResponse, Responder};
+use actix_web::{http::header::ACCEPT, web, HttpRequest, HttpResponse};
-use semver::Version;
+use serde::Deserialize;
-use serde::{Deserialize, Deserializer};
 
-use crate::{error::Error, package::PackageResponse, storage::StorageImpl, AppState};
+use crate::{
-use pesde::{
+	endpoints::package_doc::find_package_doc,
-    manifest::target::TargetKind,
+	error::RegistryError,
-    names::PackageName,
+	package::{read_package, PackageResponse},
-    source::{
+	request_path::{resolve_version_and_target, AnyOrSpecificTarget, LatestOrSpecificVersion},
-        git_index::{read_file, root_tree, GitBasedSource},
+	storage::StorageImpl,
-        pesde::{DocEntryKind, IndexFile},
+	AppState,
-    },
 };
-
+use pesde::names::PackageName;
-#[derive(Debug)]
-pub enum VersionRequest {
-    Latest,
-    Specific(Version),
-}
-
-impl<'de> Deserialize<'de> for VersionRequest {
-    fn deserialize<D>(deserializer: D) -> Result<VersionRequest, D::Error>
-    where
-        D: Deserializer<'de>,
-    {
-        let s = String::deserialize(deserializer)?;
-        if s.eq_ignore_ascii_case("latest") {
-            return Ok(VersionRequest::Latest);
-        }
-
-        s.parse()
-            .map(VersionRequest::Specific)
-            .map_err(serde::de::Error::custom)
-    }
-}
-
-#[derive(Debug)]
-pub enum TargetRequest {
-    Any,
-    Specific(TargetKind),
-}
-
-impl<'de> Deserialize<'de> for TargetRequest {
-    fn deserialize<D>(deserializer: D) -> Result<TargetRequest, D::Error>
-    where
-        D: Deserializer<'de>,
-    {
-        let s = String::deserialize(deserializer)?;
-        if s.eq_ignore_ascii_case("any") {
-            return Ok(TargetRequest::Any);
-        }
-
-        s.parse()
-            .map(TargetRequest::Specific)
-            .map_err(serde::de::Error::custom)
-    }
-}
 
 #[derive(Debug, Deserialize)]
 pub struct Query {
-    doc: Option<String>,
+	doc: Option<String>,
+}
+
+pub async fn get_package_version_v0(
+	request: HttpRequest,
+	app_state: web::Data<AppState>,
+	path: web::Path<(PackageName, LatestOrSpecificVersion, AnyOrSpecificTarget)>,
+	request_query: web::Query<Query>,
+) -> Result<HttpResponse, RegistryError> {
+	let (name, version, target) = path.into_inner();
+
+	let Some(file) = read_package(&app_state, &name, &*app_state.source.read().await).await? else {
+		return Ok(HttpResponse::NotFound().finish());
+	};
+
+	let Some(v_id) = resolve_version_and_target(&file, version, target) else {
+		return Ok(HttpResponse::NotFound().finish());
+	};
+
+	if let Some(doc_name) = request_query.doc.as_deref() {
+		let Some(hash) = find_package_doc(&file, v_id, doc_name) else {
+			return Ok(HttpResponse::NotFound().finish());
+		};
+
+		return app_state.storage.get_doc(hash).await;
+	}
+
+	let accept = request
+		.headers()
+		.get(ACCEPT)
+		.and_then(|accept| accept.to_str().ok())
+		.and_then(|accept| match accept.to_lowercase().as_str() {
+			"text/plain" => Some(true),
+			"application/octet-stream" => Some(false),
+			_ => None,
+		});
+
+	if let Some(readme) = accept {
+		return if readme {
+			app_state.storage.get_readme(&name, v_id).await
+		} else {
+			app_state.storage.get_package(&name, v_id).await
+		};
+	}
+
+	Ok(HttpResponse::Ok().json(PackageResponse::new(&name, v_id, &file)))
 }
 
 pub async fn get_package_version(
-    request: HttpRequest,
+	app_state: web::Data<AppState>,
-    app_state: web::Data<AppState>,
+	path: web::Path<(PackageName, LatestOrSpecificVersion, AnyOrSpecificTarget)>,
-    path: web::Path<(PackageName, VersionRequest, TargetRequest)>,
+) -> Result<HttpResponse, RegistryError> {
-    query: web::Query<Query>,
+	let (name, version, target) = path.into_inner();
-) -> Result<impl Responder, Error> {
-    let (name, version, target) = path.into_inner();
 
-    let (scope, name_part) = name.as_str();
+	let Some(file) = read_package(&app_state, &name, &*app_state.source.read().await).await? else {
+		return Ok(HttpResponse::NotFound().finish());
+	};
 
-    let file: IndexFile = {
+	let Some(v_id) = resolve_version_and_target(&file, version, target) else {
-        let source = app_state.source.lock().await;
+		return Ok(HttpResponse::NotFound().finish());
-        let repo = gix::open(source.path(&app_state.project))?;
+	};
-        let tree = root_tree(&repo)?;
 
-        match read_file(&tree, [scope, name_part])? {
+	Ok(HttpResponse::Ok().json(PackageResponse::new(&name, v_id, &file)))
-            Some(versions) => toml::de::from_str(&versions)?,
-            None => return Ok(HttpResponse::NotFound().finish()),
-        }
-    };
-
-    let Some((v_id, entry, targets)) = ({
-        let version = match version {
-            VersionRequest::Latest => match file.entries.keys().map(|k| k.version()).max() {
-                Some(latest) => latest.clone(),
-                None => return Ok(HttpResponse::NotFound().finish()),
-            },
-            VersionRequest::Specific(version) => version,
-        };
-
-        let versions = file
-            .entries
-            .iter()
-            .filter(|(v_id, _)| *v_id.version() == version);
-
-        match target {
-            TargetRequest::Any => versions.clone().min_by_key(|(v_id, _)| *v_id.target()),
-            TargetRequest::Specific(kind) => versions
-                .clone()
-                .find(|(_, entry)| entry.target.kind() == kind),
-        }
-        .map(|(v_id, entry)| {
-            (
-                v_id,
-                entry,
-                versions.map(|(_, entry)| (&entry.target).into()).collect(),
-            )
-        })
-    }) else {
-        return Ok(HttpResponse::NotFound().finish());
-    };
-
-    if let Some(doc_name) = query.doc.as_deref() {
-        let hash = 'finder: {
-            let mut hash = entry.docs.iter().map(|doc| &doc.kind).collect::<Vec<_>>();
-            while let Some(doc) = hash.pop() {
-                match doc {
-                    DocEntryKind::Page { name, hash } if name == doc_name => {
-                        break 'finder hash.clone()
-                    }
-                    DocEntryKind::Category { items, .. } => {
-                        hash.extend(items.iter().map(|item| &item.kind))
-                    }
-                    _ => continue,
-                };
-            }
-
-            return Ok(HttpResponse::NotFound().finish());
-        };
-
-        return app_state.storage.get_doc(&hash).await;
-    }
-
-    let accept = request
-        .headers()
-        .get(ACCEPT)
-        .and_then(|accept| accept.to_str().ok())
-        .and_then(|accept| match accept.to_lowercase().as_str() {
-            "text/plain" => Some(true),
-            "application/octet-stream" => Some(false),
-            _ => None,
-        });
-
-    if let Some(readme) = accept {
-        return if readme {
-            app_state.storage.get_readme(&name, v_id).await
-        } else {
-            app_state.storage.get_package(&name, v_id).await
-        };
-    }
-
-    let response = PackageResponse {
-        name: name.to_string(),
-        version: v_id.version().to_string(),
-        targets,
-        description: entry.description.clone().unwrap_or_default(),
-        published_at: entry.published_at,
-        license: entry.license.clone().unwrap_or_default(),
-        authors: entry.authors.clone(),
-        repository: entry.repository.clone().map(|url| url.to_string()),
-    };
-
-    let mut value = serde_json::to_value(response)?;
-    value["docs"] = serde_json::to_value(entry.docs.clone())?;
-    value["dependencies"] = serde_json::to_value(entry.dependencies.clone())?;
-
-    Ok(HttpResponse::Ok().json(value))
 }

registry/src/endpoints/package_versions.rs

@@ -1,54 +1,55 @@
-use std::collections::{BTreeMap, BTreeSet};
+use crate::{
-
+	error::RegistryError,
-use actix_web::{web, HttpResponse, Responder};
+	package::{read_package, PackageResponse, PackageVersionsResponse},
-
+	AppState,
-use crate::{error::Error, package::PackageResponse, AppState};
-use pesde::{
-    names::PackageName,
-    source::{
-        git_index::{read_file, root_tree, GitBasedSource},
-        pesde::IndexFile,
-    },
 };
+use actix_web::{web, HttpResponse, Responder};
+use pesde::{names::PackageName, source::ids::VersionId};
+use semver::Version;
+use std::collections::{btree_map::Entry, BTreeMap};
+
+pub async fn get_package_versions_v0(
+	app_state: web::Data<AppState>,
+	path: web::Path<PackageName>,
+) -> Result<impl Responder, RegistryError> {
+	let name = path.into_inner();
+
+	let Some(file) = read_package(&app_state, &name, &*app_state.source.read().await).await? else {
+		return Ok(HttpResponse::NotFound().finish());
+	};
+
+	let mut versions = BTreeMap::<&Version, &VersionId>::new();
+
+	for v_id in file.entries.keys() {
+		match versions.entry(v_id.version()) {
+			Entry::Vacant(entry) => {
+				entry.insert(v_id);
+			}
+			Entry::Occupied(mut entry) => {
+				if entry.get() < &v_id {
+					entry.insert(v_id);
+				}
+			}
+		}
+	}
+
+	let responses = versions
+		.into_values()
+		.map(|v_id| PackageResponse::new(&name, v_id, &file))
+		.collect::<Vec<_>>();
+
+	Ok(HttpResponse::Ok().json(responses))
+}
 
 pub async fn get_package_versions(
-    app_state: web::Data<AppState>,
+	app_state: web::Data<AppState>,
-    path: web::Path<PackageName>,
+	path: web::Path<PackageName>,
-) -> Result<impl Responder, Error> {
+) -> Result<impl Responder, RegistryError> {
-    let name = path.into_inner();
+	let name = path.into_inner();
 
-    let (scope, name_part) = name.as_str();
+	let Some(file) = read_package(&app_state, &name, &*app_state.source.read().await).await? else {
+		return Ok(HttpResponse::NotFound().finish());
+	};
 
-    let file: IndexFile = {
+	Ok(HttpResponse::Ok().json(PackageVersionsResponse::new(&name, &file)))
-        let source = app_state.source.lock().await;
-        let repo = gix::open(source.path(&app_state.project))?;
-        let tree = root_tree(&repo)?;
-
-        match read_file(&tree, [scope, name_part])? {
-            Some(versions) => toml::de::from_str(&versions)?,
-            None => return Ok(HttpResponse::NotFound().finish()),
-        }
-    };
-
-    let mut responses = BTreeMap::new();
-
-    for (v_id, entry) in file.entries {
-        let info = responses
-            .entry(v_id.version().clone())
-            .or_insert_with(|| PackageResponse {
-                name: name.to_string(),
-                version: v_id.version().to_string(),
-                targets: BTreeSet::new(),
-                description: entry.description.unwrap_or_default(),
-                published_at: entry.published_at,
-                license: entry.license.unwrap_or_default(),
-                authors: entry.authors.clone(),
-                repository: entry.repository.clone().map(|url| url.to_string()),
-            });
-
-        info.targets.insert(entry.target.into());
-        info.published_at = info.published_at.max(entry.published_at);
-    }
-
-    Ok(HttpResponse::Ok().json(responses.into_values().collect::<Vec<_>>()))
 }

registry/src/endpoints/publish_version.rs

@@ -1,507 +1,465 @@
 use crate::{
-    auth::UserId,
+	auth::UserId,
-    benv,
+	error::{ErrorResponse, RegistryError},
-    error::{Error, ErrorResponse},
+	git::push_changes,
-    search::update_version,
+	package::{read_package, read_scope_info},
-    storage::StorageImpl,
+	search::update_search_version,
-    AppState,
+	storage::StorageImpl,
+	AppState,
 };
-use actix_web::{web, web::Bytes, HttpResponse, Responder};
+use actix_web::{web, web::Bytes, HttpResponse};
 use async_compression::Level;
 use convert_case::{Case, Casing};
 use fs_err::tokio as fs;
-use futures::{future::join_all, join};
-use git2::{Remote, Repository, Signature};
 use pesde::{
-    manifest::Manifest,
+	manifest::{DependencyType, Manifest},
-    source::{
+	source::{
-        git_index::{read_file, root_tree, GitBasedSource},
+		git_index::GitBasedSource,
-        pesde::{DocEntry, DocEntryKind, IndexFile, IndexFileEntry, ScopeInfo, SCOPE_INFO_FILE},
+		ids::VersionId,
-        specifiers::DependencySpecifiers,
+		pesde::{DocEntry, DocEntryKind, IndexFileEntry, ScopeInfo, SCOPE_INFO_FILE},
-        version_id::VersionId,
+		specifiers::DependencySpecifiers,
-        IGNORED_DIRS, IGNORED_FILES,
+		traits::RefreshOptions,
-    },
+		ADDITIONAL_FORBIDDEN_FILES, IGNORED_DIRS, IGNORED_FILES,
-    MANIFEST_FILE_NAME,
+	},
+	MANIFEST_FILE_NAME,
 };
 use sentry::add_breadcrumb;
 use serde::Deserialize;
 use sha2::{Digest, Sha256};
 use std::{
-    collections::{BTreeSet, HashMap},
+	collections::{BTreeSet, HashMap},
-    io::{Cursor, Write},
+	io::Cursor,
+};
+use tokio::{
+	io::{AsyncReadExt, AsyncWriteExt},
+	task::JoinSet,
 };
-use tokio::io::{AsyncReadExt, AsyncWriteExt};
-
-fn signature<'a>() -> Signature<'a> {
-    Signature::now(
-        &benv!(required "COMMITTER_GIT_NAME"),
-        &benv!(required "COMMITTER_GIT_EMAIL"),
-    )
-    .unwrap()
-}
-
-fn get_refspec(repo: &Repository, remote: &mut Remote) -> Result<String, git2::Error> {
-    let upstream_branch_buf = repo.branch_upstream_name(repo.head()?.name().unwrap())?;
-    let upstream_branch = upstream_branch_buf.as_str().unwrap();
-
-    let refspec_buf = remote
-        .refspecs()
-        .find(|r| r.direction() == git2::Direction::Fetch && r.dst_matches(upstream_branch))
-        .unwrap()
-        .rtransform(upstream_branch)?;
-    let refspec = refspec_buf.as_str().unwrap();
-
-    Ok(refspec.to_string())
-}
-
-const ADDITIONAL_FORBIDDEN_FILES: &[&str] = &["default.project.json"];
 
 #[derive(Debug, Deserialize, Default)]
 struct DocEntryInfo {
-    #[serde(default)]
+	#[serde(default)]
-    label: Option<String>,
+	label: Option<String>,
-    #[serde(default, alias = "position")]
+	#[serde(default, alias = "position")]
-    sidebar_position: Option<usize>,
+	sidebar_position: Option<usize>,
-    #[serde(default)]
+	#[serde(default)]
-    collapsed: bool,
+	collapsed: bool,
 }
 
 pub async fn publish_package(
-    app_state: web::Data<AppState>,
+	app_state: web::Data<AppState>,
-    bytes: Bytes,
+	bytes: Bytes,
-    user_id: web::ReqData<UserId>,
+	user_id: web::ReqData<UserId>,
-) -> Result<impl Responder, Error> {
+) -> Result<HttpResponse, RegistryError> {
-    let source = app_state.source.lock().await;
+	let source = app_state.source.write().await;
-    source.refresh(&app_state.project).await.map_err(Box::new)?;
+	source
-    let config = source.config(&app_state.project).await?;
+		.refresh(&RefreshOptions {
+			project: app_state.project.clone(),
+		})
+		.await
+		.map_err(Box::new)?;
+	let config = source.config(&app_state.project).await?;
 
-    let package_dir = tempfile::tempdir()?;
+	let package_dir = tempfile::tempdir()?;
 
-    {
+	{
-        let mut decoder = async_compression::tokio::bufread::GzipDecoder::new(Cursor::new(&bytes));
+		let mut decoder = async_compression::tokio::bufread::GzipDecoder::new(Cursor::new(&bytes));
-        let mut archive = tokio_tar::Archive::new(&mut decoder);
+		let mut archive = tokio_tar::Archive::new(&mut decoder);
 
-        archive.unpack(package_dir.path()).await?;
+		archive.unpack(package_dir.path()).await?;
-    }
+	}
 
-    let mut manifest = None::<Manifest>;
+	let mut manifest = None::<Manifest>;
-    let mut readme = None::<Vec<u8>>;
+	let mut readme = None::<Vec<u8>>;
-    let mut docs = BTreeSet::new();
+	let mut docs = BTreeSet::new();
-    let mut docs_pages = HashMap::new();
+	let mut docs_pages = HashMap::new();
 
-    let mut read_dir = fs::read_dir(package_dir.path()).await?;
+	let mut read_dir = fs::read_dir(package_dir.path()).await?;
-    while let Some(entry) = read_dir.next_entry().await? {
+	while let Some(entry) = read_dir.next_entry().await? {
-        let file_name = entry
+		let file_name = entry
-            .file_name()
+			.file_name()
-            .to_str()
+			.to_str()
-            .ok_or_else(|| Error::InvalidArchive("file name contains non UTF-8 characters".into()))?
+			.ok_or_else(|| {
-            .to_string();
+				RegistryError::InvalidArchive("file name contains non UTF-8 characters".into())
+			})?
+			.to_string();
 
-        if entry.file_type().await?.is_dir() {
+		if entry.file_type().await?.is_dir() {
-            if IGNORED_DIRS.contains(&file_name.as_str()) {
+			if IGNORED_DIRS.contains(&file_name.as_str()) {
-                return Err(Error::InvalidArchive(format!(
+				return Err(RegistryError::InvalidArchive(format!(
-                    "archive contains forbidden directory: {file_name}"
+					"archive contains forbidden directory: {file_name}"
-                )));
+				)));
-            }
+			}
 
-            if file_name == "docs" {
+			if file_name == "docs" {
-                let mut stack = vec![(
+				let mut stack = vec![(
-                    BTreeSet::new(),
+					BTreeSet::new(),
-                    fs::read_dir(entry.path()).await?,
+					fs::read_dir(entry.path()).await?,
-                    None::<DocEntryInfo>,
+					None::<DocEntryInfo>,
-                )];
+				)];
 
-                'outer: while let Some((set, iter, category_info)) = stack.last_mut() {
+				'outer: while let Some((set, iter, category_info)) = stack.last_mut() {
-                    while let Some(entry) = iter.next_entry().await? {
+					while let Some(entry) = iter.next_entry().await? {
-                        let file_name = entry
+						let file_name = entry
-                            .file_name()
+							.file_name()
-                            .to_str()
+							.to_str()
-                            .ok_or_else(|| {
+							.ok_or_else(|| {
-                                Error::InvalidArchive(
+								RegistryError::InvalidArchive(
-                                    "file name contains non UTF-8 characters".into(),
+									"file name contains non UTF-8 characters".into(),
-                                )
+								)
-                            })?
+							})?
-                            .to_string();
+							.to_string();
 
-                        if entry.file_type().await?.is_dir() {
+						if entry.file_type().await?.is_dir() {
-                            stack.push((
+							stack.push((
-                                BTreeSet::new(),
+								BTreeSet::new(),
-                                fs::read_dir(entry.path()).await?,
+								fs::read_dir(entry.path()).await?,
-                                Some(DocEntryInfo {
+								Some(DocEntryInfo {
-                                    label: Some(file_name.to_case(Case::Title)),
+									label: Some(file_name.to_case(Case::Title)),
-                                    ..Default::default()
+									..Default::default()
-                                }),
+								}),
-                            ));
+							));
-                            continue 'outer;
+							continue 'outer;
-                        }
+						}
 
-                        if file_name == "_category_.json" {
+						if file_name == "_category_.json" {
-                            let info = fs::read_to_string(entry.path()).await?;
+							let info = fs::read_to_string(entry.path()).await?;
-                            let mut info: DocEntryInfo = serde_json::from_str(&info)?;
+							let mut info: DocEntryInfo = serde_json::from_str(&info)?;
-                            let old_info = category_info.take();
+							let old_info = category_info.take();
-                            info.label = info.label.or(old_info.and_then(|i| i.label));
+							info.label = info.label.or(old_info.and_then(|i| i.label));
-                            *category_info = Some(info);
+							*category_info = Some(info);
-                            continue;
+							continue;
-                        }
+						}
 
-                        let Some(file_name) = file_name.strip_suffix(".md") else {
+						let Some(file_name) = file_name.strip_suffix(".md") else {
-                            continue;
+							continue;
-                        };
+						};
 
-                        let content = fs::read_to_string(entry.path()).await?;
+						let content = fs::read_to_string(entry.path()).await?;
-                        let content = content.trim();
+						let content = content.trim();
-                        let hash = format!("{:x}", Sha256::digest(content.as_bytes()));
+						let hash = format!("{:x}", Sha256::digest(content.as_bytes()));
 
-                        let mut gz = async_compression::tokio::bufread::GzipEncoder::with_quality(
+						let mut gz = async_compression::tokio::bufread::GzipEncoder::with_quality(
-                            Cursor::new(content.as_bytes().to_vec()),
+							Cursor::new(content.as_bytes().to_vec()),
-                            Level::Best,
+							Level::Best,
-                        );
+						);
-                        let mut bytes = vec![];
+						let mut bytes = vec![];
-                        gz.read_to_end(&mut bytes).await?;
+						gz.read_to_end(&mut bytes).await?;
-                        docs_pages.insert(hash.to_string(), bytes);
+						docs_pages.insert(hash.to_string(), bytes);
 
-                        let mut lines = content.lines().peekable();
+						let mut lines = content.lines().peekable();
-                        let front_matter = if lines.peek().filter(|l| **l == "---").is_some() {
+						let front_matter = if lines.peek().filter(|l| **l == "---").is_some() {
-                            lines.next(); // skip the first `---`
+							lines.next(); // skip the first `---`
 
-                            let front_matter = lines
+							let front_matter = lines
-                                .by_ref()
+								.by_ref()
-                                .take_while(|l| *l != "---")
+								.take_while(|l| *l != "---")
-                                .collect::<Vec<_>>()
+								.collect::<Vec<_>>()
-                                .join("\n");
+								.join("\n");
 
-                            lines.next(); // skip the last `---`
+							lines.next(); // skip the last `---`
 
-                            front_matter
+							front_matter
-                        } else {
+						} else {
-                            "".to_string()
+							"".to_string()
-                        };
+						};
 
-                        let h1 = lines
+						let h1 = lines
-                            .find(|l| !l.trim().is_empty())
+							.find(|l| !l.trim().is_empty())
-                            .and_then(|l| l.strip_prefix("# "))
+							.and_then(|l| l.strip_prefix("# "))
-                            .map(|s| s.to_string());
+							.map(|s| s.to_string());
 
-                        let info: DocEntryInfo =
+						let info: DocEntryInfo =
-                            serde_yaml::from_str(&front_matter).map_err(|_| {
+							serde_yaml::from_str(&front_matter).map_err(|_| {
-                                Error::InvalidArchive(format!(
+								RegistryError::InvalidArchive(format!(
-                                    "doc {file_name}'s frontmatter isn't valid YAML"
+									"doc {file_name}'s frontmatter isn't valid YAML"
-                                ))
+								))
-                            })?;
+							})?;
 
-                        set.insert(DocEntry {
+						set.insert(DocEntry {
-                            label: info.label.or(h1).unwrap_or(file_name.to_case(Case::Title)),
+							label: info.label.or(h1).unwrap_or(file_name.to_case(Case::Title)),
-                            position: info.sidebar_position,
+							position: info.sidebar_position,
-                            kind: DocEntryKind::Page {
+							kind: DocEntryKind::Page {
-                                name: entry
+								name: entry
-                                    .path()
+									.path()
-                                    .strip_prefix(package_dir.path().join("docs"))
+									.strip_prefix(package_dir.path().join("docs"))
-                                    .unwrap()
+									.unwrap()
-                                    .with_extension("")
+									.with_extension("")
-                                    .to_str()
+									.to_str()
-                                    .ok_or_else(|| {
+									.ok_or_else(|| {
-                                        Error::InvalidArchive(
+										RegistryError::InvalidArchive(
-                                            "file name contains non UTF-8 characters".into(),
+											"file name contains non UTF-8 characters".into(),
-                                        )
+										)
-                                    })?
+									})?
-                                    // ensure that the path is always using forward slashes
+									// ensure that the path is always using forward slashes
-                                    .replace("\\", "/"),
+									.replace("\\", "/"),
-                                hash,
+								hash,
-                            },
+							},
-                        });
+						});
-                    }
+					}
 
-                    // should never be None
+					// should never be None
-                    let (popped, _, category_info) = stack.pop().unwrap();
+					let (popped, _, category_info) = stack.pop().unwrap();
-                    docs = popped;
+					docs = popped;
 
-                    if let Some((set, _, _)) = stack.last_mut() {
+					if let Some((set, _, _)) = stack.last_mut() {
-                        let category_info = category_info.unwrap_or_default();
+						let category_info = category_info.unwrap_or_default();
 
-                        set.insert(DocEntry {
+						set.insert(DocEntry {
-                            label: category_info.label.unwrap(),
+							label: category_info.label.unwrap(),
-                            position: category_info.sidebar_position,
+							position: category_info.sidebar_position,
-                            kind: DocEntryKind::Category {
+							kind: DocEntryKind::Category {
-                                items: {
+								items: {
-                                    let curr_docs = docs;
+									let curr_docs = docs;
-                                    docs = BTreeSet::new();
+									docs = BTreeSet::new();
-                                    curr_docs
+									curr_docs
-                                },
+								},
-                                collapsed: category_info.collapsed,
+								collapsed: category_info.collapsed,
-                            },
+							},
-                        });
+						});
-                    }
+					}
-                }
+				}
-            }
+			}
 
-            continue;
+			continue;
-        }
+		}
 
-        if IGNORED_FILES.contains(&file_name.as_str())
+		if IGNORED_FILES.contains(&file_name.as_str())
-            || ADDITIONAL_FORBIDDEN_FILES.contains(&file_name.as_str())
+			|| ADDITIONAL_FORBIDDEN_FILES.contains(&file_name.as_str())
-        {
+		{
-            return Err(Error::InvalidArchive(format!(
+			return Err(RegistryError::InvalidArchive(format!(
-                "archive contains forbidden file: {file_name}"
+				"archive contains forbidden file: {file_name}"
-            )));
+			)));
-        }
+		}
 
-        if file_name == MANIFEST_FILE_NAME {
+		if file_name == MANIFEST_FILE_NAME {
-            let content = fs::read_to_string(entry.path()).await?;
+			let content = fs::read_to_string(entry.path()).await?;
 
-            manifest = Some(toml::de::from_str(&content)?);
+			manifest = Some(toml::de::from_str(&content)?);
-        } else if file_name
+		} else if file_name
-            .to_lowercase()
+			.to_lowercase()
-            .split_once('.')
+			.split_once('.')
-            .filter(|(file, ext)| *file == "readme" && (*ext == "md" || *ext == "txt"))
+			.filter(|(file, ext)| *file == "readme" && (*ext == "md" || *ext == "txt"))
-            .is_some()
+			.is_some()
-        {
+		{
-            if readme.is_some() {
+			if readme.is_some() {
-                return Err(Error::InvalidArchive(
+				return Err(RegistryError::InvalidArchive(
-                    "archive contains multiple readme files".into(),
+					"archive contains multiple readme files".into(),
-                ));
+				));
-            }
+			}
 
-            let mut file = fs::File::open(entry.path()).await?;
+			let mut file = fs::File::open(entry.path()).await?;
 
-            let mut gz = async_compression::tokio::write::GzipEncoder::new(vec![]);
+			let mut gz = async_compression::tokio::write::GzipEncoder::new(vec![]);
-            tokio::io::copy(&mut file, &mut gz).await?;
+			tokio::io::copy(&mut file, &mut gz).await?;
-            gz.shutdown().await?;
+			gz.shutdown().await?;
-            readme = Some(gz.into_inner());
+			readme = Some(gz.into_inner());
-        }
+		}
-    }
+	}
 
-    let Some(manifest) = manifest else {
+	let Some(manifest) = manifest else {
-        return Err(Error::InvalidArchive(
+		return Err(RegistryError::InvalidArchive(
-            "archive doesn't contain a manifest".into(),
+			"archive doesn't contain a manifest".into(),
-        ));
+		));
-    };
+	};
 
-    add_breadcrumb(sentry::Breadcrumb {
+	add_breadcrumb(sentry::Breadcrumb {
-        category: Some("publish".into()),
+		category: Some("publish".into()),
-        message: Some(format!(
+		message: Some(format!(
-            "publish request for {}@{} {}. has readme: {}. docs: {}",
+			"publish request for {}@{} {}. has readme: {}. docs: {}",
-            manifest.name,
+			manifest.name,
-            manifest.version,
+			manifest.version,
-            manifest.target,
+			manifest.target,
-            readme.is_some(),
+			readme.is_some(),
-            docs_pages.len()
+			docs_pages.len()
-        )),
+		)),
-        level: sentry::Level::Info,
+		level: sentry::Level::Info,
-        ..Default::default()
+		..Default::default()
-    });
+	});
 
-    {
+	{
-        let dependencies = manifest.all_dependencies().map_err(|e| {
+		let dependencies = manifest.all_dependencies().map_err(|e| {
-            Error::InvalidArchive(format!("manifest has invalid dependencies: {e}"))
+			RegistryError::InvalidArchive(format!("manifest has invalid dependencies: {e}"))
-        })?;
+		})?;
 
-        for (specifier, _) in dependencies.values() {
+		for (specifier, ty) in dependencies.values() {
-            match specifier {
+			// we need not verify dev dependencies, as they won't be installed
-                DependencySpecifiers::Pesde(specifier) => {
+			if *ty == DependencyType::Dev {
-                    if specifier
+				continue;
-                        .index
+			}
-                        .as_deref()
-                        .filter(|index| match gix::Url::try_from(*index) {
-                            Ok(url) => config
-                                .other_registries_allowed
-                                .is_allowed_or_same(source.repo_url().clone(), url),
-                            Err(_) => false,
-                        })
-                        .is_none()
-                    {
-                        return Err(Error::InvalidArchive(format!(
-                            "invalid index in pesde dependency {specifier}"
-                        )));
-                    }
-                }
-                DependencySpecifiers::Wally(specifier) => {
-                    if specifier
-                        .index
-                        .as_deref()
-                        .filter(|index| match gix::Url::try_from(*index) {
-                            Ok(url) => config.wally_allowed.is_allowed(url),
-                            Err(_) => false,
-                        })
-                        .is_none()
-                    {
-                        return Err(Error::InvalidArchive(format!(
-                            "invalid index in wally dependency {specifier}"
-                        )));
-                    }
-                }
-                DependencySpecifiers::Git(specifier) => {
-                    if !config.git_allowed.is_allowed(specifier.repo.clone()) {
-                        return Err(Error::InvalidArchive(
-                            "git dependencies are not allowed".into(),
-                        ));
-                    }
-                }
-                DependencySpecifiers::Workspace(_) => {
-                    // workspace specifiers are to be transformed into pesde specifiers by the sender
-                    return Err(Error::InvalidArchive(
-                        "non-transformed workspace dependency".into(),
-                    ));
-                }
-            }
-        }
 
-        let repo = Repository::open_bare(source.path(&app_state.project))?;
+			match specifier {
-        let gix_repo = gix::open(repo.path())?;
+				DependencySpecifiers::Pesde(specifier) => {
+					if specifier
+						.index
+						.as_deref()
+						.filter(|index| match gix::Url::try_from(*index) {
+							Ok(url) => config
+								.other_registries_allowed
+								.is_allowed_or_same(source.repo_url().clone(), url),
+							Err(_) => false,
+						})
+						.is_none()
+					{
+						return Err(RegistryError::InvalidArchive(format!(
+							"invalid index in pesde dependency {specifier}"
+						)));
+					}
+				}
+				DependencySpecifiers::Wally(specifier) => {
+					if specifier
+						.index
+						.as_deref()
+						.filter(|index| match gix::Url::try_from(*index) {
+							Ok(url) => config.wally_allowed.is_allowed(url),
+							Err(_) => false,
+						})
+						.is_none()
+					{
+						return Err(RegistryError::InvalidArchive(format!(
+							"invalid index in wally dependency {specifier}"
+						)));
+					}
+				}
+				DependencySpecifiers::Git(specifier) => {
+					if !config.git_allowed.is_allowed(specifier.repo.clone()) {
+						return Err(RegistryError::InvalidArchive(
+							"git dependencies are not allowed".into(),
+						));
+					}
+				}
+				DependencySpecifiers::Workspace(_) => {
+					// workspace specifiers are to be transformed into pesde specifiers by the sender
+					return Err(RegistryError::InvalidArchive(
+						"non-transformed workspace dependency".into(),
+					));
+				}
+				DependencySpecifiers::Path(_) => {
+					return Err(RegistryError::InvalidArchive(
+						"path dependencies are not allowed".into(),
+					));
+				}
+			}
+		}
 
-        let gix_tree = root_tree(&gix_repo)?;
+		let mut files = HashMap::new();
 
-        let (scope, name) = manifest.name.as_str();
+		let scope = read_scope_info(&app_state, manifest.name.scope(), &source).await?;
-        let mut oids = vec![];
+		match scope {
+			Some(info) => {
+				if !info.owners.contains(&user_id.0) {
+					return Ok(HttpResponse::Forbidden().finish());
+				}
+			}
+			None => {
+				let scope_info = toml::to_string(&ScopeInfo {
+					owners: BTreeSet::from([user_id.0]),
+				})?;
 
-        match read_file(&gix_tree, [scope, SCOPE_INFO_FILE])? {
+				files.insert(SCOPE_INFO_FILE.to_string(), scope_info.into_bytes());
-            Some(info) => {
+			}
-                let info: ScopeInfo = toml::de::from_str(&info)?;
+		}
-                if !info.owners.contains(&user_id.0) {
-                    return Ok(HttpResponse::Forbidden().finish());
-                }
-            }
-            None => {
-                let scope_info = toml::to_string(&ScopeInfo {
-                    owners: BTreeSet::from([user_id.0]),
-                })?;
 
-                let mut blob_writer = repo.blob_writer(None)?;
+		let mut file = read_package(&app_state, &manifest.name, &source)
-                blob_writer.write_all(scope_info.as_bytes())?;
+			.await?
-                oids.push((SCOPE_INFO_FILE, blob_writer.commit()?));
+			.unwrap_or_default();
-            }
-        };
 
-        let mut file: IndexFile =
+		let new_entry = IndexFileEntry {
-            toml::de::from_str(&read_file(&gix_tree, [scope, name])?.unwrap_or_default())?;
+			target: manifest.target.clone(),
+			published_at: jiff::Timestamp::now(),
+			engines: manifest.engines.clone(),
+			description: manifest.description.clone(),
+			license: manifest.license.clone(),
+			authors: manifest.authors.clone(),
+			repository: manifest.repository.clone(),
+			yanked: false,
+			docs,
 
-        let new_entry = IndexFileEntry {
+			dependencies,
-            target: manifest.target.clone(),
+		};
-            published_at: chrono::Utc::now(),
-            description: manifest.description.clone(),
-            license: manifest.license.clone(),
-            authors: manifest.authors.clone(),
-            repository: manifest.repository.clone(),
-            docs,
 
-            dependencies,
+		let same_version = file
-        };
+			.entries
+			.iter()
+			.find(|(v_id, _)| *v_id.version() == manifest.version);
+		if let Some((_, other_entry)) = same_version {
+			// description cannot be different - which one to render in the "Recently published" list?
+			if other_entry.description != new_entry.description {
+				return Ok(HttpResponse::BadRequest().json(ErrorResponse {
+					error: "same versions with different descriptions are forbidden".to_string(),
+				}));
+			}
+		}
 
-        let this_version = file
+		if file
-            .entries
+			.entries
-            .keys()
+			.insert(
-            .find(|v_id| *v_id.version() == manifest.version);
+				VersionId::new(manifest.version.clone(), manifest.target.kind()),
-        if let Some(this_version) = this_version {
+				new_entry.clone(),
-            let other_entry = file.entries.get(this_version).unwrap();
+			)
+			.is_some()
+		{
+			return Ok(HttpResponse::Conflict().finish());
+		}
 
-            // description cannot be different - which one to render in the "Recently published" list?
+		files.insert(
-            // the others cannot be different because what to return from the versions endpoint?
+			manifest.name.name().to_string(),
-            if other_entry.description != new_entry.description
+			toml::to_string(&file)?.into_bytes(),
-                || other_entry.license != new_entry.license
+		);
-                || other_entry.authors != new_entry.authors
-                || other_entry.repository != new_entry.repository
-            {
-                return Ok(HttpResponse::BadRequest().json(ErrorResponse {
-                    error: "same version with different description or license already exists"
-                        .to_string(),
-                }));
-            }
-        }
 
-        if file
+		push_changes(
-            .entries
+			&app_state,
-            .insert(
+			&source,
-                VersionId::new(manifest.version.clone(), manifest.target.kind()),
+			manifest.name.scope().to_string(),
-                new_entry.clone(),
+			files,
-            )
+			format!(
-            .is_some()
+				"add {}@{} {}",
-        {
+				manifest.name, manifest.version, manifest.target
-            return Ok(HttpResponse::Conflict().finish());
+			),
-        }
+		)
+		.await?;
 
-        let mut remote = repo.find_remote("origin")?;
+		update_search_version(&app_state, &manifest.name, &new_entry);
-        let refspec = get_refspec(&repo, &mut remote)?;
+	}
 
-        let reference = repo.find_reference(&refspec)?;
+	let version_id = VersionId::new(manifest.version.clone(), manifest.target.kind());
 
-        {
+	let mut tasks = docs_pages
-            let index_content = toml::to_string(&file)?;
+		.into_iter()
-            let mut blob_writer = repo.blob_writer(None)?;
+		.map(|(hash, content)| {
-            blob_writer.write_all(index_content.as_bytes())?;
+			let app_state = app_state.clone();
-            oids.push((name, blob_writer.commit()?));
+			async move { app_state.storage.store_doc(hash, content).await }
-        }
+		})
+		.collect::<JoinSet<_>>();
 
-        let old_root_tree = reference.peel_to_tree()?;
+	{
-        let old_scope_tree = match old_root_tree.get_name(scope) {
+		let app_state = app_state.clone();
-            Some(entry) => Some(repo.find_tree(entry.id())?),
+		let name = manifest.name.clone();
-            None => None,
+		let version_id = version_id.clone();
-        };
 
-        let mut scope_tree = repo.treebuilder(old_scope_tree.as_ref())?;
+		tasks.spawn(async move {
-        for (file, oid) in oids {
+			app_state
-            scope_tree.insert(file, oid, 0o100644)?;
+				.storage
-        }
+				.store_package(&name, &version_id, bytes.to_vec())
+				.await
+		});
+	}
 
-        let scope_tree_id = scope_tree.write()?;
+	if let Some(readme) = readme {
-        let mut root_tree = repo.treebuilder(Some(&repo.find_tree(old_root_tree.id())?))?;
+		let app_state = app_state.clone();
-        root_tree.insert(scope, scope_tree_id, 0o040000)?;
+		let name = manifest.name.clone();
+		let version_id = version_id.clone();
 
-        let tree_oid = root_tree.write()?;
+		tasks.spawn(async move {
+			app_state
+				.storage
+				.store_readme(&name, &version_id, readme)
+				.await
+		});
+	}
 
-        repo.commit(
+	while let Some(res) = tasks.join_next().await {
-            Some("HEAD"),
+		res.unwrap()?;
-            &signature(),
+	}
-            &signature(),
-            &format!(
-                "add {}@{} {}",
-                manifest.name, manifest.version, manifest.target
-            ),
-            &repo.find_tree(tree_oid)?,
-            &[&reference.peel_to_commit()?],
-        )?;
 
-        let mut push_options = git2::PushOptions::new();
+	Ok(HttpResponse::Ok().body(format!("published {}@{version_id}", manifest.name)))
-        let mut remote_callbacks = git2::RemoteCallbacks::new();
-
-        let git_creds = app_state.project.auth_config().git_credentials().unwrap();
-        remote_callbacks.credentials(|_, _, _| {
-            git2::Cred::userpass_plaintext(&git_creds.username, &git_creds.password)
-        });
-
-        push_options.remote_callbacks(remote_callbacks);
-
-        remote.push(&[refspec], Some(&mut push_options))?;
-
-        update_version(&app_state, &manifest.name, new_entry);
-    }
-
-    let version_id = VersionId::new(manifest.version.clone(), manifest.target.kind());
-
-    let (a, b, c) = join!(
-        app_state
-            .storage
-            .store_package(&manifest.name, &version_id, bytes.to_vec()),
-        join_all(
-            docs_pages
-                .into_iter()
-                .map(|(hash, content)| app_state.storage.store_doc(hash, content)),
-        ),
-        async {
-            if let Some(readme) = readme {
-                app_state
-                    .storage
-                    .store_readme(&manifest.name, &version_id, readme)
-                    .await
-            } else {
-                Ok(())
-            }
-        }
-    );
-    a?;
-    b.into_iter().collect::<Result<(), _>>()?;
-    c?;
-
-    Ok(HttpResponse::Ok().body(format!(
-        "published {}@{} {}",
-        manifest.name, manifest.version, manifest.target
-    )))
 }

registry/src/endpoints/search.rs

@@ -1,107 +1,93 @@
-use std::collections::HashMap;
+use crate::{
-
+	error::RegistryError,
-use actix_web::{web, HttpResponse, Responder};
+	package::{read_package, PackageResponse},
-use serde::Deserialize;
+	search::find_max_searchable,
-use tantivy::{collector::Count, query::AllQuery, schema::Value, DateTime, Order};
+	AppState,
-
-use crate::{error::Error, package::PackageResponse, AppState};
-use pesde::{
-    names::PackageName,
-    source::{
-        git_index::{read_file, root_tree, GitBasedSource},
-        pesde::IndexFile,
-    },
 };
+use actix_web::{web, HttpResponse};
+use pesde::names::PackageName;
+use serde::Deserialize;
+use std::{collections::HashMap, sync::Arc};
+use tantivy::{collector::Count, query::AllQuery, schema::Value, DateTime, Order};
+use tokio::task::JoinSet;
 
 #[derive(Deserialize)]
 pub struct Request {
-    #[serde(default)]
+	#[serde(default)]
-    query: Option<String>,
+	query: String,
-    #[serde(default)]
+	#[serde(default)]
-    offset: Option<usize>,
+	offset: usize,
 }
 
 pub async fn search_packages(
-    app_state: web::Data<AppState>,
+	app_state: web::Data<AppState>,
-    request: web::Query<Request>,
+	request_query: web::Query<Request>,
-) -> Result<impl Responder, Error> {
+) -> Result<HttpResponse, RegistryError> {
-    let searcher = app_state.search_reader.searcher();
+	let searcher = app_state.search_reader.searcher();
-    let schema = searcher.schema();
+	let schema = searcher.schema();
 
-    let id = schema.get_field("id").unwrap();
+	let id = schema.get_field("id").unwrap();
 
-    let query = request.query.as_deref().unwrap_or_default().trim();
+	let query = request_query.query.trim();
 
-    let query = if query.is_empty() {
+	let query = if query.is_empty() {
-        Box::new(AllQuery)
+		Box::new(AllQuery)
-    } else {
+	} else {
-        app_state.query_parser.parse_query(query)?
+		app_state.query_parser.parse_query(query)?
-    };
+	};
 
-    let (count, top_docs) = searcher
+	let (count, top_docs) = searcher
-        .search(
+		.search(
-            &query,
+			&query,
-            &(
+			&(
-                Count,
+				Count,
-                tantivy::collector::TopDocs::with_limit(50)
+				tantivy::collector::TopDocs::with_limit(50)
-                    .and_offset(request.offset.unwrap_or_default())
+					.and_offset(request_query.offset)
-                    .order_by_fast_field::<DateTime>("published_at", Order::Desc),
+					.order_by_fast_field::<DateTime>("published_at", Order::Desc),
-            ),
+			),
-        )
+		)
-        .unwrap();
+		.unwrap();
 
-    let source = app_state.source.lock().await;
+	let source = Arc::new(app_state.source.clone().read_owned().await);
-    let repo = gix::open(source.path(&app_state.project))?;
-    let tree = root_tree(&repo)?;
 
-    let top_docs = top_docs
+	let mut results = top_docs
-        .into_iter()
+		.iter()
-        .map(|(_, doc_address)| {
+		.map(|_| None::<PackageResponse>)
-            let doc = searcher.doc::<HashMap<_, _>>(doc_address).unwrap();
+		.collect::<Vec<_>>();
 
-            let id = doc
+	let mut tasks = top_docs
-                .get(&id)
+		.into_iter()
-                .unwrap()
+		.enumerate()
-                .as_str()
+		.map(|(i, (_, doc_address))| {
-                .unwrap()
+			let app_state = app_state.clone();
-                .parse::<PackageName>()
+			let doc = searcher.doc::<HashMap<_, _>>(doc_address).unwrap();
-                .unwrap();
+			let source = source.clone();
-            let (scope, name) = id.as_str();
 
-            let file: IndexFile =
+			async move {
-                toml::de::from_str(&read_file(&tree, [scope, name]).unwrap().unwrap()).unwrap();
+				let id = doc
+					.get(&id)
+					.unwrap()
+					.as_str()
+					.unwrap()
+					.parse::<PackageName>()
+					.unwrap();
 
-            let (latest_version, entry) = file
+				let file = read_package(&app_state, &id, &source).await?.unwrap();
-                .entries
-                .iter()
-                .max_by_key(|(v_id, _)| v_id.version())
-                .unwrap();
 
-            PackageResponse {
+				let (version_id, _) = find_max_searchable(&file).unwrap();
-                name: id.to_string(),
-                version: latest_version.version().to_string(),
-                targets: file
-                    .entries
-                    .iter()
-                    .filter(|(v_id, _)| v_id.version() == latest_version.version())
-                    .map(|(_, entry)| (&entry.target).into())
-                    .collect(),
-                description: entry.description.clone().unwrap_or_default(),
-                published_at: file
-                    .entries
-                    .values()
-                    .map(|entry| entry.published_at)
-                    .max()
-                    .unwrap(),
-                license: entry.license.clone().unwrap_or_default(),
-                authors: entry.authors.clone(),
-                repository: entry.repository.clone().map(|url| url.to_string()),
-            }
-        })
-        .collect::<Vec<_>>();
 
-    Ok(HttpResponse::Ok().json(serde_json::json!({
+				Ok::<_, RegistryError>((i, PackageResponse::new(&id, version_id, &file)))
-        "data": top_docs,
+			}
-        "count": count,
+		})
-    })))
+		.collect::<JoinSet<_>>();
+
+	while let Some(res) = tasks.join_next().await {
+		let (i, res) = res.unwrap()?;
+		results[i] = Some(res);
+	}
+
+	Ok(HttpResponse::Ok().json(serde_json::json!({
+		"data": results,
+		"count": count,
+	})))
 }

registry/src/endpoints/yank_version.rs

@@ -0,0 +1,83 @@
+use crate::{
+	auth::UserId,
+	error::RegistryError,
+	git::push_changes,
+	package::{read_package, read_scope_info},
+	request_path::AllOrSpecificTarget,
+	search::search_version_changed,
+	AppState,
+};
+use actix_web::{http::Method, web, HttpRequest, HttpResponse};
+use pesde::names::PackageName;
+use semver::Version;
+use std::collections::HashMap;
+
+pub async fn yank_package_version(
+	request: HttpRequest,
+	app_state: web::Data<AppState>,
+	path: web::Path<(PackageName, Version, AllOrSpecificTarget)>,
+	user_id: web::ReqData<UserId>,
+) -> Result<HttpResponse, RegistryError> {
+	let yanked = request.method() != Method::DELETE;
+	let (name, version, target) = path.into_inner();
+	let source = app_state.source.write().await;
+
+	let Some(scope_info) = read_scope_info(&app_state, name.scope(), &source).await? else {
+		return Ok(HttpResponse::NotFound().finish());
+	};
+
+	if !scope_info.owners.contains(&user_id.0) {
+		return Ok(HttpResponse::Forbidden().finish());
+	}
+
+	let Some(mut file) = read_package(&app_state, &name, &source).await? else {
+		return Ok(HttpResponse::NotFound().finish());
+	};
+
+	let mut targets = vec![];
+
+	for (v_id, entry) in &mut file.entries {
+		if *v_id.version() != version {
+			continue;
+		}
+
+		match target {
+			AllOrSpecificTarget::Specific(kind) if entry.target.kind() != kind => continue,
+			_ => {}
+		}
+
+		if entry.yanked == yanked {
+			continue;
+		}
+
+		targets.push(entry.target.kind().to_string());
+		entry.yanked = yanked;
+	}
+
+	if targets.is_empty() {
+		return Ok(HttpResponse::Conflict().finish());
+	}
+
+	let file_string = toml::to_string(&file)?;
+
+	push_changes(
+		&app_state,
+		&source,
+		name.scope().to_string(),
+		HashMap::from([(name.name().to_string(), file_string.into_bytes())]),
+		format!(
+			"{}yank {name}@{version} {}",
+			if yanked { "" } else { "un" },
+			targets.join(", "),
+		),
+	)
+	.await?;
+
+	search_version_changed(&app_state, &name, &file);
+
+	Ok(HttpResponse::Ok().body(format!(
+		"{}yanked {name}@{version} {}",
+		if yanked { "" } else { "un" },
+		targets.join(", "),
+	)))
+}

registry/src/error.rs

@@ -4,86 +4,86 @@ use serde::Serialize;
 use thiserror::Error;
 
 #[derive(Debug, Error)]
-pub enum Error {
+pub enum RegistryError {
-    #[error("failed to parse query")]
+	#[error("failed to parse query")]
-    Query(#[from] tantivy::query::QueryParserError),
+	Query(#[from] tantivy::query::QueryParserError),
 
-    #[error("error reading repo file")]
+	#[error("error reading repo file")]
-    ReadFile(#[from] ReadFile),
+	ReadFile(#[from] ReadFile),
 
-    #[error("error deserializing file")]
+	#[error("error deserializing file")]
-    Deserialize(#[from] toml::de::Error),
+	Deserialize(#[from] toml::de::Error),
 
-    #[error("failed to send request: {1}\nserver response: {0}")]
+	#[error("failed to send request: {1}\nserver response: {0}")]
-    ReqwestResponse(String, #[source] reqwest::Error),
+	ReqwestResponse(String, #[source] reqwest::Error),
 
-    #[error("error sending request")]
+	#[error("error sending request")]
-    Reqwest(#[from] reqwest::Error),
+	Reqwest(#[from] reqwest::Error),
 
-    #[error("failed to parse archive entries")]
+	#[error("failed to parse archive entries")]
-    Tar(#[from] std::io::Error),
+	Tar(#[from] std::io::Error),
 
-    #[error("invalid archive")]
+	#[error("invalid archive")]
-    InvalidArchive(String),
+	InvalidArchive(String),
 
-    #[error("failed to read index config")]
+	#[error("failed to read index config")]
-    Config(#[from] pesde::source::pesde::errors::ConfigError),
+	Config(#[from] pesde::source::pesde::errors::ConfigError),
 
-    #[error("git error")]
+	#[error("git error")]
-    Git(#[from] git2::Error),
+	Git(#[from] git2::Error),
 
-    #[error("failed to refresh source")]
+	#[error("failed to refresh source")]
-    Refresh(#[from] Box<RefreshError>),
+	Refresh(#[from] Box<RefreshError>),
 
-    #[error("failed to serialize struct")]
+	#[error("failed to serialize struct")]
-    Serialize(#[from] toml::ser::Error),
+	Serialize(#[from] toml::ser::Error),
 
-    #[error("failed to serialize struct")]
+	#[error("failed to serialize struct")]
-    SerializeJson(#[from] serde_json::Error),
+	SerializeJson(#[from] serde_json::Error),
 
-    #[error("failed to open git repo")]
+	#[error("failed to open git repo")]
-    OpenRepo(#[from] gix::open::Error),
+	OpenRepo(#[from] gix::open::Error),
 
-    #[error("failed to get root tree")]
+	#[error("failed to get root tree")]
-    RootTree(#[from] TreeError),
+	RootTree(#[from] TreeError),
 }
 
 #[derive(Debug, Serialize)]
 pub struct ErrorResponse {
-    pub error: String,
+	pub error: String,
 }
 
-impl ResponseError for Error {
+impl ResponseError for RegistryError {
-    fn error_response(&self) -> HttpResponse<BoxBody> {
+	fn error_response(&self) -> HttpResponse<BoxBody> {
-        match self {
+		match self {
-            Error::Query(e) => HttpResponse::BadRequest().json(ErrorResponse {
+			RegistryError::Query(e) => HttpResponse::BadRequest().json(ErrorResponse {
-                error: format!("failed to parse query: {e}"),
+				error: format!("failed to parse query: {e}"),
-            }),
+			}),
-            Error::Tar(_) => HttpResponse::BadRequest().json(ErrorResponse {
+			RegistryError::Tar(_) => HttpResponse::BadRequest().json(ErrorResponse {
-                error: "corrupt archive".to_string(),
+				error: "corrupt archive".to_string(),
-            }),
+			}),
-            Error::InvalidArchive(e) => HttpResponse::BadRequest().json(ErrorResponse {
+			RegistryError::InvalidArchive(e) => HttpResponse::BadRequest().json(ErrorResponse {
-                error: format!("archive is invalid: {e}"),
+				error: format!("archive is invalid: {e}"),
-            }),
+			}),
-            e => {
+			e => {
-                tracing::error!("unhandled error: {e:?}");
+				tracing::error!("unhandled error: {e:?}");
-                HttpResponse::InternalServerError().finish()
+				HttpResponse::InternalServerError().finish()
-            }
+			}
-        }
+		}
-    }
+	}
 }
 
 pub trait ReqwestErrorExt {
-    async fn into_error(self) -> Result<Self, Error>
+	async fn into_error(self) -> Result<Self, RegistryError>
-    where
+	where
-        Self: Sized;
+		Self: Sized;
 }
 
 impl ReqwestErrorExt for reqwest::Response {
-    async fn into_error(self) -> Result<Self, Error> {
+	async fn into_error(self) -> Result<Self, RegistryError> {
-        match self.error_for_status_ref() {
+		match self.error_for_status_ref() {
-            Ok(_) => Ok(self),
+			Ok(_) => Ok(self),
-            Err(e) => Err(Error::ReqwestResponse(self.text().await?, e)),
+			Err(e) => Err(RegistryError::ReqwestResponse(self.text().await?, e)),
-        }
+		}
-    }
+	}
 }

registry/src/git.rs

@@ -0,0 +1,98 @@
+use crate::{benv, error::RegistryError, AppState};
+use git2::{Remote, Repository, Signature};
+use pesde::source::{git_index::GitBasedSource, pesde::PesdePackageSource};
+use std::collections::HashMap;
+use tokio::task::spawn_blocking;
+
+fn signature<'a>() -> Signature<'a> {
+	Signature::now(
+		&benv!(required "COMMITTER_GIT_NAME"),
+		&benv!(required "COMMITTER_GIT_EMAIL"),
+	)
+	.unwrap()
+}
+
+fn get_refspec(repo: &Repository, remote: &mut Remote) -> Result<String, git2::Error> {
+	let upstream_branch_buf = repo.branch_upstream_name(repo.head()?.name().unwrap())?;
+	let upstream_branch = upstream_branch_buf.as_str().unwrap();
+
+	let refspec_buf = remote
+		.refspecs()
+		.find(|r| r.direction() == git2::Direction::Fetch && r.dst_matches(upstream_branch))
+		.unwrap()
+		.rtransform(upstream_branch)?;
+	let refspec = refspec_buf.as_str().unwrap();
+
+	Ok(refspec.to_string())
+}
+
+const FILE_FILEMODE: i32 = 0o100644;
+const DIR_FILEMODE: i32 = 0o040000;
+
+pub async fn push_changes(
+	app_state: &AppState,
+	source: &PesdePackageSource,
+	directory: String,
+	files: HashMap<String, Vec<u8>>,
+	message: String,
+) -> Result<(), RegistryError> {
+	let path = source.path(&app_state.project);
+	let auth_config = app_state.project.auth_config().clone();
+
+	spawn_blocking(move || {
+		let repo = Repository::open_bare(path)?;
+		let mut oids = HashMap::new();
+
+		let mut remote = repo.find_remote("origin")?;
+		let refspec = get_refspec(&repo, &mut remote)?;
+
+		let reference = repo.find_reference(&refspec)?;
+
+		for (name, contents) in files {
+			let oid = repo.blob(&contents)?;
+			oids.insert(name, oid);
+		}
+
+		let old_root_tree = reference.peel_to_tree()?;
+		let old_dir_tree = match old_root_tree.get_name(&directory) {
+			Some(entry) => Some(repo.find_tree(entry.id())?),
+			None => None,
+		};
+
+		let mut dir_tree = repo.treebuilder(old_dir_tree.as_ref())?;
+		for (file, oid) in oids {
+			dir_tree.insert(file, oid, FILE_FILEMODE)?;
+		}
+
+		let dir_tree_id = dir_tree.write()?;
+		let mut root_tree = repo.treebuilder(Some(&repo.find_tree(old_root_tree.id())?))?;
+		root_tree.insert(directory, dir_tree_id, DIR_FILEMODE)?;
+
+		let tree_oid = root_tree.write()?;
+
+		repo.commit(
+			Some("HEAD"),
+			&signature(),
+			&signature(),
+			&message,
+			&repo.find_tree(tree_oid)?,
+			&[&reference.peel_to_commit()?],
+		)?;
+
+		let mut push_options = git2::PushOptions::new();
+		let mut remote_callbacks = git2::RemoteCallbacks::new();
+
+		let git_creds = auth_config.git_credentials().unwrap();
+		remote_callbacks.credentials(|_, _, _| {
+			git2::Cred::userpass_plaintext(&git_creds.username, &git_creds.password)
+		});
+
+		push_options.remote_callbacks(remote_callbacks);
+
+		remote.push(&[refspec], Some(&mut push_options))?;
+
+		Ok(())
+	})
+	.await
+	.unwrap()
+}

registry/src/main.rs

@@ -1,55 +1,60 @@
 use crate::{
-    auth::{get_auth_from_env, Auth, UserIdExtractor},
+	auth::{get_auth_from_env, Auth, UserIdExtractor},
-    search::make_search,
+	search::make_search,
-    storage::{get_storage_from_env, Storage},
+	storage::{get_storage_from_env, Storage},
 };
 use actix_cors::Cors;
 use actix_governor::{Governor, GovernorConfigBuilder};
 use actix_web::{
-    middleware::{from_fn, Compress, NormalizePath, TrailingSlash},
+	middleware::{from_fn, Compress, NormalizePath, TrailingSlash},
-    rt::System,
+	rt::System,
-    web,
+	web,
-    web::PayloadConfig,
+	web::PayloadConfig,
-    App, HttpServer,
+	App, HttpServer,
 };
 use fs_err::tokio as fs;
 use pesde::{
-    source::{pesde::PesdePackageSource, traits::PackageSource},
+	source::{
-    AuthConfig, Project,
+		pesde::PesdePackageSource,
+		traits::{PackageSource, RefreshOptions},
+	},
+	AuthConfig, Project,
 };
-use std::{env::current_dir, path::PathBuf};
+use std::{env::current_dir, path::PathBuf, sync::Arc};
 use tracing::level_filters::LevelFilter;
 use tracing_subscriber::{
-    fmt::format::FmtSpan, layer::SubscriberExt, util::SubscriberInitExt, EnvFilter,
+	fmt::format::FmtSpan, layer::SubscriberExt, util::SubscriberInitExt, EnvFilter,
 };
 
 mod auth;
 mod endpoints;
 mod error;
+mod git;
 mod package;
+mod request_path;
 mod search;
 mod storage;
 
 pub fn make_reqwest() -> reqwest::Client {
-    reqwest::ClientBuilder::new()
+	reqwest::ClientBuilder::new()
-        .user_agent(concat!(
+		.user_agent(concat!(
-            env!("CARGO_PKG_NAME"),
+			env!("CARGO_PKG_NAME"),
-            "/",
+			"/",
-            env!("CARGO_PKG_VERSION")
+			env!("CARGO_PKG_VERSION")
-        ))
+		))
-        .build()
+		.build()
-        .unwrap()
+		.unwrap()
 }
 
 pub struct AppState {
-    pub source: tokio::sync::Mutex<PesdePackageSource>,
+	pub source: Arc<tokio::sync::RwLock<PesdePackageSource>>,
-    pub project: Project,
+	pub project: Project,
-    pub storage: Storage,
+	pub storage: Storage,
-    pub auth: Auth,
+	pub auth: Auth,
 
-    pub search_reader: tantivy::IndexReader,
+	pub search_reader: tantivy::IndexReader,
-    pub search_writer: std::sync::Mutex<tantivy::IndexWriter>,
+	pub search_writer: std::sync::Mutex<tantivy::IndexWriter>,
-    pub query_parser: tantivy::query::QueryParser,
+	pub query_parser: tantivy::query::QueryParser,
 }
 
 #[macro_export]
@@ -86,157 +91,223 @@ macro_rules! benv {
 }
 
 async fn run() -> std::io::Result<()> {
-    let address = benv!("ADDRESS" => "127.0.0.1");
+	let address = benv!("ADDRESS" => "127.0.0.1");
-    let port: u16 = benv!(parse "PORT" => "8080");
+	let port: u16 = benv!(parse "PORT" => "8080");
 
-    let cwd = current_dir().unwrap();
+	let cwd = current_dir().unwrap();
-    let data_dir =
+	let data_dir =
-        PathBuf::from(benv!("DATA_DIR" => "{CWD}/data").replace("{CWD}", cwd.to_str().unwrap()));
+		PathBuf::from(benv!("DATA_DIR" => "{CWD}/data").replace("{CWD}", cwd.to_str().unwrap()));
-    fs::create_dir_all(&data_dir).await.unwrap();
+	fs::create_dir_all(&data_dir).await.unwrap();
 
-    let project = Project::new(
+	let project = Project::new(
-        &cwd,
+		&cwd,
-        None::<PathBuf>,
+		None::<PathBuf>,
-        data_dir.join("project"),
+		data_dir.join("project"),
-        &cwd,
+		&cwd,
-        AuthConfig::new().with_git_credentials(Some(gix::sec::identity::Account {
+		AuthConfig::new().with_git_credentials(Some(gix::sec::identity::Account {
-            username: benv!(required "GIT_USERNAME"),
+			username: benv!(required "GIT_USERNAME"),
-            password: benv!(required "GIT_PASSWORD"),
+			password: benv!(required "GIT_PASSWORD"),
-        })),
+		})),
-    );
+	);
-    let source = PesdePackageSource::new(benv!(required "INDEX_REPO_URL").try_into().unwrap());
+	let source = PesdePackageSource::new(benv!(required "INDEX_REPO_URL").try_into().unwrap());
-    source
+	source
-        .refresh(&project)
+		.refresh(&RefreshOptions {
-        .await
+			project: project.clone(),
-        .expect("failed to refresh source");
+		})
-    let config = source
+		.await
-        .config(&project)
+		.expect("failed to refresh source");
-        .await
+	let config = source
-        .expect("failed to get index config");
+		.config(&project)
+		.await
+		.expect("failed to get index config");
 
-    let (search_reader, search_writer, query_parser) = make_search(&project, &source).await;
+	let (search_reader, search_writer, query_parser) = make_search(&project, &source).await;
 
-    let app_data = web::Data::new(AppState {
+	let app_data = web::Data::new(AppState {
-        storage: {
+		storage: {
-            let storage = get_storage_from_env();
+			let storage = get_storage_from_env();
-            tracing::info!("storage: {storage}");
+			tracing::info!("storage: {storage}");
-            storage
+			storage
-        },
+		},
-        auth: {
+		auth: {
-            let auth = get_auth_from_env(&config);
+			let auth = get_auth_from_env(&config);
-            tracing::info!("auth: {auth}");
+			tracing::info!("auth: {auth}");
-            auth
+			auth
-        },
+		},
-        source: tokio::sync::Mutex::new(source),
+		source: Arc::new(tokio::sync::RwLock::new(source)),
-        project,
+		project,
 
-        search_reader,
+		search_reader,
-        search_writer: std::sync::Mutex::new(search_writer),
+		search_writer: std::sync::Mutex::new(search_writer),
-        query_parser,
+		query_parser,
-    });
+	});
 
-    let publish_governor_config = GovernorConfigBuilder::default()
+	let publish_governor_config = GovernorConfigBuilder::default()
-        .key_extractor(UserIdExtractor)
+		.key_extractor(UserIdExtractor)
-        .burst_size(12)
+		.burst_size(12)
-        .seconds_per_request(60)
+		.seconds_per_request(60)
-        .use_headers()
+		.use_headers()
-        .finish()
+		.finish()
-        .unwrap();
+		.unwrap();
 
-    HttpServer::new(move || {
+	let publish_payload_config = PayloadConfig::new(config.max_archive_size);
-        App::new()
+
-            .wrap(sentry_actix::Sentry::with_transaction())
+	HttpServer::new(move || {
-            .wrap(NormalizePath::new(TrailingSlash::Trim))
+		App::new()
-            .wrap(Cors::permissive())
+			.wrap(sentry_actix::Sentry::with_transaction())
-            .wrap(tracing_actix_web::TracingLogger::default())
+			.wrap(NormalizePath::new(TrailingSlash::Trim))
-            .wrap(Compress::default())
+			.wrap(Cors::permissive())
-            .app_data(app_data.clone())
+			.wrap(tracing_actix_web::TracingLogger::default())
-            .route(
+			.wrap(Compress::default())
-                "/",
+			.app_data(app_data.clone())
-                web::get().to(|| async {
+			.route(
-                    concat!(env!("CARGO_PKG_NAME"), "/", env!("CARGO_PKG_VERSION"))
+				"/",
-                }),
+				web::get().to(|| async {
-            )
+					concat!(env!("CARGO_PKG_NAME"), "/", env!("CARGO_PKG_VERSION"))
-            .service(
+				}),
-                web::scope("/v0")
+			)
-                    .route(
+			.service(
-                        "/search",
+				web::scope("/v0")
-                        web::get()
+					.route(
-                            .to(endpoints::search::search_packages)
+						"/search",
-                            .wrap(from_fn(auth::read_mw)),
+						web::get()
-                    )
+							.to(endpoints::search::search_packages)
-                    .route(
+							.wrap(from_fn(auth::read_mw)),
-                        "/packages/{name}",
+					)
-                        web::get()
+					.route(
-                            .to(endpoints::package_versions::get_package_versions)
+						"/packages/{name}",
-                            .wrap(from_fn(auth::read_mw)),
+						web::get()
-                    )
+							.to(endpoints::package_versions::get_package_versions_v0)
-                    .route(
+							.wrap(from_fn(auth::read_mw)),
-                        "/packages/{name}/{version}/{target}",
+					)
-                        web::get()
+					.route(
-                            .to(endpoints::package_version::get_package_version)
+						"/packages/{name}/{version}/{target}",
-                            .wrap(from_fn(auth::read_mw)),
+						web::get()
-                    )
+							.to(endpoints::package_version::get_package_version_v0)
-                    .service(
+							.wrap(from_fn(auth::read_mw)),
-                        web::scope("/packages")
+					)
-                            .app_data(PayloadConfig::new(config.max_archive_size))
+					.service(
-                            .route(
+						web::scope("/packages")
-                                "",
+							.app_data(publish_payload_config.clone())
-                                web::post()
+							.route(
-                                    .to(endpoints::publish_version::publish_package)
+								"",
-                                    .wrap(Governor::new(&publish_governor_config))
+								web::post()
-                                    .wrap(from_fn(auth::write_mw)),
+									.to(endpoints::publish_version::publish_package)
-                            ),
+									.wrap(Governor::new(&publish_governor_config))
-                    ),
+									.wrap(from_fn(auth::write_mw)),
-            )
+							),
-    })
+					),
-    .bind((address, port))?
+			)
-    .run()
+			.service(
-    .await
+				web::scope("/v1")
+					.route(
+						"/search",
+						web::get()
+							.to(endpoints::search::search_packages)
+							.wrap(from_fn(auth::read_mw)),
+					)
+					.route(
+						"/packages/{name}",
+						web::get()
+							.to(endpoints::package_versions::get_package_versions)
+							.wrap(from_fn(auth::read_mw)),
+					)
+					.service(
+						web::resource("/packages/{name}/deprecate")
+							.put(endpoints::deprecate_version::deprecate_package_version)
+							.delete(endpoints::deprecate_version::deprecate_package_version)
+							.wrap(from_fn(auth::write_mw)),
+					)
+					.route(
+						"/packages/{name}/{version}/{target}",
+						web::get()
+							.to(endpoints::package_version::get_package_version)
+							.wrap(from_fn(auth::read_mw)),
+					)
+					.route(
+						"/packages/{name}/{version}/{target}/archive",
+						web::get()
+							.to(endpoints::package_archive::get_package_archive)
+							.wrap(from_fn(auth::read_mw)),
+					)
+					.route(
+						"/packages/{name}/{version}/{target}/doc",
+						web::get()
+							.to(endpoints::package_doc::get_package_doc)
+							.wrap(from_fn(auth::read_mw)),
+					)
+					.route(
+						"/packages/{name}/{version}/{target}/readme",
+						web::get()
+							.to(endpoints::package_readme::get_package_readme)
+							.wrap(from_fn(auth::read_mw)),
+					)
+					.service(
+						web::resource("/packages/{name}/{version}/{target}/yank")
+							.put(endpoints::yank_version::yank_package_version)
+							.delete(endpoints::yank_version::yank_package_version)
+							.wrap(from_fn(auth::write_mw)),
+					)
+					.service(
+						web::scope("/packages")
+							.app_data(publish_payload_config.clone())
+							.route(
+								"",
+								web::post()
+									.to(endpoints::publish_version::publish_package)
+									.wrap(Governor::new(&publish_governor_config))
+									.wrap(from_fn(auth::write_mw)),
+							),
+					),
+			)
+	})
+	.bind((address, port))?
+	.run()
+	.await
 }
 
 // can't use #[actix_web::main] because of Sentry:
 // "Note: Macros like #[tokio::main] and #[actix_web::main] are not supported. The Sentry client must be initialized before the async runtime is started so that all threads are correctly connected to the Hub."
 // https://docs.sentry.io/platforms/rust/guides/actix-web/
 fn main() -> std::io::Result<()> {
-    let _ = dotenvy::dotenv();
+	let _ = dotenvy::dotenv();
 
-    let tracing_env_filter = EnvFilter::builder()
+	let tracing_env_filter = EnvFilter::builder()
-        .with_default_directive(LevelFilter::INFO.into())
+		.with_default_directive(LevelFilter::INFO.into())
-        .from_env_lossy()
+		.from_env_lossy()
-        .add_directive("reqwest=info".parse().unwrap())
+		.add_directive("reqwest=info".parse().unwrap())
-        .add_directive("rustls=info".parse().unwrap())
+		.add_directive("rustls=info".parse().unwrap())
-        .add_directive("tokio_util=info".parse().unwrap())
+		.add_directive("tokio_util=info".parse().unwrap())
-        .add_directive("goblin=info".parse().unwrap())
+		.add_directive("goblin=info".parse().unwrap())
-        .add_directive("tower=info".parse().unwrap())
+		.add_directive("tower=info".parse().unwrap())
-        .add_directive("hyper=info".parse().unwrap())
+		.add_directive("hyper=info".parse().unwrap())
-        .add_directive("h2=info".parse().unwrap());
+		.add_directive("h2=info".parse().unwrap());
 
-    tracing_subscriber::registry()
+	tracing_subscriber::registry()
-        .with(tracing_env_filter)
+		.with(tracing_env_filter)
-        .with(
+		.with(
-            tracing_subscriber::fmt::layer()
+			tracing_subscriber::fmt::layer()
-                .compact()
+				.compact()
-                .with_span_events(FmtSpan::NEW | FmtSpan::CLOSE),
+				.with_span_events(FmtSpan::NEW | FmtSpan::CLOSE),
-        )
+		)
-        .with(sentry::integrations::tracing::layer())
+		.with(sentry::integrations::tracing::layer())
-        .init();
+		.init();
 
-    let guard = sentry::init(sentry::ClientOptions {
+	let guard = sentry::init(sentry::ClientOptions {
-        release: sentry::release_name!(),
+		release: sentry::release_name!(),
-        dsn: benv!(parse "SENTRY_DSN").ok(),
+		dsn: benv!(parse "SENTRY_DSN").ok(),
-        session_mode: sentry::SessionMode::Request,
+		session_mode: sentry::SessionMode::Request,
-        traces_sample_rate: 1.0,
+		traces_sample_rate: 1.0,
-        debug: true,
+		debug: true,
-        ..Default::default()
+		..Default::default()
-    });
+	});
 
-    if guard.is_enabled() {
+	if guard.is_enabled() {
-        std::env::set_var("RUST_BACKTRACE", "full");
+		std::env::set_var("RUST_BACKTRACE", "full");
-        tracing::info!("sentry initialized");
+		tracing::info!("sentry initialized");
-    } else {
+	} else {
-        tracing::info!("sentry **NOT** initialized");
+		tracing::info!("sentry **NOT** initialized");
-    }
+	}
 
-    System::new().block_on(run())
+	System::new().block_on(run())
 }

registry/src/package.rs

@@ -1,61 +1,267 @@
-use chrono::{DateTime, Utc};
+use crate::AppState;
-use pesde::manifest::target::{Target, TargetKind};
+use pesde::{
+	manifest::{
+		target::{Target, TargetKind},
+		Alias, DependencyType,
+	},
+	names::PackageName,
+	source::{
+		git_index::{read_file, root_tree, GitBasedSource},
+		ids::VersionId,
+		pesde::{IndexFile, IndexFileEntry, PesdePackageSource, ScopeInfo, SCOPE_INFO_FILE},
+		specifiers::DependencySpecifiers,
+	},
+};
+use semver::Version;
 use serde::Serialize;
-use std::collections::BTreeSet;
+use std::collections::{BTreeMap, BTreeSet};
+use tokio::task::spawn_blocking;
+
+#[derive(Debug, Serialize, Eq, PartialEq)]
+struct TargetInfoInner {
+	lib: bool,
+	bin: bool,
+	#[serde(skip_serializing_if = "BTreeSet::is_empty")]
+	scripts: BTreeSet<String>,
+}
+
+impl TargetInfoInner {
+	fn new(target: &Target) -> Self {
+		TargetInfoInner {
+			lib: target.lib_path().is_some(),
+			bin: target.bin_path().is_some(),
+			scripts: target
+				.scripts()
+				.map(|scripts| scripts.keys().cloned().collect())
+				.unwrap_or_default(),
+		}
+	}
+}
 
 #[derive(Debug, Serialize, Eq, PartialEq)]
 pub struct TargetInfo {
-    kind: TargetKind,
+	kind: TargetKind,
-    lib: bool,
+	#[serde(skip_serializing_if = "std::ops::Not::not")]
-    bin: bool,
+	yanked: bool,
-    #[serde(skip_serializing_if = "BTreeSet::is_empty")]
+	#[serde(flatten)]
-    scripts: BTreeSet<String>,
+	inner: TargetInfoInner,
 }
 
-impl From<Target> for TargetInfo {
+impl TargetInfo {
-    fn from(target: Target) -> Self {
+	fn new(target: &Target, yanked: bool) -> Self {
-        (&target).into()
+		TargetInfo {
-    }
+			kind: target.kind(),
-}
+			yanked,
-
+			inner: TargetInfoInner::new(target),
-impl From<&Target> for TargetInfo {
+		}
-    fn from(target: &Target) -> Self {
+	}
-        TargetInfo {
-            kind: target.kind(),
-            lib: target.lib_path().is_some(),
-            bin: target.bin_path().is_some(),
-            scripts: target
-                .scripts()
-                .map(|scripts| scripts.keys().cloned().collect())
-                .unwrap_or_default(),
-        }
-    }
 }
 
 impl Ord for TargetInfo {
-    fn cmp(&self, other: &Self) -> std::cmp::Ordering {
+	fn cmp(&self, other: &Self) -> std::cmp::Ordering {
-        self.kind.cmp(&other.kind)
+		self.kind.cmp(&other.kind)
-    }
+	}
 }
 
 impl PartialOrd for TargetInfo {
-    fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
+	fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
-        Some(self.cmp(other))
+		Some(self.cmp(other))
-    }
+	}
+}
+
+#[derive(Debug, Serialize, Ord, PartialOrd, Eq, PartialEq)]
+#[serde(untagged)]
+pub enum RegistryDocEntryKind {
+	Page {
+		name: String,
+	},
+	Category {
+		#[serde(default, skip_serializing_if = "BTreeSet::is_empty")]
+		items: BTreeSet<RegistryDocEntry>,
+		#[serde(default, skip_serializing_if = "std::ops::Not::not")]
+		collapsed: bool,
+	},
+}
+
+#[derive(Debug, Serialize, Ord, PartialOrd, Eq, PartialEq)]
+pub struct RegistryDocEntry {
+	label: String,
+	#[serde(default, skip_serializing_if = "Option::is_none")]
+	position: Option<usize>,
+	#[serde(flatten)]
+	kind: RegistryDocEntryKind,
+}
+
+impl From<pesde::source::pesde::DocEntry> for RegistryDocEntry {
+	fn from(entry: pesde::source::pesde::DocEntry) -> Self {
+		Self {
+			label: entry.label,
+			position: entry.position,
+			kind: match entry.kind {
+				pesde::source::pesde::DocEntryKind::Page { name, .. } => {
+					RegistryDocEntryKind::Page { name }
+				}
+				pesde::source::pesde::DocEntryKind::Category { items, collapsed } => {
+					RegistryDocEntryKind::Category {
+						items: items.into_iter().map(Into::into).collect(),
+						collapsed,
+					}
+				}
+			},
+		}
+	}
+}
+
+#[derive(Debug, Serialize)]
+pub struct PackageResponseInner {
+	published_at: jiff::Timestamp,
+	#[serde(skip_serializing_if = "String::is_empty")]
+	license: String,
+	#[serde(skip_serializing_if = "Vec::is_empty")]
+	authors: Vec<String>,
+	#[serde(skip_serializing_if = "Option::is_none")]
+	repository: Option<String>,
+	#[serde(skip_serializing_if = "BTreeSet::is_empty")]
+	docs: BTreeSet<RegistryDocEntry>,
+	#[serde(skip_serializing_if = "BTreeMap::is_empty")]
+	dependencies: BTreeMap<Alias, (DependencySpecifiers, DependencyType)>,
+}
+
+impl PackageResponseInner {
+	pub fn new(entry: &IndexFileEntry) -> Self {
+		PackageResponseInner {
+			published_at: entry.published_at,
+			license: entry.license.clone().unwrap_or_default(),
+			authors: entry.authors.clone(),
+			repository: entry.repository.clone().map(|url| url.to_string()),
+			docs: entry.docs.iter().cloned().map(Into::into).collect(),
+			dependencies: entry.dependencies.clone(),
+		}
+	}
 }
 
 #[derive(Debug, Serialize)]
 pub struct PackageResponse {
-    pub name: String,
+	name: String,
-    pub version: String,
+	version: String,
-    pub targets: BTreeSet<TargetInfo>,
+	targets: BTreeSet<TargetInfo>,
-    #[serde(skip_serializing_if = "String::is_empty")]
+	#[serde(skip_serializing_if = "String::is_empty")]
-    pub description: String,
+	description: String,
-    pub published_at: DateTime<Utc>,
+	#[serde(skip_serializing_if = "String::is_empty")]
-    #[serde(skip_serializing_if = "String::is_empty")]
+	deprecated: String,
-    pub license: String,
+	#[serde(flatten)]
-    #[serde(skip_serializing_if = "Vec::is_empty")]
+	inner: PackageResponseInner,
-    pub authors: Vec<String>,
+}
-    #[serde(skip_serializing_if = "Option::is_none")]
+
-    pub repository: Option<String>,
+impl PackageResponse {
+	pub fn new(name: &PackageName, version_id: &VersionId, file: &IndexFile) -> Self {
+		let entry = file.entries.get(version_id).unwrap();
+
+		PackageResponse {
+			name: name.to_string(),
+			version: version_id.version().to_string(),
+			targets: file
+				.entries
+				.iter()
+				.filter(|(ver, _)| ver.version() == version_id.version())
+				.map(|(_, entry)| TargetInfo::new(&entry.target, entry.yanked))
+				.collect(),
+			description: entry.description.clone().unwrap_or_default(),
+			deprecated: file.meta.deprecated.clone(),
+			inner: PackageResponseInner::new(entry),
+		}
+	}
+}
+
+#[derive(Debug, Serialize)]
+struct PackageVersionsResponseVersionInner {
+	target: TargetInfoInner,
+	#[serde(skip_serializing_if = "std::ops::Not::not")]
+	yanked: bool,
+	#[serde(flatten)]
+	inner: PackageResponseInner,
+}
+
+#[derive(Debug, Serialize, Default)]
+struct PackageVersionsResponseVersion {
+	#[serde(skip_serializing_if = "String::is_empty")]
+	description: String,
+	targets: BTreeMap<TargetKind, PackageVersionsResponseVersionInner>,
+}
+
+#[derive(Debug, Serialize)]
+pub struct PackageVersionsResponse {
+	name: String,
+	#[serde(skip_serializing_if = "String::is_empty")]
+	deprecated: String,
+	versions: BTreeMap<Version, PackageVersionsResponseVersion>,
+}
+
+impl PackageVersionsResponse {
+	pub fn new(name: &PackageName, file: &IndexFile) -> Self {
+		let mut versions = BTreeMap::<Version, PackageVersionsResponseVersion>::new();
+
+		for (v_id, entry) in file.entries.iter() {
+			let versions_resp = versions.entry(v_id.version().clone()).or_default();
+
+			versions_resp.description = entry.description.clone().unwrap_or_default();
+			versions_resp.targets.insert(
+				entry.target.kind(),
+				PackageVersionsResponseVersionInner {
+					target: TargetInfoInner::new(&entry.target),
+					yanked: entry.yanked,
+					inner: PackageResponseInner::new(entry),
+				},
+			);
+		}
+
+		PackageVersionsResponse {
+			name: name.to_string(),
+			deprecated: file.meta.deprecated.clone(),
+			versions,
+		}
+	}
+}
+
+pub async fn read_package(
+	app_state: &AppState,
+	package: &PackageName,
+	source: &PesdePackageSource,
+) -> Result<Option<IndexFile>, crate::error::RegistryError> {
+	let path = source.path(&app_state.project);
+	let package = package.clone();
+	spawn_blocking(move || {
+		let (scope, name) = package.as_str();
+		let repo = gix::open(path)?;
+		let tree = root_tree(&repo)?;
+
+		let Some(versions) = read_file(&tree, [scope, name])? else {
+			return Ok(None);
+		};
+
+		toml::de::from_str(&versions).map_err(Into::into)
+	})
+	.await
+	.unwrap()
+}
+
+pub async fn read_scope_info(
+	app_state: &AppState,
+	scope: &str,
+	source: &PesdePackageSource,
+) -> Result<Option<ScopeInfo>, crate::error::RegistryError> {
+	let path = source.path(&app_state.project);
+	let scope = scope.to_string();
+	spawn_blocking(move || {
+		let repo = gix::open(path)?;
+		let tree = root_tree(&repo)?;
+
+		let Some(versions) = read_file(&tree, [&*scope, SCOPE_INFO_FILE])? else {
+			return Ok(None);
+		};
+
+		toml::de::from_str(&versions).map_err(Into::into)
+	})
+	.await
+	.unwrap()
 }

registry/src/request_path.rs

@@ -0,0 +1,99 @@
+use pesde::{
+	manifest::target::TargetKind,
+	source::{ids::VersionId, pesde::IndexFile},
+};
+use semver::Version;
+use serde::{Deserialize, Deserializer};
+
+#[derive(Debug)]
+pub enum LatestOrSpecificVersion {
+	Latest,
+	Specific(Version),
+}
+
+impl<'de> Deserialize<'de> for LatestOrSpecificVersion {
+	fn deserialize<D>(deserializer: D) -> Result<LatestOrSpecificVersion, D::Error>
+	where
+		D: Deserializer<'de>,
+	{
+		let s = String::deserialize(deserializer)?;
+		if s.eq_ignore_ascii_case("latest") {
+			return Ok(LatestOrSpecificVersion::Latest);
+		}
+
+		s.parse()
+			.map(LatestOrSpecificVersion::Specific)
+			.map_err(serde::de::Error::custom)
+	}
+}
+
+#[derive(Debug)]
+pub enum AnyOrSpecificTarget {
+	Any,
+	Specific(TargetKind),
+}
+
+impl<'de> Deserialize<'de> for AnyOrSpecificTarget {
+	fn deserialize<D>(deserializer: D) -> Result<AnyOrSpecificTarget, D::Error>
+	where
+		D: Deserializer<'de>,
+	{
+		let s = String::deserialize(deserializer)?;
+		if s.eq_ignore_ascii_case("any") {
+			return Ok(AnyOrSpecificTarget::Any);
+		}
+
+		s.parse()
+			.map(AnyOrSpecificTarget::Specific)
+			.map_err(serde::de::Error::custom)
+	}
+}
+
+pub fn resolve_version_and_target(
+	file: &IndexFile,
+	version: LatestOrSpecificVersion,
+	target: AnyOrSpecificTarget,
+) -> Option<&VersionId> {
+	let version = match version {
+		LatestOrSpecificVersion::Latest => match file.entries.keys().map(|k| k.version()).max() {
+			Some(latest) => latest.clone(),
+			None => return None,
+		},
+		LatestOrSpecificVersion::Specific(version) => version,
+	};
+
+	let mut versions = file
+		.entries
+		.iter()
+		.filter(|(v_id, _)| *v_id.version() == version);
+
+	match target {
+		AnyOrSpecificTarget::Any => versions.min_by_key(|(v_id, _)| v_id.target()),
+		AnyOrSpecificTarget::Specific(kind) => {
+			versions.find(|(_, entry)| entry.target.kind() == kind)
+		}
+	}
+	.map(|(v_id, _)| v_id)
+}
+
+#[derive(Debug)]
+pub enum AllOrSpecificTarget {
+	All,
+	Specific(TargetKind),
+}
+
+impl<'de> Deserialize<'de> for AllOrSpecificTarget {
+	fn deserialize<D>(deserializer: D) -> Result<AllOrSpecificTarget, D::Error>
+	where
+		D: Deserializer<'de>,
+	{
+		let s = String::deserialize(deserializer)?;
+		if s.eq_ignore_ascii_case("all") {
+			return Ok(AllOrSpecificTarget::All);
+		}
+
+		s.parse()
+			.map(AllOrSpecificTarget::Specific)
+			.map_err(serde::de::Error::custom)
+	}
+}

registry/src/search.rs

@@ -2,147 +2,188 @@ use crate::AppState;
 use async_stream::stream;
 use futures::{Stream, StreamExt};
 use pesde::{
-    names::PackageName,
+	names::PackageName,
-    source::{
+	source::{
-        git_index::{root_tree, GitBasedSource},
+		git_index::{root_tree, GitBasedSource},
-        pesde::{IndexFile, IndexFileEntry, PesdePackageSource, SCOPE_INFO_FILE},
+		ids::VersionId,
-    },
+		pesde::{IndexFile, IndexFileEntry, PesdePackageSource, SCOPE_INFO_FILE},
-    Project,
+	},
+	Project,
 };
 use tantivy::{
-    doc,
+	doc,
-    query::QueryParser,
+	query::QueryParser,
-    schema::{IndexRecordOption, TextFieldIndexing, TextOptions, FAST, STORED, STRING},
+	schema::{IndexRecordOption, TextFieldIndexing, TextOptions, FAST, STORED, STRING},
-    tokenizer::TextAnalyzer,
+	tokenizer::TextAnalyzer,
-    DateTime, IndexReader, IndexWriter, Term,
+	DateTime, IndexReader, IndexWriter, Term,
 };
 use tokio::pin;
 
-pub async fn all_packages(
+async fn all_packages(
-    source: &PesdePackageSource,
+	source: &PesdePackageSource,
-    project: &Project,
+	project: &Project,
 ) -> impl Stream<Item = (PackageName, IndexFile)> {
-    let path = source.path(project);
+	let path = source.path(project);
 
-    stream! {
+	stream! {
-        let repo = gix::open(&path).expect("failed to open index");
+		let repo = gix::open(&path).expect("failed to open index");
-        let tree = root_tree(&repo).expect("failed to get root tree");
+		let tree = root_tree(&repo).expect("failed to get root tree");
 
-        for entry in tree.iter() {
+		for entry in tree.iter() {
-            let entry = entry.expect("failed to read entry");
+			let entry = entry.expect("failed to read entry");
-            let object = entry.object().expect("failed to get object");
+			let object = entry.object().expect("failed to get object");
 
-            // directories will be trees, and files will be blobs
+			// directories will be trees, and files will be blobs
-            if !matches!(object.kind, gix::object::Kind::Tree) {
+			if !matches!(object.kind, gix::object::Kind::Tree) {
-                continue;
+				continue;
-            }
+			}
 
-            let package_scope = entry.filename().to_string();
+			let package_scope = entry.filename().to_string();
 
-            for inner_entry in object.into_tree().iter() {
+			for inner_entry in object.into_tree().iter() {
-                let inner_entry = inner_entry.expect("failed to read inner entry");
+				let inner_entry = inner_entry.expect("failed to read inner entry");
-                let object = inner_entry.object().expect("failed to get object");
+				let object = inner_entry.object().expect("failed to get object");
 
-                if !matches!(object.kind, gix::object::Kind::Blob) {
+				if !matches!(object.kind, gix::object::Kind::Blob) {
-                    continue;
+					continue;
-                }
+				}
 
-                let package_name = inner_entry.filename().to_string();
+				let package_name = inner_entry.filename().to_string();
 
-                if package_name == SCOPE_INFO_FILE {
+				if package_name == SCOPE_INFO_FILE {
-                    continue;
+					continue;
-                }
+				}
 
-                let blob = object.into_blob();
+				let blob = object.into_blob();
-                let string = String::from_utf8(blob.data.clone()).expect("failed to parse utf8");
+				let string = String::from_utf8(blob.data.clone()).expect("failed to parse utf8");
 
-                let file: IndexFile = toml::from_str(&string).expect("failed to parse index file");
+				let file: IndexFile = toml::from_str(&string).expect("failed to parse index file");
 
-                // if this panics, it's an issue with the index.
+				// if this panics, it's an issue with the index.
-                let name = format!("{package_scope}/{package_name}").parse().unwrap();
+				let name = format!("{package_scope}/{package_name}").parse().unwrap();
 
-                yield (name, file);
+				yield (name, file);
-            }
+			}
-        }
+		}
-    }
+	}
+}
+
+pub fn find_max_searchable(file: &IndexFile) -> Option<(&VersionId, &IndexFileEntry)> {
+	file.entries
+		.iter()
+		.filter(|(_, entry)| !entry.yanked)
+		.max_by(|(v_id_a, entry_a), (v_id_b, entry_b)| {
+			v_id_a
+				.version()
+				.cmp(v_id_b.version())
+				.then(entry_a.published_at.cmp(&entry_b.published_at))
+		})
 }
 
 pub async fn make_search(
-    project: &Project,
+	project: &Project,
-    source: &PesdePackageSource,
+	source: &PesdePackageSource,
 ) -> (IndexReader, IndexWriter, QueryParser) {
-    let mut schema_builder = tantivy::schema::SchemaBuilder::new();
+	let mut schema_builder = tantivy::schema::SchemaBuilder::new();
 
-    let field_options = TextOptions::default().set_indexing_options(
+	let field_options = TextOptions::default().set_indexing_options(
-        TextFieldIndexing::default()
+		TextFieldIndexing::default()
-            .set_tokenizer("ngram")
+			.set_tokenizer("ngram")
-            .set_index_option(IndexRecordOption::WithFreqsAndPositions),
+			.set_index_option(IndexRecordOption::WithFreqsAndPositions),
-    );
+	);
 
-    let id_field = schema_builder.add_text_field("id", STRING | STORED);
+	let id_field = schema_builder.add_text_field("id", STRING | STORED);
-    let scope = schema_builder.add_text_field("scope", field_options.clone());
-    let name = schema_builder.add_text_field("name", field_options.clone());
-    let description = schema_builder.add_text_field("description", field_options);
-    let published_at = schema_builder.add_date_field("published_at", FAST);
 
-    let search_index = tantivy::Index::create_in_ram(schema_builder.build());
+	let scope = schema_builder.add_text_field("scope", field_options.clone());
-    search_index.tokenizers().register(
+	let name = schema_builder.add_text_field("name", field_options.clone());
-        "ngram",
+	let description = schema_builder.add_text_field("description", field_options);
-        TextAnalyzer::builder(tantivy::tokenizer::NgramTokenizer::all_ngrams(1, 12).unwrap())
+	let published_at = schema_builder.add_date_field("published_at", FAST);
-            .filter(tantivy::tokenizer::LowerCaser)
-            .build(),
-    );
 
-    let search_reader = search_index
+	let search_index = tantivy::Index::create_in_ram(schema_builder.build());
-        .reader_builder()
+	search_index.tokenizers().register(
-        .reload_policy(tantivy::ReloadPolicy::Manual)
+		"ngram",
-        .try_into()
+		TextAnalyzer::builder(tantivy::tokenizer::NgramTokenizer::all_ngrams(1, 12).unwrap())
-        .unwrap();
+			.filter(tantivy::tokenizer::LowerCaser)
-    let mut search_writer = search_index.writer(50_000_000).unwrap();
+			.build(),
+	);
 
-    let stream = all_packages(source, project).await;
+	let search_reader = search_index
-    pin!(stream);
+		.reader_builder()
+		.reload_policy(tantivy::ReloadPolicy::Manual)
+		.try_into()
+		.unwrap();
+	let mut search_writer = search_index.writer(50_000_000).unwrap();
 
-    while let Some((pkg_name, mut file)) = stream.next().await {
+	let stream = all_packages(source, project).await;
-        let Some((_, latest_entry)) = file.entries.pop_last() else {
+	pin!(stream);
-            tracing::error!("no versions found for {pkg_name}");
-            continue;
-        };
 
-        search_writer.add_document(doc!(
+	while let Some((pkg_name, file)) = stream.next().await {
-            id_field => pkg_name.to_string(),
+		if !file.meta.deprecated.is_empty() {
-            scope => pkg_name.as_str().0,
+			continue;
-            name => pkg_name.as_str().1,
+		}
-            description => latest_entry.description.unwrap_or_default(),
-            published_at => DateTime::from_timestamp_secs(latest_entry.published_at.timestamp()),
-        )).unwrap();
-    }
 
-    search_writer.commit().unwrap();
+		let Some((_, latest_entry)) = find_max_searchable(&file) else {
-    search_reader.reload().unwrap();
+			continue;
+		};
 
-    let mut query_parser = QueryParser::for_index(&search_index, vec![scope, name, description]);
+		search_writer
-    query_parser.set_field_boost(scope, 2.0);
+			.add_document(doc!(
-    query_parser.set_field_boost(name, 3.5);
+				id_field => pkg_name.to_string(),
+				scope => pkg_name.scope(),
+				name => pkg_name.name(),
+				description => latest_entry.description.clone().unwrap_or_default(),
+				published_at => DateTime::from_timestamp_nanos(latest_entry.published_at.as_nanosecond() as i64),
+			))
+			.unwrap();
+	}
 
-    (search_reader, search_writer, query_parser)
+	search_writer.commit().unwrap();
+	search_reader.reload().unwrap();
+
+	let mut query_parser = QueryParser::for_index(&search_index, vec![scope, name, description]);
+	query_parser.set_field_boost(scope, 2.0);
+	query_parser.set_field_boost(name, 3.5);
+
+	(search_reader, search_writer, query_parser)
 }
 
-pub fn update_version(app_state: &AppState, name: &PackageName, entry: IndexFileEntry) {
+pub fn update_search_version(app_state: &AppState, name: &PackageName, entry: &IndexFileEntry) {
-    let mut search_writer = app_state.search_writer.lock().unwrap();
+	let mut search_writer = app_state.search_writer.lock().unwrap();
-    let schema = search_writer.index().schema();
+	let schema = search_writer.index().schema();
-    let id_field = schema.get_field("id").unwrap();
+	let id_field = schema.get_field("id").unwrap();
 
-    search_writer.delete_term(Term::from_field_text(id_field, &name.to_string()));
+	search_writer.delete_term(Term::from_field_text(id_field, &name.to_string()));
 
-    search_writer.add_document(doc!(
+	search_writer.add_document(doc!(
         id_field => name.to_string(),
-        schema.get_field("scope").unwrap() => name.as_str().0,
+        schema.get_field("scope").unwrap() => name.scope(),
-        schema.get_field("name").unwrap() => name.as_str().1,
+        schema.get_field("name").unwrap() => name.name(),
-        schema.get_field("description").unwrap() => entry.description.unwrap_or_default(),
+        schema.get_field("description").unwrap() => entry.description.clone().unwrap_or_default(),
-        schema.get_field("published_at").unwrap() => DateTime::from_timestamp_secs(entry.published_at.timestamp())
+        schema.get_field("published_at").unwrap() => DateTime::from_timestamp_nanos(entry.published_at.as_nanosecond() as i64)
     )).unwrap();
 
-    search_writer.commit().unwrap();
+	search_writer.commit().unwrap();
-    app_state.search_reader.reload().unwrap();
+	app_state.search_reader.reload().unwrap();
+}
+
+pub fn search_version_changed(app_state: &AppState, name: &PackageName, file: &IndexFile) {
+	let entry = if file.meta.deprecated.is_empty() {
+		find_max_searchable(file)
+	} else {
+		None
+	};
+
+	let Some((_, entry)) = entry else {
+		let mut search_writer = app_state.search_writer.lock().unwrap();
+		let schema = search_writer.index().schema();
+		let id_field = schema.get_field("id").unwrap();
+
+		search_writer.delete_term(Term::from_field_text(id_field, &name.to_string()));
+		search_writer.commit().unwrap();
+		app_state.search_reader.reload().unwrap();
+
+		return;
+	};
+
+	update_search_version(app_state, name, entry);
 }

registry/src/storage/fs.rs

@@ -1,126 +1,131 @@
-use crate::{error::Error, storage::StorageImpl};
+use crate::{error::RegistryError, storage::StorageImpl};
 use actix_web::{
-    http::header::{CONTENT_ENCODING, CONTENT_TYPE},
+	http::header::{CONTENT_ENCODING, CONTENT_LENGTH, CONTENT_TYPE},
-    HttpResponse,
+	HttpResponse,
 };
 use fs_err::tokio as fs;
-use pesde::{names::PackageName, source::version_id::VersionId};
+use pesde::{names::PackageName, source::ids::VersionId};
 use std::{
-    fmt::Display,
+	fmt::Display,
-    path::{Path, PathBuf},
+	path::{Path, PathBuf},
 };
+use tokio_util::io::ReaderStream;
 
 #[derive(Debug)]
 pub struct FSStorage {
-    pub root: PathBuf,
+	pub root: PathBuf,
 }
 
-async fn read_file_to_response(path: &Path, content_type: &str) -> Result<HttpResponse, Error> {
+async fn read_file_to_response(
-    Ok(match fs::read(path).await {
+	path: &Path,
-        Ok(contents) => HttpResponse::Ok()
+	content_type: &str,
-            .append_header((CONTENT_TYPE, content_type))
+) -> Result<HttpResponse, RegistryError> {
-            .append_header((CONTENT_ENCODING, "gzip"))
+	Ok(match fs::File::open(path).await {
-            .body(contents),
+		Ok(file) => HttpResponse::Ok()
-        Err(e) if e.kind() == std::io::ErrorKind::NotFound => HttpResponse::NotFound().finish(),
+			.append_header((CONTENT_TYPE, content_type))
-        Err(e) => return Err(e.into()),
+			.append_header((CONTENT_ENCODING, "gzip"))
-    })
+			.append_header((CONTENT_LENGTH, file.metadata().await?.len()))
+			.streaming(ReaderStream::new(file)),
+		Err(e) if e.kind() == std::io::ErrorKind::NotFound => HttpResponse::NotFound().finish(),
+		Err(e) => return Err(e.into()),
+	})
 }
 
 impl StorageImpl for FSStorage {
-    async fn store_package(
+	async fn store_package(
-        &self,
+		&self,
-        package_name: &PackageName,
+		package_name: &PackageName,
-        version: &VersionId,
+		version: &VersionId,
-        contents: Vec<u8>,
+		contents: Vec<u8>,
-    ) -> Result<(), Error> {
+	) -> Result<(), RegistryError> {
-        let (scope, name) = package_name.as_str();
+		let (scope, name) = package_name.as_str();
 
-        let path = self
+		let path = self
-            .root
+			.root
-            .join(scope)
+			.join(scope)
-            .join(name)
+			.join(name)
-            .join(version.version().to_string())
+			.join(version.version().to_string())
-            .join(version.target().to_string());
+			.join(version.target().to_string());
-        fs::create_dir_all(&path).await?;
+		fs::create_dir_all(&path).await?;
 
-        fs::write(path.join("pkg.tar.gz"), &contents).await?;
+		fs::write(path.join("pkg.tar.gz"), &contents).await?;
 
-        Ok(())
+		Ok(())
-    }
+	}
 
-    async fn get_package(
+	async fn get_package(
-        &self,
+		&self,
-        package_name: &PackageName,
+		package_name: &PackageName,
-        version: &VersionId,
+		version: &VersionId,
-    ) -> Result<HttpResponse, Error> {
+	) -> Result<HttpResponse, RegistryError> {
-        let (scope, name) = package_name.as_str();
+		let (scope, name) = package_name.as_str();
 
-        let path = self
+		let path = self
-            .root
+			.root
-            .join(scope)
+			.join(scope)
-            .join(name)
+			.join(name)
-            .join(version.version().to_string())
+			.join(version.version().to_string())
-            .join(version.target().to_string());
+			.join(version.target().to_string());
 
-        read_file_to_response(&path.join("pkg.tar.gz"), "application/gzip").await
+		read_file_to_response(&path.join("pkg.tar.gz"), "application/gzip").await
-    }
+	}
 
-    async fn store_readme(
+	async fn store_readme(
-        &self,
+		&self,
-        package_name: &PackageName,
+		package_name: &PackageName,
-        version: &VersionId,
+		version: &VersionId,
-        contents: Vec<u8>,
+		contents: Vec<u8>,
-    ) -> Result<(), Error> {
+	) -> Result<(), RegistryError> {
-        let (scope, name) = package_name.as_str();
+		let (scope, name) = package_name.as_str();
 
-        let path = self
+		let path = self
-            .root
+			.root
-            .join(scope)
+			.join(scope)
-            .join(name)
+			.join(name)
-            .join(version.version().to_string())
+			.join(version.version().to_string())
-            .join(version.target().to_string());
+			.join(version.target().to_string());
-        fs::create_dir_all(&path).await?;
+		fs::create_dir_all(&path).await?;
 
-        fs::write(path.join("readme.gz"), &contents).await?;
+		fs::write(path.join("readme.gz"), &contents).await?;
 
-        Ok(())
+		Ok(())
-    }
+	}
 
-    async fn get_readme(
+	async fn get_readme(
-        &self,
+		&self,
-        package_name: &PackageName,
+		package_name: &PackageName,
-        version: &VersionId,
+		version: &VersionId,
-    ) -> Result<HttpResponse, Error> {
+	) -> Result<HttpResponse, RegistryError> {
-        let (scope, name) = package_name.as_str();
+		let (scope, name) = package_name.as_str();
 
-        let path = self
+		let path = self
-            .root
+			.root
-            .join(scope)
+			.join(scope)
-            .join(name)
+			.join(name)
-            .join(version.version().to_string())
+			.join(version.version().to_string())
-            .join(version.target().to_string());
+			.join(version.target().to_string());
 
-        read_file_to_response(&path.join("readme.gz"), "text/plain").await
+		read_file_to_response(&path.join("readme.gz"), "text/plain").await
-    }
+	}
 
-    async fn store_doc(&self, doc_hash: String, contents: Vec<u8>) -> Result<(), Error> {
+	async fn store_doc(&self, doc_hash: String, contents: Vec<u8>) -> Result<(), RegistryError> {
-        let path = self.root.join("Doc");
+		let path = self.root.join("Doc");
-        fs::create_dir_all(&path).await?;
+		fs::create_dir_all(&path).await?;
 
-        fs::write(path.join(format!("{doc_hash}.gz")), &contents).await?;
+		fs::write(path.join(format!("{doc_hash}.gz")), &contents).await?;
 
-        Ok(())
+		Ok(())
-    }
+	}
 
-    async fn get_doc(&self, doc_hash: &str) -> Result<HttpResponse, Error> {
+	async fn get_doc(&self, doc_hash: &str) -> Result<HttpResponse, RegistryError> {
-        let path = self.root.join("Doc");
+		let path = self.root.join("Doc");
 
-        read_file_to_response(&path.join(format!("{doc_hash}.gz")), "text/plain").await
+		read_file_to_response(&path.join(format!("{doc_hash}.gz")), "text/plain").await
-    }
+	}
 }
 
 impl Display for FSStorage {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+	fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(f, "FS")
+		write!(f, "FS ({})", self.root.display())
-    }
+	}
 }

registry/src/storage/mod.rs

@@ -1,6 +1,6 @@
-use crate::{benv, error::Error, make_reqwest};
+use crate::{benv, error::RegistryError, make_reqwest};
 use actix_web::HttpResponse;
-use pesde::{names::PackageName, source::version_id::VersionId};
+use pesde::{names::PackageName, source::ids::VersionId};
 use rusty_s3::{Bucket, Credentials, UrlStyle};
 use std::fmt::Display;
 
@@ -9,133 +9,129 @@ mod s3;
 
 #[derive(Debug)]
 pub enum Storage {
-    S3(s3::S3Storage),
+	S3(s3::S3Storage),
-    FS(fs::FSStorage),
+	FS(fs::FSStorage),
 }
 
 pub trait StorageImpl: Display {
-    async fn store_package(
+	async fn store_package(
-        &self,
+		&self,
-        package_name: &PackageName,
+		package_name: &PackageName,
-        version: &VersionId,
+		version: &VersionId,
-        contents: Vec<u8>,
+		contents: Vec<u8>,
-    ) -> Result<(), crate::error::Error>;
+	) -> Result<(), RegistryError>;
-    async fn get_package(
+	async fn get_package(
-        &self,
+		&self,
-        package_name: &PackageName,
+		package_name: &PackageName,
-        version: &VersionId,
+		version: &VersionId,
-    ) -> Result<HttpResponse, crate::error::Error>;
+	) -> Result<HttpResponse, RegistryError>;
 
-    async fn store_readme(
+	async fn store_readme(
-        &self,
+		&self,
-        package_name: &PackageName,
+		package_name: &PackageName,
-        version: &VersionId,
+		version: &VersionId,
-        contents: Vec<u8>,
+		contents: Vec<u8>,
-    ) -> Result<(), crate::error::Error>;
+	) -> Result<(), RegistryError>;
-    async fn get_readme(
+	async fn get_readme(
-        &self,
+		&self,
-        package_name: &PackageName,
+		package_name: &PackageName,
-        version: &VersionId,
+		version: &VersionId,
-    ) -> Result<HttpResponse, crate::error::Error>;
+	) -> Result<HttpResponse, RegistryError>;
 
-    async fn store_doc(
+	async fn store_doc(&self, doc_hash: String, contents: Vec<u8>) -> Result<(), RegistryError>;
-        &self,
+	async fn get_doc(&self, doc_hash: &str) -> Result<HttpResponse, RegistryError>;
-        doc_hash: String,
-        contents: Vec<u8>,
-    ) -> Result<(), crate::error::Error>;
-    async fn get_doc(&self, doc_hash: &str) -> Result<HttpResponse, crate::error::Error>;
 }
 
 impl StorageImpl for Storage {
-    async fn store_package(
+	async fn store_package(
-        &self,
+		&self,
-        package_name: &PackageName,
+		package_name: &PackageName,
-        version: &VersionId,
+		version: &VersionId,
-        contents: Vec<u8>,
+		contents: Vec<u8>,
-    ) -> Result<(), Error> {
+	) -> Result<(), RegistryError> {
-        match self {
+		match self {
-            Storage::S3(s3) => s3.store_package(package_name, version, contents).await,
+			Storage::S3(s3) => s3.store_package(package_name, version, contents).await,
-            Storage::FS(fs) => fs.store_package(package_name, version, contents).await,
+			Storage::FS(fs) => fs.store_package(package_name, version, contents).await,
-        }
+		}
-    }
+	}
 
-    async fn get_package(
+	async fn get_package(
-        &self,
+		&self,
-        package_name: &PackageName,
+		package_name: &PackageName,
-        version: &VersionId,
+		version: &VersionId,
-    ) -> Result<HttpResponse, Error> {
+	) -> Result<HttpResponse, RegistryError> {
-        match self {
+		match self {
-            Storage::S3(s3) => s3.get_package(package_name, version).await,
+			Storage::S3(s3) => s3.get_package(package_name, version).await,
-            Storage::FS(fs) => fs.get_package(package_name, version).await,
+			Storage::FS(fs) => fs.get_package(package_name, version).await,
-        }
+		}
-    }
+	}
 
-    async fn store_readme(
+	async fn store_readme(
-        &self,
+		&self,
-        package_name: &PackageName,
+		package_name: &PackageName,
-        version: &VersionId,
+		version: &VersionId,
-        contents: Vec<u8>,
+		contents: Vec<u8>,
-    ) -> Result<(), Error> {
+	) -> Result<(), RegistryError> {
-        match self {
+		match self {
-            Storage::S3(s3) => s3.store_readme(package_name, version, contents).await,
+			Storage::S3(s3) => s3.store_readme(package_name, version, contents).await,
-            Storage::FS(fs) => fs.store_readme(package_name, version, contents).await,
+			Storage::FS(fs) => fs.store_readme(package_name, version, contents).await,
-        }
+		}
-    }
+	}
 
-    async fn get_readme(
+	async fn get_readme(
-        &self,
+		&self,
-        package_name: &PackageName,
+		package_name: &PackageName,
-        version: &VersionId,
+		version: &VersionId,
-    ) -> Result<HttpResponse, Error> {
+	) -> Result<HttpResponse, RegistryError> {
-        match self {
+		match self {
-            Storage::S3(s3) => s3.get_readme(package_name, version).await,
+			Storage::S3(s3) => s3.get_readme(package_name, version).await,
-            Storage::FS(fs) => fs.get_readme(package_name, version).await,
+			Storage::FS(fs) => fs.get_readme(package_name, version).await,
-        }
+		}
-    }
+	}
 
-    async fn store_doc(&self, doc_hash: String, contents: Vec<u8>) -> Result<(), Error> {
+	async fn store_doc(&self, doc_hash: String, contents: Vec<u8>) -> Result<(), RegistryError> {
-        match self {
+		match self {
-            Storage::S3(s3) => s3.store_doc(doc_hash, contents).await,
+			Storage::S3(s3) => s3.store_doc(doc_hash, contents).await,
-            Storage::FS(fs) => fs.store_doc(doc_hash, contents).await,
+			Storage::FS(fs) => fs.store_doc(doc_hash, contents).await,
-        }
+		}
-    }
+	}
 
-    async fn get_doc(&self, doc_hash: &str) -> Result<HttpResponse, Error> {
+	async fn get_doc(&self, doc_hash: &str) -> Result<HttpResponse, RegistryError> {
-        match self {
+		match self {
-            Storage::S3(s3) => s3.get_doc(doc_hash).await,
+			Storage::S3(s3) => s3.get_doc(doc_hash).await,
-            Storage::FS(fs) => fs.get_doc(doc_hash).await,
+			Storage::FS(fs) => fs.get_doc(doc_hash).await,
-        }
+		}
-    }
+	}
 }
 
 impl Display for Storage {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+	fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
+		match self {
-            Storage::S3(s3) => write!(f, "{}", s3),
+			Storage::S3(s3) => write!(f, "{}", s3),
-            Storage::FS(fs) => write!(f, "{}", fs),
+			Storage::FS(fs) => write!(f, "{}", fs),
-        }
+		}
-    }
+	}
 }
 
 pub fn get_storage_from_env() -> Storage {
-    if let Ok(endpoint) = benv!(parse "S3_ENDPOINT") {
+	if let Ok(endpoint) = benv!(parse "S3_ENDPOINT") {
-        Storage::S3(s3::S3Storage {
+		Storage::S3(s3::S3Storage {
-            s3_bucket: Bucket::new(
+			bucket: Bucket::new(
-                endpoint,
+				endpoint,
-                UrlStyle::Path,
+				UrlStyle::Path,
-                benv!(required "S3_BUCKET_NAME"),
+				benv!(required "S3_BUCKET_NAME"),
-                benv!(required "S3_REGION"),
+				benv!(required "S3_REGION"),
-            )
+			)
-            .unwrap(),
+			.unwrap(),
-            s3_credentials: Credentials::new(
+			credentials: Credentials::new(
-                benv!(required "S3_ACCESS_KEY"),
+				benv!(required "S3_ACCESS_KEY"),
-                benv!(required "S3_SECRET_KEY"),
+				benv!(required "S3_SECRET_KEY"),
-            ),
+			),
-            reqwest_client: make_reqwest(),
+			reqwest_client: make_reqwest(),
-        })
+		})
-    } else if let Ok(root) = benv!(parse "FS_STORAGE_ROOT") {
+	} else if let Ok(root) = benv!(parse "FS_STORAGE_ROOT") {
-        Storage::FS(fs::FSStorage { root })
+		Storage::FS(fs::FSStorage { root })
-    } else {
+	} else {
-        panic!("no storage backend configured")
+		panic!("no storage backend configured")
-    }
+	}
 }

registry/src/storage/s3.rs

@@ -1,166 +1,166 @@
 use crate::{
-    error::{Error, ReqwestErrorExt},
+	error::{RegistryError, ReqwestErrorExt},
-    storage::StorageImpl,
+	storage::StorageImpl,
 };
 use actix_web::{http::header::LOCATION, HttpResponse};
-use pesde::{names::PackageName, source::version_id::VersionId};
+use pesde::{names::PackageName, source::ids::VersionId};
 use reqwest::header::{CONTENT_ENCODING, CONTENT_TYPE};
 use rusty_s3::{
-    actions::{GetObject, PutObject},
+	actions::{GetObject, PutObject},
-    Bucket, Credentials, S3Action,
+	Bucket, Credentials, S3Action,
 };
 use std::{fmt::Display, time::Duration};
 
 #[derive(Debug)]
 pub struct S3Storage {
-    pub s3_bucket: Bucket,
+	pub bucket: Bucket,
-    pub s3_credentials: Credentials,
+	pub credentials: Credentials,
-    pub reqwest_client: reqwest::Client,
+	pub reqwest_client: reqwest::Client,
 }
 
 pub const S3_SIGN_DURATION: Duration = Duration::from_secs(60 * 15);
 
 impl StorageImpl for S3Storage {
-    async fn store_package(
+	async fn store_package(
-        &self,
+		&self,
-        package_name: &PackageName,
+		package_name: &PackageName,
-        version: &VersionId,
+		version: &VersionId,
-        contents: Vec<u8>,
+		contents: Vec<u8>,
-    ) -> Result<(), Error> {
+	) -> Result<(), RegistryError> {
-        let object_url = PutObject::new(
+		let object_url = PutObject::new(
-            &self.s3_bucket,
+			&self.bucket,
-            Some(&self.s3_credentials),
+			Some(&self.credentials),
-            &format!(
+			&format!(
-                "{package_name}/{}/{}/pkg.tar.gz",
+				"{package_name}/{}/{}/pkg.tar.gz",
-                version.version(),
+				version.version(),
-                version.target()
+				version.target()
-            ),
+			),
-        )
+		)
-        .sign(S3_SIGN_DURATION);
+		.sign(S3_SIGN_DURATION);
 
-        self.reqwest_client
+		self.reqwest_client
-            .put(object_url)
+			.put(object_url)
-            .header(CONTENT_TYPE, "application/gzip")
+			.header(CONTENT_TYPE, "application/gzip")
-            .header(CONTENT_ENCODING, "gzip")
+			.header(CONTENT_ENCODING, "gzip")
-            .body(contents)
+			.body(contents)
-            .send()
+			.send()
-            .await?
+			.await?
-            .into_error()
+			.into_error()
-            .await?;
+			.await?;
 
-        Ok(())
+		Ok(())
-    }
+	}
 
-    async fn get_package(
+	async fn get_package(
-        &self,
+		&self,
-        package_name: &PackageName,
+		package_name: &PackageName,
-        version: &VersionId,
+		version: &VersionId,
-    ) -> Result<HttpResponse, Error> {
+	) -> Result<HttpResponse, RegistryError> {
-        let object_url = GetObject::new(
+		let object_url = GetObject::new(
-            &self.s3_bucket,
+			&self.bucket,
-            Some(&self.s3_credentials),
+			Some(&self.credentials),
-            &format!(
+			&format!(
-                "{package_name}/{}/{}/pkg.tar.gz",
+				"{package_name}/{}/{}/pkg.tar.gz",
-                version.version(),
+				version.version(),
-                version.target()
+				version.target()
-            ),
+			),
-        )
+		)
-        .sign(S3_SIGN_DURATION);
+		.sign(S3_SIGN_DURATION);
 
-        Ok(HttpResponse::TemporaryRedirect()
+		Ok(HttpResponse::TemporaryRedirect()
-            .append_header((LOCATION, object_url.as_str()))
+			.append_header((LOCATION, object_url.as_str()))
-            .finish())
+			.finish())
-    }
+	}
 
-    async fn store_readme(
+	async fn store_readme(
-        &self,
+		&self,
-        package_name: &PackageName,
+		package_name: &PackageName,
-        version: &VersionId,
+		version: &VersionId,
-        contents: Vec<u8>,
+		contents: Vec<u8>,
-    ) -> Result<(), Error> {
+	) -> Result<(), RegistryError> {
-        let object_url = PutObject::new(
+		let object_url = PutObject::new(
-            &self.s3_bucket,
+			&self.bucket,
-            Some(&self.s3_credentials),
+			Some(&self.credentials),
-            &format!(
+			&format!(
-                "{package_name}/{}/{}/readme.gz",
+				"{package_name}/{}/{}/readme.gz",
-                version.version(),
+				version.version(),
-                version.target()
+				version.target()
-            ),
+			),
-        )
+		)
-        .sign(S3_SIGN_DURATION);
+		.sign(S3_SIGN_DURATION);
 
-        self.reqwest_client
+		self.reqwest_client
-            .put(object_url)
+			.put(object_url)
-            .header(CONTENT_TYPE, "text/plain")
+			.header(CONTENT_TYPE, "text/plain")
-            .header(CONTENT_ENCODING, "gzip")
+			.header(CONTENT_ENCODING, "gzip")
-            .body(contents)
+			.body(contents)
-            .send()
+			.send()
-            .await?
+			.await?
-            .into_error()
+			.into_error()
-            .await?;
+			.await?;
 
-        Ok(())
+		Ok(())
-    }
+	}
 
-    async fn get_readme(
+	async fn get_readme(
-        &self,
+		&self,
-        package_name: &PackageName,
+		package_name: &PackageName,
-        version: &VersionId,
+		version: &VersionId,
-    ) -> Result<HttpResponse, Error> {
+	) -> Result<HttpResponse, RegistryError> {
-        let object_url = GetObject::new(
+		let object_url = GetObject::new(
-            &self.s3_bucket,
+			&self.bucket,
-            Some(&self.s3_credentials),
+			Some(&self.credentials),
-            &format!(
+			&format!(
-                "{package_name}/{}/{}/readme.gz",
+				"{package_name}/{}/{}/readme.gz",
-                version.version(),
+				version.version(),
-                version.target()
+				version.target()
-            ),
+			),
-        )
+		)
-        .sign(S3_SIGN_DURATION);
+		.sign(S3_SIGN_DURATION);
 
-        Ok(HttpResponse::TemporaryRedirect()
+		Ok(HttpResponse::TemporaryRedirect()
-            .append_header((LOCATION, object_url.as_str()))
+			.append_header((LOCATION, object_url.as_str()))
-            .finish())
+			.finish())
-    }
+	}
 
-    async fn store_doc(&self, doc_hash: String, contents: Vec<u8>) -> Result<(), Error> {
+	async fn store_doc(&self, doc_hash: String, contents: Vec<u8>) -> Result<(), RegistryError> {
-        let object_url = PutObject::new(
+		let object_url = PutObject::new(
-            &self.s3_bucket,
+			&self.bucket,
-            Some(&self.s3_credentials),
+			Some(&self.credentials),
-            // capitalize Doc to prevent conflicts with scope names
+			// capitalize Doc to prevent conflicts with scope names
-            &format!("Doc/{}.gz", doc_hash),
+			&format!("Doc/{}.gz", doc_hash),
-        )
+		)
-        .sign(S3_SIGN_DURATION);
+		.sign(S3_SIGN_DURATION);
 
-        self.reqwest_client
+		self.reqwest_client
-            .put(object_url)
+			.put(object_url)
-            .header(CONTENT_TYPE, "text/plain")
+			.header(CONTENT_TYPE, "text/plain")
-            .header(CONTENT_ENCODING, "gzip")
+			.header(CONTENT_ENCODING, "gzip")
-            .body(contents)
+			.body(contents)
-            .send()
+			.send()
-            .await?
+			.await?
-            .into_error()
+			.into_error()
-            .await?;
+			.await?;
 
-        Ok(())
+		Ok(())
-    }
+	}
 
-    async fn get_doc(&self, doc_hash: &str) -> Result<HttpResponse, Error> {
+	async fn get_doc(&self, doc_hash: &str) -> Result<HttpResponse, RegistryError> {
-        let object_url = GetObject::new(
+		let object_url = GetObject::new(
-            &self.s3_bucket,
+			&self.bucket,
-            Some(&self.s3_credentials),
+			Some(&self.credentials),
-            &format!("Doc/{}.gz", doc_hash),
+			&format!("Doc/{}.gz", doc_hash),
-        )
+		)
-        .sign(S3_SIGN_DURATION);
+		.sign(S3_SIGN_DURATION);
 
-        Ok(HttpResponse::TemporaryRedirect()
+		Ok(HttpResponse::TemporaryRedirect()
-            .append_header((LOCATION, object_url.as_str()))
+			.append_header((LOCATION, object_url.as_str()))
-            .finish())
+			.finish())
-    }
+	}
 }
 
 impl Display for S3Storage {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+	fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(f, "S3")
+		write!(f, "S3 (bucket name: {})", self.bucket.name())
-    }
+	}
 }

rustfmt.toml

@@ -1 +1,2 @@
 imports_granularity = "Crate"
+hard_tabs = true

src/cli/auth.rs

@@ -5,115 +5,129 @@ use keyring::Entry;
 use reqwest::header::AUTHORIZATION;
 use serde::{ser::SerializeMap, Deserialize, Serialize};
 use std::collections::BTreeMap;
+use tokio::task::spawn_blocking;
 use tracing::instrument;
 
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, Default)]
 pub struct Tokens(pub BTreeMap<gix::Url, String>);
 
 impl Serialize for Tokens {
-    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+	fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
-    where
+	where
-        S: serde::ser::Serializer,
+		S: serde::ser::Serializer,
-    {
+	{
-        let mut map = serializer.serialize_map(Some(self.0.len()))?;
+		let mut map = serializer.serialize_map(Some(self.0.len()))?;
-        for (k, v) in &self.0 {
+		for (k, v) in &self.0 {
-            map.serialize_entry(&k.to_bstring().to_string(), v)?;
+			map.serialize_entry(&k.to_bstring().to_string(), v)?;
-        }
+		}
-        map.end()
+		map.end()
-    }
+	}
 }
 
 impl<'de> Deserialize<'de> for Tokens {
-    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+	fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where
+	where
-        D: serde::de::Deserializer<'de>,
+		D: serde::de::Deserializer<'de>,
-    {
+	{
-        Ok(Tokens(
+		Ok(Tokens(
-            BTreeMap::<String, String>::deserialize(deserializer)?
+			BTreeMap::<String, String>::deserialize(deserializer)?
-                .into_iter()
+				.into_iter()
-                .map(|(k, v)| gix::Url::from_bytes(BStr::new(&k)).map(|k| (k, v)))
+				.map(|(k, v)| gix::Url::from_bytes(BStr::new(&k)).map(|k| (k, v)))
-                .collect::<Result<_, _>>()
+				.collect::<Result<_, _>>()
-                .map_err(serde::de::Error::custom)?,
+				.map_err(serde::de::Error::custom)?,
-        ))
+		))
-    }
+	}
 }
 
 #[instrument(level = "trace")]
 pub async fn get_tokens() -> anyhow::Result<Tokens> {
-    let config = read_config().await?;
+	let config = read_config().await?;
-    if !config.tokens.0.is_empty() {
+	if !config.tokens.0.is_empty() {
-        tracing::debug!("using tokens from config");
+		tracing::debug!("using tokens from config");
-        return Ok(config.tokens);
+		return Ok(config.tokens);
-    }
+	}
 
-    match Entry::new("tokens", env!("CARGO_PKG_NAME")) {
+	let keyring_tokens = spawn_blocking(|| match Entry::new("tokens", env!("CARGO_PKG_NAME")) {
-        Ok(entry) => match entry.get_password() {
+		Ok(entry) => match entry.get_password() {
-            Ok(token) => {
+			Ok(token) => serde_json::from_str(&token)
-                tracing::debug!("using tokens from keyring");
+				.map(Some)
-                return serde_json::from_str(&token).context("failed to parse tokens");
+				.context("failed to parse tokens"),
-            }
+			Err(keyring::Error::PlatformFailure(_) | keyring::Error::NoEntry) => Ok(None),
-            Err(keyring::Error::PlatformFailure(_) | keyring::Error::NoEntry) => {}
+			Err(e) => Err(e.into()),
-            Err(e) => return Err(e.into()),
+		},
-        },
+		Err(keyring::Error::PlatformFailure(_)) => Ok(None),
-        Err(keyring::Error::PlatformFailure(_)) => {}
+		Err(e) => Err(e.into()),
-        Err(e) => return Err(e.into()),
+	})
-    }
+	.await
+	.unwrap()?;
 
-    Ok(Tokens(BTreeMap::new()))
+	if let Some(tokens) = keyring_tokens {
+		tracing::debug!("using tokens from keyring");
+		return Ok(tokens);
+	}
+
+	Ok(Tokens::default())
 }
 
 #[instrument(level = "trace")]
 pub async fn set_tokens(tokens: Tokens) -> anyhow::Result<()> {
-    let entry = Entry::new("tokens", env!("CARGO_PKG_NAME"))?;
+	let json = serde_json::to_string(&tokens).context("failed to serialize tokens")?;
-    let json = serde_json::to_string(&tokens).context("failed to serialize tokens")?;
 
-    match entry.set_password(&json) {
+	let to_keyring = spawn_blocking(move || {
-        Ok(()) => {
+		let entry = Entry::new("tokens", env!("CARGO_PKG_NAME"))?;
-            tracing::debug!("tokens saved to keyring");
-            return Ok(());
-        }
-        Err(keyring::Error::PlatformFailure(_) | keyring::Error::NoEntry) => {}
-        Err(e) => return Err(e.into()),
-    }
 
-    tracing::debug!("tokens saved to config");
+		match entry.set_password(&json) {
+			Ok(()) => Ok::<_, anyhow::Error>(true),
+			Err(keyring::Error::PlatformFailure(_) | keyring::Error::NoEntry) => Ok(false),
+			Err(e) => Err(e.into()),
+		}
+	})
+	.await
+	.unwrap()?;
 
-    let mut config = read_config().await?;
+	if to_keyring {
-    config.tokens = tokens;
+		tracing::debug!("tokens saved to keyring");
-    write_config(&config).await.map_err(Into::into)
+		return Ok(());
+	}
+
+	tracing::debug!("saving tokens to config");
+
+	let mut config = read_config().await?;
+	config.tokens = tokens;
+	write_config(&config).await
 }
 
 pub async fn set_token(repo: &gix::Url, token: Option<&str>) -> anyhow::Result<()> {
-    let mut tokens = get_tokens().await?;
+	let mut tokens = get_tokens().await?;
-    if let Some(token) = token {
+	if let Some(token) = token {
-        tokens.0.insert(repo.clone(), token.to_string());
+		tokens.0.insert(repo.clone(), token.to_string());
-    } else {
+	} else {
-        tokens.0.remove(repo);
+		tokens.0.remove(repo);
-    }
+	}
-    set_tokens(tokens).await
+	set_tokens(tokens).await
 }
 
 #[derive(Debug, Deserialize)]
 struct UserResponse {
-    login: String,
+	login: String,
 }
 
 #[instrument(level = "trace")]
 pub async fn get_token_login(
-    reqwest: &reqwest::Client,
+	reqwest: &reqwest::Client,
-    access_token: &str,
+	access_token: &str,
 ) -> anyhow::Result<String> {
-    let response = reqwest
+	let response = reqwest
-        .get("https://api.github.com/user")
+		.get("https://api.github.com/user")
-        .header(AUTHORIZATION, access_token)
+		.header(AUTHORIZATION, access_token)
-        .send()
+		.send()
-        .await
+		.await
-        .context("failed to send user request")?
+		.context("failed to send user request")?
-        .error_for_status()
+		.error_for_status()
-        .context("failed to get user")?
+		.context("failed to get user")?
-        .json::<UserResponse>()
+		.json::<UserResponse>()
-        .await
+		.await
-        .context("failed to parse user response")?;
+		.context("failed to parse user response")?;
 
-    Ok(response.login)
+	Ok(response.login)
 }

src/cli/bin_link.luau

@@ -0,0 +1,81 @@
+local process = require("@lune/process")
+local fs = require("@lune/fs")
+local stdio = require("@lune/stdio")
+local serde = require("@lune/serde")
+
+local project_root = nil
+local path_components = string.split(string.gsub(process.cwd, "\\", "/"), "/")
+if path_components[#path_components] == "" then
+    table.remove(path_components)
+end
+
+local function in_lockfile(lockfile)
+    if not lockfile.graph then
+        return false
+    end
+    
+    for _, versions in lockfile.graph do
+        for _, node in versions do
+            if node.direct and node.direct[1] == "{alias}" then
+                return true
+            end
+        end
+    end
+    
+    return false
+end
+
+for i = #path_components, 1, -1 do
+    local path = table.concat(path_components, "/", 1, i)
+    if not fs.isFile(path .. "/{MANIFEST_FILE_NAME}") then
+        continue
+    end
+    
+    if project_root == nil then
+        project_root = path
+    end
+    
+    if project_root and fs.isFile(path .. "/{LOCKFILE_FILE_NAME}") then
+        local lockfile = serde.decode("toml", fs.readFile(path .. "/{LOCKFILE_FILE_NAME}"))
+        if not lockfile.workspace then
+            continue
+        end
+        
+        local search_for = string.gsub(project_root, path, "")
+        if string.sub(search_for, 1, 1) == "/" then
+            search_for = string.sub(search_for, 2)
+        end
+        
+        if search_for == "" then
+            if in_lockfile(lockfile) then
+                break
+            end
+            
+            continue
+        end
+        
+        for _, targets in lockfile.workspace do
+            for _, member_path in targets do
+                local path_normalized = string.gsub(member_path, "\\", "/")
+                if path_normalized == search_for and in_lockfile(lockfile) then
+                    project_root = path
+                    break
+                end
+            end
+        end
+    end
+end
+
+if project_root ~= nil then
+    for _, packages_folder in {{ {all_folders} }} do
+        local path = `{{project_root}}/{{packages_folder}}/{alias}.bin.luau`
+        
+        if fs.isFile(path) then
+            require(path)
+            return
+        end
+    end
+end
+
+stdio.ewrite(stdio.color("red") .. "binary `{alias}` not found. are you in the right directory?" .. stdio.color("reset") .. "\n")
+process.exit(1)

src/cli/commands/add.rs

@@ -1,250 +1,273 @@
-use std::{collections::HashSet, str::FromStr};
+use std::str::FromStr;
 
 use anyhow::Context;
 use clap::Args;
-use colored::Colorize;
 use semver::VersionReq;
 
-use crate::cli::{config::read_config, AnyPackageIdentifier, VersionedPackageName};
+use crate::cli::{
+	config::read_config, dep_type_to_key, AnyPackageIdentifier, VersionedPackageName,
+};
 use pesde::{
-    manifest::target::TargetKind,
+	manifest::{target::TargetKind, Alias, DependencyType},
-    names::PackageNames,
+	names::PackageNames,
-    source::{
+	source::{
-        git::{specifier::GitDependencySpecifier, GitPackageSource},
+		git::{specifier::GitDependencySpecifier, GitPackageSource},
-        pesde::{specifier::PesdeDependencySpecifier, PesdePackageSource},
+		path::{specifier::PathDependencySpecifier, PathPackageSource},
-        specifiers::DependencySpecifiers,
+		pesde::{specifier::PesdeDependencySpecifier, PesdePackageSource},
-        traits::PackageSource,
+		specifiers::DependencySpecifiers,
-        workspace::WorkspacePackageSource,
+		traits::{PackageSource, RefreshOptions, ResolveOptions},
-        PackageSources,
+		workspace::{specifier::WorkspaceDependencySpecifier, WorkspacePackageSource},
-    },
+		PackageSources,
-    Project, DEFAULT_INDEX_NAME,
+	},
+	Project, RefreshedSources, DEFAULT_INDEX_NAME,
 };
 
 #[derive(Debug, Args)]
 pub struct AddCommand {
-    /// The package name to add
+	/// The package name to add
-    #[arg(index = 1)]
+	#[arg(index = 1)]
-    name: AnyPackageIdentifier<VersionReq>,
+	name: AnyPackageIdentifier<VersionReq>,
 
-    /// The index in which to search for the package
+	/// The index in which to search for the package
-    #[arg(short, long)]
+	#[arg(short, long)]
-    index: Option<String>,
+	index: Option<String>,
 
-    /// The target environment of the package
+	/// The target environment of the package
-    #[arg(short, long)]
+	#[arg(short, long)]
-    target: Option<TargetKind>,
+	target: Option<TargetKind>,
 
-    /// The alias to use for the package
+	/// The alias to use for the package
-    #[arg(short, long)]
+	#[arg(short, long)]
-    alias: Option<String>,
+	alias: Option<Alias>,
 
-    /// Whether to add the package as a peer dependency
+	/// Whether to add the package as a peer dependency
-    #[arg(short, long)]
+	#[arg(short, long)]
-    peer: bool,
+	peer: bool,
 
-    /// Whether to add the package as a dev dependency
+	/// Whether to add the package as a dev dependency
-    #[arg(short, long, conflicts_with = "peer")]
+	#[arg(short, long, conflicts_with = "peer")]
-    dev: bool,
+	dev: bool,
 }
 
 impl AddCommand {
-    pub async fn run(self, project: Project) -> anyhow::Result<()> {
+	pub async fn run(self, project: Project) -> anyhow::Result<()> {
-        let manifest = project
+		let manifest = project
-            .deser_manifest()
+			.deser_manifest()
-            .await
+			.await
-            .context("failed to read manifest")?;
+			.context("failed to read manifest")?;
 
-        let (source, specifier) = match &self.name {
+		let (source, specifier) = match &self.name {
-            AnyPackageIdentifier::PackageName(versioned) => match &versioned {
+			AnyPackageIdentifier::PackageName(versioned) => match &versioned {
-                VersionedPackageName(PackageNames::Pesde(name), version) => {
+				VersionedPackageName(PackageNames::Pesde(name), version) => {
-                    let index = manifest
+					let index = manifest
-                        .indices
+						.indices
-                        .get(self.index.as_deref().unwrap_or(DEFAULT_INDEX_NAME))
+						.get(self.index.as_deref().unwrap_or(DEFAULT_INDEX_NAME))
-                        .cloned();
+						.cloned();
 
-                    if let Some(index) = self.index.as_ref().filter(|_| index.is_none()) {
+					if let Some(index) = self.index.as_ref().filter(|_| index.is_none()) {
-                        println!("{}: index {index} not found", "error".red().bold());
+						anyhow::bail!("index {index} not found");
-                        return Ok(());
+					}
-                    }
 
-                    let index = match index {
+					let index = match index {
-                        Some(index) => index,
+						Some(index) => index,
-                        None => read_config().await?.default_index,
+						None => read_config().await?.default_index,
-                    };
+					};
 
-                    let source = PackageSources::Pesde(PesdePackageSource::new(index));
+					let source = PackageSources::Pesde(PesdePackageSource::new(index));
-                    let specifier = DependencySpecifiers::Pesde(PesdeDependencySpecifier {
+					let specifier = DependencySpecifiers::Pesde(PesdeDependencySpecifier {
-                        name: name.clone(),
+						name: name.clone(),
-                        version: version.clone().unwrap_or(VersionReq::STAR),
+						version: version.clone().unwrap_or(VersionReq::STAR),
-                        index: self.index,
+						index: self.index,
-                        target: self.target,
+						target: self.target,
-                    });
+					});
 
-                    (source, specifier)
+					(source, specifier)
-                }
+				}
-                #[cfg(feature = "wally-compat")]
+				#[cfg(feature = "wally-compat")]
-                VersionedPackageName(PackageNames::Wally(name), version) => {
+				VersionedPackageName(PackageNames::Wally(name), version) => {
-                    let index = manifest
+					let index = manifest
-                        .wally_indices
+						.wally_indices
-                        .get(self.index.as_deref().unwrap_or(DEFAULT_INDEX_NAME))
+						.get(self.index.as_deref().unwrap_or(DEFAULT_INDEX_NAME))
-                        .cloned();
+						.cloned();
 
-                    if let Some(index) = self.index.as_ref().filter(|_| index.is_none()) {
+					if let Some(index) = self.index.as_ref().filter(|_| index.is_none()) {
-                        println!("{}: wally index {index} not found", "error".red().bold());
+						anyhow::bail!("wally index {index} not found");
-                        return Ok(());
+					}
-                    }
 
-                    let index = index.context("no wally index found")?;
+					let index = index.context("no wally index found")?;
 
-                    let source =
+					let source =
-                        PackageSources::Wally(pesde::source::wally::WallyPackageSource::new(index));
+						PackageSources::Wally(pesde::source::wally::WallyPackageSource::new(index));
-                    let specifier = DependencySpecifiers::Wally(
+					let specifier = DependencySpecifiers::Wally(
-                        pesde::source::wally::specifier::WallyDependencySpecifier {
+						pesde::source::wally::specifier::WallyDependencySpecifier {
-                            name: name.clone(),
+							name: name.clone(),
-                            version: version.clone().unwrap_or(VersionReq::STAR),
+							version: version.clone().unwrap_or(VersionReq::STAR),
-                            index: self.index,
+							index: self.index,
-                        },
+						},
-                    );
+					);
 
-                    (source, specifier)
+					(source, specifier)
-                }
+				}
-            },
+			},
-            AnyPackageIdentifier::Url((url, rev)) => (
+			AnyPackageIdentifier::Url((url, rev)) => (
-                PackageSources::Git(GitPackageSource::new(url.clone())),
+				PackageSources::Git(GitPackageSource::new(url.clone())),
-                DependencySpecifiers::Git(GitDependencySpecifier {
+				DependencySpecifiers::Git(GitDependencySpecifier {
-                    repo: url.clone(),
+					repo: url.clone(),
-                    rev: rev.to_string(),
+					rev: rev.to_string(),
-                    path: None,
+					path: None,
-                }),
+				}),
-            ),
+			),
-            AnyPackageIdentifier::Workspace(VersionedPackageName(name, version)) => (
+			AnyPackageIdentifier::Workspace(VersionedPackageName(name, version)) => (
-                PackageSources::Workspace(WorkspacePackageSource),
+				PackageSources::Workspace(WorkspacePackageSource),
-                DependencySpecifiers::Workspace(
+				DependencySpecifiers::Workspace(WorkspaceDependencySpecifier {
-                    pesde::source::workspace::specifier::WorkspaceDependencySpecifier {
+					name: name.clone(),
-                        name: name.clone(),
+					version: version.clone().unwrap_or_default(),
-                        version: version.clone().unwrap_or_default(),
+					target: self.target,
-                        target: self.target,
+				}),
-                    },
+			),
-                ),
+			AnyPackageIdentifier::Path(path) => (
-            ),
+				PackageSources::Path(PathPackageSource),
-        };
+				DependencySpecifiers::Path(PathDependencySpecifier { path: path.clone() }),
-        source
+			),
-            .refresh(&project)
+		};
-            .await
-            .context("failed to refresh package source")?;
 
-        let Some(version_id) = source
+		let refreshed_sources = RefreshedSources::new();
-            .resolve(
-                &specifier,
-                &project,
-                manifest.target.kind(),
-                &mut HashSet::new(),
-            )
-            .await
-            .context("failed to resolve package")?
-            .1
-            .pop_last()
-            .map(|(v_id, _)| v_id)
-        else {
-            println!("{}: no versions found for package", "error".red().bold());
 
-            return Ok(());
+		refreshed_sources
-        };
+			.refresh(
+				&source,
+				&RefreshOptions {
+					project: project.clone(),
+				},
+			)
+			.await
+			.context("failed to refresh package source")?;
 
-        let project_target = manifest.target.kind();
+		let Some(version_id) = source
-        let mut manifest = toml_edit::DocumentMut::from_str(
+			.resolve(
-            &project
+				&specifier,
-                .read_manifest()
+				&ResolveOptions {
-                .await
+					project: project.clone(),
-                .context("failed to read manifest")?,
+					target: manifest.target.kind(),
-        )
+					refreshed_sources,
-        .context("failed to parse manifest")?;
+				},
-        let dependency_key = if self.peer {
+			)
-            "peer_dependencies"
+			.await
-        } else if self.dev {
+			.context("failed to resolve package")?
-            "dev_dependencies"
+			.1
-        } else {
+			.pop_last()
-            "dependencies"
+			.map(|(v_id, _)| v_id)
-        };
+		else {
+			anyhow::bail!("no versions found for package");
+		};
 
-        let alias = self.alias.unwrap_or_else(|| match self.name.clone() {
+		let project_target = manifest.target.kind();
-            AnyPackageIdentifier::PackageName(versioned) => versioned.0.as_str().1.to_string(),
+		let mut manifest = toml_edit::DocumentMut::from_str(
-            AnyPackageIdentifier::Url((url, _)) => url
+			&project
-                .path
+				.read_manifest()
-                .to_string()
+				.await
-                .split('/')
+				.context("failed to read manifest")?,
-                .last()
+		)
-                .map(|s| s.to_string())
+		.context("failed to parse manifest")?;
-                .unwrap_or(url.path.to_string()),
+		let dependency_key = dep_type_to_key(if self.peer {
-            AnyPackageIdentifier::Workspace(versioned) => versioned.0.as_str().1.to_string(),
+			DependencyType::Peer
-        });
+		} else if self.dev {
+			DependencyType::Dev
+		} else {
+			DependencyType::Standard
+		});
 
-        let field = &mut manifest[dependency_key]
+		let alias = match self.alias {
-            .or_insert(toml_edit::Item::Table(toml_edit::Table::new()))[&alias];
+			Some(alias) => alias,
+			None => match &self.name {
+				AnyPackageIdentifier::PackageName(versioned) => versioned.0.name().to_string(),
+				AnyPackageIdentifier::Url((url, _)) => url
+					.path
+					.to_string()
+					.split('/')
+					.next_back()
+					.map(|s| s.to_string())
+					.unwrap_or(url.path.to_string()),
+				AnyPackageIdentifier::Workspace(versioned) => versioned.0.name().to_string(),
+				AnyPackageIdentifier::Path(path) => path
+					.file_name()
+					.map(|s| s.to_string_lossy().to_string())
+					.expect("path has no file name"),
+			}
+			.parse()
+			.context("auto-generated alias is invalid. use --alias to specify one")?,
+		};
 
-        match specifier {
+		let field = &mut manifest[dependency_key]
-            DependencySpecifiers::Pesde(spec) => {
+			.or_insert(toml_edit::Item::Table(toml_edit::Table::new()))[alias.as_str()];
-                field["name"] = toml_edit::value(spec.name.clone().to_string());
-                field["version"] = toml_edit::value(format!("^{}", version_id.version()));
 
-                if *version_id.target() != project_target {
+		match specifier {
-                    field["target"] = toml_edit::value(version_id.target().to_string());
+			DependencySpecifiers::Pesde(spec) => {
-                }
+				field["name"] = toml_edit::value(spec.name.clone().to_string());
+				field["version"] = toml_edit::value(format!("^{}", version_id.version()));
 
-                if let Some(index) = spec.index.filter(|i| i != DEFAULT_INDEX_NAME) {
+				if version_id.target() != project_target {
-                    field["index"] = toml_edit::value(index);
+					field["target"] = toml_edit::value(version_id.target().to_string());
-                }
+				}
 
-                println!(
+				if let Some(index) = spec.index.filter(|i| i != DEFAULT_INDEX_NAME) {
-                    "added {}@{} {} to {}",
+					field["index"] = toml_edit::value(index);
-                    spec.name,
+				}
-                    version_id.version(),
-                    version_id.target(),
-                    dependency_key
-                );
-            }
-            #[cfg(feature = "wally-compat")]
-            DependencySpecifiers::Wally(spec) => {
-                field["wally"] = toml_edit::value(spec.name.clone().to_string());
-                field["version"] = toml_edit::value(format!("^{}", version_id.version()));
 
-                if let Some(index) = spec.index.filter(|i| i != DEFAULT_INDEX_NAME) {
+				println!(
-                    field["index"] = toml_edit::value(index);
+					"added {}@{} {} to {dependency_key}",
-                }
+					spec.name,
+					version_id.version(),
+					version_id.target()
+				);
+			}
+			#[cfg(feature = "wally-compat")]
+			DependencySpecifiers::Wally(spec) => {
+				let name_str = spec.name.to_string();
+				let name_str = name_str.trim_start_matches("wally#");
+				field["wally"] = toml_edit::value(name_str);
+				field["version"] = toml_edit::value(format!("^{}", version_id.version()));
 
-                println!(
+				if let Some(index) = spec.index.filter(|i| i != DEFAULT_INDEX_NAME) {
-                    "added wally {}@{} to {}",
+					field["index"] = toml_edit::value(index);
-                    spec.name,
+				}
-                    version_id.version(),
-                    dependency_key
-                );
-            }
-            DependencySpecifiers::Git(spec) => {
-                field["repo"] = toml_edit::value(spec.repo.to_bstring().to_string());
-                field["rev"] = toml_edit::value(spec.rev.clone());
 
-                println!("added git {}#{} to {}", spec.repo, spec.rev, dependency_key);
+				println!(
-            }
+					"added wally {name_str}@{} to {dependency_key}",
-            DependencySpecifiers::Workspace(spec) => {
+					version_id.version()
-                field["workspace"] = toml_edit::value(spec.name.clone().to_string());
+				);
-                if let AnyPackageIdentifier::Workspace(versioned) = self.name {
+			}
-                    if let Some(version) = versioned.1 {
+			DependencySpecifiers::Git(spec) => {
-                        field["version"] = toml_edit::value(version.to_string());
+				field["repo"] = toml_edit::value(spec.repo.to_bstring().to_string());
-                    }
+				field["rev"] = toml_edit::value(spec.rev.clone());
-                }
 
-                println!(
+				println!("added git {}#{} to {dependency_key}", spec.repo, spec.rev);
-                    "added workspace {}@{} to {}",
+			}
-                    spec.name, spec.version, dependency_key
+			DependencySpecifiers::Workspace(spec) => {
-                );
+				field["workspace"] = toml_edit::value(spec.name.clone().to_string());
-            }
+				if let AnyPackageIdentifier::Workspace(versioned) = self.name {
-        }
+					if let Some(version) = versioned.1 {
+						field["version"] = toml_edit::value(version.to_string());
+					}
+				}
 
-        project
+				println!(
-            .write_manifest(manifest.to_string())
+					"added workspace {}@{} to {dependency_key}",
-            .await
+					spec.name, spec.version
-            .context("failed to write manifest")?;
+				);
+			}
+			DependencySpecifiers::Path(spec) => {
+				field["path"] = toml_edit::value(spec.path.to_string_lossy().to_string());
 
-        Ok(())
+				println!("added path {} to {dependency_key}", spec.path.display());
-    }
+			}
+		}
+
+		project
+			.write_manifest(manifest.to_string())
+			.await
+			.context("failed to write manifest")?;
+
+		Ok(())
+	}
 }

src/cli/commands/auth/login.rs

@@ -1,193 +1,200 @@
 use anyhow::Context;
 use clap::Args;
-use colored::Colorize;
+use console::style;
 use serde::Deserialize;
 use std::thread::spawn;
 use tokio::time::sleep;
 use url::Url;
 
-use pesde::{
+use crate::cli::{
-    source::{pesde::PesdePackageSource, traits::PackageSource},
+	auth::{get_token_login, set_token},
-    Project,
+	style::URL_STYLE,
+};
+use pesde::{
+	source::{
+		pesde::PesdePackageSource,
+		traits::{PackageSource, RefreshOptions},
+	},
+	Project,
 };
-
-use crate::cli::auth::{get_token_login, set_token};
 
 #[derive(Debug, Args)]
 pub struct LoginCommand {
-    /// The token to use for authentication, skipping login
+	/// The token to use for authentication, skipping login
-    #[arg(short, long)]
+	#[arg(short, long)]
-    token: Option<String>,
+	token: Option<String>,
 }
 
 #[derive(Debug, Deserialize)]
 struct DeviceCodeResponse {
-    device_code: String,
+	device_code: String,
-    user_code: String,
+	user_code: String,
-    verification_uri: Url,
+	verification_uri: Url,
-    expires_in: u64,
+	expires_in: u64,
-    interval: u64,
+	interval: u64,
 }
 
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "snake_case", tag = "error")]
 enum AccessTokenError {
-    AuthorizationPending,
+	AuthorizationPending,
-    SlowDown { interval: u64 },
+	SlowDown { interval: u64 },
-    ExpiredToken,
+	ExpiredToken,
-    AccessDenied,
+	AccessDenied,
 }
 
 #[derive(Debug, Deserialize)]
 #[serde(untagged)]
 enum AccessTokenResponse {
-    Success { access_token: String },
+	Success { access_token: String },
 
-    Error(AccessTokenError),
+	Error(AccessTokenError),
 }
 
 impl LoginCommand {
-    pub async fn authenticate_device_flow(
+	pub async fn authenticate_device_flow(
-        &self,
+		&self,
-        index_url: &gix::Url,
+		index_url: &gix::Url,
-        project: &Project,
+		project: &Project,
-        reqwest: &reqwest::Client,
+		reqwest: &reqwest::Client,
-    ) -> anyhow::Result<String> {
+	) -> anyhow::Result<String> {
-        println!("logging in into {index_url}");
+		println!("logging in into {index_url}");
 
-        let source = PesdePackageSource::new(index_url.clone());
+		let source = PesdePackageSource::new(index_url.clone());
-        source
+		source
-            .refresh(project)
+			.refresh(&RefreshOptions {
-            .await
+				project: project.clone(),
-            .context("failed to refresh index")?;
+			})
+			.await
+			.context("failed to refresh index")?;
 
-        let config = source
+		let config = source
-            .config(project)
+			.config(project)
-            .await
+			.await
-            .context("failed to read index config")?;
+			.context("failed to read index config")?;
-        let Some(client_id) = config.github_oauth_client_id else {
+		let Some(client_id) = config.github_oauth_client_id else {
-            anyhow::bail!("index not configured for Github oauth.");
+			anyhow::bail!("index not configured for Github oauth.");
-        };
+		};
 
-        let response = reqwest
+		let response = reqwest
-            .post(Url::parse_with_params(
+			.post(Url::parse_with_params(
-                "https://github.com/login/device/code",
+				"https://github.com/login/device/code",
-                &[("client_id", &client_id)],
+				&[("client_id", &client_id)],
-            )?)
+			)?)
-            .send()
+			.send()
-            .await
+			.await
-            .context("failed to send device code request")?
+			.context("failed to send device code request")?
-            .error_for_status()
+			.error_for_status()
-            .context("failed to get device code response")?
+			.context("failed to get device code response")?
-            .json::<DeviceCodeResponse>()
+			.json::<DeviceCodeResponse>()
-            .await
+			.await
-            .context("failed to parse device code response")?;
+			.context("failed to parse device code response")?;
 
-        println!(
+		println!(
-            "copy your one-time code: {}\npress enter to open {} in your browser...",
+			"copy your one-time code: {}\npress enter to open {} in your browser...",
-            response.user_code.bold(),
+			style(response.user_code).bold(),
-            response.verification_uri.as_str().blue()
+			URL_STYLE.apply_to(response.verification_uri.as_str())
-        );
+		);
 
-        spawn(move || {
+		spawn(move || {
-            {
+			{
-                let mut input = String::new();
+				let mut input = String::new();
-                std::io::stdin()
+				std::io::stdin()
-                    .read_line(&mut input)
+					.read_line(&mut input)
-                    .expect("failed to read input");
+					.expect("failed to read input");
-            }
+			}
 
-            match open::that(response.verification_uri.as_str()) {
+			match open::that(response.verification_uri.as_str()) {
-                Ok(_) => (),
+				Ok(_) => (),
-                Err(e) => {
+				Err(e) => {
-                    eprintln!("failed to open browser: {e}");
+					eprintln!("failed to open browser: {e}");
-                }
+				}
-            }
+			}
-        });
+		});
 
-        let mut time_left = response.expires_in;
+		let mut time_left = response.expires_in;
-        let mut interval = std::time::Duration::from_secs(response.interval);
+		let mut interval = std::time::Duration::from_secs(response.interval);
 
-        while time_left > 0 {
+		while time_left > 0 {
-            sleep(interval).await;
+			sleep(interval).await;
-            time_left = time_left.saturating_sub(interval.as_secs());
+			time_left = time_left.saturating_sub(interval.as_secs());
 
-            let response = reqwest
+			let response = reqwest
-                .post(Url::parse_with_params(
+				.post(Url::parse_with_params(
-                    "https://github.com/login/oauth/access_token",
+					"https://github.com/login/oauth/access_token",
-                    &[
+					&[
-                        ("client_id", &client_id),
+						("client_id", &client_id),
-                        ("device_code", &response.device_code),
+						("device_code", &response.device_code),
-                        (
+						(
-                            "grant_type",
+							"grant_type",
-                            &"urn:ietf:params:oauth:grant-type:device_code".to_string(),
+							&"urn:ietf:params:oauth:grant-type:device_code".to_string(),
-                        ),
+						),
-                    ],
+					],
-                )?)
+				)?)
-                .send()
+				.send()
-                .await
+				.await
-                .context("failed to send access token request")?
+				.context("failed to send access token request")?
-                .error_for_status()
+				.error_for_status()
-                .context("failed to get access token response")?
+				.context("failed to get access token response")?
-                .json::<AccessTokenResponse>()
+				.json::<AccessTokenResponse>()
-                .await
+				.await
-                .context("failed to parse access token response")?;
+				.context("failed to parse access token response")?;
 
-            match response {
+			match response {
-                AccessTokenResponse::Success { access_token } => {
+				AccessTokenResponse::Success { access_token } => {
-                    return Ok(access_token);
+					return Ok(access_token);
-                }
+				}
-                AccessTokenResponse::Error(e) => match e {
+				AccessTokenResponse::Error(e) => match e {
-                    AccessTokenError::AuthorizationPending => continue,
+					AccessTokenError::AuthorizationPending => continue,
-                    AccessTokenError::SlowDown {
+					AccessTokenError::SlowDown {
-                        interval: new_interval,
+						interval: new_interval,
-                    } => {
+					} => {
-                        interval = std::time::Duration::from_secs(new_interval);
+						interval = std::time::Duration::from_secs(new_interval);
-                        continue;
+						continue;
-                    }
+					}
-                    AccessTokenError::ExpiredToken => {
+					AccessTokenError::ExpiredToken => {
-                        break;
+						break;
-                    }
+					}
-                    AccessTokenError::AccessDenied => {
+					AccessTokenError::AccessDenied => {
-                        anyhow::bail!("access denied, re-run the login command");
+						anyhow::bail!("access denied, re-run the login command");
-                    }
+					}
-                },
+				},
-            }
+			}
-        }
+		}
 
-        anyhow::bail!("code expired, please re-run the login command");
+		anyhow::bail!("code expired, please re-run the login command");
-    }
+	}
 
-    pub async fn run(
+	pub async fn run(
-        self,
+		self,
-        index_url: gix::Url,
+		index_url: gix::Url,
-        project: Project,
+		project: Project,
-        reqwest: reqwest::Client,
+		reqwest: reqwest::Client,
-    ) -> anyhow::Result<()> {
+	) -> anyhow::Result<()> {
-        let token_given = self.token.is_some();
+		let token_given = self.token.is_some();
-        let token = match self.token {
+		let token = match self.token {
-            Some(token) => token,
+			Some(token) => token,
-            None => {
+			None => {
-                self.authenticate_device_flow(&index_url, &project, &reqwest)
+				self.authenticate_device_flow(&index_url, &project, &reqwest)
-                    .await?
+					.await?
-            }
+			}
-        };
+		};
 
-        let token = if token_given {
+		let token = if token_given {
-            println!("set token for {index_url}");
+			println!("set token for {index_url}");
-            token
+			token
-        } else {
+		} else {
-            let token = format!("Bearer {token}");
+			let token = format!("Bearer {token}");
-            println!(
+			println!(
-                "logged in as {} for {index_url}",
+				"logged in as {} for {index_url}",
-                get_token_login(&reqwest, &token).await?.bold()
+				style(get_token_login(&reqwest, &token).await?).bold()
-            );
+			);
 
-            token
+			token
-        };
+		};
 
-        set_token(&index_url, Some(&token)).await?;
+		set_token(&index_url, Some(&token)).await?;
 
-        Ok(())
+		Ok(())
-    }
+	}
 }

src/cli/commands/auth/logout.rs

@@ -5,11 +5,11 @@ use clap::Args;
 pub struct LogoutCommand {}
 
 impl LogoutCommand {
-    pub async fn run(self, index_url: gix::Url) -> anyhow::Result<()> {
+	pub async fn run(self, index_url: gix::Url) -> anyhow::Result<()> {
-        set_token(&index_url, None).await?;
+		set_token(&index_url, None).await?;
 
-        println!("logged out of {index_url}");
+		println!("logged out of {index_url}");
 
-        Ok(())
+		Ok(())
-    }
+	}
 }

src/cli/commands/auth/mod.rs

@@ -1,6 +1,6 @@
-use crate::cli::config::read_config;
+use crate::cli::get_index;
 use clap::{Args, Subcommand};
-use pesde::{errors::ManifestReadError, Project, DEFAULT_INDEX_NAME};
+use pesde::Project;
 
 mod login;
 mod logout;
@@ -9,65 +9,36 @@ mod whoami;
 
 #[derive(Debug, Args)]
 pub struct AuthSubcommand {
-    /// The index to use. Defaults to `default`, or the configured default index if current directory doesn't have a manifest
+	/// The index to use. Defaults to `default`, or the configured default index if current directory doesn't have a manifest
-    #[arg(short, long)]
+	#[arg(short, long)]
-    pub index: Option<String>,
+	pub index: Option<String>,
 
-    #[clap(subcommand)]
+	#[clap(subcommand)]
-    pub command: AuthCommands,
+	pub command: AuthCommands,
 }
 
 #[derive(Debug, Subcommand)]
 pub enum AuthCommands {
-    /// Sets a token for an index. Optionally gets it from GitHub
+	/// Sets a token for an index. Optionally gets it from GitHub
-    Login(login::LoginCommand),
+	Login(login::LoginCommand),
-    /// Removes the stored token
+	/// Removes the stored token
-    Logout(logout::LogoutCommand),
+	Logout(logout::LogoutCommand),
-    /// Prints the username of the currently logged-in user
+	/// Prints the username of the currently logged-in user
-    #[clap(name = "whoami")]
+	#[clap(name = "whoami")]
-    WhoAmI(whoami::WhoAmICommand),
+	WhoAmI(whoami::WhoAmICommand),
-    /// Prints the token for an index
+	/// Prints the token for an index
-    Token(token::TokenCommand),
+	Token(token::TokenCommand),
 }
 
 impl AuthSubcommand {
-    pub async fn run(self, project: Project, reqwest: reqwest::Client) -> anyhow::Result<()> {
+	pub async fn run(self, project: Project, reqwest: reqwest::Client) -> anyhow::Result<()> {
-        let manifest = match project.deser_manifest().await {
+		let index_url = get_index(&project, self.index.as_deref()).await?;
-            Ok(manifest) => Some(manifest),
-            Err(e) => match e {
-                ManifestReadError::Io(e) if e.kind() == std::io::ErrorKind::NotFound => None,
-                e => return Err(e.into()),
-            },
-        };
 
-        let index_url = match self.index.as_deref() {
+		match self.command {
-            Some(index) => match index.try_into() {
+			AuthCommands::Login(login) => login.run(index_url, project, reqwest).await,
-                Ok(url) => Some(url),
+			AuthCommands::Logout(logout) => logout.run(index_url).await,
-                Err(_) => None,
+			AuthCommands::WhoAmI(whoami) => whoami.run(index_url, reqwest).await,
-            },
+			AuthCommands::Token(token) => token.run(index_url).await,
-            None => match manifest {
+		}
-                Some(_) => None,
+	}
-                None => Some(read_config().await?.default_index),
-            },
-        };
-
-        let index_url = match index_url {
-            Some(url) => url,
-            None => {
-                let index_name = self.index.as_deref().unwrap_or(DEFAULT_INDEX_NAME);
-
-                match manifest.unwrap().indices.get(index_name) {
-                    Some(index) => index.clone(),
-                    None => anyhow::bail!("index {index_name} not found in manifest"),
-                }
-            }
-        };
-
-        match self.command {
-            AuthCommands::Login(login) => login.run(index_url, project, reqwest).await,
-            AuthCommands::Logout(logout) => logout.run(index_url).await,
-            AuthCommands::WhoAmI(whoami) => whoami.run(index_url, reqwest).await,
-            AuthCommands::Token(token) => token.run(index_url).await,
-        }
-    }
 }

src/cli/commands/auth/token.rs

@@ -5,18 +5,18 @@ use clap::Args;
 pub struct TokenCommand {}
 
 impl TokenCommand {
-    pub async fn run(self, index_url: gix::Url) -> anyhow::Result<()> {
+	pub async fn run(self, index_url: gix::Url) -> anyhow::Result<()> {
-        let tokens = get_tokens().await?;
+		let tokens = get_tokens().await?;
-        let token = match tokens.0.get(&index_url) {
+		let token = match tokens.0.get(&index_url) {
-            Some(token) => token,
+			Some(token) => token,
-            None => {
+			None => {
-                println!("not logged in into {index_url}");
+				println!("not logged in into {index_url}");
-                return Ok(());
+				return Ok(());
-            }
+			}
-        };
+		};
 
-        println!("token for {index_url}: \"{token}\"");
+		println!("token for {index_url}: \"{token}\"");
 
-        Ok(())
+		Ok(())
-    }
+	}
 }

src/cli/commands/auth/whoami.rs

@@ -1,26 +1,26 @@
 use crate::cli::auth::{get_token_login, get_tokens};
 use clap::Args;
-use colored::Colorize;
+use console::style;
 
 #[derive(Debug, Args)]
 pub struct WhoAmICommand {}
 
 impl WhoAmICommand {
-    pub async fn run(self, index_url: gix::Url, reqwest: reqwest::Client) -> anyhow::Result<()> {
+	pub async fn run(self, index_url: gix::Url, reqwest: reqwest::Client) -> anyhow::Result<()> {
-        let tokens = get_tokens().await?;
+		let tokens = get_tokens().await?;
-        let token = match tokens.0.get(&index_url) {
+		let token = match tokens.0.get(&index_url) {
-            Some(token) => token,
+			Some(token) => token,
-            None => {
+			None => {
-                println!("not logged in into {index_url}");
+				println!("not logged in into {index_url}");
-                return Ok(());
+				return Ok(());
-            }
+			}
-        };
+		};
 
-        println!(
+		println!(
-            "logged in as {} into {index_url}",
+			"logged in as {} into {index_url}",
-            get_token_login(&reqwest, token).await?.bold()
+			style(get_token_login(&reqwest, token).await?).bold()
-        );
+		);
 
-        Ok(())
+		Ok(())
-    }
+	}
 }

src/cli/commands/cas/mod.rs

@@ -0,0 +1,18 @@
+use clap::Subcommand;
+use pesde::Project;
+
+mod prune;
+
+#[derive(Debug, Subcommand)]
+pub enum CasCommands {
+	/// Removes unused files from the CAS
+	Prune(prune::PruneCommand),
+}
+
+impl CasCommands {
+	pub async fn run(self, project: Project) -> anyhow::Result<()> {
+		match self {
+			CasCommands::Prune(prune) => prune.run(project).await,
+		}
+	}
+}

src/cli/commands/cas/prune.rs

@@ -0,0 +1,346 @@
+use crate::{
+	cli::{
+		reporters::run_with_reporter,
+		style::{INFO_STYLE, SUCCESS_STYLE},
+	},
+	util::remove_empty_dir,
+};
+use anyhow::Context;
+use async_stream::try_stream;
+use clap::Args;
+use fs_err::tokio as fs;
+use futures::{future::BoxFuture, FutureExt, Stream, StreamExt};
+use pesde::{
+	source::fs::{FsEntry, PackageFs},
+	Project,
+};
+use std::{
+	collections::{HashMap, HashSet},
+	future::Future,
+	path::{Path, PathBuf},
+};
+use tokio::task::JoinSet;
+
+#[derive(Debug, Args)]
+pub struct PruneCommand {}
+
+async fn read_dir_stream(
+	dir: &Path,
+) -> std::io::Result<impl Stream<Item = std::io::Result<fs::DirEntry>>> {
+	let mut read_dir = fs::read_dir(dir).await?;
+
+	Ok(try_stream! {
+		while let Some(entry) = read_dir.next_entry().await? {
+			yield entry;
+		}
+	})
+}
+
+#[allow(unreachable_code)]
+async fn get_nlinks(path: &Path) -> anyhow::Result<u64> {
+	#[cfg(unix)]
+	{
+		use std::os::unix::fs::MetadataExt;
+		let metadata = fs::metadata(path).await?;
+		return Ok(metadata.nlink());
+	}
+	// life if rust stabilized the nightly feature from 2019
+	#[cfg(windows)]
+	{
+		use std::os::windows::ffi::OsStrExt;
+		use windows::{
+			core::PWSTR,
+			Win32::{
+				Foundation::CloseHandle,
+				Storage::FileSystem::{
+					CreateFileW, GetFileInformationByHandle, FILE_ATTRIBUTE_NORMAL,
+					FILE_GENERIC_READ, FILE_SHARE_READ, OPEN_EXISTING,
+				},
+			},
+		};
+
+		let path = path.to_path_buf();
+		return tokio::task::spawn_blocking(move || unsafe {
+			let handle = CreateFileW(
+				PWSTR(
+					path.as_os_str()
+						.encode_wide()
+						.chain(std::iter::once(0))
+						.collect::<Vec<_>>()
+						.as_mut_ptr(),
+				),
+				FILE_GENERIC_READ.0,
+				FILE_SHARE_READ,
+				None,
+				OPEN_EXISTING,
+				FILE_ATTRIBUTE_NORMAL,
+				None,
+			)?;
+
+			let mut info =
+				windows::Win32::Storage::FileSystem::BY_HANDLE_FILE_INFORMATION::default();
+			let res = GetFileInformationByHandle(handle, &mut info);
+			CloseHandle(handle)?;
+			res?;
+
+			Ok(info.nNumberOfLinks as u64)
+		})
+		.await
+		.unwrap();
+	}
+	#[cfg(not(any(unix, windows)))]
+	{
+		compile_error!("unsupported platform");
+	}
+	anyhow::bail!("unsupported platform")
+}
+
+#[derive(Debug)]
+struct ExtendJoinSet<T: Send + 'static>(JoinSet<T>);
+
+impl<T: Send + 'static, F: Future<Output = T> + Send + 'static> Extend<F> for ExtendJoinSet<T> {
+	fn extend<I: IntoIterator<Item = F>>(&mut self, iter: I) {
+		for item in iter {
+			self.0.spawn(item);
+		}
+	}
+}
+
+impl<T: Send + 'static> Default for ExtendJoinSet<T> {
+	fn default() -> Self {
+		Self(JoinSet::new())
+	}
+}
+
+async fn discover_cas_packages(cas_dir: &Path) -> anyhow::Result<HashMap<PathBuf, PackageFs>> {
+	fn read_entry(
+		entry: fs::DirEntry,
+	) -> BoxFuture<'static, anyhow::Result<HashMap<PathBuf, PackageFs>>> {
+		async move {
+			if entry
+				.metadata()
+				.await
+				.context("failed to read entry metadata")?
+				.is_dir()
+			{
+				let mut tasks = read_dir_stream(&entry.path())
+					.await
+					.context("failed to read entry directory")?
+					.map(|entry| async move {
+						read_entry(entry.context("failed to read inner cas index dir entry")?).await
+					})
+					.collect::<ExtendJoinSet<Result<_, anyhow::Error>>>()
+					.await
+					.0;
+
+				let mut res = HashMap::new();
+				while let Some(entry) = tasks.join_next().await {
+					res.extend(entry.unwrap()?);
+				}
+
+				return Ok(res);
+			};
+
+			let contents = fs::read_to_string(entry.path()).await?;
+			let fs = toml::from_str(&contents).context("failed to deserialize PackageFs")?;
+
+			Ok(HashMap::from([(entry.path(), fs)]))
+		}
+		.boxed()
+	}
+
+	let mut tasks = ["index", "wally_index", "git_index"]
+		.into_iter()
+		.map(|index| cas_dir.join(index))
+		.map(|index| async move {
+			let mut res = HashMap::new();
+
+			let tasks = match read_dir_stream(&index).await {
+				Ok(tasks) => tasks,
+				Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(res),
+				Err(e) => return Err(e).context("failed to read cas index directory"),
+			};
+
+			let mut tasks = tasks
+				.map(|entry| async move {
+					read_entry(entry.context("failed to read cas index dir entry")?).await
+				})
+				.collect::<ExtendJoinSet<Result<_, anyhow::Error>>>()
+				.await
+				.0;
+
+			while let Some(task) = tasks.join_next().await {
+				res.extend(task.unwrap()?);
+			}
+
+			Ok(res)
+		})
+		.collect::<JoinSet<Result<_, anyhow::Error>>>();
+
+	let mut cas_entries = HashMap::new();
+
+	while let Some(task) = tasks.join_next().await {
+		cas_entries.extend(task.unwrap()?);
+	}
+
+	Ok(cas_entries)
+}
+
+async fn remove_hashes(cas_dir: &Path) -> anyhow::Result<HashSet<String>> {
+	let mut res = HashSet::new();
+
+	let tasks = match read_dir_stream(cas_dir).await {
+		Ok(tasks) => tasks,
+		Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(res),
+		Err(e) => return Err(e).context("failed to read cas directory"),
+	};
+
+	let mut tasks = tasks
+		.map(|cas_entry| async move {
+			let cas_entry = cas_entry.context("failed to read cas dir entry")?;
+			let prefix = cas_entry.file_name();
+			let Some(prefix) = prefix.to_str() else {
+				return Ok(None);
+			};
+			// we only want hash directories
+			if prefix.len() != 2 {
+				return Ok(None);
+			}
+
+			let mut tasks = read_dir_stream(&cas_entry.path())
+				.await
+				.context("failed to read hash directory")?
+				.map(|hash_entry| {
+					let prefix = prefix.to_string();
+					async move {
+						let hash_entry = hash_entry.context("failed to read hash dir entry")?;
+						let hash = hash_entry.file_name();
+						let hash = hash.to_str().expect("non-UTF-8 hash").to_string();
+						let hash = format!("{prefix}{hash}");
+
+						let path = hash_entry.path();
+						let nlinks = get_nlinks(&path)
+							.await
+							.context("failed to count file usage")?;
+						if nlinks > 1 {
+							return Ok(None);
+						}
+
+						fs::remove_file(&path)
+							.await
+							.context("failed to remove unused file")?;
+
+						if let Some(parent) = path.parent() {
+							remove_empty_dir(parent).await?;
+						}
+
+						Ok(Some(hash))
+					}
+				})
+				.collect::<ExtendJoinSet<Result<_, anyhow::Error>>>()
+				.await
+				.0;
+
+			let mut removed_hashes = HashSet::new();
+			while let Some(removed_hash) = tasks.join_next().await {
+				let Some(hash) = removed_hash.unwrap()? else {
+					continue;
+				};
+
+				removed_hashes.insert(hash);
+			}
+
+			Ok(Some(removed_hashes))
+		})
+		.collect::<ExtendJoinSet<Result<_, anyhow::Error>>>()
+		.await
+		.0;
+
+	while let Some(removed_hashes) = tasks.join_next().await {
+		let Some(removed_hashes) = removed_hashes.unwrap()? else {
+			continue;
+		};
+
+		res.extend(removed_hashes);
+	}
+
+	Ok(res)
+}
+
+impl PruneCommand {
+	pub async fn run(self, project: Project) -> anyhow::Result<()> {
+		// CAS structure:
+		// /2 first chars of hash/rest of hash
+		// /index/hash/name/version/target
+		// /wally_index/hash/name/version
+		// /git_index/hash/hash
+		// the last thing in the path is the serialized PackageFs
+
+		let (cas_entries, removed_hashes) = run_with_reporter(|_, root_progress, _| async {
+			let root_progress = root_progress;
+			root_progress.reset();
+			root_progress.set_message("discover packages");
+			let cas_entries = discover_cas_packages(project.cas_dir()).await?;
+			root_progress.reset();
+			root_progress.set_message("remove unused files");
+			let removed_hashes = remove_hashes(project.cas_dir()).await?;
+
+			Ok::<_, anyhow::Error>((cas_entries, removed_hashes))
+		})
+		.await?;
+
+		let mut tasks = JoinSet::new();
+
+		let mut removed_packages = 0usize;
+
+		'entry: for (path, fs) in cas_entries {
+			let PackageFs::Cas(entries) = fs else {
+				continue;
+			};
+
+			for entry in entries.into_values() {
+				let FsEntry::File(hash) = entry else {
+					continue;
+				};
+
+				if removed_hashes.contains(&hash) {
+					let cas_dir = project.cas_dir().to_path_buf();
+					tasks.spawn(async move {
+						fs::remove_file(&path)
+							.await
+							.context("failed to remove unused file")?;
+
+						// remove empty directories up to the cas dir
+						let mut path = &*path;
+						while let Some(parent) = path.parent() {
+							if parent == cas_dir {
+								break;
+							}
+
+							remove_empty_dir(parent).await?;
+							path = parent;
+						}
+
+						Ok::<_, anyhow::Error>(())
+					});
+					removed_packages += 1;
+					// if at least one file is removed, the package is not used
+					continue 'entry;
+				}
+			}
+		}
+
+		while let Some(task) = tasks.join_next().await {
+			task.unwrap()?;
+		}
+
+		println!(
+			"{} removed {} unused packages and {} individual files!",
+			SUCCESS_STYLE.apply_to("done!"),
+			INFO_STYLE.apply_to(removed_packages),
+			INFO_STYLE.apply_to(removed_hashes.len())
+		);
+
+		Ok(())
+	}
+}

src/cli/commands/config/default_index.rs

@@ -3,36 +3,36 @@ use clap::Args;
 
 #[derive(Debug, Args)]
 pub struct DefaultIndexCommand {
-    /// The new index URL to set as default, don't pass any value to check the current default index
+	/// The new index URL to set as default, don't pass any value to check the current default index
-    #[arg(index = 1, value_parser = crate::cli::parse_gix_url)]
+	#[arg(index = 1, value_parser = crate::cli::parse_gix_url)]
-    index: Option<gix::Url>,
+	index: Option<gix::Url>,
 
-    /// Resets the default index to the default value
+	/// Resets the default index to the default value
-    #[arg(short, long, conflicts_with = "index")]
+	#[arg(short, long, conflicts_with = "index")]
-    reset: bool,
+	reset: bool,
 }
 
 impl DefaultIndexCommand {
-    pub async fn run(self) -> anyhow::Result<()> {
+	pub async fn run(self) -> anyhow::Result<()> {
-        let mut config = read_config().await?;
+		let mut config = read_config().await?;
 
-        let index = if self.reset {
+		let index = if self.reset {
-            Some(CliConfig::default().default_index)
+			Some(CliConfig::default().default_index)
-        } else {
+		} else {
-            self.index
+			self.index
-        };
+		};
 
-        match index {
+		match index {
-            Some(index) => {
+			Some(index) => {
-                config.default_index = index.clone();
+				config.default_index = index.clone();
-                write_config(&config).await?;
+				write_config(&config).await?;
-                println!("default index set to: {index}");
+				println!("default index set to: {index}");
-            }
+			}
-            None => {
+			None => {
-                println!("current default index: {}", config.default_index);
+				println!("current default index: {}", config.default_index);
-            }
+			}
-        }
+		}
 
-        Ok(())
+		Ok(())
-    }
+	}
 }

src/cli/commands/config/mod.rs

@@ -4,14 +4,14 @@ mod default_index;
 
 #[derive(Debug, Subcommand)]
 pub enum ConfigCommands {
-    /// Configuration for the default index
+	/// Configuration for the default index
-    DefaultIndex(default_index::DefaultIndexCommand),
+	DefaultIndex(default_index::DefaultIndexCommand),
 }
 
 impl ConfigCommands {
-    pub async fn run(self) -> anyhow::Result<()> {
+	pub async fn run(self) -> anyhow::Result<()> {
-        match self {
+		match self {
-            ConfigCommands::DefaultIndex(default_index) => default_index.run().await,
+			ConfigCommands::DefaultIndex(default_index) => default_index.run().await,
-        }
+		}
-    }
+	}
 }

src/cli/commands/deprecate.rs

@@ -0,0 +1,100 @@
+use crate::cli::{get_index, style::SUCCESS_STYLE};
+use anyhow::Context;
+use clap::Args;
+use pesde::{
+	names::PackageName,
+	source::{
+		pesde::PesdePackageSource,
+		traits::{PackageSource, RefreshOptions},
+	},
+	Project,
+};
+use reqwest::{header::AUTHORIZATION, Method, StatusCode};
+
+#[derive(Debug, Args)]
+pub struct DeprecateCommand {
+	/// Whether to undeprecate the package
+	#[clap(long)]
+	undo: bool,
+
+	/// The index to deprecate the package in
+	#[clap(short, long)]
+	index: Option<String>,
+
+	/// The package to deprecate
+	#[clap(index = 1)]
+	package: PackageName,
+
+	/// The reason for deprecating the package
+	#[clap(index = 2, required_unless_present = "undo")]
+	reason: Option<String>,
+}
+
+impl DeprecateCommand {
+	pub async fn run(self, project: Project, reqwest: reqwest::Client) -> anyhow::Result<()> {
+		let index_url = get_index(&project, self.index.as_deref()).await?;
+		let source = PesdePackageSource::new(index_url.clone());
+		source
+			.refresh(&RefreshOptions {
+				project: project.clone(),
+			})
+			.await
+			.context("failed to refresh source")?;
+		let config = source
+			.config(&project)
+			.await
+			.context("failed to get index config")?;
+
+		let mut request = reqwest.request(
+			if self.undo {
+				Method::DELETE
+			} else {
+				Method::PUT
+			},
+			format!(
+				"{}/v1/packages/{}/deprecate",
+				config.api(),
+				urlencoding::encode(&self.package.to_string()),
+			),
+		);
+
+		if !self.undo {
+			request = request.body(
+				self.reason
+					.map(|reason| reason.trim().to_string())
+					.filter(|reason| !reason.is_empty())
+					.context("deprecating must have non-empty a reason")?,
+			);
+		}
+
+		if let Some(token) = project.auth_config().tokens().get(&index_url) {
+			tracing::debug!("using token for {index_url}");
+			request = request.header(AUTHORIZATION, token);
+		}
+
+		let response = request.send().await.context("failed to send request")?;
+
+		let status = response.status();
+		let text = response
+			.text()
+			.await
+			.context("failed to get response text")?;
+		let prefix = if self.undo { "un" } else { "" };
+		match status {
+			StatusCode::CONFLICT => {
+				anyhow::bail!("version is already {prefix}deprecated");
+			}
+			StatusCode::FORBIDDEN => {
+				anyhow::bail!("unauthorized to {prefix}deprecate under this scope");
+			}
+			code if !code.is_success() => {
+				anyhow::bail!("failed to {prefix}deprecate package: {code} ({text})");
+			}
+			_ => {
+				println!("{}", SUCCESS_STYLE.apply_to(text));
+			}
+		}
+
+		Ok(())
+	}
+}

src/cli/commands/execute.rs

@@ -1,167 +1,242 @@
-use crate::cli::{config::read_config, progress_bar, VersionedPackageName};
+use crate::cli::{
+	config::read_config,
+	reporters::{self, CliReporter},
+	VersionedPackageName,
+};
 use anyhow::Context;
 use clap::Args;
+use console::style;
 use fs_err::tokio as fs;
+use indicatif::MultiProgress;
 use pesde::{
-    linking::generator::generate_bin_linking_module,
+	download_and_link::DownloadAndLinkOptions,
-    manifest::target::TargetKind,
+	linking::generator::generate_bin_linking_module,
-    names::PackageName,
+	manifest::target::TargetKind,
-    source::{
+	names::{PackageName, PackageNames},
-        pesde::{specifier::PesdeDependencySpecifier, PesdePackageSource},
+	source::{
-        traits::PackageSource,
+		ids::PackageId,
-    },
+		pesde::{specifier::PesdeDependencySpecifier, PesdePackageSource},
-    Project,
+		traits::{
+			DownloadOptions, GetTargetOptions, PackageSource, RefreshOptions, ResolveOptions,
+		},
+		PackageSources,
+	},
+	Project, RefreshedSources,
 };
 use semver::VersionReq;
 use std::{
-    collections::HashSet, env::current_dir, ffi::OsString, io::Write, process::Command, sync::Arc,
+	env::current_dir,
+	ffi::OsString,
+	io::{Stderr, Write},
+	process::Command,
+	sync::Arc,
 };
-use tokio::sync::Mutex;
 
 #[derive(Debug, Args)]
 pub struct ExecuteCommand {
-    /// The package name, script name, or path to a script to run
+	/// The package name, script name, or path to a script to run
-    #[arg(index = 1)]
+	#[arg(index = 1)]
-    package: VersionedPackageName<VersionReq, PackageName>,
+	package: VersionedPackageName<VersionReq, PackageName>,
 
-    /// The index URL to use for the package
+	/// The index URL to use for the package
-    #[arg(short, long, value_parser = crate::cli::parse_gix_url)]
+	#[arg(short, long, value_parser = crate::cli::parse_gix_url)]
-    index: Option<gix::Url>,
+	index: Option<gix::Url>,
 
-    /// Arguments to pass to the script
+	/// Arguments to pass to the script
-    #[arg(index = 2, last = true)]
+	#[arg(index = 2, last = true)]
-    args: Vec<OsString>,
+	args: Vec<OsString>,
 }
 
 impl ExecuteCommand {
-    pub async fn run(self, project: Project, reqwest: reqwest::Client) -> anyhow::Result<()> {
+	pub async fn run(self, project: Project, reqwest: reqwest::Client) -> anyhow::Result<()> {
-        let index = match self.index {
+		let multi_progress = MultiProgress::new();
-            Some(index) => Some(index),
+		crate::PROGRESS_BARS
-            None => read_config().await.ok().map(|c| c.default_index),
+			.lock()
-        }
+			.unwrap()
-        .context("no index specified")?;
+			.replace(multi_progress.clone());
-        let source = PesdePackageSource::new(index);
-        source
-            .refresh(&project)
-            .await
-            .context("failed to refresh source")?;
 
-        let version_req = self.package.1.unwrap_or(VersionReq::STAR);
+		let refreshed_sources = RefreshedSources::new();
-        let Some((version, pkg_ref)) = ('finder: {
-            let specifier = PesdeDependencySpecifier {
-                name: self.package.0.clone(),
-                version: version_req.clone(),
-                index: None,
-                target: None,
-            };
 
-            if let Some(res) = source
+		let (tempdir, bin_path) = reporters::run_with_reporter_and_writer(
-                .resolve(&specifier, &project, TargetKind::Lune, &mut HashSet::new())
+			std::io::stderr(),
-                .await
+			|multi_progress, root_progress, reporter| async {
-                .context("failed to resolve package")?
+				let multi_progress = multi_progress;
-                .1
+				let root_progress = root_progress;
-                .pop_last()
-            {
-                break 'finder Some(res);
-            }
 
-            source
+				root_progress.set_message("resolve");
-                .resolve(&specifier, &project, TargetKind::Luau, &mut HashSet::new())
-                .await
-                .context("failed to resolve package")?
-                .1
-                .pop_last()
-        }) else {
-            anyhow::bail!(
-                "no Lune or Luau package could be found for {}@{version_req}",
-                self.package.0,
-            );
-        };
 
-        println!("using {}@{version}", pkg_ref.name);
+				let index = match self.index {
+					Some(index) => Some(index),
+					None => read_config().await.ok().map(|c| c.default_index),
+				}
+				.context("no index specified")?;
+				let source = PesdePackageSource::new(index);
+				refreshed_sources
+					.refresh(
+						&PackageSources::Pesde(source.clone()),
+						&RefreshOptions {
+							project: project.clone(),
+						},
+					)
+					.await
+					.context("failed to refresh source")?;
 
-        let tmp_dir = project.cas_dir().join(".tmp");
+				let version_req = self.package.1.unwrap_or(VersionReq::STAR);
-        fs::create_dir_all(&tmp_dir)
+				let Some((id, pkg_ref)) = ('finder: {
-            .await
+					let specifier = PesdeDependencySpecifier {
-            .context("failed to create temporary directory")?;
+						name: self.package.0.clone(),
-        let tempdir =
+						version: version_req.clone(),
-            tempfile::tempdir_in(tmp_dir).context("failed to create temporary directory")?;
+						index: None,
+						target: None,
+					};
 
-        let project = Project::new(
+					if let Some((v_id, pkg_ref)) = source
-            tempdir.path(),
+						.resolve(
-            None::<std::path::PathBuf>,
+							&specifier,
-            project.data_dir(),
+							&ResolveOptions {
-            project.cas_dir(),
+								project: project.clone(),
-            project.auth_config().clone(),
+								target: TargetKind::Lune,
-        );
+								refreshed_sources: refreshed_sources.clone(),
+							},
+						)
+						.await
+						.context("failed to resolve package")?
+						.1
+						.pop_last()
+					{
+						break 'finder Some((
+							PackageId::new(PackageNames::Pesde(self.package.0.clone()), v_id),
+							pkg_ref,
+						));
+					}
 
-        let (fs, target) = source
+					source
-            .download(&pkg_ref, &project, &reqwest)
+						.resolve(
-            .await
+							&specifier,
-            .context("failed to download package")?;
+							&ResolveOptions {
-        let bin_path = target.bin_path().context("package has no binary export")?;
+								project: project.clone(),
+								target: TargetKind::Luau,
+								refreshed_sources: refreshed_sources.clone(),
+							},
+						)
+						.await
+						.context("failed to resolve package")?
+						.1
+						.pop_last()
+						.map(|(v_id, pkg_ref)| {
+							(
+								PackageId::new(PackageNames::Pesde(self.package.0.clone()), v_id),
+								pkg_ref,
+							)
+						})
+				}) else {
+					anyhow::bail!(
+						"no Lune or Luau package could be found for {}@{version_req}",
+						self.package.0,
+					);
+				};
 
-        fs.write_to(tempdir.path(), project.cas_dir(), true)
+				let tmp_dir = project.cas_dir().join(".tmp");
-            .await
+				fs::create_dir_all(&tmp_dir)
-            .context("failed to write package contents")?;
+					.await
+					.context("failed to create temporary directory")?;
+				let tempdir = tempfile::tempdir_in(tmp_dir)
+					.context("failed to create temporary directory")?;
 
-        let mut refreshed_sources = HashSet::new();
+				let project = Project::new(
+					tempdir.path(),
+					None::<std::path::PathBuf>,
+					project.data_dir(),
+					project.cas_dir(),
+					project.auth_config().clone(),
+				);
 
-        let graph = project
+				let id = Arc::new(id);
-            .dependency_graph(None, &mut refreshed_sources, true)
-            .await
-            .context("failed to build dependency graph")?;
-        let graph = Arc::new(graph);
 
-        let (rx, downloaded_graph) = project
+				let fs = source
-            .download_and_link(
+					.download(
-                &graph,
+						&pkg_ref,
-                &Arc::new(Mutex::new(refreshed_sources)),
+						&DownloadOptions {
-                &reqwest,
+							project: project.clone(),
-                true,
+							reqwest: reqwest.clone(),
-                true,
+							reporter: Arc::new(()),
-                |_| async { Ok::<_, std::io::Error>(()) },
+							id: id.clone(),
-            )
+						},
-            .await
+					)
-            .context("failed to download dependencies")?;
+					.await
+					.context("failed to download package")?;
 
-        progress_bar(
+				fs.write_to(tempdir.path(), project.cas_dir(), true)
-            graph.values().map(|versions| versions.len() as u64).sum(),
+					.await
-            rx,
+					.context("failed to write package contents")?;
-            "📥 ".to_string(),
-            "downloading dependencies".to_string(),
-            "downloaded dependencies".to_string(),
-        )
-        .await?;
 
-        downloaded_graph
+				let target = source
-            .await
+					.get_target(
-            .context("failed to download & link dependencies")?;
+						&pkg_ref,
+						&GetTargetOptions {
+							project: project.clone(),
+							path: Arc::from(tempdir.path()),
+							id: id.clone(),
+						},
+					)
+					.await
+					.context("failed to get target")?;
 
-        let mut caller =
+				let bin_path = target.bin_path().context("package has no binary export")?;
-            tempfile::NamedTempFile::new_in(tempdir.path()).context("failed to create tempfile")?;
-        caller
-            .write_all(
-                generate_bin_linking_module(
-                    tempdir.path(),
-                    &format!("{:?}", bin_path.to_path(tempdir.path())),
-                )
-                .as_bytes(),
-            )
-            .context("failed to write to tempfile")?;
 
-        let status = Command::new("lune")
+				let graph = project
-            .arg("run")
+					.dependency_graph(None, refreshed_sources.clone(), true)
-            .arg(caller.path())
+					.await
-            .arg("--")
+					.context("failed to build dependency graph")?;
-            .args(&self.args)
-            .current_dir(current_dir().context("failed to get current directory")?)
-            .status()
-            .context("failed to run script")?;
 
-        drop(caller);
+				multi_progress.suspend(|| {
-        drop(tempdir);
+					eprintln!("{}", style(format!("using {}", style(id).bold())).dim());
+				});
 
-        std::process::exit(status.code().unwrap_or(1))
+				root_progress.reset();
-    }
+				root_progress.set_message("download");
+				root_progress.set_style(reporters::root_progress_style_with_progress());
+
+				project
+					.download_and_link(
+						&Arc::new(graph),
+						DownloadAndLinkOptions::<CliReporter<Stderr>, ()>::new(reqwest)
+							.reporter(reporter)
+							.refreshed_sources(refreshed_sources)
+							.prod(true),
+					)
+					.await
+					.context("failed to download and link dependencies")?;
+
+				anyhow::Ok((tempdir, bin_path.to_relative_path_buf()))
+			},
+		)
+		.await?;
+
+		let mut caller =
+			tempfile::NamedTempFile::new_in(tempdir.path()).context("failed to create tempfile")?;
+		caller
+			.write_all(
+				generate_bin_linking_module(
+					tempdir.path(),
+					&format!("{:?}", bin_path.to_path(tempdir.path())),
+				)
+				.as_bytes(),
+			)
+			.context("failed to write to tempfile")?;
+
+		let status = Command::new("lune")
+			.arg("run")
+			.arg(caller.path())
+			.arg("--")
+			.args(&self.args)
+			.current_dir(current_dir().context("failed to get current directory")?)
+			.status()
+			.context("failed to run script")?;
+
+		drop(caller);
+		drop(tempdir);
+
+		std::process::exit(status.code().unwrap_or(1))
+	}
 }

src/cli/commands/init.rs

@@ -1,262 +1,289 @@
-use crate::cli::config::read_config;
+use crate::cli::{
+	config::read_config,
+	style::{ERROR_PREFIX, INFO_STYLE, SUCCESS_STYLE},
+};
 use anyhow::Context;
 use clap::Args;
-use colored::Colorize;
 use inquire::validator::Validation;
 use pesde::{
-    errors::ManifestReadError,
+	errors::ManifestReadError,
-    manifest::{target::TargetKind, DependencyType},
+	manifest::{target::TargetKind, DependencyType},
-    names::PackageName,
+	names::{PackageName, PackageNames},
-    source::{
+	source::{
-        git_index::GitBasedSource,
+		git_index::GitBasedSource,
-        pesde::{specifier::PesdeDependencySpecifier, PesdePackageSource},
+		ids::PackageId,
-        specifiers::DependencySpecifiers,
+		pesde::{specifier::PesdeDependencySpecifier, PesdePackageSource},
-        traits::PackageSource,
+		specifiers::DependencySpecifiers,
-    },
+		traits::{GetTargetOptions, PackageSource, RefreshOptions, ResolveOptions},
-    Project, DEFAULT_INDEX_NAME, SCRIPTS_LINK_FOLDER,
+		PackageSources,
+	},
+	Project, RefreshedSources, DEFAULT_INDEX_NAME, SCRIPTS_LINK_FOLDER,
 };
 use semver::VersionReq;
-use std::{collections::HashSet, fmt::Display, str::FromStr};
+use std::{fmt::Display, path::Path, str::FromStr, sync::Arc};
 
 #[derive(Debug, Args)]
 pub struct InitCommand {}
 
 #[derive(Debug)]
 enum PackageNameOrCustom {
-    PackageName(PackageName),
+	PackageName(PackageName),
-    Custom,
+	Custom,
 }
 
 impl Display for PackageNameOrCustom {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+	fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
+		match self {
-            PackageNameOrCustom::PackageName(n) => write!(f, "{n}"),
+			PackageNameOrCustom::PackageName(n) => write!(f, "{n}"),
-            PackageNameOrCustom::Custom => write!(f, "custom"),
+			PackageNameOrCustom::Custom => write!(f, "custom"),
-        }
+		}
-    }
+	}
 }
 
 impl InitCommand {
-    pub async fn run(self, project: Project) -> anyhow::Result<()> {
+	pub async fn run(self, project: Project) -> anyhow::Result<()> {
-        match project.read_manifest().await {
+		match project.read_manifest().await {
-            Ok(_) => {
+			Ok(_) => {
-                println!("{}", "project already initialized".red());
+				anyhow::bail!("project already initialized");
-                return Ok(());
+			}
-            }
+			Err(ManifestReadError::Io(e)) if e.kind() == std::io::ErrorKind::NotFound => {}
-            Err(ManifestReadError::Io(e)) if e.kind() == std::io::ErrorKind::NotFound => {}
+			Err(e) => return Err(e.into()),
-            Err(e) => return Err(e.into()),
+		};
-        };
 
-        let mut manifest = toml_edit::DocumentMut::new();
+		let mut manifest = toml_edit::DocumentMut::new();
 
-        manifest["name"] = toml_edit::value(
+		manifest["name"] = toml_edit::value(
-            inquire::Text::new("what is the name of the project?")
+			inquire::Text::new("what is the name of the project?")
-                .with_validator(|name: &str| {
+				.with_validator(|name: &str| {
-                    Ok(match PackageName::from_str(name) {
+					Ok(match PackageName::from_str(name) {
-                        Ok(_) => Validation::Valid,
+						Ok(_) => Validation::Valid,
-                        Err(e) => Validation::Invalid(e.to_string().into()),
+						Err(e) => Validation::Invalid(e.to_string().into()),
-                    })
+					})
-                })
+				})
-                .prompt()
+				.prompt()
-                .unwrap(),
+				.unwrap(),
-        );
+		);
-        manifest["version"] = toml_edit::value("0.1.0");
+		manifest["version"] = toml_edit::value("0.1.0");
 
-        let description = inquire::Text::new("what is the description of the project?")
+		let description = inquire::Text::new("what is the description of the project?")
-            .with_help_message("a short description of the project. leave empty for none")
+			.with_help_message("a short description of the project. leave empty for none")
-            .prompt()
+			.prompt()
-            .unwrap();
+			.unwrap();
 
-        if !description.is_empty() {
+		if !description.is_empty() {
-            manifest["description"] = toml_edit::value(description);
+			manifest["description"] = toml_edit::value(description);
-        }
+		}
 
-        let authors = inquire::Text::new("who are the authors of this project?")
+		let authors = inquire::Text::new("who are the authors of this project?")
-            .with_help_message("comma separated list. leave empty for none")
+			.with_help_message("comma separated list. leave empty for none")
-            .prompt()
+			.prompt()
-            .unwrap();
+			.unwrap();
 
-        let authors = authors
+		let authors = authors
-            .split(',')
+			.split(',')
-            .map(str::trim)
+			.map(str::trim)
-            .filter(|s| !s.is_empty())
+			.filter(|s| !s.is_empty())
-            .collect::<toml_edit::Array>();
+			.collect::<toml_edit::Array>();
 
-        if !authors.is_empty() {
+		if !authors.is_empty() {
-            manifest["authors"] = toml_edit::value(authors);
+			manifest["authors"] = toml_edit::value(authors);
-        }
+		}
 
-        let repo = inquire::Text::new("what is the repository URL of this project?")
+		let repo = inquire::Text::new("what is the repository URL of this project?")
-            .with_validator(|repo: &str| {
+			.with_validator(|repo: &str| {
-                if repo.is_empty() {
+				if repo.is_empty() {
-                    return Ok(Validation::Valid);
+					return Ok(Validation::Valid);
-                }
+				}
 
-                Ok(match url::Url::parse(repo) {
+				Ok(match url::Url::parse(repo) {
-                    Ok(_) => Validation::Valid,
+					Ok(_) => Validation::Valid,
-                    Err(e) => Validation::Invalid(e.to_string().into()),
+					Err(e) => Validation::Invalid(e.to_string().into()),
-                })
+				})
-            })
+			})
-            .with_help_message("leave empty for none")
+			.with_help_message("leave empty for none")
-            .prompt()
+			.prompt()
-            .unwrap();
+			.unwrap();
-        if !repo.is_empty() {
+		if !repo.is_empty() {
-            manifest["repository"] = toml_edit::value(repo);
+			manifest["repository"] = toml_edit::value(repo);
-        }
+		}
 
-        let license = inquire::Text::new("what is the license of this project?")
+		let license = inquire::Text::new("what is the license of this project?")
-            .with_initial_value("MIT")
+			.with_initial_value("MIT")
-            .with_help_message("an SPDX license identifier. leave empty for none")
+			.with_help_message("an SPDX license identifier. leave empty for none")
-            .prompt()
+			.prompt()
-            .unwrap();
+			.unwrap();
-        if !license.is_empty() {
+		if !license.is_empty() {
-            manifest["license"] = toml_edit::value(license);
+			manifest["license"] = toml_edit::value(license);
-        }
+		}
 
-        let target_env = inquire::Select::new(
+		let target_env = inquire::Select::new(
-            "what environment are you targeting for your package?",
+			"what environment are you targeting for your package?",
-            TargetKind::VARIANTS.to_vec(),
+			TargetKind::VARIANTS.to_vec(),
-        )
+		)
-        .prompt()
+		.prompt()
-        .unwrap();
+		.unwrap();
 
-        manifest["target"].or_insert(toml_edit::Item::Table(toml_edit::Table::new()))
+		manifest["target"].or_insert(toml_edit::Item::Table(toml_edit::Table::new()))
-            ["environment"] = toml_edit::value(target_env.to_string());
+			["environment"] = toml_edit::value(target_env.to_string());
 
-        let source = PesdePackageSource::new(read_config().await?.default_index);
+		let source = PesdePackageSource::new(read_config().await?.default_index);
 
-        manifest["indices"].or_insert(toml_edit::Item::Table(toml_edit::Table::new()))
+		manifest["indices"].or_insert(toml_edit::Item::Table(toml_edit::Table::new()))
-            [DEFAULT_INDEX_NAME] = toml_edit::value(source.repo_url().to_bstring().to_string());
+			[DEFAULT_INDEX_NAME] = toml_edit::value(source.repo_url().to_bstring().to_string());
 
-        if target_env.is_roblox()
+		let refreshed_sources = RefreshedSources::new();
-            || inquire::prompt_confirmation(
-                "would you like to setup default Roblox compatibility scripts?",
-            )
-            .unwrap()
-        {
-            PackageSource::refresh(&source, &project)
-                .await
-                .context("failed to refresh package source")?;
-            let config = source
-                .config(&project)
-                .await
-                .context("failed to get source config")?;
 
-            let scripts_package = if config.scripts_packages.is_empty() {
+		if target_env.is_roblox()
-                PackageNameOrCustom::Custom
+			|| inquire::prompt_confirmation("would you like to setup Roblox compatibility scripts?")
-            } else {
+				.unwrap()
-                inquire::Select::new(
+		{
-                    "which scripts package do you want to use?",
+			refreshed_sources
-                    config
+				.refresh(
-                        .scripts_packages
+					&PackageSources::Pesde(source.clone()),
-                        .into_iter()
+					&RefreshOptions {
-                        .map(PackageNameOrCustom::PackageName)
+						project: project.clone(),
-                        .chain(std::iter::once(PackageNameOrCustom::Custom))
+					},
-                        .collect(),
+				)
-                )
+				.await
-                .prompt()
+				.context("failed to refresh package source")?;
-                .unwrap()
+			let config = source
-            };
+				.config(&project)
+				.await
+				.context("failed to get source config")?;
 
-            let scripts_package = match scripts_package {
+			let scripts_package = if config.scripts_packages.is_empty() {
-                PackageNameOrCustom::PackageName(p) => Some(p),
+				PackageNameOrCustom::Custom
-                PackageNameOrCustom::Custom => {
+			} else {
-                    let name = inquire::Text::new("which scripts package to use?")
+				inquire::Select::new(
-                        .with_validator(|name: &str| {
+					"which scripts package do you want to use?",
-                            if name.is_empty() {
+					config
-                                return Ok(Validation::Valid);
+						.scripts_packages
-                            }
+						.into_iter()
+						.map(PackageNameOrCustom::PackageName)
+						.chain(std::iter::once(PackageNameOrCustom::Custom))
+						.collect(),
+				)
+				.prompt()
+				.unwrap()
+			};
 
-                            Ok(match PackageName::from_str(name) {
+			let scripts_package = match scripts_package {
-                                Ok(_) => Validation::Valid,
+				PackageNameOrCustom::PackageName(p) => Some(p),
-                                Err(e) => Validation::Invalid(e.to_string().into()),
+				PackageNameOrCustom::Custom => {
-                            })
+					let name = inquire::Text::new("which scripts package to use?")
-                        })
+						.with_validator(|name: &str| {
-                        .with_help_message("leave empty for none")
+							if name.is_empty() {
-                        .prompt()
+								return Ok(Validation::Valid);
-                        .unwrap();
+							}
 
-                    if name.is_empty() {
+							Ok(match PackageName::from_str(name) {
-                        None
+								Ok(_) => Validation::Valid,
-                    } else {
+								Err(e) => Validation::Invalid(e.to_string().into()),
-                        Some(PackageName::from_str(&name).unwrap())
+							})
-                    }
+						})
-                }
+						.with_help_message("leave empty for none")
-            };
+						.prompt()
+						.unwrap();
 
-            if let Some(scripts_pkg_name) = scripts_package {
+					if name.is_empty() {
-                let (v_id, pkg_ref) = source
+						None
-                    .resolve(
+					} else {
-                        &PesdeDependencySpecifier {
+						Some(PackageName::from_str(&name).unwrap())
-                            name: scripts_pkg_name,
+					}
-                            version: VersionReq::STAR,
+				}
-                            index: None,
+			};
-                            target: None,
-                        },
-                        &project,
-                        TargetKind::Lune,
-                        &mut HashSet::new(),
-                    )
-                    .await
-                    .context("failed to resolve scripts package")?
-                    .1
-                    .pop_last()
-                    .context("scripts package not found")?;
 
-                let Some(scripts) = pkg_ref.target.scripts().filter(|s| !s.is_empty()) else {
+			if let Some(scripts_pkg_name) = scripts_package {
-                    anyhow::bail!("scripts package has no scripts. this is an issue with the index")
+				let (v_id, pkg_ref) = source
-                };
+					.resolve(
+						&PesdeDependencySpecifier {
+							name: scripts_pkg_name.clone(),
+							version: VersionReq::STAR,
+							index: None,
+							target: None,
+						},
+						&ResolveOptions {
+							project: project.clone(),
+							target: TargetKind::Lune,
+							refreshed_sources,
+						},
+					)
+					.await
+					.context("failed to resolve scripts package")?
+					.1
+					.pop_last()
+					.context("scripts package not found")?;
 
-                let scripts_field = &mut manifest["scripts"]
+				let id = Arc::new(PackageId::new(PackageNames::Pesde(scripts_pkg_name), v_id));
-                    .or_insert(toml_edit::Item::Table(toml_edit::Table::new()));
 
-                for script_name in scripts.keys() {
+				let target = source
-                    scripts_field[script_name] = toml_edit::value(format!(
+					.get_target(
-                        "{SCRIPTS_LINK_FOLDER}/scripts/{script_name}.luau"
+						&pkg_ref,
-                    ));
+						&GetTargetOptions {
-                }
+							project: project.clone(),
+							// HACK: the pesde package source doesn't use the path, so we can just use an empty one
+							path: Arc::from(Path::new("")),
+							id: id.clone(),
+						},
+					)
+					.await?;
 
-                let dev_deps = &mut manifest["dev_dependencies"]
+				let Some(scripts) = target.scripts().filter(|s| !s.is_empty()) else {
-                    .or_insert(toml_edit::Item::Table(toml_edit::Table::new()));
+					anyhow::bail!("scripts package has no scripts.")
+				};
 
-                let field = &mut dev_deps["scripts"];
+				let scripts_field = &mut manifest["scripts"]
-                field["name"] = toml_edit::value(pkg_ref.name.to_string());
+					.or_insert(toml_edit::Item::Table(toml_edit::Table::new()));
-                field["version"] = toml_edit::value(format!("^{}", v_id.version()));
-                field["target"] = toml_edit::value(v_id.target().to_string());
 
-                for (alias, (spec, ty)) in pkg_ref.dependencies {
+				for script_name in scripts.keys() {
-                    if ty != DependencyType::Peer {
+					scripts_field[script_name] = toml_edit::value(format!(
-                        continue;
+						"{SCRIPTS_LINK_FOLDER}/scripts/{script_name}.luau"
-                    }
+					));
+				}
 
-                    let DependencySpecifiers::Pesde(spec) = spec else {
+				let dev_deps = &mut manifest["dev_dependencies"]
-                        continue;
+					.or_insert(toml_edit::Item::Table(toml_edit::Table::new()));
-                    };
 
-                    let field = &mut dev_deps[alias];
+				let field = &mut dev_deps["scripts"];
-                    field["name"] = toml_edit::value(spec.name.to_string());
+				field["name"] = toml_edit::value(id.name().to_string());
-                    field["version"] = toml_edit::value(spec.version.to_string());
+				field["version"] = toml_edit::value(format!("^{}", id.version_id().version()));
-                    field["target"] =
+				field["target"] = toml_edit::value(id.version_id().target().to_string());
-                        toml_edit::value(spec.target.unwrap_or_else(|| *v_id.target()).to_string());
+
-                }
+				for (alias, (spec, ty)) in pkg_ref.dependencies {
-            } else {
+					if ty != DependencyType::Peer {
-                println!(
+						continue;
-                    "{}",
+					}
-                    "no scripts package configured, this can cause issues with Roblox compatibility".red()
+
+					let DependencySpecifiers::Pesde(spec) = spec else {
+						continue;
+					};
+
+					let field = &mut dev_deps[alias.as_str()];
+					field["name"] = toml_edit::value(spec.name.to_string());
+					field["version"] = toml_edit::value(spec.version.to_string());
+					field["target"] = toml_edit::value(
+						spec.target
+							.unwrap_or_else(|| id.version_id().target())
+							.to_string(),
+					);
+				}
+			} else {
+				println!(
+                    "{ERROR_PREFIX}: no scripts package configured, this can cause issues with Roblox compatibility"
                 );
-                if !inquire::prompt_confirmation("initialize regardless?").unwrap() {
+				if !inquire::prompt_confirmation("initialize regardless?").unwrap() {
-                    return Ok(());
+					return Ok(());
-                }
+				}
-            }
+			}
-        }
+		}
 
-        project.write_manifest(manifest.to_string()).await?;
+		project.write_manifest(manifest.to_string()).await?;
 
-        println!(
+		println!(
-            "{}\n{}: run `install` to fully finish setup",
+			"{}\n{}: run `install` to fully finish setup",
-            "initialized project".green(),
+			SUCCESS_STYLE.apply_to("initialized project"),
-            "tip".cyan().bold()
+			INFO_STYLE.apply_to("tip")
-        );
+		);
-        Ok(())
+		Ok(())
-    }
+	}
 }

src/cli/commands/install.rs

@@ -1,328 +1,55 @@
 use crate::cli::{
-    bin_dir, files::make_executable, progress_bar, run_on_workspace_members, up_to_date_lockfile,
+	install::{install, InstallOptions},
+	run_on_workspace_members,
 };
-use anyhow::Context;
 use clap::Args;
-use colored::{ColoredString, Colorize};
+use pesde::Project;
-use fs_err::tokio as fs;
+use std::num::NonZeroUsize;
-use futures::future::try_join_all;
-use pesde::{
-    download_and_link::filter_graph, lockfile::Lockfile, manifest::target::TargetKind, Project,
-    MANIFEST_FILE_NAME,
-};
-use std::{
-    collections::{BTreeSet, HashMap, HashSet},
-    sync::Arc,
-};
-use tokio::sync::Mutex;
 
 #[derive(Debug, Args, Copy, Clone)]
 pub struct InstallCommand {
-    /// Whether to error on changes in the lockfile
+	/// Whether to error on changes in the lockfile
-    #[arg(long)]
+	#[arg(long)]
-    locked: bool,
+	locked: bool,
 
-    /// Whether to not install dev dependencies
+	/// Whether to not install dev dependencies
-    #[arg(long)]
+	#[arg(long)]
-    prod: bool,
+	prod: bool,
-}
 
-fn bin_link_file(alias: &str) -> String {
+	/// The maximum number of concurrent network requests
-    let mut all_combinations = BTreeSet::new();
+	#[arg(long, default_value = "16")]
+	network_concurrency: NonZeroUsize,
 
-    for a in TargetKind::VARIANTS {
+	/// Whether to re-install all dependencies even if they are already installed
-        for b in TargetKind::VARIANTS {
+	#[arg(long)]
-            all_combinations.insert((a, b));
+	force: bool,
-        }
-    }
-
-    let all_folders = all_combinations
-        .into_iter()
-        .map(|(a, b)| format!("{:?}", a.packages_folder(b)))
-        .collect::<BTreeSet<_>>()
-        .into_iter()
-        .collect::<Vec<_>>()
-        .join(", ");
-
-    format!(
-        r#"local process = require("@lune/process")
-local fs = require("@lune/fs")
-local stdio = require("@lune/stdio")
-
-local project_root = process.cwd
-local path_components = string.split(string.gsub(project_root, "\\", "/"), "/")
-
-for i = #path_components, 1, -1 do
-    local path = table.concat(path_components, "/", 1, i)
-    if fs.isFile(path .. "/{MANIFEST_FILE_NAME}") then
-        project_root = path
-        break
-    end
-end
-
-for _, packages_folder in {{ {all_folders} }} do
-    local path = `{{project_root}}/{{packages_folder}}/{alias}.bin.luau`
-    
-    if fs.isFile(path) then
-        require(path)
-        return
-    end
-end
-
-stdio.ewrite(stdio.color("red") .. "binary `{alias}` not found. are you in the right directory?" .. stdio.color("reset") .. "\n")
-    "#,
-    )
-}
-
-#[cfg(feature = "patches")]
-const JOBS: u8 = 5;
-#[cfg(not(feature = "patches"))]
-const JOBS: u8 = 4;
-
-fn job(n: u8) -> ColoredString {
-    format!("[{n}/{JOBS}]").dimmed().bold()
 }
 
 #[derive(Debug, thiserror::Error)]
 #[error(transparent)]
 struct CallbackError(#[from] anyhow::Error);
-
 impl InstallCommand {
-    pub async fn run(self, project: Project, reqwest: reqwest::Client) -> anyhow::Result<()> {
+	pub async fn run(self, project: Project, reqwest: reqwest::Client) -> anyhow::Result<()> {
-        let mut refreshed_sources = HashSet::new();
+		let options = InstallOptions {
+			locked: self.locked,
+			prod: self.prod,
+			write: true,
+			network_concurrency: self.network_concurrency,
+			use_lockfile: true,
+			force: self.force,
+		};
 
-        let manifest = project
+		install(&options, &project, reqwest.clone(), true).await?;
-            .deser_manifest()
-            .await
-            .context("failed to read manifest")?;
 
-        let lockfile = if self.locked {
+		run_on_workspace_members(&project, |project| {
-            match up_to_date_lockfile(&project).await? {
+			let reqwest = reqwest.clone();
-                None => {
+			async move {
-                    anyhow::bail!(
+				install(&options, &project, reqwest, false).await?;
-                        "lockfile is out of sync, run `{} install` to update it",
+				Ok(())
-                        env!("CARGO_BIN_NAME")
+			}
-                    );
+		})
-                }
+		.await?;
-                file => file,
-            }
-        } else {
-            match project.deser_lockfile().await {
-                Ok(lockfile) => {
-                    if lockfile.overrides != manifest.overrides {
-                        tracing::debug!("overrides are different");
-                        None
-                    } else if lockfile.target != manifest.target.kind() {
-                        tracing::debug!("target kind is different");
-                        None
-                    } else {
-                        Some(lockfile)
-                    }
-                }
-                Err(pesde::errors::LockfileReadError::Io(e))
-                    if e.kind() == std::io::ErrorKind::NotFound =>
-                {
-                    None
-                }
-                Err(e) => return Err(e.into()),
-            }
-        };
 
-        println!(
+		Ok(())
-            "\n{}\n",
+	}
-            format!("[now installing {} {}]", manifest.name, manifest.target)
-                .bold()
-                .on_bright_black()
-        );
-
-        println!("{} ❌ removing current package folders", job(1));
-
-        {
-            let mut deleted_folders = HashMap::new();
-
-            for target_kind in TargetKind::VARIANTS {
-                let folder = manifest.target.kind().packages_folder(target_kind);
-                let package_dir = project.package_dir();
-
-                deleted_folders
-                    .entry(folder.to_string())
-                    .or_insert_with(|| async move {
-                        tracing::debug!("deleting the {folder} folder");
-
-                        if let Some(e) = fs::remove_dir_all(package_dir.join(&folder))
-                            .await
-                            .err()
-                            .filter(|e| e.kind() != std::io::ErrorKind::NotFound)
-                        {
-                            return Err(e).context(format!("failed to remove the {folder} folder"));
-                        };
-
-                        Ok(())
-                    });
-            }
-
-            try_join_all(deleted_folders.into_values())
-                .await
-                .context("failed to remove package folders")?;
-        }
-
-        let old_graph = lockfile.map(|lockfile| {
-            lockfile
-                .graph
-                .into_iter()
-                .map(|(name, versions)| {
-                    (
-                        name,
-                        versions
-                            .into_iter()
-                            .map(|(version, node)| (version, node.node))
-                            .collect(),
-                    )
-                })
-                .collect()
-        });
-
-        println!("{} 📦 building dependency graph", job(2));
-
-        let graph = project
-            .dependency_graph(old_graph.as_ref(), &mut refreshed_sources, false)
-            .await
-            .context("failed to build dependency graph")?;
-        let graph = Arc::new(graph);
-
-        let bin_folder = bin_dir().await?;
-
-        let downloaded_graph = {
-            let (rx, downloaded_graph) = project
-                .download_and_link(
-                    &graph,
-                    &Arc::new(Mutex::new(refreshed_sources)),
-                    &reqwest,
-                    self.prod,
-                    true,
-                    |graph| {
-                        let graph = graph.clone();
-
-                        async move {
-                            try_join_all(
-                                graph
-                                    .values()
-                                    .flat_map(|versions| versions.values())
-                                    .filter(|node| node.target.bin_path().is_some())
-                                    .filter_map(|node| node.node.direct.as_ref())
-                                    .map(|(alias, _, _)| alias)
-                                    .filter(|alias| {
-                                        if *alias == env!("CARGO_BIN_NAME") {
-                                            tracing::warn!(
-                                            "package {alias} has the same name as the CLI, skipping bin link"
-                                        );
-                                            return false;
-                                        }
-
-                                        true
-                                    })
-                                    .map(|alias| {
-                                        let bin_folder = bin_folder.clone();
-                                        async move {
-                                            let bin_exec_file = bin_folder.join(alias).with_extension(std::env::consts::EXE_EXTENSION);
-
-                                            let impl_folder = bin_folder.join(".impl");
-                                            fs::create_dir_all(&impl_folder).await.context("failed to create bin link folder")?;
-
-                                            let bin_file = impl_folder.join(alias).with_extension("luau");
-                                            fs::write(&bin_file, bin_link_file(alias))
-                                                .await
-                                                .context("failed to write bin link file")?;
-
-
-                                            #[cfg(windows)]
-                                            {
-                                                fs::copy(
-                                                    std::env::current_exe()
-                                                        .context("failed to get current executable path")?,
-                                                    &bin_exec_file,
-                                                )
-                                                    .await
-                                                    .context("failed to copy bin link file")?;
-                                            }
-
-                                            #[cfg(not(windows))]
-                                            {
-                                                fs::write(
-                                                    &bin_exec_file,
-                                                    format!(r#"#!/bin/sh
-exec lune run "$(dirname "$0")/.impl/{alias}.luau" -- "$@""#
-                                                    ),
-                                                )
-                                                    .await
-                                                    .context("failed to link bin link file")?;
-                                            }
-
-                                            make_executable(&bin_exec_file).await.context("failed to make bin link file executable")?;
-
-                                            Ok::<_, CallbackError>(())
-                                        }
-                                    }),
-                            )
-                                .await
-                                .map(|_| ())
-                        }
-                    }
-                )
-                .await
-                .context("failed to download dependencies")?;
-
-            progress_bar(
-                graph.values().map(|versions| versions.len() as u64).sum(),
-                rx,
-                format!("{} 📥 ", job(3)),
-                "downloading dependencies".to_string(),
-                "downloaded dependencies".to_string(),
-            )
-            .await?;
-
-            downloaded_graph
-                .await
-                .context("failed to download & link dependencies")?
-        };
-
-        #[cfg(feature = "patches")]
-        {
-            let rx = project
-                .apply_patches(&filter_graph(&downloaded_graph, self.prod))
-                .await
-                .context("failed to apply patches")?;
-
-            progress_bar(
-                manifest.patches.values().map(|v| v.len() as u64).sum(),
-                rx,
-                format!("{} 🩹 ", job(JOBS - 1)),
-                "applying patches".to_string(),
-                "applied patches".to_string(),
-            )
-            .await?;
-        }
-
-        println!("{} 🧹 finishing up", job(JOBS));
-
-        project
-            .write_lockfile(Lockfile {
-                name: manifest.name,
-                version: manifest.version,
-                target: manifest.target.kind(),
-                overrides: manifest.overrides,
-
-                graph: downloaded_graph,
-
-                workspace: run_on_workspace_members(&project, |project| {
-                    let reqwest = reqwest.clone();
-                    async move { Box::pin(self.run(project, reqwest)).await }
-                })
-                .await?,
-            })
-            .await
-            .context("failed to write lockfile")?;
-
-        Ok(())
-    }
 }

src/cli/commands/list.rs

@@ -0,0 +1,51 @@
+use std::collections::BTreeMap;
+
+use anyhow::Context;
+use clap::Args;
+
+use crate::cli::{
+	dep_type_to_key,
+	style::{INFO_STYLE, SUCCESS_STYLE},
+};
+use pesde::{
+	manifest::{Alias, DependencyType},
+	source::specifiers::DependencySpecifiers,
+	Project,
+};
+
+#[derive(Debug, Args)]
+pub struct ListCommand {}
+
+impl ListCommand {
+	pub async fn run(self, project: Project) -> anyhow::Result<()> {
+		let manifest = project
+			.deser_manifest()
+			.await
+			.context("failed to read manifest")?;
+
+		let all_deps = manifest
+			.all_dependencies()
+			.context("failed to get all dependencies")?
+			.into_iter()
+			.fold(
+				BTreeMap::<DependencyType, BTreeMap<Alias, DependencySpecifiers>>::new(),
+				|mut acc, (alias, (spec, ty))| {
+					acc.entry(ty).or_default().insert(alias, spec);
+					acc
+				},
+			);
+
+		for (dep_ty, deps) in all_deps {
+			let dep_key = dep_type_to_key(dep_ty);
+			println!("{}", INFO_STYLE.apply_to(dep_key));
+
+			for (alias, spec) in deps {
+				println!("{}: {spec}", SUCCESS_STYLE.apply_to(alias));
+			}
+
+			println!();
+		}
+
+		Ok(())
+	}
+}

src/cli/commands/mod.rs

@@ -2,95 +2,121 @@ use pesde::Project;
 
 mod add;
 mod auth;
+mod cas;
 mod config;
+mod deprecate;
 mod execute;
 mod init;
 mod install;
+mod list;
 mod outdated;
 #[cfg(feature = "patches")]
 mod patch;
 #[cfg(feature = "patches")]
 mod patch_commit;
 mod publish;
+mod remove;
 mod run;
 #[cfg(feature = "version-management")]
 mod self_install;
 #[cfg(feature = "version-management")]
 mod self_upgrade;
 mod update;
+mod yank;
 
 #[derive(Debug, clap::Subcommand)]
 pub enum Subcommand {
-    /// Authentication-related commands
+	/// Authentication-related commands
-    Auth(auth::AuthSubcommand),
+	Auth(auth::AuthSubcommand),
 
-    /// Configuration-related commands
+	/// Configuration-related commands
-    #[command(subcommand)]
+	#[command(subcommand)]
-    Config(config::ConfigCommands),
+	Config(config::ConfigCommands),
 
-    /// Initializes a manifest file in the current directory
+	/// CAS-related commands
-    Init(init::InitCommand),
+	#[command(subcommand)]
+	Cas(cas::CasCommands),
 
-    /// Runs a script, an executable package, or a file with Lune
+	/// Initializes a manifest file in the current directory
-    Run(run::RunCommand),
+	Init(init::InitCommand),
 
-    /// Installs all dependencies for the project
+	/// Adds a dependency to the project
-    Install(install::InstallCommand),
+	Add(add::AddCommand),
 
-    /// Publishes the project to the registry
+	/// Removes a dependency from the project
-    Publish(publish::PublishCommand),
+	Remove(remove::RemoveCommand),
 
-    /// Installs the pesde binary and scripts
+	/// Installs all dependencies for the project
-    #[cfg(feature = "version-management")]
+	Install(install::InstallCommand),
-    SelfInstall(self_install::SelfInstallCommand),
 
-    /// Sets up a patching environment for a package
+	/// Updates the project's lockfile. Run install to apply changes
-    #[cfg(feature = "patches")]
+	Update(update::UpdateCommand),
-    Patch(patch::PatchCommand),
 
-    /// Finalizes a patching environment for a package
+	/// Checks for outdated dependencies
-    #[cfg(feature = "patches")]
+	Outdated(outdated::OutdatedCommand),
-    PatchCommit(patch_commit::PatchCommitCommand),
 
-    /// Installs the latest version of pesde
+	/// Lists all dependencies in the project
-    #[cfg(feature = "version-management")]
+	List(list::ListCommand),
-    SelfUpgrade(self_upgrade::SelfUpgradeCommand),
 
-    /// Adds a dependency to the project
+	/// Runs a script, an executable package, or a file with Lune
-    Add(add::AddCommand),
+	Run(run::RunCommand),
 
-    /// Updates the project's lockfile. Run install to apply changes
+	/// Publishes the project to the registry
-    Update(update::UpdateCommand),
+	Publish(publish::PublishCommand),
 
-    /// Checks for outdated dependencies
+	/// Yanks a package from the registry
-    Outdated(outdated::OutdatedCommand),
+	Yank(yank::YankCommand),
 
-    /// Executes a binary package without needing to be run in a project directory
+	/// Deprecates a package from the registry
-    #[clap(name = "x", visible_alias = "execute", visible_alias = "exec")]
+	Deprecate(deprecate::DeprecateCommand),
-    Execute(execute::ExecuteCommand),
+
+	/// Sets up a patching environment for a package
+	#[cfg(feature = "patches")]
+	Patch(patch::PatchCommand),
+
+	/// Finalizes a patching environment for a package
+	#[cfg(feature = "patches")]
+	PatchCommit(patch_commit::PatchCommitCommand),
+
+	/// Executes a binary package without needing to be run in a project directory
+	#[clap(name = "x", visible_alias = "execute", visible_alias = "exec")]
+	Execute(execute::ExecuteCommand),
+
+	/// Installs the pesde binary and scripts
+	#[cfg(feature = "version-management")]
+	SelfInstall(self_install::SelfInstallCommand),
+
+	/// Installs the latest version of pesde
+	#[cfg(feature = "version-management")]
+	SelfUpgrade(self_upgrade::SelfUpgradeCommand),
 }
 
 impl Subcommand {
-    pub async fn run(self, project: Project, reqwest: reqwest::Client) -> anyhow::Result<()> {
+	pub async fn run(self, project: Project, reqwest: reqwest::Client) -> anyhow::Result<()> {
-        match self {
+		match self {
-            Subcommand::Auth(auth) => auth.run(project, reqwest).await,
+			Subcommand::Auth(auth) => auth.run(project, reqwest).await,
-            Subcommand::Config(config) => config.run().await,
+			Subcommand::Config(config) => config.run().await,
-            Subcommand::Init(init) => init.run(project).await,
+			Subcommand::Cas(cas) => cas.run(project).await,
-            Subcommand::Run(run) => run.run(project).await,
+			Subcommand::Init(init) => init.run(project).await,
-            Subcommand::Install(install) => install.run(project, reqwest).await,
+			Subcommand::Add(add) => add.run(project).await,
-            Subcommand::Publish(publish) => publish.run(project, reqwest).await,
+			Subcommand::Remove(remove) => remove.run(project).await,
-            #[cfg(feature = "version-management")]
+			Subcommand::Install(install) => install.run(project, reqwest).await,
-            Subcommand::SelfInstall(self_install) => self_install.run().await,
+			Subcommand::Update(update) => update.run(project, reqwest).await,
-            #[cfg(feature = "patches")]
+			Subcommand::Outdated(outdated) => outdated.run(project).await,
-            Subcommand::Patch(patch) => patch.run(project, reqwest).await,
+			Subcommand::List(list) => list.run(project).await,
-            #[cfg(feature = "patches")]
+			Subcommand::Run(run) => run.run(project).await,
-            Subcommand::PatchCommit(patch_commit) => patch_commit.run(project).await,
+			Subcommand::Publish(publish) => publish.run(project, reqwest).await,
-            #[cfg(feature = "version-management")]
+			Subcommand::Yank(yank) => yank.run(project, reqwest).await,
-            Subcommand::SelfUpgrade(self_upgrade) => self_upgrade.run(reqwest).await,
+			Subcommand::Deprecate(deprecate) => deprecate.run(project, reqwest).await,
-            Subcommand::Add(add) => add.run(project).await,
+			#[cfg(feature = "patches")]
-            Subcommand::Update(update) => update.run(project, reqwest).await,
+			Subcommand::Patch(patch) => patch.run(project, reqwest).await,
-            Subcommand::Outdated(outdated) => outdated.run(project).await,
+			#[cfg(feature = "patches")]
-            Subcommand::Execute(execute) => execute.run(project, reqwest).await,
+			Subcommand::PatchCommit(patch_commit) => patch_commit.run(project).await,
-        }
+			Subcommand::Execute(execute) => execute.run(project, reqwest).await,
-    }
+			#[cfg(feature = "version-management")]
+			Subcommand::SelfInstall(self_install) => self_install.run().await,
+			#[cfg(feature = "version-management")]
+			Subcommand::SelfUpgrade(self_upgrade) => self_upgrade.run(reqwest).await,
+		}
+	}
 }

src/cli/commands/outdated.rs

@@ -1,136 +1,130 @@
 use crate::cli::up_to_date_lockfile;
 use anyhow::Context;
 use clap::Args;
-use futures::future::try_join_all;
 use pesde::{
-    refresh_sources,
+	source::{
-    source::{
+		specifiers::DependencySpecifiers,
-        refs::PackageRefs,
+		traits::{PackageRef, PackageSource, RefreshOptions, ResolveOptions},
-        specifiers::DependencySpecifiers,
+	},
-        traits::{PackageRef, PackageSource},
+	Project, RefreshedSources,
-    },
-    Project,
 };
 use semver::VersionReq;
-use std::{collections::HashSet, sync::Arc};
+use tokio::task::JoinSet;
-use tokio::sync::Mutex;
 
 #[derive(Debug, Args)]
 pub struct OutdatedCommand {
-    /// Whether to check within version requirements
+	/// Whether to check within version requirements
-    #[arg(short, long)]
+	#[arg(short, long)]
-    strict: bool,
+	strict: bool,
 }
 
 impl OutdatedCommand {
-    pub async fn run(self, project: Project) -> anyhow::Result<()> {
+	pub async fn run(self, project: Project) -> anyhow::Result<()> {
-        let graph = match up_to_date_lockfile(&project).await? {
+		let graph = match up_to_date_lockfile(&project).await? {
-            Some(file) => file.graph,
+			Some(file) => file.graph,
-            None => {
+			None => {
-                anyhow::bail!(
+				anyhow::bail!(
-                    "lockfile is out of sync, run `{} install` to update it",
+					"lockfile is out of sync, run `{} install` to update it",
-                    env!("CARGO_BIN_NAME")
+					env!("CARGO_BIN_NAME")
-                );
+				);
-            }
+			}
-        };
+		};
 
-        let manifest = project
+		let manifest = project
-            .deser_manifest()
+			.deser_manifest()
-            .await
+			.await
-            .context("failed to read manifest")?;
+			.context("failed to read manifest")?;
-        let manifest_target_kind = manifest.target.kind();
+		let manifest_target_kind = manifest.target.kind();
 
-        let mut refreshed_sources = HashSet::new();
+		let refreshed_sources = RefreshedSources::new();
 
-        refresh_sources(
+		let mut tasks = graph
-            &project,
+			.into_iter()
-            graph
+			.map(|(current_id, node)| {
-                .iter()
+				let project = project.clone();
-                .flat_map(|(_, versions)| versions.iter())
+				let refreshed_sources = refreshed_sources.clone();
-                .map(|(_, node)| node.node.pkg_ref.source()),
+				async move {
-            &mut refreshed_sources,
+					let Some((alias, mut specifier, _)) = node.direct else {
-        )
+						return Ok::<bool, anyhow::Error>(true);
-        .await?;
+					};
 
-        let refreshed_sources = Arc::new(Mutex::new(refreshed_sources));
+					if matches!(
+						specifier,
+						DependencySpecifiers::Git(_)
+							| DependencySpecifiers::Workspace(_)
+							| DependencySpecifiers::Path(_)
+					) {
+						return Ok(true);
+					}
 
-        if try_join_all(
+					let source = node.pkg_ref.source();
-            graph
+					refreshed_sources
-                .into_iter()
+						.refresh(
-                .flat_map(|(_, versions)| versions.into_iter())
+							&source,
-                .map(|(current_version_id, node)| {
+							&RefreshOptions {
-                    let project = project.clone();
+								project: project.clone(),
-                    let refreshed_sources = refreshed_sources.clone();
+							},
-                    async move {
+						)
-                        let Some((alias, mut specifier, _)) = node.node.direct else {
+						.await?;
-                            return Ok::<bool, anyhow::Error>(true);
-                        };
 
-                        if matches!(
+					if !self.strict {
-                            specifier,
+						match &mut specifier {
-                            DependencySpecifiers::Git(_) | DependencySpecifiers::Workspace(_)
+							DependencySpecifiers::Pesde(spec) => {
-                        ) {
+								spec.version = VersionReq::STAR;
-                            return Ok(true);
+							}
-                        }
+							#[cfg(feature = "wally-compat")]
+							DependencySpecifiers::Wally(spec) => {
+								spec.version = VersionReq::STAR;
+							}
+							DependencySpecifiers::Git(_) => {}
+							DependencySpecifiers::Workspace(_) => {}
+							DependencySpecifiers::Path(_) => {}
+						};
+					}
 
-                        let source = node.node.pkg_ref.source();
+					let version_id = source
+						.resolve(
+							&specifier,
+							&ResolveOptions {
+								project: project.clone(),
+								target: manifest_target_kind,
+								refreshed_sources: refreshed_sources.clone(),
+							},
+						)
+						.await
+						.context("failed to resolve package versions")?
+						.1
+						.pop_last()
+						.map(|(v_id, _)| v_id)
+						.with_context(|| format!("no versions of {specifier} found"))?;
 
-                        if !self.strict {
+					if version_id != *current_id.version_id() {
-                            match specifier {
+						println!(
-                                DependencySpecifiers::Pesde(ref mut spec) => {
+							"{} ({alias}) {} -> {version_id}",
-                                    spec.version = VersionReq::STAR;
+							current_id.name(),
-                                }
+							current_id.version_id(),
-                                #[cfg(feature = "wally-compat")]
+						);
-                                DependencySpecifiers::Wally(ref mut spec) => {
-                                    spec.version = VersionReq::STAR;
-                                }
-                                DependencySpecifiers::Git(_) => {}
-                                DependencySpecifiers::Workspace(_) => {}
-                            };
-                        }
 
-                        let version_id = source
+						return Ok(false);
-                            .resolve(
+					}
-                                &specifier,
-                                &project,
-                                manifest_target_kind,
-                                &mut *refreshed_sources.lock().await,
-                            )
-                            .await
-                            .context("failed to resolve package versions")?
-                            .1
-                            .pop_last()
-                            .map(|(v_id, _)| v_id)
-                            .context(format!("no versions of {specifier} found"))?;
 
-                        if version_id != current_version_id {
+					Ok(true)
-                            println!(
+				}
-                                "{} {} ({alias}) {} -> {}",
+			})
-                                match node.node.pkg_ref {
+			.collect::<JoinSet<_>>();
-                                    PackageRefs::Pesde(pkg_ref) => pkg_ref.name.to_string(),
-                                    #[cfg(feature = "wally-compat")]
-                                    PackageRefs::Wally(pkg_ref) => pkg_ref.name.to_string(),
-                                    _ => unreachable!(),
-                                },
-                                current_version_id.target(),
-                                current_version_id.version(),
-                                version_id.version()
-                            );
 
-                            return Ok(false);
+		let mut all_up_to_date = true;
-                        }
 
-                        Ok(true)
+		while let Some(task) = tasks.join_next().await {
-                    }
+			if !task.unwrap()? {
-                }),
+				all_up_to_date = false;
-        )
+			}
-        .await?
+		}
-        .into_iter()
-        .all(|b| b)
-        {
-            println!("all packages are up to date");
-        }
 
-        Ok(())
+		if all_up_to_date {
-    }
+			println!("all packages are up to date");
+		}
+
+		Ok(())
+	}
 }

src/cli/commands/patch.rs

@@ -1,79 +1,87 @@
-use crate::cli::{up_to_date_lockfile, VersionedPackageName};
+use std::sync::Arc;
+
+use crate::cli::{
+	style::{CLI_STYLE, INFO_STYLE, WARN_PREFIX},
+	up_to_date_lockfile, VersionedPackageName,
+};
 use anyhow::Context;
 use clap::Args;
-use colored::Colorize;
+use console::style;
 use fs_err::tokio as fs;
 use pesde::{
-    patches::setup_patches_repo,
+	patches::setup_patches_repo,
-    source::{
+	source::{
-        refs::PackageRefs,
+		refs::PackageRefs,
-        traits::{PackageRef, PackageSource},
+		traits::{DownloadOptions, PackageRef, PackageSource},
-    },
+	},
-    Project, MANIFEST_FILE_NAME,
+	Project, MANIFEST_FILE_NAME,
 };
 
 #[derive(Debug, Args)]
 pub struct PatchCommand {
-    /// The package name to patch
+	/// The package name to patch
-    #[arg(index = 1)]
+	#[arg(index = 1)]
-    package: VersionedPackageName,
+	package: VersionedPackageName,
 }
 
 impl PatchCommand {
-    pub async fn run(self, project: Project, reqwest: reqwest::Client) -> anyhow::Result<()> {
+	pub async fn run(self, project: Project, reqwest: reqwest::Client) -> anyhow::Result<()> {
-        let graph = if let Some(lockfile) = up_to_date_lockfile(&project).await? {
+		let graph = if let Some(lockfile) = up_to_date_lockfile(&project).await? {
-            lockfile.graph
+			lockfile.graph
-        } else {
+		} else {
-            anyhow::bail!("outdated lockfile, please run the install command first")
+			anyhow::bail!("outdated lockfile, please run the install command first")
-        };
+		};
 
-        let (name, version_id) = self.package.get(&graph)?;
+		let id = self.package.get(&graph)?;
 
-        let node = graph
+		let node = graph.get(&id).context("package not found in graph")?;
-            .get(&name)
-            .and_then(|versions| versions.get(&version_id))
-            .context("package not found in graph")?;
 
-        if matches!(node.node.pkg_ref, PackageRefs::Workspace(_)) {
+		if matches!(
-            anyhow::bail!("cannot patch a workspace package")
+			node.pkg_ref,
-        }
+			PackageRefs::Workspace(_) | PackageRefs::Path(_)
+		) {
+			anyhow::bail!("cannot patch a workspace or a path package")
+		}
 
-        let source = node.node.pkg_ref.source();
+		let source = node.pkg_ref.source();
 
-        let directory = project
+		let directory = project
-            .data_dir()
+			.data_dir()
-            .join("patches")
+			.join("patches")
-            .join(name.escaped())
+			.join(id.name().escaped())
-            .join(version_id.escaped())
+			.join(id.version_id().escaped())
-            .join(chrono::Utc::now().timestamp().to_string());
+			.join(jiff::Timestamp::now().as_second().to_string());
-        fs::create_dir_all(&directory).await?;
+		fs::create_dir_all(&directory).await?;
 
-        source
+		source
-            .download(&node.node.pkg_ref, &project, &reqwest)
+			.download(
-            .await?
+				&node.pkg_ref,
-            .0
+				&DownloadOptions {
-            .write_to(&directory, project.cas_dir(), false)
+					project: project.clone(),
-            .await
+					reqwest,
-            .context("failed to write package contents")?;
+					reporter: Arc::new(()),
+					id: Arc::new(id),
+				},
+			)
+			.await?
+			.write_to(&directory, project.cas_dir(), false)
+			.await
+			.context("failed to write package contents")?;
 
-        setup_patches_repo(&directory)?;
+		setup_patches_repo(&directory)?;
 
-        println!(
+		println!(
-            concat!(
+			r#"done! modify the files in the directory, then run {} {}{} to apply.
-                "done! modify the files in the directory, then run `",
+{WARN_PREFIX}: do not commit these changes
-                env!("CARGO_BIN_NAME"),
+{}: the {MANIFEST_FILE_NAME} file will be ignored when patching"#,
-                r#" patch-commit {}` to apply.
+			CLI_STYLE.apply_to(concat!("`", env!("CARGO_BIN_NAME"), " patch-commit")),
-{}: do not commit these changes
+			style(format!("'{}'", directory.display())).cyan().bold(),
-{}: the {} file will be ignored when patching"#
+			CLI_STYLE.apply_to("`"),
-            ),
+			INFO_STYLE.apply_to("note")
-            directory.display().to_string().bold().cyan(),
+		);
-            "warning".yellow(),
-            "note".blue(),
-            MANIFEST_FILE_NAME
-        );
 
-        open::that(directory)?;
+		open::that(directory)?;
 
-        Ok(())
+		Ok(())
-    }
+	}
 }

src/cli/commands/patch_commit.rs

@@ -2,96 +2,102 @@ use crate::cli::up_to_date_lockfile;
 use anyhow::Context;
 use clap::Args;
 use fs_err::tokio as fs;
-use pesde::{names::PackageNames, patches::create_patch, source::version_id::VersionId, Project};
+use pesde::{
+	names::PackageNames,
+	patches::create_patch,
+	source::ids::{PackageId, VersionId},
+	Project,
+};
 use std::{path::PathBuf, str::FromStr};
 
 #[derive(Debug, Args)]
 pub struct PatchCommitCommand {
-    /// The directory containing the patch to commit
+	/// The directory containing the patch to commit
-    #[arg(index = 1)]
+	#[arg(index = 1)]
-    directory: PathBuf,
+	directory: PathBuf,
 }
 
 impl PatchCommitCommand {
-    pub async fn run(self, project: Project) -> anyhow::Result<()> {
+	pub async fn run(self, project: Project) -> anyhow::Result<()> {
-        let graph = if let Some(lockfile) = up_to_date_lockfile(&project).await? {
+		let graph = if let Some(lockfile) = up_to_date_lockfile(&project).await? {
-            lockfile.graph
+			lockfile.graph
-        } else {
+		} else {
-            anyhow::bail!("outdated lockfile, please run the install command first")
+			anyhow::bail!("outdated lockfile, please run the install command first")
-        };
+		};
 
-        let (name, version_id) = (
+		let id = PackageId::new(
-            PackageNames::from_escaped(
+			PackageNames::from_escaped(
-                self.directory
+				self.directory
-                    .parent()
+					.parent()
-                    .context("directory has no parent")?
+					.context("directory has no parent")?
-                    .parent()
+					.parent()
-                    .context("directory has no grandparent")?
+					.context("directory has no grandparent")?
-                    .file_name()
+					.file_name()
-                    .context("directory grandparent has no name")?
+					.context("directory grandparent has no name")?
-                    .to_str()
+					.to_str()
-                    .context("directory grandparent name is not valid")?,
+					.context("directory grandparent name is not valid")?,
-            )?,
+			)?,
-            VersionId::from_escaped(
+			VersionId::from_escaped(
-                self.directory
+				self.directory
-                    .parent()
+					.parent()
-                    .context("directory has no parent")?
+					.context("directory has no parent")?
-                    .file_name()
+					.file_name()
-                    .context("directory parent has no name")?
+					.context("directory parent has no name")?
-                    .to_str()
+					.to_str()
-                    .context("directory parent name is not valid")?,
+					.context("directory parent name is not valid")?,
-            )?,
+			)?,
-        );
+		);
 
-        graph
+		graph.get(&id).context("package not found in graph")?;
-            .get(&name)
-            .and_then(|versions| versions.get(&version_id))
-            .context("package not found in graph")?;
 
-        let mut manifest = toml_edit::DocumentMut::from_str(
+		let mut manifest = toml_edit::DocumentMut::from_str(
-            &project
+			&project
-                .read_manifest()
+				.read_manifest()
-                .await
+				.await
-                .context("failed to read manifest")?,
+				.context("failed to read manifest")?,
-        )
+		)
-        .context("failed to parse manifest")?;
+		.context("failed to parse manifest")?;
 
-        let patch = create_patch(&self.directory).context("failed to create patch")?;
+		let patch = create_patch(&self.directory).context("failed to create patch")?;
-        fs::remove_dir_all(self.directory)
+		fs::remove_dir_all(self.directory)
-            .await
+			.await
-            .context("failed to remove patch directory")?;
+			.context("failed to remove patch directory")?;
 
-        let patches_dir = project.package_dir().join("patches");
+		let patches_dir = project.package_dir().join("patches");
-        fs::create_dir_all(&patches_dir)
+		fs::create_dir_all(&patches_dir)
-            .await
+			.await
-            .context("failed to create patches directory")?;
+			.context("failed to create patches directory")?;
 
-        let patch_file_name = format!("{}-{}.patch", name.escaped(), version_id.escaped());
+		let patch_file_name = format!(
+			"{}-{}.patch",
+			id.name().escaped(),
+			id.version_id().escaped()
+		);
 
-        let patch_file = patches_dir.join(&patch_file_name);
+		let patch_file = patches_dir.join(&patch_file_name);
-        if patch_file.exists() {
+		if patch_file.exists() {
-            anyhow::bail!("patch file already exists: {}", patch_file.display());
+			anyhow::bail!("patch file already exists: {}", patch_file.display());
-        }
+		}
 
-        fs::write(&patch_file, patch)
+		fs::write(&patch_file, patch)
-            .await
+			.await
-            .context("failed to write patch file")?;
+			.context("failed to write patch file")?;
 
-        manifest["patches"].or_insert(toml_edit::Item::Table(toml_edit::Table::new()))
+		manifest["patches"].or_insert(toml_edit::Item::Table(toml_edit::Table::new()))
-            [&name.to_string()][&version_id.to_string()] =
+			[&id.name().to_string()][&id.version_id().to_string()] =
-            toml_edit::value(format!("patches/{patch_file_name}"));
+			toml_edit::value(format!("patches/{patch_file_name}"));
 
-        project
+		project
-            .write_manifest(manifest.to_string())
+			.write_manifest(manifest.to_string())
-            .await
+			.await
-            .context("failed to write manifest")?;
+			.context("failed to write manifest")?;
 
-        println!(concat!(
+		println!(concat!(
-            "done! run `",
+			"done! run `",
-            env!("CARGO_BIN_NAME"),
+			env!("CARGO_BIN_NAME"),
-            " install` to apply the patch"
+			" install` to apply the patch"
-        ));
+		));
 
-        Ok(())
+		Ok(())
-    }
+	}
 }

src/cli/commands/remove.rs

@@ -0,0 +1,59 @@
+use std::str::FromStr;
+
+use anyhow::Context;
+use clap::Args;
+
+use crate::cli::{
+	dep_type_to_key,
+	style::{INFO_STYLE, SUCCESS_STYLE},
+};
+use pesde::{
+	manifest::{Alias, DependencyType},
+	Project,
+};
+
+#[derive(Debug, Args)]
+pub struct RemoveCommand {
+	/// The alias of the package to remove
+	#[arg(index = 1)]
+	alias: Alias,
+}
+
+impl RemoveCommand {
+	pub async fn run(self, project: Project) -> anyhow::Result<()> {
+		let mut manifest = toml_edit::DocumentMut::from_str(
+			&project
+				.read_manifest()
+				.await
+				.context("failed to read manifest")?,
+		)
+		.context("failed to parse manifest")?;
+
+		let Some(dep_key) = DependencyType::VARIANTS
+			.iter()
+			.copied()
+			.map(dep_type_to_key)
+			.find(|dependency_key| {
+				manifest[dependency_key]
+					.as_table_mut()
+					.is_some_and(|table| table.remove(self.alias.as_str()).is_some())
+			})
+		else {
+			anyhow::bail!("package under alias `{}` not found in manifest", self.alias)
+		};
+
+		project
+			.write_manifest(manifest.to_string())
+			.await
+			.context("failed to write manifest")?;
+
+		println!(
+			"{} removed {} from {}!",
+			SUCCESS_STYLE.apply_to("success!"),
+			INFO_STYLE.apply_to(self.alias),
+			INFO_STYLE.apply_to(dep_key)
+		);
+
+		Ok(())
+	}
+}

src/cli/commands/run.rs

@@ -3,175 +3,196 @@ use anyhow::Context;
 use clap::Args;
 use futures::{StreamExt, TryStreamExt};
 use pesde::{
-    linking::generator::generate_bin_linking_module,
+	errors::{ManifestReadError, WorkspaceMembersError},
-    names::{PackageName, PackageNames},
+	linking::generator::generate_bin_linking_module,
-    Project, MANIFEST_FILE_NAME, PACKAGES_CONTAINER_NAME,
+	names::{PackageName, PackageNames},
+	source::traits::{GetTargetOptions, PackageRef, PackageSource, RefreshOptions},
+	Project, MANIFEST_FILE_NAME,
 };
 use relative_path::RelativePathBuf;
 use std::{
-    collections::HashSet, env::current_dir, ffi::OsString, io::Write, path::PathBuf,
+	collections::HashSet, env::current_dir, ffi::OsString, io::Write, path::Path, process::Command,
-    process::Command,
+	sync::Arc,
 };
 
 #[derive(Debug, Args)]
 pub struct RunCommand {
-    /// The package name, script name, or path to a script to run
+	/// The package name, script name, or path to a script to run
-    #[arg(index = 1)]
+	#[arg(index = 1)]
-    package_or_script: Option<String>,
+	package_or_script: Option<String>,
 
-    /// Arguments to pass to the script
+	/// Arguments to pass to the script
-    #[arg(index = 2, last = true)]
+	#[arg(index = 2, last = true)]
-    args: Vec<OsString>,
+	args: Vec<OsString>,
 }
 
 impl RunCommand {
-    pub async fn run(self, project: Project) -> anyhow::Result<()> {
+	pub async fn run(self, project: Project) -> anyhow::Result<()> {
-        let run = |root: PathBuf, file_path: PathBuf| {
+		let run = |root: &Path, file_path: &Path| {
-            let mut caller = tempfile::NamedTempFile::new().expect("failed to create tempfile");
+			let mut caller = tempfile::NamedTempFile::new().expect("failed to create tempfile");
-            caller
+			caller
-                .write_all(
+				.write_all(
-                    generate_bin_linking_module(
+					generate_bin_linking_module(
-                        root,
+						root,
-                        &format!("{:?}", file_path.to_string_lossy()),
+						&format!("{:?}", file_path.to_string_lossy()),
-                    )
+					)
-                    .as_bytes(),
+					.as_bytes(),
-                )
+				)
-                .expect("failed to write to tempfile");
+				.expect("failed to write to tempfile");
 
-            let status = Command::new("lune")
+			let status = Command::new("lune")
-                .arg("run")
+				.arg("run")
-                .arg(caller.path())
+				.arg(caller.path())
-                .arg("--")
+				.arg("--")
-                .args(&self.args)
+				.args(&self.args)
-                .current_dir(current_dir().expect("failed to get current directory"))
+				.current_dir(current_dir().expect("failed to get current directory"))
-                .status()
+				.status()
-                .expect("failed to run script");
+				.expect("failed to run script");
 
-            drop(caller);
+			drop(caller);
 
-            std::process::exit(status.code().unwrap_or(1))
+			std::process::exit(status.code().unwrap_or(1))
-        };
+		};
 
-        let Some(package_or_script) = self.package_or_script else {
+		let Some(package_or_script) = self.package_or_script else {
-            if let Some(script_path) = project.deser_manifest().await?.target.bin_path() {
+			if let Some(script_path) = project.deser_manifest().await?.target.bin_path() {
-                run(
+				run(
-                    project.package_dir().to_owned(),
+					project.package_dir(),
-                    script_path.to_path(project.package_dir()),
+					&script_path.to_path(project.package_dir()),
-                );
+				);
-                return Ok(());
+				return Ok(());
-            }
+			}
 
-            anyhow::bail!("no package or script specified, and no bin path found in manifest")
+			anyhow::bail!("no package or script specified, and no bin path found in manifest")
-        };
+		};
 
-        if let Ok(pkg_name) = package_or_script.parse::<PackageName>() {
+		if let Ok(pkg_name) = package_or_script.parse::<PackageName>() {
-            let graph = if let Some(lockfile) = up_to_date_lockfile(&project).await? {
+			let graph = if let Some(lockfile) = up_to_date_lockfile(&project).await? {
-                lockfile.graph
+				lockfile.graph
-            } else {
+			} else {
-                anyhow::bail!("outdated lockfile, please run the install command first")
+				anyhow::bail!("outdated lockfile, please run the install command first")
-            };
+			};
 
-            let pkg_name = PackageNames::Pesde(pkg_name);
+			let pkg_name = PackageNames::Pesde(pkg_name);
 
-            for (version_id, node) in graph.get(&pkg_name).context("package not found in graph")? {
+			let mut versions = graph
-                if node.node.direct.is_none() {
+				.into_iter()
-                    continue;
+				.filter(|(id, node)| *id.name() == pkg_name && node.direct.is_some())
-                }
+				.collect::<Vec<_>>();
 
-                let Some(bin_path) = node.target.bin_path() else {
+			let (id, node) = match versions.len() {
-                    anyhow::bail!("package has no bin path");
+				0 => anyhow::bail!("package not found"),
-                };
+				1 => versions.pop().unwrap(),
+				_ => anyhow::bail!("multiple versions found. use the package's alias instead."),
+			};
 
-                let base_folder = project
+			let container_folder = node.container_folder_from_project(
-                    .deser_manifest()
+				&id,
-                    .await?
+				&project,
-                    .target
+				project
-                    .kind()
+					.deser_manifest()
-                    .packages_folder(version_id.target());
+					.await
-                let container_folder = node.node.container_folder(
+					.context("failed to deserialize manifest")?
-                    &project
+					.target
-                        .package_dir()
+					.kind(),
-                        .join(base_folder)
+			);
-                        .join(PACKAGES_CONTAINER_NAME),
-                    &pkg_name,
-                    version_id.version(),
-                );
 
-                let path = bin_path.to_path(&container_folder);
+			let source = node.pkg_ref.source();
+			source
+				.refresh(&RefreshOptions {
+					project: project.clone(),
+				})
+				.await
+				.context("failed to refresh source")?;
+			let target = source
+				.get_target(
+					&node.pkg_ref,
+					&GetTargetOptions {
+						project,
+						path: Arc::from(container_folder.as_path()),
+						id: Arc::new(id),
+					},
+				)
+				.await?;
 
-                run(path.clone(), path);
+			let Some(bin_path) = target.bin_path() else {
-                return Ok(());
+				anyhow::bail!("package has no bin path");
-            }
+			};
-        }
 
-        if let Ok(manifest) = project.deser_manifest().await {
+			let path = bin_path.to_path(&container_folder);
-            if let Some(script_path) = manifest.scripts.get(&package_or_script) {
-                run(
-                    project.package_dir().to_path_buf(),
-                    script_path.to_path(project.package_dir()),
-                );
-                return Ok(());
-            }
-        };
 
-        let relative_path = RelativePathBuf::from(package_or_script);
+			run(&path, &path);
-        let path = relative_path.to_path(project.package_dir());
+			return Ok(());
+		}
 
-        if !path.exists() {
+		if let Ok(manifest) = project.deser_manifest().await {
-            anyhow::bail!("path `{}` does not exist", path.display());
+			if let Some(script_path) = manifest.scripts.get(&package_or_script) {
-        }
+				run(
+					project.package_dir(),
+					&script_path.to_path(project.package_dir()),
+				);
+				return Ok(());
+			}
+		};
 
-        let workspace_dir = project
+		let relative_path = RelativePathBuf::from(package_or_script);
-            .workspace_dir()
+		let path = relative_path.to_path(project.package_dir());
-            .unwrap_or_else(|| project.package_dir());
 
-        let members = match project.workspace_members(workspace_dir, false).await {
+		if !path.exists() {
-            Ok(members) => members.boxed(),
+			anyhow::bail!("path `{}` does not exist", path.display());
-            Err(pesde::errors::WorkspaceMembersError::ManifestMissing(e))
+		}
-                if e.kind() == std::io::ErrorKind::NotFound =>
-            {
-                futures::stream::empty().boxed()
-            }
-            Err(e) => Err(e).context("failed to get workspace members")?,
-        };
 
-        let members = members
+		let workspace_dir = project
-            .map(|res| {
+			.workspace_dir()
-                res.map_err(anyhow::Error::from)
+			.unwrap_or_else(|| project.package_dir());
-                    .and_then(|(path, _)| path.canonicalize().map_err(Into::into))
-            })
-            .chain(futures::stream::once(async {
-                workspace_dir.canonicalize().map_err(Into::into)
-            }))
-            .try_collect::<HashSet<_>>()
-            .await
-            .context("failed to collect workspace members")?;
 
-        let root = 'finder: {
+		let members = match project.workspace_members(false).await {
-            let mut current_path = path.to_path_buf();
+			Ok(members) => members.boxed(),
-            loop {
+			Err(WorkspaceMembersError::ManifestParse(ManifestReadError::Io(e)))
-                let canonical_path = current_path
+				if e.kind() == std::io::ErrorKind::NotFound =>
-                    .canonicalize()
+			{
-                    .context("failed to canonicalize parent")?;
+				futures::stream::empty().boxed()
+			}
+			Err(e) => Err(e).context("failed to get workspace members")?,
+		};
 
-                if members.contains(&canonical_path)
+		let members = members
-                    && canonical_path.join(MANIFEST_FILE_NAME).exists()
+			.map(|res| {
-                {
+				res.map_err(anyhow::Error::from)
-                    break 'finder canonical_path;
+					.and_then(|(path, _)| path.canonicalize().map_err(Into::into))
-                }
+			})
+			.chain(futures::stream::once(async {
+				workspace_dir.canonicalize().map_err(Into::into)
+			}))
+			.try_collect::<HashSet<_>>()
+			.await
+			.context("failed to collect workspace members")?;
 
-                if let Some(parent) = current_path.parent() {
+		let root = 'finder: {
-                    current_path = parent.to_path_buf();
+			let mut current_path = path.to_path_buf();
-                } else {
+			loop {
-                    break;
+				let canonical_path = current_path
-                }
+					.canonicalize()
-            }
+					.context("failed to canonicalize parent")?;
 
-            project.package_dir().to_path_buf()
+				if members.contains(&canonical_path)
-        };
+					&& canonical_path.join(MANIFEST_FILE_NAME).exists()
+				{
+					break 'finder canonical_path;
+				}
 
-        run(root, path);
+				if let Some(parent) = current_path.parent() {
+					current_path = parent.to_path_buf();
+				} else {
+					break;
+				}
+			}
 
-        Ok(())
+			project.package_dir().to_path_buf()
-    }
+		};
+
+		run(&root, &path);
+
+		Ok(())
+	}
 }

src/cli/commands/self_install.rs

@@ -1,77 +1,77 @@
-use crate::cli::{version::update_bin_exe, HOME_DIR};
+use crate::cli::{
+	style::{ADDED_STYLE, CLI_STYLE},
+	version::replace_pesde_bin_exe,
+	HOME_DIR,
+};
 use anyhow::Context;
 use clap::Args;
-use colored::Colorize;
+use console::style;
 use std::env::current_exe;
+
 #[derive(Debug, Args)]
 pub struct SelfInstallCommand {
-    /// Skip adding the bin directory to the PATH
+	/// Skip adding the bin directory to the PATH
-    #[cfg(windows)]
+	#[cfg(windows)]
-    #[arg(short, long)]
+	#[arg(short, long)]
-    skip_add_to_path: bool,
+	skip_add_to_path: bool,
 }
 
 impl SelfInstallCommand {
-    pub async fn run(self) -> anyhow::Result<()> {
+	pub async fn run(self) -> anyhow::Result<()> {
-        #[cfg(windows)]
+		#[cfg(windows)]
-        {
+		{
-            if !self.skip_add_to_path {
+			if !self.skip_add_to_path {
-                use anyhow::Context;
+				use crate::cli::style::WARN_STYLE;
-                use winreg::{enums::HKEY_CURRENT_USER, RegKey};
+				use anyhow::Context;
+				use windows_registry::CURRENT_USER;
 
-                let current_user = RegKey::predef(HKEY_CURRENT_USER);
+				let env = CURRENT_USER
-                let env = current_user
+					.create("Environment")
-                    .create_subkey("Environment")
+					.context("failed to open Environment key")?;
-                    .context("failed to open Environment key")?
+				let path = env.get_string("Path").context("failed to get Path value")?;
-                    .0;
-                let path: String = env.get_value("Path").context("failed to get Path value")?;
 
-                let bin_dir = crate::cli::bin_dir().await?;
+				let bin_dir = crate::cli::bin_dir().await?;
-                let bin_dir = bin_dir.to_string_lossy();
+				let bin_dir = bin_dir.to_string_lossy();
 
-                let exists = path.split(';').any(|part| *part == bin_dir);
+				let exists = path.split(';').any(|part| *part == bin_dir);
 
-                if !exists {
+				if !exists {
-                    let new_path = format!("{path};{bin_dir}");
+					let new_path = format!("{path};{bin_dir}");
-                    env.set_value("Path", &new_path)
+					env.set_string("Path", &new_path)
-                        .context("failed to set Path value")?;
+						.context("failed to set Path value")?;
 
-                    println!(
+					println!(
-                        "\nin order to allow binary exports as executables {}.\n\n{}",
+						"\nin order to allow proper functionality {} was added to PATH.\n\n{}",
-                        format!("`~/{HOME_DIR}/bin` was added to PATH").green(),
+						style(format!("`~/{HOME_DIR}/bin`")).green(),
-                        "please restart your shell for this to take effect"
+						WARN_STYLE.apply_to("please restart your shell for this to take effect")
-                            .yellow()
+					);
-                            .bold()
+				}
-                    );
+			}
-                }
-            }
 
-            println!(
+			println!(
-                "installed {} {}!",
+				"installed {} {}!",
-                env!("CARGO_BIN_NAME").cyan(),
+				CLI_STYLE.apply_to(env!("CARGO_BIN_NAME")),
-                env!("CARGO_PKG_VERSION").yellow(),
+				ADDED_STYLE.apply_to(env!("CARGO_PKG_VERSION")),
-            );
+			);
-        }
+		}
 
-        #[cfg(unix)]
+		#[cfg(unix)]
-        {
+		{
-            println!(
+			println!(
-                r#"installed {} {}! add the following line to your shell profile in order to get the binary and binary exports as executables usable from anywhere:
+				r#"installed {} {}! add the following line to your shell profile in order to get the binary and binary exports as executables usable from anywhere:
 
 {}
 
 and then restart your shell.
 "#,
-                env!("CARGO_BIN_NAME").cyan(),
+				CLI_STYLE.apply_to(env!("CARGO_BIN_NAME")),
-                env!("CARGO_PKG_VERSION").yellow(),
+				ADDED_STYLE.apply_to(env!("CARGO_PKG_VERSION")),
-                format!(r#"export PATH="$PATH:~/{HOME_DIR}/bin""#)
+				style(format!(r#"export PATH="$PATH:$HOME/{HOME_DIR}/bin""#)).green(),
-                    .bold()
+			);
-                    .green()
+		}
-            );
-        }
 
-        update_bin_exe(&current_exe().context("failed to get current exe path")?).await?;
+		replace_pesde_bin_exe(&current_exe().context("failed to get current exe path")?).await?;
 
-        Ok(())
+		Ok(())
-    }
+	}
 }

src/cli/commands/self_upgrade.rs

@@ -1,58 +1,66 @@
-use crate::cli::{
+use crate::{
-    config::read_config,
+	cli::{
-    version::{
+		config::read_config,
-        current_version, get_or_download_version, get_remote_version, no_build_metadata,
+		style::{ADDED_STYLE, CLI_STYLE, REMOVED_STYLE},
-        update_bin_exe, TagInfo, VersionType,
+		version::{
-    },
+			current_version, find_latest_version, get_or_download_engine, replace_pesde_bin_exe,
+		},
+	},
+	util::no_build_metadata,
 };
 use anyhow::Context;
 use clap::Args;
-use colored::Colorize;
+use pesde::engine::EngineKind;
+use semver::VersionReq;
 
 #[derive(Debug, Args)]
 pub struct SelfUpgradeCommand {
-    /// Whether to use the version from the "upgrades available" message
+	/// Whether to use the version from the "upgrades available" message
-    #[clap(long, default_value_t = false)]
+	#[clap(long, default_value_t = false)]
-    use_cached: bool,
+	use_cached: bool,
 }
 
 impl SelfUpgradeCommand {
-    pub async fn run(self, reqwest: reqwest::Client) -> anyhow::Result<()> {
+	pub async fn run(self, reqwest: reqwest::Client) -> anyhow::Result<()> {
-        let latest_version = if self.use_cached {
+		let latest_version = if self.use_cached {
-            read_config()
+			read_config()
-                .await?
+				.await?
-                .last_checked_updates
+				.last_checked_updates
-                .context("no cached version found")?
+				.context("no cached version found")?
-                .1
+				.1
-        } else {
+		} else {
-            get_remote_version(&reqwest, VersionType::Latest).await?
+			find_latest_version(&reqwest).await?
-        };
+		};
 
-        let latest_version_no_metadata = no_build_metadata(&latest_version);
+		let latest_version_no_metadata = no_build_metadata(&latest_version);
 
-        if latest_version_no_metadata <= current_version() {
+		if latest_version_no_metadata <= current_version() {
-            println!("already up to date");
+			println!("already up to date");
-            return Ok(());
+			return Ok(());
-        }
+		}
 
-        let display_latest_version = latest_version_no_metadata.to_string().yellow().bold();
+		let display_latest_version = ADDED_STYLE.apply_to(latest_version_no_metadata);
 
-        if !inquire::prompt_confirmation(format!(
+		let confirmed = inquire::prompt_confirmation(format!(
-            "are you sure you want to upgrade {} from {} to {display_latest_version}?",
+			"are you sure you want to upgrade {} from {} to {display_latest_version}?",
-            env!("CARGO_BIN_NAME").cyan(),
+			CLI_STYLE.apply_to(env!("CARGO_BIN_NAME")),
-            env!("CARGO_PKG_VERSION").yellow().bold()
+			REMOVED_STYLE.apply_to(env!("CARGO_PKG_VERSION"))
-        ))? {
+		))?;
-            println!("cancelled upgrade");
+		if !confirmed {
-            return Ok(());
+			println!("cancelled upgrade");
-        }
+			return Ok(());
+		}
 
-        let path = get_or_download_version(&reqwest, &TagInfo::Complete(latest_version), true)
+		let path = get_or_download_engine(
-            .await?
+			&reqwest,
-            .unwrap();
+			EngineKind::Pesde,
-        update_bin_exe(&path).await?;
+			VersionReq::parse(&format!("={latest_version}")).unwrap(),
+		)
+		.await?;
+		replace_pesde_bin_exe(&path).await?;
 
-        println!("upgraded to version {display_latest_version}!");
+		println!("upgraded to version {display_latest_version}!");
 
-        Ok(())
+		Ok(())
-    }
+	}
 }

src/cli/commands/update.rs

@@ -1,85 +1,48 @@
-use crate::cli::{progress_bar, run_on_workspace_members};
+use crate::cli::{
-use anyhow::Context;
+	install::{install, InstallOptions},
+	run_on_workspace_members,
+};
 use clap::Args;
-use colored::Colorize;
+use pesde::Project;
-use pesde::{lockfile::Lockfile, Project};
+use std::num::NonZeroUsize;
-use std::{collections::HashSet, sync::Arc};
-use tokio::sync::Mutex;
 
 #[derive(Debug, Args, Copy, Clone)]
-pub struct UpdateCommand {}
+pub struct UpdateCommand {
+	/// Update the dependencies but don't install them
+	#[arg(long)]
+	no_install: bool,
+
+	/// The maximum number of concurrent network requests
+	#[arg(long, default_value = "16")]
+	network_concurrency: NonZeroUsize,
+
+	/// Whether to re-install all dependencies even if they are already installed
+	#[arg(long)]
+	force: bool,
+}
 
 impl UpdateCommand {
-    pub async fn run(self, project: Project, reqwest: reqwest::Client) -> anyhow::Result<()> {
+	pub async fn run(self, project: Project, reqwest: reqwest::Client) -> anyhow::Result<()> {
-        let mut refreshed_sources = HashSet::new();
+		let options = InstallOptions {
+			locked: false,
+			prod: false,
+			write: !self.no_install,
+			network_concurrency: self.network_concurrency,
+			use_lockfile: false,
+			force: self.force,
+		};
 
-        let manifest = project
+		install(&options, &project, reqwest.clone(), true).await?;
-            .deser_manifest()
-            .await
-            .context("failed to read manifest")?;
 
-        println!(
+		run_on_workspace_members(&project, |project| {
-            "\n{}\n",
+			let reqwest = reqwest.clone();
-            format!("[now updating {} {}]", manifest.name, manifest.target)
+			async move {
-                .bold()
+				install(&options, &project, reqwest, false).await?;
-                .on_bright_black()
+				Ok(())
-        );
+			}
+		})
+		.await?;
 
-        let graph = project
+		Ok(())
-            .dependency_graph(None, &mut refreshed_sources, false)
+	}
-            .await
-            .context("failed to build dependency graph")?;
-        let graph = Arc::new(graph);
-
-        project
-            .write_lockfile(Lockfile {
-                name: manifest.name,
-                version: manifest.version,
-                target: manifest.target.kind(),
-                overrides: manifest.overrides,
-
-                graph: {
-                    let (rx, downloaded_graph) = project
-                        .download_and_link(
-                            &graph,
-                            &Arc::new(Mutex::new(refreshed_sources)),
-                            &reqwest,
-                            false,
-                            false,
-                            |_| async { Ok::<_, std::io::Error>(()) },
-                        )
-                        .await
-                        .context("failed to download dependencies")?;
-
-                    progress_bar(
-                        graph.values().map(|versions| versions.len() as u64).sum(),
-                        rx,
-                        "📥 ".to_string(),
-                        "downloading dependencies".to_string(),
-                        "downloaded dependencies".to_string(),
-                    )
-                    .await?;
-
-                    downloaded_graph
-                        .await
-                        .context("failed to download dependencies")?
-                },
-
-                workspace: run_on_workspace_members(&project, |project| {
-                    let reqwest = reqwest.clone();
-                    async move { Box::pin(self.run(project, reqwest)).await }
-                })
-                .await?,
-            })
-            .await
-            .context("failed to write lockfile")?;
-
-        println!(
-            "\n\n{}. run `{} install` in order to install the new dependencies",
-            "✅ done".green(),
-            env!("CARGO_BIN_NAME")
-        );
-
-        Ok(())
-    }
 }

src/cli/commands/yank.rs

@@ -0,0 +1,148 @@
+use crate::cli::{get_index, style::SUCCESS_STYLE};
+use anyhow::Context;
+use clap::Args;
+use pesde::{
+	manifest::target::TargetKind,
+	names::PackageName,
+	source::{
+		pesde::PesdePackageSource,
+		traits::{PackageSource, RefreshOptions},
+	},
+	Project,
+};
+use reqwest::{header::AUTHORIZATION, Method, StatusCode};
+use semver::Version;
+use std::{fmt::Display, str::FromStr};
+
+#[derive(Debug, Clone)]
+enum TargetKindOrAll {
+	All,
+	Specific(TargetKind),
+}
+
+impl Display for TargetKindOrAll {
+	fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+		match self {
+			TargetKindOrAll::All => write!(f, "all"),
+			TargetKindOrAll::Specific(kind) => write!(f, "{kind}"),
+		}
+	}
+}
+
+impl FromStr for TargetKindOrAll {
+	type Err = anyhow::Error;
+
+	fn from_str(s: &str) -> Result<Self, Self::Err> {
+		if s.eq_ignore_ascii_case("all") {
+			return Ok(TargetKindOrAll::All);
+		}
+
+		s.parse()
+			.map(TargetKindOrAll::Specific)
+			.context("failed to parse target kind")
+	}
+}
+
+#[derive(Debug, Clone)]
+struct YankId(PackageName, Version, TargetKindOrAll);
+
+impl FromStr for YankId {
+	type Err = anyhow::Error;
+
+	fn from_str(s: &str) -> Result<Self, Self::Err> {
+		let (package, version) = s
+			.split_once('@')
+			.context("package is not in format of `scope/name@version target`")?;
+		let target = match version.split(' ').nth(1) {
+			Some(target) => target
+				.parse()
+				.context("package is not in format of `scope/name@version target`")?,
+			None => TargetKindOrAll::All,
+		};
+
+		Ok(YankId(
+			package.parse().context("failed to parse package name")?,
+			version.parse().context("failed to parse version")?,
+			target,
+		))
+	}
+}
+
+#[derive(Debug, Args)]
+pub struct YankCommand {
+	/// Whether to unyank the package
+	#[clap(long)]
+	undo: bool,
+
+	/// The index to yank the package from
+	#[clap(short, long)]
+	index: Option<String>,
+
+	/// The package to yank
+	#[clap(index = 1)]
+	package: YankId,
+}
+
+impl YankCommand {
+	pub async fn run(self, project: Project, reqwest: reqwest::Client) -> anyhow::Result<()> {
+		let YankId(package, version, target) = self.package;
+
+		let index_url = get_index(&project, self.index.as_deref()).await?;
+		let source = PesdePackageSource::new(index_url.clone());
+		source
+			.refresh(&RefreshOptions {
+				project: project.clone(),
+			})
+			.await
+			.context("failed to refresh source")?;
+		let config = source
+			.config(&project)
+			.await
+			.context("failed to get index config")?;
+
+		let mut request = reqwest.request(
+			if self.undo {
+				Method::DELETE
+			} else {
+				Method::PUT
+			},
+			format!(
+				"{}/v1/packages/{}/{}/{}/yank",
+				config.api(),
+				urlencoding::encode(&package.to_string()),
+				urlencoding::encode(&version.to_string()),
+				urlencoding::encode(&target.to_string()),
+			),
+		);
+
+		if let Some(token) = project.auth_config().tokens().get(&index_url) {
+			tracing::debug!("using token for {index_url}");
+			request = request.header(AUTHORIZATION, token);
+		}
+
+		let response = request.send().await.context("failed to send request")?;
+
+		let status = response.status();
+		let text = response
+			.text()
+			.await
+			.context("failed to get response text")?;
+		let prefix = if self.undo { "un" } else { "" };
+		match status {
+			StatusCode::CONFLICT => {
+				anyhow::bail!("version is already {prefix}yanked");
+			}
+			StatusCode::FORBIDDEN => {
+				anyhow::bail!("unauthorized to {prefix}yank under this scope");
+			}
+			code if !code.is_success() => {
+				anyhow::bail!("failed to {prefix}yank package: {code} ({text})");
+			}
+			_ => {
+				println!("{}", SUCCESS_STYLE.apply_to(text));
+			}
+		}
+
+		Ok(())
+	}
+}

src/cli/config.rs

@@ -7,51 +7,51 @@ use tracing::instrument;
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(default)]
 pub struct CliConfig {
-    #[serde(
+	#[serde(
-        serialize_with = "crate::util::serialize_gix_url",
+		serialize_with = "crate::util::serialize_gix_url",
-        deserialize_with = "crate::util::deserialize_gix_url"
+		deserialize_with = "crate::util::deserialize_gix_url"
-    )]
+	)]
-    pub default_index: gix::Url,
+	pub default_index: gix::Url,
 
-    pub tokens: Tokens,
+	pub tokens: Tokens,
 
-    #[serde(default, skip_serializing_if = "Option::is_none")]
+	#[serde(default, skip_serializing_if = "Option::is_none")]
-    pub last_checked_updates: Option<(chrono::DateTime<chrono::Utc>, semver::Version)>,
+	pub last_checked_updates: Option<(jiff::Timestamp, semver::Version)>,
 }
 
 impl Default for CliConfig {
-    fn default() -> Self {
+	fn default() -> Self {
-        Self {
+		Self {
-            default_index: "https://github.com/pesde-pkg/index".try_into().unwrap(),
+			default_index: "https://github.com/pesde-pkg/index".try_into().unwrap(),
 
-            tokens: Tokens(Default::default()),
+			tokens: Tokens::default(),
 
-            last_checked_updates: None,
+			last_checked_updates: None,
-        }
+		}
-    }
+	}
 }
 
 #[instrument(level = "trace")]
 pub async fn read_config() -> anyhow::Result<CliConfig> {
-    let config_string = match fs::read_to_string(home_dir()?.join("config.toml")).await {
+	let config_string = match fs::read_to_string(home_dir()?.join("config.toml")).await {
-        Ok(config_string) => config_string,
+		Ok(config_string) => config_string,
-        Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
+		Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
-            return Ok(CliConfig::default());
+			return Ok(CliConfig::default());
-        }
+		}
-        Err(e) => return Err(e).context("failed to read config file"),
+		Err(e) => return Err(e).context("failed to read config file"),
-    };
+	};
 
-    let config = toml::from_str(&config_string).context("failed to parse config file")?;
+	let config = toml::from_str(&config_string).context("failed to parse config file")?;
 
-    Ok(config)
+	Ok(config)
 }
 
 #[instrument(level = "trace")]
 pub async fn write_config(config: &CliConfig) -> anyhow::Result<()> {
-    let config_string = toml::to_string(config).context("failed to serialize config")?;
+	let config_string = toml::to_string(config).context("failed to serialize config")?;
-    fs::write(home_dir()?.join("config.toml"), config_string)
+	fs::write(home_dir()?.join("config.toml"), config_string)
-        .await
+		.await
-        .context("failed to write config file")?;
+		.context("failed to write config file")?;
 
-    Ok(())
+	Ok(())
 }

src/cli/files.rs

@@ -1,21 +1,21 @@
 use std::path::Path;
 
 pub async fn make_executable<P: AsRef<Path>>(_path: P) -> anyhow::Result<()> {
-    #[cfg(unix)]
+	#[cfg(unix)]
-    {
+	{
-        use anyhow::Context;
+		use anyhow::Context;
-        use fs_err::tokio as fs;
+		use fs_err::tokio as fs;
-        use std::os::unix::fs::PermissionsExt;
+		use std::os::unix::fs::PermissionsExt;
 
-        let mut perms = fs::metadata(&_path)
+		let mut perms = fs::metadata(&_path)
-            .await
+			.await
-            .context("failed to get bin link file metadata")?
+			.context("failed to get bin link file metadata")?
-            .permissions();
+			.permissions();
-        perms.set_mode(perms.mode() | 0o111);
+		perms.set_mode(perms.mode() | 0o111);
-        fs::set_permissions(&_path, perms)
+		fs::set_permissions(&_path, perms)
-            .await
+			.await
-            .context("failed to set bin link file permissions")?;
+			.context("failed to set bin link file permissions")?;
-    }
+	}
 
-    Ok(())
+	Ok(())
 }

src/cli/install.rs

@@ -0,0 +1,574 @@
+use super::files::make_executable;
+use crate::cli::{
+	bin_dir, dep_type_to_key,
+	reporters::{self, CliReporter},
+	resolve_overrides, run_on_workspace_members,
+	style::{ADDED_STYLE, REMOVED_STYLE, WARN_PREFIX},
+	up_to_date_lockfile,
+};
+use anyhow::Context;
+use console::style;
+use fs_err::tokio as fs;
+use pesde::{
+	download_and_link::{DownloadAndLinkHooks, DownloadAndLinkOptions},
+	engine::EngineKind,
+	graph::{DependencyGraph, DependencyGraphWithTarget},
+	lockfile::Lockfile,
+	manifest::{target::TargetKind, Alias, DependencyType, Manifest},
+	names::PackageNames,
+	source::{pesde::PesdePackageSource, refs::PackageRefs, traits::PackageRef, PackageSources},
+	version_matches, Project, RefreshedSources, LOCKFILE_FILE_NAME, MANIFEST_FILE_NAME,
+};
+use std::{
+	collections::{BTreeMap, BTreeSet, HashMap},
+	num::NonZeroUsize,
+	sync::Arc,
+	time::Instant,
+};
+use tokio::task::JoinSet;
+
+fn bin_link_file(alias: &Alias) -> String {
+	let mut all_combinations = BTreeSet::new();
+
+	for a in TargetKind::VARIANTS {
+		for b in TargetKind::VARIANTS {
+			all_combinations.insert((*a, *b));
+		}
+	}
+
+	let all_folders = all_combinations
+		.into_iter()
+		.map(|(a, b)| format!("{:?}", a.packages_folder(b)))
+		.collect::<BTreeSet<_>>()
+		.into_iter()
+		.collect::<Vec<_>>()
+		.join(", ");
+
+	format!(
+		include_str!("bin_link.luau"),
+		alias = alias,
+		all_folders = all_folders,
+		MANIFEST_FILE_NAME = MANIFEST_FILE_NAME,
+		LOCKFILE_FILE_NAME = LOCKFILE_FILE_NAME
+	)
+}
+
+pub struct InstallHooks {
+	pub bin_folder: std::path::PathBuf,
+}
+
+#[derive(Debug, thiserror::Error)]
+#[error(transparent)]
+pub struct InstallHooksError(#[from] anyhow::Error);
+
+impl DownloadAndLinkHooks for InstallHooks {
+	type Error = InstallHooksError;
+
+	async fn on_bins_downloaded(
+		&self,
+		graph: &DependencyGraphWithTarget,
+	) -> Result<(), Self::Error> {
+		let mut tasks = graph
+			.values()
+			.filter(|node| node.target.bin_path().is_some())
+			.filter_map(|node| node.node.direct.as_ref())
+			.map(|(alias, _, _)| {
+				let bin_folder = self.bin_folder.clone();
+				let alias = alias.clone();
+
+				async move {
+					let bin_exec_file = bin_folder
+						.join(alias.as_str())
+						.with_extension(std::env::consts::EXE_EXTENSION);
+
+					let impl_folder = bin_folder.join(".impl");
+					fs::create_dir_all(&impl_folder)
+						.await
+						.context("failed to create bin link folder")?;
+
+					let bin_file = impl_folder.join(alias.as_str()).with_extension("luau");
+					fs::write(&bin_file, bin_link_file(&alias))
+						.await
+						.context("failed to write bin link file")?;
+
+					#[cfg(windows)]
+					match fs::symlink_file(
+						std::env::current_exe().context("failed to get current executable path")?,
+						&bin_exec_file,
+					)
+					.await
+					{
+						Ok(_) => {}
+						Err(e) if e.kind() == std::io::ErrorKind::AlreadyExists => {}
+						e => e.context("failed to copy bin link file")?,
+					}
+
+					#[cfg(not(windows))]
+					fs::write(
+						&bin_exec_file,
+						format!(
+							r#"#!/bin/sh
+exec lune run "$(dirname "$0")/.impl/{alias}.luau" -- "$@""#
+						),
+					)
+					.await
+					.context("failed to link bin link file")?;
+
+					make_executable(&bin_exec_file)
+						.await
+						.context("failed to make bin link file executable")?;
+
+					Ok::<_, anyhow::Error>(())
+				}
+			})
+			.collect::<JoinSet<_>>();
+
+		while let Some(task) = tasks.join_next().await {
+			task.unwrap()?;
+		}
+
+		Ok(())
+	}
+}
+
+#[derive(Debug, Clone, Copy)]
+pub struct InstallOptions {
+	pub locked: bool,
+	pub prod: bool,
+	pub write: bool,
+	pub use_lockfile: bool,
+	pub network_concurrency: NonZeroUsize,
+	pub force: bool,
+}
+
+pub async fn install(
+	options: &InstallOptions,
+	project: &Project,
+	reqwest: reqwest::Client,
+	is_root: bool,
+) -> anyhow::Result<()> {
+	let start = Instant::now();
+
+	let refreshed_sources = RefreshedSources::new();
+
+	let manifest = project
+		.deser_manifest()
+		.await
+		.context("failed to read manifest")?;
+
+	let mut has_irrecoverable_changes = false;
+
+	let lockfile = if options.locked {
+		match up_to_date_lockfile(project).await? {
+			None => {
+				anyhow::bail!(
+					"lockfile is out of sync, run `{} install` to update it",
+					env!("CARGO_BIN_NAME")
+				);
+			}
+			file => file,
+		}
+	} else {
+		match project.deser_lockfile().await {
+			Ok(lockfile) => {
+				if lockfile.overrides != resolve_overrides(&manifest)? {
+					tracing::debug!("overrides are different");
+					has_irrecoverable_changes = true;
+					None
+				} else if lockfile.target != manifest.target.kind() {
+					tracing::debug!("target kind is different");
+					has_irrecoverable_changes = true;
+					None
+				} else {
+					Some(lockfile)
+				}
+			}
+			Err(pesde::errors::LockfileReadError::Io(e))
+				if e.kind() == std::io::ErrorKind::NotFound =>
+			{
+				None
+			}
+			Err(e) => return Err(e.into()),
+		}
+	};
+
+	let overrides = resolve_overrides(&manifest)?;
+
+	let (new_lockfile, old_graph) =
+		reporters::run_with_reporter(|multi, root_progress, reporter| async {
+			let multi = multi;
+			let root_progress = root_progress;
+
+			root_progress.set_prefix(format!("{} {}: ", manifest.name, manifest.target));
+			#[cfg(feature = "version-management")]
+			{
+				root_progress.reset();
+				root_progress.set_message("update engine linkers");
+
+				let mut tasks = manifest
+					.engines
+					.keys()
+					.map(|engine| crate::cli::version::make_linker_if_needed(*engine))
+					.collect::<JoinSet<_>>();
+
+				while let Some(task) = tasks.join_next().await {
+					task.unwrap()?;
+				}
+			}
+
+			root_progress.reset();
+			root_progress.set_message("resolve");
+
+			let old_graph = lockfile.map(|lockfile| lockfile.graph);
+
+			let graph = project
+				.dependency_graph(
+					old_graph.as_ref().filter(|_| options.use_lockfile),
+					refreshed_sources.clone(),
+					false,
+				)
+				.await
+				.context("failed to build dependency graph")?;
+
+			let mut tasks = graph
+				.iter()
+				.filter_map(|(id, node)| {
+					let PackageSources::Pesde(source) = node.pkg_ref.source() else {
+						return None;
+					};
+					#[allow(irrefutable_let_patterns)]
+					let PackageNames::Pesde(name) = id.name().clone() else {
+						panic!("unexpected package name");
+					};
+					let project = project.clone();
+
+					Some(async move {
+						let file = source.read_index_file(&name, &project).await.context("failed to read package index file")?.context("package not found in index")?;
+
+						Ok::<_, anyhow::Error>(if file.meta.deprecated.is_empty() {
+							None
+						} else {
+							Some((name, file.meta.deprecated))
+						})
+					})
+				})
+				.collect::<JoinSet<_>>();
+
+			while let Some(task) = tasks.join_next().await {
+				let Some((name, reason)) = task.unwrap()? else {
+					continue;
+				};
+
+				multi.suspend(|| {
+					println!("{WARN_PREFIX}: package {name} is deprecated: {reason}");
+				});
+			}
+
+			let graph = Arc::new(graph);
+
+			if options.write {
+				root_progress.reset();
+				root_progress.set_length(0);
+				root_progress.set_message("download");
+				root_progress.set_style(reporters::root_progress_style_with_progress());
+
+				let hooks = InstallHooks {
+					bin_folder: bin_dir().await?,
+				};
+
+				#[allow(unused_variables)]
+				let downloaded_graph = project
+					.download_and_link(
+						&graph,
+						DownloadAndLinkOptions::<CliReporter, InstallHooks>::new(reqwest.clone())
+							.reporter(
+								#[cfg(feature = "patches")]
+								reporter.clone(),
+								#[cfg(not(feature = "patches"))]
+								reporter,
+							)
+							.hooks(hooks)
+							.refreshed_sources(refreshed_sources)
+							.prod(options.prod)
+							.network_concurrency(options.network_concurrency)
+							.force(options.force || has_irrecoverable_changes),
+					)
+					.await
+					.context("failed to download and link dependencies")?;
+
+				#[cfg(feature = "patches")]
+				{
+					use pesde::graph::ConvertableGraph;
+					root_progress.reset();
+					root_progress.set_length(0);
+					root_progress.set_message("patch");
+
+					project
+						.apply_patches(&downloaded_graph.clone().convert(), reporter)
+						.await?;
+				}
+
+				#[cfg(feature = "version-management")]
+				{
+					let mut tasks = manifest
+						.engines
+						.into_iter()
+						.map(|(engine, req)| async move {
+							Ok::<_, anyhow::Error>(
+								crate::cli::version::get_installed_versions(engine)
+									.await?
+									.into_iter()
+									.filter(|version| version_matches(&req, version))
+									.next_back()
+									.map(|version| (engine, version)),
+							)
+						})
+						.collect::<JoinSet<_>>();
+
+					let mut resolved_engine_versions = HashMap::new();
+					while let Some(task) = tasks.join_next().await {
+						let Some((engine, version)) = task.unwrap()? else {
+							continue;
+						};
+						resolved_engine_versions.insert(engine, version);
+					}
+
+					let manifest_target_kind = manifest.target.kind();
+					let mut tasks = downloaded_graph.iter()
+						.map(|(id, node)| {
+							let id = id.clone();
+							let node = node.clone();
+							let project = project.clone();
+
+							async move {
+								let engines = match &node.node.pkg_ref {
+									PackageRefs::Pesde(pkg_ref) => {
+										let source = PesdePackageSource::new(pkg_ref.index_url.clone());
+										#[allow(irrefutable_let_patterns)]
+										let PackageNames::Pesde(name) = id.name() else {
+											panic!("unexpected package name");
+										};
+
+										let mut file = source.read_index_file(name, &project).await.context("failed to read package index file")?.context("package not found in index")?;
+										file
+											.entries
+											.remove(id.version_id())
+											.context("package version not found in index")?
+											.engines
+									}
+									#[cfg(feature = "wally-compat")]
+									PackageRefs::Wally(_) => Default::default(),
+									_ => {
+										let path = node.node.container_folder_from_project(
+											&id,
+											&project,
+											manifest_target_kind,
+										);
+
+										match fs::read_to_string(path.join(MANIFEST_FILE_NAME)).await {
+											Ok(manifest) => match toml::from_str::<Manifest>(&manifest) {
+												Ok(manifest) => manifest.engines,
+												Err(e) => return Err(e).context("failed to read package manifest"),
+											},
+											Err(e) if e.kind() == std::io::ErrorKind::NotFound => Default::default(),
+											Err(e) => return Err(e).context("failed to read package manifest"),
+										}
+									}
+								};
+
+								Ok((id, engines))
+							}
+						})
+						.collect::<JoinSet<_>>();
+
+					while let Some(task) = tasks.join_next().await {
+						let (id, required_engines) = task.unwrap()?;
+
+						for (engine, req) in required_engines {
+							if engine == EngineKind::Pesde {
+								continue;
+							}
+
+							let Some(version) = resolved_engine_versions.get(&engine) else {
+								tracing::debug!("package {id} requires {engine} {req}, but it is not installed");
+								continue;
+							};
+
+							if !version_matches(&req, version) {
+								multi.suspend(|| {
+									println!("{WARN_PREFIX}: package {id} requires {engine} {req}, but {version} is installed");
+								});
+							}
+						}
+					}
+				}
+			}
+
+			root_progress.reset();
+			root_progress.set_message("finish");
+
+			let new_lockfile = Lockfile {
+				name: manifest.name.clone(),
+				version: manifest.version,
+				target: manifest.target.kind(),
+				overrides,
+
+				graph: Arc::into_inner(graph).unwrap(),
+
+				workspace: run_on_workspace_members(project, |_| async { Ok(()) }).await?,
+			};
+
+			project
+				.write_lockfile(&new_lockfile)
+				.await
+				.context("failed to write lockfile")?;
+
+			anyhow::Ok((new_lockfile, old_graph.unwrap_or_default()))
+		})
+			.await?;
+
+	let elapsed = start.elapsed();
+
+	if is_root {
+		println!();
+	}
+
+	print_package_diff(
+		&format!("{} {}:", manifest.name, manifest.target),
+		old_graph,
+		new_lockfile.graph,
+	);
+
+	println!("done in {:.2}s", elapsed.as_secs_f64());
+	println!();
+
+	Ok(())
+}
+
+/// Prints the difference between two graphs.
+pub fn print_package_diff(prefix: &str, old_graph: DependencyGraph, new_graph: DependencyGraph) {
+	let mut old_pkg_map = BTreeMap::new();
+	let mut old_direct_pkg_map = BTreeMap::new();
+	let mut new_pkg_map = BTreeMap::new();
+	let mut new_direct_pkg_map = BTreeMap::new();
+
+	for (id, node) in &old_graph {
+		old_pkg_map.insert(id, node);
+		if node.direct.is_some() {
+			old_direct_pkg_map.insert(id, node);
+		}
+	}
+
+	for (id, node) in &new_graph {
+		new_pkg_map.insert(id, node);
+		if node.direct.is_some() {
+			new_direct_pkg_map.insert(id, node);
+		}
+	}
+
+	let added_pkgs = new_pkg_map
+		.iter()
+		.filter(|(key, _)| !old_pkg_map.contains_key(*key))
+		.map(|(key, &node)| (key, node))
+		.collect::<Vec<_>>();
+	let removed_pkgs = old_pkg_map
+		.iter()
+		.filter(|(key, _)| !new_pkg_map.contains_key(*key))
+		.map(|(key, &node)| (key, node))
+		.collect::<Vec<_>>();
+	let added_direct_pkgs = new_direct_pkg_map
+		.iter()
+		.filter(|(key, _)| !old_direct_pkg_map.contains_key(*key))
+		.map(|(key, &node)| (key, node))
+		.collect::<Vec<_>>();
+	let removed_direct_pkgs = old_direct_pkg_map
+		.iter()
+		.filter(|(key, _)| !new_direct_pkg_map.contains_key(*key))
+		.map(|(key, &node)| (key, node))
+		.collect::<Vec<_>>();
+
+	let prefix = style(prefix).bold();
+
+	let no_changes = added_pkgs.is_empty()
+		&& removed_pkgs.is_empty()
+		&& added_direct_pkgs.is_empty()
+		&& removed_direct_pkgs.is_empty();
+
+	if no_changes {
+		println!("{prefix} already up to date");
+	} else {
+		let mut change_signs = [
+			(!added_pkgs.is_empty()).then(|| {
+				ADDED_STYLE
+					.apply_to(format!("+{}", added_pkgs.len()))
+					.to_string()
+			}),
+			(!removed_pkgs.is_empty()).then(|| {
+				REMOVED_STYLE
+					.apply_to(format!("-{}", removed_pkgs.len()))
+					.to_string()
+			}),
+		]
+		.into_iter()
+		.flatten()
+		.collect::<Vec<_>>()
+		.join(" ");
+
+		let changes_empty = change_signs.is_empty();
+		if changes_empty {
+			change_signs = style("(no changes)").dim().to_string();
+		}
+
+		println!("{prefix} {change_signs}");
+
+		if !changes_empty {
+			println!(
+				"{}{}",
+				ADDED_STYLE.apply_to("+".repeat(added_pkgs.len())),
+				REMOVED_STYLE.apply_to("-".repeat(removed_pkgs.len()))
+			);
+		}
+
+		let dependency_groups = added_direct_pkgs
+			.iter()
+			.map(|(key, node)| (true, key, node))
+			.chain(
+				removed_direct_pkgs
+					.iter()
+					.map(|(key, node)| (false, key, node)),
+			)
+			.filter_map(|(added, key, node)| {
+				node.direct.as_ref().map(|(_, _, ty)| (added, key, ty))
+			})
+			.fold(
+				BTreeMap::<DependencyType, BTreeSet<_>>::new(),
+				|mut map, (added, key, &ty)| {
+					map.entry(ty).or_default().insert((key, added));
+					map
+				},
+			);
+
+		for (ty, set) in dependency_groups {
+			println!();
+			println!(
+				"{}",
+				style(format!("{}:", dep_type_to_key(ty))).yellow().bold()
+			);
+
+			for (id, added) in set {
+				println!(
+					"{} {} {}",
+					if added {
+						ADDED_STYLE.apply_to("+")
+					} else {
+						REMOVED_STYLE.apply_to("-")
+					},
+					id.name(),
+					style(id.version_id()).dim()
+				);
+			}
+		}
+
+		println!();
+	}
+}

src/cli/mod.rs

@@ -1,21 +1,30 @@
+use crate::cli::{
+	config::read_config,
+	style::{ERROR_STYLE, INFO_STYLE, WARN_STYLE},
+};
 use anyhow::Context;
-use colored::Colorize;
 use fs_err::tokio as fs;
 use futures::StreamExt;
 use pesde::{
-    lockfile::Lockfile,
+	errors::ManifestReadError,
-    manifest::target::TargetKind,
+	lockfile::Lockfile,
-    names::{PackageName, PackageNames},
+	manifest::{
-    source::{version_id::VersionId, workspace::specifier::VersionTypeOrReq},
+		overrides::{OverrideKey, OverrideSpecifier},
-    Project,
+		target::TargetKind,
+		DependencyType, Manifest,
+	},
+	names::{PackageName, PackageNames},
+	source::{
+		ids::VersionId, specifiers::DependencySpecifiers, workspace::specifier::VersionTypeOrReq,
+	},
+	Project, DEFAULT_INDEX_NAME,
 };
 use relative_path::RelativePathBuf;
 use std::{
-    collections::{BTreeMap, HashSet},
+	collections::{BTreeMap, HashSet},
-    future::Future,
+	future::Future,
-    path::PathBuf,
+	path::PathBuf,
-    str::FromStr,
+	str::FromStr,
-    time::Duration,
 };
 use tokio::pin;
 use tracing::instrument;
@@ -24,280 +33,327 @@ pub mod auth;
 pub mod commands;
 pub mod config;
 pub mod files;
+pub mod install;
+pub mod reporters;
+pub mod style;
 #[cfg(feature = "version-management")]
 pub mod version;
 
 pub const HOME_DIR: &str = concat!(".", env!("CARGO_PKG_NAME"));
 
 pub fn home_dir() -> anyhow::Result<PathBuf> {
-    Ok(dirs::home_dir()
+	Ok(dirs::home_dir()
-        .context("failed to get home directory")?
+		.context("failed to get home directory")?
-        .join(HOME_DIR))
+		.join(HOME_DIR))
 }
 
 pub async fn bin_dir() -> anyhow::Result<PathBuf> {
-    let bin_dir = home_dir()?.join("bin");
+	let bin_dir = home_dir()?.join("bin");
-    fs::create_dir_all(&bin_dir)
+	fs::create_dir_all(&bin_dir)
-        .await
+		.await
-        .context("failed to create bin folder")?;
+		.context("failed to create bin folder")?;
-    Ok(bin_dir)
+	Ok(bin_dir)
+}
+
+pub fn resolve_overrides(
+	manifest: &Manifest,
+) -> anyhow::Result<BTreeMap<OverrideKey, DependencySpecifiers>> {
+	let mut dependencies = None;
+	let mut overrides = BTreeMap::new();
+
+	for (key, spec) in &manifest.overrides {
+		overrides.insert(
+			key.clone(),
+			match spec {
+				OverrideSpecifier::Specifier(spec) => spec,
+				OverrideSpecifier::Alias(alias) => {
+					if dependencies.is_none() {
+						dependencies = Some(
+							manifest
+								.all_dependencies()
+								.context("failed to get all dependencies")?,
+						);
+					}
+
+					&dependencies
+						.as_ref()
+						.and_then(|deps| deps.get(alias))
+						.with_context(|| format!("alias `{alias}` not found in manifest"))?
+						.0
+				}
+			}
+			.clone(),
+		);
+	}
+
+	Ok(overrides)
 }
 
 #[instrument(skip(project), ret(level = "trace"), level = "debug")]
 pub async fn up_to_date_lockfile(project: &Project) -> anyhow::Result<Option<Lockfile>> {
-    let manifest = project.deser_manifest().await?;
+	let manifest = project.deser_manifest().await?;
-    let lockfile = match project.deser_lockfile().await {
+	let lockfile = match project.deser_lockfile().await {
-        Ok(lockfile) => lockfile,
+		Ok(lockfile) => lockfile,
-        Err(pesde::errors::LockfileReadError::Io(e))
+		Err(pesde::errors::LockfileReadError::Io(e))
-            if e.kind() == std::io::ErrorKind::NotFound =>
+			if e.kind() == std::io::ErrorKind::NotFound =>
-        {
+		{
-            return Ok(None);
+			return Ok(None);
-        }
+		}
-        Err(e) => return Err(e.into()),
+		Err(e) => return Err(e.into()),
-    };
+	};
 
-    if manifest.overrides != lockfile.overrides {
+	if resolve_overrides(&manifest)? != lockfile.overrides {
-        tracing::debug!("overrides are different");
+		tracing::debug!("overrides are different");
-        return Ok(None);
+		return Ok(None);
-    }
+	}
 
-    if manifest.target.kind() != lockfile.target {
+	if manifest.target.kind() != lockfile.target {
-        tracing::debug!("target kind is different");
+		tracing::debug!("target kind is different");
-        return Ok(None);
+		return Ok(None);
-    }
+	}
 
-    if manifest.name != lockfile.name || manifest.version != lockfile.version {
+	if manifest.name != lockfile.name || manifest.version != lockfile.version {
-        tracing::debug!("name or version is different");
+		tracing::debug!("name or version is different");
-        return Ok(None);
+		return Ok(None);
-    }
+	}
 
-    let specs = lockfile
+	let specs = lockfile
-        .graph
+		.graph
-        .iter()
+		.iter()
-        .flat_map(|(_, versions)| versions)
+		.filter_map(|(_, node)| {
-        .filter_map(|(_, node)| {
+			node.direct
-            node.node
+				.as_ref()
-                .direct
+				.map(|(_, spec, source_ty)| (spec, source_ty))
-                .as_ref()
+		})
-                .map(|(_, spec, source_ty)| (spec, source_ty))
+		.collect::<HashSet<_>>();
-        })
-        .collect::<HashSet<_>>();
 
-    let same_dependencies = manifest
+	let same_dependencies = manifest
-        .all_dependencies()
+		.all_dependencies()
-        .context("failed to get all dependencies")?
+		.context("failed to get all dependencies")?
-        .iter()
+		.iter()
-        .all(|(_, (spec, ty))| specs.contains(&(spec, ty)));
+		.all(|(_, (spec, ty))| specs.contains(&(spec, ty)));
 
-    tracing::debug!("dependencies are the same: {same_dependencies}");
+	tracing::debug!("dependencies are the same: {same_dependencies}");
 
-    Ok(if same_dependencies {
+	Ok(if same_dependencies {
-        Some(lockfile)
+		Some(lockfile)
-    } else {
+	} else {
-        None
+		None
-    })
+	})
 }
 
 #[derive(Debug, Clone)]
 struct VersionedPackageName<V: FromStr = VersionId, N: FromStr = PackageNames>(N, Option<V>);
 
 impl<V: FromStr<Err = E>, E: Into<anyhow::Error>, N: FromStr<Err = F>, F: Into<anyhow::Error>>
-    FromStr for VersionedPackageName<V, N>
+	FromStr for VersionedPackageName<V, N>
 {
-    type Err = anyhow::Error;
+	type Err = anyhow::Error;
 
-    fn from_str(s: &str) -> Result<Self, Self::Err> {
+	fn from_str(s: &str) -> Result<Self, Self::Err> {
-        let mut parts = s.splitn(2, '@');
+		let mut parts = s.splitn(2, '@');
-        let name = parts.next().unwrap();
+		let name = parts.next().unwrap();
-        let version = parts
+		let version = parts
-            .next()
+			.next()
-            .map(FromStr::from_str)
+			.map(FromStr::from_str)
-            .transpose()
+			.transpose()
-            .map_err(Into::into)?;
+			.map_err(Into::into)?;
 
-        Ok(VersionedPackageName(
+		Ok(VersionedPackageName(
-            name.parse().map_err(Into::into)?,
+			name.parse().map_err(Into::into)?,
-            version,
+			version,
-        ))
+		))
-    }
+	}
 }
 
 impl VersionedPackageName {
-    #[cfg(feature = "patches")]
+	#[cfg(feature = "patches")]
-    fn get(
+	fn get(
-        self,
+		self,
-        graph: &pesde::lockfile::DownloadedGraph,
+		graph: &pesde::graph::DependencyGraph,
-    ) -> anyhow::Result<(PackageNames, VersionId)> {
+	) -> anyhow::Result<pesde::source::ids::PackageId> {
-        let version_id = match self.1 {
+		let version_id = match self.1 {
-            Some(version) => version,
+			Some(version) => version,
-            None => {
+			None => {
-                let versions = graph.get(&self.0).context("package not found in graph")?;
+				let versions = graph
-                if versions.len() == 1 {
+					.keys()
-                    let version = versions.keys().next().unwrap().clone();
+					.filter(|id| *id.name() == self.0)
-                    tracing::debug!("only one version found, using {version}");
+					.collect::<Vec<_>>();
-                    version
-                } else {
-                    anyhow::bail!(
-                        "multiple versions found, please specify one of: {}",
-                        versions
-                            .keys()
-                            .map(|v| v.to_string())
-                            .collect::<Vec<_>>()
-                            .join(", ")
-                    );
-                }
-            }
-        };
 
-        Ok((self.0, version_id))
+				match versions.len() {
-    }
+					0 => anyhow::bail!("package not found"),
+					1 => versions[0].version_id().clone(),
+					_ => anyhow::bail!(
+						"multiple versions found, please specify one of: {}",
+						versions
+							.iter()
+							.map(|v| v.to_string())
+							.collect::<Vec<_>>()
+							.join(", ")
+					),
+				}
+			}
+		};
+
+		Ok(pesde::source::ids::PackageId::new(self.0, version_id))
+	}
 }
 
 #[derive(Debug, Clone)]
 enum AnyPackageIdentifier<V: FromStr = VersionId, N: FromStr = PackageNames> {
-    PackageName(VersionedPackageName<V, N>),
+	PackageName(VersionedPackageName<V, N>),
-    Url((gix::Url, String)),
+	Url((gix::Url, String)),
-    Workspace(VersionedPackageName<VersionTypeOrReq, PackageName>),
+	Workspace(VersionedPackageName<VersionTypeOrReq, PackageName>),
+	Path(PathBuf),
 }
 
 impl<V: FromStr<Err = E>, E: Into<anyhow::Error>, N: FromStr<Err = F>, F: Into<anyhow::Error>>
-    FromStr for AnyPackageIdentifier<V, N>
+	FromStr for AnyPackageIdentifier<V, N>
 {
-    type Err = anyhow::Error;
+	type Err = anyhow::Error;
 
-    fn from_str(s: &str) -> Result<Self, Self::Err> {
+	fn from_str(s: &str) -> Result<Self, Self::Err> {
-        if let Some(s) = s.strip_prefix("gh#") {
+		if let Some(s) = s.strip_prefix("gh#") {
-            let s = format!("https://github.com/{s}");
+			let s = format!("https://github.com/{s}");
-            let (repo, rev) = s.split_once('#').context("missing revision")?;
+			let (repo, rev) = s.split_once('#').context("missing revision")?;
 
-            Ok(AnyPackageIdentifier::Url((
+			Ok(AnyPackageIdentifier::Url((
-                repo.try_into()?,
+				repo.try_into()?,
-                rev.to_string(),
+				rev.to_string(),
-            )))
+			)))
-        } else if let Some(rest) = s.strip_prefix("workspace:") {
+		} else if let Some(rest) = s.strip_prefix("workspace:") {
-            Ok(AnyPackageIdentifier::Workspace(rest.parse()?))
+			Ok(AnyPackageIdentifier::Workspace(rest.parse()?))
-        } else if s.contains(':') {
+		} else if let Some(rest) = s.strip_prefix("path:") {
-            let (url, rev) = s.split_once('#').context("missing revision")?;
+			Ok(AnyPackageIdentifier::Path(rest.into()))
+		} else if s.contains(':') {
+			let (url, rev) = s.split_once('#').context("missing revision")?;
 
-            Ok(AnyPackageIdentifier::Url((
+			Ok(AnyPackageIdentifier::Url((
-                url.try_into()?,
+				url.try_into()?,
-                rev.to_string(),
+				rev.to_string(),
-            )))
+			)))
-        } else {
+		} else {
-            Ok(AnyPackageIdentifier::PackageName(s.parse()?))
+			Ok(AnyPackageIdentifier::PackageName(s.parse()?))
-        }
+		}
-    }
+	}
 }
 
 pub fn parse_gix_url(s: &str) -> Result<gix::Url, gix::url::parse::Error> {
-    s.try_into()
+	s.try_into()
-}
-
-pub async fn progress_bar<E: std::error::Error + Into<anyhow::Error>>(
-    len: u64,
-    mut rx: tokio::sync::mpsc::Receiver<Result<String, E>>,
-    prefix: String,
-    progress_msg: String,
-    finish_msg: String,
-) -> anyhow::Result<()> {
-    let bar = indicatif::ProgressBar::new(len)
-        .with_style(
-            indicatif::ProgressStyle::default_bar()
-                .template("{prefix}[{elapsed_precise}] {bar:40.208/166} {pos}/{len} {msg}")?
-                .progress_chars("█▓▒░ "),
-        )
-        .with_prefix(prefix)
-        .with_message(progress_msg);
-    bar.enable_steady_tick(Duration::from_millis(100));
-
-    while let Some(result) = rx.recv().await {
-        bar.inc(1);
-
-        match result {
-            Ok(text) => {
-                bar.set_message(text);
-            }
-            Err(e) => return Err(e.into()),
-        }
-    }
-
-    bar.finish_with_message(finish_msg);
-
-    Ok(())
 }
 
 pub fn shift_project_dir(project: &Project, pkg_dir: PathBuf) -> Project {
-    Project::new(
+	Project::new(
-        pkg_dir,
+		pkg_dir,
-        Some(project.package_dir()),
+		Some(project.package_dir()),
-        project.data_dir(),
+		project.data_dir(),
-        project.cas_dir(),
+		project.cas_dir(),
-        project.auth_config().clone(),
+		project.auth_config().clone(),
-    )
+	)
 }
 
 pub async fn run_on_workspace_members<F: Future<Output = anyhow::Result<()>>>(
-    project: &Project,
+	project: &Project,
-    f: impl Fn(Project) -> F,
+	f: impl Fn(Project) -> F,
 ) -> anyhow::Result<BTreeMap<PackageName, BTreeMap<TargetKind, RelativePathBuf>>> {
-    // this might seem counterintuitive, but remember that
+	// this might seem counterintuitive, but remember that
-    // the presence of a workspace dir means that this project is a member of one
+	// the presence of a workspace dir means that this project is a member of one
-    if project.workspace_dir().is_some() {
+	if project.workspace_dir().is_some() {
-        return Ok(Default::default());
+		return Ok(Default::default());
-    }
+	}
 
-    let members_future = project
+	let members_future = project.workspace_members(true).await?;
-        .workspace_members(project.package_dir(), true)
+	pin!(members_future);
-        .await?;
-    pin!(members_future);
 
-    let mut results = BTreeMap::<PackageName, BTreeMap<TargetKind, RelativePathBuf>>::new();
+	let mut results = BTreeMap::<PackageName, BTreeMap<TargetKind, RelativePathBuf>>::new();
 
-    while let Some((path, manifest)) = members_future.next().await.transpose()? {
+	while let Some((path, manifest)) = members_future.next().await.transpose()? {
-        let relative_path =
+		let relative_path =
-            RelativePathBuf::from_path(path.strip_prefix(project.package_dir()).unwrap()).unwrap();
+			RelativePathBuf::from_path(path.strip_prefix(project.package_dir()).unwrap()).unwrap();
 
-        // don't run on the current workspace root
+		// don't run on the current workspace root
-        if relative_path != "" {
+		if relative_path != "" {
-            f(shift_project_dir(project, path)).await?;
+			f(shift_project_dir(project, path)).await?;
-        }
+		}
 
-        results
+		results
-            .entry(manifest.name)
+			.entry(manifest.name)
-            .or_default()
+			.or_default()
-            .insert(manifest.target.kind(), relative_path);
+			.insert(manifest.target.kind(), relative_path);
-    }
+	}
 
-    Ok(results)
+	Ok(results)
 }
 
 pub fn display_err(result: anyhow::Result<()>, prefix: &str) {
-    if let Err(err) = result {
+	if let Err(err) = result {
-        eprintln!("{}: {err}\n", format!("error{prefix}").red().bold());
+		eprintln!(
+			"{}: {err}\n",
+			ERROR_STYLE.apply_to(format!("error{prefix}"))
+		);
 
-        let cause = err.chain().skip(1).collect::<Vec<_>>();
+		let cause = err.chain().skip(1).collect::<Vec<_>>();
 
-        if !cause.is_empty() {
+		if !cause.is_empty() {
-            eprintln!("{}:", "caused by".red().bold());
+			eprintln!("{}:", ERROR_STYLE.apply_to("caused by"));
-            for err in cause {
+			for err in cause {
-                eprintln!("  - {err}");
+				eprintln!("\t- {err}");
-            }
+			}
-        }
+		}
 
-        let backtrace = err.backtrace();
+		let backtrace = err.backtrace();
-        match backtrace.status() {
+		match backtrace.status() {
-            std::backtrace::BacktraceStatus::Disabled => {
+			std::backtrace::BacktraceStatus::Disabled => {
-                eprintln!(
+				eprintln!(
-                    "\n{}: set RUST_BACKTRACE=1 for a backtrace",
+					"\n{}: set RUST_BACKTRACE=1 for a backtrace",
-                    "help".yellow().bold()
+					INFO_STYLE.apply_to("help")
-                );
+				);
-            }
+			}
-            std::backtrace::BacktraceStatus::Captured => {
+			std::backtrace::BacktraceStatus::Captured => {
-                eprintln!("\n{}:\n{backtrace}", "backtrace".yellow().bold());
+				eprintln!("\n{}:\n{backtrace}", WARN_STYLE.apply_to("backtrace"));
-            }
+			}
-            _ => {
+			_ => {
-                eprintln!("\n{}: not captured", "backtrace".yellow().bold());
+				eprintln!("\n{}: not captured", WARN_STYLE.apply_to("backtrace"));
-            }
+			}
-        }
+		}
-    }
+	}
+}
+
+pub async fn get_index(project: &Project, index: Option<&str>) -> anyhow::Result<gix::Url> {
+	let manifest = match project.deser_manifest().await {
+		Ok(manifest) => Some(manifest),
+		Err(e) => match e {
+			ManifestReadError::Io(e) if e.kind() == std::io::ErrorKind::NotFound => None,
+			e => return Err(e.into()),
+		},
+	};
+
+	let index_url = match index {
+		Some(index) => index.try_into().ok(),
+		None => match manifest {
+			Some(_) => None,
+			None => Some(read_config().await?.default_index),
+		},
+	};
+
+	match index_url {
+		Some(url) => Ok(url),
+		None => {
+			let index_name = index.unwrap_or(DEFAULT_INDEX_NAME);
+
+			manifest
+				.unwrap()
+				.indices
+				.remove(index_name)
+				.with_context(|| format!("index {index_name} not found in manifest"))
+		}
+	}
+}
+
+pub fn dep_type_to_key(dep_type: DependencyType) -> &'static str {
+	match dep_type {
+		DependencyType::Standard => "dependencies",
+		DependencyType::Dev => "dev_dependencies",
+		DependencyType::Peer => "peer_dependencies",
+	}
 }

src/cli/reporters.rs

@@ -0,0 +1,211 @@
+//! Progress reporters for the CLI
+
+use std::{
+	future::Future,
+	io::{Stdout, Write},
+	sync::{Arc, Mutex, Once, OnceLock},
+	time::Duration,
+};
+
+use indicatif::{MultiProgress, ProgressBar, ProgressStyle};
+use pesde::reporters::{
+	DownloadProgressReporter, DownloadsReporter, PatchProgressReporter, PatchesReporter,
+};
+
+pub const TICK_CHARS: &str = "⣷⣯⣟⡿⢿⣻⣽⣾";
+
+pub fn root_progress_style() -> ProgressStyle {
+	ProgressStyle::with_template("{prefix:.dim}{msg:>8.214/yellow} {spinner} [{elapsed_precise}]")
+		.unwrap()
+		.tick_chars(TICK_CHARS)
+}
+
+pub fn root_progress_style_with_progress() -> ProgressStyle {
+	ProgressStyle::with_template(
+		"{prefix:.dim}{msg:>8.214/yellow} {spinner} [{elapsed_precise}] {bar:20} {pos}/{len}",
+	)
+	.unwrap()
+	.tick_chars(TICK_CHARS)
+}
+
+pub async fn run_with_reporter_and_writer<W, F, R, Fut>(writer: W, f: F) -> R
+where
+	W: Write + Send + Sync + 'static,
+	F: FnOnce(MultiProgress, ProgressBar, Arc<CliReporter<W>>) -> Fut,
+	Fut: Future<Output = R>,
+{
+	let multi_progress = MultiProgress::new();
+	crate::PROGRESS_BARS
+		.lock()
+		.unwrap()
+		.replace(multi_progress.clone());
+
+	let root_progress = multi_progress.add(ProgressBar::new(0));
+	root_progress.set_style(root_progress_style());
+	root_progress.enable_steady_tick(Duration::from_millis(100));
+
+	let reporter = Arc::new(CliReporter::with_writer(
+		writer,
+		multi_progress.clone(),
+		root_progress.clone(),
+	));
+	let result = f(multi_progress.clone(), root_progress.clone(), reporter).await;
+
+	root_progress.finish();
+	multi_progress.clear().unwrap();
+	crate::PROGRESS_BARS.lock().unwrap().take();
+
+	result
+}
+
+pub async fn run_with_reporter<F, R, Fut>(f: F) -> R
+where
+	F: FnOnce(MultiProgress, ProgressBar, Arc<CliReporter<Stdout>>) -> Fut,
+	Fut: Future<Output = R>,
+{
+	run_with_reporter_and_writer(std::io::stdout(), f).await
+}
+
+pub struct CliReporter<W = Stdout> {
+	writer: Mutex<W>,
+	child_style: ProgressStyle,
+	child_style_with_bytes: ProgressStyle,
+	child_style_with_bytes_without_total: ProgressStyle,
+	multi_progress: MultiProgress,
+	root_progress: ProgressBar,
+}
+
+impl<W> CliReporter<W> {
+	#[allow(unknown_lints, clippy::literal_string_with_formatting_args)]
+	pub fn with_writer(
+		writer: W,
+		multi_progress: MultiProgress,
+		root_progress: ProgressBar,
+	) -> Self {
+		Self {
+			writer: Mutex::new(writer),
+			child_style: ProgressStyle::with_template("{msg:.dim}").unwrap(),
+			child_style_with_bytes: ProgressStyle::with_template(
+				"{msg:.dim} {bytes:.dim}/{total_bytes:.dim}",
+			)
+			.unwrap(),
+			child_style_with_bytes_without_total: ProgressStyle::with_template(
+				"{msg:.dim} {bytes:.dim}",
+			)
+			.unwrap(),
+			multi_progress,
+			root_progress,
+		}
+	}
+}
+
+pub struct CliDownloadProgressReporter<W> {
+	root_reporter: Arc<CliReporter<W>>,
+	name: String,
+	progress: OnceLock<ProgressBar>,
+	set_progress: Once,
+}
+
+impl<W: Write + Send + Sync + 'static> DownloadsReporter for CliReporter<W> {
+	type DownloadProgressReporter = CliDownloadProgressReporter<W>;
+
+	fn report_download(self: Arc<Self>, name: String) -> Self::DownloadProgressReporter {
+		self.root_progress.inc_length(1);
+
+		CliDownloadProgressReporter {
+			root_reporter: self,
+			name,
+			progress: OnceLock::new(),
+			set_progress: Once::new(),
+		}
+	}
+}
+
+impl<W: Write + Send + Sync + 'static> DownloadProgressReporter for CliDownloadProgressReporter<W> {
+	fn report_start(&self) {
+		let progress = self.root_reporter.multi_progress.add(ProgressBar::new(0));
+		progress.set_style(self.root_reporter.child_style.clone());
+		progress.set_message(format!("- {}", self.name));
+
+		self.progress
+			.set(progress)
+			.expect("report_start called more than once");
+	}
+
+	fn report_progress(&self, total: u64, len: u64) {
+		if let Some(progress) = self.progress.get() {
+			progress.set_length(total);
+			progress.set_position(len);
+
+			self.set_progress.call_once(|| {
+				if total > 0 {
+					progress.set_style(self.root_reporter.child_style_with_bytes.clone());
+				} else {
+					progress.set_style(
+						self.root_reporter
+							.child_style_with_bytes_without_total
+							.clone(),
+					);
+				}
+			});
+		}
+	}
+
+	fn report_done(&self) {
+		if let Some(progress) = self.progress.get() {
+			if progress.is_hidden() {
+				writeln!(
+					self.root_reporter.writer.lock().unwrap(),
+					"downloaded {}",
+					self.name
+				)
+				.unwrap();
+			}
+
+			progress.finish();
+			self.root_reporter.multi_progress.remove(progress);
+			self.root_reporter.root_progress.inc(1);
+		}
+	}
+}
+
+pub struct CliPatchProgressReporter<W> {
+	root_reporter: Arc<CliReporter<W>>,
+	name: String,
+	progress: ProgressBar,
+}
+
+impl<W: Write + Send + Sync + 'static> PatchesReporter for CliReporter<W> {
+	type PatchProgressReporter = CliPatchProgressReporter<W>;
+
+	fn report_patch(self: Arc<Self>, name: String) -> Self::PatchProgressReporter {
+		let progress = self.multi_progress.add(ProgressBar::new(0));
+		progress.set_style(self.child_style.clone());
+		progress.set_message(format!("- {name}"));
+
+		self.root_progress.inc_length(1);
+
+		CliPatchProgressReporter {
+			root_reporter: self,
+			name: name.to_string(),
+			progress,
+		}
+	}
+}
+
+impl<W: Write + Send + Sync + 'static> PatchProgressReporter for CliPatchProgressReporter<W> {
+	fn report_done(&self) {
+		if self.progress.is_hidden() {
+			writeln!(
+				self.root_reporter.writer.lock().unwrap(),
+				"patched {}",
+				self.name
+			)
+			.unwrap();
+		}
+
+		self.progress.finish();
+		self.root_reporter.multi_progress.remove(&self.progress);
+		self.root_reporter.root_progress.inc(1);
+	}
+}

src/cli/style.rs

@@ -0,0 +1,54 @@
+use console::{Style, StyledObject};
+use paste::paste;
+use std::{fmt::Display, sync::LazyLock};
+
+#[derive(Debug)]
+pub struct LazyStyle<T>(LazyLock<T>);
+
+impl LazyStyle<Style> {
+	pub fn apply_to<D>(&self, text: D) -> StyledObject<D> {
+		LazyLock::force(&self.0).apply_to(text)
+	}
+}
+
+impl<T: Display> Display for LazyStyle<T> {
+	fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+		write!(f, "{}", LazyLock::force(&self.0))
+	}
+}
+
+macro_rules! make_style {
+	($name:ident, $color:ident) => {
+		make_style!($name, $color());
+	};
+	($name:ident, $($color:tt)+) => {
+		paste! {
+			pub static [<$name _STYLE>]: LazyStyle<Style> = LazyStyle(LazyLock::new(||
+				Style::new().$($color)+.bold()
+			));
+		}
+	};
+}
+
+macro_rules! make_prefix {
+    ($name:ident) => {
+		paste! {
+			pub static [<$name:upper _PREFIX>]: LazyStyle<StyledObject<&'static str>> = LazyStyle(LazyLock::new(||
+				[<$name:upper _STYLE>].apply_to(stringify!($name))
+			));
+		}
+	};
+}
+
+pub const CLI_COLOR_256: u8 = 214;
+
+make_style!(INFO, cyan);
+make_style!(WARN, yellow);
+make_prefix!(warn);
+make_style!(ERROR, red);
+make_prefix!(error);
+make_style!(SUCCESS, green);
+make_style!(CLI, color256(CLI_COLOR_256));
+make_style!(ADDED, green);
+make_style!(REMOVED, red);
+make_style!(URL, blue().underlined());

src/cli/version.rs

@@ -1,361 +1,294 @@
-use crate::cli::{
+use crate::{
-    bin_dir,
+	cli::{
-    config::{read_config, write_config, CliConfig},
+		bin_dir,
-    files::make_executable,
+		config::{read_config, write_config, CliConfig},
-    home_dir,
+		files::make_executable,
+		home_dir,
+		reporters::run_with_reporter,
+		style::{ADDED_STYLE, CLI_STYLE, REMOVED_STYLE, URL_STYLE},
+	},
+	util::no_build_metadata,
 };
 use anyhow::Context;
-use colored::Colorize;
+use console::Style;
 use fs_err::tokio as fs;
-use futures::StreamExt;
+use jiff::SignedDuration;
-use reqwest::header::ACCEPT;
+use pesde::{
-use semver::Version;
+	engine::{
-use serde::Deserialize;
+		source::{
-use std::{
+			traits::{DownloadOptions, EngineSource, ResolveOptions},
-    env::current_exe,
+			EngineSources,
-    path::{Path, PathBuf},
+		},
+		EngineKind,
+	},
+	reporters::DownloadsReporter,
+	version_matches,
+};
+use semver::{Version, VersionReq};
+use std::{
+	collections::BTreeSet,
+	env::current_exe,
+	path::{Path, PathBuf},
+	sync::Arc,
 };
-use tokio::io::AsyncWrite;
 use tracing::instrument;
 
 pub fn current_version() -> Version {
-    Version::parse(env!("CARGO_PKG_VERSION")).unwrap()
+	Version::parse(env!("CARGO_PKG_VERSION")).unwrap()
 }
 
-#[derive(Debug, Deserialize)]
+const CHECK_INTERVAL: SignedDuration = SignedDuration::from_hours(6);
-struct Release {
+
-    tag_name: String,
+pub async fn find_latest_version(reqwest: &reqwest::Client) -> anyhow::Result<Version> {
-    assets: Vec<Asset>,
+	let version = EngineSources::pesde()
+		.resolve(
+			&VersionReq::STAR,
+			&ResolveOptions {
+				reqwest: reqwest.clone(),
+			},
+		)
+		.await
+		.context("failed to resolve version")?
+		.pop_last()
+		.context("no versions found")?
+		.0;
+
+	Ok(version)
 }
 
-#[derive(Debug, Deserialize)]
-struct Asset {
-    name: String,
-    url: url::Url,
-}
-
-#[instrument(level = "trace")]
-fn get_repo() -> (String, String) {
-    let mut parts = env!("CARGO_PKG_REPOSITORY").split('/').skip(3);
-    let (owner, repo) = (
-        parts.next().unwrap().to_string(),
-        parts.next().unwrap().to_string(),
-    );
-
-    tracing::trace!("repository for updates: {owner}/{repo}");
-
-    (owner, repo)
-}
-
-#[derive(Debug)]
-pub enum VersionType {
-    Latest,
-    Specific(Version),
-}
-
-#[instrument(skip(reqwest), level = "trace")]
-pub async fn get_remote_version(
-    reqwest: &reqwest::Client,
-    ty: VersionType,
-) -> anyhow::Result<Version> {
-    let (owner, repo) = get_repo();
-
-    let mut releases = reqwest
-        .get(format!(
-            "https://api.github.com/repos/{owner}/{repo}/releases",
-        ))
-        .send()
-        .await
-        .context("failed to send request to GitHub API")?
-        .error_for_status()
-        .context("failed to get GitHub API response")?
-        .json::<Vec<Release>>()
-        .await
-        .context("failed to parse GitHub API response")?
-        .into_iter()
-        .filter_map(|release| Version::parse(release.tag_name.trim_start_matches('v')).ok());
-
-    match ty {
-        VersionType::Latest => releases.max(),
-        VersionType::Specific(version) => {
-            releases.find(|v| no_build_metadata(v) == no_build_metadata(&version))
-        }
-    }
-    .context("failed to find latest version")
-}
-
-pub fn no_build_metadata(version: &Version) -> Version {
-    let mut version = version.clone();
-    version.build = semver::BuildMetadata::EMPTY;
-    version
-}
-
-const CHECK_INTERVAL: chrono::Duration = chrono::Duration::hours(6);
-
 #[instrument(skip(reqwest), level = "trace")]
 pub async fn check_for_updates(reqwest: &reqwest::Client) -> anyhow::Result<()> {
-    let config = read_config().await?;
+	let config = read_config().await?;
 
-    let version = if let Some((_, version)) = config
+	let version = if let Some((_, version)) = config
-        .last_checked_updates
+		.last_checked_updates
-        .filter(|(time, _)| chrono::Utc::now() - *time < CHECK_INTERVAL)
+		.filter(|(time, _)| jiff::Timestamp::now().duration_since(*time) < CHECK_INTERVAL)
-    {
+	{
-        tracing::debug!("using cached version");
+		tracing::debug!("using cached version");
-        version
+		version
-    } else {
+	} else {
-        tracing::debug!("checking for updates");
+		tracing::debug!("checking for updates");
-        let version = get_remote_version(reqwest, VersionType::Latest).await?;
+		let version = find_latest_version(reqwest).await?;
 
-        write_config(&CliConfig {
+		write_config(&CliConfig {
-            last_checked_updates: Some((chrono::Utc::now(), version.clone())),
+			last_checked_updates: Some((jiff::Timestamp::now(), version.clone())),
-            ..config
+			..config
-        })
+		})
-        .await?;
+		.await?;
 
-        version
+		version
-    };
+	};
-    let current_version = current_version();
+	let current_version = current_version();
-    let version_no_metadata = no_build_metadata(&version);
+	let version_no_metadata = no_build_metadata(&version);
 
-    if version_no_metadata <= current_version {
+	if version_no_metadata <= current_version {
-        return Ok(());
+		return Ok(());
-    }
+	}
 
-    let name = env!("CARGO_BIN_NAME");
+	let alert_style = Style::new().yellow();
-    let changelog = format!("{}/releases/tag/v{version}", env!("CARGO_PKG_REPOSITORY"));
+	let changelog = format!("{}/releases/tag/v{version}", env!("CARGO_PKG_REPOSITORY"));
 
-    let unformatted_messages = [
+	let messages = [
-        "".to_string(),
+		format!(
-        format!("update available! {current_version} → {version_no_metadata}"),
+			"{} {} → {}",
-        format!("changelog: {changelog}"),
+			alert_style.apply_to("update available!").bold(),
-        format!("run `{name} self-upgrade` to upgrade"),
+			REMOVED_STYLE.apply_to(current_version),
-        "".to_string(),
+			ADDED_STYLE.apply_to(version_no_metadata)
-    ];
+		),
+		format!(
+			"run {} to upgrade",
+			CLI_STYLE.apply_to(concat!("`", env!("CARGO_BIN_NAME"), " self-upgrade`")),
+		),
+		"".to_string(),
+		format!("changelog: {}", URL_STYLE.apply_to(changelog)),
+	];
 
-    let width = unformatted_messages
+	let column = alert_style.apply_to("┃");
-        .iter()
-        .map(|s| s.chars().count())
-        .max()
-        .unwrap()
-        + 4;
 
-    let column = "│".bright_magenta();
+	let message = messages
+		.into_iter()
+		.map(|s| format!("{column}  {s}"))
+		.collect::<Vec<_>>()
+		.join("\n");
 
-    let message = [
+	println!("\n{message}\n");
-        "".to_string(),
-        format!(
-            "update available! {} → {}",
-            current_version.to_string().red(),
-            version_no_metadata.to_string().green()
-        ),
-        format!("changelog: {}", changelog.blue()),
-        format!(
-            "run `{} {}` to upgrade",
-            name.blue(),
-            "self-upgrade".yellow()
-        ),
-        "".to_string(),
-    ]
-    .into_iter()
-    .enumerate()
-    .map(|(i, s)| {
-        let text_length = unformatted_messages[i].chars().count();
-        let padding = (width as f32 - text_length as f32) / 2f32;
-        let padding_l = " ".repeat(padding.floor() as usize);
-        let padding_r = " ".repeat(padding.ceil() as usize);
-        format!("{column}{padding_l}{s}{padding_r}{column}")
-    })
-    .collect::<Vec<_>>()
-    .join("\n");
 
-    let lines = "─".repeat(width).bright_magenta();
+	Ok(())
-
-    let tl = "╭".bright_magenta();
-    let tr = "╮".bright_magenta();
-    let bl = "╰".bright_magenta();
-    let br = "╯".bright_magenta();
-
-    println!("\n{tl}{lines}{tr}\n{message}\n{bl}{lines}{br}\n");
-
-    Ok(())
 }
 
-#[instrument(skip(reqwest, writer), level = "trace")]
+const ENGINES_DIR: &str = "engines";
-pub async fn download_github_release<W: AsyncWrite + Unpin>(
-    reqwest: &reqwest::Client,
-    version: &Version,
-    mut writer: W,
-) -> anyhow::Result<()> {
-    let (owner, repo) = get_repo();
 
-    let release = reqwest
+#[instrument(level = "trace")]
-        .get(format!(
+pub async fn get_installed_versions(engine: EngineKind) -> anyhow::Result<BTreeSet<Version>> {
-            "https://api.github.com/repos/{owner}/{repo}/releases/tags/v{version}",
+	let source = engine.source();
-        ))
+	let path = home_dir()?.join(ENGINES_DIR).join(source.directory());
-        .send()
+	let mut installed_versions = BTreeSet::new();
-        .await
-        .context("failed to send request to GitHub API")?
-        .error_for_status()
-        .context("failed to get GitHub API response")?
-        .json::<Release>()
-        .await
-        .context("failed to parse GitHub API response")?;
 
-    let asset = release
+	let mut read_dir = match fs::read_dir(&path).await {
-        .assets
+		Ok(read_dir) => read_dir,
-        .into_iter()
+		Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(installed_versions),
-        .find(|asset| {
+		Err(e) => return Err(e).context("failed to read engines directory"),
-            asset.name.ends_with(&format!(
+	};
-                "-{}-{}.tar.gz",
-                std::env::consts::OS,
-                std::env::consts::ARCH
-            ))
-        })
-        .context("failed to find asset for current platform")?;
 
-    let bytes = reqwest
+	while let Some(entry) = read_dir.next_entry().await? {
-        .get(asset.url)
+		let path = entry.path();
-        .header(ACCEPT, "application/octet-stream")
-        .send()
-        .await
-        .context("failed to send request to download asset")?
-        .error_for_status()
-        .context("failed to download asset")?
-        .bytes()
-        .await
-        .context("failed to download asset")?;
 
-    let mut decoder = async_compression::tokio::bufread::GzipDecoder::new(bytes.as_ref());
+		let Some(version) = path.file_name().and_then(|s| s.to_str()) else {
-    let mut archive = tokio_tar::Archive::new(&mut decoder);
+			continue;
+		};
 
-    let mut entry = archive
+		if let Ok(version) = Version::parse(version) {
-        .entries()
+			installed_versions.insert(version);
-        .context("failed to read archive entries")?
+		}
-        .next()
+	}
-        .await
-        .context("archive has no entry")?
-        .context("failed to get first archive entry")?;
 
-    tokio::io::copy(&mut entry, &mut writer)
+	Ok(installed_versions)
-        .await
-        .context("failed to write archive entry to file")
-        .map(|_| ())
-}
-
-#[derive(Debug)]
-pub enum TagInfo {
-    Complete(Version),
-    Incomplete(Version),
 }
 
 #[instrument(skip(reqwest), level = "trace")]
-pub async fn get_or_download_version(
+pub async fn get_or_download_engine(
-    reqwest: &reqwest::Client,
+	reqwest: &reqwest::Client,
-    tag: &TagInfo,
+	engine: EngineKind,
-    always_give_path: bool,
+	req: VersionReq,
-) -> anyhow::Result<Option<PathBuf>> {
+) -> anyhow::Result<PathBuf> {
-    let path = home_dir()?.join("versions");
+	let source = engine.source();
-    fs::create_dir_all(&path)
+	let path = home_dir()?.join(ENGINES_DIR).join(source.directory());
-        .await
-        .context("failed to create versions directory")?;
 
-    let version = match tag {
+	let installed_versions = get_installed_versions(engine).await?;
-        TagInfo::Complete(version) => version,
-        // don't fetch the version since it could be cached
-        TagInfo::Incomplete(version) => version,
-    };
 
-    let path = path.join(format!(
+	let max_matching = installed_versions
-        "{}{}",
+		.iter()
-        no_build_metadata(version),
+		.filter(|v| version_matches(&req, v))
-        std::env::consts::EXE_SUFFIX
+		.next_back();
-    ));
+	if let Some(version) = max_matching {
+		return Ok(path
+			.join(version.to_string())
+			.join(source.expected_file_name())
+			.with_extension(std::env::consts::EXE_EXTENSION));
+	}
 
-    let is_requested_version = !always_give_path && *version == current_version();
+	let path = run_with_reporter(|_, root_progress, reporter| async {
+		let root_progress = root_progress;
+		let reporter = reporter;
 
-    if path.exists() {
+		root_progress.set_message("resolve version");
-        tracing::debug!("version already exists");
+		let mut versions = source
+			.resolve(
+				&req,
+				&ResolveOptions {
+					reqwest: reqwest.clone(),
+				},
+			)
+			.await
+			.context("failed to resolve versions")?;
+		let (version, engine_ref) = versions.pop_last().context("no matching versions found")?;
 
-        return Ok(if is_requested_version {
+		root_progress.set_message("download");
-            None
-        } else {
-            Some(path)
-        });
-    }
 
-    if is_requested_version {
+		let reporter = reporter.report_download(format!("{engine} v{version}"));
-        tracing::debug!("copying current executable to version directory");
-        fs::copy(current_exe()?, &path)
-            .await
-            .context("failed to copy current executable to version directory")?;
-    } else {
-        let version = match tag {
-            TagInfo::Complete(version) => version.clone(),
-            TagInfo::Incomplete(version) => {
-                get_remote_version(reqwest, VersionType::Specific(version.clone()))
-                    .await
-                    .context("failed to get remote version")?
-            }
-        };
 
-        tracing::debug!("downloading version");
+		let archive = source
-        download_github_release(
+			.download(
-            reqwest,
+				&engine_ref,
-            &version,
+				&DownloadOptions {
-            fs::File::create(&path)
+					reqwest: reqwest.clone(),
-                .await
+					reporter: Arc::new(reporter),
-                .context("failed to create version file")?,
+					version: version.clone(),
-        )
+				},
-        .await?;
+			)
-    }
+			.await
+			.context("failed to download engine")?;
 
-    make_executable(&path)
+		let path = path.join(version.to_string());
-        .await
+		fs::create_dir_all(&path)
-        .context("failed to make downloaded version executable")?;
+			.await
+			.context("failed to create engine container folder")?;
+		let path = path
+			.join(source.expected_file_name())
+			.with_extension(std::env::consts::EXE_EXTENSION);
 
-    Ok(if is_requested_version {
+		let mut file = fs::File::create(&path)
-        None
+			.await
-    } else {
+			.context("failed to create new file")?;
-        Some(path)
+
-    })
+		tokio::io::copy(
+			&mut archive
+				.find_executable(source.expected_file_name())
+				.await
+				.context("failed to find executable")?,
+			&mut file,
+		)
+		.await
+		.context("failed to write to file")?;
+
+		Ok::<_, anyhow::Error>(path)
+	})
+	.await?;
+
+	make_executable(&path)
+		.await
+		.context("failed to make downloaded version executable")?;
+
+	if engine != EngineKind::Pesde {
+		make_linker_if_needed(engine).await?;
+	}
+
+	Ok(path)
 }
 
 #[instrument(level = "trace")]
-pub async fn update_bin_exe(downloaded_file: &Path) -> anyhow::Result<()> {
+pub async fn replace_pesde_bin_exe(with: &Path) -> anyhow::Result<()> {
-    let bin_exe_path = bin_dir().await?.join(format!(
+	let bin_exe_path = bin_dir()
-        "{}{}",
+		.await?
-        env!("CARGO_BIN_NAME"),
+		.join(EngineKind::Pesde.to_string())
-        std::env::consts::EXE_SUFFIX
+		.with_extension(std::env::consts::EXE_EXTENSION);
-    ));
-    let mut downloaded_file = downloaded_file.to_path_buf();
 
-    let exists = bin_exe_path.exists();
+	let exists = bin_exe_path.exists();
 
-    if cfg!(target_os = "linux") && exists {
+	if cfg!(target_os = "linux") && exists {
-        fs::remove_file(&bin_exe_path)
+		fs::remove_file(&bin_exe_path)
-            .await
+			.await
-            .context("failed to remove existing executable")?;
+			.context("failed to remove existing executable")?;
-    } else if exists {
+	} else if exists {
-        let tempfile = tempfile::Builder::new()
+		let tempfile = tempfile::Builder::new()
-            .make(|_| Ok(()))
+			.make(|_| Ok(()))
-            .context("failed to create temporary file")?;
+			.context("failed to create temporary file")?;
-        let path = tempfile.into_temp_path().to_path_buf();
+		let temp_path = tempfile.into_temp_path().to_path_buf();
-        #[cfg(windows)]
+		#[cfg(windows)]
-        let path = path.with_extension("exe");
+		let temp_path = temp_path.with_extension("exe");
 
-        let current_exe = current_exe().context("failed to get current exe path")?;
+		match fs::rename(&bin_exe_path, &temp_path).await {
-        if current_exe == downloaded_file {
+			Ok(_) => {}
-            downloaded_file = path.to_path_buf();
+			Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
-        }
+			Err(e) => return Err(e).context("failed to rename existing executable"),
+		}
+	}
 
-        fs::rename(&bin_exe_path, &path)
+	fs::copy(with, &bin_exe_path)
-            .await
+		.await
-            .context("failed to rename current executable")?;
+		.context("failed to copy executable to bin folder")?;
-    }
 
-    fs::copy(downloaded_file, &bin_exe_path)
+	make_executable(&bin_exe_path).await
-        .await
+}
-        .context("failed to copy executable to bin folder")?;
+
-
+#[instrument(level = "trace")]
-    make_executable(&bin_exe_path).await
+pub async fn make_linker_if_needed(engine: EngineKind) -> anyhow::Result<()> {
+	let bin_dir = bin_dir().await?;
+	let linker = bin_dir
+		.join(engine.to_string())
+		.with_extension(std::env::consts::EXE_EXTENSION);
+	let exists = linker.exists();
+
+	if !exists {
+		let exe = current_exe().context("failed to get current exe path")?;
+
+		#[cfg(windows)]
+		let result = fs::symlink_file(exe, linker);
+		#[cfg(not(windows))]
+		let result = fs::symlink(exe, linker);
+
+		result.await.context("failed to create symlink")?;
+	}
+
+	Ok(())
 }

src/download.rs

@@ -1,190 +1,203 @@
 use crate::{
-    lockfile::{DependencyGraph, DownloadedDependencyGraphNode, DownloadedGraph},
+	graph::{DependencyGraph, DependencyGraphNode},
-    manifest::DependencyType,
+	reporters::{DownloadProgressReporter, DownloadsReporter},
-    refresh_sources,
+	source::{
-    source::{
+		fs::PackageFs,
-        traits::{PackageRef, PackageSource},
+		ids::PackageId,
-        PackageSources,
+		traits::{DownloadOptions, PackageRef, PackageSource, RefreshOptions},
-    },
+	},
-    Project, PACKAGES_CONTAINER_NAME,
+	Project, RefreshedSources,
-};
-use fs_err::tokio as fs;
-use std::{
-    collections::HashSet,
-    sync::{Arc, Mutex},
 };
+use async_stream::try_stream;
+use futures::Stream;
+use std::{num::NonZeroUsize, sync::Arc};
+use tokio::{sync::Semaphore, task::JoinSet};
 use tracing::{instrument, Instrument};
 
-type MultithreadedGraph = Arc<Mutex<DownloadedGraph>>;
+/// Options for downloading.
+#[derive(Debug)]
+pub(crate) struct DownloadGraphOptions<Reporter> {
+	/// The reqwest client.
+	pub reqwest: reqwest::Client,
+	/// The downloads reporter.
+	pub reporter: Option<Arc<Reporter>>,
+	/// The refreshed sources.
+	pub refreshed_sources: RefreshedSources,
+	/// The max number of concurrent network requests.
+	pub network_concurrency: NonZeroUsize,
+}
 
-pub(crate) type MultithreadDownloadJob = (
+impl<Reporter> DownloadGraphOptions<Reporter>
-    tokio::sync::mpsc::Receiver<Result<String, errors::DownloadGraphError>>,
+where
-    MultithreadedGraph,
+	Reporter: DownloadsReporter + Send + Sync + 'static,
-);
+{
+	/// Creates a new download options with the given reqwest client and reporter.
+	pub(crate) fn new(reqwest: reqwest::Client) -> Self {
+		Self {
+			reqwest,
+			reporter: None,
+			refreshed_sources: Default::default(),
+			network_concurrency: NonZeroUsize::new(16).unwrap(),
+		}
+	}
+
+	/// Sets the downloads reporter.
+	pub(crate) fn reporter(mut self, reporter: impl Into<Arc<Reporter>>) -> Self {
+		self.reporter.replace(reporter.into());
+		self
+	}
+
+	/// Sets the refreshed sources.
+	pub(crate) fn refreshed_sources(mut self, refreshed_sources: RefreshedSources) -> Self {
+		self.refreshed_sources = refreshed_sources;
+		self
+	}
+
+	/// Sets the max number of concurrent network requests.
+	pub(crate) fn network_concurrency(mut self, network_concurrency: NonZeroUsize) -> Self {
+		self.network_concurrency = network_concurrency;
+		self
+	}
+}
+
+impl<Reporter> Clone for DownloadGraphOptions<Reporter> {
+	fn clone(&self) -> Self {
+		Self {
+			reqwest: self.reqwest.clone(),
+			reporter: self.reporter.clone(),
+			refreshed_sources: self.refreshed_sources.clone(),
+			network_concurrency: self.network_concurrency,
+		}
+	}
+}
 
 impl Project {
-    /// Downloads a graph of dependencies
+	/// Downloads a graph of dependencies.
-    #[instrument(skip(self, graph, refreshed_sources, reqwest), level = "debug")]
+	#[instrument(skip_all, level = "debug")]
-    pub async fn download_graph(
+	pub(crate) async fn download_graph<Reporter>(
-        &self,
+		&self,
-        graph: &DependencyGraph,
+		graph: &DependencyGraph,
-        refreshed_sources: &mut HashSet<PackageSources>,
+		options: DownloadGraphOptions<Reporter>,
-        reqwest: &reqwest::Client,
+	) -> Result<
-        prod: bool,
+		impl Stream<
-        write: bool,
+			Item = Result<(PackageId, DependencyGraphNode, PackageFs), errors::DownloadGraphError>,
-        wally: bool,
+		>,
-    ) -> Result<MultithreadDownloadJob, errors::DownloadGraphError> {
+		errors::DownloadGraphError,
-        let manifest = self.deser_manifest().await?;
+	>
-        let manifest_target_kind = manifest.target.kind();
+	where
-        let downloaded_graph: MultithreadedGraph = Arc::new(Mutex::new(Default::default()));
+		Reporter: DownloadsReporter + Send + Sync + 'static,
+	{
+		let DownloadGraphOptions {
+			reqwest,
+			reporter,
+			refreshed_sources,
+			network_concurrency,
+		} = options;
 
-        let (tx, rx) = tokio::sync::mpsc::channel(
+		let semaphore = Arc::new(Semaphore::new(network_concurrency.get()));
-            graph
-                .iter()
-                .map(|(_, versions)| versions.len())
-                .sum::<usize>()
-                .max(1),
-        );
 
-        refresh_sources(
+		let mut tasks = graph
-            self,
+			.iter()
-            graph
+			.map(|(package_id, node)| {
-                .iter()
+				let span = tracing::info_span!("download", package_id = package_id.to_string());
-                .flat_map(|(_, versions)| versions.iter())
-                .map(|(_, node)| node.pkg_ref.source()),
-            refreshed_sources,
-        )
-        .await?;
 
-        let project = Arc::new(self.clone());
+				let project = self.clone();
+				let reqwest = reqwest.clone();
+				let reporter = reporter.clone();
+				let refreshed_sources = refreshed_sources.clone();
+				let semaphore = semaphore.clone();
+				let package_id = Arc::new(package_id.clone());
+				let node = node.clone();
 
-        for (name, versions) in graph {
+				async move {
-            for (version_id, node) in versions {
+					let progress_reporter = reporter
-                // we need to download pesde packages first, since scripts (for target finding for example) can depend on them
+						.clone()
-                if node.pkg_ref.like_wally() != wally {
+						.map(|reporter| reporter.report_download(package_id.to_string()));
-                    continue;
-                }
 
-                let tx = tx.clone();
+					let _permit = semaphore.acquire().await;
 
-                let name = name.clone();
+					if let Some(ref progress_reporter) = progress_reporter {
-                let version_id = version_id.clone();
+						progress_reporter.report_start();
-                let node = node.clone();
+					}
 
-                let span = tracing::info_span!(
+					let source = node.pkg_ref.source();
-                    "download",
+					refreshed_sources
-                    name = name.to_string(),
+						.refresh(
-                    version_id = version_id.to_string()
+							&source,
-                );
+							&RefreshOptions {
+								project: project.clone(),
+							},
+						)
+						.await?;
 
-                let project = project.clone();
+					tracing::debug!("downloading");
-                let reqwest = reqwest.clone();
-                let downloaded_graph = downloaded_graph.clone();
 
-                let package_dir = self.package_dir().to_path_buf();
+					let fs = match progress_reporter {
+						Some(progress_reporter) => {
+							source
+								.download(
+									&node.pkg_ref,
+									&DownloadOptions {
+										project: project.clone(),
+										reqwest,
+										id: package_id.clone(),
+										reporter: Arc::new(progress_reporter),
+									},
+								)
+								.await
+						}
+						None => {
+							source
+								.download(
+									&node.pkg_ref,
+									&DownloadOptions {
+										project: project.clone(),
+										reqwest,
+										id: package_id.clone(),
+										reporter: Arc::new(()),
+									},
+								)
+								.await
+						}
+					}
+					.map_err(Box::new)?;
 
-                tokio::spawn(
+					tracing::debug!("downloaded");
-                    async move {
-                        let source = node.pkg_ref.source();
 
-                        let container_folder = node.container_folder(
+					Ok((Arc::into_inner(package_id).unwrap(), node, fs))
-                            &package_dir
+				}
-                                .join(manifest_target_kind.packages_folder(version_id.target()))
+				.instrument(span)
-                                .join(PACKAGES_CONTAINER_NAME),
+			})
-                            &name,
+			.collect::<JoinSet<Result<_, errors::DownloadGraphError>>>();
-                            version_id.version(),
-                        );
 
-                        match fs::create_dir_all(&container_folder).await {
+		let stream = try_stream! {
-                            Ok(_) => {}
+			while let Some(res) = tasks.join_next().await {
-                            Err(e) => {
+				yield res.unwrap()?;
-                                tx.send(Err(errors::DownloadGraphError::Io(e)))
+			}
-                                    .await
+		};
-                                    .unwrap();
-                                return;
-                            }
-                        }
 
-                        let project = project.clone();
+		Ok(stream)
-
+	}
-                        tracing::debug!("downloading");
-
-                        let (fs, target) =
-                            match source.download(&node.pkg_ref, &project, &reqwest).await {
-                                Ok(target) => target,
-                                Err(e) => {
-                                    tx.send(Err(Box::new(e).into())).await.unwrap();
-                                    return;
-                                }
-                            };
-
-                        tracing::debug!("downloaded");
-
-                        if write {
-                            if !prod || node.resolved_ty != DependencyType::Dev {
-                                match fs.write_to(container_folder, project.cas_dir(), true).await {
-                                    Ok(_) => {}
-                                    Err(e) => {
-                                        tx.send(Err(errors::DownloadGraphError::WriteFailed(e)))
-                                            .await
-                                            .unwrap();
-                                        return;
-                                    }
-                                };
-                            } else {
-                                tracing::debug!(
-                                    "skipping write to disk, dev dependency in prod mode"
-                                );
-                            }
-                        }
-
-                        let display_name = format!("{name}@{version_id}");
-
-                        {
-                            let mut downloaded_graph = downloaded_graph.lock().unwrap();
-                            downloaded_graph
-                                .entry(name)
-                                .or_default()
-                                .insert(version_id, DownloadedDependencyGraphNode { node, target });
-                        }
-
-                        tx.send(Ok(display_name)).await.unwrap();
-                    }
-                    .instrument(span),
-                );
-            }
-        }
-
-        Ok((rx, downloaded_graph))
-    }
 }
 
 /// Errors that can occur when downloading a graph
 pub mod errors {
-    use thiserror::Error;
+	use thiserror::Error;
 
-    /// Errors that can occur when downloading a graph
+	/// Errors that can occur when downloading a graph
-    #[derive(Debug, Error)]
+	#[derive(Debug, Error)]
-    #[non_exhaustive]
+	#[non_exhaustive]
-    pub enum DownloadGraphError {
+	pub enum DownloadGraphError {
-        /// An error occurred deserializing the project manifest
+		/// An error occurred refreshing a package source
-        #[error("error deserializing project manifest")]
+		#[error("failed to refresh package source")]
-        ManifestDeserializationFailed(#[from] crate::errors::ManifestReadError),
+		RefreshFailed(#[from] crate::source::errors::RefreshError),
 
-        /// An error occurred refreshing a package source
+		/// Error interacting with the filesystem
-        #[error("failed to refresh package source")]
+		#[error("error interacting with the filesystem")]
-        RefreshFailed(#[from] Box<crate::source::errors::RefreshError>),
+		Io(#[from] std::io::Error),
 
-        /// Error interacting with the filesystem
+		/// Error downloading a package
-        #[error("error interacting with the filesystem")]
+		#[error("failed to download package")]
-        Io(#[from] std::io::Error),
+		DownloadFailed(#[from] Box<crate::source::errors::DownloadError>),
-
+	}
-        /// Error downloading a package
-        #[error("failed to download package")]
-        DownloadFailed(#[from] Box<crate::source::errors::DownloadError>),
-
-        /// Error writing package contents
-        #[error("failed to write package contents")]
-        WriteFailed(#[source] std::io::Error),
-    }
 }

src/download_and_link.rs

@@ -1,176 +1,425 @@
 use crate::{
-    lockfile::{DependencyGraph, DownloadedGraph},
+	all_packages_dirs,
-    manifest::DependencyType,
+	download::DownloadGraphOptions,
-    source::PackageSources,
+	graph::{
-    Project,
+		DependencyGraph, DependencyGraphNode, DependencyGraphNodeWithTarget,
+		DependencyGraphWithTarget,
+	},
+	manifest::{target::TargetKind, DependencyType},
+	reporters::DownloadsReporter,
+	source::{
+		ids::PackageId,
+		traits::{GetTargetOptions, PackageRef, PackageSource},
+	},
+	Project, RefreshedSources, SCRIPTS_LINK_FOLDER,
 };
-use futures::FutureExt;
+use fs_err::tokio as fs;
+use futures::TryStreamExt;
 use std::{
-    collections::HashSet,
+	collections::HashMap,
-    future::Future,
+	convert::Infallible,
-    sync::{Arc, Mutex as StdMutex},
+	future::{self, Future},
+	num::NonZeroUsize,
+	path::PathBuf,
+	sync::Arc,
 };
-use tokio::sync::Mutex;
+use tokio::{pin, task::JoinSet};
 use tracing::{instrument, Instrument};
 
-/// Filters a graph to only include production dependencies, if `prod` is `true`
+/// Hooks to perform actions after certain events during download and linking.
-pub fn filter_graph(graph: &DownloadedGraph, prod: bool) -> DownloadedGraph {
+#[allow(unused_variables)]
-    if !prod {
+pub trait DownloadAndLinkHooks {
-        return graph.clone();
+	/// The error type for the hooks.
-    }
+	type Error: std::error::Error + Send + Sync + 'static;
 
-    graph
+	/// Called after scripts have been downloaded. The `downloaded_graph`
-        .iter()
+	/// contains all downloaded packages.
-        .map(|(name, versions)| {
+	fn on_scripts_downloaded(
-            (
+		&self,
-                name.clone(),
+		graph: &DependencyGraphWithTarget,
-                versions
+	) -> impl Future<Output = Result<(), Self::Error>> + Send {
-                    .iter()
+		future::ready(Ok(()))
-                    .filter(|(_, node)| node.node.resolved_ty != DependencyType::Dev)
+	}
-                    .map(|(v_id, node)| (v_id.clone(), node.clone()))
+
-                    .collect(),
+	/// Called after binary dependencies have been downloaded. The
-            )
+	/// `downloaded_graph` contains all downloaded packages.
-        })
+	fn on_bins_downloaded(
-        .collect()
+		&self,
+		graph: &DependencyGraphWithTarget,
+	) -> impl Future<Output = Result<(), Self::Error>> + Send {
+		future::ready(Ok(()))
+	}
+
+	/// Called after all dependencies have been downloaded. The
+	/// `downloaded_graph` contains all downloaded packages.
+	fn on_all_downloaded(
+		&self,
+		graph: &DependencyGraphWithTarget,
+	) -> impl Future<Output = Result<(), Self::Error>> + Send {
+		future::ready(Ok(()))
+	}
 }
 
-/// Receiver for dependencies downloaded and linked
+impl DownloadAndLinkHooks for () {
-pub type DownloadAndLinkReceiver =
+	type Error = Infallible;
-    tokio::sync::mpsc::Receiver<Result<String, crate::download::errors::DownloadGraphError>>;
+}
+
+/// Options for downloading and linking.
+#[derive(Debug)]
+pub struct DownloadAndLinkOptions<Reporter = (), Hooks = ()> {
+	/// The reqwest client.
+	pub reqwest: reqwest::Client,
+	/// The downloads reporter.
+	pub reporter: Option<Arc<Reporter>>,
+	/// The download and link hooks.
+	pub hooks: Option<Arc<Hooks>>,
+	/// The refreshed sources.
+	pub refreshed_sources: RefreshedSources,
+	/// Whether to skip dev dependencies.
+	pub prod: bool,
+	/// The max number of concurrent network requests.
+	pub network_concurrency: NonZeroUsize,
+	/// Whether to re-install all dependencies even if they are already installed
+	pub force: bool,
+}
+
+impl<Reporter, Hooks> DownloadAndLinkOptions<Reporter, Hooks>
+where
+	Reporter: DownloadsReporter + Send + Sync + 'static,
+	Hooks: DownloadAndLinkHooks + Send + Sync + 'static,
+{
+	/// Creates a new download options with the given reqwest client and reporter.
+	pub fn new(reqwest: reqwest::Client) -> Self {
+		Self {
+			reqwest,
+			reporter: None,
+			hooks: None,
+			refreshed_sources: Default::default(),
+			prod: false,
+			network_concurrency: NonZeroUsize::new(16).unwrap(),
+			force: false,
+		}
+	}
+
+	/// Sets the downloads reporter.
+	pub fn reporter(mut self, reporter: impl Into<Arc<Reporter>>) -> Self {
+		self.reporter.replace(reporter.into());
+		self
+	}
+
+	/// Sets the download and link hooks.
+	pub fn hooks(mut self, hooks: impl Into<Arc<Hooks>>) -> Self {
+		self.hooks.replace(hooks.into());
+		self
+	}
+
+	/// Sets the refreshed sources.
+	pub fn refreshed_sources(mut self, refreshed_sources: RefreshedSources) -> Self {
+		self.refreshed_sources = refreshed_sources;
+		self
+	}
+
+	/// Sets whether to skip dev dependencies.
+	pub fn prod(mut self, prod: bool) -> Self {
+		self.prod = prod;
+		self
+	}
+
+	/// Sets the max number of concurrent network requests.
+	pub fn network_concurrency(mut self, network_concurrency: NonZeroUsize) -> Self {
+		self.network_concurrency = network_concurrency;
+		self
+	}
+
+	/// Sets whether to re-install all dependencies even if they are already installed
+	pub fn force(mut self, force: bool) -> Self {
+		self.force = force;
+		self
+	}
+}
+
+impl Clone for DownloadAndLinkOptions {
+	fn clone(&self) -> Self {
+		Self {
+			reqwest: self.reqwest.clone(),
+			reporter: self.reporter.clone(),
+			hooks: self.hooks.clone(),
+			refreshed_sources: self.refreshed_sources.clone(),
+			prod: self.prod,
+			network_concurrency: self.network_concurrency,
+			force: self.force,
+		}
+	}
+}
 
 impl Project {
-    /// Downloads a graph of dependencies and links them in the correct order
+	/// Downloads a graph of dependencies and links them in the correct order
-    #[instrument(
+	#[instrument(skip_all, fields(prod = options.prod), level = "debug")]
-        skip(self, graph, refreshed_sources, reqwest, pesde_cb),
+	pub async fn download_and_link<Reporter, Hooks>(
-        level = "debug"
+		&self,
-    )]
+		graph: &Arc<DependencyGraph>,
-    pub async fn download_and_link<
+		options: DownloadAndLinkOptions<Reporter, Hooks>,
-        F: FnOnce(&Arc<DownloadedGraph>) -> R + Send + 'static,
+	) -> Result<DependencyGraphWithTarget, errors::DownloadAndLinkError<Hooks::Error>>
-        R: Future<Output = Result<(), E>> + Send,
+	where
-        E: Send + Sync + 'static,
+		Reporter: DownloadsReporter + 'static,
-    >(
+		Hooks: DownloadAndLinkHooks + 'static,
-        &self,
+	{
-        graph: &Arc<DependencyGraph>,
+		let DownloadAndLinkOptions {
-        refreshed_sources: &Arc<Mutex<HashSet<PackageSources>>>,
+			reqwest,
-        reqwest: &reqwest::Client,
+			reporter,
-        prod: bool,
+			hooks,
-        write: bool,
+			refreshed_sources,
-        pesde_cb: F,
+			prod,
-    ) -> Result<
+			network_concurrency,
-        (
+			force,
-            DownloadAndLinkReceiver,
+		} = options;
-            impl Future<Output = Result<DownloadedGraph, errors::DownloadAndLinkError<E>>>,
-        ),
-        errors::DownloadAndLinkError<E>,
-    > {
-        let (tx, rx) = tokio::sync::mpsc::channel(
-            graph
-                .iter()
-                .map(|(_, versions)| versions.len())
-                .sum::<usize>()
-                .max(1),
-        );
-        let downloaded_graph = Arc::new(StdMutex::new(DownloadedGraph::default()));
 
-        let this = self.clone();
+		let graph = graph.clone();
-        let graph = graph.clone();
+		let reqwest = reqwest.clone();
-        let reqwest = reqwest.clone();
+		let manifest = self.deser_manifest().await?;
-        let refreshed_sources = refreshed_sources.clone();
 
-        Ok((
+		if force {
-            rx,
+			async fn remove_dir(dir: PathBuf) -> std::io::Result<()> {
-            tokio::spawn(async move {
+				tracing::debug!("force deleting the `{}` folder", dir.display());
-                let mut refreshed_sources = refreshed_sources.lock().await;
 
-                // step 1. download pesde dependencies
+				match fs::remove_dir_all(dir).await {
-                let (mut pesde_rx, pesde_graph) = this
+					Ok(()) => Ok(()),
-                    .download_graph(&graph, &mut refreshed_sources, &reqwest, prod, write, false)
+					Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(()),
-                    .instrument(tracing::debug_span!("download (pesde)"))
+					Err(e) => Err(e),
-                    .await?;
+				}
+			}
 
-                while let Some(result) = pesde_rx.recv().await {
+			let mut tasks = all_packages_dirs()
-                    tx.send(result).await.unwrap();
+				.into_iter()
-                }
+				.map(|folder| remove_dir(self.package_dir().join(&folder)))
+				.chain(std::iter::once(remove_dir(
+					self.package_dir().join(SCRIPTS_LINK_FOLDER),
+				)))
+				.collect::<JoinSet<_>>();
 
-                let pesde_graph = Arc::into_inner(pesde_graph).unwrap().into_inner().unwrap();
+			while let Some(task) = tasks.join_next().await {
+				task.unwrap()?;
+			}
+		}
 
-                // step 2. link pesde dependencies. do so without types
+		// step 1. download dependencies
-                if write {
+		let downloaded_graph = {
-                    this.link_dependencies(&filter_graph(&pesde_graph, prod), false)
+			let mut download_graph_options = DownloadGraphOptions::<Reporter>::new(reqwest.clone())
-                        .instrument(tracing::debug_span!("link (pesde)"))
+				.refreshed_sources(refreshed_sources.clone())
-                        .await?;
+				.network_concurrency(network_concurrency);
-                }
 
-                let pesde_graph = Arc::new(pesde_graph);
+			if let Some(reporter) = reporter {
+				download_graph_options = download_graph_options.reporter(reporter.clone());
+			}
 
-                pesde_cb(&pesde_graph)
+			let mut downloaded_graph = DependencyGraph::new();
-                    .await
-                    .map_err(errors::DownloadAndLinkError::PesdeCallback)?;
 
-                let pesde_graph = Arc::into_inner(pesde_graph).unwrap();
+			let graph_to_download = if force {
+				graph.clone()
+			} else {
+				let mut tasks = graph
+					.iter()
+					.map(|(id, node)| {
+						let id = id.clone();
+						let node = node.clone();
+						let container_folder =
+							node.container_folder_from_project(&id, self, manifest.target.kind());
 
-                // step 3. download wally dependencies
+						async move {
-                let (mut wally_rx, wally_graph) = this
+							return (id, node, fs::metadata(&container_folder).await.is_ok());
-                    .download_graph(&graph, &mut refreshed_sources, &reqwest, prod, write, true)
+						}
-                    .instrument(tracing::debug_span!("download (wally)"))
+					})
-                    .await?;
+					.collect::<JoinSet<_>>();
 
-                while let Some(result) = wally_rx.recv().await {
+				let mut graph_to_download = DependencyGraph::new();
-                    tx.send(result).await.unwrap();
+				while let Some(task) = tasks.join_next().await {
-                }
+					let (id, node, installed) = task.unwrap();
+					if installed {
+						downloaded_graph.insert(id, node);
+						continue;
+					}
 
-                let wally_graph = Arc::into_inner(wally_graph).unwrap().into_inner().unwrap();
+					graph_to_download.insert(id, node);
+				}
 
-                {
+				Arc::new(graph_to_download)
-                    let mut downloaded_graph = downloaded_graph.lock().unwrap();
+			};
-                    downloaded_graph.extend(pesde_graph);
-                    for (name, versions) in wally_graph {
-                        for (version_id, node) in versions {
-                            downloaded_graph
-                                .entry(name.clone())
-                                .or_default()
-                                .insert(version_id, node);
-                        }
-                    }
-                }
 
-                let graph = Arc::into_inner(downloaded_graph)
+			let downloaded = self
-                    .unwrap()
+				.download_graph(&graph_to_download, download_graph_options.clone())
-                    .into_inner()
+				.instrument(tracing::debug_span!("download"))
-                    .unwrap();
+				.await?;
+			pin!(downloaded);
 
-                // step 4. link ALL dependencies. do so with types
+			let mut tasks = JoinSet::new();
-                if write {
-                    this.link_dependencies(&filter_graph(&graph, prod), true)
-                        .instrument(tracing::debug_span!("link (all)"))
-                        .await?;
-                }
 
-                Ok(graph)
+			while let Some((id, node, fs)) = downloaded.try_next().await? {
-            })
+				let container_folder =
-            .map(|r| r.unwrap()),
+					node.container_folder_from_project(&id, self, manifest.target.kind());
-        ))
+
-    }
+				downloaded_graph.insert(id, node);
+
+				let cas_dir = self.cas_dir().to_path_buf();
+				tasks.spawn(async move {
+					fs::create_dir_all(&container_folder).await?;
+					fs.write_to(container_folder, cas_dir, true).await
+				});
+			}
+
+			while let Some(task) = tasks.join_next().await {
+				task.unwrap()?;
+			}
+
+			downloaded_graph
+		};
+
+		let (downloaded_wally_graph, downloaded_other_graph) = downloaded_graph
+			.into_iter()
+			.partition::<HashMap<_, _>, _>(|(_, node)| node.pkg_ref.is_wally_package());
+
+		let mut graph = Arc::new(DependencyGraphWithTarget::new());
+
+		async fn get_graph_targets<Hooks: DownloadAndLinkHooks>(
+			graph: &mut Arc<DependencyGraphWithTarget>,
+			project: &Project,
+			manifest_target_kind: TargetKind,
+			downloaded_graph: HashMap<PackageId, DependencyGraphNode>,
+		) -> Result<(), errors::DownloadAndLinkError<Hooks::Error>> {
+			let mut tasks = downloaded_graph
+				.into_iter()
+				.map(|(id, node)| {
+					let source = node.pkg_ref.source();
+					let path = Arc::from(
+						node.container_folder_from_project(&id, project, manifest_target_kind)
+							.as_path(),
+					);
+					let id = Arc::new(id.clone());
+					let project = project.clone();
+
+					async move {
+						let target = source
+							.get_target(
+								&node.pkg_ref,
+								&GetTargetOptions {
+									project,
+									path,
+									id: id.clone(),
+								},
+							)
+							.await?;
+
+						Ok::<_, errors::DownloadAndLinkError<Hooks::Error>>((
+							Arc::into_inner(id).unwrap(),
+							DependencyGraphNodeWithTarget { node, target },
+						))
+					}
+				})
+				.collect::<JoinSet<_>>();
+
+			while let Some(task) = tasks.join_next().await {
+				let (id, node) = task.unwrap()?;
+				Arc::get_mut(graph).unwrap().insert(id, node);
+			}
+
+			Ok(())
+		}
+
+		// step 2. get targets for non Wally packages (Wally packages require the scripts packages to be downloaded first)
+		get_graph_targets::<Hooks>(
+			&mut graph,
+			self,
+			manifest.target.kind(),
+			downloaded_other_graph,
+		)
+		.instrument(tracing::debug_span!("get targets (non-wally)"))
+		.await?;
+
+		self.link_dependencies(graph.clone(), false)
+			.instrument(tracing::debug_span!("link (non-wally)"))
+			.await?;
+
+		if let Some(hooks) = &hooks {
+			hooks
+				.on_scripts_downloaded(&graph)
+				.await
+				.map_err(errors::DownloadAndLinkError::Hook)?;
+
+			hooks
+				.on_bins_downloaded(&graph)
+				.await
+				.map_err(errors::DownloadAndLinkError::Hook)?;
+		}
+
+		// step 3. get targets for Wally packages
+		get_graph_targets::<Hooks>(
+			&mut graph,
+			self,
+			manifest.target.kind(),
+			downloaded_wally_graph,
+		)
+		.instrument(tracing::debug_span!("get targets (wally)"))
+		.await?;
+
+		// step 4. link ALL dependencies. do so with types
+		self.link_dependencies(graph.clone(), true)
+			.instrument(tracing::debug_span!("link (all)"))
+			.await?;
+
+		if let Some(hooks) = &hooks {
+			hooks
+				.on_all_downloaded(&graph)
+				.await
+				.map_err(errors::DownloadAndLinkError::Hook)?;
+		}
+
+		let mut graph = Arc::into_inner(graph).unwrap();
+
+		if prod {
+			graph.retain(|_, node| node.node.resolved_ty != DependencyType::Dev);
+		}
+
+		if prod || !force {
+			self.remove_unused(&graph).await?;
+		}
+
+		Ok(graph)
+	}
 }
 
 /// Errors that can occur when downloading and linking dependencies
 pub mod errors {
-    use thiserror::Error;
+	use thiserror::Error;
 
-    /// An error that can occur when downloading and linking dependencies
+	/// An error that can occur when downloading and linking dependencies
-    #[derive(Debug, Error)]
+	#[derive(Debug, Error)]
-    #[non_exhaustive]
+	#[non_exhaustive]
-    pub enum DownloadAndLinkError<E> {
+	pub enum DownloadAndLinkError<E> {
-        /// An error occurred while downloading the graph
+		/// Reading the manifest failed
-        #[error("error downloading graph")]
+		#[error("error reading manifest")]
-        DownloadGraph(#[from] crate::download::errors::DownloadGraphError),
+		ManifestRead(#[from] crate::errors::ManifestReadError),
 
-        /// An error occurred while linking dependencies
+		/// An error occurred while downloading the graph
-        #[error("error linking dependencies")]
+		#[error("error downloading graph")]
-        Linking(#[from] crate::linking::errors::LinkingError),
+		DownloadGraph(#[from] crate::download::errors::DownloadGraphError),
 
-        /// An error occurred while executing the pesde callback
+		/// An error occurred while linking dependencies
-        #[error("error executing pesde callback")]
+		#[error("error linking dependencies")]
-        PesdeCallback(#[source] E),
+		Linking(#[from] crate::linking::errors::LinkingError),
-    }
+
+		/// An error occurred while executing the pesde callback
+		#[error("error executing hook")]
+		Hook(#[source] E),
+
+		/// IO error
+		#[error("io error")]
+		Io(#[from] std::io::Error),
+
+		/// Error getting a target
+		#[error("error getting target")]
+		GetTarget(#[from] crate::source::errors::GetTargetError),
+
+		/// Removing unused dependencies failed
+		#[error("error removing unused dependencies")]
+		RemoveUnused(#[from] crate::linking::incremental::errors::RemoveUnusedError),
+	}
 }

src/engine/mod.rs

@@ -0,0 +1,61 @@
+/// Sources of engines
+pub mod source;
+
+use crate::{engine::source::EngineSources, ser_display_deser_fromstr};
+use std::{fmt::Display, str::FromStr};
+
+/// All supported engines
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord)]
+#[cfg_attr(test, derive(schemars::JsonSchema))]
+#[cfg_attr(test, schemars(rename_all = "snake_case"))]
+pub enum EngineKind {
+	/// The pesde package manager
+	Pesde,
+	/// The Lune runtime
+	Lune,
+}
+ser_display_deser_fromstr!(EngineKind);
+
+impl Display for EngineKind {
+	fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+		match self {
+			EngineKind::Pesde => write!(f, "pesde"),
+			EngineKind::Lune => write!(f, "lune"),
+		}
+	}
+}
+
+impl FromStr for EngineKind {
+	type Err = errors::EngineKindFromStrError;
+
+	fn from_str(s: &str) -> Result<Self, Self::Err> {
+		match s.to_lowercase().as_str() {
+			"pesde" => Ok(EngineKind::Pesde),
+			"lune" => Ok(EngineKind::Lune),
+			_ => Err(errors::EngineKindFromStrError::Unknown(s.to_string())),
+		}
+	}
+}
+
+impl EngineKind {
+	/// Returns the source to get this engine from
+	pub fn source(&self) -> EngineSources {
+		match self {
+			EngineKind::Pesde => EngineSources::pesde(),
+			EngineKind::Lune => EngineSources::lune(),
+		}
+	}
+}
+
+/// Errors related to engine kinds
+pub mod errors {
+	use thiserror::Error;
+
+	/// Errors which can occur while using the FromStr implementation of EngineKind
+	#[derive(Debug, Error)]
+	pub enum EngineKindFromStrError {
+		/// The string isn't a recognized EngineKind
+		#[error("unknown engine kind {0}")]
+		Unknown(String),
+	}
+}

src/engine/source/archive.rs

@@ -0,0 +1,320 @@
+use futures::StreamExt;
+use std::{
+	collections::BTreeSet,
+	mem::ManuallyDrop,
+	path::{Path, PathBuf},
+	pin::Pin,
+	str::FromStr,
+	task::{Context, Poll},
+};
+use tokio::{
+	io::{AsyncBufRead, AsyncRead, AsyncReadExt, ReadBuf},
+	pin,
+};
+use tokio_util::compat::{Compat, FuturesAsyncReadCompatExt};
+
+/// The kind of encoding used for the archive
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum EncodingKind {
+	/// Gzip
+	Gzip,
+}
+
+/// The kind of archive
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum ArchiveKind {
+	/// Tar
+	Tar,
+	/// Zip
+	Zip,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub(crate) struct ArchiveInfo(ArchiveKind, Option<EncodingKind>);
+
+impl FromStr for ArchiveInfo {
+	type Err = errors::ArchiveInfoFromStrError;
+
+	fn from_str(s: &str) -> Result<Self, Self::Err> {
+		let parts = s.split('.').collect::<Vec<_>>();
+
+		Ok(match &*parts {
+			[.., "tar", "gz"] => ArchiveInfo(ArchiveKind::Tar, Some(EncodingKind::Gzip)),
+			[.., "tar"] => ArchiveInfo(ArchiveKind::Tar, None),
+			[.., "zip", "gz"] => {
+				return Err(errors::ArchiveInfoFromStrError::Unsupported(
+					ArchiveKind::Zip,
+					Some(EncodingKind::Gzip),
+				))
+			}
+			[.., "zip"] => ArchiveInfo(ArchiveKind::Zip, None),
+			_ => return Err(errors::ArchiveInfoFromStrError::Invalid(s.to_string())),
+		})
+	}
+}
+
+pub(crate) type ArchiveReader = Pin<Box<dyn AsyncBufRead>>;
+
+/// An archive
+pub struct Archive {
+	pub(crate) info: ArchiveInfo,
+	pub(crate) reader: ArchiveReader,
+}
+
+enum TarReader {
+	Gzip(async_compression::tokio::bufread::GzipDecoder<ArchiveReader>),
+	Plain(ArchiveReader),
+}
+
+// TODO: try to see if we can avoid the unsafe blocks
+
+impl AsyncRead for TarReader {
+	fn poll_read(
+		self: Pin<&mut Self>,
+		cx: &mut Context<'_>,
+		buf: &mut ReadBuf<'_>,
+	) -> Poll<std::io::Result<()>> {
+		unsafe {
+			match self.get_unchecked_mut() {
+				Self::Gzip(r) => Pin::new_unchecked(r).poll_read(cx, buf),
+				Self::Plain(r) => Pin::new_unchecked(r).poll_read(cx, buf),
+			}
+		}
+	}
+}
+
+enum ArchiveEntryInner {
+	Tar(tokio_tar::Entry<tokio_tar::Archive<TarReader>>),
+	Zip {
+		archive: *mut async_zip::tokio::read::seek::ZipFileReader<std::io::Cursor<Vec<u8>>>,
+		reader: ManuallyDrop<
+			Compat<
+				async_zip::tokio::read::ZipEntryReader<
+					'static,
+					std::io::Cursor<Vec<u8>>,
+					async_zip::base::read::WithoutEntry,
+				>,
+			>,
+		>,
+	},
+}
+
+impl Drop for ArchiveEntryInner {
+	fn drop(&mut self) {
+		match self {
+			Self::Tar(_) => {}
+			Self::Zip { archive, reader } => unsafe {
+				ManuallyDrop::drop(reader);
+				drop(Box::from_raw(*archive));
+			},
+		}
+	}
+}
+
+/// An entry in an archive. Usually the executable
+pub struct ArchiveEntry(ArchiveEntryInner);
+
+impl AsyncRead for ArchiveEntry {
+	fn poll_read(
+		self: Pin<&mut Self>,
+		cx: &mut Context<'_>,
+		buf: &mut ReadBuf<'_>,
+	) -> Poll<std::io::Result<()>> {
+		unsafe {
+			match &mut self.get_unchecked_mut().0 {
+				ArchiveEntryInner::Tar(r) => Pin::new_unchecked(r).poll_read(cx, buf),
+				ArchiveEntryInner::Zip { reader, .. } => {
+					Pin::new_unchecked(&mut **reader).poll_read(cx, buf)
+				}
+			}
+		}
+	}
+}
+
+impl Archive {
+	/// Finds the executable in the archive and returns it as an [`ArchiveEntry`]
+	pub async fn find_executable(
+		self,
+		expected_file_name: &str,
+	) -> Result<ArchiveEntry, errors::FindExecutableError> {
+		#[derive(Debug, PartialEq, Eq)]
+		struct Candidate {
+			path: PathBuf,
+			file_name_matches: bool,
+			extension_matches: bool,
+			has_permissions: bool,
+		}
+
+		impl Candidate {
+			fn new(path: PathBuf, perms: u32, expected_file_name: &str) -> Self {
+				Self {
+					file_name_matches: path
+						.file_name()
+						.is_some_and(|name| name == expected_file_name),
+					extension_matches: match path.extension() {
+						Some(ext) if ext == std::env::consts::EXE_EXTENSION => true,
+						None if std::env::consts::EXE_EXTENSION.is_empty() => true,
+						_ => false,
+					},
+					path,
+					has_permissions: perms & 0o111 != 0,
+				}
+			}
+
+			fn should_be_considered(&self) -> bool {
+				// if nothing matches, we should not consider this candidate as it is most likely not
+				self.file_name_matches || self.extension_matches || self.has_permissions
+			}
+		}
+
+		impl Ord for Candidate {
+			fn cmp(&self, other: &Self) -> std::cmp::Ordering {
+				self.file_name_matches
+					.cmp(&other.file_name_matches)
+					.then(self.extension_matches.cmp(&other.extension_matches))
+					.then(self.has_permissions.cmp(&other.has_permissions))
+			}
+		}
+
+		impl PartialOrd for Candidate {
+			fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
+				Some(self.cmp(other))
+			}
+		}
+
+		let mut candidates = BTreeSet::new();
+
+		match self.info {
+			ArchiveInfo(ArchiveKind::Tar, encoding) => {
+				use async_compression::tokio::bufread as decoders;
+
+				let reader = match encoding {
+					Some(EncodingKind::Gzip) => {
+						TarReader::Gzip(decoders::GzipDecoder::new(self.reader))
+					}
+					None => TarReader::Plain(self.reader),
+				};
+
+				let mut archive = tokio_tar::Archive::new(reader);
+				let mut entries = archive.entries()?;
+
+				while let Some(entry) = entries.next().await.transpose()? {
+					if entry.header().entry_type().is_dir() {
+						continue;
+					}
+
+					let candidate = Candidate::new(
+						entry.path()?.to_path_buf(),
+						entry.header().mode()?,
+						expected_file_name,
+					);
+					if candidate.should_be_considered() {
+						candidates.insert(candidate);
+					}
+				}
+
+				let Some(candidate) = candidates.pop_last() else {
+					return Err(errors::FindExecutableError::ExecutableNotFound);
+				};
+
+				let mut entries = archive.entries()?;
+
+				while let Some(entry) = entries.next().await.transpose()? {
+					if entry.header().entry_type().is_dir() {
+						continue;
+					}
+
+					let path = entry.path()?;
+					if path == candidate.path {
+						return Ok(ArchiveEntry(ArchiveEntryInner::Tar(entry)));
+					}
+				}
+			}
+			ArchiveInfo(ArchiveKind::Zip, _) => {
+				let reader = self.reader;
+				pin!(reader);
+
+				// TODO: would be lovely to not have to read the whole archive into memory
+				let mut buf = vec![];
+				reader.read_to_end(&mut buf).await?;
+
+				let archive = async_zip::base::read::seek::ZipFileReader::with_tokio(
+					std::io::Cursor::new(buf),
+				)
+				.await?;
+				for entry in archive.file().entries() {
+					if entry.dir()? {
+						continue;
+					}
+
+					let path: &Path = entry.filename().as_str()?.as_ref();
+					let candidate = Candidate::new(
+						path.to_path_buf(),
+						entry.unix_permissions().unwrap_or(0) as u32,
+						expected_file_name,
+					);
+					if candidate.should_be_considered() {
+						candidates.insert(candidate);
+					}
+				}
+
+				let Some(candidate) = candidates.pop_last() else {
+					return Err(errors::FindExecutableError::ExecutableNotFound);
+				};
+
+				for (i, entry) in archive.file().entries().iter().enumerate() {
+					if entry.dir()? {
+						continue;
+					}
+
+					let path: &Path = entry.filename().as_str()?.as_ref();
+					if candidate.path == path {
+						let ptr = Box::into_raw(Box::new(archive));
+						let reader = (unsafe { &mut *ptr }).reader_without_entry(i).await?;
+						return Ok(ArchiveEntry(ArchiveEntryInner::Zip {
+							archive: ptr,
+							reader: ManuallyDrop::new(reader.compat()),
+						}));
+					}
+				}
+			}
+		}
+
+		Err(errors::FindExecutableError::ExecutableNotFound)
+	}
+}
+
+/// Errors that can occur when working with archives
+pub mod errors {
+	use thiserror::Error;
+
+	/// Errors that can occur when parsing archive info
+	#[derive(Debug, Error)]
+	#[non_exhaustive]
+	pub enum ArchiveInfoFromStrError {
+		/// The string is not a valid archive descriptor. E.g. `{name}.tar.gz`
+		#[error("string `{0}` is not a valid archive descriptor")]
+		Invalid(String),
+
+		/// The archive type is not supported. E.g. `{name}.zip.gz`
+		#[error("archive type {0:?} with encoding {1:?} is not supported")]
+		Unsupported(super::ArchiveKind, Option<super::EncodingKind>),
+	}
+
+	/// Errors that can occur when finding an executable in an archive
+	#[derive(Debug, Error)]
+	#[non_exhaustive]
+	pub enum FindExecutableError {
+		/// The executable was not found in the archive
+		#[error("failed to find executable in archive")]
+		ExecutableNotFound,
+
+		/// An IO error occurred
+		#[error("IO error")]
+		Io(#[from] std::io::Error),
+
+		/// An error occurred reading the zip archive
+		#[error("failed to read zip archive")]
+		Zip(#[from] async_zip::error::ZipError),
+	}
+}

src/engine/source/github/engine_ref.rs

@@ -0,0 +1,19 @@
+use serde::Deserialize;
+
+/// A GitHub release
+#[derive(Debug, Eq, PartialEq, Hash, Clone, Deserialize)]
+pub struct Release {
+	/// The tag name of the release
+	pub tag_name: String,
+	/// The assets of the release
+	pub assets: Vec<Asset>,
+}
+
+/// An asset of a GitHub release
+#[derive(Debug, Eq, PartialEq, Hash, Clone, Deserialize)]
+pub struct Asset {
+	/// The name of the asset
+	pub name: String,
+	/// The download URL of the asset
+	pub url: url::Url,
+}

src/engine/source/github/mod.rs

@@ -0,0 +1,146 @@
+/// The GitHub engine reference
+pub mod engine_ref;
+
+use crate::{
+	engine::source::{
+		archive::Archive,
+		github::engine_ref::Release,
+		traits::{DownloadOptions, EngineSource, ResolveOptions},
+	},
+	reporters::{response_to_async_read, DownloadProgressReporter},
+	util::no_build_metadata,
+	version_matches,
+};
+use reqwest::header::ACCEPT;
+use semver::{Version, VersionReq};
+use std::{collections::BTreeMap, path::PathBuf};
+
+/// The GitHub engine source
+#[derive(Debug, Eq, PartialEq, Hash, Clone)]
+pub struct GitHubEngineSource {
+	/// The owner of the repository to download from
+	pub owner: String,
+	/// The repository of which to download releases from
+	pub repo: String,
+	/// The template for the asset name. `{VERSION}` will be replaced with the version
+	pub asset_template: String,
+}
+
+impl EngineSource for GitHubEngineSource {
+	type Ref = Release;
+	type ResolveError = errors::ResolveError;
+	type DownloadError = errors::DownloadError;
+
+	fn directory(&self) -> PathBuf {
+		PathBuf::from("github").join(&self.owner).join(&self.repo)
+	}
+
+	fn expected_file_name(&self) -> &str {
+		&self.repo
+	}
+
+	async fn resolve(
+		&self,
+		requirement: &VersionReq,
+		options: &ResolveOptions,
+	) -> Result<BTreeMap<Version, Self::Ref>, Self::ResolveError> {
+		let ResolveOptions { reqwest, .. } = options;
+
+		Ok(reqwest
+			.get(format!(
+				"https://api.github.com/repos/{}/{}/releases",
+				urlencoding::encode(&self.owner),
+				urlencoding::encode(&self.repo),
+			))
+			.send()
+			.await?
+			.error_for_status()?
+			.json::<Vec<Release>>()
+			.await?
+			.into_iter()
+			.filter_map(
+				|release| match release.tag_name.trim_start_matches('v').parse() {
+					Ok(version) if version_matches(requirement, &version) => {
+						Some((version, release))
+					}
+					_ => None,
+				},
+			)
+			.collect())
+	}
+
+	async fn download<R: DownloadProgressReporter + 'static>(
+		&self,
+		engine_ref: &Self::Ref,
+		options: &DownloadOptions<R>,
+	) -> Result<Archive, Self::DownloadError> {
+		let DownloadOptions {
+			reqwest,
+			reporter,
+			version,
+			..
+		} = options;
+
+		let desired_asset_names = [
+			self.asset_template
+				.replace("{VERSION}", &version.to_string()),
+			self.asset_template
+				.replace("{VERSION}", &no_build_metadata(version).to_string()),
+		];
+
+		let asset = engine_ref
+			.assets
+			.iter()
+			.find(|asset| {
+				desired_asset_names
+					.iter()
+					.any(|name| asset.name.eq_ignore_ascii_case(name))
+			})
+			.ok_or(errors::DownloadError::AssetNotFound)?;
+
+		reporter.report_start();
+
+		let response = reqwest
+			.get(asset.url.clone())
+			.header(ACCEPT, "application/octet-stream")
+			.send()
+			.await?
+			.error_for_status()?;
+
+		Ok(Archive {
+			info: asset.name.parse()?,
+			reader: Box::pin(response_to_async_read(response, reporter.clone())),
+		})
+	}
+}
+
+/// Errors that can occur when working with the GitHub engine source
+pub mod errors {
+	use thiserror::Error;
+
+	/// Errors that can occur when resolving a GitHub engine
+	#[derive(Debug, Error)]
+	#[non_exhaustive]
+	pub enum ResolveError {
+		/// Handling the request failed
+		#[error("failed to handle GitHub API request")]
+		Request(#[from] reqwest::Error),
+	}
+
+	/// Errors that can occur when downloading a GitHub engine
+	#[derive(Debug, Error)]
+	#[non_exhaustive]
+	pub enum DownloadError {
+		/// An asset for the current platform could not be found
+		#[error("failed to find asset for current platform")]
+		AssetNotFound,
+
+		/// Handling the request failed
+		#[error("failed to handle GitHub API request")]
+		Request(#[from] reqwest::Error),
+
+		/// The asset's name could not be parsed
+		#[error("failed to parse asset name")]
+		ParseAssetName(#[from] crate::engine::source::archive::errors::ArchiveInfoFromStrError),
+	}
+}

src/engine/source/mod.rs

@@ -0,0 +1,143 @@
+use crate::{
+	engine::source::{
+		archive::Archive,
+		traits::{DownloadOptions, EngineSource, ResolveOptions},
+	},
+	reporters::DownloadProgressReporter,
+};
+use semver::{Version, VersionReq};
+use std::{collections::BTreeMap, path::PathBuf};
+
+/// Archives
+pub mod archive;
+/// The GitHub engine source
+pub mod github;
+/// Traits for engine sources
+pub mod traits;
+
+/// Engine references
+#[derive(Debug, Eq, PartialEq, Hash, Clone)]
+pub enum EngineRefs {
+	/// A GitHub engine reference
+	GitHub(github::engine_ref::Release),
+}
+
+/// Engine sources
+#[derive(Debug, Eq, PartialEq, Hash, Clone)]
+pub enum EngineSources {
+	/// A GitHub engine source
+	GitHub(github::GitHubEngineSource),
+}
+
+impl EngineSource for EngineSources {
+	type Ref = EngineRefs;
+	type ResolveError = errors::ResolveError;
+	type DownloadError = errors::DownloadError;
+
+	fn directory(&self) -> PathBuf {
+		match self {
+			EngineSources::GitHub(source) => source.directory(),
+		}
+	}
+
+	fn expected_file_name(&self) -> &str {
+		match self {
+			EngineSources::GitHub(source) => source.expected_file_name(),
+		}
+	}
+
+	async fn resolve(
+		&self,
+		requirement: &VersionReq,
+		options: &ResolveOptions,
+	) -> Result<BTreeMap<Version, Self::Ref>, Self::ResolveError> {
+		match self {
+			EngineSources::GitHub(source) => source
+				.resolve(requirement, options)
+				.await
+				.map(|map| {
+					map.into_iter()
+						.map(|(version, release)| (version, EngineRefs::GitHub(release)))
+						.collect()
+				})
+				.map_err(Into::into),
+		}
+	}
+
+	async fn download<R: DownloadProgressReporter + 'static>(
+		&self,
+		engine_ref: &Self::Ref,
+		options: &DownloadOptions<R>,
+	) -> Result<Archive, Self::DownloadError> {
+		match (self, engine_ref) {
+			(EngineSources::GitHub(source), EngineRefs::GitHub(release)) => {
+				source.download(release, options).await.map_err(Into::into)
+			}
+
+			// for the future
+			#[allow(unreachable_patterns)]
+			_ => Err(errors::DownloadError::Mismatch),
+		}
+	}
+}
+
+impl EngineSources {
+	/// Returns the source for the pesde engine
+	pub fn pesde() -> Self {
+		let mut parts = env!("CARGO_PKG_REPOSITORY").split('/').skip(3);
+		let (owner, repo) = (
+			parts.next().unwrap().to_string(),
+			parts.next().unwrap().to_string(),
+		);
+
+		EngineSources::GitHub(github::GitHubEngineSource {
+			owner,
+			repo,
+			asset_template: format!(
+				"pesde-{{VERSION}}-{}-{}.zip",
+				std::env::consts::OS,
+				std::env::consts::ARCH
+			),
+		})
+	}
+
+	/// Returns the source for the lune engine
+	pub fn lune() -> Self {
+		EngineSources::GitHub(github::GitHubEngineSource {
+			owner: "lune-org".into(),
+			repo: "lune".into(),
+			asset_template: format!(
+				"lune-{{VERSION}}-{}-{}.zip",
+				std::env::consts::OS,
+				std::env::consts::ARCH
+			),
+		})
+	}
+}
+
+/// Errors that can occur when working with engine sources
+pub mod errors {
+	use thiserror::Error;
+
+	/// Errors that can occur when resolving an engine
+	#[derive(Debug, Error)]
+	#[non_exhaustive]
+	pub enum ResolveError {
+		/// Failed to resolve the GitHub engine
+		#[error("failed to resolve github engine")]
+		GitHub(#[from] super::github::errors::ResolveError),
+	}
+
+	/// Errors that can occur when downloading an engine
+	#[derive(Debug, Error)]
+	#[non_exhaustive]
+	pub enum DownloadError {
+		/// Failed to download the GitHub engine
+		#[error("failed to download github engine")]
+		GitHub(#[from] super::github::errors::DownloadError),
+
+		/// Mismatched engine reference
+		#[error("mismatched engine reference")]
+		Mismatch,
+	}
+}

src/engine/source/traits.rs

@@ -0,0 +1,51 @@
+use crate::{engine::source::archive::Archive, reporters::DownloadProgressReporter};
+use semver::{Version, VersionReq};
+use std::{collections::BTreeMap, fmt::Debug, future::Future, path::PathBuf, sync::Arc};
+
+/// Options for resolving an engine
+#[derive(Debug, Clone)]
+pub struct ResolveOptions {
+	/// The reqwest client to use
+	pub reqwest: reqwest::Client,
+}
+
+/// Options for downloading an engine
+#[derive(Debug, Clone)]
+pub struct DownloadOptions<R: DownloadProgressReporter> {
+	/// The reqwest client to use
+	pub reqwest: reqwest::Client,
+	/// The reporter to use
+	pub reporter: Arc<R>,
+	/// The version of the engine to be downloaded
+	pub version: Version,
+}
+
+/// A source of engines
+pub trait EngineSource: Debug {
+	/// The reference type for this source
+	type Ref;
+	/// The error type for resolving an engine from this source
+	type ResolveError: std::error::Error + Send + Sync + 'static;
+	/// The error type for downloading an engine from this source
+	type DownloadError: std::error::Error + Send + Sync + 'static;
+
+	/// Returns the folder to store the engine's versions in
+	fn directory(&self) -> PathBuf;
+
+	/// Returns the expected file name of the engine in the archive
+	fn expected_file_name(&self) -> &str;
+
+	/// Resolves a requirement to a reference
+	fn resolve(
+		&self,
+		requirement: &VersionReq,
+		options: &ResolveOptions,
+	) -> impl Future<Output = Result<BTreeMap<Version, Self::Ref>, Self::ResolveError>> + Send + Sync;
+
+	/// Downloads an engine
+	fn download<R: DownloadProgressReporter + 'static>(
+		&self,
+		engine_ref: &Self::Ref,
+		options: &DownloadOptions<R>,
+	) -> impl Future<Output = Result<Archive, Self::DownloadError>> + Send + Sync;
+}

src/graph.rs

@@ -0,0 +1,110 @@
+use crate::{
+	manifest::{
+		target::{Target, TargetKind},
+		Alias, DependencyType,
+	},
+	source::{
+		ids::{PackageId, VersionId},
+		refs::PackageRefs,
+		specifiers::DependencySpecifiers,
+		traits::PackageRef,
+	},
+	Project, PACKAGES_CONTAINER_NAME,
+};
+use serde::{Deserialize, Serialize};
+use std::{collections::BTreeMap, path::PathBuf};
+
+/// A graph of dependencies
+pub type Graph<Node> = BTreeMap<PackageId, Node>;
+
+/// A dependency graph node
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct DependencyGraphNode {
+	/// The alias, specifier, and original (as in the manifest) type for the dependency, if it is a direct dependency (i.e. used by the current project)
+	#[serde(default, skip_serializing_if = "Option::is_none")]
+	pub direct: Option<(Alias, DependencySpecifiers, DependencyType)>,
+	/// The dependencies of the package
+	#[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+	pub dependencies: BTreeMap<PackageId, Alias>,
+	/// The resolved (transformed, for example Peer -> Standard) type of the dependency
+	pub resolved_ty: DependencyType,
+	/// Whether the resolved type should be Peer if this isn't depended on
+	#[serde(default, skip_serializing_if = "std::ops::Not::not")]
+	pub is_peer: bool,
+	/// The package reference
+	pub pkg_ref: PackageRefs,
+}
+
+impl DependencyGraphNode {
+	pub(crate) fn dependencies_dir(
+		&self,
+		version_id: &VersionId,
+		project_target: TargetKind,
+	) -> String {
+		if self.pkg_ref.use_new_structure() {
+			version_id.target().packages_folder(project_target)
+		} else {
+			"..".to_string()
+		}
+	}
+
+	/// Returns the folder to store the contents of the package in
+	pub fn container_folder(&self, package_id: &PackageId) -> PathBuf {
+		let (name, v_id) = package_id.parts();
+
+		if self.pkg_ref.is_wally_package() {
+			return PathBuf::from(format!(
+				"{}_{}@{}",
+				name.scope(),
+				name.name(),
+				v_id.version()
+			))
+			.join(name.name());
+		}
+
+		PathBuf::from(name.escaped())
+			.join(v_id.version().to_string())
+			.join(name.name())
+	}
+
+	/// Returns the folder to store the contents of the package in starting from the project's package directory
+	pub fn container_folder_from_project(
+		&self,
+		package_id: &PackageId,
+		project: &Project,
+		manifest_target_kind: TargetKind,
+	) -> PathBuf {
+		project
+			.package_dir()
+			.join(manifest_target_kind.packages_folder(package_id.version_id().target()))
+			.join(PACKAGES_CONTAINER_NAME)
+			.join(self.container_folder(package_id))
+	}
+}
+
+/// A graph of `DependencyGraphNode`s
+pub type DependencyGraph = Graph<DependencyGraphNode>;
+
+/// A dependency graph node with a `Target`
+#[derive(Debug, Clone)]
+pub struct DependencyGraphNodeWithTarget {
+	/// The target of the package
+	pub target: Target,
+	/// The node
+	pub node: DependencyGraphNode,
+}
+
+/// A graph of `DownloadedDependencyGraphNode`s
+pub type DependencyGraphWithTarget = Graph<DependencyGraphNodeWithTarget>;
+
+/// A trait for converting a graph to a different type of graph
+pub trait ConvertableGraph<Node> {
+	/// Converts the graph to a different type of graph
+	fn convert(self) -> Graph<Node>;
+}
+
+impl ConvertableGraph<DependencyGraphNode> for DependencyGraphWithTarget {
+	fn convert(self) -> Graph<DependencyGraphNode> {
+		self.into_iter().map(|(id, node)| (id, node.node)).collect()
+	}
+}

src/lib.rs

@@ -1,21 +1,27 @@
-#![deny(missing_docs)]
+#![warn(missing_docs, clippy::redundant_closure_for_method_calls)]
 //! A package manager for the Luau programming language, supporting multiple runtimes including Roblox and Lune.
 //! pesde has its own registry, however it can also use Wally, and Git repositories as package sources.
 //! It has been designed with multiple targets in mind, namely Roblox, Lune, and Luau.
 
 use crate::{
-    lockfile::Lockfile,
+	lockfile::Lockfile,
-    manifest::Manifest,
+	manifest::{target::TargetKind, Manifest},
-    source::{traits::PackageSource, PackageSources},
+	source::{
+		traits::{PackageSource, RefreshOptions},
+		PackageSources,
+	},
 };
-use async_stream::stream;
+use async_stream::try_stream;
 use fs_err::tokio as fs;
-use futures::{future::try_join_all, Stream};
+use futures::Stream;
 use gix::sec::identity::Account;
+use semver::{Version, VersionReq};
 use std::{
-    collections::{HashMap, HashSet},
+	collections::{HashMap, HashSet},
-    fmt::Debug,
+	fmt::Debug,
-    path::{Path, PathBuf},
+	hash::{Hash, Hasher},
+	path::{Path, PathBuf},
+	sync::Arc,
 };
 use tracing::instrument;
 use wax::Pattern;
@@ -24,6 +30,10 @@ use wax::Pattern;
 pub mod download;
 /// Utility for downloading and linking in the correct order
 pub mod download_and_link;
+/// Handling of engines
+pub mod engine;
+/// Graphs
+pub mod graph;
 /// Linking packages
 pub mod linking;
 /// Lockfile
@@ -35,6 +45,7 @@ pub mod names;
 /// Patching packages
 #[cfg(feature = "patches")]
 pub mod patches;
+pub mod reporters;
 /// Resolving packages
 pub mod resolver;
 /// Running scripts
@@ -55,415 +66,468 @@ pub(crate) const LINK_LIB_NO_FILE_FOUND: &str = "____pesde_no_export_file_found"
 /// The folder in which scripts are linked
 pub const SCRIPTS_LINK_FOLDER: &str = ".pesde";
 
+#[derive(Debug, Default)]
+struct AuthConfigShared {
+	tokens: HashMap<gix::Url, String>,
+	git_credentials: Option<Account>,
+}
+
 /// Struct containing the authentication configuration
-#[derive(Debug, Default, Clone)]
+#[derive(Debug, Clone, Default)]
 pub struct AuthConfig {
-    tokens: HashMap<gix::Url, String>,
+	shared: Arc<AuthConfigShared>,
-    git_credentials: Option<Account>,
 }
 
 impl AuthConfig {
-    /// Create a new `AuthConfig`
+	/// Create a new `AuthConfig`
-    pub fn new() -> Self {
+	pub fn new() -> Self {
-        AuthConfig::default()
+		AuthConfig::default()
-    }
+	}
 
-    /// Set the tokens
+	/// Set the tokens
-    pub fn with_tokens<I: IntoIterator<Item = (gix::Url, S)>, S: AsRef<str>>(
+	/// Panics if the `AuthConfig` is shared
-        mut self,
+	pub fn with_tokens<I: IntoIterator<Item = (gix::Url, S)>, S: AsRef<str>>(
-        tokens: I,
+		mut self,
-    ) -> Self {
+		tokens: I,
-        self.tokens = tokens
+	) -> Self {
-            .into_iter()
+		Arc::get_mut(&mut self.shared).unwrap().tokens = tokens
-            .map(|(url, s)| (url, s.as_ref().to_string()))
+			.into_iter()
-            .collect();
+			.map(|(url, s)| (url, s.as_ref().to_string()))
-        self
+			.collect();
-    }
+		self
+	}
 
-    /// Set the git credentials
+	/// Set the git credentials
-    pub fn with_git_credentials(mut self, git_credentials: Option<Account>) -> Self {
+	/// Panics if the `AuthConfig` is shared
-        self.git_credentials = git_credentials;
+	pub fn with_git_credentials(mut self, git_credentials: Option<Account>) -> Self {
-        self
+		Arc::get_mut(&mut self.shared).unwrap().git_credentials = git_credentials;
-    }
+		self
+	}
 
-    /// Get the tokens
+	/// Get the tokens
-    pub fn tokens(&self) -> &HashMap<gix::Url, String> {
+	pub fn tokens(&self) -> &HashMap<gix::Url, String> {
-        &self.tokens
+		&self.shared.tokens
-    }
+	}
 
-    /// Get the git credentials
+	/// Get the git credentials
-    pub fn git_credentials(&self) -> Option<&Account> {
+	pub fn git_credentials(&self) -> Option<&Account> {
-        self.git_credentials.as_ref()
+		self.shared.git_credentials.as_ref()
-    }
+	}
+}
+
+#[derive(Debug)]
+struct ProjectShared {
+	package_dir: PathBuf,
+	workspace_dir: Option<PathBuf>,
+	data_dir: PathBuf,
+	cas_dir: PathBuf,
+	auth_config: AuthConfig,
 }
 
 /// The main struct of the pesde library, representing a project
+/// Unlike `ProjectShared`, this struct is `Send` and `Sync` and is cheap to clone because it is `Arc`-backed
 #[derive(Debug, Clone)]
 pub struct Project {
-    package_dir: PathBuf,
+	shared: Arc<ProjectShared>,
-    workspace_dir: Option<PathBuf>,
-    data_dir: PathBuf,
-    auth_config: AuthConfig,
-    cas_dir: PathBuf,
 }
 
 impl Project {
-    /// Create a new `Project`
+	/// Create a new `Project`
-    pub fn new<P: AsRef<Path>, Q: AsRef<Path>, R: AsRef<Path>, S: AsRef<Path>>(
+	pub fn new(
-        package_dir: P,
+		package_dir: impl AsRef<Path>,
-        workspace_dir: Option<Q>,
+		workspace_dir: Option<impl AsRef<Path>>,
-        data_dir: R,
+		data_dir: impl AsRef<Path>,
-        cas_dir: S,
+		cas_dir: impl AsRef<Path>,
-        auth_config: AuthConfig,
+		auth_config: AuthConfig,
-    ) -> Self {
+	) -> Self {
-        Project {
+		Project {
-            package_dir: package_dir.as_ref().to_path_buf(),
+			shared: Arc::new(ProjectShared {
-            workspace_dir: workspace_dir.map(|d| d.as_ref().to_path_buf()),
+				package_dir: package_dir.as_ref().to_path_buf(),
-            data_dir: data_dir.as_ref().to_path_buf(),
+				workspace_dir: workspace_dir.map(|d| d.as_ref().to_path_buf()),
-            auth_config,
+				data_dir: data_dir.as_ref().to_path_buf(),
-            cas_dir: cas_dir.as_ref().to_path_buf(),
+				cas_dir: cas_dir.as_ref().to_path_buf(),
-        }
+				auth_config,
-    }
+			}),
+		}
+	}
 
-    /// The directory of the package
+	/// The directory of the package
-    pub fn package_dir(&self) -> &Path {
+	pub fn package_dir(&self) -> &Path {
-        &self.package_dir
+		&self.shared.package_dir
-    }
+	}
 
-    /// The directory of the workspace this package belongs to, if any
+	/// The directory of the workspace this package belongs to, if any
-    pub fn workspace_dir(&self) -> Option<&Path> {
+	pub fn workspace_dir(&self) -> Option<&Path> {
-        self.workspace_dir.as_deref()
+		self.shared.workspace_dir.as_deref()
-    }
+	}
 
-    /// The directory to store general-purpose data
+	/// The directory to store general-purpose data
-    pub fn data_dir(&self) -> &Path {
+	pub fn data_dir(&self) -> &Path {
-        &self.data_dir
+		&self.shared.data_dir
-    }
+	}
 
-    /// The authentication configuration
+	/// The CAS (content-addressable storage) directory
-    pub fn auth_config(&self) -> &AuthConfig {
+	pub fn cas_dir(&self) -> &Path {
-        &self.auth_config
+		&self.shared.cas_dir
-    }
+	}
 
-    /// The CAS (content-addressable storage) directory
+	/// The authentication configuration
-    pub fn cas_dir(&self) -> &Path {
+	pub fn auth_config(&self) -> &AuthConfig {
-        &self.cas_dir
+		&self.shared.auth_config
-    }
+	}
 
-    /// Read the manifest file
+	/// Read the manifest file
-    #[instrument(skip(self), ret(level = "trace"), level = "debug")]
+	#[instrument(skip(self), ret(level = "trace"), level = "debug")]
-    pub async fn read_manifest(&self) -> Result<String, errors::ManifestReadError> {
+	pub async fn read_manifest(&self) -> Result<String, errors::ManifestReadError> {
-        let string = fs::read_to_string(self.package_dir.join(MANIFEST_FILE_NAME)).await?;
+		let string = fs::read_to_string(self.package_dir().join(MANIFEST_FILE_NAME)).await?;
-        Ok(string)
+		Ok(string)
-    }
+	}
 
-    // TODO: cache the manifest
+	// TODO: cache the manifest
-    /// Deserialize the manifest file
+	/// Deserialize the manifest file
-    #[instrument(skip(self), ret(level = "trace"), level = "debug")]
+	#[instrument(skip(self), ret(level = "trace"), level = "debug")]
-    pub async fn deser_manifest(&self) -> Result<Manifest, errors::ManifestReadError> {
+	pub async fn deser_manifest(&self) -> Result<Manifest, errors::ManifestReadError> {
-        let string = fs::read_to_string(self.package_dir.join(MANIFEST_FILE_NAME)).await?;
+		deser_manifest(self.package_dir()).await
-        Ok(toml::from_str(&string)?)
+	}
-    }
 
-    /// Write the manifest file
+	/// Deserialize the manifest file of the workspace root
-    #[instrument(skip(self, manifest), level = "debug")]
+	#[instrument(skip(self), ret(level = "trace"), level = "debug")]
-    pub async fn write_manifest<S: AsRef<[u8]>>(&self, manifest: S) -> Result<(), std::io::Error> {
+	pub async fn deser_workspace_manifest(
-        fs::write(self.package_dir.join(MANIFEST_FILE_NAME), manifest.as_ref()).await
+		&self,
-    }
+	) -> Result<Option<Manifest>, errors::ManifestReadError> {
+		let Some(workspace_dir) = self.workspace_dir() else {
+			return Ok(None);
+		};
 
-    /// Deserialize the lockfile
+		deser_manifest(workspace_dir).await.map(Some)
-    #[instrument(skip(self), ret(level = "trace"), level = "debug")]
+	}
-    pub async fn deser_lockfile(&self) -> Result<Lockfile, errors::LockfileReadError> {
-        let string = fs::read_to_string(self.package_dir.join(LOCKFILE_FILE_NAME)).await?;
-        Ok(toml::from_str(&string)?)
-    }
 
-    /// Write the lockfile
+	/// Write the manifest file
-    #[instrument(skip(self, lockfile), level = "debug")]
+	#[instrument(skip(self, manifest), level = "debug")]
-    pub async fn write_lockfile(
+	pub async fn write_manifest<S: AsRef<[u8]>>(&self, manifest: S) -> Result<(), std::io::Error> {
-        &self,
+		fs::write(
-        lockfile: Lockfile,
+			self.package_dir().join(MANIFEST_FILE_NAME),
-    ) -> Result<(), errors::LockfileWriteError> {
+			manifest.as_ref(),
-        let string = toml::to_string(&lockfile)?;
+		)
-        fs::write(self.package_dir.join(LOCKFILE_FILE_NAME), string).await?;
+		.await
-        Ok(())
+	}
-    }
 
-    /// Get the workspace members
+	/// Deserialize the lockfile
-    #[instrument(skip(self), level = "debug")]
+	#[instrument(skip(self), ret(level = "trace"), level = "debug")]
-    pub async fn workspace_members<P: AsRef<Path> + Debug>(
+	pub async fn deser_lockfile(&self) -> Result<Lockfile, errors::LockfileReadError> {
-        &self,
+		let string = fs::read_to_string(self.package_dir().join(LOCKFILE_FILE_NAME)).await?;
-        dir: P,
+		Ok(match toml::from_str(&string) {
-        can_ref_self: bool,
+			Ok(lockfile) => lockfile,
-    ) -> Result<
+			Err(e) => {
-        impl Stream<Item = Result<(PathBuf, Manifest), errors::WorkspaceMembersError>>,
+				#[allow(deprecated)]
-        errors::WorkspaceMembersError,
+				let Ok(old_lockfile) = toml::from_str::<lockfile::old::LockfileOld>(&string) else {
-    > {
+					return Err(errors::LockfileReadError::Serde(e));
-        let dir = dir.as_ref().to_path_buf();
+				};
-        let manifest = fs::read_to_string(dir.join(MANIFEST_FILE_NAME))
-            .await
-            .map_err(errors::WorkspaceMembersError::ManifestMissing)?;
-        let manifest = toml::from_str::<Manifest>(&manifest).map_err(|e| {
-            errors::WorkspaceMembersError::ManifestDeser(dir.to_path_buf(), Box::new(e))
-        })?;
 
-        let members = matching_globs(
+				#[allow(deprecated)]
-            dir,
+				old_lockfile.to_new()
-            manifest.workspace_members.iter().map(|s| s.as_str()),
+			}
-            false,
+		})
-            can_ref_self,
+	}
-        )
-        .await?;
 
-        Ok(stream! {
+	/// Write the lockfile
-            for path in members {
+	#[instrument(skip(self, lockfile), level = "debug")]
-                let manifest = fs::read_to_string(path.join(MANIFEST_FILE_NAME))
+	pub async fn write_lockfile(
-                    .await
+		&self,
-                    .map_err(errors::WorkspaceMembersError::ManifestMissing)?;
+		lockfile: &Lockfile,
-                let manifest = toml::from_str::<Manifest>(&manifest).map_err(|e| {
+	) -> Result<(), errors::LockfileWriteError> {
-                    errors::WorkspaceMembersError::ManifestDeser(path.clone(), Box::new(e))
+		let string = toml::to_string(lockfile)?;
-                })?;
+		fs::write(self.package_dir().join(LOCKFILE_FILE_NAME), string).await?;
+		Ok(())
+	}
 
-                yield Ok((path, manifest));
+	/// Get the workspace members
-            }
+	#[instrument(skip(self), level = "debug")]
-        })
+	pub async fn workspace_members(
-    }
+		&self,
-}
+		can_ref_self: bool,
+	) -> Result<
+		impl Stream<Item = Result<(PathBuf, Manifest), errors::WorkspaceMembersError>>,
+		errors::WorkspaceMembersError,
+	> {
+		let dir = self.workspace_dir().unwrap_or(self.package_dir());
+		let manifest = deser_manifest(dir).await?;
 
-/// Gets all matching paths in a directory
+		let members = matching_globs(
-#[deprecated(
+			dir,
-    since = "0.5.0-rc.13",
+			manifest.workspace_members.iter().map(String::as_str),
-    note = "use `matching_globs` instead, which does not have the old behaviour of including whole directories by their name (`src` instead of `src/**`)"
+			false,
-)]
+			can_ref_self,
-#[instrument(ret, level = "trace")]
+		)
-pub async fn matching_globs_old_behaviour<
+		.await?;
-    'a,
-    P: AsRef<Path> + Debug,
-    I: IntoIterator<Item = &'a str> + Debug,
->(
-    dir: P,
-    globs: I,
-    relative: bool,
-) -> Result<HashSet<PathBuf>, errors::MatchingGlobsError> {
-    let (negative_globs, positive_globs) = globs
-        .into_iter()
-        .partition::<Vec<_>, _>(|glob| glob.starts_with('!'));
 
-    let negative_globs = wax::any(
+		Ok(try_stream! {
-        negative_globs
+			for path in members {
-            .into_iter()
+				let manifest = deser_manifest(&path).await?;
-            .map(|glob| wax::Glob::new(&glob[1..]))
+				yield (path, manifest);
-            .collect::<Result<Vec<_>, _>>()?,
+			}
-    )?;
+		})
-
+	}
-    let (positive_globs, file_names) = positive_globs
-        .into_iter()
-        // only globs we can be sure of (maintaining compatibility with old "only file/dir name" system)
-        .partition::<Vec<_>, _>(|glob| glob.contains('/'));
-    let file_names = file_names.into_iter().collect::<HashSet<_>>();
-
-    let positive_globs = wax::any(
-        positive_globs
-            .into_iter()
-            .map(wax::Glob::new)
-            .collect::<Result<Vec<_>, _>>()?,
-    )?;
-
-    let mut read_dirs = vec![(fs::read_dir(dir.as_ref().to_path_buf()).await?, false)];
-    let mut paths = HashSet::new();
-
-    let mut is_root = true;
-
-    while let Some((mut read_dir, is_entire_dir_included)) = read_dirs.pop() {
-        while let Some(entry) = read_dir.next_entry().await? {
-            let path = entry.path();
-            let relative_path = path.strip_prefix(dir.as_ref()).unwrap();
-            let file_name = path.file_name().unwrap();
-            let is_filename_match =
-                is_root && file_name.to_str().is_some_and(|s| file_names.contains(s));
-
-            if entry.file_type().await?.is_dir() {
-                read_dirs.push((
-                    fs::read_dir(&path).await?,
-                    is_entire_dir_included || is_filename_match,
-                ));
-                if is_filename_match {
-                    tracing::warn!("directory name usage found for {}. this is deprecated and will be removed in the future", path.display());
-                }
-            }
-
-            if (is_entire_dir_included || is_filename_match)
-                || (positive_globs.is_match(relative_path)
-                    && !negative_globs.is_match(relative_path))
-            {
-                paths.insert(if relative {
-                    relative_path.to_path_buf()
-                } else {
-                    path.to_path_buf()
-                });
-            }
-        }
-
-        is_root = false;
-    }
-
-    Ok(paths)
 }
 
 /// Gets all matching paths in a directory
 #[instrument(ret, level = "trace")]
 pub async fn matching_globs<'a, P: AsRef<Path> + Debug, I: IntoIterator<Item = &'a str> + Debug>(
-    dir: P,
+	dir: P,
-    globs: I,
+	globs: I,
-    relative: bool,
+	relative: bool,
-    can_ref_self: bool,
+	can_ref_self: bool,
 ) -> Result<HashSet<PathBuf>, errors::MatchingGlobsError> {
-    let (negative_globs, mut positive_globs): (HashSet<&str>, _) =
+	let (negative_globs, mut positive_globs): (HashSet<&str>, _) =
-        globs.into_iter().partition(|glob| glob.starts_with('!'));
+		globs.into_iter().partition(|glob| glob.starts_with('!'));
 
-    let include_self = positive_globs.remove(".") && can_ref_self;
+	let include_self = positive_globs.remove(".") && can_ref_self;
 
-    let negative_globs = wax::any(
+	let negative_globs = wax::any(
-        negative_globs
+		negative_globs
-            .into_iter()
+			.into_iter()
-            .map(|glob| wax::Glob::new(&glob[1..]))
+			.map(|glob| wax::Glob::new(&glob[1..]))
-            .collect::<Result<Vec<_>, _>>()?,
+			.collect::<Result<Vec<_>, _>>()?,
-    )?;
+	)?;
-    let positive_globs = wax::any(
+	let positive_globs = wax::any(
-        positive_globs
+		positive_globs
-            .into_iter()
+			.into_iter()
-            .map(wax::Glob::new)
+			.map(wax::Glob::new)
-            .collect::<Result<Vec<_>, _>>()?,
+			.collect::<Result<Vec<_>, _>>()?,
-    )?;
+	)?;
 
-    let mut read_dirs = vec![fs::read_dir(dir.as_ref().to_path_buf()).await?];
+	let mut read_dirs = vec![fs::read_dir(dir.as_ref().to_path_buf()).await?];
-    let mut paths = HashSet::new();
+	let mut paths = HashSet::new();
 
-    if include_self {
+	if include_self {
-        paths.insert(if relative {
+		paths.insert(if relative {
-            PathBuf::new()
+			PathBuf::new()
-        } else {
+		} else {
-            dir.as_ref().to_path_buf()
+			dir.as_ref().to_path_buf()
-        });
+		});
-    }
+	}
 
-    while let Some(mut read_dir) = read_dirs.pop() {
+	while let Some(mut read_dir) = read_dirs.pop() {
-        while let Some(entry) = read_dir.next_entry().await? {
+		while let Some(entry) = read_dir.next_entry().await? {
-            let path = entry.path();
+			let path = entry.path();
-            if entry.file_type().await?.is_dir() {
+			if entry.file_type().await?.is_dir() {
-                read_dirs.push(fs::read_dir(&path).await?);
+				read_dirs.push(fs::read_dir(&path).await?);
-            }
+			}
 
-            let relative_path = path.strip_prefix(dir.as_ref()).unwrap();
+			let relative_path = path.strip_prefix(dir.as_ref()).unwrap();
 
-            if positive_globs.is_match(relative_path) && !negative_globs.is_match(relative_path) {
+			if positive_globs.is_match(relative_path) && !negative_globs.is_match(relative_path) {
-                paths.insert(if relative {
+				paths.insert(if relative {
-                    relative_path.to_path_buf()
+					relative_path.to_path_buf()
-                } else {
+				} else {
-                    path.to_path_buf()
+					path.to_path_buf()
-                });
+				});
-            }
+			}
-        }
+		}
-    }
+	}
 
-    Ok(paths)
+	Ok(paths)
 }
 
-/// Refreshes the sources asynchronously
+/// A struct containing sources already having been refreshed
-pub async fn refresh_sources<I: Iterator<Item = PackageSources>>(
+#[derive(Debug, Clone, Default)]
-    project: &Project,
+pub struct RefreshedSources(Arc<tokio::sync::Mutex<HashSet<u64>>>);
-    sources: I,
+
-    refreshed_sources: &mut HashSet<PackageSources>,
+impl RefreshedSources {
-) -> Result<(), Box<source::errors::RefreshError>> {
+	/// Create a new empty `RefreshedSources`
-    try_join_all(sources.map(|source| {
+	pub fn new() -> Self {
-        let needs_refresh = refreshed_sources.insert(source.clone());
+		RefreshedSources::default()
-        async move {
+	}
-            if needs_refresh {
+
-                source.refresh(project).await.map_err(Box::new)
+	/// Refreshes the source asynchronously if it has not already been refreshed.
-            } else {
+	/// Will prevent more refreshes of the same source.
-                Ok(())
+	pub async fn refresh(
-            }
+		&self,
-        }
+		source: &PackageSources,
-    }))
+		options: &RefreshOptions,
-    .await
+	) -> Result<(), source::errors::RefreshError> {
-    .map(|_| ())
+		let mut hasher = std::hash::DefaultHasher::new();
+		source.hash(&mut hasher);
+		let hash = hasher.finish();
+
+		let mut refreshed_sources = self.0.lock().await;
+
+		if refreshed_sources.insert(hash) {
+			source.refresh(options).await
+		} else {
+			Ok(())
+		}
+	}
+}
+
+async fn deser_manifest(path: &Path) -> Result<Manifest, errors::ManifestReadError> {
+	let string = fs::read_to_string(path.join(MANIFEST_FILE_NAME)).await?;
+	toml::from_str(&string).map_err(|e| errors::ManifestReadError::Serde(path.to_path_buf(), e))
+}
+
+/// Find the project & workspace directory roots
+pub async fn find_roots(
+	cwd: PathBuf,
+) -> Result<(PathBuf, Option<PathBuf>), errors::FindRootsError> {
+	let mut current_path = Some(cwd.clone());
+	let mut project_root = None::<PathBuf>;
+	let mut workspace_dir = None::<PathBuf>;
+
+	async fn get_workspace_members(
+		path: &Path,
+	) -> Result<HashSet<PathBuf>, errors::FindRootsError> {
+		let manifest = deser_manifest(path).await?;
+
+		if manifest.workspace_members.is_empty() {
+			return Ok(HashSet::new());
+		}
+
+		matching_globs(
+			path,
+			manifest.workspace_members.iter().map(String::as_str),
+			false,
+			false,
+		)
+		.await
+		.map_err(errors::FindRootsError::Globbing)
+	}
+
+	while let Some(path) = current_path {
+		current_path = path.parent().map(Path::to_path_buf);
+
+		if !path.join(MANIFEST_FILE_NAME).exists() {
+			continue;
+		}
+
+		match (project_root.as_ref(), workspace_dir.as_ref()) {
+			(Some(project_root), Some(workspace_dir)) => {
+				return Ok((project_root.clone(), Some(workspace_dir.clone())));
+			}
+
+			(Some(project_root), None) => {
+				if get_workspace_members(&path).await?.contains(project_root) {
+					workspace_dir = Some(path);
+				}
+			}
+
+			(None, None) => {
+				if get_workspace_members(&path).await?.contains(&cwd) {
+					// initializing a new member of a workspace
+					return Ok((cwd, Some(path)));
+				} else {
+					project_root = Some(path);
+				}
+			}
+
+			(None, Some(_)) => unreachable!(),
+		}
+	}
+
+	// we mustn't expect the project root to be found, as that would
+	// disable the ability to run pesde in a non-project directory (for example to init it)
+	Ok((project_root.unwrap_or(cwd), workspace_dir))
+}
+
+/// Returns whether a version matches a version requirement
+/// Differs from `VersionReq::matches` in that EVERY version matches `*`
+pub fn version_matches(req: &VersionReq, version: &Version) -> bool {
+	*req == VersionReq::STAR || req.matches(version)
+}
+
+pub(crate) fn all_packages_dirs() -> HashSet<String> {
+	let mut dirs = HashSet::new();
+	for target_kind_a in TargetKind::VARIANTS {
+		for target_kind_b in TargetKind::VARIANTS {
+			dirs.insert(target_kind_a.packages_folder(*target_kind_b));
+		}
+	}
+	dirs
 }
 
 /// Errors that can occur when using the pesde library
 pub mod errors {
-    use std::path::PathBuf;
+	use std::path::PathBuf;
-    use thiserror::Error;
+	use thiserror::Error;
 
-    /// Errors that can occur when reading the manifest file
+	/// Errors that can occur when reading the manifest file
-    #[derive(Debug, Error)]
+	#[derive(Debug, Error)]
-    #[non_exhaustive]
+	#[non_exhaustive]
-    pub enum ManifestReadError {
+	pub enum ManifestReadError {
-        /// An IO error occurred
+		/// An IO error occurred
-        #[error("io error reading manifest file")]
+		#[error("io error reading manifest file")]
-        Io(#[from] std::io::Error),
+		Io(#[from] std::io::Error),
 
-        /// An error occurred while deserializing the manifest file
+		/// An error occurred while deserializing the manifest file
-        #[error("error deserializing manifest file")]
+		#[error("error deserializing manifest file at {0}")]
-        Serde(#[from] toml::de::Error),
+		Serde(PathBuf, #[source] toml::de::Error),
-    }
+	}
 
-    /// Errors that can occur when reading the lockfile
+	/// Errors that can occur when reading the lockfile
-    #[derive(Debug, Error)]
+	#[derive(Debug, Error)]
-    #[non_exhaustive]
+	#[non_exhaustive]
-    pub enum LockfileReadError {
+	pub enum LockfileReadError {
-        /// An IO error occurred
+		/// An IO error occurred
-        #[error("io error reading lockfile")]
+		#[error("io error reading lockfile")]
-        Io(#[from] std::io::Error),
+		Io(#[from] std::io::Error),
 
-        /// An error occurred while deserializing the lockfile
+		/// An error occurred while deserializing the lockfile
-        #[error("error deserializing lockfile")]
+		#[error("error deserializing lockfile")]
-        Serde(#[from] toml::de::Error),
+		Serde(#[from] toml::de::Error),
-    }
+	}
 
-    /// Errors that can occur when writing the lockfile
+	/// Errors that can occur when writing the lockfile
-    #[derive(Debug, Error)]
+	#[derive(Debug, Error)]
-    #[non_exhaustive]
+	#[non_exhaustive]
-    pub enum LockfileWriteError {
+	pub enum LockfileWriteError {
-        /// An IO error occurred
+		/// An IO error occurred
-        #[error("io error writing lockfile")]
+		#[error("io error writing lockfile")]
-        Io(#[from] std::io::Error),
+		Io(#[from] std::io::Error),
 
-        /// An error occurred while serializing the lockfile
+		/// An error occurred while serializing the lockfile
-        #[error("error serializing lockfile")]
+		#[error("error serializing lockfile")]
-        Serde(#[from] toml::ser::Error),
+		Serde(#[from] toml::ser::Error),
-    }
+	}
 
-    /// Errors that can occur when finding workspace members
+	/// Errors that can occur when finding workspace members
-    #[derive(Debug, Error)]
+	#[derive(Debug, Error)]
-    #[non_exhaustive]
+	#[non_exhaustive]
-    pub enum WorkspaceMembersError {
+	pub enum WorkspaceMembersError {
-        /// The manifest file could not be found
+		/// An error occurred parsing the manifest file
-        #[error("missing manifest file")]
+		#[error("error parsing manifest file")]
-        ManifestMissing(#[source] std::io::Error),
+		ManifestParse(#[from] ManifestReadError),
 
-        /// An error occurred deserializing the manifest file
+		/// An error occurred interacting with the filesystem
-        #[error("error deserializing manifest file at {0}")]
+		#[error("error interacting with the filesystem")]
-        ManifestDeser(PathBuf, #[source] Box<toml::de::Error>),
+		Io(#[from] std::io::Error),
 
-        /// An error occurred interacting with the filesystem
+		/// An error occurred while globbing
-        #[error("error interacting with the filesystem")]
+		#[error("error globbing")]
-        Io(#[from] std::io::Error),
+		Globbing(#[from] MatchingGlobsError),
+	}
 
-        /// An error occurred while globbing
+	/// Errors that can occur when finding matching globs
-        #[error("error globbing")]
+	#[derive(Debug, Error)]
-        Globbing(#[from] MatchingGlobsError),
+	#[non_exhaustive]
-    }
+	pub enum MatchingGlobsError {
+		/// An error occurred interacting with the filesystem
+		#[error("error interacting with the filesystem")]
+		Io(#[from] std::io::Error),
 
-    /// Errors that can occur when finding matching globs
+		/// An error occurred while building a glob
-    #[derive(Debug, Error)]
+		#[error("error building glob")]
-    #[non_exhaustive]
+		BuildGlob(#[from] wax::BuildError),
-    pub enum MatchingGlobsError {
+	}
-        /// An error occurred interacting with the filesystem
-        #[error("error interacting with the filesystem")]
-        Io(#[from] std::io::Error),
 
-        /// An error occurred while building a glob
+	/// Errors that can occur when finding project roots
-        #[error("error building glob")]
+	#[derive(Debug, Error)]
-        BuildGlob(#[from] wax::BuildError),
+	#[non_exhaustive]
-    }
+	pub enum FindRootsError {
+		/// Reading the manifest failed
+		#[error("error reading manifest")]
+		ManifestRead(#[from] ManifestReadError),
+
+		/// Globbing failed
+		#[error("error globbing")]
+		Globbing(#[from] MatchingGlobsError),
+	}
 }

src/linking/generator.rs

@@ -2,230 +2,247 @@ use std::path::{Component, Path};
 
 use crate::manifest::{target::TargetKind, Manifest};
 use full_moon::{ast::luau::ExportedTypeDeclaration, visitors::Visitor};
-use relative_path::RelativePathBuf;
+use relative_path::RelativePath;
+use tracing::instrument;
 
 struct TypeVisitor {
-    types: Vec<String>,
+	types: Vec<String>,
 }
 
 impl Visitor for TypeVisitor {
-    fn visit_exported_type_declaration(&mut self, node: &ExportedTypeDeclaration) {
+	fn visit_exported_type_declaration(&mut self, node: &ExportedTypeDeclaration) {
-        let name = node.type_declaration().type_name().to_string();
+		let name = node.type_declaration().type_name().to_string();
 
-        let (declaration_generics, generics) =
+		let (declaration_generics, generics) =
-            if let Some(declaration) = node.type_declaration().generics() {
+			if let Some(declaration) = node.type_declaration().generics() {
-                let mut declaration_generics = vec![];
+				let mut declaration_generics = vec![];
-                let mut generics = vec![];
+				let mut generics = vec![];
 
-                for generic in declaration.generics().iter() {
+				for generic in declaration.generics().iter() {
-                    declaration_generics.push(generic.to_string());
+					declaration_generics.push(generic.to_string());
 
-                    if generic.default_type().is_some() {
+					if generic.default_type().is_some() {
-                        generics.push(generic.parameter().to_string())
+						generics.push(generic.parameter().to_string())
-                    } else {
+					} else {
-                        generics.push(generic.to_string())
+						generics.push(generic.to_string())
-                    }
+					}
-                }
+				}
 
-                (
+				(
-                    format!("<{}>", declaration_generics.join(", ")),
+					format!("<{}>", declaration_generics.join(", ")),
-                    format!("<{}>", generics.join(", ")),
+					format!("<{}>", generics.join(", ")),
-                )
+				)
-            } else {
+			} else {
-                ("".to_string(), "".to_string())
+				("".to_string(), "".to_string())
-            };
+			};
 
-        self.types.push(format!(
+		self.types.push(format!(
-            "export type {name}{declaration_generics} = module.{name}{generics}\n"
+			"export type {name}{declaration_generics} = module.{name}{generics}\n"
-        ));
+		));
-    }
+	}
 }
 
-/// Get the types exported by a file
+pub(crate) fn get_file_types(file: &str) -> Vec<String> {
-pub fn get_file_types(file: &str) -> Result<Vec<String>, Vec<full_moon::Error>> {
+	let ast = match full_moon::parse(file) {
-    let ast = full_moon::parse(file)?;
+		Ok(ast) => ast,
-    let mut visitor = TypeVisitor { types: vec![] };
+		Err(err) => {
-    visitor.visit_ast(&ast);
+			tracing::error!(
+				"failed to parse file to extract types:\n{}",
+				err.into_iter()
+					.map(|err| format!("\t- {err}"))
+					.collect::<Vec<_>>()
+					.join("\n")
+			);
 
-    Ok(visitor.types)
+			return vec![];
+		}
+	};
+	let mut visitor = TypeVisitor { types: vec![] };
+	visitor.visit_ast(&ast);
+
+	visitor.types
 }
 
 /// Generate a linking module for a library
 pub fn generate_lib_linking_module<I: IntoIterator<Item = S>, S: AsRef<str>>(
-    path: &str,
+	path: &str,
-    types: I,
+	types: I,
 ) -> String {
-    let mut output = format!("local module = require({path})\n");
+	let mut output = format!("local module = require({path})\n");
 
-    for ty in types {
+	for ty in types {
-        output.push_str(ty.as_ref());
+		output.push_str(ty.as_ref());
-    }
+	}
 
-    output.push_str("return module");
+	output.push_str("return module");
 
-    output
+	output
 }
 
 fn luau_style_path(path: &Path) -> String {
-    let path = path
+	let path = path
-        .components()
+		.components()
-        .zip(
+		.zip(
-            path.components()
+			path.components()
-                .skip(1)
+				.skip(1)
-                .map(Some)
+				.map(Some)
-                .chain(std::iter::repeat(None)),
+				.chain(std::iter::repeat(None)),
-        )
+		)
-        .filter_map(|(ct, next_ct)| match ct {
+		.filter_map(|(ct, next_ct)| match ct {
-            Component::CurDir => Some(".".to_string()),
+			Component::CurDir => Some(".".to_string()),
-            Component::ParentDir => Some("..".to_string()),
+			Component::ParentDir => Some("..".to_string()),
-            Component::Normal(part) => {
+			Component::Normal(part) => {
-                let str = part.to_string_lossy();
+				let str = part.to_string_lossy();
 
-                Some(
+				Some(
-                    (if next_ct.is_some() {
+					(if next_ct.is_some() {
-                        &str
+						&str
-                    } else {
+					} else {
-                        str.strip_suffix(".luau")
+						str.strip_suffix(".luau")
-                            .or_else(|| str.strip_suffix(".lua"))
+							.or_else(|| str.strip_suffix(".lua"))
-                            .unwrap_or(&str)
+							.unwrap_or(&str)
-                    })
+					})
-                    .to_string(),
+					.to_string(),
-                )
+				)
-            }
+			}
-            _ => None,
+			_ => None,
-        })
+		})
-        .collect::<Vec<_>>()
+		.collect::<Vec<_>>()
-        .join("/");
+		.join("/");
 
-    let require = format!("./{path}");
+	let require = format!("./{path}");
-    format!("{require:?}")
+	format!("{require:?}")
 }
 
 // This function should be simplified (especially to reduce the number of arguments),
 // but it's not clear how to do that while maintaining the current functionality.
 /// Get the require path for a library
+#[instrument(skip(project_manifest), level = "trace")]
 #[allow(clippy::too_many_arguments)]
 pub fn get_lib_require_path(
-    target: &TargetKind,
+	target: TargetKind,
-    base_dir: &Path,
+	base_dir: &Path,
-    lib_file: &RelativePathBuf,
+	lib_file: &RelativePath,
-    destination_dir: &Path,
+	destination_dir: &Path,
-    use_new_structure: bool,
+	use_new_structure: bool,
-    root_container_dir: &Path,
+	root_container_dir: &Path,
-    container_dir: &Path,
+	container_dir: &Path,
-    project_manifest: &Manifest,
+	project_manifest: &Manifest,
 ) -> Result<String, errors::GetLibRequirePath> {
-    let path = pathdiff::diff_paths(destination_dir, base_dir).unwrap();
+	let path = pathdiff::diff_paths(destination_dir, base_dir).unwrap();
-    let path = if use_new_structure {
+	tracing::debug!("diffed path: {}", path.display());
-        tracing::debug!("using new structure for require path with {lib_file:?}");
+	let path = if use_new_structure {
-        lib_file.to_path(path)
+		lib_file.to_path(path)
-    } else {
+	} else {
-        tracing::debug!("using old structure for require path with {lib_file:?}");
+		path
-        path
+	};
-    };
 
-    if matches!(target, TargetKind::Roblox | TargetKind::RobloxServer) {
+	if matches!(target, TargetKind::Roblox | TargetKind::RobloxServer) {
-        let (prefix, path) = match target.try_into() {
+		let (prefix, path) = match target.try_into() {
-            Ok(place_kind) if !destination_dir.starts_with(root_container_dir) => (
+			Ok(place_kind) if !destination_dir.starts_with(root_container_dir) => (
-                project_manifest
+				project_manifest
-                    .place
+					.place
-                    .get(&place_kind)
+					.get(&place_kind)
-                    .ok_or(errors::GetLibRequirePath::RobloxPlaceKindPathNotFound(
+					.ok_or(errors::GetLibRequirePath::RobloxPlaceKindPathNotFound(
-                        place_kind,
+						place_kind,
-                    ))?
+					))?
-                    .as_str(),
+					.as_str(),
-                if use_new_structure {
+				if use_new_structure {
-                    lib_file.to_path(container_dir)
+					lib_file.to_path(container_dir)
-                } else {
+				} else {
-                    container_dir.to_path_buf()
+					container_dir.to_path_buf()
-                },
+				},
-            ),
+			),
-            _ => ("script.Parent", path),
+			_ => ("script.Parent", path),
-        };
+		};
 
-        let path = path
+		let path = path
-            .components()
+			.components()
-            .zip(
+			.zip(
-                path.components()
+				path.components()
-                    .skip(1)
+					.skip(1)
-                    .map(Some)
+					.map(Some)
-                    .chain(std::iter::repeat(None)),
+					.chain(std::iter::repeat(None)),
-            )
+			)
-            .filter_map(|(component, next_comp)| match component {
+			.filter_map(|(component, next_comp)| match component {
-                Component::ParentDir => Some(".Parent".to_string()),
+				Component::ParentDir => Some(".Parent".to_string()),
-                Component::Normal(part) if part != "init.lua" && part != "init.luau" => {
+				Component::Normal(part) if part != "init.lua" && part != "init.luau" => {
-                    let str = part.to_string_lossy();
+					let str = part.to_string_lossy();
 
-                    Some(format!(
+					Some(format!(
-                        "[{:?}]",
+						"[{:?}]",
-                        if next_comp.is_some() {
+						if next_comp.is_some() {
-                            &str
+							&str
-                        } else {
+						} else {
-                            str.strip_suffix(".luau")
+							str.strip_suffix(".luau")
-                                .or_else(|| str.strip_suffix(".lua"))
+								.or_else(|| str.strip_suffix(".lua"))
-                                .unwrap_or(&str)
+								.unwrap_or(&str)
-                        }
+						}
-                    ))
+					))
-                }
+				}
-                _ => None,
+				_ => None,
-            })
+			})
-            .collect::<Vec<_>>()
+			.collect::<Vec<_>>()
-            .join("");
+			.join("");
 
-        return Ok(format!("{prefix}{path}"));
+		return Ok(format!("{prefix}{path}"));
-    };
+	};
 
-    Ok(luau_style_path(&path))
+	Ok(luau_style_path(&path))
 }
 
 /// Generate a linking module for a binary
 pub fn generate_bin_linking_module<P: AsRef<Path>>(package_root: P, require_path: &str) -> String {
-    format!(
+	format!(
-        r#"_G.PESDE_ROOT = {:?}
+		r#"_G.PESDE_ROOT = {:?}
 return require({require_path})"#,
-        package_root.as_ref().to_string_lossy()
+		package_root.as_ref().to_string_lossy()
-    )
+	)
 }
 
 /// Get the require path for a binary
+#[instrument(level = "trace")]
 pub fn get_bin_require_path(
-    base_dir: &Path,
+	base_dir: &Path,
-    bin_file: &RelativePathBuf,
+	bin_file: &RelativePath,
-    destination_dir: &Path,
+	destination_dir: &Path,
 ) -> String {
-    let path = pathdiff::diff_paths(destination_dir, base_dir).unwrap();
+	let path = pathdiff::diff_paths(destination_dir, base_dir).unwrap();
-    let path = bin_file.to_path(path);
+	tracing::debug!("diffed path: {}", path.display());
+	let path = bin_file.to_path(path);
 
-    luau_style_path(&path)
+	luau_style_path(&path)
 }
 
 /// Generate a linking module for a script
 pub fn generate_script_linking_module(require_path: &str) -> String {
-    format!(r#"return require({require_path})"#)
+	format!(r#"return require({require_path})"#)
 }
 
 /// Get the require path for a script
+#[instrument(level = "trace")]
 pub fn get_script_require_path(
-    base_dir: &Path,
+	base_dir: &Path,
-    script_file: &RelativePathBuf,
+	script_file: &RelativePath,
-    destination_dir: &Path,
+	destination_dir: &Path,
 ) -> String {
-    let path = pathdiff::diff_paths(destination_dir, base_dir).unwrap();
+	let path = pathdiff::diff_paths(destination_dir, base_dir).unwrap();
-    let path = script_file.to_path(path);
+	tracing::debug!("diffed path: {}", path.display());
+	let path = script_file.to_path(path);
 
-    luau_style_path(&path)
+	luau_style_path(&path)
 }
 
 /// Errors for the linking module utilities
 pub mod errors {
-    use thiserror::Error;
+	use thiserror::Error;
 
-    /// An error occurred while getting the require path for a library
+	/// An error occurred while getting the require path for a library
-    #[derive(Debug, Error)]
+	#[derive(Debug, Error)]
-    #[non_exhaustive]
+	#[non_exhaustive]
-    pub enum GetLibRequirePath {
+	pub enum GetLibRequirePath {
-        /// The path for the RobloxPlaceKind could not be found
+		/// The path for the RobloxPlaceKind could not be found
-        #[error("could not find the path for the RobloxPlaceKind {0}")]
+		#[error("could not find the path for the RobloxPlaceKind {0}")]
-        RobloxPlaceKindPathNotFound(crate::manifest::target::RobloxPlaceKind),
+		RobloxPlaceKindPathNotFound(crate::manifest::target::RobloxPlaceKind),
-    }
+	}
 }

src/linking/incremental.rs

@@ -0,0 +1,271 @@
+use crate::{
+	all_packages_dirs, graph::DependencyGraphWithTarget, manifest::Alias, util::remove_empty_dir,
+	Project, PACKAGES_CONTAINER_NAME, SCRIPTS_LINK_FOLDER,
+};
+use fs_err::tokio as fs;
+use futures::FutureExt;
+use std::{
+	collections::HashSet,
+	path::{Path, PathBuf},
+	sync::Arc,
+};
+use tokio::task::JoinSet;
+
+fn index_entry(
+	entry: fs::DirEntry,
+	packages_index_dir: &Path,
+	tasks: &mut JoinSet<std::io::Result<()>>,
+	used_paths: &Arc<HashSet<PathBuf>>,
+) {
+	let path = entry.path();
+	let path_relative = path.strip_prefix(packages_index_dir).unwrap().to_path_buf();
+
+	let is_wally = entry
+		.file_name()
+		.to_str()
+		.expect("non UTF-8 folder name in packages index")
+		.contains("@");
+
+	let used_paths = used_paths.clone();
+	tasks.spawn(async move {
+		if is_wally {
+			#[cfg(not(feature = "wally-compat"))]
+			{
+				tracing::error!(
+					"found Wally package in index despite feature being disabled at `{}`",
+					path.display()
+				);
+			}
+			#[cfg(feature = "wally-compat")]
+			{
+				if !used_paths.contains(&path_relative) {
+					fs::remove_dir_all(path).await?;
+				}
+
+				return Ok(());
+			}
+		}
+
+		let mut tasks = JoinSet::new();
+
+		let mut entries = fs::read_dir(&path).await?;
+		while let Some(entry) = entries.next_entry().await? {
+			let version = entry.file_name();
+			let path_relative = path_relative.join(&version);
+
+			if used_paths.contains(&path_relative) {
+				continue;
+			}
+
+			let path = entry.path();
+			tasks.spawn(async { fs::remove_dir_all(path).await });
+		}
+
+		while let Some(task) = tasks.join_next().await {
+			task.unwrap()?;
+		}
+
+		remove_empty_dir(&path).await
+	});
+}
+
+fn packages_entry(
+	entry: fs::DirEntry,
+	tasks: &mut JoinSet<std::io::Result<()>>,
+	expected_aliases: &Arc<HashSet<Alias>>,
+) {
+	let expected_aliases = expected_aliases.clone();
+	tasks.spawn(async move {
+		if !entry.file_type().await?.is_file() {
+			return Ok(());
+		}
+
+		let path = entry.path();
+		let name = path
+			.file_stem()
+			.unwrap()
+			.to_str()
+			.expect("non UTF-8 file name in packages folder");
+		let name = name.strip_suffix(".bin").unwrap_or(name);
+		let name = match name.parse::<Alias>() {
+			Ok(name) => name,
+			Err(e) => {
+				tracing::error!("invalid alias in packages folder: {e}");
+				return Ok(());
+			}
+		};
+
+		if !expected_aliases.contains(&name) {
+			fs::remove_file(path).await?;
+		}
+
+		Ok(())
+	});
+}
+
+fn scripts_entry(
+	entry: fs::DirEntry,
+	tasks: &mut JoinSet<std::io::Result<()>>,
+	expected_aliases: &Arc<HashSet<Alias>>,
+) {
+	let expected_aliases = expected_aliases.clone();
+	tasks.spawn(async move {
+		if !entry.file_type().await?.is_dir() {
+			return Ok(());
+		}
+
+		let path = entry.path();
+		let name = path
+			.file_name()
+			.unwrap()
+			.to_str()
+			.expect("non UTF-8 file name in scripts folder");
+		let name = match name.parse::<Alias>() {
+			Ok(name) => name,
+			Err(e) => {
+				tracing::error!("invalid alias in scripts folder: {e}");
+				return Ok(());
+			}
+		};
+
+		if !expected_aliases.contains(&name) {
+			fs::remove_dir_all(&path).await?;
+		}
+
+		Ok(())
+	});
+}
+
+impl Project {
+	/// Removes unused packages from the project
+	pub async fn remove_unused(
+		&self,
+		graph: &DependencyGraphWithTarget,
+	) -> Result<(), errors::RemoveUnusedError> {
+		let manifest = self.deser_manifest().await?;
+		let used_paths = graph
+			.iter()
+			.map(|(id, node)| {
+				node.node
+					.container_folder(id)
+					.parent()
+					.unwrap()
+					.to_path_buf()
+			})
+			.collect::<HashSet<_>>();
+		let used_paths = Arc::new(used_paths);
+
+		let mut tasks = all_packages_dirs()
+			.into_iter()
+			.map(|folder| {
+				let packages_dir = self.package_dir().join(&folder);
+				let packages_index_dir = packages_dir.join(PACKAGES_CONTAINER_NAME);
+				let used_paths = used_paths.clone();
+
+				let expected_aliases = graph
+					.iter()
+					.filter(|(id, _)| {
+						manifest
+							.target
+							.kind()
+							.packages_folder(id.version_id().target())
+							== folder
+					})
+					.filter_map(|(_, node)| {
+						node.node.direct.as_ref().map(|(alias, _, _)| alias.clone())
+					})
+					.collect::<HashSet<_>>();
+				let expected_aliases = Arc::new(expected_aliases);
+
+				async move {
+					let mut index_entries = match fs::read_dir(&packages_index_dir).await {
+						Ok(entries) => entries,
+						Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(()),
+						Err(e) => return Err(e),
+					};
+					// we don't handle NotFound here because the upper level will handle it
+					let mut packages_entries = fs::read_dir(&packages_dir).await?;
+					let mut tasks = JoinSet::new();
+
+					loop {
+						tokio::select! {
+							Some(entry) = index_entries.next_entry().map(Result::transpose) => {
+								index_entry(
+									entry?,
+									&packages_index_dir,
+									&mut tasks,
+									&used_paths,
+								);
+							}
+							Some(entry) = packages_entries.next_entry().map(Result::transpose) => {
+								packages_entry(
+									entry?,
+									&mut tasks,
+									&expected_aliases,
+								);
+							}
+							else => break,
+						}
+					}
+
+					while let Some(task) = tasks.join_next().await {
+						task.unwrap()?;
+					}
+
+					remove_empty_dir(&packages_index_dir).await?;
+					remove_empty_dir(&packages_dir).await?;
+
+					Ok::<_, std::io::Error>(())
+				}
+			})
+			.collect::<JoinSet<_>>();
+
+		let scripts_dir = self.package_dir().join(SCRIPTS_LINK_FOLDER);
+		match fs::read_dir(&scripts_dir).await {
+			Ok(mut entries) => {
+				let expected_aliases = graph
+					.iter()
+					.filter_map(|(_, node)| {
+						node.node
+							.direct
+							.as_ref()
+							.map(|(alias, _, _)| alias.clone())
+							.filter(|_| node.target.scripts().is_some_and(|s| !s.is_empty()))
+					})
+					.collect::<HashSet<_>>();
+				let expected_aliases = Arc::new(expected_aliases);
+
+				while let Some(entry) = entries.next_entry().await? {
+					scripts_entry(entry, &mut tasks, &expected_aliases);
+				}
+			}
+			Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
+			Err(e) => return Err(e.into()),
+		}
+
+		while let Some(task) = tasks.join_next().await {
+			task.unwrap()?;
+		}
+
+		remove_empty_dir(&scripts_dir).await?;
+
+		Ok(())
+	}
+}
+
+/// Errors that can occur when using incremental installs
+pub mod errors {
+	use thiserror::Error;
+
+	/// Errors that can occur when removing unused packages
+	#[derive(Debug, Error)]
+	pub enum RemoveUnusedError {
+		/// Reading the manifest failed
+		#[error("error reading manifest")]
+		ManifestRead(#[from] crate::errors::ManifestReadError),
+
+		/// IO error
+		#[error("IO error")]
+		Io(#[from] std::io::Error),
+	}
+}

src/linking/mod.rs

@@ -1,399 +1,424 @@
 use crate::{
-    linking::generator::get_file_types,
+	graph::{DependencyGraphNodeWithTarget, DependencyGraphWithTarget},
-    lockfile::{DownloadedDependencyGraphNode, DownloadedGraph},
+	linking::generator::get_file_types,
-    manifest::Manifest,
+	manifest::{Alias, Manifest},
-    names::PackageNames,
+	scripts::{execute_script, ExecuteScriptHooks, ScriptName},
-    scripts::{execute_script, ScriptName},
+	source::{
-    source::{
+		fs::{cas_path, store_in_cas},
-        fs::{cas_path, store_in_cas},
+		ids::PackageId,
-        traits::PackageRef,
+		traits::PackageRef,
-        version_id::VersionId,
+	},
-    },
+	Project, LINK_LIB_NO_FILE_FOUND, PACKAGES_CONTAINER_NAME, SCRIPTS_LINK_FOLDER,
-    Project, LINK_LIB_NO_FILE_FOUND, PACKAGES_CONTAINER_NAME, SCRIPTS_LINK_FOLDER,
 };
 use fs_err::tokio as fs;
-use futures::future::try_join_all;
 use std::{
-    collections::HashMap,
+	collections::HashMap,
-    ffi::OsStr,
+	ffi::OsStr,
-    path::{Path, PathBuf},
+	path::{Path, PathBuf},
-    sync::Arc,
+	sync::Arc,
 };
-use tokio::task::spawn_blocking;
+use tokio::task::{spawn_blocking, JoinSet};
 use tracing::{instrument, Instrument};
 
 /// Generates linking modules for a project
 pub mod generator;
+/// Incremental installs
+pub mod incremental;
 
 async fn create_and_canonicalize<P: AsRef<Path>>(path: P) -> std::io::Result<PathBuf> {
-    let p = path.as_ref();
+	let p = path.as_ref();
-    fs::create_dir_all(p).await?;
+	fs::create_dir_all(p).await?;
-    p.canonicalize()
+	p.canonicalize()
 }
 
 async fn write_cas(destination: PathBuf, cas_dir: &Path, contents: &str) -> std::io::Result<()> {
-    let hash = store_in_cas(cas_dir, contents.as_bytes(), |_| async { Ok(()) }).await?;
+	let hash = store_in_cas(cas_dir, contents.as_bytes()).await?;
 
-    match fs::remove_file(&destination).await {
+	match fs::remove_file(&destination).await {
-        Ok(_) => {}
+		Ok(_) => {}
-        Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
+		Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
-        Err(e) => return Err(e),
+		// TODO: investigate why this happens and whether we can avoid it without ignoring all PermissionDenied errors
-    };
+		#[cfg(windows)]
+		Err(e) if e.kind() == std::io::ErrorKind::PermissionDenied => {}
+		Err(e) => return Err(e),
+	};
 
-    fs::hard_link(cas_path(&hash, cas_dir), destination).await
+	fs::hard_link(cas_path(&hash, cas_dir), destination).await
 }
 
+#[derive(Debug, Clone, Copy)]
+struct LinkingExecuteScriptHooks;
+
+impl ExecuteScriptHooks for LinkingExecuteScriptHooks {
+	fn not_found(&self, script: ScriptName) {
+		tracing::warn!(
+			"not having a `{script}` script in the manifest might cause issues with linking"
+		);
+	}
+}
+
+type PackageTypes = HashMap<PackageId, Vec<String>>;
+
 impl Project {
-    /// Links the dependencies of the project
+	/// Links the dependencies of the project
-    #[instrument(skip(self, graph), level = "debug")]
+	#[instrument(skip(self, graph), level = "debug")]
-    pub async fn link_dependencies(
+	pub(crate) async fn link_dependencies(
-        &self,
+		&self,
-        graph: &DownloadedGraph,
+		graph: Arc<DependencyGraphWithTarget>,
-        with_types: bool,
+		with_types: bool,
-    ) -> Result<(), errors::LinkingError> {
+	) -> Result<(), errors::LinkingError> {
-        let manifest = self.deser_manifest().await?;
+		let manifest = self.deser_manifest().await?;
-        let manifest_target_kind = manifest.target.kind();
+		let manifest_target_kind = manifest.target.kind();
-        let manifest = Arc::new(manifest);
+		let manifest = Arc::new(manifest);
 
-        // step 1. link all non-wally packages (and their dependencies) temporarily without types
+		// step 1. link all non-wally packages (and their dependencies) temporarily without types
-        // we do this separately to allow the required tools for the scripts to be installed
+		// we do this separately to allow the required tools for the scripts to be installed
-        self.link(graph, &manifest, &Arc::new(Default::default()), false)
+		self.link(&graph, &manifest, &Arc::new(PackageTypes::default()), false)
-            .await?;
+			.await?;
 
-        if !with_types {
+		if !with_types {
-            return Ok(());
+			return Ok(());
-        }
+		}
 
-        // step 2. extract the types from libraries, prepare Roblox packages for syncing
+		// step 2. extract the types from libraries, prepare Roblox packages for syncing
-        let roblox_sync_config_gen_script = manifest
+		let mut tasks = graph
-            .scripts
+			.iter()
-            .get(&ScriptName::RobloxSyncConfigGenerator.to_string());
+			.map(|(package_id, node)| {
+				let span =
+					tracing::info_span!("extract types", package_id = package_id.to_string());
 
-        let package_types = try_join_all(graph.iter().map(|(name, versions)| async move {
+				let package_id = package_id.clone();
-            Ok::<_, errors::LinkingError>((
+				let node = node.clone();
-                name,
+				let project = self.clone();
-                try_join_all(versions.iter().map(|(version_id, node)| async move {
-                    let Some(lib_file) = node.target.lib_path() else {
-                        return Ok((version_id, vec![]));
-                    };
 
-                    let container_folder = node.node.container_folder(
+				async move {
-                        &self
+					let Some(lib_file) = node.target.lib_path() else {
-                            .package_dir()
+						return Ok((package_id, vec![]));
-                            .join(manifest_target_kind.packages_folder(version_id.target()))
+					};
-                            .join(PACKAGES_CONTAINER_NAME),
-                        name,
-                        version_id.version(),
-                    );
 
-                    let types = if lib_file.as_str() != LINK_LIB_NO_FILE_FOUND {
+					let container_folder = node.node.container_folder_from_project(
-                        let lib_file = lib_file.to_path(&container_folder);
+						&package_id,
+						&project,
+						manifest_target_kind,
+					);
 
-                        let contents = match fs::read_to_string(&lib_file).await {
+					let types = if lib_file.as_str() != LINK_LIB_NO_FILE_FOUND {
-                            Ok(contents) => contents,
+						let lib_file = lib_file.to_path(&container_folder);
-                            Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
-                                return Err(errors::LinkingError::LibFileNotFound(
-                                    lib_file.display().to_string(),
-                                ));
-                            }
-                            Err(e) => return Err(e.into()),
-                        };
 
-                        let types = match spawn_blocking(move || get_file_types(&contents))
+						let contents = match fs::read_to_string(&lib_file).await {
-                            .await
+							Ok(contents) => contents,
-                            .unwrap()
+							Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
-                        {
+								return Err(errors::LinkingError::LibFileNotFound(
-                            Ok(types) => types,
+									lib_file.display().to_string(),
-                            Err(e) => {
+								));
-                                return Err(errors::LinkingError::FullMoon(
+							}
-                                    lib_file.display().to_string(),
+							Err(e) => return Err(e.into()),
-                                    e,
+						};
-                                ))
-                            }
-                        };
 
-                        tracing::debug!("contains {} exported types", types.len());
+						let types = spawn_blocking(move || get_file_types(&contents))
+							.await
+							.unwrap();
 
-                        types
+						tracing::debug!("contains {} exported types", types.len());
-                    } else {
-                        vec![]
-                    };
 
-                    if let Some(build_files) = Some(&node.target)
+						types
-                        .filter(|_| !node.node.pkg_ref.like_wally())
+					} else {
-                        .and_then(|t| t.build_files())
+						vec![]
-                    {
+					};
-                        let Some(script_path) = roblox_sync_config_gen_script else {
-                            tracing::warn!("not having a `{}` script in the manifest might cause issues with Roblox linking", ScriptName::RobloxSyncConfigGenerator);
-                            return Ok((version_id, types));
-                        };
 
-                        execute_script(
+					if let Some(build_files) = Some(&node.target)
-                            ScriptName::RobloxSyncConfigGenerator,
+						.filter(|_| !node.node.pkg_ref.is_wally_package())
-                            &script_path.to_path(self.package_dir()),
+						.and_then(|t| t.build_files())
-                            std::iter::once(container_folder.as_os_str())
+					{
-                                .chain(build_files.iter().map(OsStr::new)),
+						execute_script(
-                            self,
+							ScriptName::RobloxSyncConfigGenerator,
-                            false,
+							&project,
-                        ).await
+							LinkingExecuteScriptHooks,
-                            .map_err(|e| {
+							std::iter::once(container_folder.as_os_str())
-                                errors::LinkingError::GenerateRobloxSyncConfig(
+								.chain(build_files.iter().map(OsStr::new)),
-                                    container_folder.display().to_string(),
+							false,
-                                    e,
+						)
-                                )
+						.await
-                            })?;
+						.map_err(errors::LinkingError::ExecuteScript)?;
-                    }
+					}
 
-                    Ok((version_id, types))
+					Ok((package_id, types))
-                }.instrument(tracing::debug_span!("extract types", name = name.to_string(), version_id = version_id.to_string()))))
+				}
-                    .await?
+				.instrument(span)
-                    .into_iter()
+			})
-                    .collect::<HashMap<_, _>>(),
+			.collect::<JoinSet<_>>();
-            ))
-        }))
-            .await?
-            .into_iter()
-            .collect::<HashMap<_, _>>();
 
-        // step 3. link all packages (and their dependencies), this time with types
+		let mut package_types = PackageTypes::new();
-        self.link(graph, &manifest, &Arc::new(package_types), true)
+		while let Some(task) = tasks.join_next().await {
-            .await
+			let (package_id, types) = task.unwrap()?;
-    }
+			package_types.insert(package_id, types);
+		}
 
-    #[allow(clippy::too_many_arguments)]
+		// step 3. link all packages (and their dependencies), this time with types
-    async fn link_files(
+		self.link(&graph, &manifest, &Arc::new(package_types), true)
-        &self,
+			.await
-        base_folder: &Path,
+	}
-        container_folder: &Path,
-        root_container_folder: &Path,
-        relative_container_folder: &Path,
-        node: &DownloadedDependencyGraphNode,
-        name: &PackageNames,
-        version_id: &VersionId,
-        alias: &str,
-        package_types: &HashMap<&PackageNames, HashMap<&VersionId, Vec<String>>>,
-        manifest: &Manifest,
-    ) -> Result<(), errors::LinkingError> {
-        static NO_TYPES: Vec<String> = Vec::new();
 
-        if let Some(lib_file) = node.target.lib_path() {
+	async fn link(
-            let lib_module = generator::generate_lib_linking_module(
+		&self,
-                &generator::get_lib_require_path(
+		graph: &Arc<DependencyGraphWithTarget>,
-                    &node.target.kind(),
+		manifest: &Arc<Manifest>,
-                    base_folder,
+		package_types: &Arc<PackageTypes>,
-                    lib_file,
+		is_complete: bool,
-                    container_folder,
+	) -> Result<(), errors::LinkingError> {
-                    node.node.pkg_ref.use_new_structure(),
+		let mut tasks = JoinSet::<Result<_, errors::LinkingError>>::new();
-                    root_container_folder,
+		let mut link_files = |base_folder: &Path,
-                    relative_container_folder,
+		                      container_folder: &Path,
-                    manifest,
+		                      root_container_folder: &Path,
-                )?,
+		                      relative_container_folder: &Path,
-                package_types
+		                      node: &DependencyGraphNodeWithTarget,
-                    .get(name)
+		                      package_id: &PackageId,
-                    .and_then(|v| v.get(version_id))
+		                      alias: &Alias,
-                    .unwrap_or(&NO_TYPES),
+		                      is_root: bool|
-            );
+		 -> Result<(), errors::LinkingError> {
+			static NO_TYPES: Vec<String> = Vec::new();
 
-            write_cas(
+			if let Some(lib_file) = node.target.lib_path() {
-                base_folder.join(format!("{alias}.luau")),
+				let destination = base_folder.join(format!("{alias}.luau"));
-                self.cas_dir(),
-                &lib_module,
-            )
-            .await?;
-        }
 
-        if let Some(bin_file) = node.target.bin_path() {
+				let lib_module = generator::generate_lib_linking_module(
-            let bin_module = generator::generate_bin_linking_module(
+					&generator::get_lib_require_path(
-                container_folder,
+						node.target.kind(),
-                &generator::get_bin_require_path(base_folder, bin_file, container_folder),
+						base_folder,
-            );
+						lib_file,
+						container_folder,
+						node.node.pkg_ref.use_new_structure(),
+						root_container_folder,
+						relative_container_folder,
+						manifest,
+					)?,
+					package_types.get(package_id).unwrap_or(&NO_TYPES),
+				);
+				let cas_dir = self.cas_dir().to_path_buf();
 
-            write_cas(
+				tasks.spawn(async move {
-                base_folder.join(format!("{alias}.bin.luau")),
+					write_cas(destination, &cas_dir, &lib_module)
-                self.cas_dir(),
+						.await
-                &bin_module,
+						.map_err(Into::into)
-            )
+				});
-            .await?;
+			}
-        }
 
-        if let Some(scripts) = node.target.scripts().filter(|s| !s.is_empty()) {
+			if let Some(bin_file) = node.target.bin_path() {
-            let scripts_base =
+				let destination = base_folder.join(format!("{alias}.bin.luau"));
-                create_and_canonicalize(self.package_dir().join(SCRIPTS_LINK_FOLDER).join(alias))
-                    .await?;
 
-            for (script_name, script_path) in scripts {
+				let bin_module = generator::generate_bin_linking_module(
-                let script_module =
+					container_folder,
-                    generator::generate_script_linking_module(&generator::get_script_require_path(
+					&generator::get_bin_require_path(base_folder, bin_file, container_folder),
-                        &scripts_base,
+				);
-                        script_path,
+				let cas_dir = self.cas_dir().to_path_buf();
-                        container_folder,
-                    ));
 
-                write_cas(
+				tasks.spawn(async move {
-                    scripts_base.join(format!("{script_name}.luau")),
+					write_cas(destination, &cas_dir, &bin_module)
-                    self.cas_dir(),
+						.await
-                    &script_module,
+						.map_err(Into::into)
-                )
+				});
-                .await?;
+			}
-            }
-        }
 
-        Ok(())
+			if let Some(scripts) = node
-    }
+				.target
+				.scripts()
+				.filter(|s| !s.is_empty() && node.node.direct.is_some() && is_root)
+			{
+				let scripts_base = self
+					.package_dir()
+					.join(SCRIPTS_LINK_FOLDER)
+					.join(alias.as_str());
 
-    async fn link(
+				for (script_name, script_path) in scripts {
-        &self,
+					let destination = scripts_base.join(format!("{script_name}.luau"));
-        graph: &DownloadedGraph,
+					let script_module = generator::generate_script_linking_module(
-        manifest: &Arc<Manifest>,
+						&generator::get_script_require_path(
-        package_types: &Arc<HashMap<&PackageNames, HashMap<&VersionId, Vec<String>>>>,
+							&scripts_base,
-        is_complete: bool,
+							script_path,
-    ) -> Result<(), errors::LinkingError> {
+							container_folder,
-        try_join_all(graph.iter().flat_map(|(name, versions)| {
+						),
-            versions.iter().map(|(version_id, node)| {
+					);
-                let name = name.clone();
+					let cas_dir = self.cas_dir().to_path_buf();
-                let manifest = manifest.clone();
-                let package_types = package_types.clone();
 
-                let span = tracing::info_span!(
+					tasks.spawn(async move {
-                    "link",
+						fs::create_dir_all(destination.parent().unwrap()).await?;
-                    name = name.to_string(),
-                    version_id = version_id.to_string()
-                );
 
-                async move {
+						write_cas(destination, &cas_dir, &script_module)
-                    let (node_container_folder, node_packages_folder) = {
+							.await
-                        let base_folder = create_and_canonicalize(
+							.map_err(Into::into)
-                            self.package_dir()
+					});
-                                .join(manifest.target.kind().packages_folder(version_id.target())),
+				}
-                        )
+			}
-                        .await?;
-                        let packages_container_folder = base_folder.join(PACKAGES_CONTAINER_NAME);
 
-                        let container_folder = node.node.container_folder(
+			Ok(())
-                            &packages_container_folder,
+		};
-                            &name,
-                            version_id.version(),
-                        );
 
-                        if let Some((alias, _, _)) = &node.node.direct {
+		let mut node_tasks = graph
-                            self.link_files(
+			.iter()
-                                &base_folder,
+			.map(|(id, node)| {
-                                &container_folder,
+				let base_folder = self.package_dir().join(
-                                &base_folder,
+					manifest
-                                container_folder.strip_prefix(&base_folder).unwrap(),
+						.target
-                                node,
+						.kind()
-                                &name,
+						.packages_folder(id.version_id().target()),
-                                version_id,
+				);
-                                alias,
-                                &package_types,
-                                &manifest,
-                            )
-                            .await?;
-                        }
 
-                        (container_folder, base_folder)
+				let id = id.clone();
-                    };
+				let node = node.clone();
 
-                    for (dependency_name, (dependency_version_id, dependency_alias)) in
+				async move {
-                        &node.node.dependencies
+					Ok::<_, errors::LinkingError>((
-                    {
+						id,
-                        let Some(dependency_node) = graph
+						node,
-                            .get(dependency_name)
+						create_and_canonicalize(base_folder).await?,
-                            .and_then(|v| v.get(dependency_version_id))
+					))
-                        else {
+				}
-                            if is_complete {
+			})
-                                return Err(errors::LinkingError::DependencyNotFound(
+			.collect::<JoinSet<_>>();
-                                    format!("{dependency_name}@{dependency_version_id}"),
-                                    format!("{name}@{version_id}"),
-                                ));
-                            }
 
-                            continue;
+		let mut dependency_tasks = JoinSet::<Result<_, errors::LinkingError>>::new();
-                        };
 
-                        let base_folder = create_and_canonicalize(
+		loop {
-                            self.package_dir().join(
+			tokio::select! {
-                                version_id
+				Some(res) = node_tasks.join_next() => {
-                                    .target()
+					let (package_id, node, base_folder) = res.unwrap()?;
-                                    .packages_folder(dependency_version_id.target()),
+					let (node_container_folder, node_packages_folder) = {
-                            ),
+						let packages_container_folder = base_folder.join(PACKAGES_CONTAINER_NAME);
-                        )
-                        .await?;
-                        let packages_container_folder = base_folder.join(PACKAGES_CONTAINER_NAME);
 
-                        let container_folder = dependency_node.node.container_folder(
+						let container_folder =
-                            &packages_container_folder,
+							packages_container_folder.join(node.node.container_folder(&package_id));
-                            dependency_name,
-                            dependency_version_id.version(),
-                        );
 
-                        let linker_folder = create_and_canonicalize(
+						if let Some((alias, _, _)) = &node.node.direct {
-                            node_container_folder.join(
+							link_files(
-                                node.node
+								&base_folder,
-                                    .base_folder(version_id, dependency_node.target.kind()),
+								&container_folder,
-                            ),
+								&base_folder,
-                        )
+								container_folder.strip_prefix(&base_folder).unwrap(),
-                        .await?;
+								&node,
+								&package_id,
+								alias,
+								true,
+							)?;
+						}
 
-                        self.link_files(
+						(container_folder, base_folder)
-                            &linker_folder,
+					};
-                            &container_folder,
-                            &node_packages_folder,
-                            container_folder.strip_prefix(&base_folder).unwrap(),
-                            dependency_node,
-                            dependency_name,
-                            dependency_version_id,
-                            dependency_alias,
-                            &package_types,
-                            &manifest,
-                        )
-                        .await?;
-                    }
 
-                    Ok(())
+					for (dep_id, dep_alias) in &node.node.dependencies {
-                }
+						let dep_id = dep_id.clone();
-                .instrument(span)
+						let dep_alias = dep_alias.clone();
-            })
+						let graph = graph.clone();
-        }))
+						let node = node.clone();
-        .await
+						let package_id = package_id.clone();
-        .map(|_| ())
+						let node_container_folder = node_container_folder.clone();
-    }
+						let node_packages_folder = node_packages_folder.clone();
+						let package_dir = self.package_dir().to_path_buf();
+
+						dependency_tasks.spawn(async move {
+							let Some(dep_node) = graph.get(&dep_id) else {
+								return if is_complete {
+									Err(errors::LinkingError::DependencyNotFound(
+										dep_id.to_string(),
+										package_id.to_string(),
+									))
+								} else {
+									Ok(None)
+								};
+							};
+
+							let base_folder = package_dir.join(
+								package_id
+									.version_id()
+									.target()
+									.packages_folder(dep_id.version_id().target()),
+							);
+							let linker_folder = node_container_folder.join(node.node.dependencies_dir(
+								package_id.version_id(),
+								dep_id.version_id().target(),
+							));
+
+							Ok(Some((
+								dep_node.clone(),
+								dep_id,
+								dep_alias,
+								create_and_canonicalize(base_folder).await?,
+								create_and_canonicalize(linker_folder).await?,
+								node_packages_folder,
+							)))
+						});
+					}
+				},
+				Some(res) = dependency_tasks.join_next() => {
+					let Some((
+						dependency_node,
+						dependency_id,
+						dependency_alias,
+						base_folder,
+						linker_folder,
+						node_packages_folder,
+					)) = res.unwrap()?
+					else {
+						continue;
+					};
+
+					let packages_container_folder = base_folder.join(PACKAGES_CONTAINER_NAME);
+
+					let container_folder = packages_container_folder
+						.join(dependency_node.node.container_folder(&dependency_id));
+
+					link_files(
+						&linker_folder,
+						&container_folder,
+						&node_packages_folder,
+						container_folder.strip_prefix(&base_folder).unwrap(),
+						&dependency_node,
+						&dependency_id,
+						&dependency_alias,
+						false,
+					)?;
+				},
+				else => break,
+			}
+		}
+
+		while let Some(task) = tasks.join_next().await {
+			task.unwrap()?;
+		}
+
+		Ok(())
+	}
 }
 
 /// Errors that can occur while linking dependencies
 pub mod errors {
-    use thiserror::Error;
+	use thiserror::Error;
 
-    /// Errors that can occur while linking dependencies
+	/// Errors that can occur while linking dependencies
-    #[derive(Debug, Error)]
+	#[derive(Debug, Error)]
-    #[non_exhaustive]
+	#[non_exhaustive]
-    pub enum LinkingError {
+	pub enum LinkingError {
-        /// An error occurred while deserializing the project manifest
+		/// An error occurred while deserializing the project manifest
-        #[error("error deserializing project manifest")]
+		#[error("error deserializing project manifest")]
-        Manifest(#[from] crate::errors::ManifestReadError),
+		Manifest(#[from] crate::errors::ManifestReadError),
 
-        /// An error occurred while interacting with the filesystem
+		/// An error occurred while interacting with the filesystem
-        #[error("error interacting with filesystem")]
+		#[error("error interacting with filesystem")]
-        Io(#[from] std::io::Error),
+		Io(#[from] std::io::Error),
 
-        /// A dependency was not found
+		/// A dependency was not found
-        #[error("dependency `{0}` of `{1}` not found")]
+		#[error("dependency `{0}` of `{1}` not found")]
-        DependencyNotFound(String, String),
+		DependencyNotFound(String, String),
 
-        /// The library file was not found
+		/// The library file was not found
-        #[error("library file at {0} not found")]
+		#[error("library file at {0} not found")]
-        LibFileNotFound(String),
+		LibFileNotFound(String),
 
-        /// An error occurred while parsing a Luau script
+		/// Executing a script failed
-        #[error("error parsing Luau script at {0}")]
+		#[error("error executing script")]
-        FullMoon(String, Vec<full_moon::Error>),
+		ExecuteScript(#[from] crate::scripts::errors::ExecuteScriptError),
 
-        /// An error occurred while generating a Roblox sync config
+		/// An error occurred while getting the require path for a library
-        #[error("error generating roblox sync config for {0}")]
+		#[error("error getting require path for library")]
-        GenerateRobloxSyncConfig(String, #[source] std::io::Error),
+		GetLibRequirePath(#[from] super::generator::errors::GetLibRequirePath),
-
+	}
-        /// An error occurred while getting the require path for a library
-        #[error("error getting require path for library")]
-        GetLibRequirePath(#[from] super::generator::errors::GetLibRequirePath),
-    }
 }

src/lockfile.rs

@@ -1,113 +1,145 @@
+#![allow(deprecated)]
 use crate::{
-    manifest::{
+	graph::DependencyGraph,
-        overrides::OverrideKey,
+	manifest::{overrides::OverrideKey, target::TargetKind},
-        target::{Target, TargetKind},
+	names::PackageName,
-        DependencyType,
+	source::specifiers::DependencySpecifiers,
-    },
-    names::{PackageName, PackageNames},
-    source::{
-        refs::PackageRefs, specifiers::DependencySpecifiers, traits::PackageRef,
-        version_id::VersionId,
-    },
 };
 use relative_path::RelativePathBuf;
 use semver::Version;
 use serde::{Deserialize, Serialize};
-use std::{
+use std::collections::BTreeMap;
-    collections::BTreeMap,
-    path::{Path, PathBuf},
-};
-
-/// A graph of dependencies
-pub type Graph<Node> = BTreeMap<PackageNames, BTreeMap<VersionId, Node>>;
-
-/// A dependency graph node
-#[derive(Serialize, Deserialize, Debug, Clone)]
-pub struct DependencyGraphNode {
-    /// The alias, specifier, and original (as in the manifest) type for the dependency, if it is a direct dependency (i.e. used by the current project)
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub direct: Option<(String, DependencySpecifiers, DependencyType)>,
-    /// The dependencies of the package
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub dependencies: BTreeMap<PackageNames, (VersionId, String)>,
-    /// The resolved (transformed, for example Peer -> Standard) type of the dependency
-    pub resolved_ty: DependencyType,
-    /// Whether the resolved type should be Peer if this isn't depended on
-    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
-    pub is_peer: bool,
-    /// The package reference
-    pub pkg_ref: PackageRefs,
-}
-
-impl DependencyGraphNode {
-    pub(crate) fn base_folder(&self, version_id: &VersionId, project_target: TargetKind) -> String {
-        if self.pkg_ref.use_new_structure() {
-            version_id.target().packages_folder(&project_target)
-        } else {
-            "..".to_string()
-        }
-    }
-
-    /// Returns the folder to store the contents of the package in
-    pub fn container_folder<P: AsRef<Path>>(
-        &self,
-        path: &P,
-        name: &PackageNames,
-        version: &Version,
-    ) -> PathBuf {
-        if self.pkg_ref.like_wally() {
-            return path
-                .as_ref()
-                .join(format!(
-                    "{}_{}@{}",
-                    name.as_str().0,
-                    name.as_str().1,
-                    version
-                ))
-                .join(name.as_str().1);
-        }
-
-        path.as_ref()
-            .join(name.escaped())
-            .join(version.to_string())
-            .join(name.as_str().1)
-    }
-}
-
-/// A graph of `DependencyGraphNode`s
-pub type DependencyGraph = Graph<DependencyGraphNode>;
-
-/// A downloaded dependency graph node, i.e. a `DependencyGraphNode` with a `Target`
-#[derive(Serialize, Deserialize, Debug, Clone)]
-pub struct DownloadedDependencyGraphNode {
-    /// The target of the package
-    pub target: Target,
-    /// The node
-    #[serde(flatten)]
-    pub node: DependencyGraphNode,
-}
-
-/// A graph of `DownloadedDependencyGraphNode`s
-pub type DownloadedGraph = Graph<DownloadedDependencyGraphNode>;
 
 /// A lockfile
 #[derive(Serialize, Deserialize, Debug, Clone)]
 pub struct Lockfile {
-    /// The name of the package
+	/// The name of the package
-    pub name: PackageName,
+	pub name: PackageName,
-    /// The version of the package
+	/// The version of the package
-    pub version: Version,
+	pub version: Version,
-    /// The target of the package
+	/// The target of the package
-    pub target: TargetKind,
+	pub target: TargetKind,
-    /// The overrides of the package
+	/// The overrides of the package
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+	#[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub overrides: BTreeMap<OverrideKey, DependencySpecifiers>,
+	pub overrides: BTreeMap<OverrideKey, DependencySpecifiers>,
 
-    /// The workspace members
+	/// The workspace members
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+	#[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub workspace: BTreeMap<PackageName, BTreeMap<TargetKind, RelativePathBuf>>,
+	pub workspace: BTreeMap<PackageName, BTreeMap<TargetKind, RelativePathBuf>>,
 
-    /// The graph of dependencies
+	/// The graph of dependencies
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+	#[serde(default, skip_serializing_if = "DependencyGraph::is_empty")]
-    pub graph: DownloadedGraph,
+	pub graph: DependencyGraph,
+}
+
+/// Old lockfile stuff. Will be removed in a future version.
+#[deprecated(
+	note = "Intended to be used to migrate old lockfiles to the new format. Will be removed in a future version."
+)]
+pub mod old {
+	use crate::{
+		manifest::{
+			overrides::OverrideKey,
+			target::{Target, TargetKind},
+			Alias, DependencyType,
+		},
+		names::{PackageName, PackageNames},
+		source::{
+			ids::{PackageId, VersionId},
+			refs::PackageRefs,
+			specifiers::DependencySpecifiers,
+		},
+	};
+	use relative_path::RelativePathBuf;
+	use semver::Version;
+	use serde::{Deserialize, Serialize};
+	use std::collections::BTreeMap;
+
+	/// An old dependency graph node
+	#[derive(Serialize, Deserialize, Debug, Clone)]
+	pub struct DependencyGraphNodeOld {
+		/// The alias, specifier, and original (as in the manifest) type for the dependency, if it is a direct dependency (i.e. used by the current project)
+		#[serde(default, skip_serializing_if = "Option::is_none")]
+		pub direct: Option<(Alias, DependencySpecifiers, DependencyType)>,
+		/// The dependencies of the package
+		#[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+		pub dependencies: BTreeMap<PackageNames, (VersionId, Alias)>,
+		/// The resolved (transformed, for example Peer -> Standard) type of the dependency
+		pub resolved_ty: DependencyType,
+		/// Whether the resolved type should be Peer if this isn't depended on
+		#[serde(default, skip_serializing_if = "std::ops::Not::not")]
+		pub is_peer: bool,
+		/// The package reference
+		pub pkg_ref: PackageRefs,
+	}
+
+	/// A downloaded dependency graph node, i.e. a `DependencyGraphNode` with a `Target`
+	#[derive(Serialize, Deserialize, Debug, Clone)]
+	pub struct DownloadedDependencyGraphNodeOld {
+		/// The target of the package
+		pub target: Target,
+		/// The node
+		#[serde(flatten)]
+		pub node: DependencyGraphNodeOld,
+	}
+
+	/// An old version of a lockfile
+	#[derive(Serialize, Deserialize, Debug, Clone)]
+	pub struct LockfileOld {
+		/// The name of the package
+		pub name: PackageName,
+		/// The version of the package
+		pub version: Version,
+		/// The target of the package
+		pub target: TargetKind,
+		/// The overrides of the package
+		#[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+		pub overrides: BTreeMap<OverrideKey, DependencySpecifiers>,
+
+		/// The workspace members
+		#[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+		pub workspace: BTreeMap<PackageName, BTreeMap<TargetKind, RelativePathBuf>>,
+
+		/// The graph of dependencies
+		#[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+		pub graph: BTreeMap<PackageNames, BTreeMap<VersionId, DownloadedDependencyGraphNodeOld>>,
+	}
+
+	impl LockfileOld {
+		/// Converts this lockfile to a new lockfile
+		pub fn to_new(self) -> super::Lockfile {
+			super::Lockfile {
+				name: self.name,
+				version: self.version,
+				target: self.target,
+				overrides: self.overrides,
+				workspace: self.workspace,
+				graph: self
+					.graph
+					.into_iter()
+					.flat_map(|(name, versions)| {
+						versions.into_iter().map(move |(version, node)| {
+							(
+								PackageId(name.clone(), version),
+								crate::graph::DependencyGraphNode {
+									direct: node.node.direct,
+									dependencies: node
+										.node
+										.dependencies
+										.into_iter()
+										.map(|(name, (version, alias))| {
+											(PackageId(name, version), alias)
+										})
+										.collect(),
+									resolved_ty: node.node.resolved_ty,
+									is_peer: node.node.is_peer,
+									pkg_ref: node.node.pkg_ref,
+								},
+							)
+						})
+					})
+					.collect(),
+			}
+		}
+	}
 }

src/main.rs

@@ -1,326 +1,340 @@
 #[cfg(feature = "version-management")]
-use crate::cli::version::{check_for_updates, get_or_download_version, TagInfo};
+use crate::cli::version::{check_for_updates, current_version, get_or_download_engine};
 use crate::cli::{auth::get_tokens, display_err, home_dir, HOME_DIR};
 use anyhow::Context;
 use clap::{builder::styling::AnsiColor, Parser};
 use fs_err::tokio as fs;
-use pesde::{matching_globs, AuthConfig, Project, MANIFEST_FILE_NAME};
+use indicatif::MultiProgress;
+use pesde::{engine::EngineKind, find_roots, version_matches, AuthConfig, Project};
+use semver::VersionReq;
 use std::{
-    collections::HashSet,
+	io,
-    path::{Path, PathBuf},
+	path::{Path, PathBuf},
+	str::FromStr,
+	sync::Mutex,
 };
 use tempfile::NamedTempFile;
 use tracing::instrument;
-use tracing_indicatif::{filter::IndicatifFilter, IndicatifLayer};
 use tracing_subscriber::{
-    filter::LevelFilter, layer::SubscriberExt, util::SubscriberInitExt, EnvFilter, Layer,
+	filter::LevelFilter, fmt::MakeWriter, layer::SubscriberExt, util::SubscriberInitExt, EnvFilter,
 };
 
 mod cli;
 pub mod util;
 
 const STYLES: clap::builder::Styles = clap::builder::Styles::styled()
-    .header(AnsiColor::Yellow.on_default().underline())
+	.header(AnsiColor::Yellow.on_default().underline())
-    .usage(AnsiColor::Yellow.on_default().underline())
+	.usage(AnsiColor::Yellow.on_default().underline())
-    .literal(AnsiColor::Green.on_default().bold())
+	.literal(AnsiColor::Green.on_default().bold())
-    .placeholder(AnsiColor::Cyan.on_default());
+	.placeholder(AnsiColor::Cyan.on_default());
 
 #[derive(Parser, Debug)]
 #[clap(
-    version,
+	version,
-    about = "A package manager for the Luau programming language",
+	about = "A package manager for the Luau programming language",
-    long_about = "A package manager for the Luau programming language, supporting multiple runtimes including Roblox and Lune"
+	long_about = "A package manager for the Luau programming language, supporting multiple runtimes including Roblox and Lune"
 )]
 #[command(disable_version_flag = true, styles = STYLES)]
 struct Cli {
-    /// Print version
+	/// Print version
-    #[arg(short = 'v', short_alias = 'V', long, action = clap::builder::ArgAction::Version)]
+	#[arg(short = 'v', short_alias = 'V', long, action = clap::builder::ArgAction::Version)]
-    version: (),
+	version: (),
 
-    #[command(subcommand)]
+	#[command(subcommand)]
-    subcommand: cli::commands::Subcommand,
+	subcommand: cli::commands::Subcommand,
 }
 
 #[instrument(level = "trace")]
 async fn get_linkable_dir(path: &Path) -> PathBuf {
-    let mut curr_path = PathBuf::new();
+	let mut curr_path = PathBuf::new();
-    let file_to_try = NamedTempFile::new_in(path).expect("failed to create temporary file");
+	let file_to_try = NamedTempFile::new_in(path).expect("failed to create temporary file");
 
-    let temp_path = tempfile::Builder::new()
+	let temp_path = tempfile::Builder::new()
-        .make(|_| Ok(()))
+		.make(|_| Ok(()))
-        .expect("failed to create temporary file")
+		.expect("failed to create temporary file")
-        .into_temp_path();
+		.into_temp_path();
-    let temp_file_name = temp_path.file_name().expect("failed to get file name");
+	let temp_file_name = temp_path.file_name().expect("failed to get file name");
 
-    // C: and \ are different components on Windows
+	// C: and \ are different components on Windows
-    #[cfg(windows)]
+	#[cfg(windows)]
-    let components = path.components().map(|c| {
+	let components = path.components().map(|c| {
-        let mut path = c.as_os_str().to_os_string();
+		let mut path = c.as_os_str().to_os_string();
-        if let std::path::Component::Prefix(_) = c {
+		if let std::path::Component::Prefix(_) = c {
-            path.push(std::path::MAIN_SEPARATOR_STR);
+			path.push(std::path::MAIN_SEPARATOR_STR);
-        }
+		}
 
-        path
+		path
-    });
+	});
-    #[cfg(not(windows))]
+	#[cfg(not(windows))]
-    let components = path.components().map(|c| c.as_os_str().to_os_string());
+	let components = path.components().map(|c| c.as_os_str().to_os_string());
 
-    for component in components {
+	for component in components {
-        curr_path.push(component);
+		curr_path.push(component);
 
-        let try_path = curr_path.join(temp_file_name);
+		let try_path = curr_path.join(temp_file_name);
 
-        if fs::hard_link(file_to_try.path(), &try_path).await.is_ok() {
+		if fs::hard_link(file_to_try.path(), &try_path).await.is_ok() {
-            if let Err(err) = fs::remove_file(&try_path).await {
+			if let Err(err) = fs::remove_file(&try_path).await {
-                tracing::warn!(
+				tracing::warn!(
-                    "failed to remove temporary file at {}: {err}",
+					"failed to remove temporary file at {}: {err}",
-                    try_path.display()
+					try_path.display()
-                );
+				);
-            }
+			}
 
-            return curr_path;
+			return curr_path;
-        }
+		}
-    }
+	}
 
-    panic!(
+	panic!(
-        "couldn't find a linkable directory for any point in {}",
+		"couldn't find a linkable directory for any point in {}",
-        curr_path.display()
+		curr_path.display()
-    );
+	);
+}
+
+pub static PROGRESS_BARS: Mutex<Option<MultiProgress>> = Mutex::new(None);
+
+#[derive(Clone, Copy)]
+pub struct IndicatifWriter;
+
+impl IndicatifWriter {
+	fn suspend<F: FnOnce() -> R, R>(f: F) -> R {
+		match *PROGRESS_BARS.lock().unwrap() {
+			Some(ref progress_bars) => progress_bars.suspend(f),
+			None => f(),
+		}
+	}
+}
+
+impl io::Write for IndicatifWriter {
+	fn write(&mut self, buf: &[u8]) -> io::Result<usize> {
+		Self::suspend(|| io::stderr().write(buf))
+	}
+
+	fn flush(&mut self) -> io::Result<()> {
+		Self::suspend(|| io::stderr().flush())
+	}
+
+	fn write_vectored(&mut self, bufs: &[io::IoSlice<'_>]) -> io::Result<usize> {
+		Self::suspend(|| io::stderr().write_vectored(bufs))
+	}
+
+	fn write_all(&mut self, buf: &[u8]) -> io::Result<()> {
+		Self::suspend(|| io::stderr().write_all(buf))
+	}
+
+	fn write_fmt(&mut self, fmt: std::fmt::Arguments<'_>) -> io::Result<()> {
+		Self::suspend(|| io::stderr().write_fmt(fmt))
+	}
+}
+
+impl<'a> MakeWriter<'a> for IndicatifWriter {
+	type Writer = IndicatifWriter;
+
+	fn make_writer(&'a self) -> Self::Writer {
+		*self
+	}
 }
 
 async fn run() -> anyhow::Result<()> {
-    let cwd = std::env::current_dir().expect("failed to get current working directory");
+	let cwd = std::env::current_dir().expect("failed to get current working directory");
+	// Unix doesn't return the symlinked path, so we need to get it from the 0 argument
+	#[cfg(unix)]
+	let current_exe = PathBuf::from(std::env::args_os().next().expect("argument 0 not set"));
+	#[cfg(not(unix))]
+	let current_exe = std::env::current_exe().expect("failed to get current executable path");
+	let exe_name = current_exe
+		.file_stem()
+		.unwrap()
+		.to_str()
+		.expect("exe name is not valid utf-8");
+	let exe_name_engine = EngineKind::from_str(exe_name);
 
-    #[cfg(windows)]
+	#[cfg(windows)]
-    'scripts: {
+	'scripts: {
-        let exe = std::env::current_exe().expect("failed to get current executable path");
+		// if we're an engine, we don't want to run any scripts
-        if exe.parent().is_some_and(|parent| {
+		if exe_name_engine.is_ok() {
-            parent.file_name().is_some_and(|parent| parent != "bin")
+			break 'scripts;
-                || parent
+		}
-                    .parent()
-                    .and_then(|parent| parent.file_name())
-                    .is_some_and(|parent| parent != HOME_DIR)
-        }) {
-            break 'scripts;
-        }
 
-        let exe_name = exe.file_name().unwrap().to_string_lossy();
+		if let Some(bin_folder) = current_exe.parent() {
-        let exe_name = exe_name
+			// we're not in {path}/bin/{exe}
-            .strip_suffix(std::env::consts::EXE_SUFFIX)
+			if bin_folder.file_name().is_some_and(|parent| parent != "bin") {
-            .unwrap_or(&exe_name);
+				break 'scripts;
+			}
 
-        if exe_name == env!("CARGO_BIN_NAME") {
+			// we're not in {path}/.pesde/bin/{exe}
-            break 'scripts;
+			if bin_folder
-        }
+				.parent()
+				.and_then(|home_folder| home_folder.file_name())
+				.is_some_and(|home_folder| home_folder != HOME_DIR)
+			{
+				break 'scripts;
+			}
+		}
 
-        // the bin script will search for the project root itself, so we do that to ensure
+		// the bin script will search for the project root itself, so we do that to ensure
-        // consistency across platforms, since the script is executed using a shebang
+		// consistency across platforms, since the script is executed using a shebang
-        // on unix systems
+		// on unix systems
-        let status = std::process::Command::new("lune")
+		let status = std::process::Command::new("lune")
-            .arg("run")
+			.arg("run")
-            .arg(
+			.arg(
-                exe.parent()
+				current_exe
-                    .map(|p| p.join(".impl").join(exe.file_name().unwrap()))
+					.parent()
-                    .unwrap_or(exe)
+					.unwrap_or(&current_exe)
-                    .with_extension("luau"),
+					.join(".impl")
-            )
+					.join(current_exe.file_name().unwrap())
-            .arg("--")
+					.with_extension("luau"),
-            .args(std::env::args_os().skip(1))
+			)
-            .current_dir(cwd)
+			.arg("--")
-            .status()
+			.args(std::env::args_os().skip(1))
-            .expect("failed to run lune");
+			.current_dir(cwd)
+			.status()
+			.expect("failed to run lune");
 
-        std::process::exit(status.code().unwrap());
+		std::process::exit(status.code().unwrap());
-    }
+	}
 
-    let indicatif_layer = IndicatifLayer::new().with_filter(IndicatifFilter::new(false));
+	let tracing_env_filter = EnvFilter::builder()
+		.with_default_directive(LevelFilter::INFO.into())
+		.from_env_lossy()
+		.add_directive("reqwest=info".parse().unwrap())
+		.add_directive("rustls=info".parse().unwrap())
+		.add_directive("tokio_util=info".parse().unwrap())
+		.add_directive("goblin=info".parse().unwrap())
+		.add_directive("tower=info".parse().unwrap())
+		.add_directive("hyper=info".parse().unwrap())
+		.add_directive("h2=info".parse().unwrap());
 
-    let tracing_env_filter = EnvFilter::builder()
+	let fmt_layer = tracing_subscriber::fmt::layer().with_writer(IndicatifWriter);
-        .with_default_directive(LevelFilter::INFO.into())
-        .from_env_lossy()
-        .add_directive("reqwest=info".parse().unwrap())
-        .add_directive("rustls=info".parse().unwrap())
-        .add_directive("tokio_util=info".parse().unwrap())
-        .add_directive("goblin=info".parse().unwrap())
-        .add_directive("tower=info".parse().unwrap())
-        .add_directive("hyper=info".parse().unwrap())
-        .add_directive("h2=info".parse().unwrap());
 
-    let fmt_layer =
+	#[cfg(debug_assertions)]
-        tracing_subscriber::fmt::layer().with_writer(indicatif_layer.inner().get_stderr_writer());
+	let fmt_layer = fmt_layer.with_timer(tracing_subscriber::fmt::time::uptime());
 
-    #[cfg(debug_assertions)]
+	#[cfg(not(debug_assertions))]
-    let fmt_layer = fmt_layer.with_timer(tracing_subscriber::fmt::time::uptime());
+	let fmt_layer = fmt_layer
+		.pretty()
+		.with_timer(())
+		.with_line_number(false)
+		.with_file(false)
+		.with_target(false);
 
-    #[cfg(not(debug_assertions))]
+	tracing_subscriber::registry()
-    let fmt_layer = fmt_layer
+		.with(tracing_env_filter)
-        .pretty()
+		.with(fmt_layer)
-        .with_timer(())
+		.init();
-        .with_line_number(false)
-        .with_file(false)
-        .with_target(false);
 
-    tracing_subscriber::registry()
+	let (project_root_dir, project_workspace_dir) = find_roots(cwd.clone())
-        .with(tracing_env_filter)
+		.await
-        .with(fmt_layer)
+		.context("failed to find project root")?;
-        .with(indicatif_layer)
-        .init();
 
-    let (project_root_dir, project_workspace_dir) = 'finder: {
+	tracing::trace!(
-        let mut current_path = Some(cwd.clone());
+		"project root: {}\nworkspace root: {}",
-        let mut project_root = None::<PathBuf>;
+		project_root_dir.display(),
-        let mut workspace_dir = None::<PathBuf>;
+		project_workspace_dir
+			.as_ref()
+			.map_or("none".to_string(), |p| p.display().to_string())
+	);
 
-        async fn get_workspace_members(path: &Path) -> anyhow::Result<HashSet<PathBuf>> {
+	let home_dir = home_dir()?;
-            let manifest = fs::read_to_string(path.join(MANIFEST_FILE_NAME))
+	let data_dir = home_dir.join("data");
-                .await
+	fs::create_dir_all(&data_dir)
-                .context("failed to read manifest")?;
+		.await
-            let manifest: pesde::manifest::Manifest =
+		.expect("failed to create data directory");
-                toml::from_str(&manifest).context("failed to parse manifest")?;
 
-            if manifest.workspace_members.is_empty() {
+	let cas_dir = get_linkable_dir(&project_root_dir).await.join(HOME_DIR);
-                return Ok(HashSet::new());
-            }
 
-            matching_globs(
+	let cas_dir = if cas_dir == home_dir {
-                path,
+		&data_dir
-                manifest.workspace_members.iter().map(|s| s.as_str()),
+	} else {
-                false,
+		&cas_dir
-                false,
+	}
-            )
+	.join("cas");
-            .await
-            .context("failed to get workspace members")
-        }
 
-        while let Some(path) = current_path {
+	tracing::debug!("using cas dir in {}", cas_dir.display());
-            current_path = path.parent().map(|p| p.to_path_buf());
 
-            if !path.join(MANIFEST_FILE_NAME).exists() {
+	let project = Project::new(
-                continue;
+		project_root_dir,
-            }
+		project_workspace_dir,
+		data_dir,
+		cas_dir,
+		AuthConfig::new().with_tokens(get_tokens().await?.0),
+	);
 
-            match (project_root.as_ref(), workspace_dir.as_ref()) {
+	let reqwest = {
-                (Some(project_root), Some(workspace_dir)) => {
+		let mut headers = reqwest::header::HeaderMap::new();
-                    break 'finder (project_root.clone(), Some(workspace_dir.clone()));
-                }
 
-                (Some(project_root), None) => {
+		headers.insert(
-                    if get_workspace_members(&path).await?.contains(project_root) {
+			reqwest::header::ACCEPT,
-                        workspace_dir = Some(path);
+			"application/json"
-                    }
+				.parse()
-                }
+				.context("failed to create accept header")?,
+		);
 
-                (None, None) => {
+		reqwest::Client::builder()
-                    if get_workspace_members(&path).await?.contains(&cwd) {
+			.user_agent(concat!(
-                        // initializing a new member of a workspace
+				env!("CARGO_PKG_NAME"),
-                        break 'finder (cwd, Some(path));
+				"/",
-                    } else {
+				env!("CARGO_PKG_VERSION")
-                        project_root = Some(path);
+			))
-                    }
+			.default_headers(headers)
-                }
+			.build()?
+	};
 
-                (None, Some(_)) => unreachable!(),
+	#[cfg(feature = "version-management")]
-            }
+	'engines: {
-        }
+		let Ok(engine) = exe_name_engine else {
+			break 'engines;
+		};
 
-        // we mustn't expect the project root to be found, as that would
+		let req = match project.deser_manifest().await {
-        // disable the ability to run pesde in a non-project directory (for example to init it)
+			Ok(mut manifest) => manifest.engines.remove(&engine),
-        (project_root.unwrap_or_else(|| cwd.clone()), workspace_dir)
+			Err(pesde::errors::ManifestReadError::Io(e)) if e.kind() == io::ErrorKind::NotFound => {
-    };
+				None
+			}
+			Err(e) => return Err(e.into()),
+		};
 
-    tracing::trace!(
+		if engine == EngineKind::Pesde {
-        "project root: {}\nworkspace root: {}",
+			match &req {
-        project_root_dir.display(),
+				// we're already running a compatible version
-        project_workspace_dir
+				Some(req) if version_matches(req, &current_version()) => break 'engines,
-            .as_ref()
+				// the user has not requested a specific version, so we'll just use the current one
-            .map_or("none".to_string(), |p| p.display().to_string())
+				None => break 'engines,
-    );
+				_ => (),
+			}
+		}
 
-    let home_dir = home_dir()?;
+		let exe_path =
-    let data_dir = home_dir.join("data");
+			get_or_download_engine(&reqwest, engine, req.unwrap_or(VersionReq::STAR)).await?;
-    fs::create_dir_all(&data_dir)
+		if exe_path == current_exe {
-        .await
+			anyhow::bail!("engine linker executed by itself")
-        .expect("failed to create data directory");
+		}
 
-    let cas_dir = get_linkable_dir(&project_root_dir).await.join(HOME_DIR);
+		let status = std::process::Command::new(exe_path)
+			.args(std::env::args_os().skip(1))
+			.status()
+			.expect("failed to run new version");
 
-    let cas_dir = if cas_dir == home_dir {
+		std::process::exit(status.code().unwrap());
-        &data_dir
+	}
-    } else {
-        &cas_dir
-    }
-    .join("cas");
 
-    tracing::debug!("using cas dir in {}", cas_dir.display());
+	#[cfg(feature = "version-management")]
+	display_err(
+		check_for_updates(&reqwest).await,
+		" while checking for updates",
+	);
 
-    let project = Project::new(
+	let cli = Cli::parse();
-        project_root_dir,
-        project_workspace_dir,
-        data_dir,
-        cas_dir,
-        AuthConfig::new().with_tokens(get_tokens().await?.0),
-    );
 
-    let reqwest = {
+	cli.subcommand.run(project, reqwest).await
-        let mut headers = reqwest::header::HeaderMap::new();
-
-        headers.insert(
-            reqwest::header::ACCEPT,
-            "application/json"
-                .parse()
-                .context("failed to create accept header")?,
-        );
-
-        reqwest::Client::builder()
-            .user_agent(concat!(
-                env!("CARGO_PKG_NAME"),
-                "/",
-                env!("CARGO_PKG_VERSION")
-            ))
-            .default_headers(headers)
-            .build()?
-    };
-
-    #[cfg(feature = "version-management")]
-    {
-        let target_version = project
-            .deser_manifest()
-            .await
-            .ok()
-            .and_then(|manifest| manifest.pesde_version);
-
-        let exe_path = if let Some(version) = target_version {
-            get_or_download_version(&reqwest, &TagInfo::Incomplete(version), false).await?
-        } else {
-            None
-        };
-
-        if let Some(exe_path) = exe_path {
-            let status = std::process::Command::new(exe_path)
-                .args(std::env::args_os().skip(1))
-                .status()
-                .expect("failed to run new version");
-
-            std::process::exit(status.code().unwrap());
-        }
-
-        display_err(
-            check_for_updates(&reqwest).await,
-            " while checking for updates",
-        );
-    }
-
-    let cli = Cli::parse();
-
-    cli.subcommand.run(project, reqwest).await
 }
 
 #[tokio::main]
 async fn main() {
-    let result = run().await;
+	let result = run().await;
-    let is_err = result.is_err();
+	let is_err = result.is_err();
-    display_err(result, "");
+	display_err(result, "");
-    if is_err {
+	if is_err {
-        std::process::exit(1);
+		std::process::exit(1);
-    }
+	}
 }