@askrjs/cli 0.0.7 → 0.0.8

package/dist/add.js

@@ -226,9 +226,18 @@ function renderServerActionRegistry(actions) {
 		...actions.map((action) => `import { ${action.handlerName} } from './actions/${action.slug}.js';`),
 		"import type { AppDependencies } from './dependencies.js';",
 		"",
+		"function csrfSecret(): string {",
+		"  const secret = process.env.CSRF_SECRET;",
+		"  if (process.env.NODE_ENV !== 'production') return secret ?? 'development-only-secret';",
+		"  if (!secret || secret.length < 32 || new Set(secret).size < 12) {",
+		"    throw new Error('Production requires a strong CSRF_SECRET (at least 32 varied characters).');",
+		"  }",
+		"  return secret;",
+		"}",
+		"",
 		"export function createActions(deps: AppDependencies) {",
 		"  return defineServerActions({ dependencies: deps,",
-		"    csrf: { secret: process.env.CSRF_SECRET ?? 'development-only-secret' },",
+		"    csrf: { secret: csrfSecret() },",
 		"  },",
 		...actions.map((action) => `    handleAction(${action.descriptorName}, ${action.handlerName}),`),
 		"  );",

package/dist/{discovery-Djq8TxJu.js → discovery-BX-lnFRK.js}

@@ -1,5 +1,4 @@
-import { t as analyzeRange } from "./range-YUs9eimn.js";
-import { t as parseDependencySpecification } from "./specification-DXnDOC-0.js";
+import { n as analyzeRange, t as parseDependencySpecification } from "./specification-BSlq_n9A.js";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { load } from "js-yaml";

package/dist/generate.js

@@ -1,6 +1,9 @@
-import { mkdir, mkdtemp, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
-import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { mkdir, mkdtemp, readFile, readdir, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import { lookup } from "node:dns/promises";
+import { request } from "node:https";
+import { BlockList, isIP } from "node:net";
 import { load } from "js-yaml";
 //#region src/generate/generator.ts
 const OWNED = [
@@ -119,30 +122,202 @@ function parseOpenApiDocument(contents, source) {
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new GenerationError(`OpenAPI document must be an object: ${source}`);
 	return parsed;
 }
-async function readSource(uri) {
-	if (uri.startsWith("http://") || uri.startsWith("https://")) {
-		const response = await fetch(uri);
-		if (!response.ok) throw new GenerationError(`Unable to fetch OpenAPI reference ${uri}: ${response.status} ${response.statusText}`);
+const blockedAddresses = new BlockList();
+for (const [network, prefix] of [
+	["0.0.0.0", 8],
+	["10.0.0.0", 8],
+	["100.64.0.0", 10],
+	["127.0.0.0", 8],
+	["169.254.0.0", 16],
+	["172.16.0.0", 12],
+	["192.0.0.0", 24],
+	["192.0.2.0", 24],
+	["192.168.0.0", 16],
+	["198.18.0.0", 15],
+	["198.51.100.0", 24],
+	["203.0.113.0", 24],
+	["224.0.0.0", 4],
+	["240.0.0.0", 4]
+]) blockedAddresses.addSubnet(network, prefix, "ipv4");
+for (const [network, prefix] of [
+	["::", 128],
+	["::1", 128],
+	["fc00::", 7],
+	["fe80::", 10],
+	["ff00::", 8],
+	["2001:db8::", 32],
+	["2001:2::", 48]
+]) blockedAddresses.addSubnet(network, prefix, "ipv6");
+function privateAddress(address) {
+	const family = isIP(address);
+	if (family === 4) return blockedAddresses.check(address, "ipv4");
+	if (family !== 6) return true;
+	const mappedSuffix = /^::ffff:(.+)$/i.exec(address)?.[1];
+	const mapped = mappedSuffix?.includes(".") ? mappedSuffix : mappedSuffix && /^[0-9a-f]{1,4}:[0-9a-f]{1,4}$/i.test(mappedSuffix) ? mappedSuffix.split(":").flatMap((part) => {
+		const value = Number.parseInt(part, 16);
+		return [value >> 8, value & 255];
+	}).join(".") : void 0;
+	return mapped ? privateAddress(mapped) : blockedAddresses.check(address, "ipv6");
+}
+function remaining(deadline, uri) {
+	const value = deadline - Date.now();
+	if (value <= 0) throw new GenerationError(`Timed out fetching OpenAPI reference ${uri}`);
+	return value;
+}
+async function withDeadline(promise, deadline, uri) {
+	let timer;
+	try {
+		return await Promise.race([promise, new Promise((_, reject) => {
+			timer = setTimeout(() => reject(new GenerationError(`Timed out fetching OpenAPI reference ${uri}`)), remaining(deadline, uri));
+		})]);
+	} finally {
+		if (timer) clearTimeout(timer);
+	}
+}
+async function vettedAddresses(url, options, deadline) {
+	const hostname = url.hostname.replace(/^\[|\]$/g, "");
+	const answers = isIP(hostname) ? [{
+		address: hostname,
+		family: isIP(hostname)
+	}] : await withDeadline(lookup(hostname, {
+		all: true,
+		verbatim: true
+	}), deadline, url.href);
+	if (answers.length === 0 || !options.allowPrivateHosts && answers.some(({ address }) => privateAddress(address))) throw new GenerationError(`OpenAPI reference resolves to a private, reserved, or link-local address: ${url.origin}`);
+	return answers.map(({ address, family }) => ({
+		address,
+		family
+	}));
+}
+function retryableConnectionError(error) {
+	if (!(error instanceof Error)) return false;
+	const code = error.code ?? "";
+	return !/^ERR_TLS_|^CERT_|SELF_SIGNED|CERTIFICATE/.test(code) && [
+		"ECONNREFUSED",
+		"ECONNRESET",
+		"EHOSTUNREACH",
+		"ENETUNREACH",
+		"ETIMEDOUT",
+		"EPIPE"
+	].includes(code);
+}
+function requestAddress(url, vetted, deadline) {
+	return new Promise((resolve, reject) => {
+		let receivedHeaders = false;
+		const request$1 = request(url, {
+			method: "GET",
+			headers: {
+				accept: "application/json, application/yaml, text/yaml, */*",
+				"accept-encoding": "identity"
+			},
+			servername: url.hostname,
+			lookup: (_hostname, _options, callback) => callback(null, vetted.address, vetted.family)
+		}, (message) => {
+			receivedHeaders = true;
+			resolve({
+				status: message.statusCode ?? 0,
+				statusText: message.statusMessage ?? "",
+				headers: message.headers,
+				message
+			});
+		});
+		request$1.setTimeout(remaining(deadline, url.href), () => {
+			request$1.destroy(Object.assign(/* @__PURE__ */ new Error("connection timed out"), { code: "ETIMEDOUT" }));
+		});
+		request$1.on("error", (error) => reject(Object.assign(error, { receivedHeaders })));
+		request$1.end();
+	});
+}
+async function requestVetted(url, addresses, deadline) {
+	let lastError;
+	for (const address of addresses) try {
+		return await withDeadline(requestAddress(url, address, deadline), deadline, url.href);
+	} catch (error) {
+		lastError = error;
+		if (!retryableConnectionError(error)) throw error;
+	}
+	throw lastError;
+}
+async function responseText(response, uri, maxBytes, deadline) {
+	const declared = Number(response.headers["content-length"]);
+	if (Number.isFinite(declared) && declared > maxBytes) throw new GenerationError(`OpenAPI reference exceeds ${maxBytes} bytes: ${uri}`);
+	const encoding = response.headers["content-encoding"];
+	if (encoding && encoding !== "identity") throw new GenerationError(`OpenAPI reference returned unsupported content encoding: ${encoding}`);
+	const chunks = [];
+	let size = 0;
+	try {
+		await withDeadline(new Promise((resolve, reject) => {
+			response.message.on("data", (value) => {
+				size += value.byteLength;
+				if (size > maxBytes) {
+					response.message.destroy();
+					reject(new GenerationError(`OpenAPI reference exceeds ${maxBytes} bytes: ${uri}`));
+					return;
+				}
+				chunks.push(value);
+			});
+			response.message.on("end", resolve);
+			response.message.on("error", reject);
+			response.message.on("aborted", () => reject(new GenerationError(`OpenAPI response body was aborted: ${uri}`)));
+		}), deadline, uri);
+	} catch (error) {
+		response.message.destroy();
+		throw error;
+	}
+	if (size > maxBytes) throw new GenerationError(`OpenAPI reference exceeds ${maxBytes} bytes: ${uri}`);
+	return Buffer.concat(chunks).toString("utf8");
+}
+async function fetchSource(uri, options) {
+	let current = new URL(uri);
+	const deadline = Date.now() + options.timeoutMs;
+	for (let redirects = 0;; redirects += 1) {
+		if (current.protocol !== "https:") throw new GenerationError(`Remote OpenAPI references must use HTTPS: ${current.href}`);
+		if (current.username || current.password) throw new GenerationError(`Remote OpenAPI references must not include credentials: ${current.origin}`);
+		if (current.origin !== options.remoteRootOrigin && !options.allowedReferenceOrigins.has(current.origin)) throw new GenerationError(`Cross-origin OpenAPI reference is not allowed: ${current.origin}`);
+		const addresses = await vettedAddresses(current, options, deadline);
+		const response = await requestVetted(current, addresses, deadline);
+		if (response.status >= 300 && response.status < 400) {
+			if (redirects >= options.maxRedirects) throw new GenerationError(`Too many redirects while fetching OpenAPI reference ${uri}`);
+			response.message.resume();
+			const location = response.headers.location;
+			if (!location) throw new GenerationError(`OpenAPI redirect is missing Location: ${current.href}`);
+			current = new URL(location, current);
+			continue;
+		}
+		if (response.status < 200 || response.status >= 300) {
+			response.message.resume();
+			throw new GenerationError(`Unable to fetch OpenAPI reference ${current.href}: ${response.status} ${response.statusText}`);
+		}
 		return {
-			uri,
-			document: parseOpenApiDocument(await response.text(), uri)
+			uri: current.href,
+			document: parseOpenApiDocument(await responseText(response, current.href, options.maxBytes, deadline), current.href)
 		};
 	}
+}
+async function readSource(uri, options) {
+	if (uri.startsWith("http://") || uri.startsWith("https://")) return fetchSource(uri, options);
 	const path = fileURLToPath(uri);
+	const canonical = await realpath(path);
+	const relativePath = options.localRootDirectory ? relative(options.localRootDirectory, canonical) : "..";
+	if (!options.localRootDirectory || relativePath === ".." || relativePath.startsWith(`..${sep}`) || isAbsolute(relativePath)) throw new GenerationError(`Local OpenAPI reference escapes the specification directory: ${path}`);
+	const contents = await readFile(canonical);
+	if (contents.byteLength > options.maxBytes) throw new GenerationError(`OpenAPI reference exceeds ${options.maxBytes} bytes: ${path}`);
 	return {
-		uri,
-		document: parseOpenApiDocument(await readFile(path, "utf8"), path)
+		uri: pathToFileURL(canonical).href,
+		document: parseOpenApiDocument(contents.toString("utf8"), canonical)
 	};
 }
 var OpenApiBundler = class {
 	root;
 	rootUri;
+	options;
 	sources = /* @__PURE__ */ new Map();
 	aliases = /* @__PURE__ */ new Map();
 	names = /* @__PURE__ */ new Map();
-	constructor(root, rootUri) {
+	constructor(root, rootUri, options) {
 		this.root = root;
 		this.rootUri = rootUri;
+		this.options = options;
 	}
 	async bundle() {
 		if (!this.root.components) this.root.components = {};
@@ -153,7 +328,7 @@ var OpenApiBundler = class {
 	async source(uri) {
 		let pending = this.sources.get(uri);
 		if (!pending) {
-			pending = readSource(uri);
+			pending = readSource(uri, this.options);
 			this.sources.set(uri, pending);
 		}
 		return pending;
@@ -175,6 +350,7 @@ var OpenApiBundler = class {
 		for (const [key, child] of Object.entries(value)) value[key] = await this.expand(child, uri, document, stack);
 	}
 	async expand(value, uri, document, stack) {
+		if (stack.size > this.options.maxDepth) throw new GenerationError(`OpenAPI reference depth exceeds ${this.options.maxDepth}`);
 		if (Array.isArray(value)) return Promise.all(value.map((item) => this.expand(item, uri, document, stack)));
 		if (!value || typeof value !== "object") return value;
 		const object = value;
@@ -215,9 +391,36 @@ var OpenApiBundler = class {
 		return this.expand(target, targetSource.uri, targetSource.document, new Set(stack).add(canonical));
 	}
 };
-async function loadOpenApi(input) {
-	const source = await readSource(/^https?:\/\//.test(input) ? input : pathToFileURL(resolve(input)).href);
-	return new OpenApiBundler(source.document, source.uri).bundle();
+async function loadOpenApi(input, options = {}) {
+	const remote = /^https?:\/\//.test(input);
+	const localPath = remote ? void 0 : await realpath(resolve(input));
+	const uri = remote ? new URL(input).href : pathToFileURL(localPath).href;
+	const rootUrl = new URL(uri);
+	if (remote && rootUrl.protocol !== "https:") throw new GenerationError("Remote OpenAPI roots must use HTTPS.");
+	const positiveOption = (name, value) => {
+		if (!Number.isSafeInteger(value) || value <= 0) throw new GenerationError(`${name} must be a positive safe integer.`);
+		return value;
+	};
+	const resolved = {
+		allowedReferenceOrigins: new Set((options.allowedReferenceOrigins ?? []).map((origin) => {
+			let parsed;
+			try {
+				parsed = new URL(origin);
+			} catch {
+				throw new GenerationError(`Allowed reference origin must be an HTTPS origin: ${origin}`);
+			}
+			if (parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash || parsed.href !== parsed.origin + "/") throw new GenerationError(`Allowed reference origin must be an HTTPS origin: ${origin}`);
+			return parsed.origin;
+		})),
+		allowPrivateHosts: options.allowPrivateHosts ?? false,
+		maxBytes: positiveOption("maxBytes", options.maxBytes ?? 5 * 1024 * 1024),
+		maxDepth: positiveOption("maxDepth", options.maxDepth ?? 32),
+		maxRedirects: positiveOption("maxRedirects", options.maxRedirects ?? 5),
+		timeoutMs: positiveOption("timeoutMs", options.timeoutMs ?? 1e4),
+		...remote ? { remoteRootOrigin: rootUrl.origin } : { localRootDirectory: await realpath(dirname(localPath)) }
+	};
+	const source = await readSource(uri, resolved);
+	return new OpenApiBundler(source.document, source.uri, resolved).bundle();
 }
 function generateFiles(document) {
 	const version = String(document.openapi ?? "");
@@ -392,13 +595,13 @@ async function writeGenerated(directory, files, check) {
 		});
 	}
 }
-async function generate(input, output, check = false) {
+async function generate(input, output, check = false, loadOptions = {}) {
 	if (!/^https?:\/\//.test(input)) {
 		const resolvedInput = resolve(input);
 		const inputWithinOutput = relative(resolve(output), resolvedInput);
 		if (!inputWithinOutput.startsWith("..") && !isAbsolute(inputWithinOutput)) throw new GenerationError("Generated output must not contain its OpenAPI input document");
 	}
-	const files = generateFiles(await loadOpenApi(input));
+	const files = generateFiles(await loadOpenApi(input, loadOptions));
 	await mkdir(dirname(resolve(output)), { recursive: true });
 	await writeGenerated(output, files, check);
 }
@@ -410,13 +613,65 @@ async function runGenerateCli(args, io = console) {
 	let check = false;
 	let json = false;
 	let help = false;
+	const allowedReferenceOrigins = [];
+	const referenceLimits = {};
 	const inputs = [];
 	for (let i = 0; i < args.length; i++) {
 		const arg = args[i];
 		if (arg === "--check") check = true;
 		else if (arg === "--json") json = true;
 		else if (arg === "--help" || arg === "-h") help = true;
-		else if (arg === "-o" || arg === "--output") {
+		else if (arg === "--allow-ref-origin") {
+			const value = args[i + 1];
+			if (!value || value.startsWith("-")) {
+				const message = `${arg} requires an HTTPS origin`;
+				io.error(wantsJson ? JSON.stringify({
+					status: "error",
+					error: message
+				}) : message);
+				return 1;
+			}
+			allowedReferenceOrigins.push(value);
+			i += 1;
+		} else if (arg.startsWith("--allow-ref-origin=")) allowedReferenceOrigins.push(arg.slice(19));
+		else if (arg === "--ref-timeout-ms" || arg === "--ref-max-bytes" || arg === "--ref-max-depth" || arg === "--ref-max-redirects") {
+			const value = args[i + 1];
+			const parsed = Number(value);
+			if (!value || value.startsWith("-") || !Number.isSafeInteger(parsed) || parsed <= 0) {
+				const message = `${arg} requires a positive safe integer`;
+				io.error(wantsJson ? JSON.stringify({
+					status: "error",
+					error: message
+				}) : message);
+				return 1;
+			}
+			const key = {
+				"--ref-timeout-ms": "timeoutMs",
+				"--ref-max-bytes": "maxBytes",
+				"--ref-max-depth": "maxDepth",
+				"--ref-max-redirects": "maxRedirects"
+			}[arg];
+			referenceLimits[key] = parsed;
+			i += 1;
+		} else if (/^--ref-(?:timeout-ms|max-bytes|max-depth|max-redirects)=/.test(arg)) {
+			const [flag, value = ""] = arg.split("=", 2);
+			const parsed = Number(value);
+			if (!Number.isSafeInteger(parsed) || parsed <= 0) {
+				const message = `${flag} requires a positive safe integer`;
+				io.error(wantsJson ? JSON.stringify({
+					status: "error",
+					error: message
+				}) : message);
+				return 1;
+			}
+			const key = {
+				"--ref-timeout-ms": "timeoutMs",
+				"--ref-max-bytes": "maxBytes",
+				"--ref-max-depth": "maxDepth",
+				"--ref-max-redirects": "maxRedirects"
+			}[flag];
+			referenceLimits[key] = parsed;
+		} else if (arg === "-o" || arg === "--output") {
 			const value = args[i + 1];
 			if (!value || value.startsWith("-")) {
 				const message = `${arg} requires a path`;
@@ -438,7 +693,7 @@ async function runGenerateCli(args, io = console) {
 			return 1;
 		} else inputs.push(arg);
 	}
-	const usage = "Usage: askr generate <input> -o <output-directory> [--check] [--json]";
+	const usage = "Usage: askr generate <input> -o <output-directory> [--check] [--json] [--allow-ref-origin <https-origin>] [--ref-timeout-ms <n>] [--ref-max-bytes <n>] [--ref-max-depth <n>] [--ref-max-redirects <n>]";
 	if (help) {
 		io.log(usage);
 		return 0;
@@ -451,7 +706,10 @@ async function runGenerateCli(args, io = console) {
 		return 1;
 	}
 	try {
-		await generate(inputs[0], output, check);
+		await generate(inputs[0], output, check, {
+			allowedReferenceOrigins,
+			...referenceLimits
+		});
 		io.log(json ? JSON.stringify({
 			status: "ok",
 			action: check ? "checked" : "generated",

package/dist/{planner-ZAX9SFjY.js → planner-DsUWndjl.js}

@@ -1,5 +1,4 @@
-import { n as isBreakingChange, r as rewriteRange, t as analyzeRange } from "./range-YUs9eimn.js";
-import { t as parseDependencySpecification } from "./specification-DXnDOC-0.js";
+import { i as rewriteRange, n as analyzeRange, r as isBreakingChange, t as parseDependencySpecification } from "./specification-BSlq_n9A.js";
 import semver from "semver";
 //#region src/update/planner.ts
 const STATUS_PRIORITY = {
@@ -123,12 +122,13 @@ function planOne(occurrence, packument, failure, tag, mode, chosen, blocker) {
 			reason: blocker
 		}
 	};
-	if (semver.satisfies(selected, occurrence.currentSpecification) || !semver.gt(selected, allowed)) return {
+	const declared = semver.minVersion(occurrence.currentSpecification)?.version ?? allowed;
+	if (!semver.gt(selected, declared)) return {
 		targetVersion: target,
 		occurrence: {
 			...withVersions,
 			status: "current",
-			reason: blocker ?? "selected version is already covered by the current specification"
+			reason: blocker ?? "the declared version is current"
 		}
 	};
 	const analysis = analyzeRange(occurrence.currentSpecification);
@@ -149,11 +149,20 @@ function planOne(occurrence, packument, failure, tag, mode, chosen, blocker) {
 			reason: "breaking update is available via askr upgrade"
 		}
 	};
+	const proposedSpecification = rewriteRange(analysis.shape, selected, breaking);
+	if (proposedSpecification === occurrence.currentSpecification) return {
+		targetVersion: target,
+		occurrence: {
+			...withVersions,
+			status: "current",
+			reason: "the selected version cannot further rebase this range style"
+		}
+	};
 	return {
 		targetVersion: target,
 		occurrence: {
 			...withVersions,
-			proposedSpecification: rewriteRange(analysis.shape, selected, breaking),
+			proposedSpecification,
 			status: breaking ? "breaking" : "safe",
 			reason: selected === target ? "selected tag target is eligible" : `compatible version ${selected} selected below ${tag}@${target}`
 		}
@@ -185,10 +194,8 @@ function solveWorkspace(workspace, selectedOccurrences, context, packuments, tag
 	}
 	const variables = [...states.entries()].filter(([, state]) => state.selected && state.candidates.length > 0).sort(([a], [b]) => a.localeCompare(b));
 	const fixed = new Map([...states].flatMap(([name, state]) => state.selected ? [] : state.current ? [[name, state.current]] : []));
-	let best = null;
-	let bestChanged = -1;
-	let firstFailure = "no jointly peer-compatible published version set exists";
-	const validate = (choices) => {
+	const currentChoices = new Map(variables.flatMap(([name, state]) => state.current ? [[name, state.current]] : []));
+	const validate = (choices, domains) => {
 		const installed = new Map([...fixed, ...choices]);
 		for (const [name, version] of installed) {
 			const packument = packuments.get(name);
@@ -198,10 +205,12 @@ function solveWorkspace(workspace, selectedOccurrences, context, packuments, tag
 			for (const [peer, requirement] of Object.entries(meta.peerDependencies ?? {}).sort(([a], [b]) => a.localeCompare(b))) {
 				if (typeof requirement !== "string") continue;
 				const providerChanged = states.get(name)?.current !== version;
-				const peerChanged = states.get(peer)?.selected && states.get(peer)?.current !== installed.get(peer);
+				const assignedPeer = choices.get(peer);
+				const peerChanged = assignedPeer !== void 0 && states.get(peer)?.current !== assignedPeer;
 				if (!providerChanged && !peerChanged) continue;
-				const peerVersion = installed.get(peer) ?? localVersions.get(peer);
+				const peerVersion = assignedPeer ?? (states.get(peer)?.selected ? void 0 : installed.get(peer));
 				if (!peerVersion) {
+					if ((domains?.get(peer))?.some((candidate) => semver.satisfies(candidate, requirement, { includePrerelease: true }))) continue;
 					if (optionalPeer(meta, peer)) continue;
 					return `${name}@${version} requires missing peer ${peer}@${requirement}`;
 				}
@@ -210,31 +219,99 @@ function solveWorkspace(workspace, selectedOccurrences, context, packuments, tag
 		}
 		return null;
 	};
-	const visit = (index, choices) => {
-		if (index === variables.length) {
-			const failure = validate(choices);
+	const edges = new Map(variables.map(([name]) => [name, /* @__PURE__ */ new Set()]));
+	for (const [name, state] of variables) for (const version of state.candidates) {
+		const peers = metadata(packuments.get(name), version)?.peerDependencies ?? {};
+		for (const peer of Object.keys(peers)) {
+			if (!edges.has(peer)) continue;
+			edges.get(name).add(peer);
+			edges.get(peer).add(name);
+		}
+	}
+	const components = [];
+	const unseen = new Set(edges.keys());
+	while (unseen.size > 0) {
+		const start = [...unseen].sort()[0];
+		const component = [];
+		const pending = [start];
+		unseen.delete(start);
+		while (pending.length > 0) {
+			const name = pending.pop();
+			component.push(name);
+			for (const neighbor of [...edges.get(name)].sort().reverse()) {
+				if (!unseen.delete(neighbor)) continue;
+				pending.push(neighbor);
+			}
+		}
+		components.push(component.sort());
+	}
+	const choices = new Map(currentChoices);
+	const blockers = /* @__PURE__ */ new Map();
+	for (const component of components) {
+		const componentSet = new Set(component);
+		const baseChoices = new Map([...choices].filter(([name]) => !componentSet.has(name)));
+		const domains = new Map(component.map((name) => [name, states.get(name).candidates]));
+		let best = null;
+		let bestChanged = -1;
+		let bestVector = [];
+		let statesVisited = 0;
+		let exhausted = false;
+		let firstFailure = "no jointly peer-compatible published version set exists";
+		const memo = /* @__PURE__ */ new Set();
+		const visit = (assigned) => {
+			if (exhausted) return;
+			statesVisited += 1;
+			if (statesVisited > 5e4) {
+				exhausted = true;
+				return;
+			}
+			const merged = new Map([...baseChoices, ...assigned]);
+			const remaining = component.filter((name) => !assigned.has(name));
+			const changed = component.filter((name) => assigned.has(name) && assigned.get(name) !== states.get(name).current).length;
+			if (changed + remaining.length < bestChanged) return;
+			const pruned = /* @__PURE__ */ new Map();
+			for (const name of remaining) {
+				const viable = domains.get(name).filter((version) => validate(new Map([...merged, [name, version]]), domains) === null);
+				if (viable.length === 0) {
+					firstFailure = validate(merged, domains) ?? firstFailure;
+					return;
+				}
+				pruned.set(name, viable);
+			}
+			const failure = validate(merged, new Map([...domains, ...pruned]));
 			if (failure) {
 				firstFailure = failure;
 				return;
 			}
-			const changed = variables.filter(([name, state]) => choices.get(name) !== state.current).length;
-			if (changed > bestChanged) {
-				best = new Map(choices);
-				bestChanged = changed;
+			if (remaining.length === 0) {
+				const vector = component.map((name) => states.get(name).candidates.indexOf(assigned.get(name)));
+				const newer = vector.some((value, index) => value < (bestVector[index] ?? Number.POSITIVE_INFINITY) && vector.slice(0, index).every((prior, priorIndex) => prior === bestVector[priorIndex]));
+				if (changed > bestChanged || changed === bestChanged && newer) {
+					best = new Map(assigned);
+					bestChanged = changed;
+					bestVector = vector;
+				}
+				return;
 			}
-			return;
-		}
-		const [name, state] = variables[index];
-		for (const version of state.candidates) {
-			choices.set(name, version);
-			visit(index + 1, choices);
-		}
-	};
-	visit(0, /* @__PURE__ */ new Map());
-	const blockers = /* @__PURE__ */ new Map();
-	if (!best) for (const [name] of variables) blockers.set(name, firstFailure);
-	const choices = best ?? new Map(variables.flatMap(([name, state]) => state.current ? [[name, state.current]] : []));
+			const next = remaining.map((name) => [name, pruned.get(name)]).sort(([leftName, left], [rightName, right]) => left.length - right.length || leftName.localeCompare(rightName))[0];
+			const signature = component.map((name) => `${name}=${assigned.get(name) ?? (pruned.get(name) ?? []).join(",")}`).join("|");
+			if (memo.has(signature)) return;
+			memo.add(signature);
+			for (const version of next[1]) {
+				assigned.set(next[0], version);
+				visit(assigned);
+				assigned.delete(next[0]);
+			}
+		};
+		visit(/* @__PURE__ */ new Map());
+		if (exhausted) {
+			const reason = "peer compatibility search exceeded the 50,000-state budget; resolve this component manually";
+			for (const name of component) blockers.set(name, reason);
+		} else if (!best) for (const name of component) blockers.set(name, firstFailure);
+		else for (const [name, version] of best) choices.set(name, version);
+	}
 	for (const [name, state] of variables) {
+		if (blockers.has(name)) continue;
 		if (choices.get(name) !== state.current || state.candidates[0] === state.current) continue;
 		const attempted = new Map(choices).set(name, state.candidates[0]);
 		blockers.set(name, validate(attempted) ?? "no jointly peer-compatible update advances this dependency");

package/dist/registry-BVliEbUv.js

@@ -0,0 +1,95 @@
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import Config from "@npmcli/config";
+import npmDefinitions from "@npmcli/config/lib/definitions/index.js";
+import registryFetch from "npm-registry-fetch";
+//#region src/update/registry.ts
+function executionEnvironment(env) {
+	if (env === process.env) return { ...process.env };
+	const inherited = { ...process.env };
+	for (const name of Object.keys(inherited)) if (/^npm_config_/i.test(name)) delete inherited[name];
+	return {
+		...inherited,
+		...env
+	};
+}
+async function loadNpmConfiguration(root, env = process.env) {
+	const effectiveEnvironment = executionEnvironment(env);
+	const { definitions, flatten, shorthands } = npmDefinitions;
+	const configuration = new Config({
+		npmPath: path.dirname(fileURLToPath(import.meta.resolve("@npmcli/config/package.json"))),
+		definitions,
+		flatten,
+		shorthands,
+		argv: [process.execPath, "askr"],
+		cwd: root,
+		env: effectiveEnvironment,
+		execPath: process.execPath,
+		warn: false
+	});
+	await configuration.load();
+	configuration.validate();
+	return {
+		cwd: root,
+		env: effectiveEnvironment,
+		options: { ...configuration.flat }
+	};
+}
+function isRecord(value) {
+	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function isPackument(value) {
+	return isRecord(value) && isRecord(value["dist-tags"]) && isRecord(value.versions);
+}
+async function fetchPackage(packageName, configuration, _specifications) {
+	return registryFetch.json(packageName.replace("/", "%2f"), {
+		...configuration.options,
+		spec: packageName,
+		headers: {
+			...isRecord(configuration.options.headers) ? configuration.options.headers : {},
+			accept: "application/vnd.npm.install-v1+json"
+		}
+	});
+}
+function sanitizeRegistryError(error) {
+	const value = error && typeof error === "object" ? error : {};
+	if (value.statusCode === 404 || value.code === "E404") return "package was not found in the selected registry";
+	if (value.statusCode === 401 || value.statusCode === 403 || value.code === "E401" || value.code === "E403") return "registry authentication or authorization failed";
+	const code = typeof value.code === "string" ? value.code.toUpperCase() : "";
+	if ([
+		"ETIMEDOUT",
+		"ETIMEOUT",
+		"FETCH_ERROR",
+		"ECONNRESET"
+	].includes(code)) return "registry request timed out or was interrupted";
+	if (/^[A-Z][A-Z0-9_]{1,30}$/.test(code)) return `registry request failed (${code})`;
+	return "registry request failed";
+}
+async function fetchPackuments(packageNames, configuration, options = {}) {
+	const names = [...new Set(packageNames)].sort((left, right) => left.localeCompare(right));
+	const packuments = /* @__PURE__ */ new Map();
+	const failures = /* @__PURE__ */ new Map();
+	const viewPackage = options.viewPackage ?? fetchPackage;
+	const configuredSockets = Number(configuration.options.maxSockets ?? 15);
+	const concurrency = Math.max(1, Math.min(names.length, Number.isFinite(configuredSockets) ? configuredSockets : 15));
+	let nextIndex = 0;
+	const worker = async () => {
+		while (nextIndex < names.length) {
+			const packageName = names[nextIndex++];
+			try {
+				const result = await viewPackage(packageName, configuration, options.requirements?.specifications?.get(packageName) ?? []);
+				if (isPackument(result)) packuments.set(packageName, result);
+				else failures.set(packageName, "registry returned malformed package metadata");
+			} catch (error) {
+				failures.set(packageName, sanitizeRegistryError(error));
+			}
+		}
+	};
+	await Promise.all(Array.from({ length: concurrency }, worker));
+	return {
+		packuments,
+		failures
+	};
+}
+//#endregion
+export { fetchPackuments, loadNpmConfiguration };

package/dist/{range-YUs9eimn.js → specification-BSlq_n9A.js}

@@ -106,12 +106,11 @@ function rewriteXRange(shape, target) {
 	if (count === 1) return String(parsed.major);
 	return `${parsed.major}.${parsed.minor}`;
 }
-function rewriteAtomic(shape, target, forcedBreaking) {
+function rewriteAtomic(shape, target, _forcedBreaking) {
 	if (shape.kind === "exact") return target;
 	if (shape.kind === "operator") return `${shape.operator}${target}`;
 	if (shape.kind === "x") return rewriteXRange(shape, target);
-	const boundary = nextBreakingBoundary(target);
-	return forcedBreaking ? `>=${target} <${boundary}` : `${shape.lower} <${boundary}`;
+	return `>=${target} <${nextBreakingBoundary(target)}`;
 }
 function rewriteRange(shape, target, forcedBreaking) {
 	if (shape.kind !== "union") return rewriteAtomic(shape, target, forcedBreaking);
@@ -122,4 +121,51 @@ function rewriteRange(shape, target, forcedBreaking) {
 	return rewritten.join(" || ");
 }
 //#endregion
-export { isBreakingChange as n, rewriteRange as r, analyzeRange as t };
+//#region src/update/specification.ts
+const WINDOWS_PATH = /^[A-Za-z]:[\\/]/;
+const HOSTED_GIT = /^(?:bitbucket|gist|github|gitlab):/i;
+const GIT_URL = /^(?:git(?:\+[^:]+)?:|git@|ssh:)/i;
+const GIT_SHORTHAND = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#.*)?$/;
+const REGISTRY_TAG = /^[A-Za-z][A-Za-z0-9._-]*$/;
+const SCOPED_PATH = /^@[^/]+\/[^/]+$/;
+function parseDependencySpecification(specification) {
+	const rawSpec = specification.trim();
+	if (!rawSpec) return {
+		type: "unsupported",
+		rawSpec
+	};
+	if (/^npm:/i.test(rawSpec)) return {
+		type: "alias",
+		rawSpec
+	};
+	if (/^(?:file|link|workspace):/i.test(rawSpec) || rawSpec.startsWith("./") || rawSpec.startsWith("../") || rawSpec.startsWith("/") || rawSpec.startsWith("~/") || /\.(?:tar\.gz|tgz)$/i.test(rawSpec) || WINDOWS_PATH.test(rawSpec) || /^[A-Za-z]:/.test(rawSpec) || SCOPED_PATH.test(rawSpec)) return {
+		type: "file",
+		rawSpec
+	};
+	if (HOSTED_GIT.test(rawSpec) || GIT_URL.test(rawSpec) || GIT_SHORTHAND.test(rawSpec)) return {
+		type: "git",
+		rawSpec
+	};
+	if (/^https?:/i.test(rawSpec) || /^[a-z][a-z0-9+.-]*:\/\//i.test(rawSpec)) return {
+		type: "remote",
+		rawSpec
+	};
+	if (semver.valid(rawSpec)) return {
+		type: "version",
+		rawSpec
+	};
+	if (semver.validRange(rawSpec)) return {
+		type: "range",
+		rawSpec
+	};
+	if (REGISTRY_TAG.test(rawSpec)) return {
+		type: "tag",
+		rawSpec
+	};
+	return {
+		type: "unsupported",
+		rawSpec
+	};
+}
+//#endregion
+export { rewriteRange as i, analyzeRange as n, isBreakingChange as r, parseDependencySpecification as t };

package/dist/templates/full-stack/src/server/app.ts

@@ -7,7 +7,18 @@ import { telemetry } from "../telemetry";
 import { createActionHandlers } from "./action-registry";
 import type { AppDependencies } from "./dependencies";
 
+function csrfSecret(): string {
+  const secret = process.env.CSRF_SECRET;
+  if (process.env.NODE_ENV !== "production") return secret ?? "development-only-secret";
+  if (!secret || secret.length < 32 || new Set(secret).size < 12) {
+    throw new Error("Production requires a strong CSRF_SECRET (at least 32 varied characters).");
+  }
+  return secret;
+}
+
 export function createApp(deps: AppDependencies) {
+  const secret = csrfSecret();
+  const development = process.env.NODE_ENV !== "production";
   return createAskrApp({
     name: "{{appName}}",
     version: "1.0.0",
@@ -37,26 +48,33 @@ export function createApp(deps: AppDependencies) {
           .summary("Create a message")
           .tags("Messages")
           .use(
-            csrf({ secret: process.env.CSRF_SECRET ?? "development-only-secret" }),
-            rateLimit({ store: deps.rateLimits, limit: 30, windowMs: 60_000 }),
+            csrf({ secret }),
+            rateLimit({
+              store: deps.rateLimits,
+              limit: 30,
+              windowMs: 60_000,
+              key: (ctx) => `message:${ctx.auth.session?.id ?? "anonymous"}`,
+            }),
           )
           .created(Message)
           .badRequest()
           .unprocessableEntity()
           .tooManyRequests();
-        api
-          .post("/session", (ctx) => {
-            const response = ctx.redirect("/", 303);
-            return ctx.setCookie(response, "askr-session", "demo-session", {
-              httpOnly: true,
-              sameSite: "lax",
-              secure: ctx.url.protocol === "https:",
-              path: "/",
-            });
-          })
-          .operationId("createSession")
-          .summary("Create a demo session")
-          .seeOther();
+        if (development) {
+          api
+            .post("/session", (ctx) => {
+              const response = ctx.redirect("/", 303);
+              return ctx.setCookie(response, "askr-session", "demo-session", {
+                httpOnly: true,
+                sameSite: "lax",
+                secure: ctx.url.protocol === "https:",
+                path: "/",
+              });
+            })
+            .operationId("createSession")
+            .summary("Create a development-only demo session")
+            .seeOther();
+        }
       },
     },
     auth: {
@@ -68,7 +86,7 @@ export function createApp(deps: AppDependencies) {
     },
     actions: {
       handlers: createActionHandlers(),
-      csrf: { secret: process.env.CSRF_SECRET ?? "development-only-secret" },
+      csrf: { secret },
     },
     middleware: [requestId(), securityHeaders()],
     telemetry,

package/dist/templates/full-stack/src/server/dependencies.ts

@@ -29,11 +29,16 @@ export function createDependencies(): AppDependencies {
   const counters = new Map<string, { count: number; reset: number }>();
   return {
     sessions: {
-      get: async (id) => (id === "demo-session" ? { id, subject: "demo-user" } : null),
+      get: async (id) =>
+        process.env.NODE_ENV !== "production" && id === "demo-session"
+          ? { id, subject: "demo-user" }
+          : null,
     },
     principals: {
       get: async (subject) =>
-        subject === "demo-user" ? { id: subject, subject, permissions: ["messages:create"] } : null,
+        process.env.NODE_ENV !== "production" && subject === "demo-user"
+          ? { id: subject, subject, permissions: ["messages:create"] }
+          : null,
     },
     actions: { record: async () => undefined },
     rateLimits: {

package/dist/update.js

@@ -193,7 +193,7 @@ function collectEdits(decisions) {
 	}] : []));
 }
 async function defaultRegistry(root, packageNames, requirements) {
-	const { fetchPackuments, loadNpmConfiguration } = await import("./registry-D2APi6x0.js");
+	const { fetchPackuments, loadNpmConfiguration } = await import("./registry-BVliEbUv.js");
 	return fetchPackuments(packageNames, await loadNpmConfiguration(root), { requirements });
 }
 async function runDependencyCli(command, args, io = console, runtime = {}) {
@@ -217,7 +217,7 @@ async function runDependencyCli(command, args, io = console, runtime = {}) {
 	let root = null;
 	let selectedWorkspaces = [];
 	try {
-		const [{ discoverProject }, { planUpdates }] = await Promise.all([import("./discovery-Djq8TxJu.js"), import("./planner-ZAX9SFjY.js")]);
+		const [{ discoverProject }, { planUpdates }] = await Promise.all([import("./discovery-BX-lnFRK.js"), import("./planner-DsUWndjl.js")]);
 		const project = await discoverProject({
 			cwd: parsed.cwd,
 			packagePatterns: parsed.packagePatterns,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askrjs/cli",
-  "version": "0.0.7",
+  "version": "0.0.8",
   "description": "Unified CLI for the Askr platform",
   "homepage": "https://github.com/askrjs/askr-cli#readme",
   "bugs": {
@@ -44,13 +44,17 @@
     "test:publint": "publint",
     "pack:check": "npm pack --ignore-scripts --dry-run --json",
     "test:templates": "node scripts/verify-packed-templates.mjs",
+    "bench": "npm run build --silent && node --import tsx benchmarks/cli.mjs --gate",
+    "bench:json": "npm run build --silent && node --import tsx benchmarks/cli.mjs --gate --json",
     "check": "npm run lint && npm run typecheck && npm run test:coverage && npm run build && npm run test:publint && npm run pack:check",
     "prepack": "npm run build",
     "prepublishOnly": "npm run check && npm run test:templates"
   },
   "dependencies": {
+    "@npmcli/config": "^10.12.0",
     "js-yaml": "^5.2.1",
     "minimatch": "^10.2.5",
+    "npm-registry-fetch": "^19.1.1",
     "semver": "^7.8.5",
     "tsx": "^4.23.1"
   },

package/dist/registry-D2APi6x0.js

@@ -1,228 +0,0 @@
-import { t as parseDependencySpecification } from "./specification-DXnDOC-0.js";
-import path from "node:path";
-import { existsSync } from "node:fs";
-import { execFile } from "node:child_process";
-import semver from "semver";
-//#region src/update/registry.ts
-function installedNpmCli(executable) {
-	const directories = /* @__PURE__ */ new Set([path.dirname(process.execPath)]);
-	if (executable && path.isAbsolute(executable)) directories.add(path.dirname(executable));
-	for (const directory of directories) for (const candidate of [path.join(directory, "node_modules", "npm", "bin", "npm-cli.js"), path.resolve(directory, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js")]) if (existsSync(candidate)) return candidate;
-	return null;
-}
-function npmInvocation(env) {
-	const executable = env.npm_execpath;
-	const executableName = executable ? path.basename(executable).toLowerCase() : "";
-	const isNpmExecutable = executableName === "npm" || executableName === "npm.cmd" || /^npm(?:-cli)?\.(?:cjs|js|mjs)$/.test(executableName);
-	if (executable && isNpmExecutable) {
-		const extension = path.extname(executable).toLowerCase();
-		if ([
-			".cjs",
-			".js",
-			".mjs"
-		].includes(extension)) return {
-			executable: process.execPath,
-			prefix: [executable]
-		};
-		const npmCli = installedNpmCli(executable);
-		return npmCli ? {
-			executable: process.execPath,
-			prefix: [npmCli]
-		} : {
-			executable,
-			prefix: []
-		};
-	}
-	const npmCli = installedNpmCli();
-	if (npmCli) return {
-		executable: process.execPath,
-		prefix: [npmCli]
-	};
-	return {
-		executable: process.platform === "win32" ? "npm.cmd" : "npm",
-		prefix: []
-	};
-}
-function executionEnvironment(env) {
-	if (env === process.env) return { ...process.env };
-	const inherited = { ...process.env };
-	for (const name of Object.keys(inherited)) if (/^npm_config_/i.test(name)) delete inherited[name];
-	return {
-		...inherited,
-		...env
-	};
-}
-async function loadNpmConfiguration(root, env = process.env) {
-	const effectiveEnvironment = executionEnvironment(env);
-	return {
-		cwd: root,
-		env: effectiveEnvironment,
-		invocation: npmInvocation(effectiveEnvironment)
-	};
-}
-function npmError(error, stderr) {
-	const details = `${String(error.code ?? "")}\n${stderr}`;
-	const safe = /* @__PURE__ */ new Error("npm registry lookup failed");
-	safe.code = (details.match(/\bE(?:401|403|404|CONNRESET|TIMEDOUT|TIMEOUT)\b/i)?.[0])?.toUpperCase() ?? (typeof error.code === "string" ? error.code : "");
-	if (safe.code === "E401") safe.statusCode = 401;
-	if (safe.code === "E403") safe.statusCode = 403;
-	if (safe.code === "E404") safe.statusCode = 404;
-	return safe;
-}
-function executeNpmJson(args, configuration, preferOnline) {
-	const [command, ...positionals] = args;
-	return new Promise((resolve, reject) => {
-		execFile(configuration.invocation.executable, [
-			...configuration.invocation.prefix,
-			command,
-			"--json",
-			preferOnline ? "--prefer-online" : "--prefer-offline",
-			"--offline=false",
-			"--loglevel=error",
-			"--update-notifier=false",
-			"--",
-			...positionals
-		], {
-			cwd: configuration.cwd,
-			encoding: "utf8",
-			env: configuration.env,
-			maxBuffer: 64 * 1024 * 1024,
-			windowsHide: true
-		}, (error, stdout, stderr) => {
-			if (error) {
-				reject(npmError(error, stderr));
-				return;
-			}
-			try {
-				resolve(JSON.parse(stdout));
-			} catch {
-				reject(/* @__PURE__ */ new Error("npm registry returned malformed JSON"));
-			}
-		});
-	});
-}
-function isRecord(value) {
-	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}
-function basePackument(value) {
-	if (!isRecord(value) || !Array.isArray(value.versions) || !isRecord(value["dist-tags"])) return null;
-	const versions = value.versions.filter((version) => typeof version === "string");
-	if (versions.length === 0) return null;
-	return {
-		"dist-tags": value["dist-tags"],
-		versions: Object.fromEntries(versions.map((version) => [version, { version }]))
-	};
-}
-function selectedVersions(packument, specifications) {
-	const versions = Object.keys(packument.versions ?? {}).filter((version) => semver.valid(version) !== null);
-	const selected = new Set(Object.values(packument["dist-tags"] ?? {}).filter((version) => typeof version === "string" && semver.valid(version) !== null && versions.includes(version)));
-	for (const specification of specifications) {
-		const parsed = parseDependencySpecification(specification);
-		if (parsed.type === "tag") {
-			const tagged = packument["dist-tags"]?.[parsed.rawSpec];
-			if (typeof tagged === "string" && versions.includes(tagged)) selected.add(tagged);
-		} else if (parsed.type === "version") {
-			if (versions.includes(parsed.rawSpec)) selected.add(parsed.rawSpec);
-		} else if (parsed.type === "range") {
-			const matching = semver.maxSatisfying(versions, parsed.rawSpec);
-			if (matching) selected.add(matching);
-		}
-	}
-	return [...selected].sort(semver.compare);
-}
-function candidateVersions(packument, specifications) {
-	const versions = Object.keys(packument.versions ?? {}).filter((version) => semver.valid(version) !== null);
-	const selected = selectedVersions(packument, specifications);
-	const lowerBounds = specifications.flatMap((specification) => {
-		const parsed = parseDependencySpecification(specification);
-		if (parsed.type === "version") return semver.valid(parsed.rawSpec) ? [parsed.rawSpec] : [];
-		if (parsed.type === "range") {
-			const current = semver.maxSatisfying(versions, parsed.rawSpec);
-			return current ? [current] : [];
-		}
-		return [];
-	});
-	if (lowerBounds.length === 0 || selected.length === 0) return selected;
-	const floor = lowerBounds.sort(semver.compare)[0];
-	const ceiling = selected.sort(semver.compare)[selected.length - 1];
-	return versions.filter((version) => semver.gte(version, floor) && semver.lte(version, ceiling));
-}
-function mergeVersionMetadata(packument, value, selected) {
-	const entries = Array.isArray(value) ? value : [value];
-	const merged = /* @__PURE__ */ new Set();
-	for (const entry of entries) {
-		if (typeof entry === "string") {
-			if (packument.versions?.[entry]) merged.add(entry);
-			continue;
-		}
-		if (!isRecord(entry) || typeof entry.version !== "string") continue;
-		const metadata = packument.versions?.[entry.version];
-		if (!isRecord(metadata)) continue;
-		if (isRecord(entry.peerDependencies)) metadata.peerDependencies = entry.peerDependencies;
-		if (isRecord(entry.peerDependenciesMeta)) metadata.peerDependenciesMeta = entry.peerDependenciesMeta;
-		merged.add(entry.version);
-	}
-	return selected.every((version) => merged.has(version));
-}
-async function executeNpmView(packageName, configuration, specifications) {
-	const packument = basePackument(await executeNpmJson([
-		"view",
-		packageName,
-		"versions",
-		"dist-tags"
-	], configuration, true));
-	if (!packument) return null;
-	const versions = candidateVersions(packument, specifications);
-	if (versions.length === 0) return packument;
-	return mergeVersionMetadata(packument, await executeNpmJson([
-		"view",
-		`${packageName}@${versions.join(" || ")}`,
-		"version",
-		"peerDependencies",
-		"peerDependenciesMeta"
-	], configuration, false), versions) ? packument : null;
-}
-function isPackument(value) {
-	return isRecord(value) && isRecord(value["dist-tags"]) && isRecord(value.versions);
-}
-function sanitizeRegistryError(error) {
-	const value = error && typeof error === "object" ? error : {};
-	if (value.statusCode === 404 || value.code === "E404") return "package was not found in the selected registry";
-	if (value.statusCode === 401 || value.statusCode === 403 || value.code === "E401" || value.code === "E403") return "registry authentication or authorization failed";
-	const code = typeof value.code === "string" ? value.code.toUpperCase() : "";
-	if ([
-		"ETIMEDOUT",
-		"ETIMEOUT",
-		"FETCH_ERROR",
-		"ECONNRESET"
-	].includes(code)) return "registry request timed out or was interrupted";
-	if (/^[A-Z][A-Z0-9_]{1,30}$/.test(code)) return `registry request failed (${code})`;
-	return "registry request failed";
-}
-async function fetchPackuments(packageNames, configuration, options = {}) {
-	const names = [...new Set(packageNames)].sort((left, right) => left.localeCompare(right));
-	const packuments = /* @__PURE__ */ new Map();
-	const failures = /* @__PURE__ */ new Map();
-	const viewPackage = options.viewPackage ?? executeNpmView;
-	let nextIndex = 0;
-	const worker = async () => {
-		while (nextIndex < names.length) {
-			const packageName = names[nextIndex];
-			nextIndex += 1;
-			try {
-				const result = await viewPackage(packageName, configuration, options.requirements?.specifications?.get(packageName) ?? []);
-				if (isPackument(result)) packuments.set(packageName, result);
-				else failures.set(packageName, "registry returned malformed package metadata");
-			} catch (error) {
-				failures.set(packageName, sanitizeRegistryError(error));
-			}
-		}
-	};
-	await Promise.all(Array.from({ length: Math.min(8, names.length) }, worker));
-	return {
-		packuments,
-		failures
-	};
-}
-//#endregion
-export { fetchPackuments, loadNpmConfiguration };

package/dist/specification-DXnDOC-0.js

@@ -1,49 +0,0 @@
-import semver from "semver";
-//#region src/update/specification.ts
-const WINDOWS_PATH = /^[A-Za-z]:[\\/]/;
-const HOSTED_GIT = /^(?:bitbucket|gist|github|gitlab):/i;
-const GIT_URL = /^(?:git(?:\+[^:]+)?:|git@|ssh:)/i;
-const GIT_SHORTHAND = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#.*)?$/;
-const REGISTRY_TAG = /^[A-Za-z][A-Za-z0-9._-]*$/;
-const SCOPED_PATH = /^@[^/]+\/[^/]+$/;
-function parseDependencySpecification(specification) {
-	const rawSpec = specification.trim();
-	if (!rawSpec) return {
-		type: "unsupported",
-		rawSpec
-	};
-	if (/^npm:/i.test(rawSpec)) return {
-		type: "alias",
-		rawSpec
-	};
-	if (/^(?:file|link|workspace):/i.test(rawSpec) || rawSpec.startsWith("./") || rawSpec.startsWith("../") || rawSpec.startsWith("/") || rawSpec.startsWith("~/") || /\.(?:tar\.gz|tgz)$/i.test(rawSpec) || WINDOWS_PATH.test(rawSpec) || /^[A-Za-z]:/.test(rawSpec) || SCOPED_PATH.test(rawSpec)) return {
-		type: "file",
-		rawSpec
-	};
-	if (HOSTED_GIT.test(rawSpec) || GIT_URL.test(rawSpec) || GIT_SHORTHAND.test(rawSpec)) return {
-		type: "git",
-		rawSpec
-	};
-	if (/^https?:/i.test(rawSpec) || /^[a-z][a-z0-9+.-]*:\/\//i.test(rawSpec)) return {
-		type: "remote",
-		rawSpec
-	};
-	if (semver.valid(rawSpec)) return {
-		type: "version",
-		rawSpec
-	};
-	if (semver.validRange(rawSpec)) return {
-		type: "range",
-		rawSpec
-	};
-	if (REGISTRY_TAG.test(rawSpec)) return {
-		type: "tag",
-		rawSpec
-	};
-	return {
-		type: "unsupported",
-		rawSpec
-	};
-}
-//#endregion
-export { parseDependencySpecification as t };