@orkestrel/scaffold 0.0.101 → 0.0.102

package/dist/host/agents/skills/orkestrel-journey/references/statechart.md

@@ -64,18 +64,15 @@ interface DisclosureContext {
 
 // A journey verb resolves its own target by accessible name, so a second mounted disclosure called
 // "Advanced" is an ambiguity rather than a second fixture. Each build takes the previous one out.
-let mounted: HTMLElement | undefined
-
 function buildDisclosure(): DisclosureContext {
-	mounted?.remove()
+	for (const stale of document.querySelectorAll('[data-disclosure]')) stale.remove()
 	const container = render(
-		'<details><summary>Advanced</summary><p>Every setting.</p></details><button type="button">Dismiss</button>',
+		'<div data-disclosure><details><summary>Advanced</summary><p>Every setting.</p></details><button type="button">Dismiss</button></div>',
 	)
 	const details = requireValue(container.querySelector('details'))
 	requireValue(container.querySelector('button')).addEventListener('click', () => {
 		details.open = false
 	})
-	mounted = container
 	return { summary: requireValue(container.querySelector('summary')) }
 }
 

package/dist/host/agents/skills/orkestrel-publish/SKILL.md

@@ -20,12 +20,13 @@ description: Run an Orkestrel release from layer order to registry confirmation.
 
 ## Scripts
 
-| Script               | Does                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `scripts/compare.ts` | `[--package NAME] [--version V] [--tarball PATH] [--dist dist] [--json]`, run from the package root after its build: fetches the published tarball and lists the material differences from the rebuilt `dist/` (sourcemaps excluded, whitespace-only differences ignored). Exit 0 when nothing differs, 3 when something does, 2 when the tarball cannot be read, 64 on usage (no package name, no `dist/`, or `--tarball` with no path).                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| `scripts/pins.ts`    | `--version PRIOR [--range PRIOR_RANGE ...] [--paths src,tests] [--json]`, run from the package root: lists every line under the paths carrying the prior version literal or a prior range literal, once per line, sweeping a one-comparator range such as `^8.3.0` for its bare version in any form. Exit 0 with no hits, 3 with hits, 64 on usage (no literal, or a flag with no value).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| `scripts/wave.ts`    | `--visit [--target DIR] [--offline] [--from STEP] [--to STEP] [--prior VERSION] [--dry-run] [--json] [--out FILE]` runs one repository's visit in the order [wave.md](references/wave.md) § Visit a repository fixes (pin, commit, overwrite, verify, install, pins, format, gates, compare), stops at the first failing step, and prints each step's exit (a failed step names the `code: message` refusal or the `note` a JSON verb writes on stdout, else the last stderr lines), the bump ruling (the rebuilt dist against the published tarball, and the final runtime dependency set against the published manifest), and a row for `.orkestrel/release.md`; `--prior` names the version a pre-ruled bump replaced so the self-pin sweep finds it; `--plan` prints the packages by layer from the catalog table. Exit 0 when every step passed, 1 when one failed, 2 when a reading failed, 64 on usage. |
-| `scripts/window.ts`  | `--whoami [--wait SECONDS]` reads or polls `npm whoami`; `--login` prints the operator's login command and polls `whoami` until it answers; `--publish DIR... --otp CODE` refuses a batch whose nearest `.git` entry is a file, including ancestor entries, with exit 3 before contacting npm; it names a linked worktree's primary clone or identifies a submodule, then uploads back to back with `npm publish --ignore-scripts --otp`, journals each upload under `tmp/units/`, stops at the first refusal naming where to resume, and confirms each accepted version against the registry; `--confirm NAME@VERSION...` re-reads the registry until it serves the version. Exit 0 on success, 3 when not.                                                                                                                                                                                                   |
+| Script               | Does                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `scripts/compare.ts` | `[--package NAME] [--version V] [--tarball PATH] [--dist dist] [--json]`, run from the package root after its build: fetches the published tarball and lists the material differences from the rebuilt `dist/` (sourcemaps excluded, whitespace-only differences ignored). Exit 0 when nothing differs, 3 when something does, 2 when the tarball cannot be read, 64 on usage (no package name, no `dist/`, or `--tarball` with no path).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| `scripts/pins.ts`    | `--version PRIOR [--range PRIOR_RANGE ...] [--paths src,tests] [--json]`, run from the package root: lists every line under the paths carrying the prior version literal or a prior range literal, once per line, sweeping a one-comparator range such as `^8.3.0` for its bare version in any form. Exit 0 with no hits, 3 with hits, 64 on usage (no literal, or a flag with no value).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| `scripts/swap.ts`    | One mode per run, from any directory: `--pin --consumer DIR --source DIR [--source DIR ...] [--override NAME ...] [--no-build] [--dry-run] [--json]` refuses a source whose packed manifest names a local dependency spec in any dependency field (a `file:` or `link:` prefix, a path start of `.`, `~/`, `/`, `\`, or a drive letter, or a protocol-free archive name ending in `.tgz`, `.tar.gz`, or `.tar` that is not a `user/repo` shorthand), builds and packs each source into `<consumer>/tmp/tarballs/` under a name carrying its SHA-256, records each replaced range in the ledger `pins.json` there, the record of which build the consumer runs, writes each tarball's absolute `file:` spec and each `--override` (repeatable, like `--source`) where oxfmt sorts it, installs, and proves that every pinned source, an override-only one included, is installed with the source's bytes; `--restore --consumer DIR [--package NAME ...] [--json]` puts back each recorded range and override, keeps an `overrides` block that existed before the pin, installs, proves the restored copy, and lists the re-pin arguments, and refuses with 64, before it writes anything, a ledger whose package or override keys are not package names or whose removal would leave `node_modules`; `--status --consumer DIR [--json]` writes nothing and reports drift between the ledger, the manifest, the tarballs, the installed bytes, and the source commits, a manifest spec holding its tarball only when it names the ledger archive's location. `--pin` and `--restore` write a receipt under `tmp/units/`. Exit 0 on success, 1 when a command or a proof failed, 3 when `--status` reports drift, 64 on usage. |
+| `scripts/wave.ts`    | `--visit [--target DIR] [--offline] [--from STEP] [--to STEP] [--prior VERSION] [--dry-run] [--json] [--out FILE]` runs one repository's visit in the order [wave.md](references/wave.md) § Visit a repository fixes (pin, commit, overwrite, verify, install, pins, format, gates, compare), stops at the first failing step, and prints each step's exit (a failed step names the `code: message` refusal or the `note` a JSON verb writes on stdout, else the last stderr lines), the bump ruling (the rebuilt dist against the published tarball, and the final runtime dependency set against the published manifest), and a row for `.orkestrel/release.md`; `--prior` names the version a pre-ruled bump replaced so the self-pin sweep finds it; `--plan` prints the packages by layer from the catalog table. Exit 0 when every step passed, 1 when one failed, 2 when a reading failed, 64 on usage.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| `scripts/window.ts`  | `--whoami [--wait SECONDS]` reads or polls `npm whoami`; `--login` prints the operator's login command and polls `whoami` until it answers; `--publish DIR... --otp CODE` refuses a batch whose nearest `.git` entry is a file, including ancestor entries, with exit 3 before contacting npm; it names a linked worktree's primary clone or identifies a submodule, then uploads back to back with `npm publish --ignore-scripts --otp`, journals each upload under `tmp/units/`, stops at the first refusal naming where to resume, and confirms each accepted version against the registry; `--confirm NAME@VERSION...` re-reads the registry until it serves the version. Exit 0 on success, 3 when not.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
 
 The user's current instruction wins. `references/release.md` owns the credential
 and authorization law; nothing here weakens it.

package/dist/host/agents/skills/orkestrel-publish/references/release.md

@@ -10,17 +10,19 @@
 
 ## Fix a dependency before it publishes
 
-When a consumer meets a defect that lives in a package it only has from the registry, build the dependency from source, pack it, and install the tarball into the consumer. Do not wait for the release and do not work around it in the consumer.
-
-- Install the tarball; never link it. A link skips packing, the `files` list, and the exports map.
-- Write the build, pack, and install to a script and run the file.
-- Record the range you replaced in the same step that replaces it.
-- Rebuild and repack whenever the dependency's source moves; a stale tarball is a stale `dist/`.
-- Delete the consumer's `node_modules/.vite` directory after every tarball install, or install into a fresh worktree; Vite keys its pre-bundle on the installed version.
+When a consumer needs a dependency's unpublished source, to meet a defect that lives in a package it only has from the registry or to work on fresh local builds, pin the consumer to a tarball of that source. Do not wait for the release and do not work around it in the consumer.
+
+- Pin with `node .agents/skills/orkestrel-publish/scripts/swap.ts --pin --consumer <consumer> --source <dependency>`, repeating `--source` for each dependency. The script refuses a source whose packed manifest names a local dependency in any dependency field, as npm reads one: a `file:` or `link:` prefix, a spec that starts like a path (`.`, `~/`, `/`, `\`, or a drive letter), or an archive name ending in `.tgz`, `.tar.gz`, or `.tar` that carries no protocol and is not a `user/repo` shorthand. A registry range, a dist-tag, an `npm:` alias, a `user/repo` shorthand, a git spec, and a URL stay remote. The script then builds and packs each source, installs the tarball, and proves the installed bytes. Never link a source instead: a link skips packing, the `files` list, and the exports map.
+- Read the ledger `<consumer>/tmp/tarballs/pins.json` as the record of which build the consumer runs. Each row names the tarball and its SHA-256, the range the pin replaced, the source with its commit and dirty flag, the digest of the proved install, and the time; the ledger also records whether the manifest held an `overrides` block before the first pin. The script writes the replaced range before it writes the manifest and keeps the first pin's range across re-pins, so edit neither the ledger nor a pinned spec by hand.
+- Keep the absolute `file:` spec the script writes. npm resolves a relative spec against the installed package's own directory, so a packed consumer installed elsewhere, as the `distribution` proof installs it, cannot find a relative tarball.
+- Pass `--override <name>` for each pinned package that another installed package also requires. The override is `$<name>` when the consumer declares the package and the tarball spec when it does not. The proof fails a pin that leaves a pinned package, an override-only one included, uninstalled at the top level, that leaves a second copy of a pinned package, or that moves an unpinned `@orkestrel` package; an override that selects no installed dependency is such a failure and exits 1.
+- Run `scripts/swap.ts --status --consumer <consumer>` before relying on any gate run against a pinned consumer. Exit 3 names each drift: a manifest entry that no longer names the full location of its ledger tarball (a relative spec that resolves to that location holds it), a missing or changed tarball, installed bytes that differ from the proved pin, a pin with no proved install, or a source whose commit moved. Re-pin to clear it.
+- Re-pin whenever the dependency's source moves; a stale tarball is a stale `dist/`. Fetch and merge the dependency's default branch before packing it.
+- Delete the consumer's `node_modules/.vite` directory after every tarball install the script does not run, or install into a fresh worktree; Vite keys its pre-bundle on the installed version, and the script deletes it after its own installs.
 - Run one unit per checkout, at that checkout's catalog layer.
-- Fetch and merge the dependency's default branch before packing it.
-- Restore the registry copy before any gate that must prove the published artifact, and before publishing anything. The release still follows layer order: the dependency publishes first, then the consumer re-pins and re-runs its gates.
-- Keep tarballs under `tmp/`; sweep them at acceptance; never commit them.
+- Restore with `scripts/swap.ts --restore --consumer <consumer>` before any `scaffold` verb, before any gate that must see a registry range or prove the published artifact, and before publishing anything. The restore puts back each recorded range, keeps an `overrides` block that existed before the pin and removes one the pin created, removes the lock entry and installed copy of each restored package and dropped override so the install resolves them again from the registry, and proves the registry source in the lockfile. The restore refuses with exit 64, before it writes anything, a ledger whose package or override keys are not package names or whose removal would leave `node_modules`. [wave.md](wave.md) § Visit a repository orders a verb run around the pins.
+- Re-pin after the verb or gate with the arguments the restore receipt's `repin` member lists, then run `--status`. The release still follows layer order: the dependency publishes first, then the consumer takes the registry range and re-runs its gates.
+- Keep pins uncommitted: commit neither a pinned `package.json` nor its `package-lock.json`. Keep tarballs, the ledger, and receipts under `tmp/`; sweep them at acceptance; never commit them.
 
 ## What a bump obliges
 

package/dist/host/agents/skills/orkestrel-publish/references/wave.md

@@ -45,11 +45,18 @@ by hand only to repair it, then resume with `--from <step>`.
    against the published tarball for material content. An exit of 2 is an unanswered comparison,
    never a moved dist: fetch and re-run rather than ruling a bump owed.
 
-Restore any unpublished tarball the target is holding before the quality gates run, per
-`release.md` § Fix a dependency before it publishes. A distribution proof run
-against a local tarball proves the local tarball. Stage an unpublished tarball with
-`npm install --no-save`, because a `file:` pin refuses the blueprint and the manifest keeps a
-registry range.
+Restore every pin the target holds with `scripts/swap.ts --restore` before the visit's first step, per
+[release.md](release.md) § Fix a dependency before it publishes, because the visit reads and
+proves registry ranges. A distribution proof run against a local tarball proves the local tarball.
+Where a `scaffold` verb must run against a target that works on local builds, run it in this order:
+
+1. Restore the pins with `scripts/swap.ts --restore --consumer <target>`.
+2. Stage the unpublished scaffold tarball with `npm install --no-save`, which leaves the
+   manifest's registry range in place. The blueprint refuses an `@orkestrel` `file:` spec under
+   `dependencies`, so `--no-save` is the staging route a verb admits.
+3. Run the verb.
+4. Re-pin with the arguments the restore receipt's `repin` member lists, then run
+   `scripts/swap.ts --status --consumer <target>` and clear any drift it reports before the gates.
 
 Where a visit runs before scaffold itself publishes, run the visit with `--offline`; the runner
 performs the offline overwrite and proves the sweep with `scaffold audit --offline`. The online verbs read vendored bytes from the published

package/dist/host/agents/skills/orkestrel-publish/scripts/compare.ts

@@ -13,6 +13,8 @@ import {
 	listFiles,
 	readMissingFlags,
 	readOption,
+	parseJsonRecord,
+	readString,
 	runNpm,
 } from '../../orkestrel-dispatch/scripts/helpers.ts'
 
@@ -24,20 +26,27 @@ interface Manifest {
 	readonly version: string | undefined
 }
 
+interface Source {
+	readonly archive: Buffer | undefined
+	readonly version: string | undefined
+	readonly failure: string | undefined
+}
+
+interface TarState {
+	readonly next: number
+	readonly name: string | undefined
+	readonly files: ReadonlyArray<readonly [string, Buffer]>
+	readonly done: boolean
+}
+
 function readManifest(): Manifest {
 	if (!existsSync('package.json')) return { name: undefined, version: undefined }
-	let parsed: unknown
 	try {
-		parsed = JSON.parse(readFileSync('package.json', 'utf8'))
+		const record = parseJsonRecord(readFileSync('package.json', 'utf8'))
+		return { name: readString(record, 'name'), version: readString(record, 'version') }
 	} catch {
 		return { name: undefined, version: undefined }
 	}
-	if (typeof parsed !== 'object' || parsed === null) return { name: undefined, version: undefined }
-	const record = Object.fromEntries(Object.entries(parsed))
-	return {
-		name: typeof record.name === 'string' ? record.name : undefined,
-		version: typeof record.version === 'string' ? record.version : undefined,
-	}
 }
 
 function readField(text: string): string | undefined {
@@ -51,41 +60,96 @@ function readHeaderText(header: Buffer, start: number, length: number): string {
 	return slice.subarray(0, end === -1 ? slice.length : end).toString('utf8')
 }
 
-function readPaxPath(data: Buffer): string | undefined {
-	let offset = 0
-	while (offset < data.length) {
-		const space = data.indexOf(0x20, offset)
-		if (space === -1) return undefined
-		const length = Number(data.subarray(offset, space).toString('utf8'))
-		if (!Number.isFinite(length) || length <= 0) return undefined
-		const record = data.subarray(space + 1, offset + length - 1).toString('utf8')
-		if (record.startsWith('path=')) return record.slice('path='.length)
-		offset += length
+function readPaxPath(data: Buffer, offset = 0): string | undefined {
+	if (offset >= data.length) return undefined
+	const space = data.indexOf(0x20, offset)
+	if (space === -1) return undefined
+	const length = Number(data.subarray(offset, space).toString('utf8'))
+	if (!Number.isFinite(length) || length <= 0) return undefined
+	const record = data.subarray(space + 1, offset + length - 1).toString('utf8')
+	return record.startsWith('path=')
+		? record.slice('path='.length)
+		: readPaxPath(data, offset + length)
+}
+
+// A tar entry occupies a header block and the data blocks its size names, so a step ignores every
+// block offset an earlier entry already consumed.
+function stepTar(archive: Buffer, state: TarState, offset: number): TarState {
+	if (state.done || offset < state.next) return state
+	const header = archive.subarray(offset, offset + BLOCK)
+	if (header.every((byte) => byte === 0)) return { ...state, done: true }
+	const size = Number.parseInt(readHeaderText(header, 124, 12).trim() || '0', 8)
+	const type = String.fromCharCode(header[156] ?? 0)
+	const magic = readHeaderText(header, 257, 6)
+	const prefix = magic.startsWith('ustar') ? readHeaderText(header, 345, 155) : ''
+	const shortName = readHeaderText(header, 0, 100)
+	const name = state.name ?? (prefix === '' ? shortName : `${prefix}/${shortName}`)
+	const data = archive.subarray(offset + BLOCK, offset + BLOCK + size)
+	const next = offset + BLOCK + Math.ceil(size / BLOCK) * BLOCK
+	return {
+		next,
+		name:
+			type === 'x'
+				? readPaxPath(data)
+				: type === 'L'
+					? readHeaderText(data, 0, data.length)
+					: undefined,
+		files:
+			type === '0' || type === '\0' ? [...state.files, [name, Buffer.from(data)]] : state.files,
+		done: !Number.isFinite(next),
 	}
-	return undefined
 }
 
 function readTar(archive: Buffer): ReadonlyMap<string, Buffer> {
-	const files = new Map<string, Buffer>()
-	let offset = 0
-	let overrideName: string | undefined
-	while (offset + BLOCK <= archive.length) {
-		const header = archive.subarray(offset, offset + BLOCK)
-		if (header.every((byte) => byte === 0)) break
-		const size = Number.parseInt(readHeaderText(header, 124, 12).trim() || '0', 8)
-		const type = String.fromCharCode(header[156] ?? 0)
-		const magic = readHeaderText(header, 257, 6)
-		const prefix = magic.startsWith('ustar') ? readHeaderText(header, 345, 155) : ''
-		const shortName = readHeaderText(header, 0, 100)
-		const name = overrideName ?? (prefix === '' ? shortName : `${prefix}/${shortName}`)
-		const data = archive.subarray(offset + BLOCK, offset + BLOCK + size)
-		overrideName = undefined
-		if (type === 'x') overrideName = readPaxPath(data)
-		else if (type === 'L') overrideName = readHeaderText(data, 0, data.length)
-		else if (type === '0' || type === '\0') files.set(name, Buffer.from(data))
-		offset += BLOCK + Math.ceil(size / BLOCK) * BLOCK
+	const offsets = Array.from(
+		{ length: Math.floor(archive.length / BLOCK) },
+		(_, index) => index * BLOCK,
+	)
+	// A later entry of the same name replaces an earlier one at the earlier position, as a map write does.
+	return new Map(
+		offsets.reduce<TarState>((state, offset) => stepTar(archive, state, offset), {
+			next: 0,
+			name: undefined,
+			files: [],
+			done: false,
+		}).files,
+	)
+}
+
+function unpackTar(archive: Buffer): ReadonlyMap<string, Buffer> | Error {
+	try {
+		return readTar(gunzipSync(archive))
+	} catch (error) {
+		return error instanceof Error ? error : new Error(String(error))
+	}
+}
+
+async function readSource(
+	name: string,
+	requested: string | undefined,
+	tarball: string | undefined,
+): Promise<Source> {
+	if (tarball !== undefined) {
+		return existsSync(tarball)
+			? { archive: readFileSync(tarball), version: requested, failure: undefined }
+			: { archive: undefined, version: requested, failure: `${tarball} does not exist` }
+	}
+	const version = requested ?? readNpmValue(['view', name, 'version', '--json'])
+	const url =
+		version === undefined
+			? undefined
+			: readNpmValue(['view', `${name}@${version}`, 'dist.tarball', '--json'])
+	if (version === undefined || url === undefined) {
+		return {
+			archive: undefined,
+			version,
+			failure: `the registry served no tarball for ${name}${version === undefined ? '' : `@${version}`}`,
+		}
 	}
-	return files
+	const fetched = await fetchTarball(url)
+	return fetched === undefined
+		? { archive: undefined, version, failure: `fetching ${url} failed` }
+		: { archive: fetched, version, failure: undefined }
 }
 
 // A dist tree holds nothing a walk skips, so every emitted file counts.
@@ -125,53 +189,31 @@ async function main(argv: readonly string[]): Promise<number> {
 		)
 		return 64
 	}
-	let version = readOption(argv, '--version')
-	let archive: Buffer
-	if (tarball !== undefined) {
-		if (!existsSync(tarball)) {
-			console.error(`compare: ${tarball} does not exist`)
-			return 2
-		}
-		archive = readFileSync(tarball)
-	} else {
-		version ??= readNpmValue(['view', name, 'version', '--json'])
-		const url =
-			version === undefined
-				? undefined
-				: readNpmValue(['view', `${name}@${version}`, 'dist.tarball', '--json'])
-		if (version === undefined || url === undefined) {
-			console.error(
-				`compare: the registry served no tarball for ${name}${version === undefined ? '' : `@${version}`}`,
-			)
-			return 2
-		}
-		const fetched = await fetchTarball(url)
-		if (fetched === undefined) {
-			console.error(`compare: fetching ${url} failed`)
-			return 2
-		}
-		archive = fetched
-	}
-	const published = new Map<string, Buffer>()
-	let entries: ReadonlyMap<string, Buffer>
-	try {
-		entries = readTar(gunzipSync(archive))
-	} catch (error) {
-		console.error(
-			`compare: the tarball could not be read: ${error instanceof Error ? error.message : String(error)}`,
-		)
+	const source = await readSource(name, readOption(argv, '--version'), tarball)
+	const { archive, version } = source
+	if (archive === undefined) {
+		console.error(`compare: ${source.failure}`)
 		return 2
 	}
-	for (const [path, content] of entries) {
-		const prefixed = `${PACKAGE_PREFIX}${dist}/`
-		if (path.startsWith(prefixed) && isMaterial(path))
-			published.set(path.slice(prefixed.length), content)
-	}
-	const local = new Map<string, Buffer>()
-	for (const { path } of listFiles(dist, NOTHING_SKIPPED)) {
-		const key = relative(dist, path).split('\\').join('/')
-		if (isMaterial(key)) local.set(key, readFileSync(path))
+	const entries = unpackTar(archive)
+	if (entries instanceof Error) {
+		console.error(`compare: the tarball could not be read: ${entries.message}`)
+		return 2
 	}
+	const prefixed = `${PACKAGE_PREFIX}${dist}/`
+	const published = new Map(
+		[...entries].flatMap(([path, content]) =>
+			path.startsWith(prefixed) && isMaterial(path)
+				? [[path.slice(prefixed.length), content] as const]
+				: [],
+		),
+	)
+	const local = new Map(
+		listFiles(dist, NOTHING_SKIPPED).flatMap(({ path }) => {
+			const key = relative(dist, path).split('\\').join('/')
+			return isMaterial(key) ? [[key, readFileSync(path)] as const] : []
+		}),
+	)
 	const added = [...local.keys()].filter((key) => !published.has(key)).sort()
 	const removed = [...published.keys()].filter((key) => !local.has(key)).sort()
 	const changed = [...local.keys()]

package/dist/host/agents/skills/orkestrel-publish/scripts/pins.ts

@@ -56,17 +56,15 @@ function buildRangeLiteral(literal: string): Literal {
 function sweepFile(path: string, literals: readonly Literal[]): readonly Hit[] {
 	const content = readFileSync(path)
 	if (content.includes(0)) return []
-	const hits: Hit[] = []
-	content
+	return content
 		.toString('utf8')
 		.split(/\r\n|\n/)
-		.forEach((text, index) => {
+		.flatMap((text, index) => {
 			const match = literals.find((entry) => entry.pattern.test(text))
-			if (match !== undefined) {
-				hits.push({ path, line: index + 1, literal: match.literal, text: text.trim() })
-			}
+			return match === undefined
+				? []
+				: [{ path, line: index + 1, literal: match.literal, text: text.trim() }]
 		})
-	return hits
 }
 
 function main(argv: readonly string[]): number {