@orkestrel/scaffold 0.0.103 → 0.0.104

package/dist/src/server/index.d.cts

@@ -55,9 +55,9 @@ export declare interface BytesReadResult {
  * Each step reads one path and moves the climb to one other: a dangling link redirects it to the
  * link's target with the same suffix, and an absent name moves it to the parent with that name added
  * to the suffix. One successor per step makes the climb a bounded recursion rather than a worklist,
- * and the depth argument is its bound, so an adversarial path or a link cycle answers `undefined`
- * after `MAX_PATH_DEPTH` steps instead of walking indefinitely. {@link resolveRealPath} starts the
- * climb at depth 0 with nothing pending.
+ * and the depth argument is its bound, so a path or a link cycle whose climb runs past that bound
+ * answers `undefined` after `MAX_PATH_DEPTH` steps instead of walking indefinitely.
+ * {@link resolveRealPath} starts the climb at depth 0 with nothing pending.
  *
  * @example
  * ```ts
@@ -233,8 +233,8 @@ export declare const DIGEST_PATTERN: RegExp;
  *
  * @remarks
  * The one segment allowed to carry a colon. Every other segment is measured by
- * {@link INVALID_SEGMENT_CHARACTER_PATTERN}, which refuses one, so a stream name
- * such as `file.txt:stream` cannot be smuggled through a later segment.
+ * {@link INVALID_SEGMENT_CHARACTER_PATTERN}, which refuses one, so a later
+ * segment cannot carry a stream name such as `file.txt:stream`.
  */
 export declare const DRIVE_PATTERN: RegExp;
 
@@ -557,7 +557,7 @@ export declare const isHostManifest: Guard<HostManifest>;
  * @remarks
  * Compose this ahead of an element guard exactly as the core collection guard is
  * composed, and for the same reason: the item count is settled before anything
- * walks the items, and a hostile `length` accessor answers `false` rather than
+ * walks the items, and a throwing `length` accessor answers `false` rather than
  * escaping as a throw. It exists beside that guard rather than reusing it
  * because they bound different things — one bounds what a caller may hand a
  * public method, this one bounds what a checkout may contain.
@@ -1046,7 +1046,7 @@ export declare function matchesGitPath(path: string): boolean;
  * The one place absence is told apart from failure. Every read here answers
  * `undefined` or an empty result for a path that is not there and reports a path
  * that is there but unreadable, so they must never be read from the same
- * caught value by eye. Total for any caught value, including a hostile one.
+ * caught value by eye. Total for any caught value, including one whose reads throw.
  *
  * @example
  * ```ts
@@ -1588,7 +1588,7 @@ export declare class Materializer implements MaterializerInterface {
             * Far above the core collection ceiling, and deliberately so. A tracked or dirty
             * path list is the target repository's own fact rather than an argument a caller
             * authored, so measuring it against the ceiling that bounds a public collection
-            * would read a legitimately large checkout as hostile and refuse the deletion
+            * would read a legitimately large checkout as off contract and refuse the deletion
             * verb on it.
             */
            export declare const MAX_INVENTORY_PATHS = 100000;
@@ -1687,7 +1687,7 @@ export declare class Materializer implements MaterializerInterface {
             * Candidates are taken deepest first, which is what lets a whole chain go: the
             * directory holding nothing but the emptied directory is empty in turn by the
             * time it is read. Each one is resolved through the containment law and left
-            * standing when it escapes the target, is not a physical directory, still holds
+            * standing when it resolves outside the target, is not a physical directory, still holds
             * an entry, or refuses removal, and a directory left standing is absent from the
             * answer.
             *
@@ -2071,7 +2071,7 @@ export declare class Materializer implements MaterializerInterface {
                  * concurrent rename or link swap during the call or before the caller finishes
                  * using the returned path. This helper returns a string, not a filesystem
                  * handle, so it cannot bind its containment check to a later operation. A caller
-                 * that admits hostile concurrent namespace mutation needs a handle-bound
+                 * that admits untrusted concurrent namespace mutation needs a handle-bound
                  * operation instead.
                  *
                  * @example
@@ -2099,7 +2099,7 @@ export declare class Materializer implements MaterializerInterface {
                  * prefix moves the destination somewhere the text never named. So the deepest
                  * existing ancestor is resolved and the remaining segments are re-joined onto
                  * it. {@link climbRealPath} performs the climb and bounds it by the path-depth
-                 * ceiling, so an adversarial path cannot make it walk indefinitely.
+                 * ceiling, so no path can make it walk indefinitely.
                  *
                  * The caller's own text is collapsed first, which is what `resolve` does with a
                  * `..` the caller wrote: it cancels the segment before it as text, before any
@@ -2325,7 +2325,7 @@ export declare class Materializer implements MaterializerInterface {
                  * baseline instead of a mixture it would have to reconcile.
                  *
                  * Requests are unauthenticated because every fleet repository is public, and
-                 * they follow no redirect, so a misconfigured or hostile endpoint cannot move a
+                 * they follow no redirect, so a misconfigured or untrusted endpoint cannot move a
                  * read to another host. Each one is bounded by its endpoint's timeout and by the
                  * reader's own abort signal, so {@link Upstream.destroy} cancels what is in
                  * flight instead of waiting for it.

package/dist/src/server/index.d.ts

@@ -55,9 +55,9 @@ export declare interface BytesReadResult {
  * Each step reads one path and moves the climb to one other: a dangling link redirects it to the
  * link's target with the same suffix, and an absent name moves it to the parent with that name added
  * to the suffix. One successor per step makes the climb a bounded recursion rather than a worklist,
- * and the depth argument is its bound, so an adversarial path or a link cycle answers `undefined`
- * after `MAX_PATH_DEPTH` steps instead of walking indefinitely. {@link resolveRealPath} starts the
- * climb at depth 0 with nothing pending.
+ * and the depth argument is its bound, so a path or a link cycle whose climb runs past that bound
+ * answers `undefined` after `MAX_PATH_DEPTH` steps instead of walking indefinitely.
+ * {@link resolveRealPath} starts the climb at depth 0 with nothing pending.
  *
  * @example
  * ```ts
@@ -233,8 +233,8 @@ export declare const DIGEST_PATTERN: RegExp;
  *
  * @remarks
  * The one segment allowed to carry a colon. Every other segment is measured by
- * {@link INVALID_SEGMENT_CHARACTER_PATTERN}, which refuses one, so a stream name
- * such as `file.txt:stream` cannot be smuggled through a later segment.
+ * {@link INVALID_SEGMENT_CHARACTER_PATTERN}, which refuses one, so a later
+ * segment cannot carry a stream name such as `file.txt:stream`.
  */
 export declare const DRIVE_PATTERN: RegExp;
 
@@ -557,7 +557,7 @@ export declare const isHostManifest: Guard<HostManifest>;
  * @remarks
  * Compose this ahead of an element guard exactly as the core collection guard is
  * composed, and for the same reason: the item count is settled before anything
- * walks the items, and a hostile `length` accessor answers `false` rather than
+ * walks the items, and a throwing `length` accessor answers `false` rather than
  * escaping as a throw. It exists beside that guard rather than reusing it
  * because they bound different things — one bounds what a caller may hand a
  * public method, this one bounds what a checkout may contain.
@@ -1046,7 +1046,7 @@ export declare function matchesGitPath(path: string): boolean;
  * The one place absence is told apart from failure. Every read here answers
  * `undefined` or an empty result for a path that is not there and reports a path
  * that is there but unreadable, so they must never be read from the same
- * caught value by eye. Total for any caught value, including a hostile one.
+ * caught value by eye. Total for any caught value, including one whose reads throw.
  *
  * @example
  * ```ts
@@ -1588,7 +1588,7 @@ export declare class Materializer implements MaterializerInterface {
             * Far above the core collection ceiling, and deliberately so. A tracked or dirty
             * path list is the target repository's own fact rather than an argument a caller
             * authored, so measuring it against the ceiling that bounds a public collection
-            * would read a legitimately large checkout as hostile and refuse the deletion
+            * would read a legitimately large checkout as off contract and refuse the deletion
             * verb on it.
             */
            export declare const MAX_INVENTORY_PATHS = 100000;
@@ -1687,7 +1687,7 @@ export declare class Materializer implements MaterializerInterface {
             * Candidates are taken deepest first, which is what lets a whole chain go: the
             * directory holding nothing but the emptied directory is empty in turn by the
             * time it is read. Each one is resolved through the containment law and left
-            * standing when it escapes the target, is not a physical directory, still holds
+            * standing when it resolves outside the target, is not a physical directory, still holds
             * an entry, or refuses removal, and a directory left standing is absent from the
             * answer.
             *
@@ -2071,7 +2071,7 @@ export declare class Materializer implements MaterializerInterface {
                  * concurrent rename or link swap during the call or before the caller finishes
                  * using the returned path. This helper returns a string, not a filesystem
                  * handle, so it cannot bind its containment check to a later operation. A caller
-                 * that admits hostile concurrent namespace mutation needs a handle-bound
+                 * that admits untrusted concurrent namespace mutation needs a handle-bound
                  * operation instead.
                  *
                  * @example
@@ -2099,7 +2099,7 @@ export declare class Materializer implements MaterializerInterface {
                  * prefix moves the destination somewhere the text never named. So the deepest
                  * existing ancestor is resolved and the remaining segments are re-joined onto
                  * it. {@link climbRealPath} performs the climb and bounds it by the path-depth
-                 * ceiling, so an adversarial path cannot make it walk indefinitely.
+                 * ceiling, so no path can make it walk indefinitely.
                  *
                  * The caller's own text is collapsed first, which is what `resolve` does with a
                  * `..` the caller wrote: it cancels the segment before it as text, before any
@@ -2325,7 +2325,7 @@ export declare class Materializer implements MaterializerInterface {
                  * baseline instead of a mixture it would have to reconcile.
                  *
                  * Requests are unauthenticated because every fleet repository is public, and
-                 * they follow no redirect, so a misconfigured or hostile endpoint cannot move a
+                 * they follow no redirect, so a misconfigured or untrusted endpoint cannot move a
                  * read to another host. Each one is bounded by its endpoint's timeout and by the
                  * reader's own abort signal, so {@link Upstream.destroy} cancels what is in
                  * flight instead of waiting for it.

package/dist/src/server/index.js

@@ -14,8 +14,8 @@ import { Emitter } from "@orkestrel/emitter";
 *
 * @remarks
 * The one segment allowed to carry a colon. Every other segment is measured by
-* {@link INVALID_SEGMENT_CHARACTER_PATTERN}, which refuses one, so a stream name
-* such as `file.txt:stream` cannot be smuggled through a later segment.
+* {@link INVALID_SEGMENT_CHARACTER_PATTERN}, which refuses one, so a later
+* segment cannot carry a stream name such as `file.txt:stream`.
 */
 var DRIVE_PATTERN = /^[A-Za-z]:$/;
 /**
@@ -80,7 +80,7 @@ var MAX_PATH_DEPTH = 64;
 * Far above the core collection ceiling, and deliberately so. A tracked or dirty
 * path list is the target repository's own fact rather than an argument a caller
 * authored, so measuring it against the ceiling that bounds a public collection
-* would read a legitimately large checkout as hostile and refuse the deletion
+* would read a legitimately large checkout as off contract and refuse the deletion
 * verb on it.
 */
 var MAX_INVENTORY_PATHS = 1e5;
@@ -173,7 +173,7 @@ var PACKUMENT_MEDIA_TYPE = "application/vnd.npm.install-v1+json";
 * The one place absence is told apart from failure. Every read here answers
 * `undefined` or an empty result for a path that is not there and reports a path
 * that is there but unreadable, so they must never be read from the same
-* caught value by eye. Total for any caught value, including a hostile one.
+* caught value by eye. Total for any caught value, including one whose reads throw.
 *
 * @example
 * ```ts
@@ -622,7 +622,7 @@ function computeFileDigest(path) {
 * prefix moves the destination somewhere the text never named. So the deepest
 * existing ancestor is resolved and the remaining segments are re-joined onto
 * it. {@link climbRealPath} performs the climb and bounds it by the path-depth
-* ceiling, so an adversarial path cannot make it walk indefinitely.
+* ceiling, so no path can make it walk indefinitely.
 *
 * The caller's own text is collapsed first, which is what `resolve` does with a
 * `..` the caller wrote: it cancels the segment before it as text, before any
@@ -673,9 +673,9 @@ function resolveRealPath(path) {
 * Each step reads one path and moves the climb to one other: a dangling link redirects it to the
 * link's target with the same suffix, and an absent name moves it to the parent with that name added
 * to the suffix. One successor per step makes the climb a bounded recursion rather than a worklist,
-* and the depth argument is its bound, so an adversarial path or a link cycle answers `undefined`
-* after `MAX_PATH_DEPTH` steps instead of walking indefinitely. {@link resolveRealPath} starts the
-* climb at depth 0 with nothing pending.
+* and the depth argument is its bound, so a path or a link cycle whose climb runs past that bound
+* answers `undefined` after `MAX_PATH_DEPTH` steps instead of walking indefinitely.
+* {@link resolveRealPath} starts the climb at depth 0 with nothing pending.
 *
 * @example
 * ```ts
@@ -728,7 +728,7 @@ function climbRealPath(current, pending, depth) {
 * concurrent rename or link swap during the call or before the caller finishes
 * using the returned path. This helper returns a string, not a filesystem
 * handle, so it cannot bind its containment check to a later operation. A caller
-* that admits hostile concurrent namespace mutation needs a handle-bound
+* that admits untrusted concurrent namespace mutation needs a handle-bound
 * operation instead.
 *
 * @example
@@ -1030,7 +1030,7 @@ function listCanonPaths(target, groups) {
 * Candidates are taken deepest first, which is what lets a whole chain go: the
 * directory holding nothing but the emptied directory is empty in turn by the
 * time it is read. Each one is resolved through the containment law and left
-* standing when it escapes the target, is not a physical directory, still holds
+* standing when it resolves outside the target, is not a physical directory, still holds
 * an entry, or refuses removal, and a directory left standing is absent from the
 * answer.
 *
@@ -2080,7 +2080,7 @@ var isDigest = stringOf({ pattern: DIGEST_PATTERN });
 * @remarks
 * Compose this ahead of an element guard exactly as the core collection guard is
 * composed, and for the same reason: the item count is settled before anything
-* walks the items, and a hostile `length` accessor answers `false` rather than
+* walks the items, and a throwing `length` accessor answers `false` rather than
 * escaping as a throw. It exists beside that guard rather than reusing it
 * because they bound different things — one bounds what a caller may hand a
 * public method, this one bounds what a checkout may contain.
@@ -3925,7 +3925,7 @@ var ReadAllowance = class {
 * baseline instead of a mixture it would have to reconcile.
 *
 * Requests are unauthenticated because every fleet repository is public, and
-* they follow no redirect, so a misconfigured or hostile endpoint cannot move a
+* they follow no redirect, so a misconfigured or untrusted endpoint cannot move a
 * read to another host. Each one is bounded by its endpoint's timeout and by the
 * reader's own abort signal, so {@link Upstream.destroy} cancels what is in
 * flight instead of waiting for it.