@orkestrel/scaffold 0.0.14 → 0.0.16

package/dist/src/server/index.cjs

@@ -296,6 +296,34 @@ function isMaterializerEventHooks(value) {
 }
 //#endregion
 //#region src/server/parsers.ts
+/**
+* Parse and semantically validate bare registry package names before Sync performs network I/O.
+*
+* @param value - Untrusted package-name collection.
+* @returns A frozen owned snapshot of valid unique npm package names.
+*/
+function parseSyncNames(value) {
+	const owned = (0, _orkestrel_contract.attempt)(() => {
+		if (!(0, _src_core.isDenseDataArray)(value, 1e3, (candidate) => typeof candidate === "string")) throw new Error("package names are malformed");
+		const length = Reflect.getOwnPropertyDescriptor(value, "length")?.value;
+		if (typeof length !== "number" || !Number.isSafeInteger(length) || length < 0 || length > 1e3) throw new Error("package name length is malformed");
+		const names = [];
+		for (let index = 0; index < length; index += 1) {
+			const descriptor = Reflect.getOwnPropertyDescriptor(value, String(index));
+			if (descriptor === void 0 || !Reflect.has(descriptor, "value") || typeof descriptor.value !== "string") throw new Error("package name is malformed");
+			names.push(descriptor.value);
+		}
+		return Object.freeze(names);
+	});
+	if (!owned.success) throw new _src_core.ScaffoldError("INVALID", "Sync package names are malformed", { error: owned.error });
+	const snapshot = owned.value;
+	const seen = /* @__PURE__ */ new Set();
+	for (const name of snapshot) {
+		if (name.length === 0 || name.length > _src_core.MAX_DEPENDENCY_NAME_LENGTH || !_src_core.EXTRA_NAME_PATTERN.test(name) || seen.has(name)) throw new _src_core.ScaffoldError("INVALID", "Sync package names are invalid", { name });
+		seen.add(name);
+	}
+	return snapshot;
+}
 /** Parse and semantically validate dependency data before Sync performs network I/O. */
 function parseSyncDependencies(value, external) {
 	const owned = (0, _orkestrel_contract.attempt)(() => {
@@ -3541,6 +3569,10 @@ var Sync = class Sync {
 	get emitter() {
 		return this.#emitter;
 	}
+	async lookup(names) {
+		this.#ensureAlive();
+		return this.#lookup(names, Float64Array.of(this.#budget));
+	}
 	async guides(deps, current) {
 		this.#ensureAlive();
 		return this.#guides(deps, current, Float64Array.of(this.#budget));
@@ -3570,21 +3602,33 @@ var Sync = class Sync {
 			return guide;
 		});
 	}
-	#versions(deps, allowance) {
+	async #versions(deps, allowance) {
 		const parsed = parseSyncDependencies(deps, true);
+		const lookups = await this.#lookup(parsed.map((dependency) => dependency.name), allowance);
+		const versions = [];
+		for (let index = 0; index < parsed.length; index += 1) {
+			const dep = parsed[index];
+			const lookup = lookups[index];
+			if (dep === void 0 || lookup === void 0) throw new _src_core.ScaffoldError("INVALID", "Sync version lookup result is incomplete");
+			versions.push(Sync.#toVersionSync(dep, lookup));
+		}
+		return Object.freeze(versions);
+	}
+	#lookup(names, allowance) {
+		const parsed = parseSyncNames(names);
 		if (parsed.length > this.#items) throw new _src_core.ScaffoldError("INVALID", "Sync dependency count exceeds its item limit", {
 			items: parsed.length,
 			limit: this.#items
 		});
-		return Sync.#runPool(parsed, this.#concurrency, async (dep) => {
-			const url = this.#registryUrl(dep.name);
+		return Sync.#runPool(parsed, this.#concurrency, async (name) => {
+			const url = this.#registryUrl(name);
 			const outcome = await Sync.#fetchText(url, this.#registryTimeout, this.#retries, this.#limit, allowance, this.#controller.signal);
-			const version = Sync.#toVersionSync(dep, outcome);
+			const version = Sync.#toVersionLookup(name, outcome);
 			if (outcome.kind === "failed") this.#emitter.emit("error", outcome.error);
-			this.#emitter.emit("version", dep.name);
+			this.#emitter.emit("version", name);
 			if (this.#strict && (version.freshness === "missing" || version.freshness === "failed")) throw new _src_core.ScaffoldError("FETCH", `Failed to fetch registry version at ${url}`, {
 				url,
-				name: dep.name
+				name
 			});
 			return version;
 		});
@@ -3925,34 +3969,42 @@ var Sync = class Sync {
 			...baseline === void 0 ? {} : { baseline }
 		};
 	}
-	static #toVersionSync(dep, outcome) {
+	static #toVersionLookup(name, outcome) {
 		if (outcome.kind === "missing") return {
-			name: dep.name,
-			range: dep.range,
-			latest: "",
+			name,
 			freshness: "missing",
 			note: "HTTP 404"
 		};
 		if (outcome.kind === "failed") return {
-			name: dep.name,
-			range: dep.range,
-			latest: "",
+			name,
 			freshness: "failed",
 			note: outcome.note
 		};
 		const latest = Sync.#parseLatest(outcome.text);
 		if (latest === void 0) return {
+			name,
+			freshness: "failed",
+			note: "malformed registry response (missing dist-tags.latest)"
+		};
+		return {
+			name,
+			latest,
+			freshness: "behind"
+		};
+	}
+	static #toVersionSync(dep, lookup) {
+		if (lookup.freshness !== "behind") return {
 			name: dep.name,
 			range: dep.range,
 			latest: "",
-			freshness: "failed",
-			note: "malformed registry response (missing dist-tags.latest)"
+			freshness: lookup.freshness,
+			note: lookup.note
 		};
 		return {
 			name: dep.name,
 			range: dep.range,
-			latest,
-			freshness: (0, _src_core.rangeToFreshness)(dep.range, latest)
+			latest: lookup.latest,
+			freshness: (0, _src_core.rangeToFreshness)(dep.range, lookup.latest)
 		};
 	}
 	static #toOrgPackages(outcome, url) {
@@ -4151,6 +4203,7 @@ exports.parseSyncBase = parseSyncBase;
 exports.parseSyncBranch = parseSyncBranch;
 exports.parseSyncCurrent = parseSyncCurrent;
 exports.parseSyncDependencies = parseSyncDependencies;
+exports.parseSyncNames = parseSyncNames;
 exports.parseSyncOptions = parseSyncOptions;
 exports.parseWritePreconditions = parseWritePreconditions;
 exports.pruneTargets = pruneTargets;