@orkestrel/scaffold 0.0.14 → 0.0.16

package/dist/src/server/index.d.cts

@@ -705,6 +705,14 @@ export declare function parseSyncCurrent(value: Readonly<Record<string, string>>
 /** Parse and semantically validate dependency data before Sync performs network I/O. */
 export declare function parseSyncDependencies(value: unknown, external: boolean): readonly Dependency[];
 
+/**
+ * Parse and semantically validate bare registry package names before Sync performs network I/O.
+ *
+ * @param value - Untrusted package-name collection.
+ * @returns A frozen owned snapshot of valid unique npm package names.
+ */
+export declare function parseSyncNames(value: unknown): readonly string[];
+
 /**
  * Parse the exact bounded `SyncOptions` boundary before allocating resources.
  *
@@ -1041,6 +1049,7 @@ export declare class Sync implements SyncInterface {
     #private;
     constructor(options?: SyncOptions);
     get emitter(): EmitterInterface<SyncEventMap>;
+    lookup(names: readonly string[]): Promise<readonly VersionLookup[]>;
     guides(deps: readonly Dependency[], current?: Readonly<Record<string, string>>): Promise<readonly GuideSync[]>;
     versions(deps: readonly Dependency[]): Promise<readonly VersionSync[]>;
     /**
@@ -1121,6 +1130,7 @@ export declare function syncGuideOptionsShape(): ObjectShape<{
  */
 export declare interface SyncInterface {
     readonly emitter: EmitterInterface<SyncEventMap>;
+    lookup(names: readonly string[]): Promise<readonly VersionLookup[]>;
     guides(deps: readonly Dependency[], current?: Readonly<Record<string, string>>): Promise<readonly GuideSync[]>;
     versions(deps: readonly Dependency[]): Promise<readonly VersionSync[]>;
     catalog(): Promise<readonly CatalogEntry[]>;
@@ -1282,6 +1292,17 @@ export declare function validateWriteTarget(transaction: WriteTransaction, owned
  */
 export declare function vendoredPruneSet(host: string, directory: string): ReadonlySet<string>;
 
+/** One bare-name registry lookup, without a caller-invented declaration range. */
+export declare type VersionLookup = {
+    readonly name: string;
+    readonly latest: string;
+    readonly freshness: 'behind';
+} | {
+    readonly name: string;
+    readonly freshness: 'missing' | 'failed';
+    readonly note: string;
+};
+
 /** Exact SHA-256 digest accepted by write preconditions. */
 export declare const WRITE_DIGEST_PATTERN: RegExp;
 

package/dist/src/server/index.d.ts

@@ -705,6 +705,14 @@ export declare function parseSyncCurrent(value: Readonly<Record<string, string>>
 /** Parse and semantically validate dependency data before Sync performs network I/O. */
 export declare function parseSyncDependencies(value: unknown, external: boolean): readonly Dependency[];
 
+/**
+ * Parse and semantically validate bare registry package names before Sync performs network I/O.
+ *
+ * @param value - Untrusted package-name collection.
+ * @returns A frozen owned snapshot of valid unique npm package names.
+ */
+export declare function parseSyncNames(value: unknown): readonly string[];
+
 /**
  * Parse the exact bounded `SyncOptions` boundary before allocating resources.
  *
@@ -1041,6 +1049,7 @@ export declare class Sync implements SyncInterface {
     #private;
     constructor(options?: SyncOptions);
     get emitter(): EmitterInterface<SyncEventMap>;
+    lookup(names: readonly string[]): Promise<readonly VersionLookup[]>;
     guides(deps: readonly Dependency[], current?: Readonly<Record<string, string>>): Promise<readonly GuideSync[]>;
     versions(deps: readonly Dependency[]): Promise<readonly VersionSync[]>;
     /**
@@ -1121,6 +1130,7 @@ export declare function syncGuideOptionsShape(): ObjectShape<{
  */
 export declare interface SyncInterface {
     readonly emitter: EmitterInterface<SyncEventMap>;
+    lookup(names: readonly string[]): Promise<readonly VersionLookup[]>;
     guides(deps: readonly Dependency[], current?: Readonly<Record<string, string>>): Promise<readonly GuideSync[]>;
     versions(deps: readonly Dependency[]): Promise<readonly VersionSync[]>;
     catalog(): Promise<readonly CatalogEntry[]>;
@@ -1282,6 +1292,17 @@ export declare function validateWriteTarget(transaction: WriteTransaction, owned
  */
 export declare function vendoredPruneSet(host: string, directory: string): ReadonlySet<string>;
 
+/** One bare-name registry lookup, without a caller-invented declaration range. */
+export declare type VersionLookup = {
+    readonly name: string;
+    readonly latest: string;
+    readonly freshness: 'behind';
+} | {
+    readonly name: string;
+    readonly freshness: 'missing' | 'failed';
+    readonly note: string;
+};
+
 /** Exact SHA-256 digest accepted by write preconditions. */
 export declare const WRITE_DIGEST_PATTERN: RegExp;
 

package/dist/src/server/index.js

@@ -1,4 +1,4 @@
-import { CONTROL_CHARACTER_PATTERN, DEFAULT_ENGINES, DEFAULT_VERSION, DEPENDENCY_NAME_PATTERN, ENVIRONMENTS, GLOBAL_SETUP_PATH, HEX_PATTERN, HOST_PATHS, INVALID_PATH_CHARACTER_PATTERN, MAX_ARTIFACT_BYTES, MAX_ARTIFACT_HEX_LENGTH, MAX_COLLECTION_ITEMS, MAX_MANIFEST_BYTES, MAX_PATH_LENGTH, MAX_TOTAL_ARTIFACT_BYTES, SERVICE_SCRIPT_PATH, SYNC_BASELINE_PATTERN, ScaffoldError, VERSION_PATTERN, blueprint, bytesToHex, contentByteLength, devDependenciesFor, diffPlan, findFileConflict, findPathConflict, hasOnlyDataProperties, hasValidAuditBytes, hasValidSnapshotBytes, isDenseDataArray, isDependency, isEmitterErrorHandler, isPlan, isSyncReport, isWorkspaceName, manifestToDependencies, manifestToName, ownDataValue, parsePlan, parseSyncReport, rangeToFreshness, snapshotPlan, validateDependencyArray, validatePlan } from "../core/index.js";
+import { CONTROL_CHARACTER_PATTERN, DEFAULT_ENGINES, DEFAULT_VERSION, DEPENDENCY_NAME_PATTERN, ENVIRONMENTS, EXTRA_NAME_PATTERN, GLOBAL_SETUP_PATH, HEX_PATTERN, HOST_PATHS, INVALID_PATH_CHARACTER_PATTERN, MAX_ARTIFACT_BYTES, MAX_ARTIFACT_HEX_LENGTH, MAX_COLLECTION_ITEMS, MAX_DEPENDENCY_NAME_LENGTH, MAX_MANIFEST_BYTES, MAX_PATH_LENGTH, MAX_TOTAL_ARTIFACT_BYTES, SERVICE_SCRIPT_PATH, SYNC_BASELINE_PATTERN, ScaffoldError, VERSION_PATTERN, blueprint, bytesToHex, contentByteLength, devDependenciesFor, diffPlan, findFileConflict, findPathConflict, hasOnlyDataProperties, hasValidAuditBytes, hasValidSnapshotBytes, isDenseDataArray, isDependency, isEmitterErrorHandler, isPlan, isSyncReport, isWorkspaceName, manifestToDependencies, manifestToName, ownDataValue, parsePlan, parseSyncReport, rangeToFreshness, snapshotPlan, validateDependencyArray, validatePlan } from "../core/index.js";
 import { attempt, booleanShape, createContract, integerShape, isError, isFunction, isRecord, isString, objectShape, optionalShape, parseJSON, parseJSONAs, stringShape } from "@orkestrel/contract";
 import { createHash, randomUUID } from "node:crypto";
 import { chmodSync, closeSync, constants, copyFileSync, existsSync, fstatSync, linkSync, lstatSync, mkdirSync, openSync, opendirSync, readSync, readdirSync, realpathSync, renameSync, rmSync, rmdirSync, writeFileSync } from "node:fs";
@@ -295,6 +295,34 @@ function isMaterializerEventHooks(value) {
 }
 //#endregion
 //#region src/server/parsers.ts
+/**
+* Parse and semantically validate bare registry package names before Sync performs network I/O.
+*
+* @param value - Untrusted package-name collection.
+* @returns A frozen owned snapshot of valid unique npm package names.
+*/
+function parseSyncNames(value) {
+	const owned = attempt(() => {
+		if (!isDenseDataArray(value, 1e3, (candidate) => typeof candidate === "string")) throw new Error("package names are malformed");
+		const length = Reflect.getOwnPropertyDescriptor(value, "length")?.value;
+		if (typeof length !== "number" || !Number.isSafeInteger(length) || length < 0 || length > 1e3) throw new Error("package name length is malformed");
+		const names = [];
+		for (let index = 0; index < length; index += 1) {
+			const descriptor = Reflect.getOwnPropertyDescriptor(value, String(index));
+			if (descriptor === void 0 || !Reflect.has(descriptor, "value") || typeof descriptor.value !== "string") throw new Error("package name is malformed");
+			names.push(descriptor.value);
+		}
+		return Object.freeze(names);
+	});
+	if (!owned.success) throw new ScaffoldError("INVALID", "Sync package names are malformed", { error: owned.error });
+	const snapshot = owned.value;
+	const seen = /* @__PURE__ */ new Set();
+	for (const name of snapshot) {
+		if (name.length === 0 || name.length > MAX_DEPENDENCY_NAME_LENGTH || !EXTRA_NAME_PATTERN.test(name) || seen.has(name)) throw new ScaffoldError("INVALID", "Sync package names are invalid", { name });
+		seen.add(name);
+	}
+	return snapshot;
+}
 /** Parse and semantically validate dependency data before Sync performs network I/O. */
 function parseSyncDependencies(value, external) {
 	const owned = attempt(() => {
@@ -3540,6 +3568,10 @@ var Sync = class Sync {
 	get emitter() {
 		return this.#emitter;
 	}
+	async lookup(names) {
+		this.#ensureAlive();
+		return this.#lookup(names, Float64Array.of(this.#budget));
+	}
 	async guides(deps, current) {
 		this.#ensureAlive();
 		return this.#guides(deps, current, Float64Array.of(this.#budget));
@@ -3569,21 +3601,33 @@ var Sync = class Sync {
 			return guide;
 		});
 	}
-	#versions(deps, allowance) {
+	async #versions(deps, allowance) {
 		const parsed = parseSyncDependencies(deps, true);
+		const lookups = await this.#lookup(parsed.map((dependency) => dependency.name), allowance);
+		const versions = [];
+		for (let index = 0; index < parsed.length; index += 1) {
+			const dep = parsed[index];
+			const lookup = lookups[index];
+			if (dep === void 0 || lookup === void 0) throw new ScaffoldError("INVALID", "Sync version lookup result is incomplete");
+			versions.push(Sync.#toVersionSync(dep, lookup));
+		}
+		return Object.freeze(versions);
+	}
+	#lookup(names, allowance) {
+		const parsed = parseSyncNames(names);
 		if (parsed.length > this.#items) throw new ScaffoldError("INVALID", "Sync dependency count exceeds its item limit", {
 			items: parsed.length,
 			limit: this.#items
 		});
-		return Sync.#runPool(parsed, this.#concurrency, async (dep) => {
-			const url = this.#registryUrl(dep.name);
+		return Sync.#runPool(parsed, this.#concurrency, async (name) => {
+			const url = this.#registryUrl(name);
 			const outcome = await Sync.#fetchText(url, this.#registryTimeout, this.#retries, this.#limit, allowance, this.#controller.signal);
-			const version = Sync.#toVersionSync(dep, outcome);
+			const version = Sync.#toVersionLookup(name, outcome);
 			if (outcome.kind === "failed") this.#emitter.emit("error", outcome.error);
-			this.#emitter.emit("version", dep.name);
+			this.#emitter.emit("version", name);
 			if (this.#strict && (version.freshness === "missing" || version.freshness === "failed")) throw new ScaffoldError("FETCH", `Failed to fetch registry version at ${url}`, {
 				url,
-				name: dep.name
+				name
 			});
 			return version;
 		});
@@ -3924,34 +3968,42 @@ var Sync = class Sync {
 			...baseline === void 0 ? {} : { baseline }
 		};
 	}
-	static #toVersionSync(dep, outcome) {
+	static #toVersionLookup(name, outcome) {
 		if (outcome.kind === "missing") return {
-			name: dep.name,
-			range: dep.range,
-			latest: "",
+			name,
 			freshness: "missing",
 			note: "HTTP 404"
 		};
 		if (outcome.kind === "failed") return {
-			name: dep.name,
-			range: dep.range,
-			latest: "",
+			name,
 			freshness: "failed",
 			note: outcome.note
 		};
 		const latest = Sync.#parseLatest(outcome.text);
 		if (latest === void 0) return {
+			name,
+			freshness: "failed",
+			note: "malformed registry response (missing dist-tags.latest)"
+		};
+		return {
+			name,
+			latest,
+			freshness: "behind"
+		};
+	}
+	static #toVersionSync(dep, lookup) {
+		if (lookup.freshness !== "behind") return {
 			name: dep.name,
 			range: dep.range,
 			latest: "",
-			freshness: "failed",
-			note: "malformed registry response (missing dist-tags.latest)"
+			freshness: lookup.freshness,
+			note: lookup.note
 		};
 		return {
 			name: dep.name,
 			range: dep.range,
-			latest,
-			freshness: rangeToFreshness(dep.range, latest)
+			latest: lookup.latest,
+			freshness: rangeToFreshness(dep.range, lookup.latest)
 		};
 	}
 	static #toOrgPackages(outcome, url) {
@@ -4075,6 +4127,6 @@ function createSync(options) {
 	return new Sync(options);
 }
 //#endregion
-export { DEFAULT_SYNC_BUDGET, DEFAULT_SYNC_CONCURRENCY, DEFAULT_SYNC_ITEMS, DEFAULT_SYNC_LIMIT, DEFAULT_SYNC_TIMEOUT, HOST_MANIFEST_PATH, MAX_CATALOG_DESCRIPTION_LENGTH, MAX_FILESYSTEM_DEPTH, MAX_GUIDE_BYTES, MAX_HOST_DEPTH, MAX_HOST_ENTRIES, MAX_PATH_SEGMENT_BYTES, MAX_SYNC_BASE_LENGTH, MAX_SYNC_BRANCH_LENGTH, MAX_SYNC_BUDGET, MAX_SYNC_CONCURRENCY, MAX_SYNC_ITEMS, MAX_SYNC_LIMIT, MAX_SYNC_RETRIES, MAX_SYNC_TIMEOUT, Materializer, PRUNE_DIRECTORIES, RESERVED_PATH_SEGMENT_PATTERN, RESERVED_TARGET_PATH_PATTERN, SENSITIVE_HOST_PATH_PATTERN, SYNC_BRANCH_PATTERN, Sync, WRITE_DIGEST_PATTERN, WriteTransaction, catalogPackages, commitWriteTransaction, consumeCatalogAllowance, createMaterializer, createSync, createWriteDirectory, deriveBlueprint, digestFile, digestHex, digestText, discardWriteTransaction, discoverPackages, guideStub, guideToDescription, hostRoot, hydratePlan, isCatalogAllowance, isCatalogDescription, isDependencyData, isFilesystemPath, isHostManifest, isManifestEntry, isMaterializerEventHooks, isMissingPathError, isPortablePath, isRealDirectory, isRealFile, isReservedTargetPath, isSensitiveHostPath, isSyncEventHooks, isTerminalText, isVacant, isWritePrecondition, listDirectories, listFiles, locateHostSource, materializerOptionsContract, materializerOptionsShape, packageShortName, parseFilesystemPaths, parseMaterializerOptions, parsePortablePaths, parseSyncBase, parseSyncBranch, parseSyncCurrent, parseSyncDependencies, parseSyncOptions, parseWritePreconditions, pruneTargets, readFileHex, readFileText, readGuideReferences, readHostManifest, readManifest, readTarget, remapArtifactPath, replaceDirectory, resolveContainedPath, resolveGuideWrites, resolvePhysicalPath, resolveRealPath, restoreFiles, selectOrkestrelEntries, stageHost, storagePath, syncGuideOptionsShape, syncOptionsContract, syncOptionsShape, syncRegistryOptionsShape, syncReportOf, validateWriteAnchor, validateWriteDirectories, validateWriteTarget, vendoredPruneSet };
+export { DEFAULT_SYNC_BUDGET, DEFAULT_SYNC_CONCURRENCY, DEFAULT_SYNC_ITEMS, DEFAULT_SYNC_LIMIT, DEFAULT_SYNC_TIMEOUT, HOST_MANIFEST_PATH, MAX_CATALOG_DESCRIPTION_LENGTH, MAX_FILESYSTEM_DEPTH, MAX_GUIDE_BYTES, MAX_HOST_DEPTH, MAX_HOST_ENTRIES, MAX_PATH_SEGMENT_BYTES, MAX_SYNC_BASE_LENGTH, MAX_SYNC_BRANCH_LENGTH, MAX_SYNC_BUDGET, MAX_SYNC_CONCURRENCY, MAX_SYNC_ITEMS, MAX_SYNC_LIMIT, MAX_SYNC_RETRIES, MAX_SYNC_TIMEOUT, Materializer, PRUNE_DIRECTORIES, RESERVED_PATH_SEGMENT_PATTERN, RESERVED_TARGET_PATH_PATTERN, SENSITIVE_HOST_PATH_PATTERN, SYNC_BRANCH_PATTERN, Sync, WRITE_DIGEST_PATTERN, WriteTransaction, catalogPackages, commitWriteTransaction, consumeCatalogAllowance, createMaterializer, createSync, createWriteDirectory, deriveBlueprint, digestFile, digestHex, digestText, discardWriteTransaction, discoverPackages, guideStub, guideToDescription, hostRoot, hydratePlan, isCatalogAllowance, isCatalogDescription, isDependencyData, isFilesystemPath, isHostManifest, isManifestEntry, isMaterializerEventHooks, isMissingPathError, isPortablePath, isRealDirectory, isRealFile, isReservedTargetPath, isSensitiveHostPath, isSyncEventHooks, isTerminalText, isVacant, isWritePrecondition, listDirectories, listFiles, locateHostSource, materializerOptionsContract, materializerOptionsShape, packageShortName, parseFilesystemPaths, parseMaterializerOptions, parsePortablePaths, parseSyncBase, parseSyncBranch, parseSyncCurrent, parseSyncDependencies, parseSyncNames, parseSyncOptions, parseWritePreconditions, pruneTargets, readFileHex, readFileText, readGuideReferences, readHostManifest, readManifest, readTarget, remapArtifactPath, replaceDirectory, resolveContainedPath, resolveGuideWrites, resolvePhysicalPath, resolveRealPath, restoreFiles, selectOrkestrelEntries, stageHost, storagePath, syncGuideOptionsShape, syncOptionsContract, syncOptionsShape, syncRegistryOptionsShape, syncReportOf, validateWriteAnchor, validateWriteDirectories, validateWriteTarget, vendoredPruneSet };
 
 //# sourceMappingURL=index.js.map