@orkestrel/scaffold 0.0.15 → 0.0.17

package/dist/src/server/index.d.cts

@@ -705,6 +705,14 @@ export declare function parseSyncCurrent(value: Readonly<Record<string, string>>
 /** Parse and semantically validate dependency data before Sync performs network I/O. */
 export declare function parseSyncDependencies(value: unknown, external: boolean): readonly Dependency[];
 
+/**
+ * Parse and semantically validate bare registry package names before Sync performs network I/O.
+ *
+ * @param value - Untrusted package-name collection.
+ * @returns A frozen owned snapshot of valid unique npm package names.
+ */
+export declare function parseSyncNames(value: unknown): readonly string[];
+
 /**
  * Parse the exact bounded `SyncOptions` boundary before allocating resources.
  *
@@ -779,13 +787,13 @@ export declare function readFileHex(root: string, path: string, code: ScaffoldEr
 export declare function readFileText(root: string, path: string, code: ScaffoldErrorCode, boundary: string, limit?: number): string;
 
 /**
- * Read bounded physical local guide mirrors for declared dependencies.
+ * Read bounded physical local guide mirrors for package names.
  *
  * @param target - The package root.
- * @param dependencies - The declared dependencies whose mirrors are eligible.
- * @returns Existing guide content keyed by dependency name.
+ * @param names - The package names whose mirrors are eligible.
+ * @returns Existing guide content keyed by package name.
  */
-export declare function readGuideReferences(target: string, dependencies: readonly Dependency[]): Readonly<Record<string, string>>;
+export declare function readGuideReferences(target: string, names: readonly string[]): Readonly<Record<string, string>>;
 
 /**
  * Read and validate a vendored host root's `manifest.json`, when present.
@@ -1020,8 +1028,10 @@ export declare function storagePath(path: string): string;
  * map, a fetched guide byte-equal to its entry verdicts `current`, anything
  * differing or absent from the map verdicts `behind`; WITHOUT the map, every
  * successful fetch verdicts `behind` (no reference means it needs syncing).
- * `pull` builds that map itself from the TARGET's own `guides/src/<short>.md`
- * mirrors, so its verdicts are target-relative; `write` commits only the
+ * `pull` builds that map itself from the TARGET's declared dependency mirrors;
+ * `mirror` builds it from the registry's exact organization package list,
+ * excluding the target's own guide and issuing no registry version reads. Both
+ * verdicts are target-relative; `write` commits only the
  * `behind` guides (never `current`, `missing`, or `failed`, which carries no
  * trustworthy content) under the same realpath-anchored containment law
  * `Materializer` enforces. After `destroy()` every method throws `DESTROYED`;
@@ -1041,6 +1051,7 @@ export declare class Sync implements SyncInterface {
     #private;
     constructor(options?: SyncOptions);
     get emitter(): EmitterInterface<SyncEventMap>;
+    lookup(names: readonly string[]): Promise<readonly VersionLookup[]>;
     guides(deps: readonly Dependency[], current?: Readonly<Record<string, string>>): Promise<readonly GuideSync[]>;
     versions(deps: readonly Dependency[]): Promise<readonly VersionSync[]>;
     /**
@@ -1071,6 +1082,7 @@ export declare class Sync implements SyncInterface {
      */
     catalog(): Promise<readonly CatalogEntry[]>;
     pull(target: string, dependencies?: readonly Dependency[]): Promise<SyncReport>;
+    mirror(target: string): Promise<SyncReport>;
     write(report: SyncReport, target: string): Promise<readonly string[]>;
     destroy(): void;
 }
@@ -1121,10 +1133,12 @@ export declare function syncGuideOptionsShape(): ObjectShape<{
  */
 export declare interface SyncInterface {
     readonly emitter: EmitterInterface<SyncEventMap>;
+    lookup(names: readonly string[]): Promise<readonly VersionLookup[]>;
     guides(deps: readonly Dependency[], current?: Readonly<Record<string, string>>): Promise<readonly GuideSync[]>;
     versions(deps: readonly Dependency[]): Promise<readonly VersionSync[]>;
     catalog(): Promise<readonly CatalogEntry[]>;
     pull(target: string, dependencies?: readonly Dependency[]): Promise<SyncReport>;
+    mirror(target: string): Promise<SyncReport>;
     write(report: SyncReport, target: string): Promise<readonly string[]>;
     destroy(): void;
 }
@@ -1282,6 +1296,17 @@ export declare function validateWriteTarget(transaction: WriteTransaction, owned
  */
 export declare function vendoredPruneSet(host: string, directory: string): ReadonlySet<string>;
 
+/** One bare-name registry lookup, without a caller-invented declaration range. */
+export declare type VersionLookup = {
+    readonly name: string;
+    readonly latest: string;
+    readonly freshness: 'behind';
+} | {
+    readonly name: string;
+    readonly freshness: 'missing' | 'failed';
+    readonly note: string;
+};
+
 /** Exact SHA-256 digest accepted by write preconditions. */
 export declare const WRITE_DIGEST_PATTERN: RegExp;
 

package/dist/src/server/index.d.ts

@@ -705,6 +705,14 @@ export declare function parseSyncCurrent(value: Readonly<Record<string, string>>
 /** Parse and semantically validate dependency data before Sync performs network I/O. */
 export declare function parseSyncDependencies(value: unknown, external: boolean): readonly Dependency[];
 
+/**
+ * Parse and semantically validate bare registry package names before Sync performs network I/O.
+ *
+ * @param value - Untrusted package-name collection.
+ * @returns A frozen owned snapshot of valid unique npm package names.
+ */
+export declare function parseSyncNames(value: unknown): readonly string[];
+
 /**
  * Parse the exact bounded `SyncOptions` boundary before allocating resources.
  *
@@ -779,13 +787,13 @@ export declare function readFileHex(root: string, path: string, code: ScaffoldEr
 export declare function readFileText(root: string, path: string, code: ScaffoldErrorCode, boundary: string, limit?: number): string;
 
 /**
- * Read bounded physical local guide mirrors for declared dependencies.
+ * Read bounded physical local guide mirrors for package names.
  *
  * @param target - The package root.
- * @param dependencies - The declared dependencies whose mirrors are eligible.
- * @returns Existing guide content keyed by dependency name.
+ * @param names - The package names whose mirrors are eligible.
+ * @returns Existing guide content keyed by package name.
  */
-export declare function readGuideReferences(target: string, dependencies: readonly Dependency[]): Readonly<Record<string, string>>;
+export declare function readGuideReferences(target: string, names: readonly string[]): Readonly<Record<string, string>>;
 
 /**
  * Read and validate a vendored host root's `manifest.json`, when present.
@@ -1020,8 +1028,10 @@ export declare function storagePath(path: string): string;
  * map, a fetched guide byte-equal to its entry verdicts `current`, anything
  * differing or absent from the map verdicts `behind`; WITHOUT the map, every
  * successful fetch verdicts `behind` (no reference means it needs syncing).
- * `pull` builds that map itself from the TARGET's own `guides/src/<short>.md`
- * mirrors, so its verdicts are target-relative; `write` commits only the
+ * `pull` builds that map itself from the TARGET's declared dependency mirrors;
+ * `mirror` builds it from the registry's exact organization package list,
+ * excluding the target's own guide and issuing no registry version reads. Both
+ * verdicts are target-relative; `write` commits only the
  * `behind` guides (never `current`, `missing`, or `failed`, which carries no
  * trustworthy content) under the same realpath-anchored containment law
  * `Materializer` enforces. After `destroy()` every method throws `DESTROYED`;
@@ -1041,6 +1051,7 @@ export declare class Sync implements SyncInterface {
     #private;
     constructor(options?: SyncOptions);
     get emitter(): EmitterInterface<SyncEventMap>;
+    lookup(names: readonly string[]): Promise<readonly VersionLookup[]>;
     guides(deps: readonly Dependency[], current?: Readonly<Record<string, string>>): Promise<readonly GuideSync[]>;
     versions(deps: readonly Dependency[]): Promise<readonly VersionSync[]>;
     /**
@@ -1071,6 +1082,7 @@ export declare class Sync implements SyncInterface {
      */
     catalog(): Promise<readonly CatalogEntry[]>;
     pull(target: string, dependencies?: readonly Dependency[]): Promise<SyncReport>;
+    mirror(target: string): Promise<SyncReport>;
     write(report: SyncReport, target: string): Promise<readonly string[]>;
     destroy(): void;
 }
@@ -1121,10 +1133,12 @@ export declare function syncGuideOptionsShape(): ObjectShape<{
  */
 export declare interface SyncInterface {
     readonly emitter: EmitterInterface<SyncEventMap>;
+    lookup(names: readonly string[]): Promise<readonly VersionLookup[]>;
     guides(deps: readonly Dependency[], current?: Readonly<Record<string, string>>): Promise<readonly GuideSync[]>;
     versions(deps: readonly Dependency[]): Promise<readonly VersionSync[]>;
     catalog(): Promise<readonly CatalogEntry[]>;
     pull(target: string, dependencies?: readonly Dependency[]): Promise<SyncReport>;
+    mirror(target: string): Promise<SyncReport>;
     write(report: SyncReport, target: string): Promise<readonly string[]>;
     destroy(): void;
 }
@@ -1282,6 +1296,17 @@ export declare function validateWriteTarget(transaction: WriteTransaction, owned
  */
 export declare function vendoredPruneSet(host: string, directory: string): ReadonlySet<string>;
 
+/** One bare-name registry lookup, without a caller-invented declaration range. */
+export declare type VersionLookup = {
+    readonly name: string;
+    readonly latest: string;
+    readonly freshness: 'behind';
+} | {
+    readonly name: string;
+    readonly freshness: 'missing' | 'failed';
+    readonly note: string;
+};
+
 /** Exact SHA-256 digest accepted by write preconditions. */
 export declare const WRITE_DIGEST_PATTERN: RegExp;
 

package/dist/src/server/index.js

@@ -1,4 +1,4 @@
-import { CONTROL_CHARACTER_PATTERN, DEFAULT_ENGINES, DEFAULT_VERSION, DEPENDENCY_NAME_PATTERN, ENVIRONMENTS, GLOBAL_SETUP_PATH, HEX_PATTERN, HOST_PATHS, INVALID_PATH_CHARACTER_PATTERN, MAX_ARTIFACT_BYTES, MAX_ARTIFACT_HEX_LENGTH, MAX_COLLECTION_ITEMS, MAX_MANIFEST_BYTES, MAX_PATH_LENGTH, MAX_TOTAL_ARTIFACT_BYTES, SERVICE_SCRIPT_PATH, SYNC_BASELINE_PATTERN, ScaffoldError, VERSION_PATTERN, blueprint, bytesToHex, contentByteLength, devDependenciesFor, diffPlan, findFileConflict, findPathConflict, hasOnlyDataProperties, hasValidAuditBytes, hasValidSnapshotBytes, isDenseDataArray, isDependency, isEmitterErrorHandler, isPlan, isSyncReport, isWorkspaceName, manifestToDependencies, manifestToName, ownDataValue, parsePlan, parseSyncReport, rangeToFreshness, snapshotPlan, validateDependencyArray, validatePlan } from "../core/index.js";
+import { CONTROL_CHARACTER_PATTERN, DEFAULT_ENGINES, DEFAULT_VERSION, DEPENDENCY_NAME_PATTERN, ENVIRONMENTS, EXTRA_NAME_PATTERN, GLOBAL_SETUP_PATH, HEX_PATTERN, HOST_PATHS, INVALID_PATH_CHARACTER_PATTERN, MAX_ARTIFACT_BYTES, MAX_ARTIFACT_HEX_LENGTH, MAX_COLLECTION_ITEMS, MAX_DEPENDENCY_NAME_LENGTH, MAX_MANIFEST_BYTES, MAX_PATH_LENGTH, MAX_TOTAL_ARTIFACT_BYTES, SERVICE_SCRIPT_PATH, SYNC_BASELINE_PATTERN, ScaffoldError, VERSION_PATTERN, blueprint, bytesToHex, contentByteLength, devDependenciesFor, diffPlan, findFileConflict, findPathConflict, hasOnlyDataProperties, hasValidAuditBytes, hasValidSnapshotBytes, isDenseDataArray, isDependency, isEmitterErrorHandler, isPlan, isSyncReport, isWorkspaceName, manifestToDependencies, manifestToName, ownDataValue, parsePlan, parseSyncReport, rangeToFreshness, snapshotPlan, validateDependencyArray, validatePlan } from "../core/index.js";
 import { attempt, booleanShape, createContract, integerShape, isError, isFunction, isRecord, isString, objectShape, optionalShape, parseJSON, parseJSONAs, stringShape } from "@orkestrel/contract";
 import { createHash, randomUUID } from "node:crypto";
 import { chmodSync, closeSync, constants, copyFileSync, existsSync, fstatSync, linkSync, lstatSync, mkdirSync, openSync, opendirSync, readSync, readdirSync, realpathSync, renameSync, rmSync, rmdirSync, writeFileSync } from "node:fs";
@@ -295,6 +295,34 @@ function isMaterializerEventHooks(value) {
 }
 //#endregion
 //#region src/server/parsers.ts
+/**
+* Parse and semantically validate bare registry package names before Sync performs network I/O.
+*
+* @param value - Untrusted package-name collection.
+* @returns A frozen owned snapshot of valid unique npm package names.
+*/
+function parseSyncNames(value) {
+	const owned = attempt(() => {
+		if (!isDenseDataArray(value, 1e3, (candidate) => typeof candidate === "string")) throw new Error("package names are malformed");
+		const length = Reflect.getOwnPropertyDescriptor(value, "length")?.value;
+		if (typeof length !== "number" || !Number.isSafeInteger(length) || length < 0 || length > 1e3) throw new Error("package name length is malformed");
+		const names = [];
+		for (let index = 0; index < length; index += 1) {
+			const descriptor = Reflect.getOwnPropertyDescriptor(value, String(index));
+			if (descriptor === void 0 || !Reflect.has(descriptor, "value") || typeof descriptor.value !== "string") throw new Error("package name is malformed");
+			names.push(descriptor.value);
+		}
+		return Object.freeze(names);
+	});
+	if (!owned.success) throw new ScaffoldError("INVALID", "Sync package names are malformed", { error: owned.error });
+	const snapshot = owned.value;
+	const seen = /* @__PURE__ */ new Set();
+	for (const name of snapshot) {
+		if (name.length === 0 || name.length > MAX_DEPENDENCY_NAME_LENGTH || !EXTRA_NAME_PATTERN.test(name) || seen.has(name)) throw new ScaffoldError("INVALID", "Sync package names are invalid", { name });
+		seen.add(name);
+	}
+	return snapshot;
+}
 /** Parse and semantically validate dependency data before Sync performs network I/O. */
 function parseSyncDependencies(value, external) {
 	const owned = attempt(() => {
@@ -928,16 +956,16 @@ function packageShortName(name) {
 	return name.startsWith("@orkestrel/") ? name.slice(11) : name;
 }
 /**
-* Read bounded physical local guide mirrors for declared dependencies.
+* Read bounded physical local guide mirrors for package names.
 *
 * @param target - The package root.
-* @param dependencies - The declared dependencies whose mirrors are eligible.
-* @returns Existing guide content keyed by dependency name.
+* @param names - The package names whose mirrors are eligible.
+* @returns Existing guide content keyed by package name.
 */
-function readGuideReferences(target, dependencies) {
+function readGuideReferences(target, names) {
 	const current = {};
-	for (const dependency of dependencies) {
-		const path = `guides/src/${packageShortName(dependency.name)}.md`;
+	for (const name of names) {
+		const path = `guides/src/${packageShortName(name)}.md`;
 		const full = resolvePhysicalPath(target, path, "TARGET", "target");
 		const status = attempt(() => lstatSync(full));
 		if (!status.success) {
@@ -948,7 +976,7 @@ function readGuideReferences(target, dependencies) {
 			});
 		}
 		if (!status.value.isFile() || status.value.isSymbolicLink() || status.value.nlink !== 1) throw new ScaffoldError("TARGET", `Local guide is not a physical file at ${path}`, { path });
-		current[dependency.name] = readFileText(target, path, "TARGET", "target");
+		current[name] = readFileText(target, path, "TARGET", "target");
 	}
 	return Object.freeze(current);
 }
@@ -3487,8 +3515,10 @@ var Materializer = class {
 * map, a fetched guide byte-equal to its entry verdicts `current`, anything
 * differing or absent from the map verdicts `behind`; WITHOUT the map, every
 * successful fetch verdicts `behind` (no reference means it needs syncing).
-* `pull` builds that map itself from the TARGET's own `guides/src/<short>.md`
-* mirrors, so its verdicts are target-relative; `write` commits only the
+* `pull` builds that map itself from the TARGET's declared dependency mirrors;
+* `mirror` builds it from the registry's exact organization package list,
+* excluding the target's own guide and issuing no registry version reads. Both
+* verdicts are target-relative; `write` commits only the
 * `behind` guides (never `current`, `missing`, or `failed`, which carries no
 * trustworthy content) under the same realpath-anchored containment law
 * `Materializer` enforces. After `destroy()` every method throws `DESTROYED`;
@@ -3540,50 +3570,67 @@ var Sync = class Sync {
 	get emitter() {
 		return this.#emitter;
 	}
+	async lookup(names) {
+		this.#ensureAlive();
+		return this.#lookup(names, Float64Array.of(this.#budget));
+	}
 	async guides(deps, current) {
 		this.#ensureAlive();
-		return this.#guides(deps, current, Float64Array.of(this.#budget));
+		const parsed = parseSyncDependencies(deps, false);
+		return this.#guides(parsed.map((dependency) => dependency.name), current, Float64Array.of(this.#budget));
 	}
 	async versions(deps) {
 		this.#ensureAlive();
 		return this.#versions(deps, Float64Array.of(this.#budget));
 	}
-	#guides(deps, current, allowance) {
-		const parsed = parseSyncDependencies(deps, false);
+	#guides(names, current, allowance) {
+		const parsed = parseSyncNames(names);
 		if (parsed.length > this.#items) throw new ScaffoldError("INVALID", "Sync dependency count exceeds its item limit", {
 			items: parsed.length,
 			limit: this.#items
 		});
-		const reference = parseSyncCurrent(current, parsed.map((dependency) => dependency.name), this.#budget);
-		return Sync.#runPool(parsed, this.#concurrency, async (dep) => {
-			const short = packageShortName(dep.name);
+		const reference = parseSyncCurrent(current, parsed, this.#budget);
+		return Sync.#runPool(parsed, this.#concurrency, async (name) => {
+			const short = packageShortName(name);
 			const url = this.#guideUrl(short);
 			const outcome = await Sync.#fetchText(url, this.#guidesTimeout, this.#retries, this.#limit, allowance, this.#controller.signal);
-			const guide = Sync.#toGuideSync(dep.name, short, outcome, reference);
+			const guide = Sync.#toGuideSync(name, short, outcome, reference);
 			if (outcome.kind === "failed") this.#emitter.emit("error", outcome.error);
-			this.#emitter.emit("guide", dep.name);
+			this.#emitter.emit("guide", name);
 			if (this.#strict && (guide.freshness === "missing" || guide.freshness === "failed")) throw new ScaffoldError("FETCH", `Failed to fetch guide at ${url}`, {
 				url,
-				name: dep.name
+				name
 			});
 			return guide;
 		});
 	}
-	#versions(deps, allowance) {
+	async #versions(deps, allowance) {
 		const parsed = parseSyncDependencies(deps, true);
+		const lookups = await this.#lookup(parsed.map((dependency) => dependency.name), allowance);
+		const versions = [];
+		for (let index = 0; index < parsed.length; index += 1) {
+			const dep = parsed[index];
+			const lookup = lookups[index];
+			if (dep === void 0 || lookup === void 0) throw new ScaffoldError("INVALID", "Sync version lookup result is incomplete");
+			versions.push(Sync.#toVersionSync(dep, lookup));
+		}
+		return Object.freeze(versions);
+	}
+	#lookup(names, allowance) {
+		const parsed = parseSyncNames(names);
 		if (parsed.length > this.#items) throw new ScaffoldError("INVALID", "Sync dependency count exceeds its item limit", {
 			items: parsed.length,
 			limit: this.#items
 		});
-		return Sync.#runPool(parsed, this.#concurrency, async (dep) => {
-			const url = this.#registryUrl(dep.name);
+		return Sync.#runPool(parsed, this.#concurrency, async (name) => {
+			const url = this.#registryUrl(name);
 			const outcome = await Sync.#fetchText(url, this.#registryTimeout, this.#retries, this.#limit, allowance, this.#controller.signal);
-			const version = Sync.#toVersionSync(dep, outcome);
+			const version = Sync.#toVersionLookup(name, outcome);
 			if (outcome.kind === "failed") this.#emitter.emit("error", outcome.error);
-			this.#emitter.emit("version", dep.name);
+			this.#emitter.emit("version", name);
 			if (this.#strict && (version.freshness === "missing" || version.freshness === "failed")) throw new ScaffoldError("FETCH", `Failed to fetch registry version at ${url}`, {
 				url,
-				name: dep.name
+				name
 			});
 			return version;
 		});
@@ -3616,16 +3663,9 @@ var Sync = class Sync {
 	*/
 	async catalog() {
 		this.#ensureAlive();
-		const orgUrl = this.#orgUrl();
 		const allowance = Float64Array.of(this.#budget);
-		const orgOutcome = await Sync.#fetchText(orgUrl, this.#registryTimeout, this.#retries, this.#limit, allowance, this.#controller.signal);
-		const names = Sync.#toOrgPackages(orgOutcome, orgUrl);
-		if (names.length > this.#items) throw new ScaffoldError("FETCH", `Package list at ${orgUrl} exceeds the item limit`, {
-			url: orgUrl,
-			items: names.length,
-			limit: this.#items
-		});
-		return [...await Sync.#runPool(names, this.#concurrency, async (name) => {
+		const names = await this.#packages(allowance);
+		return await Sync.#runPool(names, this.#concurrency, async (name) => {
 			const packumentOutcome = await Sync.#fetchText(this.#registryUrl(name), this.#registryTimeout, this.#retries, this.#limit, allowance, this.#controller.signal);
 			const packument = Sync.#toPackument(packumentOutcome);
 			const short = packageShortName(name);
@@ -3641,7 +3681,7 @@ var Sync = class Sync {
 				version: packument.version,
 				description
 			};
-		})].sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+		});
 	}
 	async pull(target, dependencies) {
 		this.#ensureAlive();
@@ -3650,10 +3690,21 @@ var Sync = class Sync {
 		const deps = dependencies === void 0 ? declared : parseSyncDependencies(dependencies, false);
 		if (dependencies !== void 0 && deps.some((dependency) => !declared.some((candidate) => candidate.name === dependency.name && candidate.range === dependency.range))) throw new ScaffoldError("INVALID", "Sync pull selection is not declared by the target");
 		const name = manifestToName(manifest);
-		const guideDependencies = name === void 0 ? deps : deps.filter((dependency) => dependency.name !== name);
-		const current = readGuideReferences(target, guideDependencies);
+		const guideNames = deps.map((dependency) => dependency.name).filter((dependency) => dependency !== name);
+		const current = readGuideReferences(target, guideNames);
 		const allowance = Float64Array.of(this.#budget);
-		const report = syncReportOf(target, await this.#guides(guideDependencies, current, allowance), await this.#versions(deps, allowance));
+		const report = syncReportOf(target, await this.#guides(guideNames, current, allowance), await this.#versions(deps, allowance));
+		this.#emitter.emit("done", report);
+		return report;
+	}
+	async mirror(target) {
+		this.#ensureAlive();
+		const manifest = readManifest(target);
+		const name = manifestToName(manifest);
+		const allowance = Float64Array.of(this.#budget);
+		const names = (await this.#packages(allowance)).filter((candidate) => candidate !== name);
+		const current = readGuideReferences(target, names);
+		const report = syncReportOf(target, await this.#guides(names, current, allowance), []);
 		this.#emitter.emit("done", report);
 		return report;
 	}
@@ -3746,6 +3797,17 @@ var Sync = class Sync {
 	#orgUrl() {
 		return `${this.#registryBase}/-/org/orkestrel/package`;
 	}
+	async #packages(allowance) {
+		const url = this.#orgUrl();
+		const outcome = await Sync.#fetchText(url, this.#registryTimeout, this.#retries, this.#limit, allowance, this.#controller.signal);
+		const names = Sync.#toOrgPackages(outcome, url);
+		if (names.length > this.#items) throw new ScaffoldError("FETCH", `Package list at ${url} exceeds the item limit`, {
+			url,
+			items: names.length,
+			limit: this.#items
+		});
+		return [...names].sort((left, right) => left < right ? -1 : left > right ? 1 : 0);
+	}
 	static async #runPool(items, concurrency, worker) {
 		const results = new Array(items.length);
 		const state = {
@@ -3924,34 +3986,42 @@ var Sync = class Sync {
 			...baseline === void 0 ? {} : { baseline }
 		};
 	}
-	static #toVersionSync(dep, outcome) {
+	static #toVersionLookup(name, outcome) {
 		if (outcome.kind === "missing") return {
-			name: dep.name,
-			range: dep.range,
-			latest: "",
+			name,
 			freshness: "missing",
 			note: "HTTP 404"
 		};
 		if (outcome.kind === "failed") return {
-			name: dep.name,
-			range: dep.range,
-			latest: "",
+			name,
 			freshness: "failed",
 			note: outcome.note
 		};
 		const latest = Sync.#parseLatest(outcome.text);
 		if (latest === void 0) return {
+			name,
+			freshness: "failed",
+			note: "malformed registry response (missing dist-tags.latest)"
+		};
+		return {
+			name,
+			latest,
+			freshness: "behind"
+		};
+	}
+	static #toVersionSync(dep, lookup) {
+		if (lookup.freshness !== "behind") return {
 			name: dep.name,
 			range: dep.range,
 			latest: "",
-			freshness: "failed",
-			note: "malformed registry response (missing dist-tags.latest)"
+			freshness: lookup.freshness,
+			note: lookup.note
 		};
 		return {
 			name: dep.name,
 			range: dep.range,
-			latest,
-			freshness: rangeToFreshness(dep.range, latest)
+			latest: lookup.latest,
+			freshness: rangeToFreshness(dep.range, lookup.latest)
 		};
 	}
 	static #toOrgPackages(outcome, url) {
@@ -4075,6 +4145,6 @@ function createSync(options) {
 	return new Sync(options);
 }
 //#endregion
-export { DEFAULT_SYNC_BUDGET, DEFAULT_SYNC_CONCURRENCY, DEFAULT_SYNC_ITEMS, DEFAULT_SYNC_LIMIT, DEFAULT_SYNC_TIMEOUT, HOST_MANIFEST_PATH, MAX_CATALOG_DESCRIPTION_LENGTH, MAX_FILESYSTEM_DEPTH, MAX_GUIDE_BYTES, MAX_HOST_DEPTH, MAX_HOST_ENTRIES, MAX_PATH_SEGMENT_BYTES, MAX_SYNC_BASE_LENGTH, MAX_SYNC_BRANCH_LENGTH, MAX_SYNC_BUDGET, MAX_SYNC_CONCURRENCY, MAX_SYNC_ITEMS, MAX_SYNC_LIMIT, MAX_SYNC_RETRIES, MAX_SYNC_TIMEOUT, Materializer, PRUNE_DIRECTORIES, RESERVED_PATH_SEGMENT_PATTERN, RESERVED_TARGET_PATH_PATTERN, SENSITIVE_HOST_PATH_PATTERN, SYNC_BRANCH_PATTERN, Sync, WRITE_DIGEST_PATTERN, WriteTransaction, catalogPackages, commitWriteTransaction, consumeCatalogAllowance, createMaterializer, createSync, createWriteDirectory, deriveBlueprint, digestFile, digestHex, digestText, discardWriteTransaction, discoverPackages, guideStub, guideToDescription, hostRoot, hydratePlan, isCatalogAllowance, isCatalogDescription, isDependencyData, isFilesystemPath, isHostManifest, isManifestEntry, isMaterializerEventHooks, isMissingPathError, isPortablePath, isRealDirectory, isRealFile, isReservedTargetPath, isSensitiveHostPath, isSyncEventHooks, isTerminalText, isVacant, isWritePrecondition, listDirectories, listFiles, locateHostSource, materializerOptionsContract, materializerOptionsShape, packageShortName, parseFilesystemPaths, parseMaterializerOptions, parsePortablePaths, parseSyncBase, parseSyncBranch, parseSyncCurrent, parseSyncDependencies, parseSyncOptions, parseWritePreconditions, pruneTargets, readFileHex, readFileText, readGuideReferences, readHostManifest, readManifest, readTarget, remapArtifactPath, replaceDirectory, resolveContainedPath, resolveGuideWrites, resolvePhysicalPath, resolveRealPath, restoreFiles, selectOrkestrelEntries, stageHost, storagePath, syncGuideOptionsShape, syncOptionsContract, syncOptionsShape, syncRegistryOptionsShape, syncReportOf, validateWriteAnchor, validateWriteDirectories, validateWriteTarget, vendoredPruneSet };
+export { DEFAULT_SYNC_BUDGET, DEFAULT_SYNC_CONCURRENCY, DEFAULT_SYNC_ITEMS, DEFAULT_SYNC_LIMIT, DEFAULT_SYNC_TIMEOUT, HOST_MANIFEST_PATH, MAX_CATALOG_DESCRIPTION_LENGTH, MAX_FILESYSTEM_DEPTH, MAX_GUIDE_BYTES, MAX_HOST_DEPTH, MAX_HOST_ENTRIES, MAX_PATH_SEGMENT_BYTES, MAX_SYNC_BASE_LENGTH, MAX_SYNC_BRANCH_LENGTH, MAX_SYNC_BUDGET, MAX_SYNC_CONCURRENCY, MAX_SYNC_ITEMS, MAX_SYNC_LIMIT, MAX_SYNC_RETRIES, MAX_SYNC_TIMEOUT, Materializer, PRUNE_DIRECTORIES, RESERVED_PATH_SEGMENT_PATTERN, RESERVED_TARGET_PATH_PATTERN, SENSITIVE_HOST_PATH_PATTERN, SYNC_BRANCH_PATTERN, Sync, WRITE_DIGEST_PATTERN, WriteTransaction, catalogPackages, commitWriteTransaction, consumeCatalogAllowance, createMaterializer, createSync, createWriteDirectory, deriveBlueprint, digestFile, digestHex, digestText, discardWriteTransaction, discoverPackages, guideStub, guideToDescription, hostRoot, hydratePlan, isCatalogAllowance, isCatalogDescription, isDependencyData, isFilesystemPath, isHostManifest, isManifestEntry, isMaterializerEventHooks, isMissingPathError, isPortablePath, isRealDirectory, isRealFile, isReservedTargetPath, isSensitiveHostPath, isSyncEventHooks, isTerminalText, isVacant, isWritePrecondition, listDirectories, listFiles, locateHostSource, materializerOptionsContract, materializerOptionsShape, packageShortName, parseFilesystemPaths, parseMaterializerOptions, parsePortablePaths, parseSyncBase, parseSyncBranch, parseSyncCurrent, parseSyncDependencies, parseSyncNames, parseSyncOptions, parseWritePreconditions, pruneTargets, readFileHex, readFileText, readGuideReferences, readHostManifest, readManifest, readTarget, remapArtifactPath, replaceDirectory, resolveContainedPath, resolveGuideWrites, resolvePhysicalPath, resolveRealPath, restoreFiles, selectOrkestrelEntries, stageHost, storagePath, syncGuideOptionsShape, syncOptionsContract, syncOptionsShape, syncRegistryOptionsShape, syncReportOf, validateWriteAnchor, validateWriteDirectories, validateWriteTarget, vendoredPruneSet };
 
 //# sourceMappingURL=index.js.map