@orkestrel/scaffold 0.0.15 → 0.0.17

package/dist/src/server/index.cjs

@@ -296,6 +296,34 @@ function isMaterializerEventHooks(value) {
 }
 //#endregion
 //#region src/server/parsers.ts
+/**
+* Parse and semantically validate bare registry package names before Sync performs network I/O.
+*
+* @param value - Untrusted package-name collection.
+* @returns A frozen owned snapshot of valid unique npm package names.
+*/
+function parseSyncNames(value) {
+	const owned = (0, _orkestrel_contract.attempt)(() => {
+		if (!(0, _src_core.isDenseDataArray)(value, 1e3, (candidate) => typeof candidate === "string")) throw new Error("package names are malformed");
+		const length = Reflect.getOwnPropertyDescriptor(value, "length")?.value;
+		if (typeof length !== "number" || !Number.isSafeInteger(length) || length < 0 || length > 1e3) throw new Error("package name length is malformed");
+		const names = [];
+		for (let index = 0; index < length; index += 1) {
+			const descriptor = Reflect.getOwnPropertyDescriptor(value, String(index));
+			if (descriptor === void 0 || !Reflect.has(descriptor, "value") || typeof descriptor.value !== "string") throw new Error("package name is malformed");
+			names.push(descriptor.value);
+		}
+		return Object.freeze(names);
+	});
+	if (!owned.success) throw new _src_core.ScaffoldError("INVALID", "Sync package names are malformed", { error: owned.error });
+	const snapshot = owned.value;
+	const seen = /* @__PURE__ */ new Set();
+	for (const name of snapshot) {
+		if (name.length === 0 || name.length > _src_core.MAX_DEPENDENCY_NAME_LENGTH || !_src_core.EXTRA_NAME_PATTERN.test(name) || seen.has(name)) throw new _src_core.ScaffoldError("INVALID", "Sync package names are invalid", { name });
+		seen.add(name);
+	}
+	return snapshot;
+}
 /** Parse and semantically validate dependency data before Sync performs network I/O. */
 function parseSyncDependencies(value, external) {
 	const owned = (0, _orkestrel_contract.attempt)(() => {
@@ -929,16 +957,16 @@ function packageShortName(name) {
 	return name.startsWith("@orkestrel/") ? name.slice(11) : name;
 }
 /**
-* Read bounded physical local guide mirrors for declared dependencies.
+* Read bounded physical local guide mirrors for package names.
 *
 * @param target - The package root.
-* @param dependencies - The declared dependencies whose mirrors are eligible.
-* @returns Existing guide content keyed by dependency name.
+* @param names - The package names whose mirrors are eligible.
+* @returns Existing guide content keyed by package name.
 */
-function readGuideReferences(target, dependencies) {
+function readGuideReferences(target, names) {
 	const current = {};
-	for (const dependency of dependencies) {
-		const path = `guides/src/${packageShortName(dependency.name)}.md`;
+	for (const name of names) {
+		const path = `guides/src/${packageShortName(name)}.md`;
 		const full = resolvePhysicalPath(target, path, "TARGET", "target");
 		const status = (0, _orkestrel_contract.attempt)(() => (0, node_fs.lstatSync)(full));
 		if (!status.success) {
@@ -949,7 +977,7 @@ function readGuideReferences(target, dependencies) {
 			});
 		}
 		if (!status.value.isFile() || status.value.isSymbolicLink() || status.value.nlink !== 1) throw new _src_core.ScaffoldError("TARGET", `Local guide is not a physical file at ${path}`, { path });
-		current[dependency.name] = readFileText(target, path, "TARGET", "target");
+		current[name] = readFileText(target, path, "TARGET", "target");
 	}
 	return Object.freeze(current);
 }
@@ -3488,8 +3516,10 @@ var Materializer = class {
 * map, a fetched guide byte-equal to its entry verdicts `current`, anything
 * differing or absent from the map verdicts `behind`; WITHOUT the map, every
 * successful fetch verdicts `behind` (no reference means it needs syncing).
-* `pull` builds that map itself from the TARGET's own `guides/src/<short>.md`
-* mirrors, so its verdicts are target-relative; `write` commits only the
+* `pull` builds that map itself from the TARGET's declared dependency mirrors;
+* `mirror` builds it from the registry's exact organization package list,
+* excluding the target's own guide and issuing no registry version reads. Both
+* verdicts are target-relative; `write` commits only the
 * `behind` guides (never `current`, `missing`, or `failed`, which carries no
 * trustworthy content) under the same realpath-anchored containment law
 * `Materializer` enforces. After `destroy()` every method throws `DESTROYED`;
@@ -3541,50 +3571,67 @@ var Sync = class Sync {
 	get emitter() {
 		return this.#emitter;
 	}
+	async lookup(names) {
+		this.#ensureAlive();
+		return this.#lookup(names, Float64Array.of(this.#budget));
+	}
 	async guides(deps, current) {
 		this.#ensureAlive();
-		return this.#guides(deps, current, Float64Array.of(this.#budget));
+		const parsed = parseSyncDependencies(deps, false);
+		return this.#guides(parsed.map((dependency) => dependency.name), current, Float64Array.of(this.#budget));
 	}
 	async versions(deps) {
 		this.#ensureAlive();
 		return this.#versions(deps, Float64Array.of(this.#budget));
 	}
-	#guides(deps, current, allowance) {
-		const parsed = parseSyncDependencies(deps, false);
+	#guides(names, current, allowance) {
+		const parsed = parseSyncNames(names);
 		if (parsed.length > this.#items) throw new _src_core.ScaffoldError("INVALID", "Sync dependency count exceeds its item limit", {
 			items: parsed.length,
 			limit: this.#items
 		});
-		const reference = parseSyncCurrent(current, parsed.map((dependency) => dependency.name), this.#budget);
-		return Sync.#runPool(parsed, this.#concurrency, async (dep) => {
-			const short = packageShortName(dep.name);
+		const reference = parseSyncCurrent(current, parsed, this.#budget);
+		return Sync.#runPool(parsed, this.#concurrency, async (name) => {
+			const short = packageShortName(name);
 			const url = this.#guideUrl(short);
 			const outcome = await Sync.#fetchText(url, this.#guidesTimeout, this.#retries, this.#limit, allowance, this.#controller.signal);
-			const guide = Sync.#toGuideSync(dep.name, short, outcome, reference);
+			const guide = Sync.#toGuideSync(name, short, outcome, reference);
 			if (outcome.kind === "failed") this.#emitter.emit("error", outcome.error);
-			this.#emitter.emit("guide", dep.name);
+			this.#emitter.emit("guide", name);
 			if (this.#strict && (guide.freshness === "missing" || guide.freshness === "failed")) throw new _src_core.ScaffoldError("FETCH", `Failed to fetch guide at ${url}`, {
 				url,
-				name: dep.name
+				name
 			});
 			return guide;
 		});
 	}
-	#versions(deps, allowance) {
+	async #versions(deps, allowance) {
 		const parsed = parseSyncDependencies(deps, true);
+		const lookups = await this.#lookup(parsed.map((dependency) => dependency.name), allowance);
+		const versions = [];
+		for (let index = 0; index < parsed.length; index += 1) {
+			const dep = parsed[index];
+			const lookup = lookups[index];
+			if (dep === void 0 || lookup === void 0) throw new _src_core.ScaffoldError("INVALID", "Sync version lookup result is incomplete");
+			versions.push(Sync.#toVersionSync(dep, lookup));
+		}
+		return Object.freeze(versions);
+	}
+	#lookup(names, allowance) {
+		const parsed = parseSyncNames(names);
 		if (parsed.length > this.#items) throw new _src_core.ScaffoldError("INVALID", "Sync dependency count exceeds its item limit", {
 			items: parsed.length,
 			limit: this.#items
 		});
-		return Sync.#runPool(parsed, this.#concurrency, async (dep) => {
-			const url = this.#registryUrl(dep.name);
+		return Sync.#runPool(parsed, this.#concurrency, async (name) => {
+			const url = this.#registryUrl(name);
 			const outcome = await Sync.#fetchText(url, this.#registryTimeout, this.#retries, this.#limit, allowance, this.#controller.signal);
-			const version = Sync.#toVersionSync(dep, outcome);
+			const version = Sync.#toVersionLookup(name, outcome);
 			if (outcome.kind === "failed") this.#emitter.emit("error", outcome.error);
-			this.#emitter.emit("version", dep.name);
+			this.#emitter.emit("version", name);
 			if (this.#strict && (version.freshness === "missing" || version.freshness === "failed")) throw new _src_core.ScaffoldError("FETCH", `Failed to fetch registry version at ${url}`, {
 				url,
-				name: dep.name
+				name
 			});
 			return version;
 		});
@@ -3617,16 +3664,9 @@ var Sync = class Sync {
 	*/
 	async catalog() {
 		this.#ensureAlive();
-		const orgUrl = this.#orgUrl();
 		const allowance = Float64Array.of(this.#budget);
-		const orgOutcome = await Sync.#fetchText(orgUrl, this.#registryTimeout, this.#retries, this.#limit, allowance, this.#controller.signal);
-		const names = Sync.#toOrgPackages(orgOutcome, orgUrl);
-		if (names.length > this.#items) throw new _src_core.ScaffoldError("FETCH", `Package list at ${orgUrl} exceeds the item limit`, {
-			url: orgUrl,
-			items: names.length,
-			limit: this.#items
-		});
-		return [...await Sync.#runPool(names, this.#concurrency, async (name) => {
+		const names = await this.#packages(allowance);
+		return await Sync.#runPool(names, this.#concurrency, async (name) => {
 			const packumentOutcome = await Sync.#fetchText(this.#registryUrl(name), this.#registryTimeout, this.#retries, this.#limit, allowance, this.#controller.signal);
 			const packument = Sync.#toPackument(packumentOutcome);
 			const short = packageShortName(name);
@@ -3642,7 +3682,7 @@ var Sync = class Sync {
 				version: packument.version,
 				description
 			};
-		})].sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+		});
 	}
 	async pull(target, dependencies) {
 		this.#ensureAlive();
@@ -3651,10 +3691,21 @@ var Sync = class Sync {
 		const deps = dependencies === void 0 ? declared : parseSyncDependencies(dependencies, false);
 		if (dependencies !== void 0 && deps.some((dependency) => !declared.some((candidate) => candidate.name === dependency.name && candidate.range === dependency.range))) throw new _src_core.ScaffoldError("INVALID", "Sync pull selection is not declared by the target");
 		const name = (0, _src_core.manifestToName)(manifest);
-		const guideDependencies = name === void 0 ? deps : deps.filter((dependency) => dependency.name !== name);
-		const current = readGuideReferences(target, guideDependencies);
+		const guideNames = deps.map((dependency) => dependency.name).filter((dependency) => dependency !== name);
+		const current = readGuideReferences(target, guideNames);
 		const allowance = Float64Array.of(this.#budget);
-		const report = syncReportOf(target, await this.#guides(guideDependencies, current, allowance), await this.#versions(deps, allowance));
+		const report = syncReportOf(target, await this.#guides(guideNames, current, allowance), await this.#versions(deps, allowance));
+		this.#emitter.emit("done", report);
+		return report;
+	}
+	async mirror(target) {
+		this.#ensureAlive();
+		const manifest = readManifest(target);
+		const name = (0, _src_core.manifestToName)(manifest);
+		const allowance = Float64Array.of(this.#budget);
+		const names = (await this.#packages(allowance)).filter((candidate) => candidate !== name);
+		const current = readGuideReferences(target, names);
+		const report = syncReportOf(target, await this.#guides(names, current, allowance), []);
 		this.#emitter.emit("done", report);
 		return report;
 	}
@@ -3747,6 +3798,17 @@ var Sync = class Sync {
 	#orgUrl() {
 		return `${this.#registryBase}/-/org/orkestrel/package`;
 	}
+	async #packages(allowance) {
+		const url = this.#orgUrl();
+		const outcome = await Sync.#fetchText(url, this.#registryTimeout, this.#retries, this.#limit, allowance, this.#controller.signal);
+		const names = Sync.#toOrgPackages(outcome, url);
+		if (names.length > this.#items) throw new _src_core.ScaffoldError("FETCH", `Package list at ${url} exceeds the item limit`, {
+			url,
+			items: names.length,
+			limit: this.#items
+		});
+		return [...names].sort((left, right) => left < right ? -1 : left > right ? 1 : 0);
+	}
 	static async #runPool(items, concurrency, worker) {
 		const results = new Array(items.length);
 		const state = {
@@ -3925,34 +3987,42 @@ var Sync = class Sync {
 			...baseline === void 0 ? {} : { baseline }
 		};
 	}
-	static #toVersionSync(dep, outcome) {
+	static #toVersionLookup(name, outcome) {
 		if (outcome.kind === "missing") return {
-			name: dep.name,
-			range: dep.range,
-			latest: "",
+			name,
 			freshness: "missing",
 			note: "HTTP 404"
 		};
 		if (outcome.kind === "failed") return {
-			name: dep.name,
-			range: dep.range,
-			latest: "",
+			name,
 			freshness: "failed",
 			note: outcome.note
 		};
 		const latest = Sync.#parseLatest(outcome.text);
 		if (latest === void 0) return {
+			name,
+			freshness: "failed",
+			note: "malformed registry response (missing dist-tags.latest)"
+		};
+		return {
+			name,
+			latest,
+			freshness: "behind"
+		};
+	}
+	static #toVersionSync(dep, lookup) {
+		if (lookup.freshness !== "behind") return {
 			name: dep.name,
 			range: dep.range,
 			latest: "",
-			freshness: "failed",
-			note: "malformed registry response (missing dist-tags.latest)"
+			freshness: lookup.freshness,
+			note: lookup.note
 		};
 		return {
 			name: dep.name,
 			range: dep.range,
-			latest,
-			freshness: (0, _src_core.rangeToFreshness)(dep.range, latest)
+			latest: lookup.latest,
+			freshness: (0, _src_core.rangeToFreshness)(dep.range, lookup.latest)
 		};
 	}
 	static #toOrgPackages(outcome, url) {
@@ -4151,6 +4221,7 @@ exports.parseSyncBase = parseSyncBase;
 exports.parseSyncBranch = parseSyncBranch;
 exports.parseSyncCurrent = parseSyncCurrent;
 exports.parseSyncDependencies = parseSyncDependencies;
+exports.parseSyncNames = parseSyncNames;
 exports.parseSyncOptions = parseSyncOptions;
 exports.parseWritePreconditions = parseWritePreconditions;
 exports.pruneTargets = pruneTargets;