@orkestrel/scaffold 0.0.99 → 0.0.101

package/dist/src/server/index.d.cts

@@ -1263,6 +1263,9 @@ export declare class Materializer implements MaterializerInterface {
                * the manifest only through `additions`, which inserts it into the section its
                * list names in key order, creating that section when the manifest lacks it,
                * before the ranges are rewritten.
+               * Scoped npm overrides insert absent ancestors and leaves and replace owned
+               * string leaves. Malformed ancestors, duplicate selected keys, and non-string
+               * owned leaves refuse the entire manifest write.
                *
                * The regions refuse differently because their targets differ. A range
                * the manifest does not declare is the caller's mistake and throws. A script
@@ -1428,7 +1431,7 @@ export declare class Materializer implements MaterializerInterface {
                /**
                 * Rewrites the manifest regions the caller names in the target's manifest.
                 *
-                * @param regions - The dependency ranges, script values, and additions the manifest must declare.
+                * @param regions - The dependency ranges, script values, additions, and npm overrides to declare.
                 * @param target - The directory to write into.
                 * @returns The manifest path, written when a named region moved and skipped otherwise.
                 *
@@ -1439,6 +1442,9 @@ export declare class Materializer implements MaterializerInterface {
                 * without a byte moving, and the range region is written regardless. An
                 * addition is inserted into the section its list names, which is created when
                 * the manifest lacks it, and one the manifest already declares is refused.
+                * Selected npm override leaves are inserted or replaced in place. Invalid JSON,
+                * duplicate selected keys, malformed ancestors, and non-string owned leaves
+                * refuse the entire manifest write before any region changes.
                 */
                declare(regions: ManifestRegionSet, target: string): MaterializeResult;
                /**

package/dist/src/server/index.d.ts

@@ -1263,6 +1263,9 @@ export declare class Materializer implements MaterializerInterface {
                * the manifest only through `additions`, which inserts it into the section its
                * list names in key order, creating that section when the manifest lacks it,
                * before the ranges are rewritten.
+               * Scoped npm overrides insert absent ancestors and leaves and replace owned
+               * string leaves. Malformed ancestors, duplicate selected keys, and non-string
+               * owned leaves refuse the entire manifest write.
                *
                * The regions refuse differently because their targets differ. A range
                * the manifest does not declare is the caller's mistake and throws. A script
@@ -1428,7 +1431,7 @@ export declare class Materializer implements MaterializerInterface {
                /**
                 * Rewrites the manifest regions the caller names in the target's manifest.
                 *
-                * @param regions - The dependency ranges, script values, and additions the manifest must declare.
+                * @param regions - The dependency ranges, script values, additions, and npm overrides to declare.
                 * @param target - The directory to write into.
                 * @returns The manifest path, written when a named region moved and skipped otherwise.
                 *
@@ -1439,6 +1442,9 @@ export declare class Materializer implements MaterializerInterface {
                 * without a byte moving, and the range region is written regardless. An
                 * addition is inserted into the section its list names, which is created when
                 * the manifest lacks it, and one the manifest already declares is refused.
+                * Selected npm override leaves are inserted or replaced in place. Invalid JSON,
+                * duplicate selected keys, malformed ancestors, and non-string owned leaves
+                * refuse the entire manifest write before any region changes.
                 */
                declare(regions: ManifestRegionSet, target: string): MaterializeResult;
                /**

package/dist/src/server/index.js

@@ -1,6 +1,6 @@
 import { createRequire } from "node:module";
-import { andOf, arrayOf, attempt, boundsOf, compareValues, holds, isArray, isBoolean, isError, isFunction, isInteger, isNumber, isRecord, isString, parseJSON, parseJSONAs, parseStringField, recordOf, stringOf, unionOf, whereOf } from "@orkestrel/contract";
-import { CANON_PATHS, CATALOG_AGENT_PATH, CATALOG_CLOSING_MARKER, CATALOG_OPENING_MARKER, CONTROL_CHARACTER_PATTERN, DEPENDENCY_NAME_PATTERN, EXECUTABLE_PATHS, HOST_INVENTORY_PATH, HOST_PATHS, MAX_ARTIFACT_BYTES, MAX_COLLECTION_ITEMS, MAX_DEPENDENCY_NAME_LENGTH, MAX_MANIFEST_BYTES, MAX_PATH_LENGTH, MAX_RANGE_LENGTH, MAX_REGISTRY_BYTES, MAX_TOTAL_ARTIFACT_BYTES, MAX_TOTAL_REGISTRY_BYTES, REFERENCE_PATHS, ScaffoldError, bytesToHex, catalogToLayers, cloneValue, compareVersions, computeBytes, contentToHex, extractRangeMajor, extractVersion, inferGroup, insertManifestDependencies, isAudit, isCatalogEntry, isCollection, isDependency, isDependencyName, isFloorPath, isHex, isManifestScript, isMirror, isPath, isPlan, isRetainedPath, isSnapshot, matchesDriftReachability, matchesRange, nameToGuide, planToFindings, renderSkillPointer, replaceManifestRanges, replaceManifestScripts } from "../core/index.js";
+import { andOf, arrayOf, attempt, boundsOf, compareValues, compileGuard, holds, isArray, isBoolean, isError, isFunction, isInteger, isNumber, isRecord, isString, parseJSON, parseJSONAs, parseStringField, recordOf, recordShape, stringOf, stringShape, unionOf, whereOf } from "@orkestrel/contract";
+import { CANON_PATHS, CATALOG_AGENT_PATH, CATALOG_CLOSING_MARKER, CATALOG_OPENING_MARKER, CONTROL_CHARACTER_PATTERN, DEPENDENCY_NAME_PATTERN, EXECUTABLE_PATHS, HOST_INVENTORY_PATH, HOST_PATHS, MAX_ARTIFACT_BYTES, MAX_COLLECTION_ITEMS, MAX_DEPENDENCY_NAME_LENGTH, MAX_MANIFEST_BYTES, MAX_PATH_LENGTH, MAX_RANGE_LENGTH, MAX_REGISTRY_BYTES, MAX_TOTAL_ARTIFACT_BYTES, MAX_TOTAL_REGISTRY_BYTES, REFERENCE_PATHS, ScaffoldError, bytesToHex, catalogToLayers, cloneValue, compareVersions, computeBytes, contentToHex, extractRangeMajor, extractVersion, inferGroup, insertManifestDependencies, isAudit, isCatalogEntry, isCollection, isDependency, isDependencyName, isFloorPath, isHex, isManifestScript, isMirror, isPath, isPlan, isRetainedPath, isSnapshot, matchesDriftReachability, matchesRange, nameToGuide, planToFindings, renderSkillPointer, replaceManifestOverrides, replaceManifestRanges, replaceManifestScripts } from "../core/index.js";
 import { createHash, randomUUID } from "node:crypto";
 import { chmodSync, closeSync, constants, copyFileSync, fstatSync, linkSync, lstatSync, mkdirSync, mkdtempSync, openSync, opendirSync, readSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, rmdirSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -2169,8 +2169,9 @@ var isManifestRegionSet = recordOf({
 	additions: recordOf({
 		runtime: isDependencies,
 		development: isDependencies
-	})
-}, ["additions"]);
+	}),
+	overrides: compileGuard(recordShape(recordShape(stringShape())))
+}, ["additions", "overrides"]);
 /** Narrows a value to a bounded list of fetched guide mirrors. */
 var isMirrors = andOf(isCollection, arrayOf(isMirror));
 /** Narrows a value to a bounded list of fleet catalog rows. */
@@ -3180,6 +3181,9 @@ var Materializer = class {
 	* the manifest only through `additions`, which inserts it into the section its
 	* list names in key order, creating that section when the manifest lacks it,
 	* before the ranges are rewritten.
+	* Scoped npm overrides insert absent ancestors and leaves and replace owned
+	* string leaves. Malformed ancestors, duplicate selected keys, and non-string
+	* owned leaves refuse the entire manifest write.
 	*
 	* The regions refuse differently because their targets differ. A range
 	* the manifest does not declare is the caller's mistake and throws. A script
@@ -3783,11 +3787,13 @@ var Materializer = class {
 	}
 	#redeclare(regions) {
 		return (text) => {
+			const overridden = replaceManifestOverrides(text, regions.overrides ?? {});
+			if (overridden === void 0) throw this.#error("INVALID", "The manifest cannot safely rewrite the selected npm overrides.");
 			const additions = regions.additions ?? {
 				runtime: [],
 				development: []
 			};
-			const declared = insertManifestDependencies(text, additions);
+			const declared = insertManifestDependencies(overridden, additions);
 			if (declared === void 0) {
 				const names = [...additions.runtime, ...additions.development].map(({ name }) => name);
 				throw this.#error("INVALID", `The manifest cannot declare ${names.join(", ")}: it already declares one of them, or the section that receives them is not an object of version strings.`, { names: names.length });