@telorun/analyzer 0.31.0 → 0.32.0

package/dist/builtins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EA2hB/C,CAAC"}
+{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EAwiB/C,CAAC"}

package/dist/builtins.js

@@ -225,6 +225,7 @@ export const KERNEL_BUILTINS = [
                     additionalProperties: true,
                 },
                 source: { type: "string" },
+                integrity: { type: "string" },
                 variables: { type: "object" },
                 secrets: { type: "object" },
                 runtime: {
@@ -359,6 +360,11 @@ export const KERNEL_BUILTINS = [
                     type: "array",
                     items: { type: "string" },
                 },
+                // Integrity hash of the decompressed payload tar (`module.tar.gz`,
+                // telo.yaml excluded), written by `telo publish`. Pinned transitively
+                // by the importer's `#sha256-...` hash over this telo.yaml; verified at
+                // extract time. See plans/federated-registries.md.
+                filesIntegrity: { type: "string" },
                 // Inline imports — name-keyed map sugar for separate `Telo.Import`
                 // documents. The key is the PascalCase alias (the import's
                 // `metadata.name`). Each value is either a bare source string
@@ -376,6 +382,7 @@ export const KERNEL_BUILTINS = [
                                 required: ["source"],
                                 properties: {
                                     source: { type: "string" },
+                                    integrity: { type: "string" },
                                     variables: { type: "object" },
                                     secrets: { type: "object" },
                                     runtime: {
@@ -490,6 +497,11 @@ export const KERNEL_BUILTINS = [
                     type: "array",
                     items: { type: "string" },
                 },
+                // Integrity hash of the decompressed payload tar (`module.tar.gz`,
+                // telo.yaml excluded), written by `telo publish`. Pinned transitively
+                // by the importer's `#sha256-...` hash over this telo.yaml; verified at
+                // extract time. See plans/federated-registries.md.
+                filesIntegrity: { type: "string" },
                 // Inline imports — same name-keyed map sugar as Telo.Application; the
                 // loader desugars each entry into a synthetic Telo.Import. See the
                 // Application schema above and analyzer/nodejs/src/inline-imports.ts.
@@ -503,6 +515,7 @@ export const KERNEL_BUILTINS = [
                                 required: ["source"],
                                 properties: {
                                     source: { type: "string" },
+                                    integrity: { type: "string" },
                                     variables: { type: "object" },
                                     secrets: { type: "object" },
                                     runtime: {

package/dist/index.d.ts

@@ -21,6 +21,9 @@ export type { DocumentPosition } from "./position-metadata.js";
 export { HttpSource } from "./sources/http-source.js";
 export { RegistrySource } from "./sources/registry-source.js";
 export { defaultSources } from "./sources/default-sources.js";
+export { splitIntegrity, foldIntegrity, verifyIntegrity, verifiedFetch, sha256Base64Url, } from "./sources/integrity.js";
+export { parseModuleRef, isRegistryRef } from "./sources/module-ref.js";
+export type { ParsedModuleRef } from "./sources/module-ref.js";
 export { withSyntheticPositions } from "./with-synthetic-positions.js";
 export { DEFAULT_MANIFEST_FILENAME, DiagnosticSeverity } from "./types.js";
 export type { AnalysisDiagnostic, AnalysisOptions, LoaderInitOptions, LoadOptions, ManifestSource, Position, PositionIndex, Range } from "./types.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,aAAa,EACb,eAAe,EACf,aAAa,EACb,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -13,5 +13,7 @@ export { buildDocumentPositions, buildLineOffsets, buildPositionIndex, documentL
 export { HttpSource } from "./sources/http-source.js";
 export { RegistrySource } from "./sources/registry-source.js";
 export { defaultSources } from "./sources/default-sources.js";
+export { splitIntegrity, foldIntegrity, verifyIntegrity, verifiedFetch, sha256Base64Url, } from "./sources/integrity.js";
+export { parseModuleRef, isRegistryRef } from "./sources/module-ref.js";
 export { withSyntheticPositions } from "./with-synthetic-positions.js";
 export { DEFAULT_MANIFEST_FILENAME, DiagnosticSeverity } from "./types.js";

package/dist/inline-imports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inline-imports.d.ts","sourceRoot":"","sources":["../src/inline-imports.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG/D;;6CAE6C;AAC7C,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,EAAE,gBAAgB,CAAC;CAC5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CACnC,cAAc,EAAE,gBAAgB,EAChC,cAAc,EAAE,gBAAgB,GAAG,SAAS,GAC3C,eAAe,EAAE,CA0BnB;AAED;;;;;;;iFAOiF;AACjF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAmB9D"}
+{"version":3,"file":"inline-imports.d.ts","sourceRoot":"","sources":["../src/inline-imports.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG/D;;6CAE6C;AAC7C,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,EAAE,gBAAgB,CAAC;CAC5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CACnC,cAAc,EAAE,gBAAgB,EAChC,cAAc,EAAE,gBAAgB,GAAG,SAAS,GAC3C,eAAe,EAAE,CA+BnB;AAED;;;;;;;iFAOiF;AACjF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAmB9D"}

package/dist/inline-imports.js

@@ -1,3 +1,4 @@
+import { foldIntegrity } from "./sources/integrity.js";
 import { isModuleKind } from "./module-kinds.js";
 /**
  * Desugar a module document's inline `imports:` map into synthetic
@@ -26,10 +27,14 @@ export function inlineImportManifests(moduleManifest, modulePosition) {
                 : undefined;
         if (!entry || typeof entry.source !== "string")
             continue;
+        // The object form carries integrity as a sibling `integrity:` field; fold it
+        // into the source string as a `#sha256-...` fragment so every downstream
+        // consumer sees a single representation (the scalar form already inlines it).
+        const source = foldIntegrity(entry.source, entry.integrity);
         const manifest = {
             kind: "Telo.Import",
             metadata: { name: alias },
-            source: entry.source,
+            source,
             ...(entry.variables !== undefined ? { variables: entry.variables } : {}),
             ...(entry.secrets !== undefined ? { secrets: entry.secrets } : {}),
             ...(entry.runtime !== undefined ? { runtime: entry.runtime } : {}),

package/dist/sources/http-source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-source.d.ts","sourceRoot":"","sources":["../../src/sources/http-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7E,qBAAa,UAAW,YAAW,cAAc;IAC/C,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAIxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAWlE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;CAIxD"}
+{"version":3,"file":"http-source.d.ts","sourceRoot":"","sources":["../../src/sources/http-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAG7E,qBAAa,UAAW,YAAW,cAAc;IAC/C,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAIxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAOlE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;CAIxD"}

package/dist/sources/http-source.js

@@ -1,15 +1,14 @@
 import { DEFAULT_MANIFEST_FILENAME } from "../types.js";
+import { splitIntegrity, verifiedFetch } from "./integrity.js";
 export class HttpSource {
     supports(url) {
         return url.startsWith("http://") || url.startsWith("https://");
     }
     async read(url) {
-        const fetchUrl = url.includes(".yaml") ? url : `${url}/${DEFAULT_MANIFEST_FILENAME}`;
-        const response = await fetch(fetchUrl);
-        if (!response.ok) {
-            throw new Error(`Failed to fetch manifest from ${fetchUrl}: ${response.status} ${response.statusText}`);
-        }
-        return { text: await response.text(), source: fetchUrl };
+        const { base, integrity } = splitIntegrity(url);
+        const fetchUrl = base.includes(".yaml") ? base : `${base}/${DEFAULT_MANIFEST_FILENAME}`;
+        const { text } = await verifiedFetch(fetchUrl, integrity, fetchUrl);
+        return { text, source: fetchUrl };
     }
     resolveRelative(base, relative) {
         const baseDir = base.endsWith("/") ? base : base.slice(0, base.lastIndexOf("/") + 1);

package/dist/sources/integrity.d.ts

@@ -0,0 +1,35 @@
+/** Inline module integrity — the `#sha256-<base64url>` fragment carried on a
+ *  remote import ref. Browser-safe: uses Web Crypto (`crypto.subtle`) and
+ *  `btoa`, both globals in Node and the browser. No Node built-ins.
+ *
+ *  The fragment is authoritative across every transport: a source's `read()`
+ *  hashes the fetched bytes and compares against it before the manifest is
+ *  parsed or cached. A mismatch is a terminal error — never a cache miss. */
+/** Split a trailing integrity fragment off a ref/URL. Returns the bare ref in
+ *  `base` (safe to build fetch URLs and cache paths from) and the fragment in
+ *  `integrity` (e.g. `sha256-<base64url>`), or `undefined` when absent. */
+export declare function splitIntegrity(ref: string): {
+    base: string;
+    integrity?: string;
+};
+/** Attach an integrity hash to a ref as a `#<alg>-...` fragment. No-op when the
+ *  hash is absent/non-string or the ref already carries a fragment (an
+ *  author-authored pin is never overwritten). Inverse of `splitIntegrity`;
+ *  used to fold the object form's `integrity:` sibling into the source string. */
+export declare function foldIntegrity(source: string, integrity: unknown): string;
+/** SHA-256 of `bytes` as unpadded base64url — the canonical inline-hash form. */
+export declare function sha256Base64Url(bytes: Uint8Array): Promise<string>;
+/** Hash `bytes` and compare against `integrity` (`<alg>-<digest>`). Throws a
+ *  terminal error on mismatch or an unsupported algorithm. `describe` names the
+ *  artifact in the error (e.g. the module ref) so the failure is actionable. */
+export declare function verifyIntegrity(bytes: Uint8Array, integrity: string, describe: string): Promise<void>;
+/** The single verified network read for remote manifests: fetch `fetchUrl`,
+ *  verify the raw bytes against `integrity` (when pinned), and return both the
+ *  bytes and the decoded text. The one choke point every network `ManifestSource`
+ *  routes through, so verification cannot drift between them. `describe` names
+ *  the artifact in error messages. */
+export declare function verifiedFetch(fetchUrl: string, integrity: string | undefined, describe: string): Promise<{
+    bytes: Uint8Array;
+    text: string;
+}>;
+//# sourceMappingURL=integrity.d.ts.map

package/dist/sources/integrity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity.d.ts","sourceRoot":"","sources":["../../src/sources/integrity.ts"],"names":[],"mappings":"AAAA;;;;;;6EAM6E;AAO7E;;2EAE2E;AAC3E,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAIhF;AAED;;;kFAGkF;AAClF,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,CAIxE;AAcD,iFAAiF;AACjF,wBAAsB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAOxE;AAED;;gFAEgF;AAChF,wBAAsB,eAAe,CACnC,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAkBf;AAED;;;;sCAIsC;AACtC,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAU9C"}

package/dist/sources/integrity.js

@@ -0,0 +1,82 @@
+/** Inline module integrity — the `#sha256-<base64url>` fragment carried on a
+ *  remote import ref. Browser-safe: uses Web Crypto (`crypto.subtle`) and
+ *  `btoa`, both globals in Node and the browser. No Node built-ins.
+ *
+ *  The fragment is authoritative across every transport: a source's `read()`
+ *  hashes the fetched bytes and compares against it before the manifest is
+ *  parsed or cached. A mismatch is a terminal error — never a cache miss. */
+/** Only a `#<alg>-<base64url>` suffix is treated as integrity; other `#`
+ *  fragments (rare in module refs) pass through untouched. `sha256` is the
+ *  only algorithm accepted today; the prefix leaves room to migrate. */
+const INTEGRITY_FRAGMENT = /#(sha256-[A-Za-z0-9_+/=-]+)$/;
+/** Split a trailing integrity fragment off a ref/URL. Returns the bare ref in
+ *  `base` (safe to build fetch URLs and cache paths from) and the fragment in
+ *  `integrity` (e.g. `sha256-<base64url>`), or `undefined` when absent. */
+export function splitIntegrity(ref) {
+    const match = ref.match(INTEGRITY_FRAGMENT);
+    if (!match)
+        return { base: ref };
+    return { base: ref.slice(0, match.index), integrity: match[1] };
+}
+/** Attach an integrity hash to a ref as a `#<alg>-...` fragment. No-op when the
+ *  hash is absent/non-string or the ref already carries a fragment (an
+ *  author-authored pin is never overwritten). Inverse of `splitIntegrity`;
+ *  used to fold the object form's `integrity:` sibling into the source string. */
+export function foldIntegrity(source, integrity) {
+    return typeof integrity === "string" && !source.includes("#")
+        ? `${source}#${integrity}`
+        : source;
+}
+function toBase64Url(bytes) {
+    let binary = "";
+    for (let i = 0; i < bytes.length; i++)
+        binary += String.fromCharCode(bytes[i]);
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+/** Normalize an encoded digest to unpadded base64url so a standard-base64 or
+ *  padded input still compares equal to our canonical form. */
+function normalizeDigest(value) {
+    return value.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+/** SHA-256 of `bytes` as unpadded base64url — the canonical inline-hash form. */
+export async function sha256Base64Url(bytes) {
+    // Copy into a plain ArrayBuffer: a Uint8Array may be backed by a
+    // SharedArrayBuffer, which `crypto.subtle.digest` does not accept.
+    const buffer = new ArrayBuffer(bytes.byteLength);
+    new Uint8Array(buffer).set(bytes);
+    const digest = await crypto.subtle.digest("SHA-256", buffer);
+    return toBase64Url(new Uint8Array(digest));
+}
+/** Hash `bytes` and compare against `integrity` (`<alg>-<digest>`). Throws a
+ *  terminal error on mismatch or an unsupported algorithm. `describe` names the
+ *  artifact in the error (e.g. the module ref) so the failure is actionable. */
+export async function verifyIntegrity(bytes, integrity, describe) {
+    const dash = integrity.indexOf("-");
+    const algorithm = dash > 0 ? integrity.slice(0, dash) : "";
+    const expected = dash > 0 ? integrity.slice(dash + 1) : "";
+    if (algorithm !== "sha256") {
+        throw new Error(`Unsupported integrity algorithm '${algorithm || integrity}' for ${describe}. ` +
+            `Only sha256 is supported (sha256-<base64url>).`);
+    }
+    const actual = await sha256Base64Url(bytes);
+    if (actual !== normalizeDigest(expected)) {
+        throw new Error(`Integrity check failed for ${describe}: expected sha256-${normalizeDigest(expected)}, ` +
+            `got sha256-${actual}. The fetched bytes do not match the recorded hash — ` +
+            `the module may have been tampered with or republished.`);
+    }
+}
+/** The single verified network read for remote manifests: fetch `fetchUrl`,
+ *  verify the raw bytes against `integrity` (when pinned), and return both the
+ *  bytes and the decoded text. The one choke point every network `ManifestSource`
+ *  routes through, so verification cannot drift between them. `describe` names
+ *  the artifact in error messages. */
+export async function verifiedFetch(fetchUrl, integrity, describe) {
+    const response = await fetch(fetchUrl);
+    if (!response.ok) {
+        throw new Error(`Failed to fetch manifest ${describe}: ${response.status} ${response.statusText} (${fetchUrl})`);
+    }
+    const bytes = new Uint8Array(await response.arrayBuffer());
+    if (integrity)
+        await verifyIntegrity(bytes, integrity, describe);
+    return { bytes, text: new TextDecoder().decode(bytes) };
+}

package/dist/sources/module-ref.d.ts

@@ -0,0 +1,17 @@
+/** A parsed registry module reference. `modulePath` is `namespace/name`,
+ *  `version` has any leading `v` stripped, and `integrity` carries the inline
+ *  `sha256-<base64url>` hash when the ref was pinned. */
+export interface ParsedModuleRef {
+    modulePath: string;
+    version: string;
+    integrity?: string;
+}
+/** True when `url` has the bare registry-ref shape `namespace/name@version`
+ *  (no scheme, no leading `/` or `.`, contains both `@` and `/`). The integrity
+ *  fragment, if any, does not affect the classification. */
+export declare function isRegistryRef(url: string): boolean;
+/** Canonical parser for `namespace/name@version[#sha256-...]` refs. The single
+ *  source of truth shared by the registry source, the kernel manifest cache,
+ *  and the CLI (install / upgrade / bundle). Throws on a malformed ref. */
+export declare function parseModuleRef(ref: string): ParsedModuleRef;
+//# sourceMappingURL=module-ref.d.ts.map

package/dist/sources/module-ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-ref.d.ts","sourceRoot":"","sources":["../../src/sources/module-ref.ts"],"names":[],"mappings":"AAEA;;yDAEyD;AACzD,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;4DAE4D;AAC5D,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAYlD;AAED;;2EAE2E;AAC3E,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAgB3D"}

package/dist/sources/module-ref.js

@@ -0,0 +1,35 @@
+import { splitIntegrity } from "./integrity.js";
+/** True when `url` has the bare registry-ref shape `namespace/name@version`
+ *  (no scheme, no leading `/` or `.`, contains both `@` and `/`). The integrity
+ *  fragment, if any, does not affect the classification. */
+export function isRegistryRef(url) {
+    const { base } = splitIntegrity(url);
+    return (!base.startsWith("http://") &&
+        !base.startsWith("https://") &&
+        !base.startsWith("/") &&
+        !base.startsWith(".") &&
+        !base.startsWith("file://") &&
+        !base.startsWith("memory://") &&
+        base.includes("@") &&
+        base.includes("/"));
+}
+/** Canonical parser for `namespace/name@version[#sha256-...]` refs. The single
+ *  source of truth shared by the registry source, the kernel manifest cache,
+ *  and the CLI (install / upgrade / bundle). Throws on a malformed ref. */
+export function parseModuleRef(ref) {
+    const { base, integrity } = splitIntegrity(ref);
+    const atIdx = base.lastIndexOf("@");
+    if (atIdx <= 0 || atIdx === base.length - 1) {
+        throw new Error(`Invalid module reference '${ref}', expected namespace/name@version`);
+    }
+    const modulePath = base.slice(0, atIdx);
+    if (!modulePath.includes("/")) {
+        throw new Error(`Invalid module reference '${ref}', expected namespace/name@version`);
+    }
+    const rawVersion = base.slice(atIdx + 1);
+    const version = rawVersion.startsWith("v") ? rawVersion.slice(1) : rawVersion;
+    if (!version) {
+        throw new Error(`Invalid module reference '${ref}', expected namespace/name@version`);
+    }
+    return { modulePath, version, integrity };
+}

package/dist/sources/registry-source.d.ts

@@ -10,6 +10,5 @@ export declare class RegistrySource implements ManifestSource {
     resolveRelative(base: string, relative: string): string;
     private toRegistryModuleBase;
     private toRegistryUrl;
-    private parseModuleRef;
 }
 //# sourceMappingURL=registry-source.d.ts.map

package/dist/sources/registry-source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry-source.d.ts","sourceRoot":"","sources":["../../src/sources/registry-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAI7E,qBAAa,cAAe,YAAW,cAAc;IACvC,OAAO,CAAC,WAAW;gBAAX,WAAW,SAAuB;IAEtD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAWxB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IA4BxE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAMvD,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,cAAc;CAmBvB"}
+{"version":3,"file":"registry-source.d.ts","sourceRoot":"","sources":["../../src/sources/registry-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAM7E,qBAAa,cAAe,YAAW,cAAc;IACvC,OAAO,CAAC,WAAW;gBAAX,WAAW,SAAuB;IAEtD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAIxB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAuBxE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAMvD,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,aAAa;CAGtB"}

package/dist/sources/registry-source.js

@@ -1,4 +1,6 @@
 import { DEFAULT_MANIFEST_FILENAME } from "../types.js";
+import { splitIntegrity, verifiedFetch } from "./integrity.js";
+import { isRegistryRef, parseModuleRef } from "./module-ref.js";
 const DEFAULT_REGISTRY_URL = "https://registry.telo.run";
 export class RegistrySource {
     registryUrl;
@@ -6,20 +8,12 @@ export class RegistrySource {
         this.registryUrl = registryUrl;
     }
     supports(url) {
-        return (!url.startsWith("http://") &&
-            !url.startsWith("https://") &&
-            !url.startsWith("/") &&
-            !url.startsWith(".") &&
-            url.includes("@") &&
-            url.includes("/"));
+        return isRegistryRef(url);
     }
     async read(moduleRef) {
-        const fetchUrl = this.toRegistryUrl(moduleRef);
-        const response = await fetch(fetchUrl);
-        if (!response.ok) {
-            throw new Error(`Failed to fetch manifest ${moduleRef}: ${response.status} ${response.statusText}`);
-        }
-        const text = await response.text();
+        const { base, integrity } = splitIntegrity(moduleRef);
+        const fetchUrl = this.toRegistryUrl(base);
+        const { text } = await verifiedFetch(fetchUrl, integrity, base);
         // Some object-storage backends (e.g. Cloudflare R2 / S3) surface auth or
         // permission failures by returning a 200 status with an XML error body.
         // Catch this here so the loader produces a precise error rather than
@@ -30,7 +24,7 @@ export class RegistrySource {
             const detail = codeMatch && messageMatch
                 ? `${codeMatch[1]}: ${messageMatch[1]}`
                 : text.slice(0, 200);
-            throw new Error(`Registry returned a non-manifest response for ${moduleRef} ` +
+            throw new Error(`Registry returned a non-manifest response for ${base} ` +
                 `(URL: ${fetchUrl}): ${detail}`);
         }
         return { text, source: fetchUrl };
@@ -41,27 +35,11 @@ export class RegistrySource {
         return new URL(relative, baseWithSlash).href;
     }
     toRegistryModuleBase(moduleRef) {
-        const parsed = this.parseModuleRef(moduleRef);
+        const parsed = parseModuleRef(moduleRef);
         const normalizedBase = this.registryUrl.replace(/\/+$/, "");
         return `${normalizedBase}/${parsed.modulePath}/${parsed.version}`;
     }
     toRegistryUrl(moduleRef) {
         return `${this.toRegistryModuleBase(moduleRef)}/${DEFAULT_MANIFEST_FILENAME}`;
     }
-    parseModuleRef(moduleRef) {
-        const atIdx = moduleRef.lastIndexOf("@");
-        if (atIdx <= 0 || atIdx === moduleRef.length - 1) {
-            throw new Error(`Invalid module reference '${moduleRef}', expected namespace/name@version`);
-        }
-        const modulePath = moduleRef.slice(0, atIdx);
-        if (!modulePath.includes("/")) {
-            throw new Error(`Invalid module reference '${moduleRef}', expected namespace/name@version`);
-        }
-        const rawVersion = moduleRef.slice(atIdx + 1);
-        const version = rawVersion.startsWith("v") ? rawVersion.substring(1) : rawVersion;
-        if (!version) {
-            throw new Error(`Invalid module reference '${moduleRef}', expected namespace/name@version`);
-        }
-        return { modulePath, version };
-    }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.31.0",
+  "version": "0.32.0",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",
@@ -48,7 +48,7 @@
     "@types/node": "^20.0.0",
     "typescript": "^5.0.0",
     "vitest": "^2.1.8",
-    "@telorun/sdk": "0.38.0"
+    "@telorun/sdk": "0.41.0"
   },
   "peerDependencies": {
     "@telorun/sdk": "*"

package/src/builtins.ts

@@ -227,6 +227,7 @@ export const KERNEL_BUILTINS: ResourceDefinition[] = [
           additionalProperties: true,
         },
         source: { type: "string" },
+        integrity: { type: "string" },
         variables: { type: "object" },
         secrets: { type: "object" },
         runtime: {
@@ -361,6 +362,11 @@ export const KERNEL_BUILTINS: ResourceDefinition[] = [
           type: "array",
           items: { type: "string" },
         },
+        // Integrity hash of the decompressed payload tar (`module.tar.gz`,
+        // telo.yaml excluded), written by `telo publish`. Pinned transitively
+        // by the importer's `#sha256-...` hash over this telo.yaml; verified at
+        // extract time. See plans/federated-registries.md.
+        filesIntegrity: { type: "string" },
         // Inline imports — name-keyed map sugar for separate `Telo.Import`
         // documents. The key is the PascalCase alias (the import's
         // `metadata.name`). Each value is either a bare source string
@@ -378,6 +384,7 @@ export const KERNEL_BUILTINS: ResourceDefinition[] = [
                 required: ["source"],
                 properties: {
                   source: { type: "string" },
+                  integrity: { type: "string" },
                   variables: { type: "object" },
                   secrets: { type: "object" },
                   runtime: {
@@ -492,6 +499,11 @@ export const KERNEL_BUILTINS: ResourceDefinition[] = [
           type: "array",
           items: { type: "string" },
         },
+        // Integrity hash of the decompressed payload tar (`module.tar.gz`,
+        // telo.yaml excluded), written by `telo publish`. Pinned transitively
+        // by the importer's `#sha256-...` hash over this telo.yaml; verified at
+        // extract time. See plans/federated-registries.md.
+        filesIntegrity: { type: "string" },
         // Inline imports — same name-keyed map sugar as Telo.Application; the
         // loader desugars each entry into a synthetic Telo.Import. See the
         // Application schema above and analyzer/nodejs/src/inline-imports.ts.
@@ -505,6 +517,7 @@ export const KERNEL_BUILTINS: ResourceDefinition[] = [
                 required: ["source"],
                 properties: {
                   source: { type: "string" },
+                  integrity: { type: "string" },
                   variables: { type: "object" },
                   secrets: { type: "object" },
                   runtime: {

package/src/index.ts

@@ -53,6 +53,15 @@ export type { DocumentPosition } from "./position-metadata.js";
 export { HttpSource } from "./sources/http-source.js";
 export { RegistrySource } from "./sources/registry-source.js";
 export { defaultSources } from "./sources/default-sources.js";
+export {
+  splitIntegrity,
+  foldIntegrity,
+  verifyIntegrity,
+  verifiedFetch,
+  sha256Base64Url,
+} from "./sources/integrity.js";
+export { parseModuleRef, isRegistryRef } from "./sources/module-ref.js";
+export type { ParsedModuleRef } from "./sources/module-ref.js";
 export { withSyntheticPositions } from "./with-synthetic-positions.js";
 export { DEFAULT_MANIFEST_FILENAME, DiagnosticSeverity } from "./types.js";
 export type {

package/src/inline-imports.ts

@@ -1,5 +1,6 @@
 import type { ResourceManifest } from "@telorun/sdk";
 import type { LoadedFile } from "./loaded-types.js";
+import { foldIntegrity } from "./sources/integrity.js";
 import { isModuleKind } from "./module-kinds.js";
 import type { DocumentPosition } from "./position-metadata.js";
 import type { PositionIndex } from "./types.js";
@@ -42,10 +43,15 @@ export function inlineImportManifests(
         : undefined;
     if (!entry || typeof entry.source !== "string") continue;
 
+    // The object form carries integrity as a sibling `integrity:` field; fold it
+    // into the source string as a `#sha256-...` fragment so every downstream
+    // consumer sees a single representation (the scalar form already inlines it).
+    const source = foldIntegrity(entry.source, entry.integrity);
+
     const manifest = {
       kind: "Telo.Import",
       metadata: { name: alias },
-      source: entry.source,
+      source,
       ...(entry.variables !== undefined ? { variables: entry.variables } : {}),
       ...(entry.secrets !== undefined ? { secrets: entry.secrets } : {}),
       ...(entry.runtime !== undefined ? { runtime: entry.runtime } : {}),

package/src/sources/http-source.ts

@@ -1,4 +1,5 @@
 import { DEFAULT_MANIFEST_FILENAME, type ManifestSource } from "../types.js";
+import { splitIntegrity, verifiedFetch } from "./integrity.js";
 
 export class HttpSource implements ManifestSource {
   supports(url: string): boolean {
@@ -6,14 +7,10 @@ export class HttpSource implements ManifestSource {
   }
 
   async read(url: string): Promise<{ text: string; source: string }> {
-    const fetchUrl = url.includes(".yaml") ? url : `${url}/${DEFAULT_MANIFEST_FILENAME}`;
-    const response = await fetch(fetchUrl);
-    if (!response.ok) {
-      throw new Error(
-        `Failed to fetch manifest from ${fetchUrl}: ${response.status} ${response.statusText}`,
-      );
-    }
-    return { text: await response.text(), source: fetchUrl };
+    const { base, integrity } = splitIntegrity(url);
+    const fetchUrl = base.includes(".yaml") ? base : `${base}/${DEFAULT_MANIFEST_FILENAME}`;
+    const { text } = await verifiedFetch(fetchUrl, integrity, fetchUrl);
+    return { text, source: fetchUrl };
   }
 
   resolveRelative(base: string, relative: string): string {

package/src/sources/integrity.ts

@@ -0,0 +1,101 @@
+/** Inline module integrity — the `#sha256-<base64url>` fragment carried on a
+ *  remote import ref. Browser-safe: uses Web Crypto (`crypto.subtle`) and
+ *  `btoa`, both globals in Node and the browser. No Node built-ins.
+ *
+ *  The fragment is authoritative across every transport: a source's `read()`
+ *  hashes the fetched bytes and compares against it before the manifest is
+ *  parsed or cached. A mismatch is a terminal error — never a cache miss. */
+
+/** Only a `#<alg>-<base64url>` suffix is treated as integrity; other `#`
+ *  fragments (rare in module refs) pass through untouched. `sha256` is the
+ *  only algorithm accepted today; the prefix leaves room to migrate. */
+const INTEGRITY_FRAGMENT = /#(sha256-[A-Za-z0-9_+/=-]+)$/;
+
+/** Split a trailing integrity fragment off a ref/URL. Returns the bare ref in
+ *  `base` (safe to build fetch URLs and cache paths from) and the fragment in
+ *  `integrity` (e.g. `sha256-<base64url>`), or `undefined` when absent. */
+export function splitIntegrity(ref: string): { base: string; integrity?: string } {
+  const match = ref.match(INTEGRITY_FRAGMENT);
+  if (!match) return { base: ref };
+  return { base: ref.slice(0, match.index), integrity: match[1] };
+}
+
+/** Attach an integrity hash to a ref as a `#<alg>-...` fragment. No-op when the
+ *  hash is absent/non-string or the ref already carries a fragment (an
+ *  author-authored pin is never overwritten). Inverse of `splitIntegrity`;
+ *  used to fold the object form's `integrity:` sibling into the source string. */
+export function foldIntegrity(source: string, integrity: unknown): string {
+  return typeof integrity === "string" && !source.includes("#")
+    ? `${source}#${integrity}`
+    : source;
+}
+
+function toBase64Url(bytes: Uint8Array): string {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+/** Normalize an encoded digest to unpadded base64url so a standard-base64 or
+ *  padded input still compares equal to our canonical form. */
+function normalizeDigest(value: string): string {
+  return value.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+/** SHA-256 of `bytes` as unpadded base64url — the canonical inline-hash form. */
+export async function sha256Base64Url(bytes: Uint8Array): Promise<string> {
+  // Copy into a plain ArrayBuffer: a Uint8Array may be backed by a
+  // SharedArrayBuffer, which `crypto.subtle.digest` does not accept.
+  const buffer = new ArrayBuffer(bytes.byteLength);
+  new Uint8Array(buffer).set(bytes);
+  const digest = await crypto.subtle.digest("SHA-256", buffer);
+  return toBase64Url(new Uint8Array(digest));
+}
+
+/** Hash `bytes` and compare against `integrity` (`<alg>-<digest>`). Throws a
+ *  terminal error on mismatch or an unsupported algorithm. `describe` names the
+ *  artifact in the error (e.g. the module ref) so the failure is actionable. */
+export async function verifyIntegrity(
+  bytes: Uint8Array,
+  integrity: string,
+  describe: string,
+): Promise<void> {
+  const dash = integrity.indexOf("-");
+  const algorithm = dash > 0 ? integrity.slice(0, dash) : "";
+  const expected = dash > 0 ? integrity.slice(dash + 1) : "";
+  if (algorithm !== "sha256") {
+    throw new Error(
+      `Unsupported integrity algorithm '${algorithm || integrity}' for ${describe}. ` +
+        `Only sha256 is supported (sha256-<base64url>).`,
+    );
+  }
+  const actual = await sha256Base64Url(bytes);
+  if (actual !== normalizeDigest(expected)) {
+    throw new Error(
+      `Integrity check failed for ${describe}: expected sha256-${normalizeDigest(expected)}, ` +
+        `got sha256-${actual}. The fetched bytes do not match the recorded hash — ` +
+        `the module may have been tampered with or republished.`,
+    );
+  }
+}
+
+/** The single verified network read for remote manifests: fetch `fetchUrl`,
+ *  verify the raw bytes against `integrity` (when pinned), and return both the
+ *  bytes and the decoded text. The one choke point every network `ManifestSource`
+ *  routes through, so verification cannot drift between them. `describe` names
+ *  the artifact in error messages. */
+export async function verifiedFetch(
+  fetchUrl: string,
+  integrity: string | undefined,
+  describe: string,
+): Promise<{ bytes: Uint8Array; text: string }> {
+  const response = await fetch(fetchUrl);
+  if (!response.ok) {
+    throw new Error(
+      `Failed to fetch manifest ${describe}: ${response.status} ${response.statusText} (${fetchUrl})`,
+    );
+  }
+  const bytes = new Uint8Array(await response.arrayBuffer());
+  if (integrity) await verifyIntegrity(bytes, integrity, describe);
+  return { bytes, text: new TextDecoder().decode(bytes) };
+}

package/src/sources/module-ref.ts

@@ -0,0 +1,48 @@
+import { splitIntegrity } from "./integrity.js";
+
+/** A parsed registry module reference. `modulePath` is `namespace/name`,
+ *  `version` has any leading `v` stripped, and `integrity` carries the inline
+ *  `sha256-<base64url>` hash when the ref was pinned. */
+export interface ParsedModuleRef {
+  modulePath: string;
+  version: string;
+  integrity?: string;
+}
+
+/** True when `url` has the bare registry-ref shape `namespace/name@version`
+ *  (no scheme, no leading `/` or `.`, contains both `@` and `/`). The integrity
+ *  fragment, if any, does not affect the classification. */
+export function isRegistryRef(url: string): boolean {
+  const { base } = splitIntegrity(url);
+  return (
+    !base.startsWith("http://") &&
+    !base.startsWith("https://") &&
+    !base.startsWith("/") &&
+    !base.startsWith(".") &&
+    !base.startsWith("file://") &&
+    !base.startsWith("memory://") &&
+    base.includes("@") &&
+    base.includes("/")
+  );
+}
+
+/** Canonical parser for `namespace/name@version[#sha256-...]` refs. The single
+ *  source of truth shared by the registry source, the kernel manifest cache,
+ *  and the CLI (install / upgrade / bundle). Throws on a malformed ref. */
+export function parseModuleRef(ref: string): ParsedModuleRef {
+  const { base, integrity } = splitIntegrity(ref);
+  const atIdx = base.lastIndexOf("@");
+  if (atIdx <= 0 || atIdx === base.length - 1) {
+    throw new Error(`Invalid module reference '${ref}', expected namespace/name@version`);
+  }
+  const modulePath = base.slice(0, atIdx);
+  if (!modulePath.includes("/")) {
+    throw new Error(`Invalid module reference '${ref}', expected namespace/name@version`);
+  }
+  const rawVersion = base.slice(atIdx + 1);
+  const version = rawVersion.startsWith("v") ? rawVersion.slice(1) : rawVersion;
+  if (!version) {
+    throw new Error(`Invalid module reference '${ref}', expected namespace/name@version`);
+  }
+  return { modulePath, version, integrity };
+}

package/src/sources/registry-source.ts

@@ -1,4 +1,6 @@
 import { DEFAULT_MANIFEST_FILENAME, type ManifestSource } from "../types.js";
+import { splitIntegrity, verifiedFetch } from "./integrity.js";
+import { isRegistryRef, parseModuleRef } from "./module-ref.js";
 
 const DEFAULT_REGISTRY_URL = "https://registry.telo.run";
 
@@ -6,25 +8,13 @@ export class RegistrySource implements ManifestSource {
   constructor(private registryUrl = DEFAULT_REGISTRY_URL) {}
 
   supports(url: string): boolean {
-    return (
-      !url.startsWith("http://") &&
-      !url.startsWith("https://") &&
-      !url.startsWith("/") &&
-      !url.startsWith(".") &&
-      url.includes("@") &&
-      url.includes("/")
-    );
+    return isRegistryRef(url);
   }
 
   async read(moduleRef: string): Promise<{ text: string; source: string }> {
-    const fetchUrl = this.toRegistryUrl(moduleRef);
-    const response = await fetch(fetchUrl);
-    if (!response.ok) {
-      throw new Error(
-        `Failed to fetch manifest ${moduleRef}: ${response.status} ${response.statusText}`,
-      );
-    }
-    const text = await response.text();
+    const { base, integrity } = splitIntegrity(moduleRef);
+    const fetchUrl = this.toRegistryUrl(base);
+    const { text } = await verifiedFetch(fetchUrl, integrity, base);
     // Some object-storage backends (e.g. Cloudflare R2 / S3) surface auth or
     // permission failures by returning a 200 status with an XML error body.
     // Catch this here so the loader produces a precise error rather than
@@ -37,7 +27,7 @@ export class RegistrySource implements ManifestSource {
           ? `${codeMatch[1]}: ${messageMatch[1]}`
           : text.slice(0, 200);
       throw new Error(
-        `Registry returned a non-manifest response for ${moduleRef} ` +
+        `Registry returned a non-manifest response for ${base} ` +
           `(URL: ${fetchUrl}): ${detail}`,
       );
     }
@@ -51,7 +41,7 @@ export class RegistrySource implements ManifestSource {
   }
 
   private toRegistryModuleBase(moduleRef: string): string {
-    const parsed = this.parseModuleRef(moduleRef);
+    const parsed = parseModuleRef(moduleRef);
     const normalizedBase = this.registryUrl.replace(/\/+$/, "");
     return `${normalizedBase}/${parsed.modulePath}/${parsed.version}`;
   }
@@ -59,24 +49,4 @@ export class RegistrySource implements ManifestSource {
   private toRegistryUrl(moduleRef: string): string {
     return `${this.toRegistryModuleBase(moduleRef)}/${DEFAULT_MANIFEST_FILENAME}`;
   }
-
-  private parseModuleRef(moduleRef: string): { modulePath: string; version: string } {
-    const atIdx = moduleRef.lastIndexOf("@");
-    if (atIdx <= 0 || atIdx === moduleRef.length - 1) {
-      throw new Error(`Invalid module reference '${moduleRef}', expected namespace/name@version`);
-    }
-
-    const modulePath = moduleRef.slice(0, atIdx);
-    if (!modulePath.includes("/")) {
-      throw new Error(`Invalid module reference '${moduleRef}', expected namespace/name@version`);
-    }
-
-    const rawVersion = moduleRef.slice(atIdx + 1);
-    const version = rawVersion.startsWith("v") ? rawVersion.substring(1) : rawVersion;
-    if (!version) {
-      throw new Error(`Invalid module reference '${moduleRef}', expected namespace/name@version`);
-    }
-
-    return { modulePath, version };
-  }
 }