@telorun/analyzer 0.47.0 → 0.48.0

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AA6B9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAyyB/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IA4hCvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAyBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AA6B9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA0yB/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAiiCvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAyBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -24,6 +24,7 @@ import { extractAccessChains, extractCelRegionScopes, extractContextsFromSchema,
 import { buildEvalPaths, evalPathsCover } from "./eval-paths.js";
 import { validateExtends } from "./validate-extends.js";
 import { validateLogging } from "./validate-logging.js";
+import { validateModuleArtifact } from "./validate-module-artifact.js";
 import { validateBaseMapping } from "./validate-base-mapping.js";
 import { validateNestedInlineResources } from "./validate-nested-inline.js";
 import { validateProviderCoherence } from "./validate-provider-coherence.js";
@@ -1015,6 +1016,11 @@ export class StaticAnalyzer {
             // §14.1 / §10.3: redaction paths and `on_full: block` are statically
             // detectable, so they fail `telo check` rather than only at boot.
             diagnostics.push(...validateLogging(allManifests, defs, aliases, aliasesByModule));
+            // Module-artifact surface: bundled-controller selector qualifiers and the
+            // published `layers:` index. Every case is decidable from the manifest and
+            // would otherwise fail on a consumer's machine — or, for a mistyped platform
+            // axis, silently offer one platform's binary to every host.
+            diagnostics.push(...validateModuleArtifact(allManifests));
         }
         resolveSchemaTypeRefs(allManifests, aliases, aliasesByModule);
         // Trusted-input fast path: when the caller has already attested that

package/dist/artifact-layer-index.d.ts

@@ -0,0 +1,55 @@
+/**
+ * The **layer index** of `kernel/specs/module-artifact.md` — the `layers:` block
+ * a published `telo.yaml` carries, listing every layer of the module artifact
+ * except the manifest layer itself.
+ *
+ * Why it lives in `telo.yaml` rather than in the OCI manifest, which has layers
+ * natively: a Telo import is pinned to a hash of `telo.yaml` and nothing else.
+ * The OCI manifest sits one level up, is fetched by a reference that is usually
+ * a mutable tag, and is never hashed by Telo — so digests held only there would
+ * leave the pin proving nothing about the payload. Pinning the OCI manifest
+ * instead is circular: `telo.yaml` is one of its layers.
+ *
+ * The manifest layer therefore has no entry — a hash of `telo.yaml` cannot sit
+ * inside `telo.yaml`. It is pinned by the importer's `#sha256-...` instead, so
+ * the chain reads `import pin -> telo.yaml -> blob digest -> layer contents`.
+ *
+ * Each entry carries two digests, answering different questions:
+ *  - `blob` — the OCI blob digest over the pushed bytes. It *addresses* the
+ *    layer, so a client pulls by digest and never reads the OCI layer list, and
+ *    it verifies the transfer. Publish pushes payload blobs first and injects
+ *    their digests here, then pushes the manifest blob, so nothing is circular.
+ *  - `integrity` — the content digest (`computeFilesIntegrity`) over that
+ *    layer's own files, independent of tar/gzip framing. It verifies what is
+ *    already extracted on disk and can be re-derived from it without re-tarring,
+ *    which is what makes a per-layer cache marker checkable.
+ *
+ * Browser-safe: `telo check`, the editor and the hub validate an index through
+ * this module; only the kernel fetches and extracts.
+ */
+import { type ArtifactSelector, type LayerRole, type PlatformTarget } from "./artifact-selector.js";
+export interface ArtifactLayer {
+    role: LayerRole;
+    /** Present on `controller` layers only. */
+    selector?: ArtifactSelector;
+    /** OCI blob digest — addresses the layer and verifies the transfer. */
+    blob: string;
+    /** Content digest over the layer's files — verifies what is on disk. */
+    integrity: string;
+}
+export declare class LayerIndexError extends Error {
+    readonly code = "INVALID_LAYER_INDEX";
+    constructor(detail: string);
+}
+/**
+ * Parse and validate a `layers:` value off an owner document. Order is
+ * preserved — when several controller layers match a target, precedence is
+ * declaration order, so the author controls it.
+ */
+export declare function parseLayerIndex(value: unknown, describe?: string): ArtifactLayer[];
+/** The singleton layer for a role, or undefined when the artifact has none. */
+export declare function singletonLayer(layers: readonly ArtifactLayer[], role: Exclude<LayerRole, "controller">): ArtifactLayer | undefined;
+/** Every controller layer matching `target`, in declaration order. Used by
+ *  `telo install` to warm a cache for one platform. */
+export declare function matchControllerLayers(layers: readonly ArtifactLayer[], target: PlatformTarget): ArtifactLayer[];
+//# sourceMappingURL=artifact-layer-index.d.ts.map

package/dist/artifact-layer-index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-layer-index.d.ts","sourceRoot":"","sources":["../src/artifact-layer-index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAKL,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,cAAc,EACpB,MAAM,wBAAwB,CAAC;AAQhC,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,SAAS,CAAC;IAChB,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,yBAAyB;gBAE1B,MAAM,EAAE,MAAM;CAI3B;AAiBD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,SAAW,GAAG,aAAa,EAAE,CAyDpF;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAC5B,MAAM,EAAE,SAAS,aAAa,EAAE,EAChC,IAAI,EAAE,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC,GACrC,aAAa,GAAG,SAAS,CAE3B;AAED;uDACuD;AACvD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,SAAS,aAAa,EAAE,EAChC,MAAM,EAAE,cAAc,GACrB,aAAa,EAAE,CAIjB"}

package/dist/artifact-layer-index.js

@@ -0,0 +1,116 @@
+/**
+ * The **layer index** of `kernel/specs/module-artifact.md` — the `layers:` block
+ * a published `telo.yaml` carries, listing every layer of the module artifact
+ * except the manifest layer itself.
+ *
+ * Why it lives in `telo.yaml` rather than in the OCI manifest, which has layers
+ * natively: a Telo import is pinned to a hash of `telo.yaml` and nothing else.
+ * The OCI manifest sits one level up, is fetched by a reference that is usually
+ * a mutable tag, and is never hashed by Telo — so digests held only there would
+ * leave the pin proving nothing about the payload. Pinning the OCI manifest
+ * instead is circular: `telo.yaml` is one of its layers.
+ *
+ * The manifest layer therefore has no entry — a hash of `telo.yaml` cannot sit
+ * inside `telo.yaml`. It is pinned by the importer's `#sha256-...` instead, so
+ * the chain reads `import pin -> telo.yaml -> blob digest -> layer contents`.
+ *
+ * Each entry carries two digests, answering different questions:
+ *  - `blob` — the OCI blob digest over the pushed bytes. It *addresses* the
+ *    layer, so a client pulls by digest and never reads the OCI layer list, and
+ *    it verifies the transfer. Publish pushes payload blobs first and injects
+ *    their digests here, then pushes the manifest blob, so nothing is circular.
+ *  - `integrity` — the content digest (`computeFilesIntegrity`) over that
+ *    layer's own files, independent of tar/gzip framing. It verifies what is
+ *    already extracted on disk and can be re-derived from it without re-tarring,
+ *    which is what makes a per-layer cache marker checkable.
+ *
+ * Browser-safe: `telo check`, the editor and the hub validate an index through
+ * this module; only the kernel fetches and extracts.
+ */
+import { isLayerRole, normalizeSelector, selectorKey, selectorMatches, } from "./artifact-selector.js";
+/** OCI content digest: `sha256:` + 64 lowercase hex. */
+const BLOB_DIGEST = /^sha256:[0-9a-f]{64}$/;
+/** Telo content digest: `sha256-` + unpadded base64url of 32 bytes. */
+const CONTENT_DIGEST = /^sha256-[A-Za-z0-9_-]{43}$/;
+export class LayerIndexError extends Error {
+    code = "INVALID_LAYER_INDEX";
+    constructor(detail) {
+        super(detail);
+        this.name = "LayerIndexError";
+    }
+}
+function digest(field, raw, describe) {
+    if (typeof raw !== "string" || raw === "") {
+        throw new LayerIndexError(`${describe}: ${field} is required and must be a string.`);
+    }
+    const pattern = field === "blob" ? BLOB_DIGEST : CONTENT_DIGEST;
+    if (!pattern.test(raw)) {
+        throw new LayerIndexError(field === "blob"
+            ? `${describe}: blob '${raw}' is not an OCI digest (expected 'sha256:' + 64 hex characters).`
+            : `${describe}: integrity '${raw}' is not a content digest (expected 'sha256-' + 43 base64url characters).`);
+    }
+    return raw;
+}
+/**
+ * Parse and validate a `layers:` value off an owner document. Order is
+ * preserved — when several controller layers match a target, precedence is
+ * declaration order, so the author controls it.
+ */
+export function parseLayerIndex(value, describe = "layers") {
+    if (!Array.isArray(value)) {
+        throw new LayerIndexError(`${describe}: expected an array of layer entries.`);
+    }
+    const layers = [];
+    const seenSelectors = new Set();
+    const seenSingletons = new Set();
+    value.forEach((raw, index) => {
+        const where = `${describe}[${index}]`;
+        if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+            throw new LayerIndexError(`${where}: expected an object.`);
+        }
+        const entry = raw;
+        if (!isLayerRole(entry.role)) {
+            throw new LayerIndexError(`${where}: role must be one of 'controller', 'assets', 'common'; got ` +
+                `${entry.role === undefined ? "nothing" : `'${String(entry.role)}'`}.`);
+        }
+        const role = entry.role;
+        let selector;
+        if (role === "controller") {
+            if (entry.selector === undefined) {
+                throw new LayerIndexError(`${where}: a controller layer must declare a selector.`);
+            }
+            selector = normalizeSelector(entry.selector, where);
+            const key = selectorKey(selector);
+            if (seenSelectors.has(key)) {
+                throw new LayerIndexError(`${where}: a second controller layer claims the selector ${key}. ` +
+                    `Each selector addresses exactly one layer.`);
+            }
+            seenSelectors.add(key);
+        }
+        else {
+            if (entry.selector !== undefined) {
+                throw new LayerIndexError(`${where}: a '${role}' layer must not declare a selector — it is a singleton.`);
+            }
+            if (seenSingletons.has(role)) {
+                throw new LayerIndexError(`${where}: a second '${role}' layer is declared.`);
+            }
+            seenSingletons.add(role);
+        }
+        layers.push({
+            role,
+            ...(selector ? { selector } : {}),
+            blob: digest("blob", entry.blob, where),
+            integrity: digest("integrity", entry.integrity, where),
+        });
+    });
+    return layers;
+}
+/** The singleton layer for a role, or undefined when the artifact has none. */
+export function singletonLayer(layers, role) {
+    return layers.find((l) => l.role === role);
+}
+/** Every controller layer matching `target`, in declaration order. Used by
+ *  `telo install` to warm a cache for one platform. */
+export function matchControllerLayers(layers, target) {
+    return layers.filter((l) => l.role === "controller" && l.selector !== undefined && selectorMatches(l.selector, target));
+}

package/dist/artifact-selector.d.ts

@@ -0,0 +1,81 @@
+/**
+ * The **selector** of `kernel/specs/module-artifact.md` — the tuple a bundled
+ * controller candidate is chosen by, and the key a controller layer of a module
+ * artifact is stored under.
+ *
+ * A selector is `format` plus the optional platform axes `os` / `arch` / `libc`.
+ * Matching is one rule, applied per axis: an axis the selector omits accepts
+ * anything, an axis it states must be equal. That is what lets a `js` controller
+ * be platform-neutral and a `napi` controller be pinned to one triple, with no
+ * special case for either.
+ *
+ * Browser-safe and dependency-free by construction. Three consumers must agree
+ * on this grammar or a published artifact stops loading: `telo publish`
+ * (partitioning files into layers), `telo install --platform` (deciding which
+ * layers to pre-fetch), and the kernel's bundle controller loader (matching a
+ * candidate against the host). Keeping it here — beside the redaction path
+ * parser, for the same reason — means one implementation rather than three that
+ * drift.
+ *
+ * PURL *syntax* is deliberately not parsed here. Callers hand in the format and
+ * an already-decoded qualifier map, so this module owns selector semantics while
+ * the caller owns its own package-URL library. The Node vocabulary is likewise
+ * not known here: `process.platform` / `process.arch` are mapped to the
+ * canonical OCI/GOOS names at the kernel boundary, since these values are
+ * published into OCI descriptors.
+ */
+/** The role a layer plays in a module artifact. `controller` layers carry a
+ *  selector; `assets` and `common` are singletons and carry none. */
+export type LayerRole = "controller" | "assets" | "common";
+export declare const LAYER_ROLES: readonly LayerRole[];
+export declare function isLayerRole(value: unknown): value is LayerRole;
+/** The platform axes, in canonical order. Not a closed vocabulary of *values* —
+ *  new architectures appear without a Telo release — only of axis names. */
+export declare const PLATFORM_AXES: readonly ["os", "arch", "libc"];
+export type PlatformAxis = (typeof PLATFORM_AXES)[number];
+export interface ArtifactSelector {
+    /** Bundled controller format: the PURL name segment (`js`, `napi`, `wasm`, …). */
+    format: string;
+    os?: string;
+    arch?: string;
+    libc?: string;
+}
+/** What a selector is matched against: the host the kernel runs on, or the
+ *  target `telo install --platform` is warming a cache for. An axis left
+ *  undetermined (a host whose libc cannot be detected) matches no selector that
+ *  constrains it — refusing to load is the safe direction for a native binary. */
+export interface PlatformTarget {
+    format?: string;
+    os?: string;
+    arch?: string;
+    libc?: string;
+}
+export declare class ArtifactSelectorError extends Error {
+    readonly code = "INVALID_ARTIFACT_SELECTOR";
+    constructor(detail: string);
+}
+/**
+ * Build a selector from a controller candidate's format and qualifier map.
+ * Qualifier keys other than the platform axes are ignored — `path` and the
+ * sibling list live in the same map and are not part of the selector.
+ */
+export declare function selectorFromQualifiers(format: unknown, qualifiers: Readonly<Record<string, unknown>> | undefined, describe?: string): ArtifactSelector;
+/** Validate and normalize a selector read off a published layer index. */
+export declare function normalizeSelector(value: unknown, describe?: string): ArtifactSelector;
+/**
+ * The canonical stable key for a selector: sorted `axis=value` pairs joined by
+ * `;`. Used to group entry points into layers at publish time and to detect two
+ * layers claiming the same selector. Sorted and fully qualified so no two
+ * distinct selectors can collide and no one selector has two spellings.
+ */
+export declare function selectorKey(selector: ArtifactSelector): string;
+/** Human-facing rendering for diagnostics and the publish partition printout. */
+export declare function describeSelector(selector: ArtifactSelector): string;
+/**
+ * The matching rule: every axis the selector states must equal the target's;
+ * every axis it omits accepts anything. A target axis left undetermined matches
+ * only a selector that does not constrain it — a host whose libc is unknown must
+ * not be handed a `libc=gnu` binary on the assumption it will run.
+ */
+export declare function selectorMatches(selector: ArtifactSelector, target: PlatformTarget): boolean;
+//# sourceMappingURL=artifact-selector.d.ts.map

package/dist/artifact-selector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-selector.d.ts","sourceRoot":"","sources":["../src/artifact-selector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;qEACqE;AACrE,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE3D,eAAO,MAAM,WAAW,EAAE,SAAS,SAAS,EAAuC,CAAC;AAEpF,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,SAAS,CAE9D;AAED;4EAC4E;AAC5E,eAAO,MAAM,aAAa,iCAAkC,CAAC;AAE7D,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D,MAAM,WAAW,gBAAgB;IAC/B,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;kFAGkF;AAClF,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,IAAI,+BAA+B;gBAEhC,MAAM,EAAE,MAAM;CAI3B;AAsBD;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,OAAO,EACf,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,EACzD,QAAQ,SAAwB,GAC/B,gBAAgB,CAUlB;AAED,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,OAAO,EACd,QAAQ,SAAmB,GAC1B,gBAAgB,CAelB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,CAO9D;AAED,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,CAKnE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAQ3F"}

package/dist/artifact-selector.js

@@ -0,0 +1,122 @@
+/**
+ * The **selector** of `kernel/specs/module-artifact.md` — the tuple a bundled
+ * controller candidate is chosen by, and the key a controller layer of a module
+ * artifact is stored under.
+ *
+ * A selector is `format` plus the optional platform axes `os` / `arch` / `libc`.
+ * Matching is one rule, applied per axis: an axis the selector omits accepts
+ * anything, an axis it states must be equal. That is what lets a `js` controller
+ * be platform-neutral and a `napi` controller be pinned to one triple, with no
+ * special case for either.
+ *
+ * Browser-safe and dependency-free by construction. Three consumers must agree
+ * on this grammar or a published artifact stops loading: `telo publish`
+ * (partitioning files into layers), `telo install --platform` (deciding which
+ * layers to pre-fetch), and the kernel's bundle controller loader (matching a
+ * candidate against the host). Keeping it here — beside the redaction path
+ * parser, for the same reason — means one implementation rather than three that
+ * drift.
+ *
+ * PURL *syntax* is deliberately not parsed here. Callers hand in the format and
+ * an already-decoded qualifier map, so this module owns selector semantics while
+ * the caller owns its own package-URL library. The Node vocabulary is likewise
+ * not known here: `process.platform` / `process.arch` are mapped to the
+ * canonical OCI/GOOS names at the kernel boundary, since these values are
+ * published into OCI descriptors.
+ */
+export const LAYER_ROLES = ["controller", "assets", "common"];
+export function isLayerRole(value) {
+    return typeof value === "string" && LAYER_ROLES.includes(value);
+}
+/** The platform axes, in canonical order. Not a closed vocabulary of *values* —
+ *  new architectures appear without a Telo release — only of axis names. */
+export const PLATFORM_AXES = ["os", "arch", "libc"];
+export class ArtifactSelectorError extends Error {
+    code = "INVALID_ARTIFACT_SELECTOR";
+    constructor(detail) {
+        super(detail);
+        this.name = "ArtifactSelectorError";
+    }
+}
+/** Canonical token shape for every selector value. Lowercase, so the same
+ *  platform written two ways is one layer rather than two. */
+const TOKEN = /^[a-z0-9][a-z0-9_.-]*$/;
+function normalizeToken(axis, raw, describe) {
+    if (typeof raw !== "string") {
+        throw new ArtifactSelectorError(`${describe}: ${axis} must be a string, got ${raw === null ? "null" : typeof raw}.`);
+    }
+    const value = raw.trim().toLowerCase();
+    if (!TOKEN.test(value)) {
+        throw new ArtifactSelectorError(`${describe}: ${axis} value '${raw}' is not a canonical token. ` +
+            `Use lowercase letters, digits, '.', '-' or '_', starting with a letter or digit.`);
+    }
+    return value;
+}
+/**
+ * Build a selector from a controller candidate's format and qualifier map.
+ * Qualifier keys other than the platform axes are ignored — `path` and the
+ * sibling list live in the same map and are not part of the selector.
+ */
+export function selectorFromQualifiers(format, qualifiers, describe = "controller selector") {
+    const selector = {
+        format: normalizeToken("format", format, describe),
+    };
+    for (const axis of PLATFORM_AXES) {
+        const raw = qualifiers?.[axis];
+        if (raw === undefined || raw === "")
+            continue;
+        selector[axis] = normalizeToken(axis, raw, describe);
+    }
+    return selector;
+}
+/** Validate and normalize a selector read off a published layer index. */
+export function normalizeSelector(value, describe = "layer selector") {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new ArtifactSelectorError(`${describe}: expected an object of selector axes.`);
+    }
+    const record = value;
+    const unknown = Object.keys(record).filter((k) => k !== "format" && !PLATFORM_AXES.includes(k));
+    if (unknown.length > 0) {
+        throw new ArtifactSelectorError(`${describe}: unknown selector ${unknown.length === 1 ? "axis" : "axes"} ` +
+            `${unknown.map((k) => `'${k}'`).join(", ")}. Known axes: format, ${PLATFORM_AXES.join(", ")}.`);
+    }
+    return selectorFromQualifiers(record.format, record, describe);
+}
+/**
+ * The canonical stable key for a selector: sorted `axis=value` pairs joined by
+ * `;`. Used to group entry points into layers at publish time and to detect two
+ * layers claiming the same selector. Sorted and fully qualified so no two
+ * distinct selectors can collide and no one selector has two spellings.
+ */
+export function selectorKey(selector) {
+    const pairs = [`format=${selector.format}`];
+    for (const axis of PLATFORM_AXES) {
+        const value = selector[axis];
+        if (value !== undefined)
+            pairs.push(`${axis}=${value}`);
+    }
+    return pairs.sort().join(";");
+}
+/** Human-facing rendering for diagnostics and the publish partition printout. */
+export function describeSelector(selector) {
+    const platform = PLATFORM_AXES.map((axis) => selector[axis]).filter((v) => v !== undefined);
+    return platform.length === 0 ? selector.format : `${selector.format} (${platform.join("/")})`;
+}
+/**
+ * The matching rule: every axis the selector states must equal the target's;
+ * every axis it omits accepts anything. A target axis left undetermined matches
+ * only a selector that does not constrain it — a host whose libc is unknown must
+ * not be handed a `libc=gnu` binary on the assumption it will run.
+ */
+export function selectorMatches(selector, target) {
+    if (target.format !== undefined && selector.format !== target.format)
+        return false;
+    for (const axis of PLATFORM_AXES) {
+        const constraint = selector[axis];
+        if (constraint === undefined)
+            continue;
+        if (target[axis] !== constraint)
+            return false;
+    }
+    return true;
+}

package/dist/builtins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AA4GvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EA+nB/C,CAAC"}
+{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AA2JvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EA0nB/C,CAAC"}

package/dist/builtins.js

@@ -20,6 +20,50 @@ const PROVENANCE_METADATA = {
     license: { type: "string" },
     documentation: { type: "string" },
 };
+/** Author-declared subset of `files:` that ships in the artifact's lazily
+ *  materialized `assets` layer. Optional: an unclaimed file joins the `common`
+ *  layer, which is pulled alongside any controller layer, so omitting this costs
+ *  laziness rather than correctness. See kernel/specs/module-artifact.md. */
+const ASSETS_FILES_SCHEMA = {
+    type: "array",
+    items: { type: "string" },
+};
+/** The published layer index, written by `telo publish` (never hand-authored).
+ *  One entry per layer except the manifest layer, which cannot list its own hash
+ *  inside itself and is pinned by the importer's `#sha256-...` instead. Shape and
+ *  matching rules are normative in kernel/specs/module-artifact.md; the parser
+ *  that enforces them is `artifact-layer-index.ts`. */
+const LAYER_INDEX_SCHEMA = {
+    type: "array",
+    items: {
+        type: "object",
+        required: ["role", "blob", "integrity"],
+        properties: {
+            role: { type: "string", enum: ["controller", "assets", "common"] },
+            selector: {
+                type: "object",
+                required: ["format"],
+                properties: {
+                    format: { type: "string" },
+                    os: { type: "string" },
+                    arch: { type: "string" },
+                    libc: { type: "string" },
+                },
+                additionalProperties: false,
+            },
+            blob: { type: "string", pattern: "^sha256:[0-9a-f]{64}$" },
+            integrity: { type: "string", pattern: "^sha256-[A-Za-z0-9_-]{43}$" },
+        },
+        additionalProperties: false,
+    },
+};
+/** The pre-layers payload digest, superseded by the per-layer `integrity` values
+ *  in `layers:`. Accepted and ignored, for one reason only: a module published in
+ *  the old single-blob shape must reach the *actionable* failure — the controller
+ *  loader's "republish the module" error — instead of dying earlier on
+ *  `must NOT have additional properties`, which tells an author nothing. Nothing
+ *  reads this field. */
+const LEGACY_FILES_INTEGRITY_SCHEMA = { type: "string" };
 /** The six named levels of `kernel/specs/logging.md` §5.1. The full 1–24 OTel
  *  range stays valid on the wire; only these are nameable in a manifest. */
 const LOG_LEVEL_ENUM = ["trace", "debug", "info", "warn", "error", "fatal"];
@@ -520,21 +564,18 @@ export const KERNEL_BUILTINS = [
                     type: "array",
                     items: { type: "string" },
                 },
-                // Files bundled alongside `telo.yaml` into the module's registry
-                // artifact (`module.tar.gz`) — static assets served by Http.Static,
-                // templates, etc. Ordered `.gitignore`-style patterns resolved against
-                // the manifest dir at publish time. Analyzer-only role: accept the
-                // field (the schema is additionalProperties:false); the analyzer never
-                // reads the assets. See kernel/nodejs/plans/bundle-controllers.md.
+                // Files bundled alongside `telo.yaml` into the module's artifact —
+                // controller bundles, static assets served by Http.Static, templates,
+                // etc. Ordered `.gitignore`-style patterns resolved against the manifest
+                // dir at publish time. Analyzer-only role: accept the field (the schema
+                // is additionalProperties:false); the analyzer never reads the payload.
                 files: {
                     type: "array",
                     items: { type: "string" },
                 },
-                // Integrity hash of the decompressed payload tar (`module.tar.gz`,
-                // telo.yaml excluded), written by `telo publish`. Pinned transitively
-                // by the importer's `#sha256-...` hash over this telo.yaml; verified at
-                // extract time. See plans/federated-registries.md.
-                filesIntegrity: { type: "string" },
+                assets: ASSETS_FILES_SCHEMA,
+                layers: LAYER_INDEX_SCHEMA,
+                filesIntegrity: LEGACY_FILES_INTEGRITY_SCHEMA,
                 // Inline imports — name-keyed map sugar for separate `Telo.Import`
                 // documents. The key is the PascalCase alias (the import's
                 // `metadata.name`). Each value is either a bare source string
@@ -671,18 +712,16 @@ export const KERNEL_BUILTINS = [
                     type: "array",
                     items: { type: "string" },
                 },
-                // Files bundled into the module's registry artifact — same semantics as
-                // the Telo.Application `files` field above (a library may ship bundled
-                // templates, migrations, seed data).
+                // Files bundled into the module's artifact — same semantics as the
+                // Telo.Application `files` field above (a library may ship bundled
+                // controllers, templates, migrations, seed data).
                 files: {
                     type: "array",
                     items: { type: "string" },
                 },
-                // Integrity hash of the decompressed payload tar (`module.tar.gz`,
-                // telo.yaml excluded), written by `telo publish`. Pinned transitively
-                // by the importer's `#sha256-...` hash over this telo.yaml; verified at
-                // extract time. See plans/federated-registries.md.
-                filesIntegrity: { type: "string" },
+                assets: ASSETS_FILES_SCHEMA,
+                layers: LAYER_INDEX_SCHEMA,
+                filesIntegrity: LEGACY_FILES_INTEGRITY_SCHEMA,
                 // Inline imports — same name-keyed map sugar as Telo.Application; the
                 // loader desugars each entry into a synthetic Telo.Import. See the
                 // Application schema above and analyzer/nodejs/src/inline-imports.ts.

package/dist/index.d.ts

@@ -44,6 +44,11 @@ export type { ParsedVersionedRef } from "./sources/versioned-ref.js";
 export { isLocalPathSource } from "./sources/local-path-ref.js";
 export { MANIFEST_CACHE_BASE_URL, ManifestCacheSource, isHttpsModuleRef, manifestCacheKey, manifestCacheUrl, ociManifestCacheCoords, urlManifestCacheCoords, } from "./sources/manifest-cache.js";
 export type { ManifestCacheCoords } from "./sources/manifest-cache.js";
+export { LAYER_ROLES, PLATFORM_AXES, ArtifactSelectorError, describeSelector, isLayerRole, normalizeSelector, selectorFromQualifiers, selectorKey, selectorMatches, } from "./artifact-selector.js";
+export type { ArtifactSelector, LayerRole, PlatformAxis, PlatformTarget, } from "./artifact-selector.js";
+export { LayerIndexError, matchControllerLayers, parseLayerIndex, singletonLayer, } from "./artifact-layer-index.js";
+export type { ArtifactLayer } from "./artifact-layer-index.js";
+export { validateModuleArtifact } from "./validate-module-artifact.js";
 export { withSyntheticPositions } from "./with-synthetic-positions.js";
 export { documentToAst, parseToAst } from "./yaml-ast.js";
 export type { AstDocument, AstMap, AstNode, AstPair, AstScalar, AstSeq } from "./yaml-ast.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACjF,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,iCAAiC,EACjC,wBAAwB,EACxB,iBAAiB,EACjB,iCAAiC,EACjC,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACxF,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACtF,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,qBAAqB,EACrB,qBAAqB,EACrB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC5F,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACnB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,aAAa,EACb,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC/E,YAAY,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC9F,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC5D,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACjF,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,iCAAiC,EACjC,wBAAwB,EACxB,iBAAiB,EACjB,iCAAiC,EACjC,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACxF,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACtF,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,qBAAqB,EACrB,qBAAqB,EACrB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC5F,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACnB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,aAAa,EACb,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC/E,YAAY,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EACL,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,sBAAsB,EACtB,WAAW,EACX,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,SAAS,EACT,YAAY,EACZ,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,eAAe,EACf,cAAc,GACf,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC9F,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC5D,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -26,6 +26,9 @@ export { OCI_SCHEME, isOciRef, parseOciRef } from "./sources/oci-ref.js";
 export { parseVersionedRef, withRefVersion } from "./sources/versioned-ref.js";
 export { isLocalPathSource } from "./sources/local-path-ref.js";
 export { MANIFEST_CACHE_BASE_URL, ManifestCacheSource, isHttpsModuleRef, manifestCacheKey, manifestCacheUrl, ociManifestCacheCoords, urlManifestCacheCoords, } from "./sources/manifest-cache.js";
+export { LAYER_ROLES, PLATFORM_AXES, ArtifactSelectorError, describeSelector, isLayerRole, normalizeSelector, selectorFromQualifiers, selectorKey, selectorMatches, } from "./artifact-selector.js";
+export { LayerIndexError, matchControllerLayers, parseLayerIndex, singletonLayer, } from "./artifact-layer-index.js";
+export { validateModuleArtifact } from "./validate-module-artifact.js";
 export { withSyntheticPositions } from "./with-synthetic-positions.js";
 export { documentToAst, parseToAst } from "./yaml-ast.js";
 export { buildCelSegments, wrapCelAst } from "./cel-ast.js";

package/dist/validate-module-artifact.d.ts

@@ -0,0 +1,27 @@
+import type { ResourceManifest } from "@telorun/sdk";
+import { type AnalysisDiagnostic } from "./types.js";
+/**
+ * Static validation of the module-artifact surface — `kernel/specs/module-artifact.md`.
+ *
+ * Everything here is decidable from the manifest text alone, and every case would
+ * otherwise surface on a *consumer's* machine at controller-resolve time (or, worse,
+ * not at all). That is the whole argument: an author who mistypes a platform axis
+ * gets a platform-neutral candidate, publish emits one layer, and every host
+ * happily loads a binary built for one architecture — silently, forever.
+ *
+ * Two checks. Note that several candidates *sharing* one selector is not among
+ * them: a controller layer holds the entry points of every candidate with that
+ * selector (spec §1), which is what every module with two `js` controllers relies
+ * on.
+ *
+ * 1. **Controller selector qualifiers.** `os` / `arch` / `libc` / `siblings` are
+ *    authored surface. An unknown qualifier is reported rather than ignored, since
+ *    ignoring is what makes a typo invisible; an invalid value is reported here
+ *    instead of throwing from the loader later.
+ * 2. **The published layer index.** The owner doc's JSON Schema covers shape; the
+ *    semantic rules — controller-requires-selector, singletons carry none, no
+ *    duplicate selector, the token grammar (`os: Linux` passes the schema and
+ *    throws at runtime) — live in the parser, so run it.
+ */
+export declare function validateModuleArtifact(manifests: ResourceManifest[]): AnalysisDiagnostic[];
+//# sourceMappingURL=validate-module-artifact.d.ts.map

package/dist/validate-module-artifact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-module-artifact.d.ts","sourceRoot":"","sources":["../src/validate-module-artifact.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAQrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,gBAAgB,EAAE,GAAG,kBAAkB,EAAE,CAO1F"}