@telorun/analyzer 0.50.0 → 0.52.0

package/src/sources/integrity.ts

@@ -11,6 +11,13 @@
  *  only algorithm accepted today; the prefix leaves room to migrate. */
 const INTEGRITY_FRAGMENT = /#(sha256-[A-Za-z0-9_+/=-]+)$/;
 
+/** The canonical written form: SHA-256 as unpadded base64url, exactly what
+ *  {@link sha256Base64Url} emits and what the `layers[].integrity` schema
+ *  accepts. Stricter than {@link INTEGRITY_FRAGMENT}, which also tolerates the
+ *  padded / standard-base64 spellings {@link verifyIntegrity} normalizes on the
+ *  way in — reading is forgiving, writing is not. */
+const CANONICAL_INTEGRITY = /^sha256-[A-Za-z0-9_-]{43}$/;
+
 /** A failed integrity/tamper check — always terminal, never best-effort. A
  *  distinct type so a caller doing best-effort network handling (e.g. the
  *  bundle extractor warning-and-skipping on a fetch blip) can still let a
@@ -41,6 +48,19 @@ export function foldIntegrity(source: string, integrity: unknown): string {
     : source;
 }
 
+/** True for a value safe to WRITE into a manifest as an integrity pin.
+ *
+ *  A pin arriving from outside the file — the hub's version index, a registry
+ *  response — is untrusted text before it is untrusted *content*: a value
+ *  carrying a quote, a `#`, or a newline corrupts the YAML it is spliced into,
+ *  which no later install-time verification can catch because the manifest no
+ *  longer parses. A wrong-but-well-formed hash is the case install *does*
+ *  catch; this is the case it cannot. Callers writing a pin they did not
+ *  compute check here first and fall back to writing none. */
+export function isCanonicalIntegrity(value: unknown): value is string {
+  return typeof value === "string" && CANONICAL_INTEGRITY.test(value);
+}
+
 function toBase64Url(bytes: Uint8Array): string {
   let binary = "";
   for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);

package/src/validate-cel-context.ts

@@ -325,11 +325,16 @@ export function resolveContextAnnotations(
       : [fromRefKindRaw];
   if (fromRoot || fromRefKinds.length > 0) {
     if (fromRoot) {
-      const resolved = navigatePath(manifestRoot, fromRoot.split("/")) as
+      const navigated = navigatePath(manifestRoot, fromRoot.split("/")) as
         | Record<string, any>
         | undefined;
-      if (resolved && typeof resolved === "object" && !Array.isArray(resolved)) {
-        return resolved;
+      if (navigated && typeof navigated === "object" && !Array.isArray(navigated)) {
+        // A `telo#Type` slot resolves to the schema it names — the inline
+        // `{ kind, schema }` wrapper, a `!ref` to a named type, or a bare name —
+        // so the variable is typed by the CONTRACT rather than by the wrapper
+        // around it. A raw JSON Schema resolves to itself, and a plain property
+        // map (a transport scope) resolves to nothing and is used verbatim.
+        return resolveTypeFieldToSchema(navigated, allManifests ?? []) ?? navigated;
       }
     }
     if (defs) {