npm - @telorun/analyzer - Versions diffs - 0.58.0 → 0.60.0 - Mend

@telorun/analyzer 0.58.0 → 0.60.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (89) hide show

package/dist/analyzer.d.ts +9 -2
package/dist/analyzer.d.ts.map +1 -1
package/dist/analyzer.js +38 -10
package/dist/builtins.d.ts.map +1 -1
package/dist/builtins.js +16 -42
package/dist/cel-environment.d.ts.map +1 -1
package/dist/cel-environment.js +35 -0
package/dist/flatten-for-analyzer.d.ts +4 -0
package/dist/flatten-for-analyzer.d.ts.map +1 -1
package/dist/flatten-for-analyzer.js +8 -0
package/dist/index.d.ts +6 -3
package/dist/index.d.ts.map +1 -1
package/dist/index.js +8 -2
package/dist/invocation-contract.d.ts +37 -0
package/dist/invocation-contract.d.ts.map +1 -1
package/dist/invocation-contract.js +81 -1
package/dist/kernel-globals.d.ts +1 -1
package/dist/kernel-globals.d.ts.map +1 -1
package/dist/kernel-globals.js +15 -1
package/dist/manifest-schemas.d.ts +407 -0
package/dist/manifest-schemas.d.ts.map +1 -0
package/dist/manifest-schemas.js +396 -0
package/dist/module-file-claims.d.ts +6 -0
package/dist/module-file-claims.d.ts.map +1 -1
package/dist/module-file-claims.js +4 -0
package/dist/module-metadata-scope.d.ts +44 -0
package/dist/module-metadata-scope.d.ts.map +1 -0
package/dist/module-metadata-scope.js +82 -0
package/dist/parse-loaded-file.d.ts.map +1 -1
package/dist/parse-loaded-file.js +16 -0
package/dist/release/bump-level.d.ts +46 -0
package/dist/release/bump-level.d.ts.map +1 -0
package/dist/release/bump-level.js +80 -0
package/dist/release/changelog.d.ts +36 -0
package/dist/release/changelog.d.ts.map +1 -0
package/dist/release/changelog.js +53 -0
package/dist/release/fragment.d.ts +48 -0
package/dist/release/fragment.d.ts.map +1 -0
package/dist/release/fragment.js +84 -0
package/dist/release/index.d.ts +26 -0
package/dist/release/index.d.ts.map +1 -0
package/dist/release/index.js +18 -0
package/dist/release/ledger.d.ts +53 -0
package/dist/release/ledger.d.ts.map +1 -0
package/dist/release/ledger.js +109 -0
package/dist/release/payload-digest.d.ts +63 -0
package/dist/release/payload-digest.d.ts.map +1 -0
package/dist/release/payload-digest.js +65 -0
package/dist/release/release-plan.d.ts +128 -0
package/dist/release/release-plan.d.ts.map +1 -0
package/dist/release/release-plan.js +277 -0
package/dist/release/version-stamp.d.ts +50 -0
package/dist/release/version-stamp.d.ts.map +1 -0
package/dist/release/version-stamp.js +119 -0
package/dist/release/workspace-config.d.ts +41 -0
package/dist/release/workspace-config.d.ts.map +1 -0
package/dist/release/workspace-config.js +60 -0
package/dist/schema-compat.d.ts +18 -0
package/dist/schema-compat.d.ts.map +1 -1
package/dist/schema-compat.js +71 -7
package/dist/validate-cel-context.d.ts.map +1 -1
package/dist/validate-cel-context.js +69 -13
package/dist/validate-step-inputs.d.ts +1 -1
package/dist/validate-step-inputs.d.ts.map +1 -1
package/dist/validate-step-inputs.js +99 -8
package/package.json +3 -3
package/src/analyzer.ts +41 -10
package/src/builtins.ts +16 -42
package/src/cel-environment.ts +37 -0
package/src/flatten-for-analyzer.ts +12 -0
package/src/index.ts +18 -3
package/src/invocation-contract.ts +92 -1
package/src/kernel-globals.ts +23 -1
package/src/manifest-schemas.ts +408 -0
package/src/module-file-claims.ts +10 -0
package/src/module-metadata-scope.ts +88 -0
package/src/parse-loaded-file.ts +16 -0
package/src/release/bump-level.ts +95 -0
package/src/release/changelog.ts +62 -0
package/src/release/fragment.ts +130 -0
package/src/release/index.ts +66 -0
package/src/release/ledger.ts +142 -0
package/src/release/payload-digest.ts +83 -0
package/src/release/release-plan.ts +392 -0
package/src/release/version-stamp.ts +142 -0
package/src/release/workspace-config.ts +81 -0
package/src/schema-compat.ts +69 -5
package/src/validate-cel-context.ts +82 -13
package/src/validate-step-inputs.ts +109 -9

package/dist/release/bump-level.js ADDED Viewed

@@ -0,0 +1,80 @@
+/**
+ * The two vocabularies a release speaks, and the arithmetic between them.
+ *
+ * A **kind** is what an author writes in a fragment (`Added`, `Fixed`, …). It is
+ * changie's vocabulary, kept because it drives two things at once: the semantic
+ * level of the bump, and the heading the entry lands under in the changelog. A
+ * **level** is what the version arithmetic consumes.
+ *
+ * The mapping is the only place the two meet, and it is deliberately total: an
+ * unrecognized kind is refused rather than defaulted, because a typo that
+ * degraded to `patch` would silently under-release a breaking change.
+ */
+/** Ordering used whenever several levels reach one module — the maximum wins,
+ *  because a module that inlines a breaking change is breaking for its own
+ *  consumers. */
+const LEVEL_RANK = { patch: 0, minor: 1, major: 2 };
+export function maxLevel(a, b) {
+    return LEVEL_RANK[a] >= LEVEL_RANK[b] ? a : b;
+}
+/**
+ * Fragment kinds, in changelog section order, each with the level it induces.
+ *
+ * `Changed` / `Removed` induce `major`, which the pre-1.0 guard then rejects —
+ * they are kept in the vocabulary rather than dropped so the rejection can name
+ * what was written and say why, instead of reporting an unknown kind.
+ */
+export const FRAGMENT_KINDS = {
+    Added: "minor",
+    Changed: "major",
+    Deprecated: "minor",
+    Removed: "major",
+    Fixed: "patch",
+    Security: "patch",
+};
+/** Declaration order, which is also the order sections appear in a changelog
+ *  release block. */
+export const FRAGMENT_KIND_ORDER = Object.keys(FRAGMENT_KINDS);
+export function isFragmentKind(value) {
+    return typeof value === "string" && value in FRAGMENT_KINDS;
+}
+export function levelOfKind(kind) {
+    return FRAGMENT_KINDS[kind];
+}
+/** A `major.minor.patch` triple. Pre-release and build metadata are not accepted:
+ *  a module version is the tag an artifact publishes under and the value a pin
+ *  resolves, and neither has a meaning for a suffix today. */
+const VERSION = /^(\d+)\.(\d+)\.(\d+)$/;
+export function isReleaseVersion(value) {
+    return typeof value === "string" && VERSION.test(value);
+}
+/** Apply `level` to `version`. Throws on a version this system cannot represent,
+ *  rather than returning something plausible — every caller has already read the
+ *  value out of a manifest it is about to rewrite. */
+export function applyBump(version, level) {
+    const match = VERSION.exec(version);
+    if (!match) {
+        throw new Error(`'${version}' is not a major.minor.patch version, so no ${level} bump can be derived from it.`);
+    }
+    const [major, minor, patch] = match.slice(1, 4).map(Number);
+    if (level === "major")
+        return `${major + 1}.0.0`;
+    if (level === "minor")
+        return `${major}.${minor + 1}.0`;
+    return `${major}.${minor}.${patch + 1}`;
+}
+/** Numeric comparison, so `0.10.0` sorts after `0.9.0`. Returns a negative
+ *  number when `a` precedes `b`. An unparseable version sorts last rather than
+ *  throwing — this is used for display ordering, not for decisions. */
+export function compareVersions(a, b) {
+    const pa = VERSION.exec(a);
+    const pb = VERSION.exec(b);
+    if (!pa || !pb)
+        return pa ? -1 : pb ? 1 : a.localeCompare(b);
+    for (let i = 1; i <= 3; i++) {
+        const diff = Number(pa[i]) - Number(pb[i]);
+        if (diff !== 0)
+            return diff;
+    }
+    return 0;
+}

package/dist/release/changelog.d.ts ADDED Viewed

@@ -0,0 +1,36 @@
+/**
+ * Rendering a module's `CHANGELOG.md` entry, and splicing it into the file.
+ *
+ * The output shape is the one changie was configured to emit — `## <version> -
+ * <date>`, `### <Kind>`, `* <body>` — so a module's history stays one document
+ * across the handover rather than changing format mid-file.
+ *
+ * Prepending rather than rewriting: a changelog is append-only history, and the
+ * only edit ever made to it is inserting the newest release above the previous
+ * one. Everything already written is untouched bytes.
+ */
+import { type FragmentKind } from "./bump-level.js";
+export declare const CHANGELOG_HEADER = "# Changelog";
+export interface ChangelogRelease {
+    readonly version: string;
+    /** `YYYY-MM-DD`. Passed in rather than read from a clock, so a plan renders
+     *  identically whenever it is rendered and a test needs no clock control. */
+    readonly date: string;
+    readonly entries: readonly {
+        readonly kind: FragmentKind;
+        readonly body: string;
+    }[];
+}
+/** One release block. Entries group under their kind, in the vocabulary's own
+ *  order, so two releases never disagree about where `Fixed` sits. */
+export declare function renderChangelogRelease(release: ChangelogRelease): string;
+/**
+ * Insert a release block below the file's `# Changelog` header, creating the
+ * file's skeleton when it has none.
+ *
+ * A module with no changelog yet is the ordinary case for a new module, so this
+ * writes the header rather than failing — the alternative is a release that
+ * stops to ask for an empty file to be created by hand.
+ */
+export declare function prependChangelogRelease(existing: string | undefined, block: string): string;
+//# sourceMappingURL=changelog.d.ts.map

package/dist/release/changelog.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"changelog.d.ts","sourceRoot":"","sources":["../../src/release/changelog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEzE,eAAO,MAAM,gBAAgB,gBAAgB,CAAC;AAE9C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;iFAC6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACrF;AAED;sEACsE;AACtE,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAgBxE;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAS3F"}

package/dist/release/changelog.js ADDED Viewed

@@ -0,0 +1,53 @@
+/**
+ * Rendering a module's `CHANGELOG.md` entry, and splicing it into the file.
+ *
+ * The output shape is the one changie was configured to emit — `## <version> -
+ * <date>`, `### <Kind>`, `* <body>` — so a module's history stays one document
+ * across the handover rather than changing format mid-file.
+ *
+ * Prepending rather than rewriting: a changelog is append-only history, and the
+ * only edit ever made to it is inserting the newest release above the previous
+ * one. Everything already written is untouched bytes.
+ */
+import { FRAGMENT_KIND_ORDER } from "./bump-level.js";
+export const CHANGELOG_HEADER = "# Changelog";
+/** One release block. Entries group under their kind, in the vocabulary's own
+ *  order, so two releases never disagree about where `Fixed` sits. */
+export function renderChangelogRelease(release) {
+    const byKind = new Map();
+    for (const entry of release.entries) {
+        const list = byKind.get(entry.kind);
+        if (list)
+            list.push(entry.body);
+        else
+            byKind.set(entry.kind, [entry.body]);
+    }
+    const lines = [`## ${release.version} - ${release.date}`];
+    for (const kind of FRAGMENT_KIND_ORDER) {
+        const bodies = byKind.get(kind);
+        if (!bodies)
+            continue;
+        lines.push(`### ${kind}`);
+        for (const body of bodies)
+            lines.push(`* ${body}`);
+    }
+    return lines.join("\n") + "\n";
+}
+/**
+ * Insert a release block below the file's `# Changelog` header, creating the
+ * file's skeleton when it has none.
+ *
+ * A module with no changelog yet is the ordinary case for a new module, so this
+ * writes the header rather than failing — the alternative is a release that
+ * stops to ask for an empty file to be created by hand.
+ */
+export function prependChangelogRelease(existing, block) {
+    const text = existing ?? "";
+    const header = text.match(/^#\s+Changelog[^\n]*\n/);
+    if (!header) {
+        const rest = text.trim();
+        return `${CHANGELOG_HEADER}\n\n${block}${rest ? `\n${rest}\n` : ""}`;
+    }
+    const after = text.slice(header[0].length).replace(/^\n+/, "");
+    return `${header[0]}\n${block}${after ? `\n${after}` : ""}`;
+}

package/dist/release/fragment.d.ts ADDED Viewed

@@ -0,0 +1,48 @@
+/**
+ * A release fragment — one pending change, written by an author.
+ *
+ * The shape is changesets' (one file, several modules, one body) carrying
+ * changie's kind vocabulary, which is what lets one cross-cutting change be one
+ * file while the kind still drives both the level and the changelog section a
+ * line lands under. Changie's own file is the other arrangement — one module per
+ * file — so a change touching five modules meant five files repeating one
+ * sentence, and its key was the module's bare directory NAME, which two
+ * directories in different subtrees can share.
+ *
+ * A fragment names modules by **workspace-relative path**, the same key the
+ * ledger and every diagnostic use.
+ *
+ * They are plain YAML validated here, not a `Telo.*` kind: build-time repo state
+ * with no controller and no capability, which the runtime never loads.
+ */
+import { type FragmentKind } from "./bump-level.js";
+/** A module's workspace-relative directory path — `modules/sql`, `apps/hub`. */
+export type ModuleKey = string;
+export interface ReleaseFragment {
+    /**
+     * Where this fragment was read from, workspace-relative. Carried so a
+     * diagnostic can name the file to fix and `apply` can delete the file it
+     * consumed.
+     */
+    readonly source: string;
+    /** The directly-changed modules this fragment declares, each with its kind. */
+    readonly modules: ReadonlyMap<ModuleKey, FragmentKind>;
+    /** The changelog line. */
+    readonly body: string;
+}
+export declare class FragmentError extends Error {
+    readonly source: string;
+    constructor(source: string, message: string);
+}
+export declare function parseFragment(text: string, source: string): ReleaseFragment;
+/**
+ * Render a fragment, for `telo release add`.
+ *
+ * Serialized rather than templated so a long body folds the way the YAML writer
+ * folds it, and so a module path needing quotes gets them.
+ */
+export declare function serializeFragment(modules: ReadonlyMap<ModuleKey, FragmentKind>, body: string): string;
+/** Module keys are POSIX-separated and carry no leading `./` or trailing slash,
+ *  so the same directory written three ways is one key. */
+export declare function normalizeModuleKey(key: string): ModuleKey;
+//# sourceMappingURL=fragment.d.ts.map

package/dist/release/fragment.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"fragment.d.ts","sourceRoot":"","sources":["../../src/release/fragment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEpE,gFAAgF;AAChF,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC;AAE/B,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACvD,0BAA0B;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,aAAc,SAAQ,KAAK;IAEpC,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM;CAIlB;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe,CA4D3E;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE,YAAY,CAAC,EAC7C,IAAI,EAAE,MAAM,GACX,MAAM,CAMR;AAED;2DAC2D;AAC3D,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAEzD"}

package/dist/release/fragment.js ADDED Viewed

@@ -0,0 +1,84 @@
+/**
+ * A release fragment — one pending change, written by an author.
+ *
+ * The shape is changesets' (one file, several modules, one body) carrying
+ * changie's kind vocabulary, which is what lets one cross-cutting change be one
+ * file while the kind still drives both the level and the changelog section a
+ * line lands under. Changie's own file is the other arrangement — one module per
+ * file — so a change touching five modules meant five files repeating one
+ * sentence, and its key was the module's bare directory NAME, which two
+ * directories in different subtrees can share.
+ *
+ * A fragment names modules by **workspace-relative path**, the same key the
+ * ledger and every diagnostic use.
+ *
+ * They are plain YAML validated here, not a `Telo.*` kind: build-time repo state
+ * with no controller and no capability, which the runtime never loads.
+ */
+import { Document, parseDocument } from "yaml";
+import { isFragmentKind } from "./bump-level.js";
+export class FragmentError extends Error {
+    source;
+    constructor(source, message) {
+        super(message);
+        this.source = source;
+    }
+}
+export function parseFragment(text, source) {
+    let value;
+    try {
+        value = parseDocument(text).toJSON();
+    }
+    catch (err) {
+        throw new FragmentError(source, `${source} is not valid YAML: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        throw new FragmentError(source, `${source} must be a YAML mapping.`);
+    }
+    const record = value;
+    for (const key of Object.keys(record)) {
+        if (key !== "modules" && key !== "body") {
+            throw new FragmentError(source, `${source}: unknown field '${key}'. A fragment carries 'modules:' and 'body:'.`);
+        }
+    }
+    const rawModules = record.modules;
+    if (rawModules === null || typeof rawModules !== "object" || Array.isArray(rawModules)) {
+        throw new FragmentError(source, `${source}: 'modules' must be a mapping of module path to kind, ` +
+            `e.g. { modules/sql: Fixed }.`);
+    }
+    const modules = new Map();
+    for (const [key, kind] of Object.entries(rawModules)) {
+        if (!isFragmentKind(kind)) {
+            throw new FragmentError(source, `${source}: '${key}' declares kind '${String(kind)}', which is not a release kind. ` +
+                `Use Added, Changed, Deprecated, Removed, Fixed or Security.`);
+        }
+        modules.set(normalizeModuleKey(key), kind);
+    }
+    if (modules.size === 0) {
+        throw new FragmentError(source, `${source}: 'modules' is empty, so this fragment releases nothing. ` +
+            `Name at least one module by its workspace-relative path.`);
+    }
+    const body = record.body;
+    if (typeof body !== "string" || body.trim() === "") {
+        throw new FragmentError(source, `${source}: 'body' must be the changelog line for this change.`);
+    }
+    return { source, modules, body: body.trim() };
+}
+/**
+ * Render a fragment, for `telo release add`.
+ *
+ * Serialized rather than templated so a long body folds the way the YAML writer
+ * folds it, and so a module path needing quotes gets them.
+ */
+export function serializeFragment(modules, body) {
+    const doc = new Document({
+        modules: Object.fromEntries([...modules].map(([key, kind]) => [key, kind])),
+        body,
+    });
+    return doc.toString({ lineWidth: 88 });
+}
+/** Module keys are POSIX-separated and carry no leading `./` or trailing slash,
+ *  so the same directory written three ways is one key. */
+export function normalizeModuleKey(key) {
+    return key.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "");
+}

package/dist/release/index.d.ts ADDED Viewed

@@ -0,0 +1,26 @@
+/**
+ * The release model: module identity, fragments, the ledger, the edge graph,
+ * level propagation and version planning.
+ *
+ * Browser-safe by construction — pure data in, plan out — so the telo editor can
+ * answer "what does changing this library bump?" from the same model the CLI
+ * releases from. Everything Node-shaped (finding the workspace, running the
+ * controller builder, building payloads, reading git, writing files) is
+ * `cli/nodejs/src/release/`.
+ */
+export { FRAGMENT_KINDS, FRAGMENT_KIND_ORDER, applyBump, compareVersions, isFragmentKind, isReleaseVersion, levelOfKind, maxLevel, } from "./bump-level.js";
+export type { BumpLevel, FragmentKind } from "./bump-level.js";
+export { CHANGELOG_HEADER, prependChangelogRelease, renderChangelogRelease, } from "./changelog.js";
+export type { ChangelogRelease } from "./changelog.js";
+export { FragmentError, normalizeModuleKey, parseFragment, serializeFragment } from "./fragment.js";
+export type { ModuleKey, ReleaseFragment } from "./fragment.js";
+export { EMPTY_LEDGER, LEDGER_PATH, LedgerError, parseLedger, serializeLedger } from "./ledger.js";
+export type { Ledger, LedgerEntry } from "./ledger.js";
+export { LOCALLY_DERIVED_LAYERS, MANIFEST_LAYER, diffLayerDigests, layerDigestKey, } from "./payload-digest.js";
+export type { LayerChange, LayerDigests } from "./payload-digest.js";
+export { orderByImports, planRelease } from "./release-plan.js";
+export type { ArtifactKind, BumpReason, ChangelogEntry, ModuleEvidence, PlannedModule, ReleaseDiagnostic, ReleaseEvidence, ReleasePlan, } from "./release-plan.js";
+export { VersionStampError, readManifestVersion, stampCrateVersion, stampManifestVersion, stampPackageVersion, } from "./version-stamp.js";
+export { WORKSPACE_FILENAME, WorkspaceConfigError, parseWorkspaceConfig } from "./workspace-config.js";
+export type { WorkspaceConfig } from "./workspace-config.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/release/index.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/release/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,SAAS,EACT,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,QAAQ,GACT,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/D,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACpG,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnG,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,gBAAgB,EAChB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAErE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChE,YAAY,EACV,YAAY,EACZ,UAAU,EACV,cAAc,EACd,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,WAAW,GACZ,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AACvG,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/release/index.js ADDED Viewed

@@ -0,0 +1,18 @@
+/**
+ * The release model: module identity, fragments, the ledger, the edge graph,
+ * level propagation and version planning.
+ *
+ * Browser-safe by construction — pure data in, plan out — so the telo editor can
+ * answer "what does changing this library bump?" from the same model the CLI
+ * releases from. Everything Node-shaped (finding the workspace, running the
+ * controller builder, building payloads, reading git, writing files) is
+ * `cli/nodejs/src/release/`.
+ */
+export { FRAGMENT_KINDS, FRAGMENT_KIND_ORDER, applyBump, compareVersions, isFragmentKind, isReleaseVersion, levelOfKind, maxLevel, } from "./bump-level.js";
+export { CHANGELOG_HEADER, prependChangelogRelease, renderChangelogRelease, } from "./changelog.js";
+export { FragmentError, normalizeModuleKey, parseFragment, serializeFragment } from "./fragment.js";
+export { EMPTY_LEDGER, LEDGER_PATH, LedgerError, parseLedger, serializeLedger } from "./ledger.js";
+export { LOCALLY_DERIVED_LAYERS, MANIFEST_LAYER, diffLayerDigests, layerDigestKey, } from "./payload-digest.js";
+export { orderByImports, planRelease } from "./release-plan.js";
+export { VersionStampError, readManifestVersion, stampCrateVersion, stampManifestVersion, stampPackageVersion, } from "./version-stamp.js";
+export { WORKSPACE_FILENAME, WorkspaceConfigError, parseWorkspaceConfig } from "./workspace-config.js";

package/dist/release/ledger.d.ts ADDED Viewed

@@ -0,0 +1,53 @@
+/**
+ * `.changes/ledger.yaml` — what each module looks like **as published**.
+ *
+ * It exists so a gate can answer "does my payload differ from what is published
+ * at my current version?" with no network call, no merge base and no
+ * credentials: a fork's PR runs the identical computation the release job runs.
+ * That is the load-bearing property — the PR gate and the publish gate compute
+ * the same number.
+ *
+ * **It is a cache, never the authority.** A committed digest can disagree with
+ * the registry — a hand edit, an `apply` whose publish then failed, a push made
+ * outside the pipeline — so `telo publish` still reads the registry, and
+ * `telo release verify` reconciles the two on demand. A *missing* entry is not
+ * drift: it means nothing is published, which is the correct reading for a
+ * module that has never shipped.
+ *
+ * **It records the registry base**, because canonicalizing a relative `imports:`
+ * source writes the destination into the manifest layer — so the digests below
+ * are digests *against that base*, and comparing them to digests taken against
+ * another one would be comparing two different artifacts.
+ */
+import { type ModuleKey } from "./fragment.js";
+import type { LayerDigests } from "./payload-digest.js";
+export declare const LEDGER_PATH = ".changes/ledger.yaml";
+export interface LedgerEntry {
+    /** The version these digests were taken at — the tag the artifact published
+     *  under. */
+    readonly version: string;
+    readonly layers: LayerDigests;
+}
+export interface Ledger {
+    /**
+     * The publish destination base the digests were taken against
+     * (`oci://ghcr.io/telorun`). Absent in a workspace that has published nothing
+     * yet, which is why it is optional rather than required — but a `check` that
+     * has entries and no base cannot reproduce them, and says so.
+     */
+    readonly registry?: string;
+    readonly modules: ReadonlyMap<ModuleKey, LedgerEntry>;
+}
+export declare class LedgerError extends Error {
+}
+export declare const EMPTY_LEDGER: Ledger;
+export declare function parseLedger(text: string, where: string): Ledger;
+/**
+ * Render the ledger.
+ *
+ * Keys are sorted so a release's ledger diff shows only the modules that moved
+ * — the file is committed and reviewed, and a map whose order followed insertion
+ * would reorder wholesale on every run.
+ */
+export declare function serializeLedger(ledger: Ledger): string;
+//# sourceMappingURL=ledger.d.ts.map

package/dist/release/ledger.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"ledger.d.ts","sourceRoot":"","sources":["../../src/release/ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,eAAO,MAAM,WAAW,yBAAyB,CAAC;AAElD,MAAM,WAAW,WAAW;IAC1B;iBACa;IACb,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;CAC/B;AAED,MAAM,WAAW,MAAM;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;CACvD;AAED,qBAAa,WAAY,SAAQ,KAAK;CAAG;AAEzC,eAAO,MAAM,YAAY,EAAE,MAA+B,CAAC;AAE3D,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CA+D/D;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAkBtD"}

package/dist/release/ledger.js ADDED Viewed

@@ -0,0 +1,109 @@
+/**
+ * `.changes/ledger.yaml` — what each module looks like **as published**.
+ *
+ * It exists so a gate can answer "does my payload differ from what is published
+ * at my current version?" with no network call, no merge base and no
+ * credentials: a fork's PR runs the identical computation the release job runs.
+ * That is the load-bearing property — the PR gate and the publish gate compute
+ * the same number.
+ *
+ * **It is a cache, never the authority.** A committed digest can disagree with
+ * the registry — a hand edit, an `apply` whose publish then failed, a push made
+ * outside the pipeline — so `telo publish` still reads the registry, and
+ * `telo release verify` reconciles the two on demand. A *missing* entry is not
+ * drift: it means nothing is published, which is the correct reading for a
+ * module that has never shipped.
+ *
+ * **It records the registry base**, because canonicalizing a relative `imports:`
+ * source writes the destination into the manifest layer — so the digests below
+ * are digests *against that base*, and comparing them to digests taken against
+ * another one would be comparing two different artifacts.
+ */
+import { Document, parseDocument } from "yaml";
+import { isReleaseVersion } from "./bump-level.js";
+import { normalizeModuleKey } from "./fragment.js";
+export const LEDGER_PATH = ".changes/ledger.yaml";
+export class LedgerError extends Error {
+}
+export const EMPTY_LEDGER = { modules: new Map() };
+export function parseLedger(text, where) {
+    let value;
+    try {
+        value = parseDocument(text).toJSON();
+    }
+    catch (err) {
+        throw new LedgerError(`${where} is not valid YAML: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (value === null)
+        return EMPTY_LEDGER;
+    if (typeof value !== "object" || Array.isArray(value)) {
+        throw new LedgerError(`${where} must be a YAML mapping.`);
+    }
+    const record = value;
+    for (const key of Object.keys(record)) {
+        if (key !== "registry" && key !== "modules") {
+            throw new LedgerError(`${where}: unknown field '${key}'. The ledger carries 'registry:' and 'modules:'.`);
+        }
+    }
+    const registry = record.registry;
+    if (registry !== undefined && typeof registry !== "string") {
+        throw new LedgerError(`${where}: 'registry' must be the publish destination base, as a string.`);
+    }
+    const rawModules = record.modules;
+    if (rawModules === undefined || rawModules === null)
+        return { ...(registry ? { registry } : {}), modules: new Map() };
+    if (typeof rawModules !== "object" || Array.isArray(rawModules)) {
+        throw new LedgerError(`${where}: 'modules' must be a mapping of module path to entry.`);
+    }
+    const modules = new Map();
+    for (const [key, raw] of Object.entries(rawModules)) {
+        if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+            throw new LedgerError(`${where}: entry '${key}' must be a mapping.`);
+        }
+        const entry = raw;
+        if (!isReleaseVersion(entry.version)) {
+            throw new LedgerError(`${where}: entry '${key}' has no major.minor.patch 'version'. The ledger records the ` +
+                `version each digest was taken at; without it the digest says nothing.`);
+        }
+        const layers = {};
+        const rawLayers = entry.layers;
+        if (rawLayers !== undefined && rawLayers !== null) {
+            if (typeof rawLayers !== "object" || Array.isArray(rawLayers)) {
+                throw new LedgerError(`${where}: entry '${key}' has a non-mapping 'layers'.`);
+            }
+            for (const [layer, digest] of Object.entries(rawLayers)) {
+                if (typeof digest !== "string") {
+                    throw new LedgerError(`${where}: entry '${key}' layer '${layer}' is not a digest string.`);
+                }
+                layers[layer] = digest;
+            }
+        }
+        modules.set(normalizeModuleKey(key), { version: entry.version, layers });
+    }
+    return { ...(registry ? { registry } : {}), modules };
+}
+/**
+ * Render the ledger.
+ *
+ * Keys are sorted so a release's ledger diff shows only the modules that moved
+ * — the file is committed and reviewed, and a map whose order followed insertion
+ * would reorder wholesale on every run.
+ */
+export function serializeLedger(ledger) {
+    const modules = {};
+    for (const key of [...ledger.modules.keys()].sort()) {
+        const entry = ledger.modules.get(key);
+        const layers = {};
+        for (const layer of Object.keys(entry.layers).sort())
+            layers[layer] = entry.layers[layer];
+        modules[key] = { version: entry.version, layers };
+    }
+    const doc = new Document({
+        ...(ledger.registry ? { registry: ledger.registry } : {}),
+        modules,
+    });
+    return ("# Generated by `telo release apply` — what each module looks like as published.\n" +
+        "# A cache of the registry's answer, so a PR gate needs no credentials.\n" +
+        "# `telo release verify` reconciles it against the registry.\n" +
+        doc.toString({ lineWidth: 0 }));
+}

package/dist/release/payload-digest.d.ts ADDED Viewed

@@ -0,0 +1,63 @@
+/**
+ * A module's payload, reduced to one digest per layer — the exact answer to
+ * "did this module's artifact change?".
+ *
+ * It is exact because it is taken from the bytes: it fires for an inlined
+ * sibling's edit, for a shared-library fix, and for a transitive bump the
+ * lockfile alone moved, none of which touch a file under the module's own
+ * directory. No path-scoped rule and no declared-dependency graph can see any of
+ * them.
+ *
+ * The digest itself is `computeFilesIntegrity`, the same framing-independent
+ * content digest the published `layers:` index carries — which is what makes the
+ * ledger's recorded number and the registry's the same number, comparable
+ * without fetching a blob.
+ */
+import { type ArtifactSelector, type LayerRole } from "../artifact-selector.js";
+/** Per-layer integrity, keyed by `layerDigestKey`. */
+export type LayerDigests = Readonly<Record<string, string>>;
+/** The ledger key for the module's `telo.yaml` layer. */
+export declare const MANIFEST_LAYER = "manifest";
+/**
+ * Ledger keys the registry cannot answer for, and so the ones `telo release
+ * verify` reconciles nothing about and must preserve.
+ *
+ * Exactly one today, and for a structural reason rather than an omission: the
+ * published `layers:` index lives *inside* `telo.yaml`, so it cannot carry that
+ * file's own digest — the entry would have to be computed over bytes containing
+ * it. Nor can the digest be recovered by hashing what the registry serves, since
+ * the transport injects the index at push time and the published text is
+ * therefore not the text the payload builder produced.
+ *
+ * It stays in the ledger regardless, because it is the only thing that sees a
+ * **manifest-only change**: a schema edit, a new kind, a description, a
+ * dependency's version moving into a pin. None of those touch a controller byte,
+ * so without this key such a module would report no drift and its fix would ship
+ * to nobody — the exact failure the digest exists to prevent.
+ */
+export declare const LOCALLY_DERIVED_LAYERS: ReadonlySet<string>;
+/**
+ * A layer's identity within an artifact, as a stable, readable, YAML-plain key.
+ *
+ * A role alone is not the identity — there is one controller layer per selector
+ * — so a selector's axes join the key. Rendered as `controller/js` and
+ * `controller/napi+linux+amd64+gnu` rather than through `selectorKey`'s
+ * `axis=value;…` form, because this string is read by a human in a ledger diff
+ * and written into a plain YAML key; the axis order is `PLATFORM_AXES`, so the
+ * rendering is deterministic rather than dependent on how the selector was
+ * built.
+ */
+export declare function layerDigestKey(role: LayerRole | string, selector?: ArtifactSelector): string;
+/** A layer whose digest differs between two readings, or that exists in only
+ *  one of them. `before` / `after` are absent when the layer is absent there —
+ *  a payload that gained or lost a layer changed just as much as one whose
+ *  bytes moved. */
+export interface LayerChange {
+    readonly layer: string;
+    readonly before?: string;
+    readonly after?: string;
+}
+/** Every layer on which two readings disagree, in key order. Empty means the
+ *  payloads are byte-identical. */
+export declare function diffLayerDigests(before: LayerDigests, after: LayerDigests): LayerChange[];
+//# sourceMappingURL=payload-digest.d.ts.map

package/dist/release/payload-digest.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"payload-digest.d.ts","sourceRoot":"","sources":["../../src/release/payload-digest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAiB,KAAK,gBAAgB,EAAE,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAE/F,sDAAsD;AACtD,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAE5D,yDAAyD;AACzD,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAA6B,CAAC;AAErF;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,EAAE,QAAQ,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAM5F;AAED;;;mBAGmB;AACnB,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;mCACmC;AACnC,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,GAAG,WAAW,EAAE,CAQzF"}