@telorun/analyzer 0.71.0 → 0.73.0

package/dist/ref-slot.js

@@ -166,6 +166,7 @@ export function readRefSlot(node) {
     const uses = new Set();
     let useCases;
     let inputs;
+    let throwsThrough = false;
     for (const carrier of nodes) {
         const annotation = carrier["x-telo-ref"];
         for (const kind of readKinds(annotation)) {
@@ -180,6 +181,8 @@ export function readRefSlot(node) {
         useCases ??= readUseCases(obj.use);
         if (typeof obj.inputs === "string")
             inputs ??= obj.inputs;
+        if (obj.throwsThrough === true)
+            throwsThrough = true;
     }
     const slot = {
         kinds,
@@ -191,6 +194,8 @@ export function readRefSlot(node) {
         slot.useCases = useCases;
     if (inputs !== undefined)
         slot.inputs = inputs;
+    if (throwsThrough)
+        slot.throwsThrough = true;
     return slot;
 }
 /** True when the node declares a reference slot in any accepted shape. The
@@ -218,6 +223,8 @@ export function refSlotAnnotation(slot) {
         annotation.use = slot.uses;
     if (slot.inputs !== undefined)
         annotation.inputs = slot.inputs;
+    if (slot.throwsThrough)
+        annotation.throwsThrough = true;
     return annotation;
 }
 /**

package/dist/release/destinations.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Where each module publishes, and the two ways a set of destinations can be
+ * inconsistent.
+ *
+ * A destination is the module's resolved registry base plus its own directory
+ * name. That rule held silently for as long as every module sat at one depth
+ * under one base with a unique directory name; per-subtree bases remove that
+ * coincidence, so both failures it was hiding become reachable and are checked
+ * here — **at plan time, before any payload is built**, because the payload
+ * builder's own refusal speaks about a manifest published to two places rather
+ * than about the workspace file that said so.
+ *
+ * Pure data in, diagnostics out: the destinations are already computed for
+ * `telo release order`, so one derivation feeds that payload and both checks.
+ */
+import type { ModuleKey } from "./fragment.js";
+import type { ReleaseDiagnostic } from "./release-plan.js";
+export interface ModuleDestination {
+    readonly key: ModuleKey;
+    /** `<registry>/<the module's own directory name>`. */
+    readonly destination: string;
+}
+/**
+ * A relative import between two workspace modules, with both answers about
+ * where the target publishes.
+ *
+ * `derived` is what the importer's own destination yields when the import path
+ * is applied to it — the transport's rule, and what ref canonicalization writes
+ * into the published manifest. `assigned` is what discovery independently gives
+ * that module.
+ */
+export interface ImportDestination {
+    readonly from: ModuleKey;
+    readonly to: ModuleKey;
+    readonly derived: string;
+    readonly assigned: string;
+}
+/**
+ * Two modules must not resolve to one ref.
+ *
+ * Nothing else catches it: the payload builder is keyed by manifest, so it sees
+ * one module claimed by two destinations and never two modules claiming one,
+ * while the ledger keys by module — both entries would record digests for a
+ * single published artifact and reconciliation could never settle.
+ */
+export declare function checkDestinationCollisions(destinations: readonly ModuleDestination[]): ReleaseDiagnostic[];
+/**
+ * A relative import is valid only where the importer's derived ref for its
+ * target equals the destination that module is independently assigned.
+ *
+ * Equal registries are necessary and not sufficient — two modules under one base
+ * at different directory depths derive differently too. Making the builder take
+ * the assigned destination instead is not the fix: it would put a ref in the
+ * artifact that the transport's resolution rule does not produce, so the
+ * manifest would say one thing and every consumer resolving relatively would
+ * compute another.
+ */
+export declare function checkImportDestinations(edges: readonly ImportDestination[]): ReleaseDiagnostic[];
+//# sourceMappingURL=destinations.d.ts.map

package/dist/release/destinations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"destinations.d.ts","sourceRoot":"","sources":["../../src/release/destinations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,sDAAsD;IACtD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,YAAY,EAAE,SAAS,iBAAiB,EAAE,GACzC,iBAAiB,EAAE,CAsBrB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,SAAS,iBAAiB,EAAE,GAClC,iBAAiB,EAAE,CAgBrB"}

package/dist/release/destinations.js

@@ -0,0 +1,75 @@
+/**
+ * Where each module publishes, and the two ways a set of destinations can be
+ * inconsistent.
+ *
+ * A destination is the module's resolved registry base plus its own directory
+ * name. That rule held silently for as long as every module sat at one depth
+ * under one base with a unique directory name; per-subtree bases remove that
+ * coincidence, so both failures it was hiding become reachable and are checked
+ * here — **at plan time, before any payload is built**, because the payload
+ * builder's own refusal speaks about a manifest published to two places rather
+ * than about the workspace file that said so.
+ *
+ * Pure data in, diagnostics out: the destinations are already computed for
+ * `telo release order`, so one derivation feeds that payload and both checks.
+ */
+/**
+ * Two modules must not resolve to one ref.
+ *
+ * Nothing else catches it: the payload builder is keyed by manifest, so it sees
+ * one module claimed by two destinations and never two modules claiming one,
+ * while the ledger keys by module — both entries would record digests for a
+ * single published artifact and reconciliation could never settle.
+ */
+export function checkDestinationCollisions(destinations) {
+    const byDestination = new Map();
+    for (const { key, destination } of destinations) {
+        const sharing = byDestination.get(destination);
+        if (sharing)
+            sharing.push(key);
+        else
+            byDestination.set(destination, [key]);
+    }
+    const diagnostics = [];
+    for (const [destination, keys] of byDestination) {
+        if (keys.length < 2)
+            continue;
+        diagnostics.push({
+            severity: "error",
+            code: "DESTINATION_COLLISION",
+            message: `${keys.sort().join(" and ")} both publish to '${destination}'. A module's ref is its ` +
+                `registry base plus its own directory name, so they would overwrite one artifact and ` +
+                `their ledger entries could never reconcile. Rename one directory, or give one of the ` +
+                `subtrees its own 'registry:' in telo-workspace.yaml.`,
+        });
+    }
+    return diagnostics;
+}
+/**
+ * A relative import is valid only where the importer's derived ref for its
+ * target equals the destination that module is independently assigned.
+ *
+ * Equal registries are necessary and not sufficient — two modules under one base
+ * at different directory depths derive differently too. Making the builder take
+ * the assigned destination instead is not the fix: it would put a ref in the
+ * artifact that the transport's resolution rule does not produce, so the
+ * manifest would say one thing and every consumer resolving relatively would
+ * compute another.
+ */
+export function checkImportDestinations(edges) {
+    const diagnostics = [];
+    for (const edge of edges) {
+        if (edge.derived === edge.assigned)
+            continue;
+        diagnostics.push({
+            severity: "error",
+            code: "IMPORT_DESTINATION_CONFLICT",
+            message: `${edge.from} imports ${edge.to} by relative path, which canonicalizes to ` +
+                `'${edge.derived}' — but ${edge.to} publishes to '${edge.assigned}'. Publishing rewrites ` +
+                `the import to the ref its own path yields, so the artifact would name a module nobody ` +
+                `pushes. Give the two the same registry base and the same directory depth, or make it a ` +
+                `pinned remote import, which is what a dependency across a publish boundary is.`,
+        });
+    }
+    return diagnostics;
+}

package/dist/release/index.d.ts

@@ -21,6 +21,10 @@ export type { LayerChange, LayerDigests } from "./payload-digest.js";
 export { orderByImports, planRelease } from "./release-plan.js";
 export type { ArtifactKind, BumpReason, ChangelogEntry, ModuleEvidence, PlannedModule, ReleaseDiagnostic, ReleaseEvidence, ReleasePlan, } from "./release-plan.js";
 export { VersionStampError, readManifestVersion, stampCrateVersion, stampManifestVersion, stampSelfNpmPins, stampPackageVersion, } from "./version-stamp.js";
-export { WORKSPACE_FILENAME, WorkspaceConfigError, parseWorkspaceConfig } from "./workspace-config.js";
-export type { WorkspaceConfig } from "./workspace-config.js";
+export { checkDestinationCollisions, checkImportDestinations } from "./destinations.js";
+export type { ImportDestination, ModuleDestination } from "./destinations.js";
+export { DEFAULT_ENV_FILES, DEFAULT_RELEASE_IGNORE, WORKSPACE_FILENAME, WorkspaceConfigError, diagnosticsFor, hasError, matchesPatterns, readWorkspaceConfig, requireReleaseSettings, settingsForModule, } from "./workspace-config.js";
+export type { EnvSettings, ModuleEntry, ModuleSettings, PatternMatch, ReleaseSettings, WorkspaceConfig, WorkspaceDiagnostic, WorkspaceDiagnosticCode, WorkspaceRead, } from "./workspace-config.js";
+export { MODULE_ENTRY_KEYS, WORKSPACE_BLOCKS, WORKSPACE_SCHEMA, } from "./workspace-schema.js";
+export type { WorkspaceBlockSchema, WorkspaceKeySchema } from "./workspace-schema.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/release/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/release/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,SAAS,EACT,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,QAAQ,GACT,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/D,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACpG,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnG,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,gBAAgB,EAChB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAErE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChE,YAAY,EACV,YAAY,EACZ,UAAU,EACV,cAAc,EACd,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,WAAW,GACZ,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AACvG,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/release/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,SAAS,EACT,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,QAAQ,GACT,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/D,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACpG,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnG,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,gBAAgB,EAChB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAErE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChE,YAAY,EACV,YAAY,EACZ,UAAU,EACV,cAAc,EACd,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,WAAW,GACZ,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACxF,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE9E,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,QAAQ,EACR,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,WAAW,EACX,WAAW,EACX,cAAc,EACd,YAAY,EACZ,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,uBAAuB,EACvB,aAAa,GACd,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/release/index.js

@@ -15,4 +15,6 @@ export { EMPTY_LEDGER, LEDGER_PATH, LedgerError, parseLedger, serializeLedger }
 export { LOCALLY_DERIVED_LAYERS, MANIFEST_LAYER, diffLayerDigests, layerDigestKey, } from "./payload-digest.js";
 export { orderByImports, planRelease } from "./release-plan.js";
 export { VersionStampError, readManifestVersion, stampCrateVersion, stampManifestVersion, stampSelfNpmPins, stampPackageVersion, } from "./version-stamp.js";
-export { WORKSPACE_FILENAME, WorkspaceConfigError, parseWorkspaceConfig } from "./workspace-config.js";
+export { checkDestinationCollisions, checkImportDestinations } from "./destinations.js";
+export { DEFAULT_ENV_FILES, DEFAULT_RELEASE_IGNORE, WORKSPACE_FILENAME, WorkspaceConfigError, diagnosticsFor, hasError, matchesPatterns, readWorkspaceConfig, requireReleaseSettings, settingsForModule, } from "./workspace-config.js";
+export { MODULE_ENTRY_KEYS, WORKSPACE_BLOCKS, WORKSPACE_SCHEMA, } from "./workspace-schema.js";

package/dist/release/ledger.d.ts

@@ -14,10 +14,22 @@
  * drift: it means nothing is published, which is the correct reading for a
  * module that has never shipped.
  *
- * **It records the registry base**, because canonicalizing a relative `imports:`
- * source writes the destination into the manifest layer — so the digests below
- * are digests *against that base*, and comparing them to digests taken against
- * another one would be comparing two different artifacts.
+ * **Every entry records its own registry base**, because canonicalizing a
+ * relative `imports:` source writes the destination into the manifest layer — so
+ * each digest is a digest *against that base*, and comparing it to one taken
+ * against another would be comparing two different artifacts.
+ *
+ * Per entry rather than one top-level base with per-entry deltas: a workspace
+ * whose `release.modules` entries each author a destination has no meaningful
+ * top-level base, an absent one already means *nothing has been published yet*,
+ * and the agreement check returns early on that — so the multi-destination
+ * workspace would be the one whose bases are never compared. The file is
+ * generated and never hand-maintained, so the redundancy costs nothing and it
+ * removes the "differs from what?" question and the absent-versus-unknown
+ * conflation together. A **top-level `registry:` is a legacy form the reader
+ * accepts and never writes**, applied to every entry: the credential-free PR
+ * gate reads whatever ledger is committed on the branch, and that stays in the
+ * old shape until a release regenerates it.
  */
 import { type ModuleKey } from "./fragment.js";
 import type { LayerDigests } from "./payload-digest.js";
@@ -26,16 +38,13 @@ export interface LedgerEntry {
     /** The version these digests were taken at — the tag the artifact published
      *  under. */
     readonly version: string;
+    /** The publish destination base these digests were taken against
+     *  (`oci://ghcr.io/telorun`). Absent only in a ledger written before the base
+     *  was recorded at all. */
+    readonly registry?: string;
     readonly layers: LayerDigests;
 }
 export interface Ledger {
-    /**
-     * The publish destination base the digests were taken against
-     * (`oci://ghcr.io/telorun`). Absent in a workspace that has published nothing
-     * yet, which is why it is optional rather than required — but a `check` that
-     * has entries and no base cannot reproduce them, and says so.
-     */
-    readonly registry?: string;
     readonly modules: ReadonlyMap<ModuleKey, LedgerEntry>;
 }
 export declare class LedgerError extends Error {

package/dist/release/ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ledger.d.ts","sourceRoot":"","sources":["../../src/release/ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,eAAO,MAAM,WAAW,yBAAyB,CAAC;AAElD,MAAM,WAAW,WAAW;IAC1B;iBACa;IACb,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;CAC/B;AAED,MAAM,WAAW,MAAM;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;CACvD;AAED,qBAAa,WAAY,SAAQ,KAAK;CAAG;AAEzC,eAAO,MAAM,YAAY,EAAE,MAA+B,CAAC;AAE3D,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CA+D/D;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAkBtD"}
+{"version":3,"file":"ledger.d.ts","sourceRoot":"","sources":["../../src/release/ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAIH,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,eAAO,MAAM,WAAW,yBAAyB,CAAC;AAElD,MAAM,WAAW,WAAW;IAC1B;iBACa;IACb,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;+BAE2B;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;CAC/B;AAED,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;CACvD;AAED,qBAAa,WAAY,SAAQ,KAAK;CAAG;AAEzC,eAAO,MAAM,YAAY,EAAE,MAA+B,CAAC;AAE3D,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAmF/D;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAmBtD"}

package/dist/release/ledger.js

@@ -14,10 +14,22 @@
  * drift: it means nothing is published, which is the correct reading for a
  * module that has never shipped.
  *
- * **It records the registry base**, because canonicalizing a relative `imports:`
- * source writes the destination into the manifest layer — so the digests below
- * are digests *against that base*, and comparing them to digests taken against
- * another one would be comparing two different artifacts.
+ * **Every entry records its own registry base**, because canonicalizing a
+ * relative `imports:` source writes the destination into the manifest layer — so
+ * each digest is a digest *against that base*, and comparing it to one taken
+ * against another would be comparing two different artifacts.
+ *
+ * Per entry rather than one top-level base with per-entry deltas: a workspace
+ * whose `release.modules` entries each author a destination has no meaningful
+ * top-level base, an absent one already means *nothing has been published yet*,
+ * and the agreement check returns early on that — so the multi-destination
+ * workspace would be the one whose bases are never compared. The file is
+ * generated and never hand-maintained, so the redundancy costs nothing and it
+ * removes the "differs from what?" question and the absent-versus-unknown
+ * conflation together. A **top-level `registry:` is a legacy form the reader
+ * accepts and never writes**, applied to every entry: the credential-free PR
+ * gate reads whatever ledger is committed on the branch, and that stays in the
+ * old shape until a release regenerates it.
  */
 import { Document, parseDocument } from "yaml";
 import { isReleaseVersion } from "./bump-level.js";
@@ -45,13 +57,14 @@ export function parseLedger(text, where) {
             throw new LedgerError(`${where}: unknown field '${key}'. The ledger carries 'registry:' and 'modules:'.`);
         }
     }
-    const registry = record.registry;
-    if (registry !== undefined && typeof registry !== "string") {
+    // The legacy top-level base: read and applied to every entry, never written.
+    const inherited = record.registry;
+    if (inherited !== undefined && typeof inherited !== "string") {
         throw new LedgerError(`${where}: 'registry' must be the publish destination base, as a string.`);
     }
     const rawModules = record.modules;
     if (rawModules === undefined || rawModules === null)
-        return { ...(registry ? { registry } : {}), modules: new Map() };
+        return { modules: new Map() };
     if (typeof rawModules !== "object" || Array.isArray(rawModules)) {
         throw new LedgerError(`${where}: 'modules' must be a mapping of module path to entry.`);
     }
@@ -61,6 +74,16 @@ export function parseLedger(text, where) {
             throw new LedgerError(`${where}: entry '${key}' must be a mapping.`);
         }
         const entry = raw;
+        for (const field of Object.keys(entry)) {
+            if (field !== "version" && field !== "registry" && field !== "layers") {
+                throw new LedgerError(`${where}: entry '${key}' has unknown field '${field}'. An entry carries 'version:', ` +
+                    `'registry:' and 'layers:'.`);
+            }
+        }
+        if (entry.registry !== undefined && typeof entry.registry !== "string") {
+            throw new LedgerError(`${where}: entry '${key}' has a non-string 'registry'. It is the publish destination base ` +
+                `the digests beside it were taken against.`);
+        }
         if (!isReleaseVersion(entry.version)) {
             throw new LedgerError(`${where}: entry '${key}' has no major.minor.patch 'version'. The ledger records the ` +
                 `version each digest was taken at; without it the digest says nothing.`);
@@ -78,9 +101,14 @@ export function parseLedger(text, where) {
                 layers[layer] = digest;
             }
         }
-        modules.set(normalizeModuleKey(key), { version: entry.version, layers });
+        const registry = entry.registry ?? inherited;
+        modules.set(normalizeModuleKey(key), {
+            version: entry.version,
+            ...(registry ? { registry } : {}),
+            layers,
+        });
     }
-    return { ...(registry ? { registry } : {}), modules };
+    return { modules };
 }
 /**
  * Render the ledger.
@@ -96,12 +124,13 @@ export function serializeLedger(ledger) {
         const layers = {};
         for (const layer of Object.keys(entry.layers).sort())
             layers[layer] = entry.layers[layer];
-        modules[key] = { version: entry.version, layers };
+        modules[key] = {
+            version: entry.version,
+            ...(entry.registry ? { registry: entry.registry } : {}),
+            layers,
+        };
     }
-    const doc = new Document({
-        ...(ledger.registry ? { registry: ledger.registry } : {}),
-        modules,
-    });
+    const doc = new Document({ modules });
     return ("# Generated by `telo release apply` — what each module looks like as published.\n" +
         "# A cache of the registry's answer, so a PR gate needs no credentials.\n" +
         "# `telo release verify` reconciles it against the registry.\n" +

package/dist/release/release-plan.d.ts

@@ -58,13 +58,14 @@ export interface ModuleEvidence {
     /** Whether a file under this module's own directory that reaches the artifact
      *  changed. Decides only whether a changelog line is requested. */
     readonly ownFilesChanged: boolean;
+    /** The publish destination base THIS module's payload was built against —
+     *  per module, because a workspace may declare one per subtree. */
+    readonly registry: string;
 }
 export interface ReleaseEvidence {
     readonly modules: readonly ModuleEvidence[];
     readonly ledger: Ledger;
     readonly fragments: readonly ReleaseFragment[];
-    /** The publish destination base the digests above were built against. */
-    readonly registry?: string;
 }
 /** Why a module is in the plan. A module usually carries several. */
 export type BumpReason = {

package/dist/release/release-plan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release-plan.d.ts","sourceRoot":"","sources":["../../src/release/release-plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,YAAY,EAElB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAoB,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAE5F;;uDAEuD;AACvD,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,OAAO,CAAC;AAEhD,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IAC5D;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,CAAC;IACvC;uEACmE;IACnE,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,eAAe,EAAE,CAAC;IAC/C,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,qEAAqE;AACrE,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAA;CAAE,GACnF;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC3F;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;CAAE,CAAC;AAEtC,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IACxC;iFAC6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;CAC7C;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B;6EACyE;IACzE,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;IAC3C,2DAA2D;IAC3D,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACpD;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,eAAe,GAAG,WAAW,CA6GlE;AAsID;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,cAAc,EAAE,CAgBnF"}
+{"version":3,"file":"release-plan.d.ts","sourceRoot":"","sources":["../../src/release/release-plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,YAAY,EAElB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAoB,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAE5F;;uDAEuD;AACvD,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,OAAO,CAAC;AAEhD,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IAC5D;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,CAAC;IACvC;uEACmE;IACnE,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC;uEACmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,eAAe,EAAE,CAAC;CAChD;AAED,qEAAqE;AACrE,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAA;CAAE,GACnF;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC3F;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;CAAE,CAAC;AAEtC,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IACxC;iFAC6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;CAC7C;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B;6EACyE;IACzE,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;IAC3C,2DAA2D;IAC3D,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACpD;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,eAAe,GAAG,WAAW,CAwHlE;AAgHD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,cAAc,EAAE,CAgBnF"}

package/dist/release/release-plan.js

@@ -28,7 +28,6 @@ import { diffLayerDigests } from "./payload-digest.js";
 export function planRelease(evidence) {
     const diagnostics = [];
     const byKey = new Map(evidence.modules.map((module) => [module.key, module]));
-    checkRegistryAgreement(evidence, diagnostics);
     // What the digest says, per module. A module with no ledger entry has never
     // been published, which is not drift — there is nothing to differ from.
     const drift = new Map();
@@ -36,6 +35,18 @@ export function planRelease(evidence) {
         const recorded = evidence.ledger.modules.get(module.key);
         if (!recorded)
             continue;
+        if (recorded.registry && recorded.registry !== module.registry) {
+            diagnostics.push({
+                severity: "error",
+                code: "LEDGER_REGISTRY_MISMATCH",
+                message: `${module.key}: its ledger digests were taken against '${recorded.registry}', but this ` +
+                    `run built against '${module.registry}'. Publishing rewrites each relative import to ` +
+                    `'<base>/<sibling>@<version>', so the manifest layers of the two are different bytes ` +
+                    `and comparing them would report the module as changed. Publish to the recorded base, ` +
+                    `or re-record with \`telo release verify --write\`.`,
+            });
+            continue;
+        }
         if (recorded.version !== module.version) {
             diagnostics.push({
                 severity: "error",
@@ -228,24 +239,6 @@ function requestMissingChangelogEntries(modules, entries, diagnostics) {
             `One \`telo release add\` can name them all.`,
     });
 }
-/**
- * The base the digests were built against has to be the base they were recorded
- * against, or the manifest layers are not comparable: canonicalization writes
- * the destination into them.
- */
-function checkRegistryAgreement(evidence, diagnostics) {
-    const recorded = evidence.ledger.registry;
-    if (!recorded || !evidence.registry || recorded === evidence.registry)
-        return;
-    diagnostics.push({
-        severity: "error",
-        code: "LEDGER_REGISTRY_MISMATCH",
-        message: `The ledger's digests were taken against '${recorded}', but this run built against ` +
-            `'${evidence.registry}'. Publishing rewrites each relative import to ` +
-            `'<base>/<sibling>@<version>', so the manifest layers of the two are different bytes ` +
-            `and comparing them would report every module as changed.`,
-    });
-}
 /**
  * Dependency order over in-repo imports — a dependency before its dependents.
  *

package/dist/release/workspace-config.d.ts

@@ -1,45 +1,125 @@
 /**
- * `telo-workspace.yaml` — the release anchor.
- *
- * Every path the release system names — a module key, a ledger entry, a
- * fragment's `modules:` — is relative to this file's directory. That is the
- * whole of its job: **its location is the anchor**, and its one field names the
- * subtrees that may hold modules, which is not derivable (a whole-tree scan
- * would read every example and every cached `.telo/manifests` copy as a released
- * module).
- *
- * The file is **optional**, and everything reading it is harmless without one.
- * `telo release` requires one. `telo run` uses its LOCATION — never `modules:`,
- * which is release scope — as the bound on the walk-up that collects `.env` /
- * `.env.local`, and with no marker reads the manifest's own directory alone, as
- * it did before this file existed; a bound is what keeps that walk out of a
- * user's home directory. Nothing else — not `check`, `publish`, `install`,
- * `upgrade`, `migrate`, `module`, and not the kernel — looks for it, so a
- * single-manifest repo, a bare `examples/` directory and a third-party module
- * checkout keep working with nothing added. Any field added later must be true
- * of the whole tree, not derivable from it, and harmless by its absence.
- *
- * Parsing lives here, in the browser-safe half, because the editor answers
- * "what does changing this library bump?" from the same model. Finding the file
- * on disk is the CLI's half — this side takes text.
+ * `telo-workspace.yaml` — the anchor.
+ *
+ * **Its location is the anchor, and every field lives in a block scoped to what
+ * it governs.** Every path the release system names — a module key, a ledger
+ * entry, a fragment's `modules:` — is relative to this file's directory, and so
+ * is the `.telo` cache. `release:` is what `telo release` reads; `env:` is what
+ * `telo run` reads when it resolves a manifest's environment.
+ *
+ * That rule is why `modules:` sits under `release:` rather than at the top
+ * level. It is a release inventory, not an inventory of manifests: it exists so
+ * a whole-tree scan does not read every example and every cached
+ * `.telo/manifests` copy as something to version and publish, and nothing else
+ * consults it — the env walk refuses to, which is why a manifest under
+ * `examples/`, in no release subtree, still gets the full walk.
+ *
+ * The file is **optional and every block in it is optional**. A marker whose
+ * whole content is comments is valid: it anchors the cache and bounds the env
+ * walk, which is exactly what a runner seeds one for.
+ *
+ * **The reader is lenient; the diagnostics are the strict half.** It returns
+ * everything it could read plus everything it found wrong, each anchored at a
+ * key path, because an editor wants all of them and a command wants to exit on
+ * the first. Which of them are fatal is the CALLER's policy, not the file's:
+ * `telo release` refuses on any error, while `telo run` consumes `env:` alone
+ * and prints the rest — aborting every app in a workspace over a release typo is
+ * not a trade to make silently.
+ *
+ * Parsing lives here, in the browser-safe half, because the editor answers "what
+ * does changing this library bump?" from the same model. Finding the file on
+ * disk is the CLI's half — this side takes text. Gitignore matching is INJECTED
+ * (`PatternMatch`) for the same reason: the grammar belongs to the glob package,
+ * which this half does not depend on.
  */
+import { DEFAULT_ENV_FILES, DEFAULT_RELEASE_IGNORE } from "./workspace-schema.js";
 export declare const WORKSPACE_FILENAME = "telo-workspace.yaml";
+export { DEFAULT_ENV_FILES, DEFAULT_RELEASE_IGNORE };
+/** One `release.modules` entry. A bare string in the file normalizes to this
+ *  with no overrides. */
+export interface ModuleEntry {
+    readonly path: string;
+    readonly registry?: string;
+    readonly ignore?: readonly string[];
+}
+export interface ReleaseSettings {
+    readonly registry?: string;
+    readonly ignore?: readonly string[];
+    readonly modules: readonly ModuleEntry[];
+}
+export interface EnvSettings {
+    readonly roots?: readonly string[];
+    readonly files?: readonly string[];
+}
 export interface WorkspaceConfig {
-    /**
-     * Gitignore-style patterns, workspace-relative, naming the subtrees that may
-     * hold modules (`modules/*`, `apps/*`). A pattern names a place to look, never
-     * a module: what makes a directory a module is its `telo.yaml`.
-     */
-    readonly modules: readonly string[];
+    readonly release?: ReleaseSettings;
+    readonly env?: EnvSettings;
+}
+export type WorkspaceDiagnosticCode = "WORKSPACE_UNKNOWN_KEY" | "WORKSPACE_MODULES_MOVED" | "WORKSPACE_INVALID_VALUE" | "WORKSPACE_ENTRY_MATCHES_NOTHING" | "WORKSPACE_ENTRY_SHADOWED" | "WORKSPACE_MARKER_SHADOWED";
+export interface WorkspaceDiagnostic {
+    readonly code: WorkspaceDiagnosticCode;
+    readonly severity: "error" | "warning";
+    readonly message: string;
+    /** Key path from the document root (`["release", "modules", 2, "registry"]`),
+     *  so a host can anchor a squiggle without re-deriving where it came from. */
+    readonly path: readonly (string | number)[];
+}
+export interface WorkspaceRead {
+    readonly config: WorkspaceConfig;
+    readonly diagnostics: readonly WorkspaceDiagnostic[];
 }
 export declare class WorkspaceConfigError extends Error {
 }
 /**
- * Parse the marker file's text.
+ * Read the marker's text.
+ *
+ * Never throws: unreadable YAML is itself a diagnostic, because the one caller
+ * that must not abort on it is the run path.
+ */
+export declare function readWorkspaceConfig(text: string, where: string): WorkspaceRead;
+/** The diagnostics anchored inside one top-level block, plus the ones anchored
+ *  at the document itself (unreadable YAML, a non-mapping root) — those are
+ *  every block's problem. */
+export declare function diagnosticsFor(diagnostics: readonly WorkspaceDiagnostic[], block: string): readonly WorkspaceDiagnostic[];
+export declare function hasError(diagnostics: readonly WorkspaceDiagnostic[]): boolean;
+/**
+ * The release settings, or a throw naming what is missing.
+ *
+ * `telo release` is the one caller for which any error is fatal, and for which
+ * an absent block is itself one: a marker with no `release:` anchors a cache and
+ * declares no release scope, which is exactly the state a runner's seeded marker
+ * is in.
+ */
+export declare function requireReleaseSettings(read: WorkspaceRead, where: string): ReleaseSettings;
+/**
+ * Gitignore-style matching over one authored list.
+ *
+ * Injected rather than imported: the grammar is the glob package's, and this
+ * half is browser-safe. Returns the index of the LAST pattern matching `path`,
+ * or `-1` — which is what makes a decision attributable to the entry that made
+ * it (the `buildImportUpgrades` environment precedent).
+ */
+export type PatternMatch = (path: string, patterns: readonly string[]) => number;
+export interface ModuleSettings {
+    /** Index into `release.modules` of the entry that decided this module. */
+    readonly entry: number;
+    readonly registry?: string;
+    readonly ignore: readonly string[];
+}
+/**
+ * Which entry claims `key`, and what it therefore settles.
+ *
+ * **The last matching entry supplies them** — the rule the list already has,
+ * since it is one gitignore-style list evaluated last-match-wins. A negation
+ * entry is an exclusion and therefore supplies nothing: a module the last match
+ * excludes is not a module of this workspace at all, which is why this returns
+ * `undefined` rather than a settings object for it.
  *
- * Strict about its one field, because there is nothing here to be lenient with:
- * an empty or absent `modules:` names no subtree, so discovery would find no
- * module and every gate would silently pass over a whole repo.
+ * The cascade is key-wise and each key's value replaces whole, so an entry
+ * naming only `registry:` keeps the block's `ignore:`.
  */
-export declare function parseWorkspaceConfig(text: string, where: string): WorkspaceConfig;
+export declare function settingsForModule(release: ReleaseSettings, key: string, match: PatternMatch): ModuleSettings | undefined;
+/** Whether `path` is matched by an authored pattern list, negations honoured.
+ *  `env.roots` and a resolved `ignore` list are both read through this. */
+export declare function matchesPatterns(path: string, patterns: readonly string[], match: PatternMatch): boolean;
 //# sourceMappingURL=workspace-config.d.ts.map

package/dist/release/workspace-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-config.d.ts","sourceRoot":"","sources":["../../src/release/workspace-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AAExD,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,qBAAa,oBAAqB,SAAQ,KAAK;CAAG;AAElD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,eAAe,CAoCjF"}
+{"version":3,"file":"workspace-config.d.ts","sourceRoot":"","sources":["../../src/release/workspace-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAGH,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EAKvB,MAAM,uBAAuB,CAAC;AAE/B,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AAExD,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,CAAC;AAErD;yBACyB;AACzB,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC;CAC5B;AAED,MAAM,MAAM,uBAAuB,GAC/B,uBAAuB,GACvB,yBAAyB,GACzB,yBAAyB,GACzB,iCAAiC,GACjC,0BAA0B,GAC1B,2BAA2B,CAAC;AAEhC,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;kFAC8E;IAC9E,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;CAC7C;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACtD;AAED,qBAAa,oBAAqB,SAAQ,KAAK;CAAG;AAIlD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,CA+D9E;AAiPD;;6BAE6B;AAC7B,wBAAgB,cAAc,CAC5B,WAAW,EAAE,SAAS,mBAAmB,EAAE,EAC3C,KAAK,EAAE,MAAM,GACZ,SAAS,mBAAmB,EAAE,CAEhC;AAED,wBAAgB,QAAQ,CAAC,WAAW,EAAE,SAAS,mBAAmB,EAAE,GAAG,OAAO,CAE7E;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,aAAa,EACnB,KAAK,EAAE,MAAM,GACZ,eAAe,CAUjB;AAMD;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,KAAK,MAAM,CAAC;AAEjF,MAAM,WAAW,cAAc;IAC7B,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,YAAY,GAClB,cAAc,GAAG,SAAS,CAW5B;AAED;2EAC2E;AAC3E,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,KAAK,EAAE,YAAY,GAClB,OAAO,CAET"}