@telorun/analyzer 0.72.0 → 0.74.0

package/src/release/ledger.ts

@@ -14,10 +14,22 @@
  * drift: it means nothing is published, which is the correct reading for a
  * module that has never shipped.
  *
- * **It records the registry base**, because canonicalizing a relative `imports:`
- * source writes the destination into the manifest layer — so the digests below
- * are digests *against that base*, and comparing them to digests taken against
- * another one would be comparing two different artifacts.
+ * **Every entry records its own registry base**, because canonicalizing a
+ * relative `imports:` source writes the destination into the manifest layer — so
+ * each digest is a digest *against that base*, and comparing it to one taken
+ * against another would be comparing two different artifacts.
+ *
+ * Per entry rather than one top-level base with per-entry deltas: a workspace
+ * whose `release.modules` entries each author a destination has no meaningful
+ * top-level base, an absent one already means *nothing has been published yet*,
+ * and the agreement check returns early on that — so the multi-destination
+ * workspace would be the one whose bases are never compared. The file is
+ * generated and never hand-maintained, so the redundancy costs nothing and it
+ * removes the "differs from what?" question and the absent-versus-unknown
+ * conflation together. A **top-level `registry:` is a legacy form the reader
+ * accepts and never writes**, applied to every entry: the credential-free PR
+ * gate reads whatever ledger is committed on the branch, and that stays in the
+ * old shape until a release regenerates it.
  */
 
 import { Document, parseDocument } from "yaml";
@@ -31,17 +43,14 @@ export interface LedgerEntry {
   /** The version these digests were taken at — the tag the artifact published
    *  under. */
   readonly version: string;
+  /** The publish destination base these digests were taken against
+   *  (`oci://ghcr.io/telorun`). Absent only in a ledger written before the base
+   *  was recorded at all. */
+  readonly registry?: string;
   readonly layers: LayerDigests;
 }
 
 export interface Ledger {
-  /**
-   * The publish destination base the digests were taken against
-   * (`oci://ghcr.io/telorun`). Absent in a workspace that has published nothing
-   * yet, which is why it is optional rather than required — but a `check` that
-   * has entries and no base cannot reproduce them, and says so.
-   */
-  readonly registry?: string;
   readonly modules: ReadonlyMap<ModuleKey, LedgerEntry>;
 }
 
@@ -72,13 +81,14 @@ export function parseLedger(text: string, where: string): Ledger {
     }
   }
 
-  const registry = record.registry;
-  if (registry !== undefined && typeof registry !== "string") {
+  // The legacy top-level base: read and applied to every entry, never written.
+  const inherited = record.registry;
+  if (inherited !== undefined && typeof inherited !== "string") {
     throw new LedgerError(`${where}: 'registry' must be the publish destination base, as a string.`);
   }
 
   const rawModules = record.modules;
-  if (rawModules === undefined || rawModules === null) return { ...(registry ? { registry } : {}), modules: new Map() };
+  if (rawModules === undefined || rawModules === null) return { modules: new Map() };
   if (typeof rawModules !== "object" || Array.isArray(rawModules)) {
     throw new LedgerError(`${where}: 'modules' must be a mapping of module path to entry.`);
   }
@@ -89,6 +99,20 @@ export function parseLedger(text: string, where: string): Ledger {
       throw new LedgerError(`${where}: entry '${key}' must be a mapping.`);
     }
     const entry = raw as Record<string, unknown>;
+    for (const field of Object.keys(entry)) {
+      if (field !== "version" && field !== "registry" && field !== "layers") {
+        throw new LedgerError(
+          `${where}: entry '${key}' has unknown field '${field}'. An entry carries 'version:', ` +
+            `'registry:' and 'layers:'.`,
+        );
+      }
+    }
+    if (entry.registry !== undefined && typeof entry.registry !== "string") {
+      throw new LedgerError(
+        `${where}: entry '${key}' has a non-string 'registry'. It is the publish destination base ` +
+          `the digests beside it were taken against.`,
+      );
+    }
     if (!isReleaseVersion(entry.version)) {
       throw new LedgerError(
         `${where}: entry '${key}' has no major.minor.patch 'version'. The ledger records the ` +
@@ -108,10 +132,15 @@ export function parseLedger(text: string, where: string): Ledger {
         layers[layer] = digest;
       }
     }
-    modules.set(normalizeModuleKey(key), { version: entry.version, layers });
+    const registry = (entry.registry as string | undefined) ?? inherited;
+    modules.set(normalizeModuleKey(key), {
+      version: entry.version,
+      ...(registry ? { registry } : {}),
+      layers,
+    });
   }
 
-  return { ...(registry ? { registry } : {}), modules };
+  return { modules };
 }
 
 /**
@@ -127,12 +156,13 @@ export function serializeLedger(ledger: Ledger): string {
     const entry = ledger.modules.get(key)!;
     const layers: Record<string, string> = {};
     for (const layer of Object.keys(entry.layers).sort()) layers[layer] = entry.layers[layer];
-    modules[key] = { version: entry.version, layers };
+    modules[key] = {
+      version: entry.version,
+      ...(entry.registry ? { registry: entry.registry } : {}),
+      layers,
+    };
   }
-  const doc = new Document({
-    ...(ledger.registry ? { registry: ledger.registry } : {}),
-    modules,
-  });
+  const doc = new Document({ modules });
   return (
     "# Generated by `telo release apply` — what each module looks like as published.\n" +
     "# A cache of the registry's answer, so a PR gate needs no credentials.\n" +

package/src/release/payload-digest.ts

@@ -54,7 +54,8 @@ export const LOCALLY_DERIVED_LAYERS: ReadonlySet<string> = new Set([MANIFEST_LAY
  * `axis=value;…` form, because this string is read by a human in a ledger diff
  * and written into a plain YAML key; the axis order is `PLATFORM_AXES`, so the
  * rendering is deterministic rather than dependent on how the selector was
- * built.
+ * built. An axis a selector omits renders nothing, so a new axis appended to the
+ * vocabulary leaves every existing key unchanged — reordering it would not.
  */
 export function layerDigestKey(role: LayerRole | string, selector?: ArtifactSelector): string {
   if (!selector) return role;

package/src/release/release-plan.ts

@@ -67,14 +67,15 @@ export interface ModuleEvidence {
   /** Whether a file under this module's own directory that reaches the artifact
    *  changed. Decides only whether a changelog line is requested. */
   readonly ownFilesChanged: boolean;
+  /** The publish destination base THIS module's payload was built against —
+   *  per module, because a workspace may declare one per subtree. */
+  readonly registry: string;
 }
 
 export interface ReleaseEvidence {
   readonly modules: readonly ModuleEvidence[];
   readonly ledger: Ledger;
   readonly fragments: readonly ReleaseFragment[];
-  /** The publish destination base the digests above were built against. */
-  readonly registry?: string;
 }
 
 /** Why a module is in the plan. A module usually carries several. */
@@ -123,14 +124,25 @@ export function planRelease(evidence: ReleaseEvidence): ReleasePlan {
   const diagnostics: ReleaseDiagnostic[] = [];
   const byKey = new Map(evidence.modules.map((module) => [module.key, module]));
 
-  checkRegistryAgreement(evidence, diagnostics);
-
   // What the digest says, per module. A module with no ledger entry has never
   // been published, which is not drift — there is nothing to differ from.
   const drift = new Map<ModuleKey, LayerChange[]>();
   for (const module of evidence.modules) {
     const recorded = evidence.ledger.modules.get(module.key);
     if (!recorded) continue;
+    if (recorded.registry && recorded.registry !== module.registry) {
+      diagnostics.push({
+        severity: "error",
+        code: "LEDGER_REGISTRY_MISMATCH",
+        message:
+          `${module.key}: its ledger digests were taken against '${recorded.registry}', but this ` +
+          `run built against '${module.registry}'. Publishing rewrites each relative import to ` +
+          `'<base>/<sibling>@<version>', so the manifest layers of the two are different bytes ` +
+          `and comparing them would report the module as changed. Publish to the recorded base, ` +
+          `or re-record with \`telo release verify --write\`.`,
+      });
+      continue;
+    }
     if (recorded.version !== module.version) {
       diagnostics.push({
         severity: "error",
@@ -340,28 +352,6 @@ function requestMissingChangelogEntries(
   });
 }
 
-/**
- * The base the digests were built against has to be the base they were recorded
- * against, or the manifest layers are not comparable: canonicalization writes
- * the destination into them.
- */
-function checkRegistryAgreement(
-  evidence: ReleaseEvidence,
-  diagnostics: ReleaseDiagnostic[],
-): void {
-  const recorded = evidence.ledger.registry;
-  if (!recorded || !evidence.registry || recorded === evidence.registry) return;
-  diagnostics.push({
-    severity: "error",
-    code: "LEDGER_REGISTRY_MISMATCH",
-    message:
-      `The ledger's digests were taken against '${recorded}', but this run built against ` +
-      `'${evidence.registry}'. Publishing rewrites each relative import to ` +
-      `'<base>/<sibling>@<version>', so the manifest layers of the two are different bytes ` +
-      `and comparing them would report every module as changed.`,
-  });
-}
-
 /**
  * Dependency order over in-repo imports — a dependency before its dependents.
  *