@telorun/analyzer 0.72.0 → 0.74.0

package/dist/reference-field-map.js

@@ -1,5 +1,23 @@
+import { resolveLocalRef } from "./manifest-navigation.js";
 import { readRefSlot } from "./ref-slot.js";
+import { readStepSlot } from "./step-slot.js";
 export { readRefSlot, isRefSlot, hasDeclaredUse } from "./ref-slot.js";
+/** The slot an entry records, as `readRefSlot` read it. */
+export function refSlotOfEntry(entry) {
+    const slot = {
+        kinds: entry.refs,
+        uses: entry.uses,
+        inline: entry.inline === true,
+        valueBranches: entry.valueBranches ?? [],
+    };
+    if (entry.useCases)
+        slot.useCases = entry.useCases;
+    if (entry.inputs !== undefined)
+        slot.inputs = entry.inputs;
+    if (entry.throwsThrough)
+        slot.throwsThrough = true;
+    return slot;
+}
 export function isRefEntry(entry) {
     return "refs" in entry;
 }
@@ -121,9 +139,10 @@ export function resolveFieldValues(obj, path) {
  */
 export function buildReferenceFieldMap(schema) {
     const map = new Map();
+    const sink = injectionSink(map);
     if (schema.properties) {
         for (const [key, propSchema] of Object.entries(schema.properties)) {
-            traverseNode(propSchema, key, map, schema);
+            traverseNode(propSchema, key, sink, schema);
         }
     }
     return map;
@@ -140,32 +159,175 @@ export function collectRefs(node) {
  *  hid behind the schema-from indirection. */
 export function buildFieldMapAtPath(schema, pathPrefix) {
     const map = new Map();
-    traverseNode(schema, pathPrefix, map, schema);
+    traverseNode(schema, pathPrefix, injectionSink(map), schema);
     return map;
 }
-function traverseNode(node, path, map, root, visitedRefs = new Set()) {
-    // Local `$ref` is intentionally NOT followed. This map is the kernel's
+const drivenSlotMaps = new WeakMap();
+/** The resource envelope: present on every resource document, and never
+ *  configuration a kind's root `additionalProperties` describes. */
+const RESOURCE_ENVELOPE_KEYS = ["kind", "metadata"];
+/**
+ * Every slot through which a resource of this schema DRIVES another — the
+ * reference field map's own traversal, plus what a dispatch analysis needs and
+ * the injection surface must not have:
+ *
+ * - local `$ref` is followed, resolved against the root. The injection map
+ *   stops there so a step's `invoke` never becomes an injection site; this map
+ *   stops AT a step body instead, which removes that reason. A reference back
+ *   to a node already on the descent is recorded as a back-edge rather than
+ *   unrolled, so a recursive shape stays finite here and is followed as deep as
+ *   the data goes by `forEachDrivenSlot`;
+ * - a step body is recorded and not descended — the step traversal owns
+ *   everything below it;
+ * - the root's own variant branches and `additionalProperties` are walked, not
+ *   only its `properties`;
+ * - a path keeps EVERY slot any branch declares there, where the injection map
+ *   keeps the last one written (see {@link DrivenPath.refs});
+ * - each `{}` path records the keys its `additionalProperties` does not cover.
+ *
+ * Shared by every throws question (a kind's `inherit` union, a scope list's
+ * denominator, catch-scope enclosure, and whether `inherit` is legal at all),
+ * so none can reach a slot another cannot. Memoized per schema object.
+ */
+export function buildDrivenSlotMap(schema) {
+    const cached = drivenSlotMaps.get(schema);
+    if (cached)
+        return cached;
+    const slots = { paths: new Map(), declaredKeys: new Map(), drives: false };
+    traverseNode(schema, "", drivenSink(slots), schema);
+    drivenSlotMaps.set(schema, slots);
+    return slots;
+}
+const joinPath = (path, key) => (path ? `${path}.${key}` : key);
+/** The injection map: one entry per path, the last one written. Step bodies,
+ *  back-edges and map-value keys are the driven map's alone. */
+function injectionSink(map) {
+    return {
+        driven: false,
+        ref: (path, entry) => {
+            map.set(path, entry);
+        },
+        stop: (path, entry) => {
+            map.set(path, entry);
+        },
+        step: () => { },
+        recurse: () => { },
+        mapValue: () => { },
+    };
+}
+function drivenSink(slots) {
+    const recorded = new Map();
+    const at = (path) => {
+        let entry = slots.paths.get(path);
+        if (!entry) {
+            entry = { refs: [], steps: [], recurse: [] };
+            slots.paths.set(path, entry);
+        }
+        return entry;
+    };
+    // One schema node reached twice at one path (two branches `$ref`-ing one
+    // definition) is one slot.
+    const firstTime = (path, node) => {
+        let nodes = recorded.get(path);
+        if (!nodes)
+            recorded.set(path, (nodes = new Set()));
+        if (nodes.has(node))
+            return false;
+        nodes.add(node);
+        return true;
+    };
+    return {
+        driven: true,
+        ref: (path, entry, node) => {
+            if (!firstTime(path, node))
+                return;
+            at(path).refs.push(entry);
+            slots.drives = true;
+        },
+        stop: () => { },
+        step: (path, step, node) => {
+            if (!firstTime(path, node))
+                return;
+            at(path).steps.push(step);
+            slots.drives = true;
+        },
+        recurse: (path, to) => {
+            const entry = at(path);
+            if (!entry.recurse.includes(to))
+                entry.recurse.push(to);
+        },
+        mapValue: (mapPath, declared) => {
+            const previous = slots.declaredKeys.get(mapPath);
+            slots.declaredKeys.set(mapPath, new Set(previous ? declared.filter((key) => previous.has(key)) : declared));
+        },
+    };
+}
+/** Follow a local `$ref` in driven mode. `onStack` maps each node on the
+ *  current descent to the path it was entered at: re-entering one records a
+ *  back-edge to that path, and a cycle that made no structural progress (same
+ *  path) records nothing, since its body is already recorded there. */
+function followLocalRef(node, path, sink, root, onStack) {
+    if (!root)
+        return;
+    const target = resolveLocalRef(node, root);
+    if (!target || target === node)
+        return;
+    const entered = onStack.get(target);
+    if (entered !== undefined) {
+        if (entered !== path)
+            sink.recurse(path, entered);
+        return;
+    }
+    onStack.set(target, path);
+    try {
+        traverseNode(target, path, sink, root, onStack);
+    }
+    finally {
+        onStack.delete(target);
+    }
+}
+/** `owner.additionalProperties`, the schema of every value in an open-keyed
+ *  object. JSON Schema applies it only to keys `owner` does not declare, which
+ *  the driven map records so a walk skips them. */
+function traverseMapValue(owner, path, sink, root, onStack) {
+    const valueSchema = owner.additionalProperties;
+    if (!valueSchema || typeof valueSchema !== "object" || Array.isArray(valueSchema))
+        return;
+    const mapPath = joinPath(path, "{}");
+    const declared = owner.properties && typeof owner.properties === "object" ? Object.keys(owner.properties) : [];
+    sink.mapValue(mapPath, path === "" ? [...declared, ...RESOURCE_ENVELOPE_KEYS] : declared);
+    traverseNode(valueSchema, mapPath, sink, root, onStack);
+}
+function traverseNode(node, path, sink, root, onStack = new Map()) {
+    const driven = sink.driven;
+    // Local `$ref` is intentionally NOT followed here. This map is the kernel's
     // Phase-5 injection surface: descending into shared `$defs` (notably
     // `Run.Sequence`'s `step` definition) would make every step's `invoke` an
     // injection site, and step slots resolve at dispatch — injecting there is
     // unwanted regardless of tracing (the original dispatcher-bypass blocker
     // has since shipped via the `REF_IDENTITY` stamp). Static analysis is NOT
     // limited by this stop: the call graph (`call-graph.ts`) reads step slots
-    // from the item schema itself and scans the value tree, so it sees what
-    // this map deliberately hides. `visitedRefs` stays as a parameter so the
-    // recursive calls below thread the right signature.
-    if (typeof node?.$ref === "string")
+    // from the item schema itself and scans the value tree, and the driven-slot
+    // mode (`buildDrivenSlotMap`) follows the reference.
+    if (typeof node?.$ref === "string" && !driven)
         return;
     // Scope slot — record and stop; do not recurse into scope contents
     if ("x-telo-scope" in node) {
-        map.set(path, { scope: node["x-telo-scope"] });
+        sink.stop(path, { scope: node["x-telo-scope"] });
         return;
     }
     // Schema-from slot — record and stop; no further traversal needed
     if ("x-telo-schema-from" in node) {
-        map.set(path, { schemaFrom: node["x-telo-schema-from"] });
+        sink.stop(path, { schemaFrom: node["x-telo-schema-from"] });
         return;
     }
+    if (driven) {
+        const step = readStepSlot(node);
+        if (step) {
+            sink.step(path, step, node);
+            return;
+        }
+    }
     // Reference slot (direct, via a `kind:` list, or via anyOf)
     const slot = readRefSlot(node);
     if (slot && slot.kinds.length > 0) {
@@ -184,7 +346,9 @@ function traverseNode(node, path, map, root, visitedRefs = new Set()) {
             entry.context = node["x-telo-context"];
         if (slot.inline)
             entry.inline = true;
-        map.set(path, entry);
+        if (slot.throwsThrough)
+            entry.throwsThrough = true;
+        sink.ref(path, entry, node);
         // A node can mix item-level ref branches (a bare string / `{kind, name}`)
         // with object branches that carry their OWN nested refs — e.g. Application
         // `targets`: a bare ref vs inline `{ invoke }` vs gated `{ ref }`. Descend
@@ -198,21 +362,24 @@ function traverseNode(node, path, map, root, visitedRefs = new Set()) {
             for (const variant of variants) {
                 if (!variant || typeof variant !== "object")
                     continue;
-                traverseVariant(variant, path, map, root, visitedRefs);
+                traverseVariant(variant, path, sink, root, onStack);
             }
         }
         return;
     }
-    if (typeof node?.$ref === "string")
+    // Reached only in driven mode — the injection map stopped at the top.
+    if (typeof node?.$ref === "string") {
+        followLocalRef(node, path, sink, root, onStack);
         return;
+    }
     // Array — recurse into items
     if (node.type === "array" && node.items) {
-        traverseNode(node.items, path + "[]", map, root, visitedRefs);
+        traverseNode(node.items, path + "[]", sink, root, onStack);
     }
     // Object — recurse into properties
     if (node.properties) {
         for (const [key, propSchema] of Object.entries(node.properties)) {
-            traverseNode(propSchema, `${path}.${key}`, map, root, visitedRefs);
+            traverseNode(propSchema, joinPath(path, key), sink, root, onStack);
         }
     }
     // Variant branches — descend into every alternative's properties / items.
@@ -221,10 +388,11 @@ function traverseNode(node, path, map, root, visitedRefs = new Set()) {
     // slots inside the branch. Walking each branch surfaces those slots into
     // the field map so downstream passes (ref validation, sentinel
     // resolution, dependency graph) cover them without a runtime fallback.
-    // The same field path may be added by multiple branches; the later
-    // assignment wins, which is fine — branches with the same field path
-    // share the same ref/context configuration (any divergence is already
-    // a schema bug).
+    // The same field path may be added by multiple branches. The injection map
+    // keeps the later assignment, which is fine for injection — branches with
+    // the same field path share the same ref/context configuration. The driven
+    // map keeps every one, because which branch applies decides what a
+    // dispatch can throw.
     for (const variantKey of ["oneOf", "anyOf", "allOf"]) {
         const variants = node[variantKey];
         if (!Array.isArray(variants))
@@ -232,34 +400,32 @@ function traverseNode(node, path, map, root, visitedRefs = new Set()) {
         for (const variant of variants) {
             if (!variant || typeof variant !== "object")
                 continue;
-            traverseVariant(variant, path, map, root, visitedRefs);
+            traverseVariant(variant, path, sink, root, onStack);
         }
     }
     // Map — `additionalProperties: { ... }` describes every value in an
     // open-keyed object. Encoder refs nested inside `content[mime]` map
     // entries reach Phase 5 through this branch.
-    if (node.additionalProperties &&
-        typeof node.additionalProperties === "object" &&
-        !Array.isArray(node.additionalProperties)) {
-        traverseNode(node.additionalProperties, `${path}.{}`, map, root, visitedRefs);
-    }
+    traverseMapValue(node, path, sink, root, onStack);
 }
 /** Walk a single variant of a `oneOf` / `anyOf` / `allOf` branch. Only
  *  the properties / items / map slots are followed — collectRefs at the
  *  variant root is handled by the parent's `collectRefs(node)` already
- *  (anyOf of x-telo-ref branches is the canonical multi-ref shape). */
-function traverseVariant(variant, path, map, root, visitedRefs = new Set()) {
+ *  (anyOf of x-telo-ref branches is the canonical multi-ref shape). In
+ *  driven mode a `$ref` branch is followed as a node in its own right, since
+ *  `readRefSlot` does not look through one. */
+function traverseVariant(variant, path, sink, root, onStack = new Map()) {
+    if (sink.driven && typeof variant.$ref === "string") {
+        followLocalRef(variant, path, sink, root, onStack);
+        return;
+    }
     if (variant.properties) {
         for (const [key, propSchema] of Object.entries(variant.properties)) {
-            traverseNode(propSchema, `${path}.${key}`, map, root, visitedRefs);
+            traverseNode(propSchema, joinPath(path, key), sink, root, onStack);
         }
     }
     if (variant.type === "array" && variant.items) {
-        traverseNode(variant.items, path + "[]", map, root, visitedRefs);
-    }
-    if (variant.additionalProperties &&
-        typeof variant.additionalProperties === "object" &&
-        !Array.isArray(variant.additionalProperties)) {
-        traverseNode(variant.additionalProperties, `${path}.{}`, map, root, visitedRefs);
+        traverseNode(variant.items, path + "[]", sink, root, onStack);
     }
+    traverseMapValue(variant, path, sink, root, onStack);
 }

package/dist/release/destinations.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Where each module publishes, and the two ways a set of destinations can be
+ * inconsistent.
+ *
+ * A destination is the module's resolved registry base plus its own directory
+ * name. That rule held silently for as long as every module sat at one depth
+ * under one base with a unique directory name; per-subtree bases remove that
+ * coincidence, so both failures it was hiding become reachable and are checked
+ * here — **at plan time, before any payload is built**, because the payload
+ * builder's own refusal speaks about a manifest published to two places rather
+ * than about the workspace file that said so.
+ *
+ * Pure data in, diagnostics out: the destinations are already computed for
+ * `telo release order`, so one derivation feeds that payload and both checks.
+ */
+import type { ModuleKey } from "./fragment.js";
+import type { ReleaseDiagnostic } from "./release-plan.js";
+export interface ModuleDestination {
+    readonly key: ModuleKey;
+    /** `<registry>/<the module's own directory name>`. */
+    readonly destination: string;
+}
+/**
+ * A relative import between two workspace modules, with both answers about
+ * where the target publishes.
+ *
+ * `derived` is what the importer's own destination yields when the import path
+ * is applied to it — the transport's rule, and what ref canonicalization writes
+ * into the published manifest. `assigned` is what discovery independently gives
+ * that module.
+ */
+export interface ImportDestination {
+    readonly from: ModuleKey;
+    readonly to: ModuleKey;
+    readonly derived: string;
+    readonly assigned: string;
+}
+/**
+ * Two modules must not resolve to one ref.
+ *
+ * Nothing else catches it: the payload builder is keyed by manifest, so it sees
+ * one module claimed by two destinations and never two modules claiming one,
+ * while the ledger keys by module — both entries would record digests for a
+ * single published artifact and reconciliation could never settle.
+ */
+export declare function checkDestinationCollisions(destinations: readonly ModuleDestination[]): ReleaseDiagnostic[];
+/**
+ * A relative import is valid only where the importer's derived ref for its
+ * target equals the destination that module is independently assigned.
+ *
+ * Equal registries are necessary and not sufficient — two modules under one base
+ * at different directory depths derive differently too. Making the builder take
+ * the assigned destination instead is not the fix: it would put a ref in the
+ * artifact that the transport's resolution rule does not produce, so the
+ * manifest would say one thing and every consumer resolving relatively would
+ * compute another.
+ */
+export declare function checkImportDestinations(edges: readonly ImportDestination[]): ReleaseDiagnostic[];
+//# sourceMappingURL=destinations.d.ts.map

package/dist/release/destinations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"destinations.d.ts","sourceRoot":"","sources":["../../src/release/destinations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,sDAAsD;IACtD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,YAAY,EAAE,SAAS,iBAAiB,EAAE,GACzC,iBAAiB,EAAE,CAsBrB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,SAAS,iBAAiB,EAAE,GAClC,iBAAiB,EAAE,CAgBrB"}

package/dist/release/destinations.js

@@ -0,0 +1,75 @@
+/**
+ * Where each module publishes, and the two ways a set of destinations can be
+ * inconsistent.
+ *
+ * A destination is the module's resolved registry base plus its own directory
+ * name. That rule held silently for as long as every module sat at one depth
+ * under one base with a unique directory name; per-subtree bases remove that
+ * coincidence, so both failures it was hiding become reachable and are checked
+ * here — **at plan time, before any payload is built**, because the payload
+ * builder's own refusal speaks about a manifest published to two places rather
+ * than about the workspace file that said so.
+ *
+ * Pure data in, diagnostics out: the destinations are already computed for
+ * `telo release order`, so one derivation feeds that payload and both checks.
+ */
+/**
+ * Two modules must not resolve to one ref.
+ *
+ * Nothing else catches it: the payload builder is keyed by manifest, so it sees
+ * one module claimed by two destinations and never two modules claiming one,
+ * while the ledger keys by module — both entries would record digests for a
+ * single published artifact and reconciliation could never settle.
+ */
+export function checkDestinationCollisions(destinations) {
+    const byDestination = new Map();
+    for (const { key, destination } of destinations) {
+        const sharing = byDestination.get(destination);
+        if (sharing)
+            sharing.push(key);
+        else
+            byDestination.set(destination, [key]);
+    }
+    const diagnostics = [];
+    for (const [destination, keys] of byDestination) {
+        if (keys.length < 2)
+            continue;
+        diagnostics.push({
+            severity: "error",
+            code: "DESTINATION_COLLISION",
+            message: `${keys.sort().join(" and ")} both publish to '${destination}'. A module's ref is its ` +
+                `registry base plus its own directory name, so they would overwrite one artifact and ` +
+                `their ledger entries could never reconcile. Rename one directory, or give one of the ` +
+                `subtrees its own 'registry:' in telo-workspace.yaml.`,
+        });
+    }
+    return diagnostics;
+}
+/**
+ * A relative import is valid only where the importer's derived ref for its
+ * target equals the destination that module is independently assigned.
+ *
+ * Equal registries are necessary and not sufficient — two modules under one base
+ * at different directory depths derive differently too. Making the builder take
+ * the assigned destination instead is not the fix: it would put a ref in the
+ * artifact that the transport's resolution rule does not produce, so the
+ * manifest would say one thing and every consumer resolving relatively would
+ * compute another.
+ */
+export function checkImportDestinations(edges) {
+    const diagnostics = [];
+    for (const edge of edges) {
+        if (edge.derived === edge.assigned)
+            continue;
+        diagnostics.push({
+            severity: "error",
+            code: "IMPORT_DESTINATION_CONFLICT",
+            message: `${edge.from} imports ${edge.to} by relative path, which canonicalizes to ` +
+                `'${edge.derived}' — but ${edge.to} publishes to '${edge.assigned}'. Publishing rewrites ` +
+                `the import to the ref its own path yields, so the artifact would name a module nobody ` +
+                `pushes. Give the two the same registry base and the same directory depth, or make it a ` +
+                `pinned remote import, which is what a dependency across a publish boundary is.`,
+        });
+    }
+    return diagnostics;
+}

package/dist/release/index.d.ts

@@ -21,6 +21,10 @@ export type { LayerChange, LayerDigests } from "./payload-digest.js";
 export { orderByImports, planRelease } from "./release-plan.js";
 export type { ArtifactKind, BumpReason, ChangelogEntry, ModuleEvidence, PlannedModule, ReleaseDiagnostic, ReleaseEvidence, ReleasePlan, } from "./release-plan.js";
 export { VersionStampError, readManifestVersion, stampCrateVersion, stampManifestVersion, stampSelfNpmPins, stampPackageVersion, } from "./version-stamp.js";
-export { WORKSPACE_FILENAME, WorkspaceConfigError, parseWorkspaceConfig } from "./workspace-config.js";
-export type { WorkspaceConfig } from "./workspace-config.js";
+export { checkDestinationCollisions, checkImportDestinations } from "./destinations.js";
+export type { ImportDestination, ModuleDestination } from "./destinations.js";
+export { DEFAULT_ENV_FILES, DEFAULT_RELEASE_IGNORE, WORKSPACE_FILENAME, WorkspaceConfigError, diagnosticsFor, hasError, matchesPatterns, readWorkspaceConfig, requireReleaseSettings, settingsForModule, } from "./workspace-config.js";
+export type { EnvSettings, ModuleEntry, ModuleSettings, PatternMatch, ReleaseSettings, WorkspaceConfig, WorkspaceDiagnostic, WorkspaceDiagnosticCode, WorkspaceRead, } from "./workspace-config.js";
+export { MODULE_ENTRY_KEYS, WORKSPACE_BLOCKS, WORKSPACE_SCHEMA, } from "./workspace-schema.js";
+export type { WorkspaceBlockSchema, WorkspaceKeySchema } from "./workspace-schema.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/release/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/release/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,SAAS,EACT,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,QAAQ,GACT,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/D,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACpG,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnG,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,gBAAgB,EAChB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAErE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChE,YAAY,EACV,YAAY,EACZ,UAAU,EACV,cAAc,EACd,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,WAAW,GACZ,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AACvG,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/release/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,SAAS,EACT,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,QAAQ,GACT,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/D,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACpG,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnG,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,gBAAgB,EAChB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAErE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChE,YAAY,EACV,YAAY,EACZ,UAAU,EACV,cAAc,EACd,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,WAAW,GACZ,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACxF,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE9E,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,QAAQ,EACR,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,WAAW,EACX,WAAW,EACX,cAAc,EACd,YAAY,EACZ,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,uBAAuB,EACvB,aAAa,GACd,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/release/index.js

@@ -15,4 +15,6 @@ export { EMPTY_LEDGER, LEDGER_PATH, LedgerError, parseLedger, serializeLedger }
 export { LOCALLY_DERIVED_LAYERS, MANIFEST_LAYER, diffLayerDigests, layerDigestKey, } from "./payload-digest.js";
 export { orderByImports, planRelease } from "./release-plan.js";
 export { VersionStampError, readManifestVersion, stampCrateVersion, stampManifestVersion, stampSelfNpmPins, stampPackageVersion, } from "./version-stamp.js";
-export { WORKSPACE_FILENAME, WorkspaceConfigError, parseWorkspaceConfig } from "./workspace-config.js";
+export { checkDestinationCollisions, checkImportDestinations } from "./destinations.js";
+export { DEFAULT_ENV_FILES, DEFAULT_RELEASE_IGNORE, WORKSPACE_FILENAME, WorkspaceConfigError, diagnosticsFor, hasError, matchesPatterns, readWorkspaceConfig, requireReleaseSettings, settingsForModule, } from "./workspace-config.js";
+export { MODULE_ENTRY_KEYS, WORKSPACE_BLOCKS, WORKSPACE_SCHEMA, } from "./workspace-schema.js";

package/dist/release/ledger.d.ts

@@ -14,10 +14,22 @@
  * drift: it means nothing is published, which is the correct reading for a
  * module that has never shipped.
  *
- * **It records the registry base**, because canonicalizing a relative `imports:`
- * source writes the destination into the manifest layer — so the digests below
- * are digests *against that base*, and comparing them to digests taken against
- * another one would be comparing two different artifacts.
+ * **Every entry records its own registry base**, because canonicalizing a
+ * relative `imports:` source writes the destination into the manifest layer — so
+ * each digest is a digest *against that base*, and comparing it to one taken
+ * against another would be comparing two different artifacts.
+ *
+ * Per entry rather than one top-level base with per-entry deltas: a workspace
+ * whose `release.modules` entries each author a destination has no meaningful
+ * top-level base, an absent one already means *nothing has been published yet*,
+ * and the agreement check returns early on that — so the multi-destination
+ * workspace would be the one whose bases are never compared. The file is
+ * generated and never hand-maintained, so the redundancy costs nothing and it
+ * removes the "differs from what?" question and the absent-versus-unknown
+ * conflation together. A **top-level `registry:` is a legacy form the reader
+ * accepts and never writes**, applied to every entry: the credential-free PR
+ * gate reads whatever ledger is committed on the branch, and that stays in the
+ * old shape until a release regenerates it.
  */
 import { type ModuleKey } from "./fragment.js";
 import type { LayerDigests } from "./payload-digest.js";
@@ -26,16 +38,13 @@ export interface LedgerEntry {
     /** The version these digests were taken at — the tag the artifact published
      *  under. */
     readonly version: string;
+    /** The publish destination base these digests were taken against
+     *  (`oci://ghcr.io/telorun`). Absent only in a ledger written before the base
+     *  was recorded at all. */
+    readonly registry?: string;
     readonly layers: LayerDigests;
 }
 export interface Ledger {
-    /**
-     * The publish destination base the digests were taken against
-     * (`oci://ghcr.io/telorun`). Absent in a workspace that has published nothing
-     * yet, which is why it is optional rather than required — but a `check` that
-     * has entries and no base cannot reproduce them, and says so.
-     */
-    readonly registry?: string;
     readonly modules: ReadonlyMap<ModuleKey, LedgerEntry>;
 }
 export declare class LedgerError extends Error {

package/dist/release/ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ledger.d.ts","sourceRoot":"","sources":["../../src/release/ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,eAAO,MAAM,WAAW,yBAAyB,CAAC;AAElD,MAAM,WAAW,WAAW;IAC1B;iBACa;IACb,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;CAC/B;AAED,MAAM,WAAW,MAAM;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;CACvD;AAED,qBAAa,WAAY,SAAQ,KAAK;CAAG;AAEzC,eAAO,MAAM,YAAY,EAAE,MAA+B,CAAC;AAE3D,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CA+D/D;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAkBtD"}
+{"version":3,"file":"ledger.d.ts","sourceRoot":"","sources":["../../src/release/ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAIH,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,eAAO,MAAM,WAAW,yBAAyB,CAAC;AAElD,MAAM,WAAW,WAAW;IAC1B;iBACa;IACb,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;+BAE2B;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;CAC/B;AAED,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;CACvD;AAED,qBAAa,WAAY,SAAQ,KAAK;CAAG;AAEzC,eAAO,MAAM,YAAY,EAAE,MAA+B,CAAC;AAE3D,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAmF/D;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAmBtD"}

package/dist/release/ledger.js

@@ -14,10 +14,22 @@
  * drift: it means nothing is published, which is the correct reading for a
  * module that has never shipped.
  *
- * **It records the registry base**, because canonicalizing a relative `imports:`
- * source writes the destination into the manifest layer — so the digests below
- * are digests *against that base*, and comparing them to digests taken against
- * another one would be comparing two different artifacts.
+ * **Every entry records its own registry base**, because canonicalizing a
+ * relative `imports:` source writes the destination into the manifest layer — so
+ * each digest is a digest *against that base*, and comparing it to one taken
+ * against another would be comparing two different artifacts.
+ *
+ * Per entry rather than one top-level base with per-entry deltas: a workspace
+ * whose `release.modules` entries each author a destination has no meaningful
+ * top-level base, an absent one already means *nothing has been published yet*,
+ * and the agreement check returns early on that — so the multi-destination
+ * workspace would be the one whose bases are never compared. The file is
+ * generated and never hand-maintained, so the redundancy costs nothing and it
+ * removes the "differs from what?" question and the absent-versus-unknown
+ * conflation together. A **top-level `registry:` is a legacy form the reader
+ * accepts and never writes**, applied to every entry: the credential-free PR
+ * gate reads whatever ledger is committed on the branch, and that stays in the
+ * old shape until a release regenerates it.
  */
 import { Document, parseDocument } from "yaml";
 import { isReleaseVersion } from "./bump-level.js";
@@ -45,13 +57,14 @@ export function parseLedger(text, where) {
             throw new LedgerError(`${where}: unknown field '${key}'. The ledger carries 'registry:' and 'modules:'.`);
         }
     }
-    const registry = record.registry;
-    if (registry !== undefined && typeof registry !== "string") {
+    // The legacy top-level base: read and applied to every entry, never written.
+    const inherited = record.registry;
+    if (inherited !== undefined && typeof inherited !== "string") {
         throw new LedgerError(`${where}: 'registry' must be the publish destination base, as a string.`);
     }
     const rawModules = record.modules;
     if (rawModules === undefined || rawModules === null)
-        return { ...(registry ? { registry } : {}), modules: new Map() };
+        return { modules: new Map() };
     if (typeof rawModules !== "object" || Array.isArray(rawModules)) {
         throw new LedgerError(`${where}: 'modules' must be a mapping of module path to entry.`);
     }
@@ -61,6 +74,16 @@ export function parseLedger(text, where) {
             throw new LedgerError(`${where}: entry '${key}' must be a mapping.`);
         }
         const entry = raw;
+        for (const field of Object.keys(entry)) {
+            if (field !== "version" && field !== "registry" && field !== "layers") {
+                throw new LedgerError(`${where}: entry '${key}' has unknown field '${field}'. An entry carries 'version:', ` +
+                    `'registry:' and 'layers:'.`);
+            }
+        }
+        if (entry.registry !== undefined && typeof entry.registry !== "string") {
+            throw new LedgerError(`${where}: entry '${key}' has a non-string 'registry'. It is the publish destination base ` +
+                `the digests beside it were taken against.`);
+        }
         if (!isReleaseVersion(entry.version)) {
             throw new LedgerError(`${where}: entry '${key}' has no major.minor.patch 'version'. The ledger records the ` +
                 `version each digest was taken at; without it the digest says nothing.`);
@@ -78,9 +101,14 @@ export function parseLedger(text, where) {
                 layers[layer] = digest;
             }
         }
-        modules.set(normalizeModuleKey(key), { version: entry.version, layers });
+        const registry = entry.registry ?? inherited;
+        modules.set(normalizeModuleKey(key), {
+            version: entry.version,
+            ...(registry ? { registry } : {}),
+            layers,
+        });
     }
-    return { ...(registry ? { registry } : {}), modules };
+    return { modules };
 }
 /**
  * Render the ledger.
@@ -96,12 +124,13 @@ export function serializeLedger(ledger) {
         const layers = {};
         for (const layer of Object.keys(entry.layers).sort())
             layers[layer] = entry.layers[layer];
-        modules[key] = { version: entry.version, layers };
+        modules[key] = {
+            version: entry.version,
+            ...(entry.registry ? { registry: entry.registry } : {}),
+            layers,
+        };
     }
-    const doc = new Document({
-        ...(ledger.registry ? { registry: ledger.registry } : {}),
-        modules,
-    });
+    const doc = new Document({ modules });
     return ("# Generated by `telo release apply` — what each module looks like as published.\n" +
         "# A cache of the registry's answer, so a PR gate needs no credentials.\n" +
         "# `telo release verify` reconciles it against the registry.\n" +