@telorun/cli 0.46.0 → 0.48.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/registry-hash.d.ts +11 -5
- package/dist/registry-hash.d.ts.map +1 -1
- package/dist/registry-hash.js +15 -22
- package/dist/registry-hash.js.map +1 -1
- package/package.json +5 -5
package/dist/registry-hash.d.ts
CHANGED
|
@@ -1,10 +1,16 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* Fetch a remote import's published `telo.yaml` and return its integrity hash
|
|
3
|
-
* (`sha256-<base64url>`).
|
|
4
|
-
*
|
|
5
|
-
*
|
|
6
|
-
*
|
|
7
|
-
*
|
|
3
|
+
* (`sha256-<base64url>`). Used by `telo publish` (import pinning) and `telo
|
|
4
|
+
* upgrade` (re-pin on version change). Throws when no transport owns the ref or
|
|
5
|
+
* the fetch fails — callers decide whether that is fatal (`--frozen`) or
|
|
6
|
+
* best-effort.
|
|
7
|
+
*
|
|
8
|
+
* Dispatch is the transport registry, never a scheme branch here: each
|
|
9
|
+
* transport hashes exactly what its own `read()` verifies (registry/HTTP the
|
|
10
|
+
* raw bytes, OCI the UTF-8 text extracted from the tar layer), so a pin written
|
|
11
|
+
* at publish always matches at import. A caller-side branch cannot know which,
|
|
12
|
+
* and silently degrades the moment a transport is added — that is precisely how
|
|
13
|
+
* `oci://` refs came to be published unpinned.
|
|
8
14
|
*/
|
|
9
15
|
export declare function fetchManifestHash(registryUrl: string, ref: string): Promise<string>;
|
|
10
16
|
//# sourceMappingURL=registry-hash.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"registry-hash.d.ts","sourceRoot":"","sources":["../src/registry-hash.ts"],"names":[],"mappings":"AAEA
|
|
1
|
+
{"version":3,"file":"registry-hash.d.ts","sourceRoot":"","sources":["../src/registry-hash.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMzF"}
|
package/dist/registry-hash.js
CHANGED
|
@@ -1,30 +1,23 @@
|
|
|
1
|
-
import {
|
|
1
|
+
import { defaultTransportRegistry } from "@telorun/kernel";
|
|
2
2
|
/**
|
|
3
3
|
* Fetch a remote import's published `telo.yaml` and return its integrity hash
|
|
4
|
-
* (`sha256-<base64url>`).
|
|
5
|
-
*
|
|
6
|
-
*
|
|
7
|
-
*
|
|
8
|
-
*
|
|
4
|
+
* (`sha256-<base64url>`). Used by `telo publish` (import pinning) and `telo
|
|
5
|
+
* upgrade` (re-pin on version change). Throws when no transport owns the ref or
|
|
6
|
+
* the fetch fails — callers decide whether that is fatal (`--frozen`) or
|
|
7
|
+
* best-effort.
|
|
8
|
+
*
|
|
9
|
+
* Dispatch is the transport registry, never a scheme branch here: each
|
|
10
|
+
* transport hashes exactly what its own `read()` verifies (registry/HTTP the
|
|
11
|
+
* raw bytes, OCI the UTF-8 text extracted from the tar layer), so a pin written
|
|
12
|
+
* at publish always matches at import. A caller-side branch cannot know which,
|
|
13
|
+
* and silently degrades the moment a transport is added — that is precisely how
|
|
14
|
+
* `oci://` refs came to be published unpinned.
|
|
9
15
|
*/
|
|
10
16
|
export async function fetchManifestHash(registryUrl, ref) {
|
|
11
|
-
const
|
|
12
|
-
|
|
13
|
-
if (isRegistryRef(ref)) {
|
|
14
|
-
const { modulePath, version } = parseModuleRef(ref);
|
|
15
|
-
url = `${trimmed}/${modulePath}/${version}/telo.yaml`;
|
|
16
|
-
}
|
|
17
|
-
else if (ref.startsWith("http://") || ref.startsWith("https://")) {
|
|
18
|
-
url = ref.includes(".yaml") ? ref : `${ref.replace(/\/+$/, "")}/telo.yaml`;
|
|
19
|
-
}
|
|
20
|
-
else {
|
|
17
|
+
const transport = defaultTransportRegistry(registryUrl).forRef(ref);
|
|
18
|
+
if (!transport) {
|
|
21
19
|
throw new Error(`cannot hash non-remote import '${ref}'`);
|
|
22
20
|
}
|
|
23
|
-
|
|
24
|
-
if (!res.ok) {
|
|
25
|
-
throw new Error(`fetch ${url}: ${res.status} ${res.statusText}`);
|
|
26
|
-
}
|
|
27
|
-
const bytes = new Uint8Array(await res.arrayBuffer());
|
|
28
|
-
return `sha256-${await sha256Base64Url(bytes)}`;
|
|
21
|
+
return transport.manifestHash(ref);
|
|
29
22
|
}
|
|
30
23
|
//# sourceMappingURL=registry-hash.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"registry-hash.js","sourceRoot":"","sources":["../src/registry-hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"registry-hash.js","sourceRoot":"","sources":["../src/registry-hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAE3D;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,WAAmB,EAAE,GAAW;IACtE,MAAM,SAAS,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,GAAG,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@telorun/cli",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.48.0",
|
|
4
4
|
"description": "Telo CLI - Command-line interface for the Telo runtime.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"telo",
|
|
@@ -34,11 +34,11 @@
|
|
|
34
34
|
"dist"
|
|
35
35
|
],
|
|
36
36
|
"dependencies": {
|
|
37
|
-
"@telorun/analyzer": "0.
|
|
37
|
+
"@telorun/analyzer": "0.38.0",
|
|
38
38
|
"@telorun/glob": "0.2.0",
|
|
39
|
-
"@telorun/ide-support": "0.4.
|
|
40
|
-
"@telorun/kernel": "0.
|
|
41
|
-
"@telorun/sdk": "0.
|
|
39
|
+
"@telorun/ide-support": "0.4.44",
|
|
40
|
+
"@telorun/kernel": "0.48.0",
|
|
41
|
+
"@telorun/sdk": "0.48.0",
|
|
42
42
|
"@telorun/templating": "0.10.1",
|
|
43
43
|
"dotenv": "^17.4.0",
|
|
44
44
|
"packageurl-js": "^2.0.1",
|