@telorun/cli 0.73.0 → 0.75.0

package/dist/bundle/manifest-text.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Reading and rewriting a module's `telo.yaml` on the way to the artifact.
+ *
+ * These three transforms sit between the author's manifest and the published
+ * one, and both gates that care about the published bytes — `telo publish` and
+ * `telo release` — go through them. They were inside the publish command, which
+ * is where a second copy would have appeared the moment anything else needed to
+ * know what a module ships.
+ */
+/**
+ * Resolve `include:` globs and inline each partial as an extra document, then
+ * drop the `include:` key.
+ *
+ * The declaring file does not exist in the artifact, which is why every
+ * module-relative path in a manifest is module-ROOT-relative rather than
+ * relative to the file it was written in.
+ */
+export declare function expandAndInlineIncludes(content: string, manifestDir: string): string;
+/** The owner doc's `files:` globs — the payload set the manifest cannot
+ *  otherwise name. Empty when none are declared. */
+export declare function readFilesPatterns(content: string): string[];
+/** The owner doc's `assets:` globs — the author-claimed subset of `files:` that
+ *  ships in the lazily materialized asset layer. */
+export declare function readAssetPatterns(content: string): string[];
+/** The owner doc's `metadata.version` — the tag this artifact publishes under,
+ *  and so the version every drift check compares against. */
+export declare function readOwnerVersion(content: string): string | undefined;
+//# sourceMappingURL=manifest-text.d.ts.map

package/dist/bundle/manifest-text.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-text.d.ts","sourceRoot":"","sources":["../../src/bundle/manifest-text.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAoDpF;AAED;oDACoD;AACpD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAE3D;AAED;oDACoD;AACpD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAE3D;AAED;6DAC6D;AAC7D,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKpE"}

package/dist/bundle/manifest-text.js

@@ -0,0 +1,92 @@
+/**
+ * Reading and rewriting a module's `telo.yaml` on the way to the artifact.
+ *
+ * These three transforms sit between the author's manifest and the published
+ * one, and both gates that care about the published bytes — `telo publish` and
+ * `telo release` — go through them. They were inside the publish command, which
+ * is where a second copy would have appeared the moment anything else needed to
+ * know what a module ships.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { defaultCustomTags } from "@telorun/templating";
+import { parseAllDocuments } from "yaml";
+import { selectFiles } from "./select-files.js";
+/**
+ * Resolve `include:` globs and inline each partial as an extra document, then
+ * drop the `include:` key.
+ *
+ * The declaring file does not exist in the artifact, which is why every
+ * module-relative path in a manifest is module-ROOT-relative rather than
+ * relative to the file it was written in.
+ */
+export function expandAndInlineIncludes(content, manifestDir) {
+    const docs = parseAllDocuments(content, { customTags: defaultCustomTags() });
+    const firstParsed = docs[0]?.toJSON();
+    if (!firstParsed || !Array.isArray(firstParsed.include) || firstParsed.include.length === 0) {
+        return content;
+    }
+    const patterns = firstParsed.include.filter((p) => typeof p === "string");
+    if (patterns.length === 0)
+        return content;
+    // A glob entry is matched with the shared `ignore` engine (gitignore
+    // semantics); a plain path is taken verbatim and validated to exist — an
+    // explicit `include:` of a missing file is an error, unlike a glob that
+    // simply matches nothing.
+    const hasGlobs = patterns.some((p) => /[*?{}\[\]!]/.test(p));
+    let resolvedFiles;
+    if (hasGlobs) {
+        resolvedFiles = selectFiles(manifestDir, patterns, { applyDefaultIgnore: false }).map((rel) => path.resolve(manifestDir, rel));
+    }
+    else {
+        resolvedFiles = [...new Set(patterns.map((p) => path.resolve(manifestDir, p)))];
+        const realManifestDir = fs.realpathSync(manifestDir) + path.sep;
+        for (const filePath of resolvedFiles) {
+            if (!fs.existsSync(filePath)) {
+                throw new Error(`Included file not found: ${filePath}`);
+            }
+            const realPath = fs.realpathSync(filePath);
+            if (!realPath.startsWith(realManifestDir)) {
+                throw new Error(`Include path '${filePath}' resolves outside the module directory. ` +
+                    `Publishing files from outside the module root is not allowed.`);
+            }
+        }
+    }
+    docs[0].deleteIn(["include"]);
+    let inlined = "";
+    for (const filePath of resolvedFiles) {
+        const partialContent = fs.readFileSync(filePath, "utf-8").trim();
+        if (!partialContent)
+            continue;
+        inlined += "\n---\n" + partialContent + "\n";
+    }
+    const serialized = docs.map((d) => d.toString()).join("---\n");
+    return serialized + inlined;
+}
+/** The owner doc's `files:` globs — the payload set the manifest cannot
+ *  otherwise name. Empty when none are declared. */
+export function readFilesPatterns(content) {
+    return readPatternField(content, "files");
+}
+/** The owner doc's `assets:` globs — the author-claimed subset of `files:` that
+ *  ships in the lazily materialized asset layer. */
+export function readAssetPatterns(content) {
+    return readPatternField(content, "assets");
+}
+/** The owner doc's `metadata.version` — the tag this artifact publishes under,
+ *  and so the version every drift check compares against. */
+export function readOwnerVersion(content) {
+    const docs = parseAllDocuments(content, { customTags: defaultCustomTags() });
+    const first = docs[0]?.toJSON();
+    const version = first?.metadata?.version;
+    return typeof version === "string" ? version : undefined;
+}
+function readPatternField(content, field) {
+    const docs = parseAllDocuments(content, { customTags: defaultCustomTags() });
+    const first = docs[0]?.toJSON();
+    const value = first?.[field];
+    if (!Array.isArray(value))
+        return [];
+    return value.filter((p) => typeof p === "string");
+}
+//# sourceMappingURL=manifest-text.js.map

package/dist/bundle/manifest-text.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-text.js","sourceRoot":"","sources":["../../src/bundle/manifest-text.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,WAAmB;IAC1E,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;IAC7E,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;IACtC,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5F,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,QAAQ,GAAa,WAAW,CAAC,OAAO,CAAC,MAAM,CACnD,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CACnD,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IAE1C,qEAAqE;IACrE,yEAAyE;IACzE,wEAAwE;IACxE,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,IAAI,aAAuB,CAAC;IAE5B,IAAI,QAAQ,EAAE,CAAC;QACb,aAAa,GAAG,WAAW,CAAC,WAAW,EAAE,QAAQ,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC5F,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAC/B,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEhF,MAAM,eAAe,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC;QAChE,KAAK,MAAM,QAAQ,IAAI,aAAa,EAAE,CAAC;YACrC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YAC3C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CACb,iBAAiB,QAAQ,2CAA2C;oBAClE,+DAA+D,CAClE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAE9B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,MAAM,QAAQ,IAAI,aAAa,EAAE,CAAC;QACrC,MAAM,cAAc,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACjE,IAAI,CAAC,cAAc;YAAE,SAAS;QAC9B,OAAO,IAAI,SAAS,GAAG,cAAc,GAAG,IAAI,CAAC;IAC/C,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/D,OAAO,UAAU,GAAG,OAAO,CAAC;AAC9B,CAAC;AAED;oDACoD;AACpD,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED;oDACoD;AACpD,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AAC7C,CAAC;AAED;6DAC6D;AAC7D,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAsD,CAAC;IACpF,MAAM,OAAO,GAAG,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC;IACzC,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe,EAAE,KAAyB;IAClE,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AAC1E,CAAC"}

package/dist/bundle/module-payload.d.ts

@@ -0,0 +1,157 @@
+/**
+ * Building a module's published payload — the one computation both gates run.
+ *
+ * `telo publish` pushes it and `telo release` digests it, and they have to be
+ * the same bytes or the ledger's number and the registry's number are answers to
+ * different questions. So there is one builder, and the publish command consumes
+ * it rather than carrying its own copy of the transform.
+ *
+ * ## What makes the bytes a pure function of the commit
+ *
+ * Three inputs used to leak in, and each is closed here:
+ *
+ * 1. **Pins were discovered, not authored.** Publish fetched each remote
+ *    dependency's published `telo.yaml` to derive its hash, best-effort — so one
+ *    commit produced different manifest bytes depending on network reachability.
+ *    An author's pin is now the input: `telo install` / `telo upgrade` write it,
+ *    and an unpinned remote import is refused here rather than resolved.
+ * 2. **Re-serialization was conditional** on at least one pin having been
+ *    written, so the same manifest serialized two ways depending on its own
+ *    content. It is unconditional now.
+ * 3. **A sibling's pin came from the registry.** An in-repo sibling is on disk,
+ *    so its published manifest is *derived* — recursively, through this same
+ *    builder — which is what lets a whole release batch be planned offline, with
+ *    post-bump versions the registry has never seen.
+ *
+ * The publish destination stays an input, because canonicalization writes it
+ * into the manifest. It is not derivable, so the ledger records which base its
+ * digests were taken against.
+ */
+import { type ArtifactSelector, type LayerRole } from "@telorun/analyzer";
+import { type PayloadFile } from "@telorun/kernel";
+import { type Partition } from "./partition-layers.js";
+/** A layer built from a working copy: what publish pushes and what the release
+ *  ledger digests. Mutable-shaped because the transport's own `PayloadLayer` is,
+ *  and the two are handed straight across. */
+export interface BuiltLayer {
+    role: LayerRole;
+    selector?: ArtifactSelector;
+    files: PayloadFile[];
+}
+export interface ModulePayload {
+    /** The `telo.yaml` that ships: canonicalized, pinned, includes inlined. */
+    readonly manifest: string;
+    readonly layers: BuiltLayer[];
+    readonly partition: Partition;
+    /**
+     * Absolute paths of every file the controller builds read — the module's own
+     * sources, the shared libraries they inline, their dependency tree. The
+     * release edge graph is built from these; nothing else can see what a bundle
+     * actually contains.
+     */
+    readonly buildInputs: readonly string[];
+    /**
+     * In-repo siblings this module imports relatively: the sibling's absolute
+     * manifest path (the release edge) and the ref the import canonicalized to
+     * (which publish checks resolves at its published location before pushing).
+     */
+    readonly relativeImports: readonly {
+        readonly manifestPath: string;
+        readonly ref: string;
+    }[];
+    /**
+     * Remote imports carrying an author-written pin, already split into the ref
+     * and the hash it claims.
+     *
+     * Split HERE because this is the only place both spellings are in hand: a
+     * scalar-form pin carries its hash as a `#sha256-…` fragment on the source,
+     * and the object form carries it as an `integrity:` sibling. A consumer handed
+     * only the ref can recover the first by re-splitting and the second not at all
+     * — which is exactly how the verification below came to be a silent no-op for
+     * every pin in this repo.
+     *
+     * Publish verifies these against the registry — fetch, compare, hard-fail on
+     * mismatch. A sibling-derived pin is deliberately not here: it was computed
+     * from local bytes the registry has not seen yet, and the batch pushes
+     * dependencies first precisely so it does not have to have.
+     */
+    readonly authoredPins: readonly {
+        readonly alias: string;
+        /** The ref with no integrity fragment — what the registry is asked for. */
+        readonly ref: string;
+        /** The hash the author committed. */
+        readonly integrity: string;
+    }[];
+}
+export interface PayloadBuilderOptions {
+    /** The read-only registry origin `registry://` refs resolve against. Not the
+     *  publish destination, which is per module and passed to `payload()`. */
+    readonly registryOrigin?: string;
+    /** Where the controller build cache lives. */
+    readonly cacheRoot: string;
+}
+/**
+ * One module's payload, memoized across a batch.
+ *
+ * Memoized because a release digests every module in a workspace and the
+ * standard library's import graph is dense — `modules/sql`'s published manifest
+ * is needed by five dependents to derive their pins, and re-deriving it per
+ * dependent would rebuild its controller each time.
+ */
+export declare class ModulePayloadBuilder {
+    private readonly options;
+    private readonly manifests;
+    private readonly payloads;
+    /** Manifest paths currently being derived, so an import cycle is reported
+     *  rather than overflowing the stack. */
+    private readonly deriving;
+    /**
+     * Where each manifest publishes.
+     *
+     * A ROOT's destination is an input — which repo a module publishes to is a
+     * policy no graph can answer, so the caller states it (the release derives it
+     * as `<base>/<directory name>`, the rule the OCI mirror has always used).
+     *
+     * A SIBLING's is *derived*: the parent's destination with the relative path
+     * applied, which is the transport's own rule and exactly what canonicalization
+     * writes into the manifest. That one is not a free choice — deriving it
+     * independently, from the directory name say, would work for this repo's
+     * layout and quietly disagree with the ref the artifact actually carries the
+     * moment a layout differs.
+     *
+     * When a module is reached both ways and the two answers differ,
+     * `claimDestination` refuses rather than picking one, because the manifest can
+     * only carry a single ref.
+     */
+    private readonly destinations;
+    constructor(options: PayloadBuilderOptions);
+    payload(manifestPath: string, destination: string): Promise<ModulePayload>;
+    /**
+     * The in-repo siblings this module imports relatively, without building a
+     * single controller.
+     *
+     * Publish ORDER needs only this — a dependency must be pushed before its
+     * dependents, because canonicalization writes the sibling's ref into the
+     * manifest and publish then hard-fails when it does not resolve — and running
+     * esbuild across the whole standard library to answer it would be minutes of
+     * work for a question the manifests already contain.
+     */
+    relativeImportsOf(manifestPath: string, destination: string): Promise<readonly {
+        manifestPath: string;
+        ref: string;
+    }[]>;
+    /** The published `telo.yaml` text alone — what a dependent needs to derive its
+     *  pin, without building the dependency's controller layers. */
+    publishedManifest(manifestPath: string): Promise<string>;
+    private claimDestination;
+    private destinationOf;
+    private deriveManifest;
+    /**
+     * Canonicalize, pin and inline — every rewrite that stands between the
+     * author's `telo.yaml` and the published one.
+     */
+    private transformManifest;
+    private siblingHash;
+    private buildPayload;
+}
+//# sourceMappingURL=module-payload.d.ts.map

package/dist/bundle/module-payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-payload.d.ts","sourceRoot":"","sources":["../../src/bundle/module-payload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAKL,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAmD,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAOpG,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAGxE;;8CAE8C;AAC9C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,SAAS,CAAC;IAChB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,KAAK,EAAE,WAAW,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,SAAS;QACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;KACtB,EAAE,CAAC;IACJ;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS;QAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,2EAA2E;QAC3E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,qCAAqC;QACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,EAAE,CAAC;CACL;AAED,MAAM,WAAW,qBAAqB;IACpC;8EAC0E;IAC1E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,8CAA8C;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,qBAAa,oBAAoB;IA2BnB,OAAO,CAAC,QAAQ,CAAC,OAAO;IA1BpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsC;IAChE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6C;IACtE;6CACyC;IACzC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAE9C;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;gBAE7B,OAAO,EAAE,qBAAqB;IAErD,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAUhF;;;;;;;;;OASG;IACG,iBAAiB,CACrB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,SAAS;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAM5D;oEACgE;IAC1D,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAgB9D,OAAO,CAAC,gBAAgB;IAYxB,OAAO,CAAC,aAAa;YAQP,cAAc;IAK5B;;;OAGG;YACW,iBAAiB;YAqEjB,WAAW;YAKX,YAAY;CA6D3B"}

package/dist/bundle/module-payload.js

@@ -0,0 +1,273 @@
+/**
+ * Building a module's published payload — the one computation both gates run.
+ *
+ * `telo publish` pushes it and `telo release` digests it, and they have to be
+ * the same bytes or the ledger's number and the registry's number are answers to
+ * different questions. So there is one builder, and the publish command consumes
+ * it rather than carrying its own copy of the transform.
+ *
+ * ## What makes the bytes a pure function of the commit
+ *
+ * Three inputs used to leak in, and each is closed here:
+ *
+ * 1. **Pins were discovered, not authored.** Publish fetched each remote
+ *    dependency's published `telo.yaml` to derive its hash, best-effort — so one
+ *    commit produced different manifest bytes depending on network reachability.
+ *    An author's pin is now the input: `telo install` / `telo upgrade` write it,
+ *    and an unpinned remote import is refused here rather than resolved.
+ * 2. **Re-serialization was conditional** on at least one pin having been
+ *    written, so the same manifest serialized two ways depending on its own
+ *    content. It is unconditional now.
+ * 3. **A sibling's pin came from the registry.** An in-repo sibling is on disk,
+ *    so its published manifest is *derived* — recursively, through this same
+ *    builder — which is what lets a whole release batch be planned offline, with
+ *    post-bump versions the registry has never seen.
+ *
+ * The publish destination stays an input, because canonicalization writes it
+ * into the manifest. It is not derivable, so the ledger records which base its
+ * digests were taken against.
+ */
+import { collectModuleFileClaims, DEFAULT_MANIFEST_FILENAME, sha256Base64Url, splitIntegrity, } from "@telorun/analyzer";
+import { buildControllerBundle, defaultTransportRegistry } from "@telorun/kernel";
+import { defaultCustomTags } from "@telorun/templating";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { parseAllDocuments } from "yaml";
+import { findModuleDoc, importSourceRefs } from "../commands/manifest-imports.js";
+import { expandAndInlineIncludes, readAssetPatterns, readFilesPatterns } from "./manifest-text.js";
+import { partitionLayers } from "./partition-layers.js";
+import { assertWithinModule, selectFiles } from "./select-files.js";
+/**
+ * One module's payload, memoized across a batch.
+ *
+ * Memoized because a release digests every module in a workspace and the
+ * standard library's import graph is dense — `modules/sql`'s published manifest
+ * is needed by five dependents to derive their pins, and re-deriving it per
+ * dependent would rebuild its controller each time.
+ */
+export class ModulePayloadBuilder {
+    options;
+    manifests = new Map();
+    payloads = new Map();
+    /** Manifest paths currently being derived, so an import cycle is reported
+     *  rather than overflowing the stack. */
+    deriving = new Set();
+    /**
+     * Where each manifest publishes.
+     *
+     * A ROOT's destination is an input — which repo a module publishes to is a
+     * policy no graph can answer, so the caller states it (the release derives it
+     * as `<base>/<directory name>`, the rule the OCI mirror has always used).
+     *
+     * A SIBLING's is *derived*: the parent's destination with the relative path
+     * applied, which is the transport's own rule and exactly what canonicalization
+     * writes into the manifest. That one is not a free choice — deriving it
+     * independently, from the directory name say, would work for this repo's
+     * layout and quietly disagree with the ref the artifact actually carries the
+     * moment a layout differs.
+     *
+     * When a module is reached both ways and the two answers differ,
+     * `claimDestination` refuses rather than picking one, because the manifest can
+     * only carry a single ref.
+     */
+    destinations = new Map();
+    constructor(options) {
+        this.options = options;
+    }
+    async payload(manifestPath, destination) {
+        const key = path.resolve(manifestPath);
+        this.claimDestination(key, destination);
+        const existing = this.payloads.get(key);
+        if (existing)
+            return existing;
+        const work = this.buildPayload(key);
+        this.payloads.set(key, work);
+        return work;
+    }
+    /**
+     * The in-repo siblings this module imports relatively, without building a
+     * single controller.
+     *
+     * Publish ORDER needs only this — a dependency must be pushed before its
+     * dependents, because canonicalization writes the sibling's ref into the
+     * manifest and publish then hard-fails when it does not resolve — and running
+     * esbuild across the whole standard library to answer it would be minutes of
+     * work for a question the manifests already contain.
+     */
+    async relativeImportsOf(manifestPath, destination) {
+        const key = path.resolve(manifestPath);
+        this.claimDestination(key, destination);
+        return (await this.transformManifest(key)).relativeImports;
+    }
+    /** The published `telo.yaml` text alone — what a dependent needs to derive its
+     *  pin, without building the dependency's controller layers. */
+    async publishedManifest(manifestPath) {
+        const key = path.resolve(manifestPath);
+        const existing = this.manifests.get(key);
+        if (existing)
+            return existing;
+        if (this.deriving.has(key)) {
+            throw new Error(`Import cycle through '${key}': a module's published manifest embeds a hash of its ` +
+                `dependency's, so a cycle has no fixed point.`);
+        }
+        this.deriving.add(key);
+        const work = this.deriveManifest(key).finally(() => this.deriving.delete(key));
+        this.manifests.set(key, work);
+        return work;
+    }
+    claimDestination(manifestPath, destination) {
+        const existing = this.destinations.get(manifestPath);
+        if (existing && existing !== destination) {
+            throw new Error(`'${manifestPath}' is being published to both '${existing}' and '${destination}'. ` +
+                `A module's destination is part of its published bytes — canonicalization writes it ` +
+                `into every relative import — so it cannot be two things in one batch.`);
+        }
+        this.destinations.set(manifestPath, destination);
+    }
+    destinationOf(manifestPath) {
+        const destination = this.destinations.get(manifestPath);
+        if (!destination) {
+            throw new Error(`no publish destination is known for '${manifestPath}'.`);
+        }
+        return destination;
+    }
+    async deriveManifest(manifestPath) {
+        const { text } = await this.transformManifest(manifestPath);
+        return text;
+    }
+    /**
+     * Canonicalize, pin and inline — every rewrite that stands between the
+     * author's `telo.yaml` and the published one.
+     */
+    async transformManifest(manifestPath) {
+        const manifestDir = path.dirname(manifestPath);
+        const original = fs.readFileSync(manifestPath, "utf8");
+        const docs = parseAllDocuments(original, { customTags: defaultCustomTags() });
+        const moduleDoc = findModuleDoc(docs);
+        const relativeImports = [];
+        const authoredPins = [];
+        if (moduleDoc) {
+            const destination = this.destinationOf(manifestPath);
+            const transport = defaultTransportRegistry(this.options.registryOrigin).forRef(destination);
+            if (!transport) {
+                throw new Error(`no transport owns publish destination '${destination}'`);
+            }
+            for (const entry of importSourceRefs(moduleDoc)) {
+                const source = entry.source;
+                if (!source.startsWith(".") && !source.startsWith("/")) {
+                    // A remote import. Its pin is authored state — the deliberate
+                    // statement "I am not affected until I choose to be" — so publishing
+                    // reads it and never invents one. Refusing an unpinned ref is what
+                    // keeps the bytes a function of the commit; it used to be resolved
+                    // over the network, or silently shipped unpinned when that failed.
+                    const { base, integrity } = splitIntegrity(source);
+                    const declared = integrity ?? entry.integrity;
+                    if (declared) {
+                        authoredPins.push({ alias: entry.alias, ref: base, integrity: declared });
+                        continue;
+                    }
+                    throw new Error(`import '${entry.alias}' points at '${source}' with no integrity pin. ` +
+                        `A pin is written when the dependency is added or moved — run ` +
+                        `\`telo install\` or \`telo upgrade\` in ${path.basename(manifestDir)} — so that ` +
+                        `what this artifact embeds is decided by its author rather than by whatever the ` +
+                        `registry happened to serve at publish time.`);
+                }
+                const siblingManifest = resolveSiblingManifest(manifestDir, source);
+                const version = readSiblingVersion(siblingManifest, source);
+                const ref = transport.canonicalizeSiblingRef(destination, source, version);
+                relativeImports.push({ manifestPath: siblingManifest, ref });
+                this.claimDestination(siblingManifest, transport.source.resolveRelative(destination, source));
+                // The sibling's pin comes from the sibling's own published bytes, in
+                // topological order — never from the registry, which has not seen the
+                // post-bump version this batch is planning.
+                const hash = await this.siblingHash(siblingManifest);
+                moduleDoc.setIn(entry.path, `${ref}#${hash}`);
+            }
+        }
+        // Unconditional. Whether a manifest was rewritten is a property of its own
+        // content, and letting it decide the serializer meant one commit produced two
+        // different byte sequences for the same document.
+        const canonical = docs.map((doc) => doc.toString()).join("---\n");
+        return {
+            text: expandAndInlineIncludes(canonical, manifestDir),
+            relativeImports,
+            authoredPins,
+        };
+    }
+    async siblingHash(siblingManifest) {
+        const published = await this.publishedManifest(siblingManifest);
+        return `sha256-${await sha256Base64Url(new TextEncoder().encode(published))}`;
+    }
+    async buildPayload(manifestPath) {
+        const manifestDir = path.dirname(manifestPath);
+        const { text: manifest, relativeImports, authoredPins } = await this.transformManifest(manifestPath);
+        const claims = collectModuleFileClaims(manifest);
+        const partition = partitionLayers(claims, selectFiles(manifestDir, readFilesPatterns(manifest)), readAssetPatterns(manifest));
+        // Controller entry points are BUILT, not read: `path=` names a gitignored
+        // artifact that may not exist at all on a fresh clone, and reading a stale
+        // one would digest and ship bytes other than the source the manifest says
+        // they came from.
+        //
+        // This runs BEFORE the payload guard, because the guard's job is to reject a
+        // file that will not be there when the artifact is read — and an entry point
+        // this loop just produced WILL be there. Checking first was a latent break:
+        // on a checkout with no `.mjs` files, publish refused before the builder ran
+        // and told the author to run a build step this design removed.
+        const built = new Map();
+        const buildInputs = new Set();
+        for (const claim of claims) {
+            if (claim.role !== "controller" || !claim.localPath)
+                continue;
+            const entry = path.resolve(manifestDir, claim.localPath);
+            if (!fs.existsSync(entry)) {
+                throw new Error(`controller source '${claim.localPath}' does not exist (from ${claim.origin}).`);
+            }
+            const bundle = await buildControllerBundle(entry, this.options.cacheRoot);
+            built.set(claim.path, fs.readFileSync(bundle.path));
+            for (const input of bundle.inputs)
+                buildInputs.add(input);
+        }
+        assertWithinModule(manifestDir, partition.layers.flatMap((layer) => layer.files), new Set(built.keys()));
+        const layers = partition.layers.map((layer) => ({
+            role: layer.role,
+            ...(layer.selector ? { selector: layer.selector } : {}),
+            files: layer.files.map((rel) => ({
+                name: rel,
+                content: built.get(rel) ?? fs.readFileSync(path.resolve(manifestDir, rel)),
+            })),
+        }));
+        return {
+            manifest,
+            layers,
+            partition,
+            buildInputs: [...buildInputs],
+            relativeImports,
+            authoredPins,
+        };
+    }
+}
+/** A relative `imports:` source resolved to the sibling's `telo.yaml`. */
+function resolveSiblingManifest(manifestDir, source) {
+    const resolved = path.resolve(manifestDir, source);
+    try {
+        if (fs.statSync(resolved).isDirectory()) {
+            return path.join(resolved, DEFAULT_MANIFEST_FILENAME);
+        }
+    }
+    catch {
+        throw new Error(`import source '${source}' does not resolve to a file or directory on disk.`);
+    }
+    return resolved;
+}
+function readSiblingVersion(siblingManifest, source) {
+    const first = parseAllDocuments(fs.readFileSync(siblingManifest, "utf8"), {
+        customTags: defaultCustomTags(),
+    })[0]?.toJSON();
+    const version = first?.metadata?.version;
+    if (typeof version !== "string") {
+        throw new Error(`import source '${source}' (resolved: '${siblingManifest}') has no metadata.version, ` +
+            `which is what a canonicalized ref names it by.`);
+    }
+    return version;
+}
+//# sourceMappingURL=module-payload.js.map

package/dist/bundle/module-payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-payload.js","sourceRoot":"","sources":["../../src/bundle/module-payload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,eAAe,EACf,cAAc,GAGf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAoB,MAAM,iBAAiB,CAAC;AACpG,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAClF,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACnG,OAAO,EAAE,eAAe,EAAkB,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAiEpE;;;;;;;GAOG;AACH,MAAM,OAAO,oBAAoB;IA2BF;IA1BZ,SAAS,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC/C,QAAQ,GAAG,IAAI,GAAG,EAAkC,CAAC;IACtE;6CACyC;IACxB,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAE9C;;;;;;;;;;;;;;;;;OAiBG;IACc,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE1D,YAA6B,OAA8B;QAA9B,YAAO,GAAP,OAAO,CAAuB;IAAG,CAAC;IAE/D,KAAK,CAAC,OAAO,CAAC,YAAoB,EAAE,WAAmB;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACvC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,iBAAiB,CACrB,YAAoB,EACpB,WAAmB;QAEnB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACvC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACxC,OAAO,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC;IAC7D,CAAC;IAED;oEACgE;IAChE,KAAK,CAAC,iBAAiB,CAAC,YAAoB;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,yBAAyB,GAAG,wDAAwD;gBAClF,8CAA8C,CACjD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,gBAAgB,CAAC,YAAoB,EAAE,WAAmB;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACrD,IAAI,QAAQ,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,IAAI,YAAY,iCAAiC,QAAQ,UAAU,WAAW,KAAK;gBACjF,qFAAqF;gBACrF,uEAAuE,CAC1E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACnD,CAAC;IAEO,aAAa,CAAC,YAAoB;QACxC,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,wCAAwC,YAAY,IAAI,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,YAAoB;QAC/C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,iBAAiB,CAAC,YAAoB;QAKlD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;QAC9E,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,eAAe,GAA4C,EAAE,CAAC;QACpE,MAAM,YAAY,GAAwD,EAAE,CAAC;QAE7E,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;YACrD,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC5F,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,0CAA0C,WAAW,GAAG,CAAC,CAAC;YAC5E,CAAC;YAED,KAAK,MAAM,KAAK,IAAI,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;gBAC5B,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACvD,8DAA8D;oBAC9D,qEAAqE;oBACrE,mEAAmE;oBACnE,mEAAmE;oBACnE,mEAAmE;oBACnE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;oBACnD,MAAM,QAAQ,GAAG,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC;oBAC9C,IAAI,QAAQ,EAAE,CAAC;wBACb,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;wBAC1E,SAAS;oBACX,CAAC;oBACD,MAAM,IAAI,KAAK,CACb,WAAW,KAAK,CAAC,KAAK,gBAAgB,MAAM,2BAA2B;wBACrE,+DAA+D;wBAC/D,2CAA2C,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,aAAa;wBAClF,iFAAiF;wBACjF,6CAA6C,CAChD,CAAC;gBACJ,CAAC;gBAED,MAAM,eAAe,GAAG,sBAAsB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;gBACpE,MAAM,OAAO,GAAG,kBAAkB,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;gBAC5D,MAAM,GAAG,GAAG,SAAS,CAAC,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC3E,eAAe,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC7D,IAAI,CAAC,gBAAgB,CACnB,eAAe,EACf,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC,CACtD,CAAC;gBACF,qEAAqE;gBACrE,sEAAsE;gBACtE,4CAA4C;gBAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;gBACrD,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,8EAA8E;QAC9E,kDAAkD;QAClD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClE,OAAO;YACL,IAAI,EAAE,uBAAuB,CAAC,SAAS,EAAE,WAAW,CAAC;YACrD,eAAe;YACf,YAAY;SACb,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,eAAuB;QAC/C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC;QAChE,OAAO,UAAU,MAAM,eAAe,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;IAChF,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,YAAoB;QAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC/C,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,YAAY,EAAE,GACrD,MAAM,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAE7C,MAAM,MAAM,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,eAAe,CAC/B,MAAM,EACN,WAAW,CAAC,WAAW,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC,EACrD,iBAAiB,CAAC,QAAQ,CAAC,CAC5B,CAAC;QAEF,0EAA0E;QAC1E,2EAA2E;QAC3E,0EAA0E;QAC1E,kBAAkB;QAClB,EAAE;QACF,6EAA6E;QAC7E,6EAA6E;QAC7E,4EAA4E;QAC5E,6EAA6E;QAC7E,+DAA+D;QAC/D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;QAC5C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,KAAK,CAAC,SAAS;gBAAE,SAAS;YAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YACzD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,sBAAsB,KAAK,CAAC,SAAS,0BAA0B,KAAK,CAAC,MAAM,IAAI,CAChF,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC1E,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACpD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM;gBAAE,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5D,CAAC;QAED,kBAAkB,CAChB,WAAW,EACX,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAChD,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CACtB,CAAC;QAEF,MAAM,MAAM,GAAiB,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC5D,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC/B,IAAI,EAAE,GAAG;gBACT,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;aAC3E,CAAC,CAAC;SACJ,CAAC,CAAC,CAAC;QAEJ,OAAO;YACL,QAAQ;YACR,MAAM;YACN,SAAS;YACT,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC;YAC7B,eAAe;YACf,YAAY;SACb,CAAC;IACJ,CAAC;CACF;AAED,0EAA0E;AAC1E,SAAS,sBAAsB,CAAC,WAAmB,EAAE,MAAc;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,oDAAoD,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,kBAAkB,CAAC,eAAuB,EAAE,MAAc;IACjE,MAAM,KAAK,GAAG,iBAAiB,CAAC,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,EAAE;QACxE,UAAU,EAAE,iBAAiB,EAAE;KAChC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAsD,CAAC;IACpE,MAAM,OAAO,GAAG,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC;IACzC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,kBAAkB,MAAM,iBAAiB,eAAe,8BAA8B;YACpF,gDAAgD,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/bundle/payload-drift.d.ts

@@ -1,5 +1,4 @@
-import { type ArtifactSelector } from "@telorun/analyzer";
-import { type PayloadFile } from "@telorun/kernel";
+import { type LayerDigests } from "@telorun/analyzer";
 /**
  * Does the payload we are about to publish differ from what is already published
  * at this `metadata.version`?
@@ -27,18 +26,25 @@ export interface LayerDrift {
      *  the build no longer produces this layer. */
     built?: string;
 }
-export interface BuiltLayer {
-    role: string;
-    selector?: ArtifactSelector;
-    files: PayloadFile[];
-}
+import type { BuiltLayer } from "./module-payload.js";
+export type { BuiltLayer };
+/**
+ * The per-layer integrity the registry serves at `<destination>@<version>`, or
+ * `null` when nothing is published there.
+ *
+ * The **registry's own numbers**, read off the published `layers:` index rather
+ * than recomputed from anything local. That is what makes it the authority half
+ * of the ledger's cache: `telo release verify` compares the committed digests
+ * against these, and `--write` records these.
+ */
+export declare function readPublishedDigests(destination: string, version: string, registry: string): Promise<LayerDigests | null>;
 /**
  * Compare the built payload against the published one at the same version.
  *
  * Returns `null` when nothing is published at that ref — a new version, so there
  * is nothing to disagree with. Returns an empty array when the payloads match.
  */
-export declare function findPayloadDrift(destination: string, version: string, built: BuiltLayer[], registry: string): Promise<LayerDrift[] | null>;
+export declare function findPayloadDrift(destination: string, version: string, built: readonly BuiltLayer[], registry: string): Promise<LayerDrift[] | null>;
 /** The message shown when the gate fires. It names the version to bump, because
  *  that — not a re-push — is the fix: overwriting a published tag would change
  *  what an existing pinned import resolves to. */

package/dist/bundle/payload-drift.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload-drift.d.ts","sourceRoot":"","sources":["../../src/bundle/payload-drift.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAmD,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAGpG;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;+EAC2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;mDAC+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,KAAK,EAAE,WAAW,EAAE,CAAC;CACtB;AA2DD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,UAAU,EAAE,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,CA6B9B;AAED;;kDAEkD;AAClD,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,CAc7F"}
+{"version":3,"file":"payload-drift.d.ts","sourceRoot":"","sources":["../../src/bundle/payload-drift.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAC;AAI3B;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;+EAC2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;mDAC+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAKD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,YAAY,EAAE,UAAU,EAAE,CAAC;AA2D3B;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAQ9B;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,SAAS,UAAU,EAAE,EAC5B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,CA6B9B;AAED;;kDAEkD;AAClD,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,CAe7F"}