@telorun/ide-support 0.8.0 → 0.10.0

package/dist/definition/resolve-export-chain.js

@@ -0,0 +1,89 @@
+import { parseExportEntry, resolveExportedKinds, } from "@telorun/analyzer";
+import { locateKindDefinition, locateResource, moduleDoc, moduleFiles, moduleName, } from "./manifest-navigation.js";
+/** One `exports.*` list as authored. `undefined` means the block is ABSENT,
+ *  which is not the same as an empty list — the distinction is the gate itself,
+ *  and it is load-bearing in both halves (`AliasResolver.registerImport`,
+ *  `ModuleContext.buildExportTable`), so it must survive here too. */
+function exportList(mod, block) {
+    const exports = moduleDoc(mod)?.exports;
+    const list = exports?.[block];
+    if (!Array.isArray(list))
+        return undefined;
+    return list.filter((e) => typeof e === "string");
+}
+/** Every loaded module keyed by its `metadata.name` — what `resolveExportedKinds`
+ *  speaks, since a canonical kind names its owning module rather than a URL. */
+function modulesByName(graph) {
+    const byName = new Map();
+    for (const mod of graph.modules.values()) {
+        const name = moduleName(mod);
+        if (name && !byName.has(name))
+            byName.set(name, mod);
+    }
+    return byName;
+}
+/** Resolve the kind suffix `name` exported by the module at `targetSource` to
+ *  the `Telo.Definition` / `Telo.Abstract` doc that owns it.
+ *
+ *  The gate and the transitive re-export chain come from the analyzer's own
+ *  `resolveExportedKinds` fixpoint rather than a local walk, so navigation
+ *  cannot disagree with `telo check` about what an import exposes — including
+ *  the two rules a hand-rolled walk gets wrong: `exports.kinds: []` gates
+ *  everything while an absent block gates nothing, and a re-export FROM an
+ *  ungated module resolves straight to it. */
+export function resolveExportedKind(graph, targetSource, name) {
+    const target = graph.modules.get(targetSource);
+    if (!target)
+        return undefined;
+    // No `exports.kinds` block → every kind the module defines is importable (the
+    // legacy permissive default the kernel still honors for already-published
+    // versions). The fixpoint builds tables only from declared entries, so an
+    // ungated module has none to look this up in — and this is also the cheap
+    // path, so it settles before anything is indexed.
+    if (exportList(target, "kinds") === undefined) {
+        return locateKindDefinition(moduleFiles(target), name);
+    }
+    const targetName = moduleName(target);
+    if (!targetName)
+        return undefined;
+    const byName = modulesByName(graph);
+    const tables = resolveExportedKinds([...byName].map(([module, mod]) => ({ module, exportsKinds: exportList(mod, "kinds") })), (module, alias) => {
+        const owner = byName.get(module)?.owner.source;
+        return owner ? graph.importEdges.get(owner)?.get(alias)?.targetModuleName ?? undefined : undefined;
+    });
+    const canonical = tables.get(targetName)?.get(name);
+    if (!canonical)
+        return undefined;
+    // `<owningModule>.<Kind>` — a re-export resolves to its true owner, so the
+    // jump lands where the kind is actually declared, however many hops away.
+    const dot = canonical.lastIndexOf(".");
+    const owner = byName.get(canonical.slice(0, dot));
+    return owner ? locateKindDefinition(moduleFiles(owner), canonical.slice(dot + 1)) : undefined;
+}
+/** Resolve the instance `name` exported by the module at `targetSource`,
+ *  following `<Alias>.<name>` re-exports transitively. `seen` bounds cyclic
+ *  import graphs.
+ *
+ *  Unlike kinds there is no permissive default: the kernel reads
+ *  `exports.resources ?? []` and builds its export table strictly from that, so
+ *  an absent block exports nothing and an unlisted name is an
+ *  `UNRESOLVED_REFERENCE` — navigating to it would tell the author a wiring is
+ *  real that the analyzer rejects. */
+export function resolveExportedResource(graph, targetSource, name, seen = new Set()) {
+    if (seen.has(targetSource))
+        return undefined;
+    seen.add(targetSource);
+    const target = graph.modules.get(targetSource);
+    if (!target)
+        return undefined;
+    const entries = (exportList(target, "resources") ?? []).map(parseExportEntry);
+    const entry = entries.find((e) => e.name === name);
+    if (!entry)
+        return undefined;
+    // `Self.<name>` names the declaring module's own instance, exactly as a bare
+    // name does — `ModuleContext.buildExportTable` treats the two alike.
+    if (!entry.alias || entry.alias === "Self")
+        return locateResource(moduleFiles(target), name);
+    const edge = graph.importEdges.get(target.owner.source)?.get(entry.alias);
+    return edge ? resolveExportedResource(graph, edge.targetSource, name, seen) : undefined;
+}

package/dist/definition/resolve-kind-target.d.ts

@@ -0,0 +1,26 @@
+import type { LoadedGraph, LoadedModule } from "@telorun/analyzer";
+import type { DefinitionResult } from "../types.js";
+import type { ResolvedCursor } from "../completions/resolve-node.js";
+import type { AliasQualifiedValue } from "./alias-qualified-value.js";
+/** Whether the cursor sits in a slot whose value is an alias-qualified kind.
+ *
+ *  `x-telo-ref` is an `x-telo-*` annotation, unambiguous wherever it appears.
+ *  `extends:` is only a kind at the top level of a definition doc, so it is
+ *  gated on both. `kind:` is positional by nature: a map carrying a
+ *  `<Alias>.<Kind>` value under `kind` IS an inline resource declaration as far
+ *  as the analyzer is concerned too (`resourceKindOf`), so there is no further
+ *  structure to check — an unresolvable value simply navigates nowhere.
+ *
+ *  `capability:` is deliberately absent — its values are kernel built-ins with
+ *  no manifest to jump to (hover documents them instead). */
+export declare function isKindSlot(resolved: ResolvedCursor): boolean;
+/** Resolve an alias-qualified kind (`Http.Server`) to the `Telo.Definition` /
+ *  `Telo.Abstract` doc that registers it, or — when the cursor sits on the
+ *  alias — to the import that declares the alias.
+ *
+ *  `Self.<Kind>` is the declaring module's own kind; `Telo.<Kind>` is a kernel
+ *  built-in with no manifest, so it resolves to nothing. Across an import the
+ *  walk honors `exports.kinds` and follows `<Inner>.<Kind>` re-exports to the
+ *  owning module, matching what the kernel resolves the kind to at runtime. */
+export declare function resolveKindTarget(graph: LoadedGraph, currentModule: LoadedModule, kind: AliasQualifiedValue): DefinitionResult | undefined;
+//# sourceMappingURL=resolve-kind-target.d.ts.map

package/dist/definition/resolve-kind-target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-kind-target.d.ts","sourceRoot":"","sources":["../../src/definition/resolve-kind-target.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAMtE;;;;;;;;;;6DAU6D;AAC7D,wBAAgB,UAAU,CAAC,QAAQ,EAAE,cAAc,GAAG,OAAO,CAQ5D;AAED;;;;;;;+EAO+E;AAC/E,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,WAAW,EAClB,aAAa,EAAE,YAAY,EAC3B,IAAI,EAAE,mBAAmB,GACxB,gBAAgB,GAAG,SAAS,CAkB9B"}

package/dist/definition/resolve-kind-target.js

@@ -0,0 +1,51 @@
+import { locateImport, locateKindDefinition, moduleFiles } from "./manifest-navigation.js";
+import { resolveExportedKind } from "./resolve-export-chain.js";
+const DEFINITION_DOC_KINDS = new Set(["Telo.Definition", "Telo.Abstract"]);
+/** Whether the cursor sits in a slot whose value is an alias-qualified kind.
+ *
+ *  `x-telo-ref` is an `x-telo-*` annotation, unambiguous wherever it appears.
+ *  `extends:` is only a kind at the top level of a definition doc, so it is
+ *  gated on both. `kind:` is positional by nature: a map carrying a
+ *  `<Alias>.<Kind>` value under `kind` IS an inline resource declaration as far
+ *  as the analyzer is concerned too (`resourceKindOf`), so there is no further
+ *  structure to check — an unresolvable value simply navigates nowhere.
+ *
+ *  `capability:` is deliberately absent — its values are kernel built-ins with
+ *  no manifest to jump to (hover documents them instead). */
+export function isKindSlot(resolved) {
+    const key = resolved.path[resolved.path.length - 1];
+    if (key === "x-telo-ref" || key === "kind")
+        return true;
+    return (key === "extends" &&
+        resolved.path.length === 1 &&
+        DEFINITION_DOC_KINDS.has(resolved.docKind ?? ""));
+}
+/** Resolve an alias-qualified kind (`Http.Server`) to the `Telo.Definition` /
+ *  `Telo.Abstract` doc that registers it, or — when the cursor sits on the
+ *  alias — to the import that declares the alias.
+ *
+ *  `Self.<Kind>` is the declaring module's own kind; `Telo.<Kind>` is a kernel
+ *  built-in with no manifest, so it resolves to nothing. Across an import the
+ *  walk honors `exports.kinds` and follows `<Inner>.<Kind>` re-exports to the
+ *  owning module, matching what the kernel resolves the kind to at runtime. */
+export function resolveKindTarget(graph, currentModule, kind) {
+    const { alias, name, onAlias } = kind;
+    if (alias === undefined) {
+        // The legacy `<namespace>/<module>#<Kind>` identity form of `x-telo-ref`
+        // still resolves for already-published module versions, but it names a
+        // module this manifest need not import, so there is no alias to follow.
+        if (name.includes("#"))
+            return undefined;
+        return locateKindDefinition(moduleFiles(currentModule), name);
+    }
+    if (alias === "Self")
+        return locateKindDefinition(moduleFiles(currentModule), name);
+    if (alias === "Telo")
+        return undefined;
+    if (onAlias)
+        return locateImport(currentModule, alias);
+    const edge = graph.importEdges.get(currentModule.owner.source)?.get(alias);
+    if (!edge)
+        return undefined;
+    return resolveExportedKind(graph, edge.targetSource, name);
+}

package/dist/definition/resolve-ref-target.d.ts

@@ -0,0 +1,14 @@
+import type { LoadedGraph, LoadedModule } from "@telorun/analyzer";
+import type { DefinitionResult } from "../types.js";
+import type { AliasQualifiedValue } from "./alias-qualified-value.js";
+/** Resolve a `!ref` target to the resource instance it names.
+ *
+ *  The grammar mirrors `resolveRefSentinels`: a bare name (or `Self.name`) is a
+ *  local resource in the current module; `Alias.name` is an exported instance of
+ *  the module the import `Alias` points at, followed transitively through
+ *  re-exports and gated on each module's `exports.resources`. The alias half
+ *  navigates to the import that declares it. Returns `undefined` when the target
+ *  can't be found (a scope-local name, an instance the target does not export,
+ *  or an import that failed to load). */
+export declare function resolveRefTarget(graph: LoadedGraph, currentModule: LoadedModule, ref: AliasQualifiedValue): DefinitionResult | undefined;
+//# sourceMappingURL=resolve-ref-target.d.ts.map

package/dist/definition/resolve-ref-target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-ref-target.d.ts","sourceRoot":"","sources":["../../src/definition/resolve-ref-target.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAItE;;;;;;;;yCAQyC;AACzC,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,WAAW,EAClB,aAAa,EAAE,YAAY,EAC3B,GAAG,EAAE,mBAAmB,GACvB,gBAAgB,GAAG,SAAS,CAc9B"}

package/dist/definition/resolve-ref-target.js

@@ -0,0 +1,25 @@
+import { locateImport, locateResource, moduleFiles } from "./manifest-navigation.js";
+import { resolveExportedResource } from "./resolve-export-chain.js";
+/** Resolve a `!ref` target to the resource instance it names.
+ *
+ *  The grammar mirrors `resolveRefSentinels`: a bare name (or `Self.name`) is a
+ *  local resource in the current module; `Alias.name` is an exported instance of
+ *  the module the import `Alias` points at, followed transitively through
+ *  re-exports and gated on each module's `exports.resources`. The alias half
+ *  navigates to the import that declares it. Returns `undefined` when the target
+ *  can't be found (a scope-local name, an instance the target does not export,
+ *  or an import that failed to load). */
+export function resolveRefTarget(graph, currentModule, ref) {
+    const { alias, name, onAlias } = ref;
+    if (alias === undefined || alias === "Self") {
+        // `Self` names the declaring module itself — there is no import to jump to,
+        // so the alias half resolves like the name half.
+        return locateResource(moduleFiles(currentModule), name);
+    }
+    if (onAlias)
+        return locateImport(currentModule, alias);
+    const edge = graph.importEdges.get(currentModule.owner.source)?.get(alias);
+    if (!edge)
+        return undefined;
+    return resolveExportedResource(graph, edge.targetSource, name);
+}

package/dist/import-upgrades/build-import-upgrades.d.ts

@@ -1,13 +1,28 @@
 import { type AstDocument, type Range } from "@telorun/analyzer";
+/** One version of a module, as the hub reports it.
+ *
+ *  `integrity` is the import pin for exactly this version (`sha256-<base64url>`
+ *  over whatever the owning transport verifies its own reads against). It is
+ *  absent for a version the hub tracked before it recorded pins, and for a ref
+ *  no transport can hash — never an error, just no pin to write. */
+export interface ModuleVersion {
+    version: string;
+    integrity?: string;
+}
 /** Version enumeration for one version-independent base ref, newest first.
  *
  *  Narrower than the full `IdeEnvironmentAdapter` on purpose. It is the only
  *  environment capability an upgrade check needs, and a host that caches or
  *  throttles hub traffic wraps just this — a CodeLens re-resolves far more
  *  often than a completion popup opens, so the refresh cadence is the host's
- *  policy, not this module's. A host backed by the hub passes
- *  `adapter.listVersionsForRef`. */
-export type ModuleVersionLookup = (baseRef: string) => Promise<string[]>;
+ *  policy, not this module's.
+ *
+ *  Deliberately NOT `adapter.listVersionsForRef`, which answers `string[]`:
+ *  completion offers names, an upgrade writes a pin, so the two want different
+ *  things from one route. A host backed by the hub fetches
+ *  `GET /module/versions` and passes the body through
+ *  {@link parseModuleVersions}. */
+export type ModuleVersionLookup = (baseRef: string) => Promise<ModuleVersion[]>;
 /** A source edit a host applies verbatim to upgrade an import. Ranges never
  *  overlap, within an upgrade or across a batch, so a host may apply the whole
  *  set in one pass without ordering them. */
@@ -22,18 +37,38 @@ export interface ImportUpgrade {
     source: string;
     currentVersion: string;
     latestVersion: string;
-    /** The source that replaces it: re-pointed at `latestVersion` with the
-     *  integrity pin dropped. */
+    /** What the import resolves to after the edits, in the same folded form as
+     *  `source` — re-pointed at `latestVersion`, carrying the new pin as a
+     *  `#sha256-…` fragment when one was available. Folded rather than literal
+     *  because where the pin physically lands depends on the shape the author
+     *  wrote (fragment vs `integrity:` sibling), and a host showing this as a
+     *  preview wants the resolved import, not one of two spellings of it. */
     newSource: string;
-    /** True when the replaced import carried a pin. A host that cannot recompute
-     *  the hash should say so — the pin covers the version being replaced, and
-     *  `telo upgrade` re-pins either shape. */
+    /** True when the replaced import carried a pin. */
     wasPinned: boolean;
+    /** True when the edits leave the import pinned to `latestVersion`. False
+     *  means no pin was available for the target version — a host should say so
+     *  when `wasPinned`, since the rewrite silently drops a hash the author had. */
+    repinned: boolean;
     /** Span of the alias key — where a per-entry affordance anchors. */
     keyRange: Range;
     /** Apply all of these to upgrade this one import. */
     edits: ImportUpgradeEdit[];
 }
+/** One import that is already at the newest version but carries no integrity
+ *  pin, and for which a pin is available. Mirrors what `telo upgrade` does with
+ *  `ensurePinned`: a rarely-released module whose version never moves would
+ *  otherwise stay unpinned forever, because nothing ever offers to rewrite it. */
+export interface ImportPin {
+    alias: string;
+    source: string;
+    version: string;
+    /** The source that replaces it: unchanged but for the appended pin. */
+    newSource: string;
+    /** Span of the alias key — where a per-entry affordance anchors. */
+    keyRange: Range;
+    edits: ImportUpgradeEdit[];
+}
 /** An import that IS behind but that this module declines to rewrite. Carries
  *  the same anchor and versions an {@link ImportUpgrade} does, so a host can
  *  render it in place of the upgrade affordance rather than leaving the author
@@ -51,6 +86,7 @@ export interface ImportUpgradeSet {
     /** Span of the `imports:` key — where a summary affordance anchors. */
     importsKeyRange: Range;
     upgrades: ImportUpgrade[];
+    pins: ImportPin[];
     skipped: ImportUpgradeSkip[];
     /** Base refs whose version lookup failed. Never thrown: one unreachable ref
      *  must not blank the affordances for every other import in the file. The
@@ -63,7 +99,8 @@ export interface ImportUpgradeSet {
 /**
  * Find every `imports:` entry of a module document that names a version older
  * than the newest one `listVersions` reports, and produce the source edits that
- * re-point it.
+ * re-point it — plus every entry already at the newest version that carries no
+ * integrity pin, and the edits that pin it.
  *
  * Skips what carries no upgradeable version: local path imports, bare URLs,
  * untagged refs, and pins that are not SemVer (an OCI digest, a moving tag like

package/dist/import-upgrades/build-import-upgrades.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-import-upgrades.d.ts","sourceRoot":"","sources":["../../src/import-upgrades/build-import-upgrades.ts"],"names":[],"mappings":"AAAA,OAAO,EAQL,KAAK,WAAW,EAChB,KAAK,KAAK,EACX,MAAM,mBAAmB,CAAC;AAG3B;;;;;;;oCAOoC;AACpC,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAEzE;;6CAE6C;AAC7C,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,KAAK,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB;iCAC6B;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB;;+CAE2C;IAC3C,SAAS,EAAE,OAAO,CAAC;IACnB,oEAAoE;IACpE,QAAQ,EAAE,KAAK,CAAC;IAChB,qDAAqD;IACrD,KAAK,EAAE,iBAAiB,EAAE,CAAC;CAC5B;AAED;;;yDAGyD;AACzD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,EAAE,KAAK,CAAC;IAChB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,uEAAuE;IACvE,eAAe,EAAE,KAAK,CAAC;IACvB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B;;wDAEoD;IACpD,QAAQ,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACvD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,mBAAmB,EACjC,IAAI,CAAC,EAAE,WAAW,EAAE,GACnB,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAmDvC"}
+{"version":3,"file":"build-import-upgrades.d.ts","sourceRoot":"","sources":["../../src/import-upgrades/build-import-upgrades.ts"],"names":[],"mappings":"AAAA,OAAO,EAYL,KAAK,WAAW,EAChB,KAAK,KAAK,EACX,MAAM,mBAAmB,CAAC;AAG3B;;;;;oEAKoE;AACpE,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;mCAYmC;AACnC,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;AAEhF;;6CAE6C;AAC7C,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,KAAK,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;6EAKyE;IACzE,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,SAAS,EAAE,OAAO,CAAC;IACnB;;oFAEgF;IAChF,QAAQ,EAAE,OAAO,CAAC;IAClB,oEAAoE;IACpE,QAAQ,EAAE,KAAK,CAAC;IAChB,qDAAqD;IACrD,KAAK,EAAE,iBAAiB,EAAE,CAAC;CAC5B;AAED;;;kFAGkF;AAClF,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,QAAQ,EAAE,KAAK,CAAC;IAChB,KAAK,EAAE,iBAAiB,EAAE,CAAC;CAC5B;AAED;;;yDAGyD;AACzD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,EAAE,KAAK,CAAC;IAChB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,uEAAuE;IACvE,eAAe,EAAE,KAAK,CAAC;IACvB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,IAAI,EAAE,SAAS,EAAE,CAAC;IAClB,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B;;wDAEoD;IACpD,QAAQ,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACvD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,mBAAmB,EACjC,IAAI,CAAC,EAAE,WAAW,EAAE,GACnB,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAmEvC"}

package/dist/import-upgrades/build-import-upgrades.js

@@ -1,9 +1,10 @@
-import { buildLineOffsets, isLocalPathSource, isNewerModuleVersion, newestModuleVersion, parseToAst, parseVersionedRef, withRefVersion, } from "@telorun/analyzer";
+import { buildLineOffsets, foldIntegrity, isCanonicalIntegrity, isLocalPathSource, isNewerModuleVersion, isSameModuleVersion, newestModuleVersion, parseModuleVersion, parseToAst, parseVersionedRef, withRefVersion, } from "@telorun/analyzer";
 import { findImportEntries } from "./find-import-entries.js";
 /**
  * Find every `imports:` entry of a module document that names a version older
  * than the newest one `listVersions` reports, and produce the source edits that
- * re-point it.
+ * re-point it — plus every entry already at the newest version that carries no
+ * integrity pin, and the edits that pin it.
  *
  * Skips what carries no upgradeable version: local path imports, bare URLs,
  * untagged refs, and pins that are not SemVer (an OCI digest, a moving tag like
@@ -26,70 +27,134 @@ export async function buildImportUpgrades(text, listVersions, docs) {
         return ref ? [{ entry, ref }] : [];
     });
     const failures = [];
-    const latest = await resolveLatest([...new Set(candidates.map((c) => c.ref.baseRef))], listVersions, failures);
+    const known = await resolveVersions([...new Set(candidates.map((c) => c.ref.baseRef))], listVersions, failures);
     const upgrades = [];
+    const pins = [];
     const skipped = [];
     for (const { entry, ref } of candidates) {
-        const newest = latest.get(ref.baseRef);
-        if (!newest || !isNewerModuleVersion(newest, ref.version))
+        const versions = known.get(ref.baseRef);
+        if (!versions)
             continue;
-        if (entry.integrityInline) {
+        const newest = newestModuleVersion(versions.map((v) => v.version));
+        if (!newest)
+            continue;
+        if (!isNewerModuleVersion(newest, ref.version)) {
+            const pin = pinInPlace(entry, ref.version, ref.integrity, versions);
+            if (pin)
+                pins.push(pin);
+            continue;
+        }
+        const integrity = integrityFor(versions, newest);
+        // A stale pin that can be neither replaced nor removed is the one case left
+        // that has to be declined: re-pointing the source while leaving a hash for
+        // the version it replaced turns the next install into a tamper error.
+        if (ref.integrity && !integrity && entry.integrity && !entry.integrity.lineRange) {
             skipped.push({
                 alias: entry.alias,
                 currentVersion: ref.version,
                 latestVersion: newest,
                 keyRange: entry.keyRange,
                 reason: `'${entry.alias}' carries an inline 'integrity:' that shares a line with other ` +
-                    `fields, so the stale pin cannot be removed by a line edit. Run \`telo upgrade\`.`,
+                    `fields, and no pin is published for ${newest}, so the stale one cannot be ` +
+                    `removed by a line edit. Run \`telo upgrade\`.`,
             });
             continue;
         }
+        const newSource = withRefVersion(entry.source, newest);
         upgrades.push({
             alias: entry.alias,
             source: entry.source,
             currentVersion: ref.version,
             latestVersion: newest,
-            newSource: withRefVersion(entry.source, newest),
+            newSource: foldIntegrity(newSource, integrity),
             wasPinned: ref.integrity != null,
+            repinned: integrity != null,
             keyRange: entry.keyRange,
-            edits: buildEdits(entry, withRefVersion(entry.source, newest)),
+            edits: buildEdits(entry, newSource, integrity),
         });
     }
-    return { importsKeyRange: block.keyRange, upgrades, skipped, failures };
+    return { importsKeyRange: block.keyRange, upgrades, pins, skipped, failures };
 }
-/** Re-point the source scalar, and delete a now-stale object-form `integrity:`
- *  line. `withRefVersion` already strips an inline `#sha256-…` fragment, so the
- *  scalar shorthand needs no second edit. Dropping the pin is not optional: it
- *  hashes the `telo.yaml` of the version being replaced, so carrying it onto a
- *  different version turns the next install into a tamper error. */
-function buildEdits(entry, newSource) {
+/** The edits that re-point an entry at `newSource` and settle its pin.
+ *
+ *  Where the pin is written follows the shape the author chose: an entry with an
+ *  `integrity:` sibling keeps it (its value is replaced in place, which works in
+ *  block and flow style alike), and everything else carries the pin inside the
+ *  source as a `#sha256-…` fragment — the form `telo upgrade` writes.
+ *
+ *  With no pin available the sibling is deleted instead. That is not optional:
+ *  it hashes the `telo.yaml` of the version being replaced, so carrying it onto
+ *  a different version turns the next install into a tamper error.
+ *  `withRefVersion` has already stripped a fragment-form pin for the same
+ *  reason, so the scalar shorthand needs no second edit. */
+function buildEdits(entry, newSource, integrity) {
+    if (!entry.integrity) {
+        return [{ range: entry.sourceRange, newText: foldIntegrity(newSource, integrity) }];
+    }
     const edits = [{ range: entry.sourceRange, newText: newSource }];
-    if (entry.integrityLineRange) {
-        edits.push({ range: entry.integrityLineRange, newText: "" });
+    if (integrity) {
+        edits.push({ range: entry.integrity.valueRange, newText: integrity });
+    }
+    else if (entry.integrity.lineRange) {
+        edits.push({ range: entry.integrity.lineRange, newText: "" });
     }
     return edits;
 }
-/** Newest version per base ref, fetched once each. A ref whose lookup rejects
- *  is recorded in `failures` and left out of the map, so it yields no upgrade
+/** Pin an entry that is already at the newest version, or `undefined` when
+ *  there is nothing to do — it is pinned already, the hub published no pin for
+ *  the version it names, or that version is not one this module will order.
+ *
+ *  The version gate matters: a moving tag (`latest`) or a digest names bytes
+ *  that are expected to change, so pinning it would break the next release
+ *  rather than protect it. `telo upgrade` draws the same line. */
+function pinInPlace(entry, version, existingIntegrity, versions) {
+    if (existingIntegrity != null || entry.integrity)
+        return undefined;
+    if (parseModuleVersion(version) === null)
+        return undefined;
+    const integrity = integrityFor(versions, version);
+    if (!integrity)
+        return undefined;
+    const newSource = foldIntegrity(entry.source, integrity);
+    return {
+        alias: entry.alias,
+        source: entry.source,
+        version,
+        newSource,
+        keyRange: entry.keyRange,
+        edits: [{ range: entry.sourceRange, newText: newSource }],
+    };
+}
+/** The pin the hub reports for one version, matched by SemVer identity rather
+ *  than string equality so a `v`-prefixed tag on either side still lines up.
+ *
+ *  Re-checked here even though the host's parse already did: this value is
+ *  spliced into the author's YAML, and a caller reaching the builder through
+ *  its own `ModuleVersionLookup` never passed through that parse. */
+function integrityFor(versions, version) {
+    const integrity = versions.find((v) => isSameModuleVersion(v.version, version))?.integrity;
+    return isCanonicalIntegrity(integrity) ? integrity : undefined;
+}
+/** Versions per base ref, fetched once each. A ref whose lookup rejects is
+ *  recorded in `failures` and left out of the map, so it yields no upgrade
  *  rather than a wrong one. */
-async function resolveLatest(baseRefs, listVersions, failures) {
+async function resolveVersions(baseRefs, listVersions, failures) {
     const results = await Promise.all(baseRefs.map(async (baseRef) => {
         try {
-            const versions = await listVersions(baseRef);
-            return { baseRef, newest: newestModuleVersion(versions) };
+            return { baseRef, versions: await listVersions(baseRef) };
         }
         catch (err) {
             failures.push({
                 baseRef,
                 message: err instanceof Error ? err.message : String(err),
             });
-            return { baseRef, newest: undefined };
+            return { baseRef, versions: undefined };
         }
     }));
     const map = new Map();
-    for (const { baseRef, newest } of results) {
-        if (newest)
-            map.set(baseRef, newest);
+    for (const { baseRef, versions } of results) {
+        if (versions)
+            map.set(baseRef, versions);
     }
     return map;
 }

package/dist/import-upgrades/find-import-entries.d.ts

@@ -15,17 +15,23 @@ export interface ImportEntry {
      *  shorthand, the `source:` value for the object form. Replacing this span
      *  re-points the import. */
     sourceRange: Range;
-    /** Whole-line span of an object-form `integrity:` entry, including its
-     *  trailing newline, so a caller can delete the line. Absent for the scalar
-     *  shorthand (where the pin rides inside `sourceRange`) and for an entry that
-     *  declares no `integrity:`. */
-    integrityLineRange?: Range;
-    /** Set when the entry carries an `integrity:` sibling that does NOT occupy
-     *  whole lines of its own (a flow-style `{source: …, integrity: …}` map).
-     *  Deleting it would need a structural rewrite rather than a line splice, so
-     *  a caller that cannot leave the pin behind must skip this entry rather
-     *  than re-point it and strand a hash for the version it replaced. */
-    integrityInline?: boolean;
+    /** Where an object-form `integrity:` sibling sits, when the entry declares
+     *  one. Absent for the scalar shorthand — there the pin rides inside
+     *  `sourceRange` as a `#sha256-…` fragment — and for an unpinned entry. */
+    integrity?: ImportEntryIntegrity;
+}
+/** The two spans a caller needs to act on an object-form `integrity:`: one to
+ *  re-pin it, one to remove it. They are separate because a flow-style map
+ *  (`{source: …, integrity: …}`) supports the first and not the second. */
+export interface ImportEntryIntegrity {
+    /** Span of the hash value itself. Replacing it re-pins the entry in the shape
+     *  the author wrote, in any YAML style. */
+    valueRange: Range;
+    /** Whole-line span of the `integrity:` entry including its trailing newline,
+     *  so a caller with no replacement hash can delete the line outright. Absent
+     *  when the pair shares a line with other content, where removing it would
+     *  need a structural rewrite rather than a line splice. */
+    lineRange?: Range;
 }
 /** Where the `imports:` map lives in a module document. */
 export interface ImportsBlock {

package/dist/import-upgrades/find-import-entries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"find-import-entries.d.ts","sourceRoot":"","sources":["../../src/import-upgrades/find-import-entries.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,WAAW,EAGhB,KAAK,KAAK,EACX,MAAM,mBAAmB,CAAC;AAE3B;;;;;iEAKiE;AACjE,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,QAAQ,EAAE,KAAK,CAAC;IAChB;;gCAE4B;IAC5B,WAAW,EAAE,KAAK,CAAC;IACnB;;;oCAGgC;IAChC,kBAAkB,CAAC,EAAE,KAAK,CAAC;IAC3B;;;;0EAIsE;IACtE,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,2DAA2D;AAC3D,MAAM,WAAW,YAAY;IAC3B,uEAAuE;IACvE,QAAQ,EAAE,KAAK,CAAC;IAChB,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB;AAED;;;;;;;qEAOqE;AACrE,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,WAAW,EAAE,EACnB,WAAW,EAAE,MAAM,EAAE,GACpB,YAAY,GAAG,SAAS,CAsB1B"}
+{"version":3,"file":"find-import-entries.d.ts","sourceRoot":"","sources":["../../src/import-upgrades/find-import-entries.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,WAAW,EAGhB,KAAK,KAAK,EACX,MAAM,mBAAmB,CAAC;AAE3B;;;;;iEAKiE;AACjE,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,QAAQ,EAAE,KAAK,CAAC;IAChB;;gCAE4B;IAC5B,WAAW,EAAE,KAAK,CAAC;IACnB;;+EAE2E;IAC3E,SAAS,CAAC,EAAE,oBAAoB,CAAC;CAClC;AAED;;2EAE2E;AAC3E,MAAM,WAAW,oBAAoB;IACnC;+CAC2C;IAC3C,UAAU,EAAE,KAAK,CAAC;IAClB;;;+DAG2D;IAC3D,SAAS,CAAC,EAAE,KAAK,CAAC;CACnB;AAED,2DAA2D;AAC3D,MAAM,WAAW,YAAY;IAC3B,uEAAuE;IACvE,QAAQ,EAAE,KAAK,CAAC;IAChB,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB;AAED;;;;;;;qEAOqE;AACrE,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,WAAW,EAAE,EACnB,WAAW,EAAE,MAAM,EAAE,GACpB,YAAY,GAAG,SAAS,CAsB1B"}

package/dist/import-upgrades/find-import-entries.js

@@ -56,11 +56,10 @@ function readEntry(alias, keyNode, valueNode, text, lineOffsets) {
         sourceRange: toRange(sourceNode, lineOffsets),
     };
     if (integrityPair?.value && integrity !== undefined) {
-        const lineSpan = wholeLineSpan(integrityPair.key.range[0], integrityPair.value.range[1], text, lineOffsets);
-        if (lineSpan)
-            entry.integrityLineRange = lineSpan;
-        else
-            entry.integrityInline = true;
+        entry.integrity = {
+            valueRange: toRange(integrityPair.value, lineOffsets),
+            lineRange: wholeLineSpan(integrityPair.key.range[0], integrityPair.value.range[1], text, lineOffsets),
+        };
     }
     return entry;
 }

package/dist/import-upgrades/index.d.ts

@@ -1,5 +1,6 @@
 export { buildImportUpgrades } from "./build-import-upgrades.js";
-export type { ImportUpgrade, ImportUpgradeEdit, ImportUpgradeSet, ImportUpgradeSkip, ModuleVersionLookup, } from "./build-import-upgrades.js";
+export type { ImportPin, ImportUpgrade, ImportUpgradeEdit, ImportUpgradeSet, ImportUpgradeSkip, ModuleVersion, ModuleVersionLookup, } from "./build-import-upgrades.js";
+export { parseModuleVersions } from "./parse-module-versions.js";
 export { findImportEntries } from "./find-import-entries.js";
-export type { ImportEntry, ImportsBlock } from "./find-import-entries.js";
+export type { ImportEntry, ImportEntryIntegrity, ImportsBlock, } from "./find-import-entries.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/import-upgrades/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/import-upgrades/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/import-upgrades/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,YAAY,EACV,SAAS,EACT,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,YAAY,EACV,WAAW,EACX,oBAAoB,EACpB,YAAY,GACb,MAAM,0BAA0B,CAAC"}

package/dist/import-upgrades/index.js

@@ -1,2 +1,3 @@
 export { buildImportUpgrades } from "./build-import-upgrades.js";
+export { parseModuleVersions } from "./parse-module-versions.js";
 export { findImportEntries } from "./find-import-entries.js";

package/dist/import-upgrades/parse-module-versions.d.ts

@@ -0,0 +1,19 @@
+import type { ModuleVersion } from "./build-import-upgrades.js";
+/**
+ * Read the hub's `GET /module/versions` payload into {@link ModuleVersion}s,
+ * newest first (the route's own ordering, preserved).
+ *
+ * Pure — the host owns the `fetch`, as everything else in this package does.
+ * It lives here rather than in each host because the shape is this package's:
+ * three hosts parsing the same route by hand is how one of them was left
+ * filtering for strings after the route started returning objects, which
+ * TypeScript could not catch behind the response cast and which surfaced only
+ * as a silently empty version list.
+ *
+ * Tolerant by design: an entry with no usable `version` is dropped rather than
+ * throwing, and an `integrity` that is not a canonical `sha256-<base64url>` is
+ * discarded rather than carried — a pin is spliced into the author's YAML, so a
+ * malformed one has to become "no pin", never corrupt text.
+ */
+export declare function parseModuleVersions(payload: unknown): ModuleVersion[];
+//# sourceMappingURL=parse-module-versions.d.ts.map

package/dist/import-upgrades/parse-module-versions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-module-versions.d.ts","sourceRoot":"","sources":["../../src/import-upgrades/parse-module-versions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAEhE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,aAAa,EAAE,CAUrE"}