@telorun/ide-support 0.9.0 → 0.10.1

package/dist/import-upgrades/build-import-upgrades.d.ts

@@ -1,13 +1,28 @@
 import { type AstDocument, type Range } from "@telorun/analyzer";
+/** One version of a module, as the hub reports it.
+ *
+ *  `integrity` is the import pin for exactly this version (`sha256-<base64url>`
+ *  over whatever the owning transport verifies its own reads against). It is
+ *  absent for a version the hub tracked before it recorded pins, and for a ref
+ *  no transport can hash — never an error, just no pin to write. */
+export interface ModuleVersion {
+    version: string;
+    integrity?: string;
+}
 /** Version enumeration for one version-independent base ref, newest first.
  *
  *  Narrower than the full `IdeEnvironmentAdapter` on purpose. It is the only
  *  environment capability an upgrade check needs, and a host that caches or
  *  throttles hub traffic wraps just this — a CodeLens re-resolves far more
  *  often than a completion popup opens, so the refresh cadence is the host's
- *  policy, not this module's. A host backed by the hub passes
- *  `adapter.listVersionsForRef`. */
-export type ModuleVersionLookup = (baseRef: string) => Promise<string[]>;
+ *  policy, not this module's.
+ *
+ *  Deliberately NOT `adapter.listVersionsForRef`, which answers `string[]`:
+ *  completion offers names, an upgrade writes a pin, so the two want different
+ *  things from one route. A host backed by the hub fetches
+ *  `GET /module/versions` and passes the body through
+ *  {@link parseModuleVersions}. */
+export type ModuleVersionLookup = (baseRef: string) => Promise<ModuleVersion[]>;
 /** A source edit a host applies verbatim to upgrade an import. Ranges never
  *  overlap, within an upgrade or across a batch, so a host may apply the whole
  *  set in one pass without ordering them. */
@@ -22,18 +37,38 @@ export interface ImportUpgrade {
     source: string;
     currentVersion: string;
     latestVersion: string;
-    /** The source that replaces it: re-pointed at `latestVersion` with the
-     *  integrity pin dropped. */
+    /** What the import resolves to after the edits, in the same folded form as
+     *  `source` — re-pointed at `latestVersion`, carrying the new pin as a
+     *  `#sha256-…` fragment when one was available. Folded rather than literal
+     *  because where the pin physically lands depends on the shape the author
+     *  wrote (fragment vs `integrity:` sibling), and a host showing this as a
+     *  preview wants the resolved import, not one of two spellings of it. */
     newSource: string;
-    /** True when the replaced import carried a pin. A host that cannot recompute
-     *  the hash should say so — the pin covers the version being replaced, and
-     *  `telo upgrade` re-pins either shape. */
+    /** True when the replaced import carried a pin. */
     wasPinned: boolean;
+    /** True when the edits leave the import pinned to `latestVersion`. False
+     *  means no pin was available for the target version — a host should say so
+     *  when `wasPinned`, since the rewrite silently drops a hash the author had. */
+    repinned: boolean;
     /** Span of the alias key — where a per-entry affordance anchors. */
     keyRange: Range;
     /** Apply all of these to upgrade this one import. */
     edits: ImportUpgradeEdit[];
 }
+/** One import that is already at the newest version but carries no integrity
+ *  pin, and for which a pin is available. Mirrors what `telo upgrade` does with
+ *  `ensurePinned`: a rarely-released module whose version never moves would
+ *  otherwise stay unpinned forever, because nothing ever offers to rewrite it. */
+export interface ImportPin {
+    alias: string;
+    source: string;
+    version: string;
+    /** The source that replaces it: unchanged but for the appended pin. */
+    newSource: string;
+    /** Span of the alias key — where a per-entry affordance anchors. */
+    keyRange: Range;
+    edits: ImportUpgradeEdit[];
+}
 /** An import that IS behind but that this module declines to rewrite. Carries
  *  the same anchor and versions an {@link ImportUpgrade} does, so a host can
  *  render it in place of the upgrade affordance rather than leaving the author
@@ -51,6 +86,7 @@ export interface ImportUpgradeSet {
     /** Span of the `imports:` key — where a summary affordance anchors. */
     importsKeyRange: Range;
     upgrades: ImportUpgrade[];
+    pins: ImportPin[];
     skipped: ImportUpgradeSkip[];
     /** Base refs whose version lookup failed. Never thrown: one unreachable ref
      *  must not blank the affordances for every other import in the file. The
@@ -63,7 +99,8 @@ export interface ImportUpgradeSet {
 /**
  * Find every `imports:` entry of a module document that names a version older
  * than the newest one `listVersions` reports, and produce the source edits that
- * re-point it.
+ * re-point it — plus every entry already at the newest version that carries no
+ * integrity pin, and the edits that pin it.
  *
  * Skips what carries no upgradeable version: local path imports, bare URLs,
  * untagged refs, and pins that are not SemVer (an OCI digest, a moving tag like

package/dist/import-upgrades/build-import-upgrades.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-import-upgrades.d.ts","sourceRoot":"","sources":["../../src/import-upgrades/build-import-upgrades.ts"],"names":[],"mappings":"AAAA,OAAO,EAQL,KAAK,WAAW,EAChB,KAAK,KAAK,EACX,MAAM,mBAAmB,CAAC;AAG3B;;;;;;;oCAOoC;AACpC,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAEzE;;6CAE6C;AAC7C,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,KAAK,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB;iCAC6B;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB;;+CAE2C;IAC3C,SAAS,EAAE,OAAO,CAAC;IACnB,oEAAoE;IACpE,QAAQ,EAAE,KAAK,CAAC;IAChB,qDAAqD;IACrD,KAAK,EAAE,iBAAiB,EAAE,CAAC;CAC5B;AAED;;;yDAGyD;AACzD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,EAAE,KAAK,CAAC;IAChB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,uEAAuE;IACvE,eAAe,EAAE,KAAK,CAAC;IACvB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B;;wDAEoD;IACpD,QAAQ,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACvD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,mBAAmB,EACjC,IAAI,CAAC,EAAE,WAAW,EAAE,GACnB,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAmDvC"}
+{"version":3,"file":"build-import-upgrades.d.ts","sourceRoot":"","sources":["../../src/import-upgrades/build-import-upgrades.ts"],"names":[],"mappings":"AAAA,OAAO,EAYL,KAAK,WAAW,EAChB,KAAK,KAAK,EACX,MAAM,mBAAmB,CAAC;AAG3B;;;;;oEAKoE;AACpE,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;mCAYmC;AACnC,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;AAEhF;;6CAE6C;AAC7C,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,KAAK,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;6EAKyE;IACzE,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,SAAS,EAAE,OAAO,CAAC;IACnB;;oFAEgF;IAChF,QAAQ,EAAE,OAAO,CAAC;IAClB,oEAAoE;IACpE,QAAQ,EAAE,KAAK,CAAC;IAChB,qDAAqD;IACrD,KAAK,EAAE,iBAAiB,EAAE,CAAC;CAC5B;AAED;;;kFAGkF;AAClF,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,QAAQ,EAAE,KAAK,CAAC;IAChB,KAAK,EAAE,iBAAiB,EAAE,CAAC;CAC5B;AAED;;;yDAGyD;AACzD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,EAAE,KAAK,CAAC;IAChB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,uEAAuE;IACvE,eAAe,EAAE,KAAK,CAAC;IACvB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,IAAI,EAAE,SAAS,EAAE,CAAC;IAClB,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B;;wDAEoD;IACpD,QAAQ,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACvD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,mBAAmB,EACjC,IAAI,CAAC,EAAE,WAAW,EAAE,GACnB,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAmEvC"}

package/dist/import-upgrades/build-import-upgrades.js

@@ -1,9 +1,10 @@
-import { buildLineOffsets, isLocalPathSource, isNewerModuleVersion, newestModuleVersion, parseToAst, parseVersionedRef, withRefVersion, } from "@telorun/analyzer";
+import { buildLineOffsets, foldIntegrity, isCanonicalIntegrity, isLocalPathSource, isNewerModuleVersion, isSameModuleVersion, newestModuleVersion, parseModuleVersion, parseToAst, parseVersionedRef, withRefVersion, } from "@telorun/analyzer";
 import { findImportEntries } from "./find-import-entries.js";
 /**
  * Find every `imports:` entry of a module document that names a version older
  * than the newest one `listVersions` reports, and produce the source edits that
- * re-point it.
+ * re-point it — plus every entry already at the newest version that carries no
+ * integrity pin, and the edits that pin it.
  *
  * Skips what carries no upgradeable version: local path imports, bare URLs,
  * untagged refs, and pins that are not SemVer (an OCI digest, a moving tag like
@@ -26,70 +27,134 @@ export async function buildImportUpgrades(text, listVersions, docs) {
         return ref ? [{ entry, ref }] : [];
     });
     const failures = [];
-    const latest = await resolveLatest([...new Set(candidates.map((c) => c.ref.baseRef))], listVersions, failures);
+    const known = await resolveVersions([...new Set(candidates.map((c) => c.ref.baseRef))], listVersions, failures);
     const upgrades = [];
+    const pins = [];
     const skipped = [];
     for (const { entry, ref } of candidates) {
-        const newest = latest.get(ref.baseRef);
-        if (!newest || !isNewerModuleVersion(newest, ref.version))
+        const versions = known.get(ref.baseRef);
+        if (!versions)
             continue;
-        if (entry.integrityInline) {
+        const newest = newestModuleVersion(versions.map((v) => v.version));
+        if (!newest)
+            continue;
+        if (!isNewerModuleVersion(newest, ref.version)) {
+            const pin = pinInPlace(entry, ref.version, ref.integrity, versions);
+            if (pin)
+                pins.push(pin);
+            continue;
+        }
+        const integrity = integrityFor(versions, newest);
+        // A stale pin that can be neither replaced nor removed is the one case left
+        // that has to be declined: re-pointing the source while leaving a hash for
+        // the version it replaced turns the next install into a tamper error.
+        if (ref.integrity && !integrity && entry.integrity && !entry.integrity.lineRange) {
             skipped.push({
                 alias: entry.alias,
                 currentVersion: ref.version,
                 latestVersion: newest,
                 keyRange: entry.keyRange,
                 reason: `'${entry.alias}' carries an inline 'integrity:' that shares a line with other ` +
-                    `fields, so the stale pin cannot be removed by a line edit. Run \`telo upgrade\`.`,
+                    `fields, and no pin is published for ${newest}, so the stale one cannot be ` +
+                    `removed by a line edit. Run \`telo upgrade\`.`,
             });
             continue;
         }
+        const newSource = withRefVersion(entry.source, newest);
         upgrades.push({
             alias: entry.alias,
             source: entry.source,
             currentVersion: ref.version,
             latestVersion: newest,
-            newSource: withRefVersion(entry.source, newest),
+            newSource: foldIntegrity(newSource, integrity),
             wasPinned: ref.integrity != null,
+            repinned: integrity != null,
             keyRange: entry.keyRange,
-            edits: buildEdits(entry, withRefVersion(entry.source, newest)),
+            edits: buildEdits(entry, newSource, integrity),
         });
     }
-    return { importsKeyRange: block.keyRange, upgrades, skipped, failures };
+    return { importsKeyRange: block.keyRange, upgrades, pins, skipped, failures };
 }
-/** Re-point the source scalar, and delete a now-stale object-form `integrity:`
- *  line. `withRefVersion` already strips an inline `#sha256-…` fragment, so the
- *  scalar shorthand needs no second edit. Dropping the pin is not optional: it
- *  hashes the `telo.yaml` of the version being replaced, so carrying it onto a
- *  different version turns the next install into a tamper error. */
-function buildEdits(entry, newSource) {
+/** The edits that re-point an entry at `newSource` and settle its pin.
+ *
+ *  Where the pin is written follows the shape the author chose: an entry with an
+ *  `integrity:` sibling keeps it (its value is replaced in place, which works in
+ *  block and flow style alike), and everything else carries the pin inside the
+ *  source as a `#sha256-…` fragment — the form `telo upgrade` writes.
+ *
+ *  With no pin available the sibling is deleted instead. That is not optional:
+ *  it hashes the `telo.yaml` of the version being replaced, so carrying it onto
+ *  a different version turns the next install into a tamper error.
+ *  `withRefVersion` has already stripped a fragment-form pin for the same
+ *  reason, so the scalar shorthand needs no second edit. */
+function buildEdits(entry, newSource, integrity) {
+    if (!entry.integrity) {
+        return [{ range: entry.sourceRange, newText: foldIntegrity(newSource, integrity) }];
+    }
     const edits = [{ range: entry.sourceRange, newText: newSource }];
-    if (entry.integrityLineRange) {
-        edits.push({ range: entry.integrityLineRange, newText: "" });
+    if (integrity) {
+        edits.push({ range: entry.integrity.valueRange, newText: integrity });
+    }
+    else if (entry.integrity.lineRange) {
+        edits.push({ range: entry.integrity.lineRange, newText: "" });
     }
     return edits;
 }
-/** Newest version per base ref, fetched once each. A ref whose lookup rejects
- *  is recorded in `failures` and left out of the map, so it yields no upgrade
+/** Pin an entry that is already at the newest version, or `undefined` when
+ *  there is nothing to do — it is pinned already, the hub published no pin for
+ *  the version it names, or that version is not one this module will order.
+ *
+ *  The version gate matters: a moving tag (`latest`) or a digest names bytes
+ *  that are expected to change, so pinning it would break the next release
+ *  rather than protect it. `telo upgrade` draws the same line. */
+function pinInPlace(entry, version, existingIntegrity, versions) {
+    if (existingIntegrity != null || entry.integrity)
+        return undefined;
+    if (parseModuleVersion(version) === null)
+        return undefined;
+    const integrity = integrityFor(versions, version);
+    if (!integrity)
+        return undefined;
+    const newSource = foldIntegrity(entry.source, integrity);
+    return {
+        alias: entry.alias,
+        source: entry.source,
+        version,
+        newSource,
+        keyRange: entry.keyRange,
+        edits: [{ range: entry.sourceRange, newText: newSource }],
+    };
+}
+/** The pin the hub reports for one version, matched by SemVer identity rather
+ *  than string equality so a `v`-prefixed tag on either side still lines up.
+ *
+ *  Re-checked here even though the host's parse already did: this value is
+ *  spliced into the author's YAML, and a caller reaching the builder through
+ *  its own `ModuleVersionLookup` never passed through that parse. */
+function integrityFor(versions, version) {
+    const integrity = versions.find((v) => isSameModuleVersion(v.version, version))?.integrity;
+    return isCanonicalIntegrity(integrity) ? integrity : undefined;
+}
+/** Versions per base ref, fetched once each. A ref whose lookup rejects is
+ *  recorded in `failures` and left out of the map, so it yields no upgrade
  *  rather than a wrong one. */
-async function resolveLatest(baseRefs, listVersions, failures) {
+async function resolveVersions(baseRefs, listVersions, failures) {
     const results = await Promise.all(baseRefs.map(async (baseRef) => {
         try {
-            const versions = await listVersions(baseRef);
-            return { baseRef, newest: newestModuleVersion(versions) };
+            return { baseRef, versions: await listVersions(baseRef) };
         }
         catch (err) {
             failures.push({
                 baseRef,
                 message: err instanceof Error ? err.message : String(err),
             });
-            return { baseRef, newest: undefined };
+            return { baseRef, versions: undefined };
         }
     }));
     const map = new Map();
-    for (const { baseRef, newest } of results) {
-        if (newest)
-            map.set(baseRef, newest);
+    for (const { baseRef, versions } of results) {
+        if (versions)
+            map.set(baseRef, versions);
     }
     return map;
 }

package/dist/import-upgrades/find-import-entries.d.ts

@@ -15,17 +15,23 @@ export interface ImportEntry {
      *  shorthand, the `source:` value for the object form. Replacing this span
      *  re-points the import. */
     sourceRange: Range;
-    /** Whole-line span of an object-form `integrity:` entry, including its
-     *  trailing newline, so a caller can delete the line. Absent for the scalar
-     *  shorthand (where the pin rides inside `sourceRange`) and for an entry that
-     *  declares no `integrity:`. */
-    integrityLineRange?: Range;
-    /** Set when the entry carries an `integrity:` sibling that does NOT occupy
-     *  whole lines of its own (a flow-style `{source: …, integrity: …}` map).
-     *  Deleting it would need a structural rewrite rather than a line splice, so
-     *  a caller that cannot leave the pin behind must skip this entry rather
-     *  than re-point it and strand a hash for the version it replaced. */
-    integrityInline?: boolean;
+    /** Where an object-form `integrity:` sibling sits, when the entry declares
+     *  one. Absent for the scalar shorthand — there the pin rides inside
+     *  `sourceRange` as a `#sha256-…` fragment — and for an unpinned entry. */
+    integrity?: ImportEntryIntegrity;
+}
+/** The two spans a caller needs to act on an object-form `integrity:`: one to
+ *  re-pin it, one to remove it. They are separate because a flow-style map
+ *  (`{source: …, integrity: …}`) supports the first and not the second. */
+export interface ImportEntryIntegrity {
+    /** Span of the hash value itself. Replacing it re-pins the entry in the shape
+     *  the author wrote, in any YAML style. */
+    valueRange: Range;
+    /** Whole-line span of the `integrity:` entry including its trailing newline,
+     *  so a caller with no replacement hash can delete the line outright. Absent
+     *  when the pair shares a line with other content, where removing it would
+     *  need a structural rewrite rather than a line splice. */
+    lineRange?: Range;
 }
 /** Where the `imports:` map lives in a module document. */
 export interface ImportsBlock {

package/dist/import-upgrades/find-import-entries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"find-import-entries.d.ts","sourceRoot":"","sources":["../../src/import-upgrades/find-import-entries.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,WAAW,EAGhB,KAAK,KAAK,EACX,MAAM,mBAAmB,CAAC;AAE3B;;;;;iEAKiE;AACjE,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,QAAQ,EAAE,KAAK,CAAC;IAChB;;gCAE4B;IAC5B,WAAW,EAAE,KAAK,CAAC;IACnB;;;oCAGgC;IAChC,kBAAkB,CAAC,EAAE,KAAK,CAAC;IAC3B;;;;0EAIsE;IACtE,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,2DAA2D;AAC3D,MAAM,WAAW,YAAY;IAC3B,uEAAuE;IACvE,QAAQ,EAAE,KAAK,CAAC;IAChB,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB;AAED;;;;;;;qEAOqE;AACrE,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,WAAW,EAAE,EACnB,WAAW,EAAE,MAAM,EAAE,GACpB,YAAY,GAAG,SAAS,CAsB1B"}
+{"version":3,"file":"find-import-entries.d.ts","sourceRoot":"","sources":["../../src/import-upgrades/find-import-entries.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,WAAW,EAGhB,KAAK,KAAK,EACX,MAAM,mBAAmB,CAAC;AAE3B;;;;;iEAKiE;AACjE,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,QAAQ,EAAE,KAAK,CAAC;IAChB;;gCAE4B;IAC5B,WAAW,EAAE,KAAK,CAAC;IACnB;;+EAE2E;IAC3E,SAAS,CAAC,EAAE,oBAAoB,CAAC;CAClC;AAED;;2EAE2E;AAC3E,MAAM,WAAW,oBAAoB;IACnC;+CAC2C;IAC3C,UAAU,EAAE,KAAK,CAAC;IAClB;;;+DAG2D;IAC3D,SAAS,CAAC,EAAE,KAAK,CAAC;CACnB;AAED,2DAA2D;AAC3D,MAAM,WAAW,YAAY;IAC3B,uEAAuE;IACvE,QAAQ,EAAE,KAAK,CAAC;IAChB,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB;AAED;;;;;;;qEAOqE;AACrE,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,WAAW,EAAE,EACnB,WAAW,EAAE,MAAM,EAAE,GACpB,YAAY,GAAG,SAAS,CAsB1B"}

package/dist/import-upgrades/find-import-entries.js

@@ -56,11 +56,10 @@ function readEntry(alias, keyNode, valueNode, text, lineOffsets) {
         sourceRange: toRange(sourceNode, lineOffsets),
     };
     if (integrityPair?.value && integrity !== undefined) {
-        const lineSpan = wholeLineSpan(integrityPair.key.range[0], integrityPair.value.range[1], text, lineOffsets);
-        if (lineSpan)
-            entry.integrityLineRange = lineSpan;
-        else
-            entry.integrityInline = true;
+        entry.integrity = {
+            valueRange: toRange(integrityPair.value, lineOffsets),
+            lineRange: wholeLineSpan(integrityPair.key.range[0], integrityPair.value.range[1], text, lineOffsets),
+        };
     }
     return entry;
 }

package/dist/import-upgrades/index.d.ts

@@ -1,5 +1,6 @@
 export { buildImportUpgrades } from "./build-import-upgrades.js";
-export type { ImportUpgrade, ImportUpgradeEdit, ImportUpgradeSet, ImportUpgradeSkip, ModuleVersionLookup, } from "./build-import-upgrades.js";
+export type { ImportPin, ImportUpgrade, ImportUpgradeEdit, ImportUpgradeSet, ImportUpgradeSkip, ModuleVersion, ModuleVersionLookup, } from "./build-import-upgrades.js";
+export { parseModuleVersions } from "./parse-module-versions.js";
 export { findImportEntries } from "./find-import-entries.js";
-export type { ImportEntry, ImportsBlock } from "./find-import-entries.js";
+export type { ImportEntry, ImportEntryIntegrity, ImportsBlock, } from "./find-import-entries.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/import-upgrades/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/import-upgrades/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/import-upgrades/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,YAAY,EACV,SAAS,EACT,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,YAAY,EACV,WAAW,EACX,oBAAoB,EACpB,YAAY,GACb,MAAM,0BAA0B,CAAC"}

package/dist/import-upgrades/index.js

@@ -1,2 +1,3 @@
 export { buildImportUpgrades } from "./build-import-upgrades.js";
+export { parseModuleVersions } from "./parse-module-versions.js";
 export { findImportEntries } from "./find-import-entries.js";

package/dist/import-upgrades/parse-module-versions.d.ts

@@ -0,0 +1,19 @@
+import type { ModuleVersion } from "./build-import-upgrades.js";
+/**
+ * Read the hub's `GET /module/versions` payload into {@link ModuleVersion}s,
+ * newest first (the route's own ordering, preserved).
+ *
+ * Pure — the host owns the `fetch`, as everything else in this package does.
+ * It lives here rather than in each host because the shape is this package's:
+ * three hosts parsing the same route by hand is how one of them was left
+ * filtering for strings after the route started returning objects, which
+ * TypeScript could not catch behind the response cast and which surfaced only
+ * as a silently empty version list.
+ *
+ * Tolerant by design: an entry with no usable `version` is dropped rather than
+ * throwing, and an `integrity` that is not a canonical `sha256-<base64url>` is
+ * discarded rather than carried — a pin is spliced into the author's YAML, so a
+ * malformed one has to become "no pin", never corrupt text.
+ */
+export declare function parseModuleVersions(payload: unknown): ModuleVersion[];
+//# sourceMappingURL=parse-module-versions.d.ts.map

package/dist/import-upgrades/parse-module-versions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-module-versions.d.ts","sourceRoot":"","sources":["../../src/import-upgrades/parse-module-versions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAEhE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,aAAa,EAAE,CAUrE"}

package/dist/import-upgrades/parse-module-versions.js

@@ -0,0 +1,29 @@
+import { isCanonicalIntegrity } from "@telorun/analyzer";
+/**
+ * Read the hub's `GET /module/versions` payload into {@link ModuleVersion}s,
+ * newest first (the route's own ordering, preserved).
+ *
+ * Pure — the host owns the `fetch`, as everything else in this package does.
+ * It lives here rather than in each host because the shape is this package's:
+ * three hosts parsing the same route by hand is how one of them was left
+ * filtering for strings after the route started returning objects, which
+ * TypeScript could not catch behind the response cast and which surfaced only
+ * as a silently empty version list.
+ *
+ * Tolerant by design: an entry with no usable `version` is dropped rather than
+ * throwing, and an `integrity` that is not a canonical `sha256-<base64url>` is
+ * discarded rather than carried — a pin is spliced into the author's YAML, so a
+ * malformed one has to become "no pin", never corrupt text.
+ */
+export function parseModuleVersions(payload) {
+    const versions = payload?.versions;
+    if (!Array.isArray(versions))
+        return [];
+    return versions.flatMap((entry) => {
+        const version = entry?.version;
+        if (typeof version !== "string" || version === "")
+            return [];
+        const integrity = entry.integrity;
+        return [isCanonicalIntegrity(integrity) ? { version, integrity } : { version }];
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/ide-support",
-  "version": "0.9.0",
+  "version": "0.10.1",
   "description": "Editor-host-agnostic IDE support (completions, diagnostic normalization) for Telo manifests.",
   "keywords": [
     "telo",
@@ -36,7 +36,7 @@
     "src/**"
   ],
   "dependencies": {
-    "@telorun/analyzer": "0.51.0"
+    "@telorun/analyzer": "0.53.0"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",

package/src/import-upgrades/build-import-upgrades.ts

@@ -1,8 +1,12 @@
 import {
   buildLineOffsets,
+  foldIntegrity,
+  isCanonicalIntegrity,
   isLocalPathSource,
   isNewerModuleVersion,
+  isSameModuleVersion,
   newestModuleVersion,
+  parseModuleVersion,
   parseToAst,
   parseVersionedRef,
   withRefVersion,
@@ -11,15 +15,31 @@ import {
 } from "@telorun/analyzer";
 import { findImportEntries, type ImportEntry } from "./find-import-entries.js";
 
+/** One version of a module, as the hub reports it.
+ *
+ *  `integrity` is the import pin for exactly this version (`sha256-<base64url>`
+ *  over whatever the owning transport verifies its own reads against). It is
+ *  absent for a version the hub tracked before it recorded pins, and for a ref
+ *  no transport can hash — never an error, just no pin to write. */
+export interface ModuleVersion {
+  version: string;
+  integrity?: string;
+}
+
 /** Version enumeration for one version-independent base ref, newest first.
  *
  *  Narrower than the full `IdeEnvironmentAdapter` on purpose. It is the only
  *  environment capability an upgrade check needs, and a host that caches or
  *  throttles hub traffic wraps just this — a CodeLens re-resolves far more
  *  often than a completion popup opens, so the refresh cadence is the host's
- *  policy, not this module's. A host backed by the hub passes
- *  `adapter.listVersionsForRef`. */
-export type ModuleVersionLookup = (baseRef: string) => Promise<string[]>;
+ *  policy, not this module's.
+ *
+ *  Deliberately NOT `adapter.listVersionsForRef`, which answers `string[]`:
+ *  completion offers names, an upgrade writes a pin, so the two want different
+ *  things from one route. A host backed by the hub fetches
+ *  `GET /module/versions` and passes the body through
+ *  {@link parseModuleVersions}. */
+export type ModuleVersionLookup = (baseRef: string) => Promise<ModuleVersion[]>;
 
 /** A source edit a host applies verbatim to upgrade an import. Ranges never
  *  overlap, within an upgrade or across a batch, so a host may apply the whole
@@ -36,19 +56,40 @@ export interface ImportUpgrade {
   source: string;
   currentVersion: string;
   latestVersion: string;
-  /** The source that replaces it: re-pointed at `latestVersion` with the
-   *  integrity pin dropped. */
+  /** What the import resolves to after the edits, in the same folded form as
+   *  `source` — re-pointed at `latestVersion`, carrying the new pin as a
+   *  `#sha256-…` fragment when one was available. Folded rather than literal
+   *  because where the pin physically lands depends on the shape the author
+   *  wrote (fragment vs `integrity:` sibling), and a host showing this as a
+   *  preview wants the resolved import, not one of two spellings of it. */
   newSource: string;
-  /** True when the replaced import carried a pin. A host that cannot recompute
-   *  the hash should say so — the pin covers the version being replaced, and
-   *  `telo upgrade` re-pins either shape. */
+  /** True when the replaced import carried a pin. */
   wasPinned: boolean;
+  /** True when the edits leave the import pinned to `latestVersion`. False
+   *  means no pin was available for the target version — a host should say so
+   *  when `wasPinned`, since the rewrite silently drops a hash the author had. */
+  repinned: boolean;
   /** Span of the alias key — where a per-entry affordance anchors. */
   keyRange: Range;
   /** Apply all of these to upgrade this one import. */
   edits: ImportUpgradeEdit[];
 }
 
+/** One import that is already at the newest version but carries no integrity
+ *  pin, and for which a pin is available. Mirrors what `telo upgrade` does with
+ *  `ensurePinned`: a rarely-released module whose version never moves would
+ *  otherwise stay unpinned forever, because nothing ever offers to rewrite it. */
+export interface ImportPin {
+  alias: string;
+  source: string;
+  version: string;
+  /** The source that replaces it: unchanged but for the appended pin. */
+  newSource: string;
+  /** Span of the alias key — where a per-entry affordance anchors. */
+  keyRange: Range;
+  edits: ImportUpgradeEdit[];
+}
+
 /** An import that IS behind but that this module declines to rewrite. Carries
  *  the same anchor and versions an {@link ImportUpgrade} does, so a host can
  *  render it in place of the upgrade affordance rather than leaving the author
@@ -67,6 +108,7 @@ export interface ImportUpgradeSet {
   /** Span of the `imports:` key — where a summary affordance anchors. */
   importsKeyRange: Range;
   upgrades: ImportUpgrade[];
+  pins: ImportPin[];
   skipped: ImportUpgradeSkip[];
   /** Base refs whose version lookup failed. Never thrown: one unreachable ref
    *  must not blank the affordances for every other import in the file. The
@@ -77,7 +119,8 @@ export interface ImportUpgradeSet {
 /**
  * Find every `imports:` entry of a module document that names a version older
  * than the newest one `listVersions` reports, and produce the source edits that
- * re-point it.
+ * re-point it — plus every entry already at the newest version that carries no
+ * integrity pin, and the edits that pin it.
  *
  * Skips what carries no upgradeable version: local path imports, bare URLs,
  * untagged refs, and pins that are not SemVer (an OCI digest, a moving tag like
@@ -104,20 +147,33 @@ export async function buildImportUpgrades(
   });
 
   const failures: Array<{ baseRef: string; message: string }> = [];
-  const latest = await resolveLatest(
+  const known = await resolveVersions(
     [...new Set(candidates.map((c) => c.ref.baseRef))],
     listVersions,
     failures,
   );
 
   const upgrades: ImportUpgrade[] = [];
+  const pins: ImportPin[] = [];
   const skipped: ImportUpgradeSkip[] = [];
 
   for (const { entry, ref } of candidates) {
-    const newest = latest.get(ref.baseRef);
-    if (!newest || !isNewerModuleVersion(newest, ref.version)) continue;
+    const versions = known.get(ref.baseRef);
+    if (!versions) continue;
+    const newest = newestModuleVersion(versions.map((v) => v.version));
+    if (!newest) continue;
 
-    if (entry.integrityInline) {
+    if (!isNewerModuleVersion(newest, ref.version)) {
+      const pin = pinInPlace(entry, ref.version, ref.integrity, versions);
+      if (pin) pins.push(pin);
+      continue;
+    }
+
+    const integrity = integrityFor(versions, newest);
+    // A stale pin that can be neither replaced nor removed is the one case left
+    // that has to be declined: re-pointing the source while leaving a hash for
+    // the version it replaced turns the next install into a tamper error.
+    if (ref.integrity && !integrity && entry.integrity && !entry.integrity.lineRange) {
       skipped.push({
         alias: entry.alias,
         currentVersion: ref.version,
@@ -125,66 +181,124 @@ export async function buildImportUpgrades(
         keyRange: entry.keyRange,
         reason:
           `'${entry.alias}' carries an inline 'integrity:' that shares a line with other ` +
-          `fields, so the stale pin cannot be removed by a line edit. Run \`telo upgrade\`.`,
+          `fields, and no pin is published for ${newest}, so the stale one cannot be ` +
+          `removed by a line edit. Run \`telo upgrade\`.`,
       });
       continue;
     }
 
+    const newSource = withRefVersion(entry.source, newest);
     upgrades.push({
       alias: entry.alias,
       source: entry.source,
       currentVersion: ref.version,
       latestVersion: newest,
-      newSource: withRefVersion(entry.source, newest),
+      newSource: foldIntegrity(newSource, integrity),
       wasPinned: ref.integrity != null,
+      repinned: integrity != null,
       keyRange: entry.keyRange,
-      edits: buildEdits(entry, withRefVersion(entry.source, newest)),
+      edits: buildEdits(entry, newSource, integrity),
     });
   }
 
-  return { importsKeyRange: block.keyRange, upgrades, skipped, failures };
+  return { importsKeyRange: block.keyRange, upgrades, pins, skipped, failures };
 }
 
-/** Re-point the source scalar, and delete a now-stale object-form `integrity:`
- *  line. `withRefVersion` already strips an inline `#sha256-…` fragment, so the
- *  scalar shorthand needs no second edit. Dropping the pin is not optional: it
- *  hashes the `telo.yaml` of the version being replaced, so carrying it onto a
- *  different version turns the next install into a tamper error. */
-function buildEdits(entry: ImportEntry, newSource: string): ImportUpgradeEdit[] {
+/** The edits that re-point an entry at `newSource` and settle its pin.
+ *
+ *  Where the pin is written follows the shape the author chose: an entry with an
+ *  `integrity:` sibling keeps it (its value is replaced in place, which works in
+ *  block and flow style alike), and everything else carries the pin inside the
+ *  source as a `#sha256-…` fragment — the form `telo upgrade` writes.
+ *
+ *  With no pin available the sibling is deleted instead. That is not optional:
+ *  it hashes the `telo.yaml` of the version being replaced, so carrying it onto
+ *  a different version turns the next install into a tamper error.
+ *  `withRefVersion` has already stripped a fragment-form pin for the same
+ *  reason, so the scalar shorthand needs no second edit. */
+function buildEdits(
+  entry: ImportEntry,
+  newSource: string,
+  integrity: string | undefined,
+): ImportUpgradeEdit[] {
+  if (!entry.integrity) {
+    return [{ range: entry.sourceRange, newText: foldIntegrity(newSource, integrity) }];
+  }
+
   const edits: ImportUpgradeEdit[] = [{ range: entry.sourceRange, newText: newSource }];
-  if (entry.integrityLineRange) {
-    edits.push({ range: entry.integrityLineRange, newText: "" });
+  if (integrity) {
+    edits.push({ range: entry.integrity.valueRange, newText: integrity });
+  } else if (entry.integrity.lineRange) {
+    edits.push({ range: entry.integrity.lineRange, newText: "" });
   }
   return edits;
 }
 
-/** Newest version per base ref, fetched once each. A ref whose lookup rejects
- *  is recorded in `failures` and left out of the map, so it yields no upgrade
+/** Pin an entry that is already at the newest version, or `undefined` when
+ *  there is nothing to do — it is pinned already, the hub published no pin for
+ *  the version it names, or that version is not one this module will order.
+ *
+ *  The version gate matters: a moving tag (`latest`) or a digest names bytes
+ *  that are expected to change, so pinning it would break the next release
+ *  rather than protect it. `telo upgrade` draws the same line. */
+function pinInPlace(
+  entry: ImportEntry,
+  version: string,
+  existingIntegrity: string | undefined,
+  versions: ModuleVersion[],
+): ImportPin | undefined {
+  if (existingIntegrity != null || entry.integrity) return undefined;
+  if (parseModuleVersion(version) === null) return undefined;
+  const integrity = integrityFor(versions, version);
+  if (!integrity) return undefined;
+
+  const newSource = foldIntegrity(entry.source, integrity);
+  return {
+    alias: entry.alias,
+    source: entry.source,
+    version,
+    newSource,
+    keyRange: entry.keyRange,
+    edits: [{ range: entry.sourceRange, newText: newSource }],
+  };
+}
+
+/** The pin the hub reports for one version, matched by SemVer identity rather
+ *  than string equality so a `v`-prefixed tag on either side still lines up.
+ *
+ *  Re-checked here even though the host's parse already did: this value is
+ *  spliced into the author's YAML, and a caller reaching the builder through
+ *  its own `ModuleVersionLookup` never passed through that parse. */
+function integrityFor(versions: ModuleVersion[], version: string): string | undefined {
+  const integrity = versions.find((v) => isSameModuleVersion(v.version, version))?.integrity;
+  return isCanonicalIntegrity(integrity) ? integrity : undefined;
+}
+
+/** Versions per base ref, fetched once each. A ref whose lookup rejects is
+ *  recorded in `failures` and left out of the map, so it yields no upgrade
  *  rather than a wrong one. */
-async function resolveLatest(
+async function resolveVersions(
   baseRefs: string[],
   listVersions: ModuleVersionLookup,
   failures: Array<{ baseRef: string; message: string }>,
-): Promise<Map<string, string>> {
+): Promise<Map<string, ModuleVersion[]>> {
   const results = await Promise.all(
     baseRefs.map(async (baseRef) => {
       try {
-        const versions = await listVersions(baseRef);
-        return { baseRef, newest: newestModuleVersion(versions) };
+        return { baseRef, versions: await listVersions(baseRef) };
       } catch (err) {
         failures.push({
           baseRef,
           message: err instanceof Error ? err.message : String(err),
         });
-        return { baseRef, newest: undefined };
+        return { baseRef, versions: undefined };
       }
     }),
   );
 
-  const map = new Map<string, string>();
-  for (const { baseRef, newest } of results) {
-    if (newest) map.set(baseRef, newest);
+  const map = new Map<string, ModuleVersion[]>();
+  for (const { baseRef, versions } of results) {
+    if (versions) map.set(baseRef, versions);
   }
   return map;
 }
-

package/src/import-upgrades/find-import-entries.ts

@@ -24,17 +24,24 @@ export interface ImportEntry {
    *  shorthand, the `source:` value for the object form. Replacing this span
    *  re-points the import. */
   sourceRange: Range;
-  /** Whole-line span of an object-form `integrity:` entry, including its
-   *  trailing newline, so a caller can delete the line. Absent for the scalar
-   *  shorthand (where the pin rides inside `sourceRange`) and for an entry that
-   *  declares no `integrity:`. */
-  integrityLineRange?: Range;
-  /** Set when the entry carries an `integrity:` sibling that does NOT occupy
-   *  whole lines of its own (a flow-style `{source: …, integrity: …}` map).
-   *  Deleting it would need a structural rewrite rather than a line splice, so
-   *  a caller that cannot leave the pin behind must skip this entry rather
-   *  than re-point it and strand a hash for the version it replaced. */
-  integrityInline?: boolean;
+  /** Where an object-form `integrity:` sibling sits, when the entry declares
+   *  one. Absent for the scalar shorthand — there the pin rides inside
+   *  `sourceRange` as a `#sha256-…` fragment — and for an unpinned entry. */
+  integrity?: ImportEntryIntegrity;
+}
+
+/** The two spans a caller needs to act on an object-form `integrity:`: one to
+ *  re-pin it, one to remove it. They are separate because a flow-style map
+ *  (`{source: …, integrity: …}`) supports the first and not the second. */
+export interface ImportEntryIntegrity {
+  /** Span of the hash value itself. Replacing it re-pins the entry in the shape
+   *  the author wrote, in any YAML style. */
+  valueRange: Range;
+  /** Whole-line span of the `integrity:` entry including its trailing newline,
+   *  so a caller with no replacement hash can delete the line outright. Absent
+   *  when the pair shares a line with other content, where removing it would
+   *  need a structural rewrite rather than a line splice. */
+  lineRange?: Range;
 }
 
 /** Where the `imports:` map lives in a module document. */
@@ -116,14 +123,15 @@ function readEntry(
   };
 
   if (integrityPair?.value && integrity !== undefined) {
-    const lineSpan = wholeLineSpan(
-      integrityPair.key.range[0],
-      integrityPair.value.range[1],
-      text,
-      lineOffsets,
-    );
-    if (lineSpan) entry.integrityLineRange = lineSpan;
-    else entry.integrityInline = true;
+    entry.integrity = {
+      valueRange: toRange(integrityPair.value, lineOffsets),
+      lineRange: wholeLineSpan(
+        integrityPair.key.range[0],
+        integrityPair.value.range[1],
+        text,
+        lineOffsets,
+      ),
+    };
   }
 
   return entry;

package/src/import-upgrades/index.ts

@@ -1,10 +1,17 @@
 export { buildImportUpgrades } from "./build-import-upgrades.js";
 export type {
+  ImportPin,
   ImportUpgrade,
   ImportUpgradeEdit,
   ImportUpgradeSet,
   ImportUpgradeSkip,
+  ModuleVersion,
   ModuleVersionLookup,
 } from "./build-import-upgrades.js";
+export { parseModuleVersions } from "./parse-module-versions.js";
 export { findImportEntries } from "./find-import-entries.js";
-export type { ImportEntry, ImportsBlock } from "./find-import-entries.js";
+export type {
+  ImportEntry,
+  ImportEntryIntegrity,
+  ImportsBlock,
+} from "./find-import-entries.js";

package/src/import-upgrades/parse-module-versions.ts

@@ -0,0 +1,30 @@
+import { isCanonicalIntegrity } from "@telorun/analyzer";
+import type { ModuleVersion } from "./build-import-upgrades.js";
+
+/**
+ * Read the hub's `GET /module/versions` payload into {@link ModuleVersion}s,
+ * newest first (the route's own ordering, preserved).
+ *
+ * Pure — the host owns the `fetch`, as everything else in this package does.
+ * It lives here rather than in each host because the shape is this package's:
+ * three hosts parsing the same route by hand is how one of them was left
+ * filtering for strings after the route started returning objects, which
+ * TypeScript could not catch behind the response cast and which surfaced only
+ * as a silently empty version list.
+ *
+ * Tolerant by design: an entry with no usable `version` is dropped rather than
+ * throwing, and an `integrity` that is not a canonical `sha256-<base64url>` is
+ * discarded rather than carried — a pin is spliced into the author's YAML, so a
+ * malformed one has to become "no pin", never corrupt text.
+ */
+export function parseModuleVersions(payload: unknown): ModuleVersion[] {
+  const versions = (payload as { versions?: unknown } | null | undefined)?.versions;
+  if (!Array.isArray(versions)) return [];
+
+  return versions.flatMap((entry) => {
+    const version = (entry as { version?: unknown } | null)?.version;
+    if (typeof version !== "string" || version === "") return [];
+    const integrity = (entry as { integrity?: unknown }).integrity;
+    return [isCanonicalIntegrity(integrity) ? { version, integrity } : { version }];
+  });
+}