@telorun/kernel 0.41.0 → 0.43.0

package/dist/transports/oci/oci-client.js

@@ -0,0 +1,170 @@
+import { createHash } from "node:crypto";
+import { resolveDockerCredential } from "./docker-credentials.js";
+export const TELO_LAYER_MEDIA_TYPE = "application/vnd.telo.module.v1+tar";
+export const OCI_MANIFEST_MEDIA_TYPE = "application/vnd.oci.image.manifest.v1+json";
+export const OCI_EMPTY_CONFIG_MEDIA_TYPE = "application/vnd.oci.empty.v1+json";
+/** The standard OCI empty descriptor — config `{}` (2 bytes). */
+const EMPTY_CONFIG = Buffer.from("{}", "utf-8");
+const EMPTY_CONFIG_DIGEST = "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a";
+const MANIFEST_ACCEPT = [
+    OCI_MANIFEST_MEDIA_TYPE,
+    "application/vnd.oci.image.index.v1+json",
+    "application/vnd.docker.distribution.manifest.v2+json",
+    "application/vnd.docker.distribution.manifest.list.v2+json",
+].join(", ");
+function sha256Hex(bytes) {
+    return createHash("sha256").update(bytes).digest("hex");
+}
+/** Parse a `WWW-Authenticate: Bearer realm="...",service="...",scope="..."` header. */
+function parseBearerChallenge(header) {
+    const out = {};
+    const params = header.replace(/^Bearer\s+/i, "");
+    for (const m of params.matchAll(/([a-z]+)="([^"]*)"/gi)) {
+        out[m[1].toLowerCase()] = m[2];
+    }
+    return out;
+}
+/**
+ * A minimal OCI distribution (registry v2) client — exactly the surface Telo
+ * needs: pull manifest / pull blob / push blob / push manifest / list tags,
+ * with the `WWW-Authenticate` bearer-token handshake and the ambient Docker
+ * credential chain. Hand-rolled rather than depending on a stale/Deno-only
+ * client (see plan Decisions). One instance per `(host, repo)`; tokens are
+ * cached per scope for the instance's lifetime.
+ */
+export class OciClient {
+    constructor(host, repo) {
+        this.host = host;
+        this.repo = repo;
+        this.tokenByScope = new Map();
+    }
+    base() {
+        return `https://${this.host}/v2/${this.repo}`;
+    }
+    pullScope() {
+        return `repository:${this.repo}:pull`;
+    }
+    pushScope() {
+        return `repository:${this.repo}:pull,push`;
+    }
+    /** Fetch with the bearer-token dance: try (cached token if any), and on 401
+     *  resolve a token from the `WWW-Authenticate` challenge and retry once. */
+    async authedFetch(url, init, scope) {
+        const withToken = (token) => {
+            const headers = new Headers(init.headers);
+            if (token)
+                headers.set("authorization", `Bearer ${token}`);
+            return { ...init, headers };
+        };
+        const cached = this.tokenByScope.get(scope);
+        let res = await fetch(url, withToken(cached));
+        if (res.status !== 401)
+            return res;
+        const challenge = res.headers.get("www-authenticate");
+        if (!challenge)
+            return res;
+        const token = await this.fetchToken(challenge, scope);
+        if (!token)
+            return res;
+        this.tokenByScope.set(scope, token);
+        // Drain the 401 body so the connection can be reused.
+        await res.text().catch(() => { });
+        return fetch(url, withToken(token));
+    }
+    /** Exchange a bearer challenge for a token, authenticating to the token
+     *  service with Docker credentials when available (else anonymous). */
+    async fetchToken(challenge, scope) {
+        const params = parseBearerChallenge(challenge);
+        if (!params.realm)
+            return null;
+        const tokenUrl = new URL(params.realm);
+        if (params.service)
+            tokenUrl.searchParams.set("service", params.service);
+        tokenUrl.searchParams.set("scope", params.scope || scope);
+        const headers = new Headers();
+        const cred = await resolveDockerCredential(this.host);
+        if (cred) {
+            const basic = Buffer.from(`${cred.username}:${cred.password}`).toString("base64");
+            headers.set("authorization", `Basic ${basic}`);
+        }
+        const res = await fetch(tokenUrl.href, { headers });
+        if (!res.ok)
+            return null;
+        const body = (await res.json());
+        return body.token ?? body.access_token ?? null;
+    }
+    async pullManifest(reference) {
+        const res = await this.authedFetch(`${this.base()}/manifests/${reference}`, { headers: { accept: MANIFEST_ACCEPT } }, this.pullScope());
+        if (!res.ok) {
+            throw new Error(`OCI pull manifest ${this.repo}:${reference} on ${this.host} failed: ${res.status} ${res.statusText}`);
+        }
+        return (await res.json());
+    }
+    async pullBlob(digest) {
+        const res = await this.authedFetch(`${this.base()}/blobs/${digest}`, {}, this.pullScope());
+        if (!res.ok) {
+            throw new Error(`OCI pull blob ${digest} from ${this.repo} on ${this.host} failed: ${res.status} ${res.statusText}`);
+        }
+        return Buffer.from(await res.arrayBuffer());
+    }
+    async listTags() {
+        const res = await this.authedFetch(`${this.base()}/tags/list`, {}, this.pullScope());
+        if (res.status === 404)
+            return [];
+        if (!res.ok) {
+            throw new Error(`OCI list tags for ${this.repo} on ${this.host} failed: ${res.status} ${res.statusText}`);
+        }
+        const body = (await res.json());
+        return Array.isArray(body.tags) ? body.tags : [];
+    }
+    /** Upload `bytes` as a blob (skipped when already present), returning its
+     *  `sha256:<hex>` digest. Two-step upload: obtain a session, then PUT with
+     *  the digest. */
+    async pushBlob(bytes) {
+        const digest = `sha256:${sha256Hex(bytes)}`;
+        const head = await this.authedFetch(`${this.base()}/blobs/${digest}`, { method: "HEAD" }, this.pushScope());
+        if (head.ok)
+            return digest; // already present
+        await head.text().catch(() => { });
+        const start = await this.authedFetch(`${this.base()}/blobs/uploads/`, { method: "POST" }, this.pushScope());
+        if (start.status !== 202) {
+            throw new Error(`OCI blob upload start for ${this.repo} on ${this.host} failed: ${start.status} ${start.statusText}`);
+        }
+        const location = start.headers.get("location");
+        await start.text().catch(() => { });
+        if (!location) {
+            throw new Error(`OCI blob upload for ${this.repo} returned no Location header`);
+        }
+        const uploadUrl = new URL(location, `https://${this.host}`);
+        uploadUrl.searchParams.set("digest", digest);
+        const put = await this.authedFetch(uploadUrl.href, {
+            method: "PUT",
+            headers: { "content-type": "application/octet-stream" },
+            body: bytes,
+        }, this.pushScope());
+        if (put.status !== 201) {
+            const detail = await put.text().catch(() => "");
+            throw new Error(`OCI blob PUT for ${this.repo} on ${this.host} failed: ${put.status} ${put.statusText} ${detail}`);
+        }
+        return digest;
+    }
+    async pushManifest(reference, manifest) {
+        const body = Buffer.from(JSON.stringify(manifest), "utf-8");
+        const res = await this.authedFetch(`${this.base()}/manifests/${reference}`, { method: "PUT", headers: { "content-type": OCI_MANIFEST_MEDIA_TYPE }, body }, this.pushScope());
+        if (res.status !== 201) {
+            const detail = await res.text().catch(() => "");
+            throw new Error(`OCI push manifest ${this.repo}:${reference} on ${this.host} failed: ${res.status} ${res.statusText} ${detail}`);
+        }
+    }
+    /** Push the standard empty config blob and return its descriptor. */
+    async pushEmptyConfig() {
+        await this.pushBlob(EMPTY_CONFIG);
+        return {
+            mediaType: OCI_EMPTY_CONFIG_MEDIA_TYPE,
+            digest: EMPTY_CONFIG_DIGEST,
+            size: EMPTY_CONFIG.length,
+            data: EMPTY_CONFIG.toString("base64"),
+        };
+    }
+}
+//# sourceMappingURL=oci-client.js.map

package/dist/transports/oci/oci-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oci-client.js","sourceRoot":"","sources":["../../../src/transports/oci/oci-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAElE,MAAM,CAAC,MAAM,qBAAqB,GAAG,oCAAoC,CAAC;AAC1E,MAAM,CAAC,MAAM,uBAAuB,GAAG,4CAA4C,CAAC;AACpF,MAAM,CAAC,MAAM,2BAA2B,GAAG,mCAAmC,CAAC;AAE/E,iEAAiE;AACjE,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAChD,MAAM,mBAAmB,GAAG,yEAAyE,CAAC;AAEtG,MAAM,eAAe,GAAG;IACtB,uBAAuB;IACvB,yCAAyC;IACzC,sDAAsD;IACtD,2DAA2D;CAC5D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAkBb,SAAS,SAAS,CAAC,KAAiB;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,uFAAuF;AACvF,SAAS,oBAAoB,CAAC,MAAc;IAC1C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,SAAS;IAGpB,YACmB,IAAY,EACZ,IAAY;QADZ,SAAI,GAAJ,IAAI,CAAQ;QACZ,SAAI,GAAJ,IAAI,CAAQ;QAJd,iBAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAKvD,CAAC;IAEI,IAAI;QACV,OAAO,WAAW,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;IAChD,CAAC;IAEO,SAAS;QACf,OAAO,cAAc,IAAI,CAAC,IAAI,OAAO,CAAC;IACxC,CAAC;IAEO,SAAS;QACf,OAAO,cAAc,IAAI,CAAC,IAAI,YAAY,CAAC;IAC7C,CAAC;IAED;gFAC4E;IACpE,KAAK,CAAC,WAAW,CACvB,GAAW,EACX,IAAiB,EACjB,KAAa;QAEb,MAAM,SAAS,GAAG,CAAC,KAAc,EAAe,EAAE;YAChD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,KAAK;gBAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;YAC3D,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC;QAC9B,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9C,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,GAAG,CAAC;QAEnC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS;YAAE,OAAO,GAAG,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK;YAAE,OAAO,GAAG,CAAC;QACvB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACpC,sDAAsD;QACtD,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACjC,OAAO,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACtC,CAAC;IAED;2EACuE;IAC/D,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,KAAa;QACvD,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,OAAO;YAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACzE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC;QAE1D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAClF,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,KAAK,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8C,CAAC;QAC7E,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,SAAiB;QAClC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAChC,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,SAAS,EAAE,EACvC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,EACxC,IAAI,CAAC,SAAS,EAAE,CACjB,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,CAAC,IAAI,IAAI,SAAS,OAAO,IAAI,CAAC,IAAI,YAAY,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CACtG,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAgB,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAc;QAC3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC3F,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,iBAAiB,MAAM,SAAS,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,YAAY,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CACpG,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACrF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,YAAY,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CACzF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA+B,CAAC;QAC9D,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,CAAC;IAED;;sBAEkB;IAClB,KAAK,CAAC,QAAQ,CAAC,KAAiB;QAC9B,MAAM,MAAM,GAAG,UAAU,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAE5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CACjC,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,MAAM,EAAE,EAChC,EAAE,MAAM,EAAE,MAAM,EAAE,EAClB,IAAI,CAAC,SAAS,EAAE,CACjB,CAAC;QACF,IAAI,IAAI,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,CAAC,kBAAkB;QAC9C,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAElC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAClC,GAAG,IAAI,CAAC,IAAI,EAAE,iBAAiB,EAC/B,EAAE,MAAM,EAAE,MAAM,EAAE,EAClB,IAAI,CAAC,SAAS,EAAE,CACjB,CAAC;QACF,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,6BAA6B,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,YAAY,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,UAAU,EAAE,CACrG,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,IAAI,8BAA8B,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,WAAW,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5D,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAE7C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAChC,SAAS,CAAC,IAAI,EACd;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;YACvD,IAAI,EAAE,KAAK;SACZ,EACD,IAAI,CAAC,SAAS,EAAE,CACjB,CAAC;QACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,oBAAoB,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,YAAY,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,IAAI,MAAM,EAAE,CAClG,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,SAAiB,EAAE,QAAqB;QACzD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAChC,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,SAAS,EAAE,EACvC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,uBAAuB,EAAE,EAAE,IAAI,EAAE,EAC7E,IAAI,CAAC,SAAS,EAAE,CACjB,CAAC;QACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,CAAC,IAAI,IAAI,SAAS,OAAO,IAAI,CAAC,IAAI,YAAY,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,IAAI,MAAM,EAAE,CAChH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,KAAK,CAAC,eAAe;QACnB,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAClC,OAAO;YACL,SAAS,EAAE,2BAA2B;YACtC,MAAM,EAAE,mBAAmB;YAC3B,IAAI,EAAE,YAAY,CAAC,MAAM;YACzB,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;SACtC,CAAC;IACJ,CAAC;CACF"}

package/dist/transports/oci/oci-ref.d.ts

@@ -0,0 +1,21 @@
+export declare const OCI_SCHEME = "oci://";
+/** A parsed `oci://host/repo@reference` module ref.
+ *
+ *  - `host` — the registry host (`ghcr.io`, `123.dkr.ecr.us-east-1.amazonaws.com`).
+ *  - `repo` — the repository path (`aws/telo-s3`), possibly multi-segment.
+ *  - `reference` — a tag (`1.2.0`) or a digest (`sha256:...`); the OCI address.
+ *  - `integrity` — Telo's inline `sha256-<base64url>` hash when the ref is pinned
+ *    (authoritative across transports; the OCI digest is only corroborating). */
+export interface ParsedOciRef {
+    host: string;
+    repo: string;
+    reference: string;
+    integrity?: string;
+}
+/** True when `ref` uses the `oci://` scheme (integrity fragment tolerated). */
+export declare function isOciRef(ref: string): boolean;
+/** Parse `oci://host/repo@reference[#sha256-...]`. Throws on a malformed ref.
+ *  A `reference` may be a tag or a `sha256:` digest; when absent (`@` omitted)
+ *  it defaults to `latest`, matching OCI tooling. */
+export declare function parseOciRef(ref: string): ParsedOciRef;
+//# sourceMappingURL=oci-ref.d.ts.map

package/dist/transports/oci/oci-ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oci-ref.d.ts","sourceRoot":"","sources":["../../../src/transports/oci/oci-ref.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,UAAU,WAAW,CAAC;AAEnC;;;;;;iFAMiF;AACjF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,+EAA+E;AAC/E,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE7C;AAED;;qDAEqD;AACrD,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CA0BrD"}

package/dist/transports/oci/oci-ref.js

@@ -0,0 +1,36 @@
+import { splitIntegrity } from "@telorun/analyzer";
+export const OCI_SCHEME = "oci://";
+/** True when `ref` uses the `oci://` scheme (integrity fragment tolerated). */
+export function isOciRef(ref) {
+    return splitIntegrity(ref).base.startsWith(OCI_SCHEME);
+}
+/** Parse `oci://host/repo@reference[#sha256-...]`. Throws on a malformed ref.
+ *  A `reference` may be a tag or a `sha256:` digest; when absent (`@` omitted)
+ *  it defaults to `latest`, matching OCI tooling. */
+export function parseOciRef(ref) {
+    const { base, integrity } = splitIntegrity(ref);
+    if (!base.startsWith(OCI_SCHEME)) {
+        throw new Error(`Invalid OCI reference '${ref}', expected oci://host/repo@reference`);
+    }
+    const rest = base.slice(OCI_SCHEME.length);
+    const slash = rest.indexOf("/");
+    if (slash <= 0) {
+        throw new Error(`Invalid OCI reference '${ref}', missing repository path after host`);
+    }
+    const host = rest.slice(0, slash);
+    let repoAndRef = rest.slice(slash + 1);
+    let reference = "latest";
+    const at = repoAndRef.lastIndexOf("@");
+    // A digest reference is `repo@sha256:...` — the `@` before `sha256:` is the
+    // separator, not part of the repo. A tag reference has no `@`.
+    if (at > 0) {
+        reference = repoAndRef.slice(at + 1);
+        repoAndRef = repoAndRef.slice(0, at);
+    }
+    const repo = repoAndRef;
+    if (!host || !repo || !reference) {
+        throw new Error(`Invalid OCI reference '${ref}', expected oci://host/repo@reference`);
+    }
+    return { host, repo, reference, integrity };
+}
+//# sourceMappingURL=oci-ref.js.map

package/dist/transports/oci/oci-ref.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oci-ref.js","sourceRoot":"","sources":["../../../src/transports/oci/oci-ref.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC;AAgBnC,+EAA+E;AAC/E,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACzD,CAAC;AAED;;qDAEqD;AACrD,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,uCAAuC,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,uCAAuC,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAClC,IAAI,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAEvC,IAAI,SAAS,GAAG,QAAQ,CAAC;IACzB,MAAM,EAAE,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,4EAA4E;IAC5E,+DAA+D;IAC/D,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;QACX,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACrC,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC;IACxB,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,uCAAuC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAC9C,CAAC"}

package/dist/transports/oci/oci-transport.d.ts

@@ -0,0 +1,29 @@
+import { type ManifestSource } from "@telorun/analyzer";
+import type { FetchedArtifact, PublishBundle, PublishOptions, PublishResult, SiblingIdentity, Transport } from "../transport.js";
+/**
+ * OCI transport: `oci://host/repo@reference` modules on any OCI distribution
+ * registry (GHCR / ECR / Docker Hub / Harbor), over a hand-rolled minimal
+ * client. A module is a single artifact — one tar blob carrying `telo.yaml`
+ * and the `files:` payload — pushed under a standard OCI artifact manifest.
+ *
+ * Not browser-reachable (token handshake, Docker credentials, tar extraction),
+ * so its resolution `source` is Node-only; the editor resolves `oci://` imports
+ * through the discovery hub instead.
+ */
+export declare class OciTransport implements Transport {
+    readonly source: ManifestSource;
+    constructor();
+    supports(ref: string): boolean;
+    cacheLocation(ref: string): string[] | null;
+    /** Resolve a relative import against an `oci://` base, normalizing the repo to
+     *  a directory base so `../lib` under `oci://ghcr.io/aws/my-app` →
+     *  `oci://ghcr.io/aws/lib` (never `oci://ghcr.io/lib`). Non-relative refs pass
+     *  through. The reference/tag is dropped — the caller re-pins from the
+     *  sibling's own version. */
+    resolveRelative(base: string, relative: string): string;
+    listVersions(ref: string): Promise<string[] | null>;
+    fetchArtifact(ref: string): Promise<FetchedArtifact>;
+    publish(destination: string, bundle: PublishBundle, _opts?: PublishOptions): Promise<PublishResult>;
+    canonicalizeSiblingRef(destination: string, relativeSource: string, sibling: SiblingIdentity): string;
+}
+//# sourceMappingURL=oci-transport.d.ts.map

package/dist/transports/oci/oci-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oci-transport.d.ts","sourceRoot":"","sources":["../../../src/transports/oci/oci-transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,KAAK,EACV,eAAe,EACf,aAAa,EACb,cAAc,EACd,aAAa,EACb,eAAe,EACf,SAAS,EACV,MAAM,iBAAiB,CAAC;AAmDzB;;;;;;;;;GASG;AACH,qBAAa,YAAa,YAAW,SAAS;IAC5C,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;;IAchC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAI9B,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI;IAU3C;;;;iCAI6B;IAC7B,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IASjD,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC;IAMnD,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAIpD,OAAO,CACX,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,aAAa,EACrB,KAAK,GAAE,cAAmB,GACzB,OAAO,CAAC,aAAa,CAAC;IA+CzB,sBAAsB,CACpB,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,eAAe,GACvB,MAAM;CAKV"}

package/dist/transports/oci/oci-transport.js

@@ -0,0 +1,142 @@
+import { DEFAULT_MANIFEST_FILENAME, IntegrityError, verifyIntegrity, } from "@telorun/analyzer";
+import { computeFilesIntegrity, injectFilesIntegrity } from "../../bundle/files-integrity.js";
+import { readOwnerManifest } from "../../bundle/module-manifest.js";
+import { makeTarGz, readTarGz, toPayloadFiles } from "../../bundle/tar.js";
+import { OciClient, OCI_MANIFEST_MEDIA_TYPE, TELO_LAYER_MEDIA_TYPE, } from "./oci-client.js";
+import { OCI_SCHEME, isOciRef, parseOciRef } from "./oci-ref.js";
+/** Pull the module blob, returning its extracted entries and the `telo.yaml`
+ *  bytes, verified against the ref's inline hash and its own `filesIntegrity`. */
+async function pullVerified(ref) {
+    const { host, repo, reference, integrity } = parseOciRef(ref);
+    const client = new OciClient(host, repo);
+    const manifest = await client.pullManifest(reference);
+    const layer = manifest.layers.find((l) => l.mediaType === TELO_LAYER_MEDIA_TYPE) ?? manifest.layers[0];
+    if (!layer) {
+        throw new Error(`OCI artifact ${ref} has no layers`);
+    }
+    const tar = await client.pullBlob(layer.digest);
+    const entries = await readTarGz(tar);
+    const teloEntry = entries.find((e) => e.name === DEFAULT_MANIFEST_FILENAME);
+    if (!teloEntry) {
+        throw new Error(`OCI artifact ${ref} blob does not contain ${DEFAULT_MANIFEST_FILENAME}`);
+    }
+    const manifestText = typeof teloEntry.content === "string" ? teloEntry.content : teloEntry.content.toString("utf-8");
+    // Telo's inline hash is authoritative; the OCI content digest only corroborates.
+    if (integrity) {
+        await verifyIntegrity(new TextEncoder().encode(manifestText), integrity, ref);
+    }
+    const files = toPayloadFiles(entries);
+    const { filesIntegrity } = readOwnerManifest(manifestText);
+    if (filesIntegrity) {
+        const actual = await computeFilesIntegrity(files);
+        if (actual !== filesIntegrity) {
+            throw new IntegrityError(`Integrity check failed for ${ref}: filesIntegrity expected ${filesIntegrity}, ` +
+                `got ${actual}. The payload does not match the recorded hash.`);
+        }
+    }
+    return { manifest: manifestText, files };
+}
+/**
+ * OCI transport: `oci://host/repo@reference` modules on any OCI distribution
+ * registry (GHCR / ECR / Docker Hub / Harbor), over a hand-rolled minimal
+ * client. A module is a single artifact — one tar blob carrying `telo.yaml`
+ * and the `files:` payload — pushed under a standard OCI artifact manifest.
+ *
+ * Not browser-reachable (token handshake, Docker credentials, tar extraction),
+ * so its resolution `source` is Node-only; the editor resolves `oci://` imports
+ * through the discovery hub instead.
+ */
+export class OciTransport {
+    constructor() {
+        this.source = {
+            supports: (url) => this.supports(url),
+            read: async (url) => {
+                const { manifest } = await pullVerified(url);
+                const { host, repo, reference } = parseOciRef(url);
+                return { text: manifest, source: `${OCI_SCHEME}${host}/${repo}@${reference}` };
+            },
+            resolveRelative: (base, relative) => this.resolveRelative(base, relative),
+        };
+    }
+    supports(ref) {
+        return isOciRef(ref);
+    }
+    cacheLocation(ref) {
+        let parsed;
+        try {
+            parsed = parseOciRef(ref);
+        }
+        catch {
+            return null;
+        }
+        return ["__oci", parsed.host, ...parsed.repo.split("/"), parsed.reference];
+    }
+    /** Resolve a relative import against an `oci://` base, normalizing the repo to
+     *  a directory base so `../lib` under `oci://ghcr.io/aws/my-app` →
+     *  `oci://ghcr.io/aws/lib` (never `oci://ghcr.io/lib`). Non-relative refs pass
+     *  through. The reference/tag is dropped — the caller re-pins from the
+     *  sibling's own version. */
+    resolveRelative(base, relative) {
+        if (!relative.startsWith(".") && !relative.startsWith("/"))
+            return relative;
+        const { host, repo } = parseOciRef(base);
+        // Resolve the repo path with standard URL semantics against a directory base.
+        const resolved = new URL(relative, `https://${host}/${repo}/`);
+        const newRepo = resolved.pathname.replace(/^\/+/, "");
+        return `${OCI_SCHEME}${host}/${newRepo}`;
+    }
+    async listVersions(ref) {
+        const { host, repo } = parseOciRef(ref);
+        const tags = await new OciClient(host, repo).listTags();
+        return tags;
+    }
+    async fetchArtifact(ref) {
+        return pullVerified(ref);
+    }
+    async publish(destination, bundle, _opts = {}) {
+        const identity = readOwnerManifest(bundle.manifest);
+        if (!identity.version) {
+            throw new Error("OCI publish requires metadata.version (used as the tag).");
+        }
+        // Destination is a full repo (`oci://host/repo`) or host-only
+        // (`oci://host`), which defaults the repo to `<namespace>/<name>`.
+        const afterScheme = destination.replace(/^oci:\/\//, "").replace(/\/+$/, "");
+        const slash = afterScheme.indexOf("/");
+        const host = slash > 0 ? afterScheme.slice(0, slash) : afterScheme;
+        let repo = slash > 0 ? afterScheme.slice(slash + 1) : "";
+        if (!repo) {
+            if (!identity.namespace || !identity.name) {
+                throw new Error(`OCI publish to host-only '${destination}' needs metadata.namespace and metadata.name to default the repo.`);
+            }
+            repo = `${identity.namespace}/${identity.name}`;
+        }
+        const tag = identity.version;
+        // Pin the payload, then pack telo.yaml + files into the single module blob.
+        let manifestText = bundle.manifest;
+        if (bundle.files.length > 0) {
+            manifestText = injectFilesIntegrity(manifestText, await computeFilesIntegrity(bundle.files));
+        }
+        const tar = await makeTarGz([
+            { name: DEFAULT_MANIFEST_FILENAME, content: manifestText },
+            ...bundle.files.map((f) => ({ name: f.name, content: Buffer.from(f.content) })),
+        ]);
+        const client = new OciClient(host, repo);
+        const layerDigest = await client.pushBlob(tar);
+        const config = await client.pushEmptyConfig();
+        const manifest = {
+            schemaVersion: 2,
+            mediaType: OCI_MANIFEST_MEDIA_TYPE,
+            artifactType: TELO_LAYER_MEDIA_TYPE,
+            config,
+            layers: [{ mediaType: TELO_LAYER_MEDIA_TYPE, digest: layerDigest, size: tar.length }],
+        };
+        await client.pushManifest(tag, manifest);
+        return { label: `${repo}@${tag}`, url: `${OCI_SCHEME}${host}/${repo}@${tag}` };
+    }
+    canonicalizeSiblingRef(destination, relativeSource, sibling) {
+        // The sibling's repo is the destination repo with the relative applied; the
+        // version is its own (identity is the ref, not metadata).
+        return `${this.resolveRelative(destination, relativeSource)}@${sibling.version}`;
+    }
+}
+//# sourceMappingURL=oci-transport.js.map

package/dist/transports/oci/oci-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oci-transport.js","sourceRoot":"","sources":["../../../src/transports/oci/oci-transport.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,cAAc,EACd,eAAe,GAEhB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAS3E,OAAO,EACL,SAAS,EACT,uBAAuB,EACvB,qBAAqB,GAEtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEjE;kFACkF;AAClF,KAAK,UAAU,YAAY,CAAC,GAAW;IACrC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,KAAK,GACT,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,qBAAqB,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,gBAAgB,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IAErC,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,yBAAyB,CAAC,CAAC;IAC5E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,0BAA0B,yBAAyB,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,YAAY,GAChB,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAElG,iFAAiF;IACjF,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,eAAe,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAEtC,MAAM,EAAE,cAAc,EAAE,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAC3D,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;YAC9B,MAAM,IAAI,cAAc,CACtB,8BAA8B,GAAG,6BAA6B,cAAc,IAAI;gBAC9E,OAAO,MAAM,iDAAiD,CACjE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,YAAY;IAGvB;QACE,IAAI,CAAC,MAAM,GAAG;YACZ,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YACrC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAClB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;gBAC7C,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;gBACnD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,IAAI,IAAI,IAAI,SAAS,EAAE,EAAE,CAAC;YACjF,CAAC;YACD,eAAe,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC;SAC1E,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,aAAa,CAAC,GAAW;QACvB,IAAI,MAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC7E,CAAC;IAED;;;;iCAI6B;IAC7B,eAAe,CAAC,IAAY,EAAE,QAAgB;QAC5C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,QAAQ,CAAC;QAC5E,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACzC,8EAA8E;QAC9E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,WAAW,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACtD,OAAO,GAAG,UAAU,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAW;QAC5B,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,IAAI,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAAW;QAC7B,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,OAAO,CACX,WAAmB,EACnB,MAAqB,EACrB,QAAwB,EAAE;QAE1B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QAED,8DAA8D;QAC9D,mEAAmE;QACnE,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7E,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;QACnE,IAAI,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CACb,6BAA6B,WAAW,mEAAmE,CAC5G,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,GAAG,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClD,CAAC;QACD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC;QAE7B,4EAA4E;QAC5E,IAAI,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC;QACnC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,YAAY,GAAG,oBAAoB,CAAC,YAAY,EAAE,MAAM,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC;YAC1B,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,YAAY,EAAE;YAC1D,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;SAChF,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAgB;YAC5B,aAAa,EAAE,CAAC;YAChB,SAAS,EAAE,uBAAuB;YAClC,YAAY,EAAE,qBAAqB;YACnC,MAAM;YACN,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;SACtF,CAAC;QACF,MAAM,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAEzC,OAAO,EAAE,KAAK,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,IAAI,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC;IACjF,CAAC;IAED,sBAAsB,CACpB,WAAmB,EACnB,cAAsB,EACtB,OAAwB;QAExB,4EAA4E;QAC5E,0DAA0D;QAC1D,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,cAAc,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IACnF,CAAC;CACF"}

package/dist/transports/registry-transport.d.ts

@@ -0,0 +1,23 @@
+import { type ManifestSource } from "@telorun/analyzer";
+import type { FetchedArtifact, PublishBundle, PublishOptions, PublishResult, SiblingIdentity, Transport } from "./transport.js";
+/** The default HTTP transport: bare `namespace/name@version` registry refs and
+ *  direct `https://…` URLs, resolving against `registry.telo.run` (or a
+ *  configured registry). Its resolution `source` composes the browser-safe
+ *  `RegistrySource` / `HttpSource` from `analyzer`; the Node-only management
+ *  methods live here. This is the fallback transport for any ref that carries
+ *  no owning scheme, so `oci://` (or a future `s3://`) never falls through to
+ *  it — those refs are claimed by their own transport's `supports()`. */
+export declare class RegistryTransport implements Transport {
+    private readonly registryUrl;
+    private readonly registrySource;
+    private readonly httpSource;
+    readonly source: ManifestSource;
+    constructor(registryUrl?: string);
+    supports(ref: string): boolean;
+    cacheLocation(ref: string): string[] | null;
+    listVersions(ref: string): Promise<string[] | null>;
+    fetchArtifact(ref: string): Promise<FetchedArtifact>;
+    publish(destination: string, bundle: PublishBundle, opts?: PublishOptions): Promise<PublishResult>;
+    canonicalizeSiblingRef(_destination: string, _relativeSource: string, sibling: SiblingIdentity): string;
+}
+//# sourceMappingURL=registry-transport.d.ts.map

package/dist/transports/registry-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-transport.d.ts","sourceRoot":"","sources":["../../src/transports/registry-transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAQL,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAM3B,OAAO,KAAK,EACV,eAAe,EACf,aAAa,EACb,cAAc,EACd,aAAa,EACb,eAAe,EACf,SAAS,EACV,MAAM,gBAAgB,CAAC;AAiDxB;;;;;;yEAMyE;AACzE,qBAAa,iBAAkB,YAAW,SAAS;IAKrC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAJxC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;IACxC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;gBAEH,WAAW,GAAE,MAA6B;IAYvE,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAK9B,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI;IA+CrC,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC;IAenD,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IA+BpD,OAAO,CACX,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,aAAa,EACrB,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,aAAa,CAAC;IAsEzB,sBAAsB,CACpB,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,MAAM,EACvB,OAAO,EAAE,eAAe,GACvB,MAAM;CASV"}