@telorun/kernel 0.42.0 → 0.43.0

package/dist/transports/oci/oci-transport.js

@@ -0,0 +1,142 @@
+import { DEFAULT_MANIFEST_FILENAME, IntegrityError, verifyIntegrity, } from "@telorun/analyzer";
+import { computeFilesIntegrity, injectFilesIntegrity } from "../../bundle/files-integrity.js";
+import { readOwnerManifest } from "../../bundle/module-manifest.js";
+import { makeTarGz, readTarGz, toPayloadFiles } from "../../bundle/tar.js";
+import { OciClient, OCI_MANIFEST_MEDIA_TYPE, TELO_LAYER_MEDIA_TYPE, } from "./oci-client.js";
+import { OCI_SCHEME, isOciRef, parseOciRef } from "./oci-ref.js";
+/** Pull the module blob, returning its extracted entries and the `telo.yaml`
+ *  bytes, verified against the ref's inline hash and its own `filesIntegrity`. */
+async function pullVerified(ref) {
+    const { host, repo, reference, integrity } = parseOciRef(ref);
+    const client = new OciClient(host, repo);
+    const manifest = await client.pullManifest(reference);
+    const layer = manifest.layers.find((l) => l.mediaType === TELO_LAYER_MEDIA_TYPE) ?? manifest.layers[0];
+    if (!layer) {
+        throw new Error(`OCI artifact ${ref} has no layers`);
+    }
+    const tar = await client.pullBlob(layer.digest);
+    const entries = await readTarGz(tar);
+    const teloEntry = entries.find((e) => e.name === DEFAULT_MANIFEST_FILENAME);
+    if (!teloEntry) {
+        throw new Error(`OCI artifact ${ref} blob does not contain ${DEFAULT_MANIFEST_FILENAME}`);
+    }
+    const manifestText = typeof teloEntry.content === "string" ? teloEntry.content : teloEntry.content.toString("utf-8");
+    // Telo's inline hash is authoritative; the OCI content digest only corroborates.
+    if (integrity) {
+        await verifyIntegrity(new TextEncoder().encode(manifestText), integrity, ref);
+    }
+    const files = toPayloadFiles(entries);
+    const { filesIntegrity } = readOwnerManifest(manifestText);
+    if (filesIntegrity) {
+        const actual = await computeFilesIntegrity(files);
+        if (actual !== filesIntegrity) {
+            throw new IntegrityError(`Integrity check failed for ${ref}: filesIntegrity expected ${filesIntegrity}, ` +
+                `got ${actual}. The payload does not match the recorded hash.`);
+        }
+    }
+    return { manifest: manifestText, files };
+}
+/**
+ * OCI transport: `oci://host/repo@reference` modules on any OCI distribution
+ * registry (GHCR / ECR / Docker Hub / Harbor), over a hand-rolled minimal
+ * client. A module is a single artifact — one tar blob carrying `telo.yaml`
+ * and the `files:` payload — pushed under a standard OCI artifact manifest.
+ *
+ * Not browser-reachable (token handshake, Docker credentials, tar extraction),
+ * so its resolution `source` is Node-only; the editor resolves `oci://` imports
+ * through the discovery hub instead.
+ */
+export class OciTransport {
+    constructor() {
+        this.source = {
+            supports: (url) => this.supports(url),
+            read: async (url) => {
+                const { manifest } = await pullVerified(url);
+                const { host, repo, reference } = parseOciRef(url);
+                return { text: manifest, source: `${OCI_SCHEME}${host}/${repo}@${reference}` };
+            },
+            resolveRelative: (base, relative) => this.resolveRelative(base, relative),
+        };
+    }
+    supports(ref) {
+        return isOciRef(ref);
+    }
+    cacheLocation(ref) {
+        let parsed;
+        try {
+            parsed = parseOciRef(ref);
+        }
+        catch {
+            return null;
+        }
+        return ["__oci", parsed.host, ...parsed.repo.split("/"), parsed.reference];
+    }
+    /** Resolve a relative import against an `oci://` base, normalizing the repo to
+     *  a directory base so `../lib` under `oci://ghcr.io/aws/my-app` →
+     *  `oci://ghcr.io/aws/lib` (never `oci://ghcr.io/lib`). Non-relative refs pass
+     *  through. The reference/tag is dropped — the caller re-pins from the
+     *  sibling's own version. */
+    resolveRelative(base, relative) {
+        if (!relative.startsWith(".") && !relative.startsWith("/"))
+            return relative;
+        const { host, repo } = parseOciRef(base);
+        // Resolve the repo path with standard URL semantics against a directory base.
+        const resolved = new URL(relative, `https://${host}/${repo}/`);
+        const newRepo = resolved.pathname.replace(/^\/+/, "");
+        return `${OCI_SCHEME}${host}/${newRepo}`;
+    }
+    async listVersions(ref) {
+        const { host, repo } = parseOciRef(ref);
+        const tags = await new OciClient(host, repo).listTags();
+        return tags;
+    }
+    async fetchArtifact(ref) {
+        return pullVerified(ref);
+    }
+    async publish(destination, bundle, _opts = {}) {
+        const identity = readOwnerManifest(bundle.manifest);
+        if (!identity.version) {
+            throw new Error("OCI publish requires metadata.version (used as the tag).");
+        }
+        // Destination is a full repo (`oci://host/repo`) or host-only
+        // (`oci://host`), which defaults the repo to `<namespace>/<name>`.
+        const afterScheme = destination.replace(/^oci:\/\//, "").replace(/\/+$/, "");
+        const slash = afterScheme.indexOf("/");
+        const host = slash > 0 ? afterScheme.slice(0, slash) : afterScheme;
+        let repo = slash > 0 ? afterScheme.slice(slash + 1) : "";
+        if (!repo) {
+            if (!identity.namespace || !identity.name) {
+                throw new Error(`OCI publish to host-only '${destination}' needs metadata.namespace and metadata.name to default the repo.`);
+            }
+            repo = `${identity.namespace}/${identity.name}`;
+        }
+        const tag = identity.version;
+        // Pin the payload, then pack telo.yaml + files into the single module blob.
+        let manifestText = bundle.manifest;
+        if (bundle.files.length > 0) {
+            manifestText = injectFilesIntegrity(manifestText, await computeFilesIntegrity(bundle.files));
+        }
+        const tar = await makeTarGz([
+            { name: DEFAULT_MANIFEST_FILENAME, content: manifestText },
+            ...bundle.files.map((f) => ({ name: f.name, content: Buffer.from(f.content) })),
+        ]);
+        const client = new OciClient(host, repo);
+        const layerDigest = await client.pushBlob(tar);
+        const config = await client.pushEmptyConfig();
+        const manifest = {
+            schemaVersion: 2,
+            mediaType: OCI_MANIFEST_MEDIA_TYPE,
+            artifactType: TELO_LAYER_MEDIA_TYPE,
+            config,
+            layers: [{ mediaType: TELO_LAYER_MEDIA_TYPE, digest: layerDigest, size: tar.length }],
+        };
+        await client.pushManifest(tag, manifest);
+        return { label: `${repo}@${tag}`, url: `${OCI_SCHEME}${host}/${repo}@${tag}` };
+    }
+    canonicalizeSiblingRef(destination, relativeSource, sibling) {
+        // The sibling's repo is the destination repo with the relative applied; the
+        // version is its own (identity is the ref, not metadata).
+        return `${this.resolveRelative(destination, relativeSource)}@${sibling.version}`;
+    }
+}
+//# sourceMappingURL=oci-transport.js.map

package/dist/transports/oci/oci-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oci-transport.js","sourceRoot":"","sources":["../../../src/transports/oci/oci-transport.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,cAAc,EACd,eAAe,GAEhB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAS3E,OAAO,EACL,SAAS,EACT,uBAAuB,EACvB,qBAAqB,GAEtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEjE;kFACkF;AAClF,KAAK,UAAU,YAAY,CAAC,GAAW;IACrC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,KAAK,GACT,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,qBAAqB,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,gBAAgB,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IAErC,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,yBAAyB,CAAC,CAAC;IAC5E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,0BAA0B,yBAAyB,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,YAAY,GAChB,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAElG,iFAAiF;IACjF,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,eAAe,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAEtC,MAAM,EAAE,cAAc,EAAE,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAC3D,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;YAC9B,MAAM,IAAI,cAAc,CACtB,8BAA8B,GAAG,6BAA6B,cAAc,IAAI;gBAC9E,OAAO,MAAM,iDAAiD,CACjE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,YAAY;IAGvB;QACE,IAAI,CAAC,MAAM,GAAG;YACZ,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YACrC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAClB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;gBAC7C,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;gBACnD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,IAAI,IAAI,IAAI,SAAS,EAAE,EAAE,CAAC;YACjF,CAAC;YACD,eAAe,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC;SAC1E,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,aAAa,CAAC,GAAW;QACvB,IAAI,MAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC7E,CAAC;IAED;;;;iCAI6B;IAC7B,eAAe,CAAC,IAAY,EAAE,QAAgB;QAC5C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,QAAQ,CAAC;QAC5E,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACzC,8EAA8E;QAC9E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,WAAW,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACtD,OAAO,GAAG,UAAU,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAW;QAC5B,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,IAAI,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAAW;QAC7B,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,OAAO,CACX,WAAmB,EACnB,MAAqB,EACrB,QAAwB,EAAE;QAE1B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QAED,8DAA8D;QAC9D,mEAAmE;QACnE,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7E,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;QACnE,IAAI,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CACb,6BAA6B,WAAW,mEAAmE,CAC5G,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,GAAG,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClD,CAAC;QACD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC;QAE7B,4EAA4E;QAC5E,IAAI,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC;QACnC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,YAAY,GAAG,oBAAoB,CAAC,YAAY,EAAE,MAAM,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC;YAC1B,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,YAAY,EAAE;YAC1D,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;SAChF,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAgB;YAC5B,aAAa,EAAE,CAAC;YAChB,SAAS,EAAE,uBAAuB;YAClC,YAAY,EAAE,qBAAqB;YACnC,MAAM;YACN,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;SACtF,CAAC;QACF,MAAM,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAEzC,OAAO,EAAE,KAAK,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,IAAI,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC;IACjF,CAAC;IAED,sBAAsB,CACpB,WAAmB,EACnB,cAAsB,EACtB,OAAwB;QAExB,4EAA4E;QAC5E,0DAA0D;QAC1D,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,cAAc,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IACnF,CAAC;CACF"}

package/dist/transports/registry-transport.d.ts

@@ -0,0 +1,23 @@
+import { type ManifestSource } from "@telorun/analyzer";
+import type { FetchedArtifact, PublishBundle, PublishOptions, PublishResult, SiblingIdentity, Transport } from "./transport.js";
+/** The default HTTP transport: bare `namespace/name@version` registry refs and
+ *  direct `https://…` URLs, resolving against `registry.telo.run` (or a
+ *  configured registry). Its resolution `source` composes the browser-safe
+ *  `RegistrySource` / `HttpSource` from `analyzer`; the Node-only management
+ *  methods live here. This is the fallback transport for any ref that carries
+ *  no owning scheme, so `oci://` (or a future `s3://`) never falls through to
+ *  it — those refs are claimed by their own transport's `supports()`. */
+export declare class RegistryTransport implements Transport {
+    private readonly registryUrl;
+    private readonly registrySource;
+    private readonly httpSource;
+    readonly source: ManifestSource;
+    constructor(registryUrl?: string);
+    supports(ref: string): boolean;
+    cacheLocation(ref: string): string[] | null;
+    listVersions(ref: string): Promise<string[] | null>;
+    fetchArtifact(ref: string): Promise<FetchedArtifact>;
+    publish(destination: string, bundle: PublishBundle, opts?: PublishOptions): Promise<PublishResult>;
+    canonicalizeSiblingRef(_destination: string, _relativeSource: string, sibling: SiblingIdentity): string;
+}
+//# sourceMappingURL=registry-transport.d.ts.map

package/dist/transports/registry-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-transport.d.ts","sourceRoot":"","sources":["../../src/transports/registry-transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAQL,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAM3B,OAAO,KAAK,EACV,eAAe,EACf,aAAa,EACb,cAAc,EACd,aAAa,EACb,eAAe,EACf,SAAS,EACV,MAAM,gBAAgB,CAAC;AAiDxB;;;;;;yEAMyE;AACzE,qBAAa,iBAAkB,YAAW,SAAS;IAKrC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAJxC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;IACxC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;gBAEH,WAAW,GAAE,MAA6B;IAYvE,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAK9B,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI;IA+CrC,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC;IAenD,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IA+BpD,OAAO,CACX,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,aAAa,EACrB,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,aAAa,CAAC;IAsEzB,sBAAsB,CACpB,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,MAAM,EACvB,OAAO,EAAE,eAAe,GACvB,MAAM;CASV"}

package/dist/transports/registry-transport.js

@@ -0,0 +1,225 @@
+import { DEFAULT_MANIFEST_FILENAME, HttpSource, IntegrityError, RegistrySource, isRegistryRef, parseModuleRef, splitIntegrity, } from "@telorun/analyzer";
+import { createHash } from "crypto";
+import { computeFilesIntegrity, injectFilesIntegrity } from "../bundle/files-integrity.js";
+import { readOwnerManifest } from "../bundle/module-manifest.js";
+import { makeTarGz, readTarGz, toPayloadFiles } from "../bundle/tar.js";
+const DEFAULT_REGISTRY_URL = "https://registry.telo.run";
+const HTTP_NAMESPACE = "__http";
+const QUERY_HASH_LENGTH = 12;
+const MAX_PUSH_ATTEMPTS = 4;
+const PUSH_BASE_DELAY_MS = 1000;
+/** Registry / object-storage backends treat 408/425/429/5xx as transient. */
+function isRetryableStatus(status) {
+    return status === 408 || status === 425 || status === 429 || status >= 500;
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/** Mirror `HttpSource.read`'s `fetchUrl` derivation: when the URL does not
+ *  already point at a YAML file, append `/telo.yaml`, so a raw import URL and
+ *  the canonical source it resolves to map to the same cache path. */
+function normalizePathname(rawUrl, parsed) {
+    let pathname = parsed.pathname;
+    if (!rawUrl.includes(".yaml")) {
+        pathname = pathname.endsWith("/")
+            ? `${pathname}${DEFAULT_MANIFEST_FILENAME}`
+            : `${pathname}/${DEFAULT_MANIFEST_FILENAME}`;
+    }
+    return pathname;
+}
+/** Short hash of `search + hash` so two URLs that differ only in query /
+ *  fragment do not collide at the same cache path. */
+function disambiguatePath(pathname, search, hash) {
+    if (!search && !hash)
+        return pathname;
+    const digest = createHash("sha256")
+        .update(search + hash)
+        .digest("hex")
+        .slice(0, QUERY_HASH_LENGTH);
+    const dotIdx = pathname.lastIndexOf(".");
+    const slashIdx = pathname.lastIndexOf("/");
+    const ext = dotIdx > slashIdx ? pathname.slice(dotIdx) : "";
+    const base = pathname.slice(0, pathname.length - ext.length);
+    return `${base}.${digest}${ext}`;
+}
+/** The default HTTP transport: bare `namespace/name@version` registry refs and
+ *  direct `https://…` URLs, resolving against `registry.telo.run` (or a
+ *  configured registry). Its resolution `source` composes the browser-safe
+ *  `RegistrySource` / `HttpSource` from `analyzer`; the Node-only management
+ *  methods live here. This is the fallback transport for any ref that carries
+ *  no owning scheme, so `oci://` (or a future `s3://`) never falls through to
+ *  it — those refs are claimed by their own transport's `supports()`. */
+export class RegistryTransport {
+    constructor(registryUrl = DEFAULT_REGISTRY_URL) {
+        this.registryUrl = registryUrl;
+        this.registrySource = new RegistrySource(registryUrl);
+        this.httpSource = new HttpSource();
+        const pick = (ref) => this.httpSource.supports(ref) ? this.httpSource : this.registrySource;
+        this.source = {
+            supports: (url) => this.supports(url),
+            read: (url) => pick(url).read(url),
+            resolveRelative: (base, relative) => pick(base).resolveRelative(base, relative),
+        };
+    }
+    supports(ref) {
+        const { base } = splitIntegrity(ref);
+        return base.startsWith("http://") || base.startsWith("https://") || isRegistryRef(ref);
+    }
+    cacheLocation(ref) {
+        const url = splitIntegrity(ref).base;
+        const trimmedRegistry = this.registryUrl.replace(/\/+$/, "");
+        // 1. Registry ref form: namespace/name@version
+        if (isRegistryRef(url)) {
+            let parsed;
+            try {
+                parsed = parseModuleRef(url);
+            }
+            catch {
+                return null;
+            }
+            return [parsed.modulePath, parsed.version, DEFAULT_MANIFEST_FILENAME];
+        }
+        // 2. HTTP(S) URL — a direct registry URL or arbitrary external.
+        if (url.startsWith("http://") || url.startsWith("https://")) {
+            let parsed;
+            try {
+                parsed = new URL(url);
+            }
+            catch {
+                return null;
+            }
+            const pathname = normalizePathname(url, parsed);
+            // 2a. On the configured registry, no query/fragment: fold into the
+            //     registry layout so a ref and a direct URL land on the same file.
+            const normalizedUrl = `${parsed.protocol}//${parsed.host}${pathname}`;
+            if (!parsed.search &&
+                !parsed.hash &&
+                (normalizedUrl === trimmedRegistry || normalizedUrl.startsWith(`${trimmedRegistry}/`))) {
+                const rel = normalizedUrl.slice(trimmedRegistry.length + 1);
+                if (!rel)
+                    return null;
+                return rel.split("/");
+            }
+            // 2b. Arbitrary HTTP(S) → __http subtree, query-hash suffix on collision.
+            const cleanPath = pathname.startsWith("/") ? pathname.slice(1) : pathname;
+            const disambiguated = disambiguatePath(cleanPath, parsed.search, parsed.hash);
+            return [HTTP_NAMESPACE, parsed.host, ...disambiguated.split("/")];
+        }
+        return null;
+    }
+    async listVersions(ref) {
+        // Only bare registry refs are version-enumerable — a direct `https://` URL
+        // has no version-list endpoint.
+        if (!isRegistryRef(ref))
+            return null;
+        const { modulePath } = parseModuleRef(ref);
+        const url = `${this.registryUrl.replace(/\/+$/, "")}/${modulePath}`;
+        const res = await fetch(url, { headers: { accept: "application/json" } });
+        if (res.status === 404)
+            return null;
+        if (!res.ok) {
+            throw new Error(`Registry returned ${res.status} ${res.statusText} for ${modulePath}`);
+        }
+        const body = (await res.json());
+        return Array.isArray(body.versions) ? body.versions : [];
+    }
+    async fetchArtifact(ref) {
+        // `read` verifies the manifest bytes against the inline `#sha256-...` hash.
+        const { text: manifest, source } = await this.source.read(ref);
+        const meta = readOwnerManifest(manifest);
+        if (!meta.declaresFiles)
+            return { manifest, files: [] };
+        // The payload rides beside the manifest as `module.tar.gz`.
+        const tarUrl = source.replace(/\/telo\.yaml$/, "/module.tar.gz");
+        const res = await fetch(tarUrl);
+        if (!res.ok) {
+            throw new Error(`could not fetch bundle ${tarUrl}: ${res.status} ${res.statusText}`);
+        }
+        const files = toPayloadFiles(await readTarGz(Buffer.from(await res.arrayBuffer())));
+        // Verify the payload against the manifest's `filesIntegrity` before handing
+        // it back — a mismatch is terminal (a tampered bundle must never be used).
+        // The manifest that carries the hash is itself pinned by the inline hash.
+        if (meta.filesIntegrity) {
+            const actual = await computeFilesIntegrity(files);
+            if (actual !== meta.filesIntegrity) {
+                throw new IntegrityError(`Integrity check failed for bundle ${tarUrl}: filesIntegrity expected ` +
+                    `${meta.filesIntegrity}, got ${actual}. The payload does not match the recorded ` +
+                    `hash — the module may have been tampered with or republished.`);
+            }
+        }
+        return { manifest, files };
+    }
+    async publish(destination, bundle, opts = {}) {
+        // Pin the payload in the manifest before it enters the tarball, then choose
+        // the artifact body: a `module.tar.gz` when there are files, else raw YAML.
+        let manifest = bundle.manifest;
+        let body = manifest;
+        let contentType = "text/yaml";
+        let urlSuffix = "";
+        if (bundle.files.length > 0) {
+            manifest = injectFilesIntegrity(manifest, await computeFilesIntegrity(bundle.files));
+            const entries = [
+                { name: DEFAULT_MANIFEST_FILENAME, content: manifest },
+                ...bundle.files.map((f) => ({ name: f.name, content: Buffer.from(f.content) })),
+            ];
+            body = await makeTarGz(entries);
+            contentType = "application/gzip";
+            urlSuffix = "/module.tar.gz";
+        }
+        const { namespace, name, version } = readOwnerManifest(manifest);
+        if (!namespace || !name || !version) {
+            throw new Error("metadata must include namespace, name, and version.");
+        }
+        const identity = { namespace, name, version };
+        const base = `${destination.replace(/\/+$/, "")}/${identity.namespace}/${identity.name}/${identity.version}`;
+        const url = `${base}${urlSuffix}`;
+        const label = `${identity.namespace}/${identity.name}@${identity.version}`;
+        const headers = { "content-type": contentType };
+        if (opts.token)
+            headers.authorization = `Bearer ${opts.token}`;
+        let res = null;
+        let networkErr = null;
+        for (let attempt = 1; attempt <= MAX_PUSH_ATTEMPTS; attempt++) {
+            networkErr = null;
+            try {
+                res = await fetch(url, { method: "PUT", headers, body });
+            }
+            catch (err) {
+                networkErr = err;
+                res = null;
+            }
+            const transient = networkErr != null || (res != null && isRetryableStatus(res.status));
+            if (!transient)
+                break;
+            if (attempt === MAX_PUSH_ATTEMPTS)
+                break;
+            const reason = networkErr
+                ? `network error: ${networkErr instanceof Error ? networkErr.message : String(networkErr)}`
+                : `HTTP ${res.status}`;
+            // Drain the body so the underlying connection can be reused for the retry.
+            if (res)
+                await res.text().catch(() => { });
+            const delayMs = PUSH_BASE_DELAY_MS * 2 ** (attempt - 1) + Math.floor(Math.random() * 250);
+            opts.onRetry?.({ reason, attempt, maxAttempts: MAX_PUSH_ATTEMPTS, delayMs });
+            await sleep(delayMs);
+        }
+        if (networkErr) {
+            throw new Error(`Network error: ${networkErr instanceof Error ? networkErr.message : String(networkErr)} ` +
+                `(after ${MAX_PUSH_ATTEMPTS} attempts)`);
+        }
+        if (!res.ok) {
+            const ct = res.headers.get("content-type") ?? "";
+            const errBody = ct.includes("application/json") ? await res.json() : await res.text();
+            throw new Error(`Push failed (${res.status}): ${JSON.stringify(errBody)}`);
+        }
+        return { label, url };
+    }
+    canonicalizeSiblingRef(_destination, _relativeSource, sibling) {
+        // An HTTP registry path defaults to the sibling's own `<namespace>/<name>`.
+        if (!sibling.namespace || !sibling.name) {
+            throw new Error("a relative import canonicalized to an HTTP registry needs the sibling's metadata.namespace and metadata.name.");
+        }
+        return `${sibling.namespace}/${sibling.name}@${sibling.version}`;
+    }
+}
+//# sourceMappingURL=registry-transport.js.map

package/dist/transports/registry-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-transport.js","sourceRoot":"","sources":["../../src/transports/registry-transport.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,cAAc,EACd,cAAc,EACd,aAAa,EACb,cAAc,EACd,cAAc,GAEf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAC3F,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAUxE,MAAM,oBAAoB,GAAG,2BAA2B,CAAC;AACzD,MAAM,cAAc,GAAG,QAAQ,CAAC;AAChC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC,6EAA6E;AAC7E,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,IAAI,GAAG,CAAC;AAC7E,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;sEAEsE;AACtE,SAAS,iBAAiB,CAAC,MAAc,EAAE,MAAW;IACpD,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC/B,CAAC,CAAC,GAAG,QAAQ,GAAG,yBAAyB,EAAE;YAC3C,CAAC,CAAC,GAAG,QAAQ,IAAI,yBAAyB,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;sDACsD;AACtD,SAAS,gBAAgB,CAAC,QAAgB,EAAE,MAAc,EAAE,IAAY;IACtE,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC;IACtC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;SAChC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;SACrB,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7D,OAAO,GAAG,IAAI,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;AACnC,CAAC;AAMD;;;;;;yEAMyE;AACzE,MAAM,OAAO,iBAAiB;IAK5B,YAA6B,cAAsB,oBAAoB;QAA1C,gBAAW,GAAX,WAAW,CAA+B;QACrE,IAAI,CAAC,cAAc,GAAG,IAAI,cAAc,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,CAAC,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,CAAC,GAAW,EAAkB,EAAE,CAC3C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;QACxE,IAAI,CAAC,MAAM,GAAG;YACZ,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YACrC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAClC,eAAe,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC;SAChF,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC;IACzF,CAAC;IAED,aAAa,CAAC,GAAW;QACvB,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACrC,MAAM,eAAe,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAE7D,+CAA+C;QAC/C,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,MAAyC,CAAC;YAC9C,IAAI,CAAC;gBACH,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;QACxE,CAAC;QAED,gEAAgE;QAChE,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5D,IAAI,MAAW,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAEhD,mEAAmE;YACnE,uEAAuE;YACvE,MAAM,aAAa,GAAG,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;YACtE,IACE,CAAC,MAAM,CAAC,MAAM;gBACd,CAAC,MAAM,CAAC,IAAI;gBACZ,CAAC,aAAa,KAAK,eAAe,IAAI,aAAa,CAAC,UAAU,CAAC,GAAG,eAAe,GAAG,CAAC,CAAC,EACtF,CAAC;gBACD,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBAC5D,IAAI,CAAC,GAAG;oBAAE,OAAO,IAAI,CAAC;gBACtB,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;YAED,0EAA0E;YAC1E,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC1E,MAAM,aAAa,GAAG,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9E,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAW;QAC5B,2EAA2E;QAC3E,gCAAgC;QAChC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,MAAM,EAAE,UAAU,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC;QACpE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;QAC1E,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,QAAQ,UAAU,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAC;QACpD,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAAW;QAC7B,4EAA4E;QAC5E,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QAExD,4DAA4D;QAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;QAEpF,4EAA4E;QAC5E,2EAA2E;QAC3E,0EAA0E;QAC1E,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;YAClD,IAAI,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;gBACnC,MAAM,IAAI,cAAc,CACtB,qCAAqC,MAAM,4BAA4B;oBACrE,GAAG,IAAI,CAAC,cAAc,SAAS,MAAM,4CAA4C;oBACjF,+DAA+D,CAClE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,OAAO,CACX,WAAmB,EACnB,MAAqB,EACrB,OAAuB,EAAE;QAEzB,4EAA4E;QAC5E,4EAA4E;QAC5E,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC/B,IAAI,IAAI,GAAwB,QAAQ,CAAC;QACzC,IAAI,WAAW,GAAG,WAAW,CAAC;QAC9B,IAAI,SAAS,GAAG,EAAE,CAAC;QACnB,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,EAAE,MAAM,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACrF,MAAM,OAAO,GAAG;gBACd,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,QAAQ,EAAE;gBACtD,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;aAChF,CAAC;YACF,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;YAChC,WAAW,GAAG,kBAAkB,CAAC;YACjC,SAAS,GAAG,gBAAgB,CAAC;QAC/B,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,QAAQ,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC7G,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,SAAS,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,GAAG,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QAE3E,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;QACxE,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,aAAa,GAAG,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;QAE/D,IAAI,GAAG,GAAoB,IAAI,CAAC;QAChC,IAAI,UAAU,GAAY,IAAI,CAAC;QAC/B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,iBAAiB,EAAE,OAAO,EAAE,EAAE,CAAC;YAC9D,UAAU,GAAG,IAAI,CAAC;YAClB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,UAAU,GAAG,GAAG,CAAC;gBACjB,GAAG,GAAG,IAAI,CAAC;YACb,CAAC;YAED,MAAM,SAAS,GAAG,UAAU,IAAI,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YACvF,IAAI,CAAC,SAAS;gBAAE,MAAM;YACtB,IAAI,OAAO,KAAK,iBAAiB;gBAAE,MAAM;YAEzC,MAAM,MAAM,GAAG,UAAU;gBACvB,CAAC,CAAC,kBAAkB,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE;gBAC3F,CAAC,CAAC,QAAQ,GAAI,CAAC,MAAM,EAAE,CAAC;YAC1B,2EAA2E;YAC3E,IAAI,GAAG;gBAAE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,kBAAkB,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC;YAC1F,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC;YAC7E,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,kBAAkB,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG;gBACxF,UAAU,iBAAiB,YAAY,CAC1C,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,EAAE,GAAG,GAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YAClD,MAAM,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,MAAM,GAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,GAAI,CAAC,IAAI,EAAE,CAAC;YACxF,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAI,CAAC,MAAM,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACxB,CAAC;IAED,sBAAsB,CACpB,YAAoB,EACpB,eAAuB,EACvB,OAAwB;QAExB,4EAA4E;QAC5E,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,+GAA+G,CAChH,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IACnE,CAAC;CACF"}

package/dist/transports/transport-registry.d.ts

@@ -0,0 +1,40 @@
+import type { ManifestSource } from "@telorun/analyzer";
+import type { FetchedArtifact, PublishBundle, PublishOptions, PublishResult, Transport } from "./transport.js";
+/** Dispatches ref-scheme-specific operations to the transport that owns a ref.
+ *  The loader, cache source, `upgrade`, and `publish` consult this instead of
+ *  branching on ref shape. `RegistryTransport` is always last so it is the
+ *  fallback for bare / `https` refs, and a scheme-owning transport (OCI, later
+ *  S3) claims its refs via `supports()` before the fallback is reached. */
+export declare class TransportRegistry {
+    private readonly transports;
+    constructor(transports: Transport[]);
+    /** The transport that owns `ref`, or `undefined` if none does. */
+    forRef(ref: string): Transport | undefined;
+    /** The resolution `ManifestSource`s of every registered transport, in order —
+     *  the browser-safe subset the loader appends to its source chain. */
+    sources(): ManifestSource[];
+    /** Cache-path segments for `ref`, from its owning transport; `null` when no
+     *  transport owns it or the ref is not cacheable. */
+    cacheLocation(ref: string): string[] | null;
+    /** Published versions for `ref` via its owning transport; `null` when the
+     *  module is unpublished. Throws when no transport owns the ref. */
+    listVersions(ref: string): Promise<string[] | null>;
+    /** Full artifact for `ref` via its owning transport. Throws when no transport
+     *  owns the ref. */
+    fetchArtifact(ref: string): Promise<FetchedArtifact>;
+    /** Publish `bundle` to `destination` via the transport its scheme selects.
+     *  Throws when no transport owns the destination. */
+    publish(destination: string, bundle: PublishBundle, opts?: PublishOptions): Promise<PublishResult>;
+    private require;
+}
+/** The default transport set. Scheme-owning transports come first; the
+ *  `RegistryTransport` is last, the fallback for bare / `https` refs. OCI (and
+ *  later S3) claim their `oci://` / `s3://` refs before the fallback is reached. */
+export declare function defaultTransports(registryUrl?: string): Transport[];
+/** A `TransportRegistry` seeded with {@link defaultTransports}, memoized per
+ *  `registryUrl`. The default transports are stateless config (a fresh
+ *  `OciClient` with its own token cache is created per OCI operation), so one
+ *  shared instance per registry URL is safe — and avoids re-instantiating the
+ *  whole set on hot paths like `cachePathForCanonical`. */
+export declare function defaultTransportRegistry(registryUrl?: string): TransportRegistry;
+//# sourceMappingURL=transport-registry.d.ts.map

package/dist/transports/transport-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport-registry.d.ts","sourceRoot":"","sources":["../../src/transports/transport-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAIxD,OAAO,KAAK,EACV,eAAe,EACf,aAAa,EACb,cAAc,EACd,aAAa,EACb,SAAS,EACV,MAAM,gBAAgB,CAAC;AAExB;;;;2EAI2E;AAC3E,qBAAa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,SAAS,EAAE;IAEpD,kEAAkE;IAClE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS;IAI1C;0EACsE;IACtE,OAAO,IAAI,cAAc,EAAE;IAI3B;yDACqD;IACrD,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI;IAI3C;wEACoE;IACpE,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC;IAInD;wBACoB;IACpB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAIpD;yDACqD;IACrD,OAAO,CACL,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,aAAa,EACrB,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CAAC,aAAa,CAAC;IAIzB,OAAO,CAAC,OAAO;CAOhB;AAED;;oFAEoF;AACpF,wBAAgB,iBAAiB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,CAEnE;AAID;;;;2DAI2D;AAC3D,wBAAgB,wBAAwB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAQhF"}

package/dist/transports/transport-registry.js

@@ -0,0 +1,70 @@
+import { OciTransport } from "./oci/oci-transport.js";
+import { RegistryTransport } from "./registry-transport.js";
+/** Dispatches ref-scheme-specific operations to the transport that owns a ref.
+ *  The loader, cache source, `upgrade`, and `publish` consult this instead of
+ *  branching on ref shape. `RegistryTransport` is always last so it is the
+ *  fallback for bare / `https` refs, and a scheme-owning transport (OCI, later
+ *  S3) claims its refs via `supports()` before the fallback is reached. */
+export class TransportRegistry {
+    constructor(transports) {
+        this.transports = transports;
+    }
+    /** The transport that owns `ref`, or `undefined` if none does. */
+    forRef(ref) {
+        return this.transports.find((t) => t.supports(ref));
+    }
+    /** The resolution `ManifestSource`s of every registered transport, in order —
+     *  the browser-safe subset the loader appends to its source chain. */
+    sources() {
+        return this.transports.map((t) => t.source);
+    }
+    /** Cache-path segments for `ref`, from its owning transport; `null` when no
+     *  transport owns it or the ref is not cacheable. */
+    cacheLocation(ref) {
+        return this.forRef(ref)?.cacheLocation(ref) ?? null;
+    }
+    /** Published versions for `ref` via its owning transport; `null` when the
+     *  module is unpublished. Throws when no transport owns the ref. */
+    listVersions(ref) {
+        return this.require(ref).listVersions(ref);
+    }
+    /** Full artifact for `ref` via its owning transport. Throws when no transport
+     *  owns the ref. */
+    fetchArtifact(ref) {
+        return this.require(ref).fetchArtifact(ref);
+    }
+    /** Publish `bundle` to `destination` via the transport its scheme selects.
+     *  Throws when no transport owns the destination. */
+    publish(destination, bundle, opts) {
+        return this.require(destination).publish(destination, bundle, opts);
+    }
+    require(ref) {
+        const transport = this.forRef(ref);
+        if (!transport) {
+            throw new Error(`no transport owns ref '${ref}'`);
+        }
+        return transport;
+    }
+}
+/** The default transport set. Scheme-owning transports come first; the
+ *  `RegistryTransport` is last, the fallback for bare / `https` refs. OCI (and
+ *  later S3) claim their `oci://` / `s3://` refs before the fallback is reached. */
+export function defaultTransports(registryUrl) {
+    return [new OciTransport(), new RegistryTransport(registryUrl)];
+}
+const defaultRegistryCache = new Map();
+/** A `TransportRegistry` seeded with {@link defaultTransports}, memoized per
+ *  `registryUrl`. The default transports are stateless config (a fresh
+ *  `OciClient` with its own token cache is created per OCI operation), so one
+ *  shared instance per registry URL is safe — and avoids re-instantiating the
+ *  whole set on hot paths like `cachePathForCanonical`. */
+export function defaultTransportRegistry(registryUrl) {
+    const key = registryUrl ?? "";
+    let cached = defaultRegistryCache.get(key);
+    if (!cached) {
+        cached = new TransportRegistry(defaultTransports(registryUrl));
+        defaultRegistryCache.set(key, cached);
+    }
+    return cached;
+}
+//# sourceMappingURL=transport-registry.js.map

package/dist/transports/transport-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport-registry.js","sourceRoot":"","sources":["../../src/transports/transport-registry.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAS5D;;;;2EAI2E;AAC3E,MAAM,OAAO,iBAAiB;IAC5B,YAA6B,UAAuB;QAAvB,eAAU,GAAV,UAAU,CAAa;IAAG,CAAC;IAExD,kEAAkE;IAClE,MAAM,CAAC,GAAW;QAChB,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,CAAC;IAED;0EACsE;IACtE,OAAO;QACL,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED;yDACqD;IACrD,aAAa,CAAC,GAAW;QACvB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IACtD,CAAC;IAED;wEACoE;IACpE,YAAY,CAAC,GAAW;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED;wBACoB;IACpB,aAAa,CAAC,GAAW;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IAED;yDACqD;IACrD,OAAO,CACL,WAAmB,EACnB,MAAqB,EACrB,IAAqB;QAErB,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACtE,CAAC;IAEO,OAAO,CAAC,GAAW;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,GAAG,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAED;;oFAEoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,WAAoB;IACpD,OAAO,CAAC,IAAI,YAAY,EAAE,EAAE,IAAI,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAA6B,CAAC;AAElE;;;;2DAI2D;AAC3D,MAAM,UAAU,wBAAwB,CAAC,WAAoB;IAC3D,MAAM,GAAG,GAAG,WAAW,IAAI,EAAE,CAAC;IAC9B,IAAI,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,IAAI,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC;QAC/D,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/transports/transport.d.ts

@@ -0,0 +1,92 @@
+import type { ManifestSource } from "@telorun/analyzer";
+import type { PayloadFile } from "../bundle/files-integrity.js";
+/** The full module artifact a transport delivers: the `telo.yaml` bytes plus
+ *  the decompressed `files:` payload (empty for a manifest-only module). The
+ *  manifest is already verified against the import's inline hash; the payload
+ *  against the manifest-embedded `filesIntegrity`. */
+export interface FetchedArtifact {
+    manifest: string;
+    files: PayloadFile[];
+}
+/** The module bundle handed to a transport for publishing: the final,
+ *  already-analyzed / pinned / canonicalized `telo.yaml` bytes plus the `files:`
+ *  payload (empty for a manifest-only module). The transport is responsible for
+ *  pinning the payload (`filesIntegrity`) and for the artifact shape it writes
+ *  (HTTP: `telo.yaml` + `module.tar.gz`; OCI: a single blob). */
+export interface PublishBundle {
+    manifest: string;
+    files: PayloadFile[];
+}
+export interface PublishResult {
+    /** Human-readable `<ns>/<name>@<version>` label of what was pushed. */
+    label: string;
+    /** The location the artifact was written to. */
+    url: string;
+}
+/** Identity of a sibling library, read from its own manifest, that a relative
+ *  import canonicalizes to. `version` is always required; `namespace`/`name` are
+ *  used only by transports whose location is metadata-derived (HTTP registry). */
+export interface SiblingIdentity {
+    namespace?: string;
+    name?: string;
+    version: string;
+}
+export interface PublishOptions {
+    /** Bearer token for registries that require auth. */
+    token?: string;
+    /** Notified before each backoff sleep on a transient push failure, so the
+     *  caller can surface retry progress. */
+    onRetry?: (info: {
+        reason: string;
+        attempt: number;
+        maxAttempts: number;
+        delayMs: number;
+    }) => void;
+}
+/** A Transport owns everything ref-scheme-specific about a module's lifecycle:
+ *  resolution (through its `ManifestSource`), cache placement, version
+ *  enumeration, full-artifact fetch, and publish. Registering a transport is
+ *  the only thing needed to add a backend — the loader, cache, `upgrade`, and
+ *  `publish` never branch on scheme again; they ask the {@link TransportRegistry}
+ *  which transport owns a ref and delegate.
+ *
+ *  A Transport *composes* a resolution `ManifestSource`, it does not extend it:
+ *  `ManifestSource` is the browser-safe resolution primitive (also implemented
+ *  by the cache / local / memory sources, which have no versions and nothing to
+ *  publish), so it stays in `analyzer`, while the Node-only management methods
+ *  (`cacheLocation` and, in later phases, `listVersions` / `fetchArtifact` /
+ *  `publish`) live on the Transport here in `kernel`. */
+export interface Transport {
+    /** True when this transport owns the given ref (or publish destination). */
+    supports(ref: string): boolean;
+    /** The resolution primitive: fetch + verify `telo.yaml`, resolve relatives.
+     *  Browser-safe for a browser-reachable transport (HTTP/registry), so it can
+     *  live in `analyzer`; a Node-only transport has no browser-safe source. */
+    readonly source: ManifestSource;
+    /** Deterministic cache-path segments for a ref, joined under the cache root by
+     *  the cache source. Returns `null` when the ref is not cacheable here
+     *  (unsupported scheme, malformed ref, or path-traversal in the ref). */
+    cacheLocation(ref: string): string[] | null;
+    /** The versions published for the module `ref` names, newest-first order not
+     *  guaranteed (the caller sorts). Returns `null` when the module is not
+     *  published (e.g. a 404), distinct from `[]` (published, no versions). Used
+     *  by `telo upgrade`. */
+    listVersions(ref: string): Promise<string[] | null>;
+    /** Retrieve the full artifact for `ref` — the `telo.yaml` and its `files:`
+     *  payload — verifying the manifest against the inline hash and the payload
+     *  against the manifest's `filesIntegrity`. Used by `telo install`; subsumes
+     *  the out-of-band bundle fetch that used to sit outside the source chain. */
+    fetchArtifact(ref: string): Promise<FetchedArtifact>;
+    /** Push `bundle` to `destination` (a base ref / repo whose scheme this
+     *  transport owns), pinning the payload and writing the transport-native
+     *  artifact shape. Throws on failure. Used by `telo publish`. */
+    publish(destination: string, bundle: PublishBundle, opts?: PublishOptions): Promise<PublishResult>;
+    /** Canonicalize a relative sibling import (`../lib`) declared in a module
+     *  being published to `destination` into the absolute ref it will resolve to
+     *  once published. Owns the scheme-specific "where does a sibling land" rule —
+     *  OCI derives the repo from the destination, HTTP from the sibling's
+     *  `<namespace>/<name>` — so `telo publish` delegates instead of branching on
+     *  transport shape. */
+    canonicalizeSiblingRef(destination: string, relativeSource: string, sibling: SiblingIdentity): string;
+}
+//# sourceMappingURL=transport.d.ts.map