@telorun/kernel 0.58.0 → 0.60.0

package/dist/bundle/files-integrity.d.ts

@@ -1,25 +1,34 @@
+import { type ArtifactLayer } from "@telorun/analyzer";
 export interface PayloadFile {
     /** POSIX-relative path inside the bundle. */
     name: string;
     content: Buffer | Uint8Array;
 }
 /**
- * Canonical per-file content digest of a module's `files:` payload — the value
- * of `filesIntegrity` in a bundle's `telo.yaml`. SHA-256 over the sorted
- * `<path>\0<sha256(content)>` lines of every payload file, `telo.yaml`
- * excluded (the importer's `#sha256-...` hash already covers the manifest, and
- * excluding it breaks the self-reference — the manifest embeds this value).
+ * Canonical per-file content digest of one **layer**'s files — the `integrity`
+ * value of that layer's entry in the published `layers:` index. SHA-256 over the
+ * sorted `<path>\0<sha256(content)>` lines of every file in the layer,
+ * `telo.yaml` excluded (it is the manifest layer, which carries the index and so
+ * cannot hash itself; the importer's `#sha256-...` pin covers it instead).
  *
  * Hashing file *contents* rather than the tar/gzip bytes makes the digest
  * independent of archive framing, so publisher and client compute the same
  * value from the same file set, and it can be re-derived from the extracted
- * files on disk. Returns `sha256-<base64url>`.
+ * files on disk — which is what makes a per-layer cache marker checkable without
+ * re-tarring. Distinct from the layer's `blob` digest, which covers the pushed
+ * bytes and addresses the layer. Returns `sha256-<base64url>`.
  */
 export declare function computeFilesIntegrity(files: PayloadFile[]): Promise<string>;
-/** Write `filesIntegrity` onto the manifest's owner doc so the published
- *  `telo.yaml` pins its payload — transitively covered by importers'
- *  `#sha256-...` hash. The digest excludes `telo.yaml`, so injecting it does
- *  not change the digest. Returns the manifest unchanged when it has no owner
- *  doc. */
-export declare function injectFilesIntegrity(manifest: string, hash: string): string;
+/**
+ * Write the `layers:` index onto the manifest's owner doc so the published
+ * `telo.yaml` pins and addresses every payload layer — transitively covered by
+ * importers' `#sha256-...` hash over this manifest.
+ *
+ * Called after the payload blobs are pushed and before the manifest blob is,
+ * which is what keeps the index non-circular: it names only layers other than
+ * the one carrying it. Each layer's own digest excludes `telo.yaml`, so
+ * injecting the index does not invalidate any of them. Returns the manifest
+ * unchanged when it has no owner doc.
+ */
+export declare function injectLayerIndex(manifest: string, layers: readonly ArtifactLayer[]): string;
 //# sourceMappingURL=files-integrity.d.ts.map

package/dist/bundle/files-integrity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"files-integrity.d.ts","sourceRoot":"","sources":["../../src/bundle/files-integrity.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,WAAW;IAC1B,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;CAC9B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAUjF;AAED;;;;WAIW;AACX,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAM3E"}
+{"version":3,"file":"files-integrity.d.ts","sourceRoot":"","sources":["../../src/bundle/files-integrity.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,mBAAmB,CAAC;AAI3B,MAAM,WAAW,WAAW;IAC1B,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;CAC9B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAUjF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,aAAa,EAAE,GAAG,MAAM,CAc3F"}

package/dist/bundle/files-integrity.js

@@ -1,16 +1,18 @@
-import { DEFAULT_MANIFEST_FILENAME, sha256Base64Url } from "@telorun/analyzer";
+import { DEFAULT_MANIFEST_FILENAME, sha256Base64Url, } from "@telorun/analyzer";
 import { findOwnerDoc, parseManifestDocs } from "./module-manifest.js";
 /**
- * Canonical per-file content digest of a module's `files:` payload — the value
- * of `filesIntegrity` in a bundle's `telo.yaml`. SHA-256 over the sorted
- * `<path>\0<sha256(content)>` lines of every payload file, `telo.yaml`
- * excluded (the importer's `#sha256-...` hash already covers the manifest, and
- * excluding it breaks the self-reference — the manifest embeds this value).
+ * Canonical per-file content digest of one **layer**'s files — the `integrity`
+ * value of that layer's entry in the published `layers:` index. SHA-256 over the
+ * sorted `<path>\0<sha256(content)>` lines of every file in the layer,
+ * `telo.yaml` excluded (it is the manifest layer, which carries the index and so
+ * cannot hash itself; the importer's `#sha256-...` pin covers it instead).
  *
  * Hashing file *contents* rather than the tar/gzip bytes makes the digest
  * independent of archive framing, so publisher and client compute the same
  * value from the same file set, and it can be re-derived from the extracted
- * files on disk. Returns `sha256-<base64url>`.
+ * files on disk — which is what makes a per-layer cache marker checkable without
+ * re-tarring. Distinct from the layer's `blob` digest, which covers the pushed
+ * bytes and addresses the layer. Returns `sha256-<base64url>`.
  */
 export async function computeFilesIntegrity(files) {
     const lines = [];
@@ -24,17 +26,28 @@ export async function computeFilesIntegrity(files) {
     const canonical = new TextEncoder().encode(lines.join("\n"));
     return `sha256-${await sha256Base64Url(canonical)}`;
 }
-/** Write `filesIntegrity` onto the manifest's owner doc so the published
- *  `telo.yaml` pins its payload — transitively covered by importers'
- *  `#sha256-...` hash. The digest excludes `telo.yaml`, so injecting it does
- *  not change the digest. Returns the manifest unchanged when it has no owner
- *  doc. */
-export function injectFilesIntegrity(manifest, hash) {
+/**
+ * Write the `layers:` index onto the manifest's owner doc so the published
+ * `telo.yaml` pins and addresses every payload layer — transitively covered by
+ * importers' `#sha256-...` hash over this manifest.
+ *
+ * Called after the payload blobs are pushed and before the manifest blob is,
+ * which is what keeps the index non-circular: it names only layers other than
+ * the one carrying it. Each layer's own digest excludes `telo.yaml`, so
+ * injecting the index does not invalidate any of them. Returns the manifest
+ * unchanged when it has no owner doc.
+ */
+export function injectLayerIndex(manifest, layers) {
     const docs = parseManifestDocs(manifest);
     const owner = findOwnerDoc(docs);
     if (!owner)
         return manifest;
-    owner.set("filesIntegrity", hash);
+    owner.set("layers", layers.map((layer) => ({
+        role: layer.role,
+        ...(layer.selector ? { selector: { ...layer.selector } } : {}),
+        blob: layer.blob,
+        integrity: layer.integrity,
+    })));
     return docs.map((d) => d.toString()).join("---\n");
 }
 //# sourceMappingURL=files-integrity.js.map

package/dist/bundle/files-integrity.js.map

@@ -1 +1 @@
-{"version":3,"file":"files-integrity.js","sourceRoot":"","sources":["../../src/bundle/files-integrity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAE/E,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAQvE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAoB;IAC9D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,KAAK,yBAAyB;YAAE,SAAS;QACtD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,YAAY,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/F,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,MAAM,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,KAAK,CAAC,IAAI,EAAE,CAAC;IACb,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,OAAO,UAAU,MAAM,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;AACtD,CAAC;AAED;;;;WAIW;AACX,MAAM,UAAU,oBAAoB,CAAC,QAAgB,EAAE,IAAY;IACjE,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,KAAK,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACrD,CAAC"}
+{"version":3,"file":"files-integrity.js","sourceRoot":"","sources":["../../src/bundle/files-integrity.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,eAAe,GAEhB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAQvE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAoB;IAC9D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,KAAK,yBAAyB;YAAE,SAAS;QACtD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,YAAY,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/F,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,MAAM,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,KAAK,CAAC,IAAI,EAAE,CAAC;IACb,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,OAAO,UAAU,MAAM,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;AACtD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,MAAgC;IACjF,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,KAAK,CAAC,GAAG,CACP,QAAQ,EACR,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC,CACJ,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACrD,CAAC"}

package/dist/bundle/module-artifact.d.ts

@@ -0,0 +1,134 @@
+import { type ArtifactLayer, type ArtifactSelector, type PlatformTarget } from "@telorun/analyzer";
+import { type Logger } from "@telorun/sdk";
+import type { TransportRegistry } from "../transports/transport-registry.js";
+/** A materialized layer: the directory its files were extracted into (the
+ *  module's cache directory) and the manifest-relative paths it wrote. */
+export interface MaterializedLayer {
+    dir: string;
+    files: string[];
+}
+export declare function hostPlatformTarget(): PlatformTarget;
+/**
+ * A module's artifact, scoped to one loaded module.
+ *
+ * Built during module load, where the **pinned** import ref and the
+ * already-verified manifest are both in hand — which is the whole reason this
+ * exists as its own object rather than as logic inside a controller loader. A
+ * loader is handed only the canonical base URI, which carries no `#sha256-`, so
+ * a loader that fetched for itself would have to re-read the layer index off the
+ * cache directory: verification silently downgraded from "anchored at the
+ * importer's pin" to "trust whatever is already on disk".
+ *
+ * Materialization is per layer, memoized in-process, and guarded by the shared
+ * cross-process directory lock — oauth-client alone has seventeen definitions
+ * resolving concurrently against one controller layer, and several kernels may
+ * populate one cache directory at once.
+ *
+ * Verification runs before extraction: the transport checks the transfer against
+ * the layer's `blob` digest, and the extracted file set is checked against its
+ * `integrity` content digest here. A per-layer marker keyed by the blob digest
+ * records success, so a republish to different bytes re-extracts rather than
+ * being mistaken for an already-populated layer.
+ */
+export declare class ModuleArtifact {
+    /** The importer's pinned ref — what the transport verifies the manifest layer
+     *  against, and what keeps the Merkle chain anchored. */
+    private readonly pinnedRef;
+    private readonly layers;
+    private readonly dir;
+    private readonly transports;
+    private readonly log;
+    /** In-flight / completed materializations, keyed by blob digest. Rejections
+     *  are dropped so a transient fetch failure retries on the next ask. */
+    private readonly inFlight;
+    constructor(opts: {
+        pinnedRef: string;
+        layers: readonly ArtifactLayer[];
+        dir: string;
+        transports: TransportRegistry;
+        log?: Logger;
+    });
+    /** The module's local directory — where every materialized layer lands, and
+     *  what a module-relative path resolves against. */
+    get directory(): string;
+    /**
+     * Materialize the layer carrying `selector` exactly, plus the `common` layer.
+     *
+     * Looked up by exact selector key rather than by re-matching the host: the
+     * candidate being resolved already *is* one selector, and it is by construction
+     * the key of the layer that carries it. Re-matching would take the first layer
+     * in declaration order that the host satisfies, so a module shipping both a
+     * platform-neutral and a platform-constrained layer of one format would fetch
+     * whichever came first regardless of which candidate asked — materializing the
+     * wrong layer and then reporting "bundle not found".
+     *
+     * The `common` layer rides along because it is the sink for files no candidate
+     * claimed — an undeclared sidecar an entry point loads at runtime. Pulling it
+     * with any controller layer is what makes a forgotten declaration cost bytes
+     * instead of a module-not-found at import.
+     *
+     * Returns `undefined` when the artifact ships no layer for this selector, which
+     * is how a loader learns to fall through to the next candidate.
+     */
+    materializeController(selector: ArtifactSelector): Promise<MaterializedLayer | undefined>;
+    /**
+     * Materialize everything a module-relative file read could need: the `assets`
+     * layer **and** the `common` layer.
+     *
+     * Both, because `common` is where the sink rule puts a file the author did not
+     * claim via `assets:` — and a module that ships static files but has no bundled
+     * controller has no other path to its own payload. Assets alone would leave such
+     * a module's `Http.Static` root resolving into an empty directory, which is the
+     * exact silent failure this design promises not to have.
+     */
+    materializeModuleFiles(): Promise<void>;
+    /** Materialize the lazily-fetched `assets` layer, if the module ships one. */
+    materializeAssets(): Promise<MaterializedLayer | undefined>;
+    /** Materialize the `common` layer, if the module ships one. */
+    materializeCommon(): Promise<MaterializedLayer | undefined>;
+    /**
+     * Materialize every layer a `target` platform could need — both singletons and
+     * each controller layer matching it. `telo install`'s make-this-offline pass,
+     * where being exhaustive for one platform is the point.
+     */
+    materializeAll(target: PlatformTarget): Promise<MaterializedLayer[]>;
+    /** Human-facing description of what this artifact ships, for diagnostics that
+     *  have to explain why no layer matched. */
+    describeLayers(): string;
+    private materialize;
+    private markerPath;
+    private materializeUncached;
+    private extract;
+}
+/**
+ * The directory a module's layers live in.
+ *
+ * Derived from the **pinned** `requestedUrl`, not the canonical `source`, because
+ * those diverge exactly when the manifest cache is warm: a cache hit is served as
+ * a `file://` URL into `.telo/manifests/`, which no transport claims, so a
+ * `source`-derived path is `null` on every run after the first. The pinned ref is
+ * what the importer wrote and survives the hit, so it places the module
+ * identically cold and warm. A genuinely local `source` (development, or a module
+ * loaded straight off disk) resolves to its own directory.
+ *
+ * Returns `null` when neither route yields a directory — a `memory://` module, or
+ * a ref this cache has no coordinates for.
+ */
+export declare function moduleDirectoryFor(requestedUrl: string, source: string, entryDir: string, registryUrl: string | undefined, manifestsDir: string | undefined): string | null;
+/**
+ * Build the artifact handle for a loaded module, or `undefined` when the module
+ * has no payload to materialize.
+ *
+ * The trigger is the presence of a `layers:` index — a module that ships nothing
+ * needs no handle. `pinnedRef` is the ref **as the importer wrote it**, integrity
+ * fragment included, which is what keeps verification anchored to the importer's
+ * pin; `moduleDir` is where its layers extract to (see {@link moduleDirectoryFor}).
+ */
+export declare function moduleArtifactFor(opts: {
+    pinnedRef: string;
+    layers: readonly ArtifactLayer[] | undefined;
+    moduleDir: string | null;
+    transports: TransportRegistry;
+    log?: Logger;
+}): ModuleArtifact | undefined;
+//# sourceMappingURL=module-artifact.d.ts.map

package/dist/bundle/module-artifact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-artifact.d.ts","sourceRoot":"","sources":["../../src/bundle/module-artifact.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAA6B,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AAQtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAG7E;0EAC0E;AAC1E,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AA2DD,wBAAgB,kBAAkB,IAAI,cAAc,CAOnD;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,cAAc;IACzB;6DACyD;IACzD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2B;IAClD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoB;IAC/C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B;4EACwE;IACxE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiD;gBAE9D,IAAI,EAAE;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;QACjC,GAAG,EAAE,MAAM,CAAC;QACZ,UAAU,EAAE,iBAAiB,CAAC;QAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;KACd;IAQD;wDACoD;IACpD,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACG,qBAAqB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAU/F;;;;;;;;;OASG;IACG,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7C,8EAA8E;IACxE,iBAAiB,IAAI,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAKjE,+DAA+D;IACzD,iBAAiB,IAAI,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAKjE;;;;OAIG;IACG,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAW1E;gDAC4C;IAC5C,cAAc,IAAI,MAAM;IAOxB,OAAO,CAAC,WAAW;IAanB,OAAO,CAAC,UAAU;YAQJ,mBAAmB;YA0CnB,OAAO;CAkBtB;AAOD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,MAAM,GAAG,IAAI,CAWf;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,SAAS,aAAa,EAAE,GAAG,SAAS,CAAC;IAC7C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,iBAAiB,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,cAAc,GAAG,SAAS,CAU7B"}

package/dist/bundle/module-artifact.js

@@ -0,0 +1,300 @@
+import { matchControllerLayers, selectorKey, singletonLayer, splitIntegrity, describeSelector, } from "@telorun/analyzer";
+import { NOOP_LOGGER, RuntimeError } from "@telorun/sdk";
+import { existsSync } from "fs";
+import * as fs from "fs/promises";
+import * as path from "path";
+import { fileURLToPath } from "url";
+import { withDirectoryLock } from "../directory-lock.js";
+import { cachePathForCanonical } from "../manifest-sources/local-manifest-cache-source.js";
+import { computeFilesIntegrity } from "./files-integrity.js";
+/**
+ * Map Node's platform vocabulary onto the canonical OCI/GOOS names selectors are
+ * published with. Node says `win32`/`x64`; OCI descriptors say
+ * `windows`/`amd64`, and the published artifact is what has to be matched.
+ */
+const NODE_OS_TO_OCI = {
+    win32: "windows",
+    darwin: "darwin",
+    linux: "linux",
+    freebsd: "freebsd",
+    openbsd: "openbsd",
+    sunos: "solaris",
+    aix: "aix",
+};
+const NODE_ARCH_TO_OCI = {
+    x64: "amd64",
+    ia32: "386",
+    arm64: "arm64",
+    arm: "arm",
+    ppc64: "ppc64le",
+    s390x: "s390x",
+    riscv64: "riscv64",
+    loong64: "loong64",
+};
+/**
+ * Which libc this process is linked against, or `undefined` when it cannot be
+ * determined. Undetermined is deliberately *not* guessed: a selector that
+ * constrains `libc` then matches nothing, so a glibc binary is never handed to
+ * an Alpine host on the assumption it will run. Node reports
+ * `glibcVersionRuntime` in its process report only on a glibc build, which makes
+ * its absence on Linux the musl signal.
+ */
+function detectLibc() {
+    if (process.platform !== "linux")
+        return undefined;
+    try {
+        const report = process.report?.getReport();
+        return report?.header?.glibcVersionRuntime ? "gnu" : "musl";
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The platform this kernel is running on, in the published vocabulary. An axis
+ * Node cannot name is left absent rather than guessed.
+ *
+ * Computed once: the host cannot change mid-process, and `detectLibc` generates a
+ * full Node diagnostic report (a heap and stack walk costing tens of milliseconds).
+ * The controller loader asks per candidate per definition — oauth-client alone has
+ * seventeen — so recomputing would put that squarely inside the init loop.
+ */
+let cachedHostTarget;
+export function hostPlatformTarget() {
+    cachedHostTarget ?? (cachedHostTarget = {
+        os: NODE_OS_TO_OCI[process.platform],
+        arch: NODE_ARCH_TO_OCI[process.arch],
+        libc: detectLibc(),
+    });
+    return cachedHostTarget;
+}
+/**
+ * A module's artifact, scoped to one loaded module.
+ *
+ * Built during module load, where the **pinned** import ref and the
+ * already-verified manifest are both in hand — which is the whole reason this
+ * exists as its own object rather than as logic inside a controller loader. A
+ * loader is handed only the canonical base URI, which carries no `#sha256-`, so
+ * a loader that fetched for itself would have to re-read the layer index off the
+ * cache directory: verification silently downgraded from "anchored at the
+ * importer's pin" to "trust whatever is already on disk".
+ *
+ * Materialization is per layer, memoized in-process, and guarded by the shared
+ * cross-process directory lock — oauth-client alone has seventeen definitions
+ * resolving concurrently against one controller layer, and several kernels may
+ * populate one cache directory at once.
+ *
+ * Verification runs before extraction: the transport checks the transfer against
+ * the layer's `blob` digest, and the extracted file set is checked against its
+ * `integrity` content digest here. A per-layer marker keyed by the blob digest
+ * records success, so a republish to different bytes re-extracts rather than
+ * being mistaken for an already-populated layer.
+ */
+export class ModuleArtifact {
+    constructor(opts) {
+        /** In-flight / completed materializations, keyed by blob digest. Rejections
+         *  are dropped so a transient fetch failure retries on the next ask. */
+        this.inFlight = new Map();
+        this.pinnedRef = opts.pinnedRef;
+        this.layers = opts.layers;
+        this.dir = opts.dir;
+        this.transports = opts.transports;
+        this.log = opts.log ?? NOOP_LOGGER;
+    }
+    /** The module's local directory — where every materialized layer lands, and
+     *  what a module-relative path resolves against. */
+    get directory() {
+        return this.dir;
+    }
+    /**
+     * Materialize the layer carrying `selector` exactly, plus the `common` layer.
+     *
+     * Looked up by exact selector key rather than by re-matching the host: the
+     * candidate being resolved already *is* one selector, and it is by construction
+     * the key of the layer that carries it. Re-matching would take the first layer
+     * in declaration order that the host satisfies, so a module shipping both a
+     * platform-neutral and a platform-constrained layer of one format would fetch
+     * whichever came first regardless of which candidate asked — materializing the
+     * wrong layer and then reporting "bundle not found".
+     *
+     * The `common` layer rides along because it is the sink for files no candidate
+     * claimed — an undeclared sidecar an entry point loads at runtime. Pulling it
+     * with any controller layer is what makes a forgotten declaration cost bytes
+     * instead of a module-not-found at import.
+     *
+     * Returns `undefined` when the artifact ships no layer for this selector, which
+     * is how a loader learns to fall through to the next candidate.
+     */
+    async materializeController(selector) {
+        const key = selectorKey(selector);
+        const layer = this.layers.find((l) => l.role === "controller" && l.selector !== undefined && selectorKey(l.selector) === key);
+        if (!layer)
+            return undefined;
+        await this.materializeCommon();
+        return this.materialize(layer);
+    }
+    /**
+     * Materialize everything a module-relative file read could need: the `assets`
+     * layer **and** the `common` layer.
+     *
+     * Both, because `common` is where the sink rule puts a file the author did not
+     * claim via `assets:` — and a module that ships static files but has no bundled
+     * controller has no other path to its own payload. Assets alone would leave such
+     * a module's `Http.Static` root resolving into an empty directory, which is the
+     * exact silent failure this design promises not to have.
+     */
+    async materializeModuleFiles() {
+        await Promise.all([this.materializeAssets(), this.materializeCommon()]);
+    }
+    /** Materialize the lazily-fetched `assets` layer, if the module ships one. */
+    async materializeAssets() {
+        const layer = singletonLayer(this.layers, "assets");
+        return layer ? this.materialize(layer) : undefined;
+    }
+    /** Materialize the `common` layer, if the module ships one. */
+    async materializeCommon() {
+        const layer = singletonLayer(this.layers, "common");
+        return layer ? this.materialize(layer) : undefined;
+    }
+    /**
+     * Materialize every layer a `target` platform could need — both singletons and
+     * each controller layer matching it. `telo install`'s make-this-offline pass,
+     * where being exhaustive for one platform is the point.
+     */
+    async materializeAll(target) {
+        const wanted = [
+            ...matchControllerLayers(this.layers, target),
+            singletonLayer(this.layers, "assets"),
+            singletonLayer(this.layers, "common"),
+        ].filter((l) => l !== undefined);
+        const out = [];
+        for (const layer of wanted)
+            out.push(await this.materialize(layer));
+        return out;
+    }
+    /** Human-facing description of what this artifact ships, for diagnostics that
+     *  have to explain why no layer matched. */
+    describeLayers() {
+        if (this.layers.length === 0)
+            return "(no payload layers)";
+        return this.layers
+            .map((l) => (l.selector ? `${l.role} ${describeSelector(l.selector)}` : l.role))
+            .join(", ");
+    }
+    materialize(layer) {
+        const pending = this.inFlight.get(layer.blob);
+        if (pending)
+            return pending;
+        const work = this.materializeUncached(layer).catch((err) => {
+            // Drop the rejection so a transient fetch failure is retried rather than
+            // cached for the lifetime of the module.
+            this.inFlight.delete(layer.blob);
+            throw err;
+        });
+        this.inFlight.set(layer.blob, work);
+        return work;
+    }
+    markerPath(layer) {
+        // Keyed by the blob digest, so a republish to different bytes gets a new
+        // marker and re-extracts instead of being read as already-populated. The
+        // role is in the name purely so a human can tell the markers apart.
+        const short = layer.blob.replace(/^sha256:/, "").slice(0, 16);
+        return path.join(this.dir, `.telo-layer-${layer.role}-${short}`);
+    }
+    async materializeUncached(layer) {
+        const marker = this.markerPath(layer);
+        if (existsSync(marker)) {
+            return { dir: this.dir, files: await readMarker(marker) };
+        }
+        return withDirectoryLock(this.dir, "module layer", async () => {
+            // Re-check inside the lock: a peer may have extracted this layer between
+            // the fast-path miss and our acquisition.
+            if (existsSync(marker)) {
+                return { dir: this.dir, files: await readMarker(marker) };
+            }
+            const files = await this.transports.fetchLayer(this.pinnedRef, layer.blob);
+            const actual = await computeFilesIntegrity(files);
+            if (actual !== layer.integrity) {
+                throw new RuntimeError("ERR_MODULE_LAYER_INTEGRITY", `Integrity check failed for the ${layer.role} layer of ${this.pinnedRef}: ` +
+                    `expected ${layer.integrity}, got ${actual}. The layer's contents do not match ` +
+                    `the digest recorded in the module's pinned telo.yaml — it may have been ` +
+                    `tampered with or republished.`);
+            }
+            const written = await this.extract(files, layer);
+            // Marker last, so a partial extraction leaves none and re-runs.
+            await fs.writeFile(marker, `${written.join("\n")}\n`, "utf-8");
+            this.log.debug("materialized module layer", {
+                "telo.module.ref": this.pinnedRef,
+                "telo.layer.role": layer.role,
+                "telo.layer.files": written.length,
+            });
+            return { dir: this.dir, files: written };
+        }, this.log);
+    }
+    async extract(files, layer) {
+        const root = path.resolve(this.dir) + path.sep;
+        const written = [];
+        for (const entry of files) {
+            const dest = path.resolve(this.dir, entry.name);
+            if (!dest.startsWith(root)) {
+                throw new RuntimeError("ERR_MODULE_LAYER_INVALID", `The ${layer.role} layer of ${this.pinnedRef} contains entry '${entry.name}', which ` +
+                    `resolves outside the module's cache directory.`);
+            }
+            await fs.mkdir(path.dirname(dest), { recursive: true });
+            await fs.writeFile(dest, entry.content);
+            written.push(entry.name);
+        }
+        return written.sort();
+    }
+}
+async function readMarker(marker) {
+    const text = await fs.readFile(marker, "utf-8");
+    return text.split("\n").filter((line) => line !== "");
+}
+/**
+ * The directory a module's layers live in.
+ *
+ * Derived from the **pinned** `requestedUrl`, not the canonical `source`, because
+ * those diverge exactly when the manifest cache is warm: a cache hit is served as
+ * a `file://` URL into `.telo/manifests/`, which no transport claims, so a
+ * `source`-derived path is `null` on every run after the first. The pinned ref is
+ * what the importer wrote and survives the hit, so it places the module
+ * identically cold and warm. A genuinely local `source` (development, or a module
+ * loaded straight off disk) resolves to its own directory.
+ *
+ * Returns `null` when neither route yields a directory — a `memory://` module, or
+ * a ref this cache has no coordinates for.
+ */
+export function moduleDirectoryFor(requestedUrl, source, entryDir, registryUrl, manifestsDir) {
+    const cacheFile = cachePathForCanonical(splitIntegrity(requestedUrl).base, entryDir, registryUrl, manifestsDir);
+    if (cacheFile)
+        return path.dirname(cacheFile);
+    if (source.startsWith("file://"))
+        return path.dirname(fileURLToPath(source));
+    if (path.isAbsolute(source))
+        return path.dirname(source);
+    return null;
+}
+/**
+ * Build the artifact handle for a loaded module, or `undefined` when the module
+ * has no payload to materialize.
+ *
+ * The trigger is the presence of a `layers:` index — a module that ships nothing
+ * needs no handle. `pinnedRef` is the ref **as the importer wrote it**, integrity
+ * fragment included, which is what keeps verification anchored to the importer's
+ * pin; `moduleDir` is where its layers extract to (see {@link moduleDirectoryFor}).
+ */
+export function moduleArtifactFor(opts) {
+    if (!opts.layers || opts.layers.length === 0)
+        return undefined;
+    if (!opts.moduleDir)
+        return undefined;
+    return new ModuleArtifact({
+        pinnedRef: opts.pinnedRef,
+        layers: opts.layers,
+        dir: opts.moduleDir,
+        transports: opts.transports,
+        log: opts.log,
+    });
+}
+//# sourceMappingURL=module-artifact.js.map

package/dist/bundle/module-artifact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-artifact.js","sourceRoot":"","sources":["../../src/bundle/module-artifact.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,WAAW,EACX,cAAc,EACd,cAAc,EACd,gBAAgB,GAIjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,WAAW,EAAE,YAAY,EAAe,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,KAAK,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oDAAoD,CAAC;AAE3F,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sBAAsB,CAAC;AAS/E;;;;GAIG;AACH,MAAM,cAAc,GAAqC;IACvD,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,SAAS;IAChB,GAAG,EAAE,KAAK;CACX,CAAC;AAEF,MAAM,gBAAgB,GAAqC;IACzD,GAAG,EAAE,OAAO;IACZ,IAAI,EAAE,KAAK;IACX,KAAK,EAAE,OAAO;IACd,GAAG,EAAE,KAAK;IACV,KAAK,EAAE,SAAS;IAChB,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;CACnB,CAAC;AAEF;;;;;;;GAOG;AACH,SAAS,UAAU;IACjB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,SAAS,EAE3B,CAAC;QACd,OAAO,MAAM,EAAE,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,IAAI,gBAA4C,CAAC;AAEjD,MAAM,UAAU,kBAAkB;IAChC,gBAAgB,KAAhB,gBAAgB,GAAK;QACnB,EAAE,EAAE,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC;QACpC,IAAI,EAAE,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC;QACpC,IAAI,EAAE,UAAU,EAAE;KACnB,EAAC;IACF,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,OAAO,cAAc;IAYzB,YAAY,IAMX;QAVD;gFACwE;QACvD,aAAQ,GAAG,IAAI,GAAG,EAAsC,CAAC;QASxE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACpB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC;IACrC,CAAC;IAED;wDACoD;IACpD,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,qBAAqB,CAAC,QAA0B;QACpD,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,GAAG,CAC9F,CAAC;QACF,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,sBAAsB;QAC1B,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,iBAAiB;QACrB,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACpD,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,iBAAiB;QACrB,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACpD,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,MAAsB;QACzC,MAAM,MAAM,GAAG;YACb,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;YAC7C,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;YACrC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;SACtC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAsB,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QACrD,MAAM,GAAG,GAAwB,EAAE,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,MAAM;YAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QACpE,OAAO,GAAG,CAAC;IACb,CAAC;IAED;gDAC4C;IAC5C,cAAc;QACZ,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,qBAAqB,CAAC;QAC3D,OAAO,IAAI,CAAC,MAAM;aACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;aAC/E,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;IAEO,WAAW,CAAC,KAAoB;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACzD,yEAAyE;YACzE,yCAAyC;YACzC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,UAAU,CAAC,KAAoB;QACrC,yEAAyE;QACzE,yEAAyE;QACzE,oEAAoE;QACpE,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,KAAK,CAAC,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;IACnE,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,KAAoB;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,CAAC;QAED,OAAO,iBAAiB,CACtB,IAAI,CAAC,GAAG,EACR,cAAc,EACd,KAAK,IAAI,EAAE;YACT,yEAAyE;YACzE,0CAA0C;YAC1C,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvB,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5D,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3E,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;YAClD,IAAI,MAAM,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;gBAC/B,MAAM,IAAI,YAAY,CACpB,4BAA4B,EAC5B,kCAAkC,KAAK,CAAC,IAAI,aAAa,IAAI,CAAC,SAAS,IAAI;oBACzE,YAAY,KAAK,CAAC,SAAS,SAAS,MAAM,sCAAsC;oBAChF,0EAA0E;oBAC1E,+BAA+B,CAClC,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACjD,gEAAgE;YAChE,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC/D,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,2BAA2B,EAAE;gBAC1C,iBAAiB,EAAE,IAAI,CAAC,SAAS;gBACjC,iBAAiB,EAAE,KAAK,CAAC,IAAI;gBAC7B,kBAAkB,EAAE,OAAO,CAAC,MAAM;aACnC,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC3C,CAAC,EACD,IAAI,CAAC,GAAG,CACT,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,KAAoB,EAAE,KAAoB;QAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC;QAC/C,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,YAAY,CACpB,0BAA0B,EAC1B,OAAO,KAAK,CAAC,IAAI,aAAa,IAAI,CAAC,SAAS,oBAAoB,KAAK,CAAC,IAAI,WAAW;oBACnF,gDAAgD,CACnD,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;IACxB,CAAC;CACF;AAED,KAAK,UAAU,UAAU,CAAC,MAAc;IACtC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAChC,YAAoB,EACpB,MAAc,EACd,QAAgB,EAChB,WAA+B,EAC/B,YAAgC;IAEhC,MAAM,SAAS,GAAG,qBAAqB,CACrC,cAAc,CAAC,YAAY,CAAC,CAAC,IAAI,EACjC,QAAQ,EACR,WAAW,EACX,YAAY,CACb,CAAC;IACF,IAAI,SAAS;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7E,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAMjC;IACC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/D,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,OAAO,IAAI,cAAc,CAAC;QACxB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG,EAAE,IAAI,CAAC,SAAS;QACnB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;KACd,CAAC,CAAC;AACL,CAAC"}

package/dist/bundle/module-manifest.d.ts

@@ -1,16 +1,24 @@
+import { type ArtifactLayer } from "@telorun/analyzer";
 import { type Document } from "yaml";
 /** Parse a manifest's YAML documents, tolerating its `!cel` / `!ref` tags. */
 export declare function parseManifestDocs(text: string): Document[];
 /** The owner document of a manifest — the single `Telo.Application` /
- *  `Telo.Library` doc that carries its identity, `files:`, and `filesIntegrity`.
- *  The one place that selects it, shared by every reader/writer. */
+ *  `Telo.Library` doc that carries its identity, `files:` / `assets:`, and the
+ *  published `layers:` index. The one place that selects it, shared by every
+ *  reader/writer. */
 export declare function findOwnerDoc(docs: Document[]): Document | undefined;
 /** The owner-doc fields the transports read: identity for the publish location,
  *  and payload markers for artifact fetch. */
 export interface OwnerManifest {
     name?: string;
     version?: string;
-    filesIntegrity?: string;
+    /** The published layer index, absent on an unpublished manifest. Parsed and
+     *  validated through the analyzer's shared model, so a malformed index is a
+     *  hard `LayerIndexError` rather than a silently ignored field. */
+    layers?: ArtifactLayer[];
+    /** Ordered `.gitignore`-style patterns the author claimed as the lazily
+     *  materialized `assets` layer. */
+    assetPatterns: string[];
     /** True when the owner doc declares a non-empty `files:` list. */
     declaresFiles: boolean;
     /** Descriptive provenance a transport projects into its backend's metadata
@@ -22,6 +30,6 @@ export interface OwnerManifest {
 }
 /** Read the owner doc's identity + payload fields from a manifest, parsing once
  *  (never regex-scraping). The single source both transports call for the
- *  module's name and version, `filesIntegrity`, and payload detection. */
+ *  module's name and version, its layer index, and payload detection. */
 export declare function readOwnerManifest(text: string): OwnerManifest;
 //# sourceMappingURL=module-manifest.d.ts.map

package/dist/bundle/module-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module-manifest.d.ts","sourceRoot":"","sources":["../../src/bundle/module-manifest.ts"],"names":[],"mappings":"AACA,OAAO,EAAqB,KAAK,QAAQ,EAAE,MAAM,MAAM,CAAC;AAIxD,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CAE1D;AAED;;oEAEoE;AACpE,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,QAAQ,GAAG,SAAS,CAKnE;AAED;8CAC8C;AAC9C,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,aAAa,EAAE,OAAO,CAAC;IACvB;iEAC6D;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;0EAE0E;AAC1E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAiB7D"}
+{"version":3,"file":"module-manifest.d.ts","sourceRoot":"","sources":["../../src/bundle/module-manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAExE,OAAO,EAAqB,KAAK,QAAQ,EAAE,MAAM,MAAM,CAAC;AAIxD,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CAE1D;AAED;;;qBAGqB;AACrB,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,QAAQ,GAAG,SAAS,CAKnE;AAED;8CAC8C;AAC9C,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;uEAEmE;IACnE,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC;IACzB;uCACmC;IACnC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,kEAAkE;IAClE,aAAa,EAAE,OAAO,CAAC;IACvB;iEAC6D;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;yEAEyE;AACzE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAyB7D"}