@telorun/kernel 0.83.0 → 0.85.0

package/dist/transports/http-transport.d.ts

@@ -0,0 +1,37 @@
+import { type ArtifactLayer, type ManifestCacheCoords, type ManifestSource } from "@telorun/analyzer";
+import type { PayloadFile } from "../bundle/files-integrity.js";
+import type { PayloadLayer, PublishBundle, PublishOptions, PublishResult, Transport } from "./transport.js";
+/** The transport for direct `https://…` (and `http://`) module URLs. Its
+ *  resolution `source` composes the browser-safe `HttpSource` from `analyzer`;
+ *  the Node-only management methods live here. This is the fallback transport
+ *  for any ref that carries no owning scheme, so `oci://` (or a future `s3://`)
+ *  never falls through to it — those refs are claimed by their own transport's
+ *  `supports()`.
+ *
+ *  A URL addresses exactly one file, so it names no enumerable version: this
+ *  transport publishes nothing, lists no versions, and has no `@version` segment
+ *  to bump. What it does own is reading, hashing and caching those bytes. */
+export declare class HttpTransport implements Transport {
+    private readonly httpSource;
+    readonly source: ManifestSource;
+    constructor();
+    supports(ref: string): boolean;
+    cacheCoords(ref: string): ManifestCacheCoords | null;
+    listVersions(): Promise<string[] | null>;
+    refVersion(): string | null;
+    withVersion(ref: string): string;
+    /** Mirrors the source's fetch-URL derivation: the URL points at (or contains)
+     *  the YAML file. `null` when this transport does not own the ref's shape. */
+    private manifestUrl;
+    digest(ref: string): Promise<string | null>;
+    /** Hashes the **raw response bytes**, which is exactly what `verifiedFetch`
+     *  checks an inline `#sha256-…` pin against on the read path. */
+    manifestHash(ref: string): Promise<string>;
+    /** Layered artifacts are an OCI concept — a module reached over a plain URL is
+     *  manifest-only, and its controllers come from npm. */
+    fetchLayer(ref: string, blobDigest: string): Promise<PayloadFile[]>;
+    layerIndex(layers: readonly PayloadLayer[]): Promise<ArtifactLayer[]>;
+    publish(destination: string, bundle: PublishBundle, opts?: PublishOptions): Promise<PublishResult>;
+    canonicalizeSiblingRef(destination: string, relativeSource: string, version: string): string;
+}
+//# sourceMappingURL=http-transport.d.ts.map

package/dist/transports/http-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-transport.d.ts","sourceRoot":"","sources":["../../src/transports/http-transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAI3B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAEhE,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,cAAc,EACd,aAAa,EACb,SAAS,EACV,MAAM,gBAAgB,CAAC;AAgCxB;;;;;;;;;6EAS6E;AAC7E,qBAAa,aAAc,YAAW,SAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;IACxC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;;IAgBhC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAK9B,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI;IAsB9C,YAAY,IAAI,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC;IAK9C,UAAU,IAAI,MAAM,GAAG,IAAI;IAK3B,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAMhC;kFAC8E;IAC9E,OAAO,CAAC,WAAW;IAMb,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAejD;qEACiE;IAC3D,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAchD;4DACwD;IAClD,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAOnE,UAAU,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAYrE,OAAO,CACX,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,aAAa,EACrB,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,aAAa,CAAC;IASzB,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM;CAY7F"}

package/dist/transports/http-transport.js

@@ -0,0 +1,168 @@
+import { DEFAULT_MANIFEST_FILENAME, HttpSource, sha256Base64Url, splitIntegrity, } from "@telorun/analyzer";
+import { fetchOrThrow } from "@telorun/sdk";
+import { createHash } from "crypto";
+import { assertPublicEgress } from "./egress-guard.js";
+const QUERY_HASH_LENGTH = 12;
+/** Mirror `HttpSource.read`'s `fetchUrl` derivation: when the URL does not
+ *  already point at a YAML file, append `/telo.yaml`, so a raw import URL and
+ *  the canonical source it resolves to map to the same cache path. */
+function normalizePathname(rawUrl, parsed) {
+    let pathname = parsed.pathname;
+    if (!rawUrl.includes(".yaml")) {
+        pathname = pathname.endsWith("/")
+            ? `${pathname}${DEFAULT_MANIFEST_FILENAME}`
+            : `${pathname}/${DEFAULT_MANIFEST_FILENAME}`;
+    }
+    return pathname;
+}
+/** Short hash of `search + hash` so two URLs that differ only in query /
+ *  fragment do not collide at the same cache path. */
+function disambiguatePath(pathname, search, hash) {
+    if (!search && !hash)
+        return pathname;
+    const digest = createHash("sha256")
+        .update(search + hash)
+        .digest("hex")
+        .slice(0, QUERY_HASH_LENGTH);
+    const dotIdx = pathname.lastIndexOf(".");
+    const slashIdx = pathname.lastIndexOf("/");
+    const ext = dotIdx > slashIdx ? pathname.slice(dotIdx) : "";
+    const base = pathname.slice(0, pathname.length - ext.length);
+    return `${base}.${digest}${ext}`;
+}
+/** The transport for direct `https://…` (and `http://`) module URLs. Its
+ *  resolution `source` composes the browser-safe `HttpSource` from `analyzer`;
+ *  the Node-only management methods live here. This is the fallback transport
+ *  for any ref that carries no owning scheme, so `oci://` (or a future `s3://`)
+ *  never falls through to it — those refs are claimed by their own transport's
+ *  `supports()`.
+ *
+ *  A URL addresses exactly one file, so it names no enumerable version: this
+ *  transport publishes nothing, lists no versions, and has no `@version` segment
+ *  to bump. What it does own is reading, hashing and caching those bytes. */
+export class HttpTransport {
+    httpSource;
+    source;
+    constructor() {
+        this.httpSource = new HttpSource();
+        this.source = {
+            supports: (url) => this.supports(url),
+            read: async (url) => {
+                // The browser-safe source does the fetch; the Node-side egress policy
+                // is enforced here, on the host the read will actually hit.
+                await assertPublicEgress(url);
+                return this.httpSource.read(url);
+            },
+            resolveRelative: (base, relative) => this.httpSource.resolveRelative(base, relative),
+        };
+    }
+    supports(ref) {
+        const { base } = splitIntegrity(ref);
+        return base.startsWith("http://") || base.startsWith("https://");
+    }
+    cacheCoords(ref) {
+        const url = splitIntegrity(ref).base;
+        if (!url.startsWith("http://") && !url.startsWith("https://"))
+            return null;
+        let parsed;
+        try {
+            parsed = new URL(url);
+        }
+        catch {
+            return null;
+        }
+        const pathname = normalizePathname(url, parsed);
+        // `url` subtree, query-hash suffix on collision. No version segment: a URL
+        // addresses exactly one file, and the version it declares lives inside
+        // bytes the cache maps paths without.
+        const cleanPath = pathname.startsWith("/") ? pathname.slice(1) : pathname;
+        const segments = disambiguatePath(cleanPath, parsed.search, parsed.hash).split("/");
+        const file = segments.pop();
+        if (!file)
+            return null;
+        return { transport: "url", host: parsed.host, path: segments.join("/"), file };
+    }
+    async listVersions() {
+        // A direct `https://` URL has no version-list endpoint.
+        return null;
+    }
+    refVersion() {
+        // A direct `https://` URL has no version segment to bump.
+        return null;
+    }
+    withVersion(ref) {
+        throw new Error(`cannot set a version on '${ref}': a URL addresses one file and carries no version segment.`);
+    }
+    /** Mirrors the source's fetch-URL derivation: the URL points at (or contains)
+     *  the YAML file. `null` when this transport does not own the ref's shape. */
+    manifestUrl(ref) {
+        const { base } = splitIntegrity(ref);
+        if (!base.startsWith("http://") && !base.startsWith("https://"))
+            return null;
+        return base.includes(".yaml") ? base : `${base}/${DEFAULT_MANIFEST_FILENAME}`;
+    }
+    async digest(ref) {
+        // The digest is Telo's canonical hash over the `telo.yaml` bytes — the same
+        // value `manifestHash` returns, but absent-is-null rather than a throw.
+        const fetchUrl = this.manifestUrl(ref);
+        if (!fetchUrl)
+            return null;
+        await assertPublicEgress(fetchUrl);
+        const res = await fetchOrThrow(fetchUrl, undefined, { operation: "Module manifest read" });
+        if (res.status === 404)
+            return null;
+        if (!res.ok) {
+            throw new Error(`${fetchUrl} returned ${res.status} ${res.statusText}`);
+        }
+        const bytes = new Uint8Array(await res.arrayBuffer());
+        return `sha256-${await sha256Base64Url(bytes)}`;
+    }
+    /** Hashes the **raw response bytes**, which is exactly what `verifiedFetch`
+     *  checks an inline `#sha256-…` pin against on the read path. */
+    async manifestHash(ref) {
+        const fetchUrl = this.manifestUrl(ref);
+        if (!fetchUrl) {
+            throw new Error(`cannot hash non-remote import '${ref}'`);
+        }
+        await assertPublicEgress(fetchUrl);
+        const res = await fetchOrThrow(fetchUrl, undefined, { operation: "Module manifest hash" });
+        if (!res.ok) {
+            throw new Error(`fetch ${fetchUrl}: ${res.status} ${res.statusText}`);
+        }
+        const bytes = new Uint8Array(await res.arrayBuffer());
+        return `sha256-${await sha256Base64Url(bytes)}`;
+    }
+    /** Layered artifacts are an OCI concept — a module reached over a plain URL is
+     *  manifest-only, and its controllers come from npm. */
+    async fetchLayer(ref, blobDigest) {
+        throw new Error(`Cannot fetch layer ${blobDigest} of ${ref}: a plain URL serves the manifest only. ` +
+            `A module with a bundled payload is published as an OCI artifact (oci://host/repo).`);
+    }
+    async layerIndex(layers) {
+        // Same boundary `fetchLayer` and `publish` draw: a plain URL serves the
+        // manifest only, so it frames no layer and can name no blob. An empty set is
+        // not a payload, so it answers rather than throws — a manifest-only module
+        // builds its payload through this transport during analysis.
+        if (layers.every((layer) => layer.files.length === 0))
+            return [];
+        throw new Error("A plain URL serves the manifest only, so it cannot index payload layers. " +
+            "A module with a bundled payload is published as an OCI artifact (oci://host/repo).");
+    }
+    async publish(destination, bundle, opts = {}) {
+        // `telo publish` rejects a non-OCI destination up front, so this is only a
+        // guard for a direct programmatic call.
+        throw new Error("Publishing over HTTP has been removed. Publish to an OCI registry " +
+            "(oci://host/repo) instead.");
+    }
+    canonicalizeSiblingRef(destination, relativeSource, version) {
+        // Canonicalizing a sibling is publish-path work, and this transport does not
+        // publish — so it refuses here for the same reason `publish` does, rather
+        // than computing a ref nothing could ever push. Silence would be worse than
+        // useless: an `https://host/` destination has no path to resolve `../lib`
+        // beside, so joining anyway yields a ref one segment short with no error.
+        throw new Error(`Cannot canonicalize the relative import '${relativeSource}' against '${destination}': ` +
+            `publishing over plain HTTP has been removed. Publish to an OCI registry ` +
+            `(oci://host/repo) instead.`);
+    }
+}
+//# sourceMappingURL=http-transport.js.map

package/dist/transports/http-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-transport.js","sourceRoot":"","sources":["../../src/transports/http-transport.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EACf,cAAc,GAIf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAGpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AASvD,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;sEAEsE;AACtE,SAAS,iBAAiB,CAAC,MAAc,EAAE,MAAW;IACpD,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC/B,CAAC,CAAC,GAAG,QAAQ,GAAG,yBAAyB,EAAE;YAC3C,CAAC,CAAC,GAAG,QAAQ,IAAI,yBAAyB,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;sDACsD;AACtD,SAAS,gBAAgB,CAAC,QAAgB,EAAE,MAAc,EAAE,IAAY;IACtE,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC;IACtC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;SAChC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;SACrB,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7D,OAAO,GAAG,IAAI,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;;6EAS6E;AAC7E,MAAM,OAAO,aAAa;IACP,UAAU,CAAa;IAC/B,MAAM,CAAiB;IAEhC;QACE,IAAI,CAAC,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG;YACZ,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YACrC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAClB,sEAAsE;gBACtE,4DAA4D;gBAC5D,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;gBAC9B,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC;YACD,eAAe,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC;SACrF,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACnE,CAAC;IAED,WAAW,CAAC,GAAW;QACrB,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACrC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QAE3E,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAEhD,2EAA2E;QAC3E,uEAAuE;QACvE,sCAAsC;QACtC,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC1E,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpF,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;IACjF,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,wDAAwD;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,UAAU;QACR,0DAA0D;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,WAAW,CAAC,GAAW;QACrB,MAAM,IAAI,KAAK,CACb,4BAA4B,GAAG,6DAA6D,CAC7F,CAAC;IACJ,CAAC;IAED;kFAC8E;IACtE,WAAW,CAAC,GAAW;QAC7B,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7E,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,yBAAyB,EAAE,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAC3F,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,aAAa,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACtD,OAAO,UAAU,MAAM,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;IAClD,CAAC;IAED;qEACiE;IACjE,KAAK,CAAC,YAAY,CAAC,GAAW;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,GAAG,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAC3F,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,SAAS,QAAQ,KAAK,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACtD,OAAO,UAAU,MAAM,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;IAClD,CAAC;IAED;4DACwD;IACxD,KAAK,CAAC,UAAU,CAAC,GAAW,EAAE,UAAkB;QAC9C,MAAM,IAAI,KAAK,CACb,sBAAsB,UAAU,OAAO,GAAG,0CAA0C;YAClF,oFAAoF,CACvF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAA+B;QAC9C,wEAAwE;QACxE,6EAA6E;QAC7E,2EAA2E;QAC3E,6DAA6D;QAC7D,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CACb,2EAA2E;YACzE,oFAAoF,CACvF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CACX,WAAmB,EACnB,MAAqB,EACrB,OAAuB,EAAE;QAEzB,2EAA2E;QAC3E,wCAAwC;QACxC,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,4BAA4B,CAC/B,CAAC;IACJ,CAAC;IAED,sBAAsB,CAAC,WAAmB,EAAE,cAAsB,EAAE,OAAe;QACjF,6EAA6E;QAC7E,0EAA0E;QAC1E,4EAA4E;QAC5E,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,IAAI,KAAK,CACb,4CAA4C,cAAc,cAAc,WAAW,KAAK;YACtF,0EAA0E;YAC1E,4BAA4B,CAC/B,CAAC;IACJ,CAAC;CACF"}

package/dist/transports/transport-registry.d.ts

@@ -3,9 +3,9 @@ import type { PayloadFile } from "../bundle/files-integrity.js";
 import type { PublishBundle, PublishOptions, PublishResult, Transport } from "./transport.js";
 /** Dispatches ref-scheme-specific operations to the transport that owns a ref.
  *  The loader, cache source, `upgrade`, and `publish` consult this instead of
- *  branching on ref shape. `RegistryTransport` is always last so it is the
- *  fallback for bare / `https` refs, and a scheme-owning transport (OCI, later
- *  S3) claims its refs via `supports()` before the fallback is reached. */
+ *  branching on ref shape. `HttpTransport` is always last so it is the fallback
+ *  for plain `https` refs, and a scheme-owning transport (OCI, later S3) claims
+ *  its refs via `supports()` before the fallback is reached. */
 export declare class TransportRegistry {
     private readonly transports;
     constructor(transports: Transport[]);
@@ -32,15 +32,14 @@ export declare class TransportRegistry {
     private require;
 }
 /** The default transport set. Scheme-owning transports come first; the
- *  `RegistryTransport` is last, the fallback for bare / `https` refs. OCI (and
- *  later S3) claim their `oci://` / `s3://` refs before the fallback is reached. */
-export declare function defaultTransports(registryUrl?: string): Transport[];
-/** A `TransportRegistry` seeded with {@link defaultTransports}, memoized per
- *  `registryUrl`. The default transports hold no per-call state, so one shared
- *  instance per registry URL is safe — and avoids re-instantiating the whole set
- *  on hot paths like `cachePathForCanonical`. It is also what gives
- *  `OciTransport`'s per-instance read-client pool a process-wide lifetime here,
- *  so the bearer-token cache survives across operations without the pool having
- *  to be global. */
-export declare function defaultTransportRegistry(registryUrl?: string): TransportRegistry;
+ *  `HttpTransport` is last, the fallback for plain `https` refs. OCI (and later
+ *  S3) claim their `oci://` / `s3://` refs before the fallback is reached. */
+export declare function defaultTransports(): Transport[];
+/** A `TransportRegistry` seeded with {@link defaultTransports}, memoized. The
+ *  default transports hold no per-call state, so one shared instance is safe —
+ *  and avoids re-instantiating the whole set on hot paths like
+ *  `cachePathForCanonical`. It is also what gives `OciTransport`'s per-instance
+ *  read-client pool a process-wide lifetime here, so the bearer-token cache
+ *  survives across operations without the pool having to be global. */
+export declare function defaultTransportRegistry(): TransportRegistry;
 //# sourceMappingURL=transport-registry.d.ts.map

package/dist/transports/transport-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transport-registry.d.ts","sourceRoot":"","sources":["../../src/transports/transport-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAE7E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAGhE,OAAO,KAAK,EACV,aAAa,EACb,cAAc,EACd,aAAa,EACb,SAAS,EACV,MAAM,gBAAgB,CAAC;AAExB;;;;2EAI2E;AAC3E,qBAAa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,SAAS,EAAE;IAEpD,kEAAkE;IAClE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS;IAI1C;0EACsE;IACtE,OAAO,IAAI,cAAc,EAAE;IAI3B;iEAC6D;IAC7D,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI;IAIpD;wEACoE;IACpE,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC;IAInD;gEAC4D;IAC5D,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAInE;kFAC8E;IAC9E,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI3C;yDACqD;IACrD,OAAO,CACL,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,aAAa,EACrB,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CAAC,aAAa,CAAC;IAIzB,OAAO,CAAC,OAAO;CAOhB;AAED;;oFAEoF;AACpF,wBAAgB,iBAAiB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,CAEnE;AAID;;;;;;oBAMoB;AACpB,wBAAgB,wBAAwB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAQhF"}
+{"version":3,"file":"transport-registry.d.ts","sourceRoot":"","sources":["../../src/transports/transport-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAE7E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAGhE,OAAO,KAAK,EACV,aAAa,EACb,cAAc,EACd,aAAa,EACb,SAAS,EACV,MAAM,gBAAgB,CAAC;AAExB;;;;gEAIgE;AAChE,qBAAa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,SAAS,EAAE;IAEpD,kEAAkE;IAClE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS;IAI1C;0EACsE;IACtE,OAAO,IAAI,cAAc,EAAE;IAI3B;iEAC6D;IAC7D,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI;IAIpD;wEACoE;IACpE,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC;IAInD;gEAC4D;IAC5D,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAInE;kFAC8E;IAC9E,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI3C;yDACqD;IACrD,OAAO,CACL,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,aAAa,EACrB,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CAAC,aAAa,CAAC;IAIzB,OAAO,CAAC,OAAO;CAOhB;AAED;;8EAE8E;AAC9E,wBAAgB,iBAAiB,IAAI,SAAS,EAAE,CAE/C;AAID;;;;;uEAKuE;AACvE,wBAAgB,wBAAwB,IAAI,iBAAiB,CAE5D"}

package/dist/transports/transport-registry.js

@@ -1,10 +1,10 @@
+import { HttpTransport } from "./http-transport.js";
 import { OciTransport } from "./oci/oci-transport.js";
-import { RegistryTransport } from "./registry-transport.js";
 /** Dispatches ref-scheme-specific operations to the transport that owns a ref.
  *  The loader, cache source, `upgrade`, and `publish` consult this instead of
- *  branching on ref shape. `RegistryTransport` is always last so it is the
- *  fallback for bare / `https` refs, and a scheme-owning transport (OCI, later
- *  S3) claims its refs via `supports()` before the fallback is reached. */
+ *  branching on ref shape. `HttpTransport` is always last so it is the fallback
+ *  for plain `https` refs, and a scheme-owning transport (OCI, later S3) claims
+ *  its refs via `supports()` before the fallback is reached. */
 export class TransportRegistry {
     transports;
     constructor(transports) {
@@ -53,26 +53,19 @@ export class TransportRegistry {
     }
 }
 /** The default transport set. Scheme-owning transports come first; the
- *  `RegistryTransport` is last, the fallback for bare / `https` refs. OCI (and
- *  later S3) claim their `oci://` / `s3://` refs before the fallback is reached. */
-export function defaultTransports(registryUrl) {
-    return [new OciTransport(), new RegistryTransport(registryUrl)];
+ *  `HttpTransport` is last, the fallback for plain `https` refs. OCI (and later
+ *  S3) claim their `oci://` / `s3://` refs before the fallback is reached. */
+export function defaultTransports() {
+    return [new OciTransport(), new HttpTransport()];
 }
-const defaultRegistryCache = new Map();
-/** A `TransportRegistry` seeded with {@link defaultTransports}, memoized per
- *  `registryUrl`. The default transports hold no per-call state, so one shared
- *  instance per registry URL is safe — and avoids re-instantiating the whole set
- *  on hot paths like `cachePathForCanonical`. It is also what gives
- *  `OciTransport`'s per-instance read-client pool a process-wide lifetime here,
- *  so the bearer-token cache survives across operations without the pool having
- *  to be global. */
-export function defaultTransportRegistry(registryUrl) {
-    const key = registryUrl ?? "";
-    let cached = defaultRegistryCache.get(key);
-    if (!cached) {
-        cached = new TransportRegistry(defaultTransports(registryUrl));
-        defaultRegistryCache.set(key, cached);
-    }
-    return cached;
+let defaultRegistry;
+/** A `TransportRegistry` seeded with {@link defaultTransports}, memoized. The
+ *  default transports hold no per-call state, so one shared instance is safe —
+ *  and avoids re-instantiating the whole set on hot paths like
+ *  `cachePathForCanonical`. It is also what gives `OciTransport`'s per-instance
+ *  read-client pool a process-wide lifetime here, so the bearer-token cache
+ *  survives across operations without the pool having to be global. */
+export function defaultTransportRegistry() {
+    return (defaultRegistry ??= new TransportRegistry(defaultTransports()));
 }
 //# sourceMappingURL=transport-registry.js.map

package/dist/transports/transport-registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"transport-registry.js","sourceRoot":"","sources":["../../src/transports/transport-registry.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAQ5D;;;;2EAI2E;AAC3E,MAAM,OAAO,iBAAiB;IACC;IAA7B,YAA6B,UAAuB;QAAvB,eAAU,GAAV,UAAU,CAAa;IAAG,CAAC;IAExD,kEAAkE;IAClE,MAAM,CAAC,GAAW;QAChB,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,CAAC;IAED;0EACsE;IACtE,OAAO;QACL,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED;iEAC6D;IAC7D,WAAW,CAAC,GAAW;QACrB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IACpD,CAAC;IAED;wEACoE;IACpE,YAAY,CAAC,GAAW;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED;gEAC4D;IAC5D,UAAU,CAAC,GAAW,EAAE,UAAkB;QACxC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACvD,CAAC;IAED;kFAC8E;IAC9E,MAAM,CAAC,GAAW;QAChB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IAED;yDACqD;IACrD,OAAO,CACL,WAAmB,EACnB,MAAqB,EACrB,IAAqB;QAErB,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACtE,CAAC;IAEO,OAAO,CAAC,GAAW;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,GAAG,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAED;;oFAEoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,WAAoB;IACpD,OAAO,CAAC,IAAI,YAAY,EAAE,EAAE,IAAI,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAA6B,CAAC;AAElE;;;;;;oBAMoB;AACpB,MAAM,UAAU,wBAAwB,CAAC,WAAoB;IAC3D,MAAM,GAAG,GAAG,WAAW,IAAI,EAAE,CAAC;IAC9B,IAAI,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,IAAI,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC;QAC/D,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"transport-registry.js","sourceRoot":"","sources":["../../src/transports/transport-registry.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAQtD;;;;gEAIgE;AAChE,MAAM,OAAO,iBAAiB;IACC;IAA7B,YAA6B,UAAuB;QAAvB,eAAU,GAAV,UAAU,CAAa;IAAG,CAAC;IAExD,kEAAkE;IAClE,MAAM,CAAC,GAAW;QAChB,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,CAAC;IAED;0EACsE;IACtE,OAAO;QACL,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED;iEAC6D;IAC7D,WAAW,CAAC,GAAW;QACrB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IACpD,CAAC;IAED;wEACoE;IACpE,YAAY,CAAC,GAAW;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED;gEAC4D;IAC5D,UAAU,CAAC,GAAW,EAAE,UAAkB;QACxC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACvD,CAAC;IAED;kFAC8E;IAC9E,MAAM,CAAC,GAAW;QAChB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IAED;yDACqD;IACrD,OAAO,CACL,WAAmB,EACnB,MAAqB,EACrB,IAAqB;QAErB,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACtE,CAAC;IAEO,OAAO,CAAC,GAAW;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,GAAG,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAED;;8EAE8E;AAC9E,MAAM,UAAU,iBAAiB;IAC/B,OAAO,CAAC,IAAI,YAAY,EAAE,EAAE,IAAI,aAAa,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,IAAI,eAA8C,CAAC;AAEnD;;;;;uEAKuE;AACvE,MAAM,UAAU,wBAAwB;IACtC,OAAO,CAAC,eAAe,KAAK,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;AAC1E,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/kernel",
-  "version": "0.83.0",
+  "version": "0.85.0",
   "description": "Telo Runtime - A lightweight, polyglot execution host.",
   "keywords": [
     "telo",
@@ -61,7 +61,7 @@
   "dependencies": {
     "@marcbachmann/cel-js": "^7.6.1",
     "@sinclair/typebox": "^0.34.48",
-    "@telorun/analyzer": "0.67.0",
+    "@telorun/analyzer": "0.69.0",
     "@telorun/glob": "0.2.0",
     "@telorun/templating": "0.18.0",
     "ajv": "^8.17.1",

package/src/bundle/module-artifact.ts

@@ -433,15 +433,14 @@ export function moduleDirectoryFor(
   requestedUrl: string,
   source: string,
   entryDir: string,
-  registryUrl: string | undefined,
   manifestsDir: string | undefined,
   legacyDir?: string | null,
 ): string | null {
   const pinned = splitIntegrity(requestedUrl).base;
-  const cacheFile = cachePathForCanonical(pinned, entryDir, registryUrl, manifestsDir);
+  const cacheFile = cachePathForCanonical(pinned, entryDir, manifestsDir);
   if (cacheFile) {
     if (legacyDir && !existsSync(cacheFile)) {
-      const legacyFile = cachePathForCanonical(pinned, entryDir, registryUrl, legacyDir);
+      const legacyFile = cachePathForCanonical(pinned, entryDir, legacyDir);
       if (legacyFile && existsSync(legacyFile)) return path.dirname(legacyFile);
     }
     return path.dirname(cacheFile);

package/src/controller-loaders/bundle-loader.ts

@@ -285,17 +285,17 @@ function findPackageRoot(entryFile: string, name: string): string | null {
 
 /**
  * Loads a `pkg:telo` controller — a controller delivered inside the module's own
- * bundle (the Telo registry artifact), not fetched from an external package
- * registry. Every PURL segment carries meaning:
+ * artifact, not fetched from an external package registry. Every PURL segment
+ * carries meaning:
  *
  *   pkg:telo / local / <format> ? path=./nodejs/x.mjs # export
  *      type     ns       name          qualifier        subpath
  *
  *  - `type=telo` — Telo-delivered (not npm/cargo).
  *  - `namespace=local` — the delivery sub-mode: bundled in the module artifact.
- *    Reserves `pkg:telo/registry/…` for a future "controller fetched from the
- *    Telo registry as its own artifact". A non-`local` namespace → env-missing
- *    here (a different mode another branch/kernel would handle).
+ *    The namespace is what leaves room for a future sub-mode (a controller
+ *    fetched as its own artifact). A non-`local` namespace → env-missing here
+ *    (a different mode another branch/kernel would handle).
  *  - `name=<format>` — the artifact format the loader dispatches on (`js` /
  *    `napi` / `wasm`). Bundling is the one delivery not tied to an ecosystem's
  *    runtime (npm ⇒ JS, cargo ⇒ Rust; a bundle is just files), so the format is
@@ -497,8 +497,8 @@ export class BundleControllerLoader {
     }
 
     // Delivery sub-mode lives in the namespace; this loader handles bundled
-    // (`local`) controllers. Anything else (e.g. a future `registry` mode) is
-    // env-missing so the candidate list falls through.
+    // (`local`) controllers. Anything else (a future sub-mode) is env-missing
+    // so the candidate list falls through.
     if (parsed.namespace !== "local") {
       throw new ControllerEnvMissingError(
         `pkg:telo controller "${purl}" must use the "local" namespace (pkg:telo/local/<format>); got "${parsed.namespace ?? "(none)"}"`,

package/src/controllers/resource-definition/resource-definition-controller.ts

@@ -9,6 +9,7 @@ import { RuntimeError } from "@telorun/sdk";
 import {
   controllerBearingAncestor,
   effectiveAuthorSchema,
+  publishedOwnFields,
   effectiveStatusSchema,
   hasOwnControllerOrTemplate,
   inheritedCapability,
@@ -30,6 +31,9 @@ type ResourceDefinitionResource = RuntimeResource & {
   };
   schema: Record<string, any>;
   status?: Record<string, any>;
+  /** Derived stamp: the fields a merge-form inheriting child publishes over the
+   *  parent instance's reading (see `publishedOwnFields`). */
+  publishedOwnFields?: string[];
   capability?: string;
   extends?: string;
   base?: Record<string, any>;
@@ -77,6 +81,16 @@ class ResourceDefinition implements ResourceInstance {
           `Telo.Definition '${this.resource.metadata.name}': 'extends' target '${this.resource.extends}' is not loaded yet.`,
         );
       }
+      // Which of the child's fields publish over the parent's reading. Stamped
+      // here for the reason `status:` is: an `extends` alias belongs to the file
+      // that declared it, so the set must be derived in the DEFINING scope — a
+      // consumer importing only the backend has no alias for the parent's
+      // library. Derived before the schema stamp only because it reads the same
+      // resolver, not because it reads the pre-stamp value.
+      this.resource.publishedOwnFields = publishedOwnFields(
+        this.resource as ResourceDefinitionManifest,
+        resolveDef,
+      );
       this.resource.schema = effectiveAuthorSchema(
         this.resource as ResourceDefinitionManifest,
         resolveDef,

package/src/evaluation-context.ts

@@ -30,6 +30,11 @@ import {
 import { RuntimeError } from "@telorun/sdk";
 import { evalPathCovers } from "@telorun/analyzer";
 import { effectOwnerOf, executeReturnedChain } from "./effect-scope.js";
+import {
+  REDACTED,
+  redactSensitive,
+  sensitivePathsOfInstance,
+} from "./instance-sensitive-paths.js";
 import {
   classifyInitFailures,
   isDeferral,
@@ -142,6 +147,12 @@ function localDependencyNames(refs: ResourceRef[]): string[] {
  *  whole-value match is redacted. */
 const MIN_SUBSTRING_SCRUB_LEN = 5;
 
+/** A live resource instance, as opposed to the raw config value a slot held
+ *  before Phase-5 injection — the same duck-test the reference-resolving
+ *  controllers use. */
+const hasSnapshotMethod = (value: unknown): boolean =>
+  !!value && typeof (value as { snapshot?: unknown }).snapshot === "function";
+
 export function buildResolvedProperties(
   resource: ResourceManifest,
   secretValues: Set<string>,
@@ -752,6 +763,43 @@ export class EvaluationContext implements IEvaluationContext {
     return def?.status;
   }
 
+  /**
+   * The configured values a merge-form inheriting child publishes over the
+   * parent instance's reading, or undefined when the kind declares none.
+   *
+   * Such a child IS the parent instance — the inherited controller returns it
+   * verbatim — so `snapshot()` is the parent's and a field the parent never
+   * declared would be readable from nowhere. The field NAMES come from
+   * `publishedOwnFields`, stamped onto the definition at registration in the
+   * scope that declared the `extends` alias; resolving the chain here would
+   * resolve it in the READING module's scope, which may have no alias for the
+   * parent's library. Done here rather than by rebinding the instance's
+   * `snapshot()` because this is definition-derived data joined into a reading —
+   * exactly what `statusSchemaOf` already does — and a second kernel cannot
+   * rebind a trait method.
+   *
+   * Two values are withheld rather than published, both conservatively: a
+   * runtime-eval field is still a `CompiledValue` at this point (only compile
+   * paths are expanded at create), and a live instance is a collaborator rather
+   * than a reading. Publishing either would put a wrong-typed value in the CEL
+   * scope, which is the failure this overlay exists to remove.
+   */
+  private ownFieldOverlay(
+    kind: string,
+    resource: Record<string, unknown>,
+  ): Record<string, unknown> | undefined {
+    const def = this.getDefinition?.(this.resolveKindSafe(kind)) ?? this.getDefinition?.(kind);
+    const fields = (def as { publishedOwnFields?: string[] } | undefined)?.publishedOwnFields;
+    if (!fields?.length) return undefined;
+    let overlay: Record<string, unknown> | undefined;
+    for (const field of fields) {
+      const value = resource[field];
+      if (value === undefined || isCompiledValue(value) || hasSnapshotMethod(value)) continue;
+      (overlay ??= {})[field] = value;
+    }
+    return overlay;
+  }
+
   /**
    * Re-read a resource's `snapshot()` and republish it, joined with whatever
    * observed state the resource has reported. The single publication path — the
@@ -760,11 +808,14 @@ export class EvaluationContext implements IEvaluationContext {
    */
   async publishSnapshot(name: string): Promise<void> {
     const entry = this.resourceInstances.get(name) ?? this.createdInstances.get(name);
-    if (!entry?.instance.snapshot) return;
-    const snap = (await Promise.resolve(entry.instance.snapshot())) as
-      | Record<string, unknown>
-      | undefined;
+    if (!entry) return;
     const kind = entry.resource.kind as string;
+    const own = this.ownFieldOverlay(kind, entry.resource);
+    if (!entry.instance.snapshot && !own) return;
+    const snapshot = entry.instance.snapshot
+      ? ((await Promise.resolve(entry.instance.snapshot())) as Record<string, unknown> | undefined)
+      : undefined;
+    const snap = own ? { ...(snapshot ?? {}), ...own } : snapshot;
     const props = buildPublishedProps(snap, {
       kind,
       name,
@@ -1606,6 +1657,30 @@ export class EvaluationContext implements IEvaluationContext {
       : undefined;
     // Capture the root CEL scope once, on the trace's root span's terminal event.
     const rootScope = tracing && parentInvocationId === undefined ? this.traceRootScope() : undefined;
+    // What a payload may say about this call. A credential is a dispatched
+    // invocable, so its material is an invoke OUTPUT — and inputs and outputs
+    // ride the debug wire on every call under `--inspect`, i.e. every watch
+    // session, which the substring scrubbing does not reach (one call site, the
+    // resource-Created event's properties). The kind that owns the contract
+    // marks the field; nothing here knows which kind that is.
+    const hide = (detail: Record<string, unknown>): Record<string, unknown> => {
+      let out = detail;
+      for (const direction of ["inputType", "outputType"] as const) {
+        const key = direction === "inputType" ? "inputs" : "outputs";
+        if (!(key in out)) continue;
+        const paths = sensitivePathsOfInstance(instance, direction);
+        // Unknown, because the contract would not resolve — withhold the whole
+        // value rather than guess. The dispatch is about to raise that same
+        // failure with its own code.
+        if (paths === undefined) {
+          out = { ...out, [key]: REDACTED };
+          continue;
+        }
+        if (paths.length === 0) continue;
+        out = { ...out, [key]: redactSensitive(out[key], paths) };
+      }
+      return out;
+    };
     const span = (
       phase: "start" | "end",
       outcome: SpanOutcome | undefined,
@@ -1620,7 +1695,7 @@ export class EvaluationContext implements IEvaluationContext {
         "invoke",
         phase,
         outcome,
-        phase === "end" && rootScope ? { ...detail, context: rootScope } : detail,
+        phase === "end" && rootScope ? { ...hide(detail), context: rootScope } : hide(detail),
       );
     // When tracing, a derived context carries the new id down the tree so nested
     // invokes read it as their parent; it is never `=== ambient`, so the call

package/src/index.ts

@@ -12,7 +12,7 @@ export {
 export { MemorySource } from "./manifest-sources/memory-source.js";
 export { WORKSPACE_FILENAME, findWorkspaceRoot, realPath } from "./workspace-marker.js";
 export type { Transport } from "./transports/transport.js";
-export { RegistryTransport } from "./transports/registry-transport.js";
+export { HttpTransport } from "./transports/http-transport.js";
 export { OciTransport } from "./transports/oci/oci-transport.js";
 export { OciClient } from "./transports/oci/oci-client.js";
 export { isOciRef, parseOciRef, type ParsedOciRef } from "./transports/oci/oci-ref.js";