@telorun/kernel 0.83.0 → 0.85.0

package/src/instance-sensitive-paths.ts

@@ -0,0 +1,123 @@
+/**
+ * Instance → the contract paths its kind marked `x-telo-sensitive`, recorded at
+ * `create()` beside the handle and the declaration.
+ *
+ * The trace site has only the instance. It cannot re-derive this: the resolved
+ * contract is compiled inside `bindContract`'s closure and dropped, the
+ * definition carries the DECLARATION rather than the resolved schema, and an
+ * instance-manifest override would be missed by re-resolving from the kind. So
+ * the answer is recorded where both halves are in hand, exactly as
+ * `instance-declaration.ts` records the other direction.
+ *
+ * TWO entries per instance, kept apart by direction, because a contract may mark
+ * a field on the way in as well as on the way out — `forceRefresh` going to a
+ * credential is not sensitive, but a signing key handed to one would be, and a
+ * single merged list would redact an input path in an output payload where it
+ * names something else entirely.
+ *
+ * Weak and one-way: paths are obtainable FROM an instance, never an instance
+ * from paths, so nothing here extends a lifetime or hands out live state.
+ * Resolution is LAZY — the paths are read through a thunk rather than eagerly,
+ * because compiling a contract at create time would make every contract-bearing
+ * kind depend on type-registration order, which is the reason the binding defers
+ * it in the first place.
+ */
+
+export type ContractDirection = "inputType" | "outputType";
+
+interface SensitiveThunks {
+  inputType?: () => string[][];
+  outputType?: () => string[][];
+}
+
+const sensitive = new WeakMap<object, SensitiveThunks>();
+
+/** Record how to obtain one direction's sensitive paths for a live instance.
+ *  First record wins, matching the handle and declaration rules: a `base:` child
+ *  IS its parent instance, and the parent's binding is the one that produced
+ *  it. */
+export function recordSensitivePaths(
+  instance: object,
+  direction: ContractDirection,
+  paths: () => string[][],
+): void {
+  const entry = sensitive.get(instance) ?? {};
+  if (entry[direction] !== undefined) return;
+  entry[direction] = paths;
+  sensitive.set(instance, entry);
+}
+
+/**
+ * The paths one direction of a live instance's contract marked sensitive.
+ *
+ * An EMPTY list means the contract marked nothing, or the kind declares no
+ * contract at all — carry the payload verbatim. `undefined` means the contract
+ * could not be resolved, so WHICH fields are sensitive is unknown and the
+ * payload must be withheld whole.
+ *
+ * Nothing is swallowed by that: resolving is exactly what the dispatch about to
+ * follow does, so the same failure surfaces from it a moment later, with its own
+ * code and its own message. What the catch avoids is a trace site becoming the
+ * place an unrelated contract defect first appears — and, far worse, emitting
+ * auth material onto the wire because a schema failed to compile.
+ */
+export function sensitivePathsOfInstance(
+  instance: unknown,
+  direction: ContractDirection,
+): string[][] | undefined {
+  if (!instance || typeof instance !== "object") return [];
+  const thunk = sensitive.get(instance as object)?.[direction];
+  if (!thunk) return [];
+  try {
+    return thunk();
+  } catch {
+    return undefined;
+  }
+}
+
+/** What a hidden value reads as. The key is KEPT and only the value replaced,
+ *  per the logging spec §14: a payload that silently loses a key reads as a
+ *  value that was never produced. */
+export const REDACTED = "[redacted]";
+
+/**
+ * `value` with the marked paths replaced by {@link REDACTED}.
+ *
+ * Copy-on-write ALONG THE PATHS ONLY, so the caller's own object — the very
+ * object being handed to a controller, or the one it just returned — is never
+ * mutated. A whole-payload clone would be the obvious alternative and is wrong
+ * twice: it costs a deep copy per span on the dispatch path, and it would
+ * rewrite live values (a stream handle, a resource instance) that only survive
+ * by identity.
+ */
+export function redactSensitive(value: unknown, paths: readonly string[][]): unknown {
+  if (paths.length === 0) return value;
+  let out = value;
+  for (const path of paths) out = redactAt(out, path, 0);
+  return out;
+}
+
+function redactAt(node: unknown, path: readonly string[], index: number): unknown {
+  if (node === null || node === undefined) return node;
+  if (index === path.length) return REDACTED;
+  const segment = path[index];
+  if (segment === "[]") {
+    return Array.isArray(node) ? node.map((element) => redactAt(element, path, index + 1)) : node;
+  }
+  // The map-value wildcard: every own key, whatever it is named. What
+  // `additionalProperties` / `patternProperties` emit, since neither carries
+  // property names to walk.
+  if (segment === "{}") {
+    if (typeof node !== "object" || Array.isArray(node)) return node;
+    const source = node as Record<string, unknown>;
+    const out: Record<string, unknown> = {};
+    for (const [key, value] of Object.entries(source)) out[key] = redactAt(value, path, index + 1);
+    return out;
+  }
+  if (typeof node !== "object" || Array.isArray(node)) return node;
+  const object = node as Record<string, unknown>;
+  // A path the value does not carry is not a defect — the contract describes
+  // what MAY be there, and an optional field is routinely absent.
+  if (!(segment in object)) return node;
+  return { ...object, [segment]: redactAt(object[segment], path, index + 1) };
+}

package/src/invocation-contract-binding.ts

@@ -5,6 +5,7 @@ import {
   type DeclaredScalarForm,
   type DeclaredScalarPath,
   defaultBearingPaths,
+  sensitivePaths,
   effectiveContractField,
   describeProjectionFailure,
   resolveSchemaProjections,
@@ -75,6 +76,9 @@ export interface BoundContract {
    *  value is normalized at, in either direction. Empty when the contract
    *  declares none. */
   scalarPaths(): DeclaredScalarPath[];
+  /** Paths the contract marked `x-telo-sensitive` — the values a trace payload
+   *  carries as `[redacted]`. Empty when the contract marks none. */
+  sensitivePaths(): string[][];
 }
 
 const CONTRACT_ERROR: Record<ContractDirection, string> = {
@@ -149,6 +153,7 @@ export function resolveBoundContract(
   let compiled: { validate(value: unknown): void } | undefined;
   let paths: string[][] | undefined;
   let scalars: DeclaredScalarPath[] | undefined;
+  let sensitive: string[][] | undefined;
 
   const resolve = (): { validate(value: unknown): void } => {
     if (compiled !== undefined) return compiled;
@@ -193,6 +198,9 @@ export function resolveBoundContract(
     const stripped = withLiveValuesSkipped(projected, factory.resolveRef);
     paths = defaultBearingPaths(stripped, factory.resolveRef);
     scalars = declaredScalarPaths(stripped, factory.resolveRef);
+    // Read off the STRIPPED schema like the other two, so a marked node behind a
+    // live value is not reported: nothing walks into a stream to redact it.
+    sensitive = sensitivePaths(stripped, factory.resolveRef);
     // Compile by NAME whenever the declaration is one, so the type's CEL
     // `rules:` are composed in — including when a stream had to be stripped, in
     // which case the stream-bearing properties are dropped from the schema the
@@ -220,6 +228,10 @@ export function resolveBoundContract(
       resolve();
       return scalars ?? [];
     },
+    sensitivePaths: () => {
+      resolve();
+      return sensitive ?? [];
+    },
   };
 }
 

package/src/kernel.ts

@@ -53,6 +53,7 @@ import { ResourceContextImpl } from "./resource-context.js";
 import { mintResourceHandle } from "./resource-handle.js";
 import { bindEffectOwner } from "./effect-scope.js";
 import { declarationOfInstance, recordInstanceDeclaration } from "./instance-declaration.js";
+import { recordSensitivePaths } from "./instance-sensitive-paths.js";
 import { nodeHostVersions } from "./host-versions.js";
 import { nodeCelHandlers } from "./cel-handlers.js";
 import { parseRef, seedInvokeSource } from "./invoke-dispatch.js";
@@ -128,10 +129,6 @@ export interface KernelOptions {
    *  fails to dispatch). Order matters — later entries take priority over
    *  earlier ones (sources are unshifted onto the dispatch chain). */
   sources: ManifestSource[];
-  /** Base URL for the registry source. When unset, the `RegistrySource`
-   *  default applies. Callers (e.g. the CLI) are responsible for resolving
-   *  `TELO_REGISTRY_URL` or any other env-based fallback before passing. */
-  registryUrl?: string;
 }
 
 /**
@@ -194,7 +191,6 @@ export class Kernel implements IKernel {
   readonly stderr: NodeJS.WritableStream;
   readonly env: Record<string, string | undefined>;
   readonly argv: string[];
-  readonly registryUrl: string | undefined;
   /** The sources this kernel was constructed with, kept so `ctx.runtime` can
    *  give a child manifest — or a static check of one — the same resolution
    *  chain this kernel runs on. The transports come from the registry and are
@@ -231,11 +227,10 @@ export class Kernel implements IKernel {
       return { traceId: ambient.traceId, spanId };
     });
     this.argv = options.argv ?? [];
-    this.registryUrl = options.registryUrl;
     // Resolution sources come from the transport registry, so a scheme-owning
     // transport (OCI, later S3) joins the loader's dispatch chain by being
     // registered — no source-chain edits here.
-    this.loader = new Loader(defaultTransportRegistry(this.registryUrl).sources(), {
+    this.loader = new Loader(defaultTransportRegistry().sources(), {
       celHandlers: nodeCelHandlers,
     });
     this.injectedSources = [...options.sources];
@@ -333,8 +328,8 @@ export class Kernel implements IKernel {
     // import-controller's independent re-resolution onto the winning source so a
     // sub-library importing a lower version loads the same controller/definition
     // the analyzer registered — never a second, colliding copy. Keyed by
-    // canonical URL; `canonicalize` maps a registry ref (returned verbatim by
-    // the loader) to the URL the graph walk already resolved it to.
+    // canonical URL; `canonicalize` maps a ref returned verbatim by the loader
+    // to the URL the graph walk already resolved it to.
     const overrides = this._loadedGraph?.overrides;
     if (overrides && overrides.size > 0) {
       const canonical = this.loader.canonicalize(resolved) ?? resolved;
@@ -1063,7 +1058,7 @@ export class Kernel implements IKernel {
   private buildModuleArtifacts(graph: LoadedGraph, manifestsDir: string | undefined): void {
     this.moduleArtifacts.clear();
     this.siblingLibraries.clear();
-    const transports = defaultTransportRegistry(this.registryUrl);
+    const transports = defaultTransportRegistry();
     const entryDir = this._entryUrl ? resolveEntryDir(this._entryUrl) ?? "" : "";
     // The same pre-anchor root `LocalManifestCacheSource` falls back to. Layers
     // live beside the cached manifest, so both halves have to look in the same
@@ -1085,7 +1080,6 @@ export class Kernel implements IKernel {
         file.requestedUrl,
         file.source,
         entryDir,
-        this.registryUrl,
         manifestsDir,
         legacyDir,
       );
@@ -1479,6 +1473,26 @@ export class Kernel implements IKernel {
 
     if (!runtime.length) return { instance, ctx, resource: processedResource };
 
+    // Runtime eval paths are expanded against a CALL's inputs, so they need a
+    // call. `invoke` is the only entry point that takes any — `run()` and
+    // `provide()` are parameterless — so a kind that declares one of these paths
+    // and has no `invoke()` has annotated something nothing can ever expand: the
+    // value stays a compiled expression for the life of the resource. Reported
+    // here rather than dereferenced: this used to be a non-null assertion, and it
+    // failed as `undefined is not an object (evaluating 'instance.invoke.bind')`
+    // against the kernel's own source, naming neither the kind nor the field.
+    // Method presence rather than declared capability, because the kernel
+    // dispatches on the method — a Provider that implements `invoke` is bound
+    // exactly like an Invocable.
+    if (typeof instance.invoke !== "function") {
+      throw new RuntimeError(
+        "ERR_RUNTIME_EVAL_WITHOUT_INVOKE",
+        `Kind ${resolvedKind} declares 'x-telo-eval: runtime' (at ${runtime.join(", ")}), but its resources have no invoke() — ` +
+          `runtime evaluation expands a call's inputs, and run() / provide() take none. ` +
+          `Use 'x-telo-eval: compile' for a value resolved once when the resource is created, or give the kind an invocable controller.`,
+      );
+    }
+
     // Override invoke in-place so all lifecycle methods (init/invoke/teardown/snapshot)
     // share the same `this`. A wrapper object would split identity: state mutated by
     // init() on the wrapper would be invisible to the original invoke(), which still
@@ -1487,7 +1501,7 @@ export class Kernel implements IKernel {
     // Every argument is forwarded: `invoke(inputs, ctx)` carries the
     // InvokeContext (cancellation, tracing) as its second parameter, and a
     // wrapper that declares only `inputs` silently drops it.
-    const originalInvoke = instance.invoke!.bind(instance);
+    const originalInvoke = instance.invoke.bind(instance);
     instance.invoke = async (inputs: any, ...rest: unknown[]) => {
       const expanded = evalContext.expandPaths(inputs as Record<string, unknown>, runtime);
       return (originalInvoke as (i: any, ...r: unknown[]) => Promise<unknown>)(expanded, ...rest);
@@ -1564,6 +1578,13 @@ export class Kernel implements IKernel {
     );
     if (!input && !output) return;
 
+    // Recorded here because this is the only point holding both the instance and
+    // its resolved contract — `bindContract` closes over the contract and drops
+    // it, and the trace site has only the instance. Lazily, so a contract is
+    // still compiled on first dispatch rather than at create time.
+    if (input) recordSensitivePaths(instance, "inputType", () => input.sensitivePaths());
+    if (output) recordSensitivePaths(instance, "outputType", () => output.sensitivePaths());
+
     bindContract(instance, {
       input,
       output,

package/src/manifest-sources/local-manifest-cache-source.ts

@@ -15,7 +15,6 @@ import { TransportRegistry, defaultTransportRegistry } from "../transports/trans
 import { findWorkspaceRoot } from "../workspace-marker.js";
 
 const CACHE_SUBDIR = ".telo/manifests";
-const DEFAULT_REGISTRY_URL = "https://registry.telo.run";
 
 /** Verify that `candidate` resolves to a path under `root`. Returns the
  *  candidate path on success, `null` when any segment escapes the root.
@@ -33,8 +32,8 @@ function joinUnder(root: string, ...segments: string[]): string | null {
 
 /** Single source of truth for URL → cache path. Used identically by the
  *  reader (cache lookup) and writer (install-time persistence). For any
- *  given import ref — registry ref, direct registry URL, arbitrary HTTP, or
- *  `oci://` — both sides land on the same file: the owning transport supplies
+ *  given import ref — an HTTP(S) URL or an `oci://` ref — both sides land on
+ *  the same file: the owning transport supplies
  *  the coordinates and the analyzer's `manifestCacheKey` renders them, the same
  *  grammar the hub's static manifest bucket and the editor's read path use.
  *
@@ -80,8 +79,8 @@ export function legacyManifestsDirFallback(
 
 /**
  * Reads previously-cached manifest YAMLs from the resolved manifest cache. Sits
- * ahead of `RegistrySource` / `HttpSource` in the source chain — a hit makes boot
- * hermetic, a miss falls through to the network source unchanged.
+ * ahead of `HttpSource` in the source chain — a hit makes boot hermetic, a miss
+ * falls through to the network source unchanged.
  *
  * Populated by `writeManifestCache` at install time.
  *
@@ -90,7 +89,7 @@ export function legacyManifestsDirFallback(
  * costs only CPU when it goes cold; this one costs network, so without the
  * fallback the move to a workspace-anchored root would stop a hermetic setup from
  * booting — its `telo install` output stranded at the old path, with the failure
- * surfacing as a registry fetch on a machine that has no route to one. Read-only
+ * surfacing as a network fetch on a machine that has no route out. Read-only
  * and one directory deep: writes always go to the current root, so the old copy
  * ages out rather than being maintained.
  */
@@ -99,17 +98,13 @@ export class LocalManifestCacheSource implements ManifestSource {
   private readonly legacyRoot: string | null;
   private readonly transports: TransportRegistry;
 
-  constructor(
-    entryDir: string,
-    registryUrl: string = DEFAULT_REGISTRY_URL,
-    manifestsDir?: string,
-  ) {
+  constructor(entryDir: string, manifestsDir?: string) {
     // `manifestsDir` is the resolved manifest-cache directory threaded from a
     // single `resolveCacheRoot` (honours `TELO_CACHE_DIR`); when absent we fall
     // back to the entry-anchored default so library/test callers are unchanged.
     this.cacheRoot = manifestsDir ?? legacyManifestsDir(entryDir);
     this.legacyRoot = legacyManifestsDirFallback(entryDir, this.cacheRoot);
-    this.transports = defaultTransportRegistry(registryUrl);
+    this.transports = defaultTransportRegistry();
   }
 
   supports(url: string): boolean {
@@ -176,11 +171,10 @@ export class LocalManifestCacheSource implements ManifestSource {
 export function cachePathForCanonical(
   canonicalSource: string,
   entryDir: string,
-  registryUrl: string | undefined = DEFAULT_REGISTRY_URL,
   manifestsDir?: string,
 ): string | null {
   const cacheRoot = manifestsDir ?? path.join(entryDir, CACHE_SUBDIR);
-  return cachePathForUrl(canonicalSource, cacheRoot, defaultTransportRegistry(registryUrl));
+  return cachePathForUrl(canonicalSource, cacheRoot, defaultTransportRegistry());
 }
 
 /**
@@ -198,7 +192,6 @@ export function cachePathForCanonical(
 export async function writeManifestCache(
   graph: LoadedGraph,
   entryDir: string,
-  registryUrl: string = DEFAULT_REGISTRY_URL,
   manifestsDir?: string,
 ): Promise<string[]> {
   const written: string[] = [];
@@ -210,7 +203,7 @@ export async function writeManifestCache(
       if (seen.has(file.source)) continue;
       seen.add(file.source);
 
-      const target = cachePathForCanonical(file.source, entryDir, registryUrl, manifestsDir);
+      const target = cachePathForCanonical(file.source, entryDir, manifestsDir);
       if (!target) continue;
 
       await fs.mkdir(path.dirname(target), { recursive: true });

package/src/runtime-seam.ts

@@ -167,7 +167,6 @@ export class KernelRuntimeSeam implements RuntimeSeam {
       stdout: stdout.writable,
       stderr: stderr.writable,
       sources: [...this.kernel.injectedSources],
-      registryUrl: this.kernel.registryUrl,
     });
 
     // A child that fails to load is not an exception on this side: the caller
@@ -223,7 +222,7 @@ export class KernelRuntimeSeam implements RuntimeSeam {
     // rather than the kernel's own loader because a checked manifest is often
     // deliberately broken and has no business entering the running kernel's
     // parse cache.
-    const loader = new Loader(defaultTransportRegistry(this.kernel.registryUrl).sources(), {
+    const loader = new Loader(defaultTransportRegistry().sources(), {
       celHandlers: nodeCelHandlers,
     });
     for (const injected of this.kernel.injectedSources) {

package/src/transports/http-transport.ts

@@ -0,0 +1,209 @@
+import {
+  DEFAULT_MANIFEST_FILENAME,
+  HttpSource,
+  sha256Base64Url,
+  splitIntegrity,
+  type ArtifactLayer,
+  type ManifestCacheCoords,
+  type ManifestSource,
+} from "@telorun/analyzer";
+import { fetchOrThrow } from "@telorun/sdk";
+import { createHash } from "crypto";
+
+import type { PayloadFile } from "../bundle/files-integrity.js";
+import { assertPublicEgress } from "./egress-guard.js";
+import type {
+  PayloadLayer,
+  PublishBundle,
+  PublishOptions,
+  PublishResult,
+  Transport,
+} from "./transport.js";
+
+const QUERY_HASH_LENGTH = 12;
+
+/** Mirror `HttpSource.read`'s `fetchUrl` derivation: when the URL does not
+ *  already point at a YAML file, append `/telo.yaml`, so a raw import URL and
+ *  the canonical source it resolves to map to the same cache path. */
+function normalizePathname(rawUrl: string, parsed: URL): string {
+  let pathname = parsed.pathname;
+  if (!rawUrl.includes(".yaml")) {
+    pathname = pathname.endsWith("/")
+      ? `${pathname}${DEFAULT_MANIFEST_FILENAME}`
+      : `${pathname}/${DEFAULT_MANIFEST_FILENAME}`;
+  }
+  return pathname;
+}
+
+/** Short hash of `search + hash` so two URLs that differ only in query /
+ *  fragment do not collide at the same cache path. */
+function disambiguatePath(pathname: string, search: string, hash: string): string {
+  if (!search && !hash) return pathname;
+  const digest = createHash("sha256")
+    .update(search + hash)
+    .digest("hex")
+    .slice(0, QUERY_HASH_LENGTH);
+  const dotIdx = pathname.lastIndexOf(".");
+  const slashIdx = pathname.lastIndexOf("/");
+  const ext = dotIdx > slashIdx ? pathname.slice(dotIdx) : "";
+  const base = pathname.slice(0, pathname.length - ext.length);
+  return `${base}.${digest}${ext}`;
+}
+
+/** The transport for direct `https://…` (and `http://`) module URLs. Its
+ *  resolution `source` composes the browser-safe `HttpSource` from `analyzer`;
+ *  the Node-only management methods live here. This is the fallback transport
+ *  for any ref that carries no owning scheme, so `oci://` (or a future `s3://`)
+ *  never falls through to it — those refs are claimed by their own transport's
+ *  `supports()`.
+ *
+ *  A URL addresses exactly one file, so it names no enumerable version: this
+ *  transport publishes nothing, lists no versions, and has no `@version` segment
+ *  to bump. What it does own is reading, hashing and caching those bytes. */
+export class HttpTransport implements Transport {
+  private readonly httpSource: HttpSource;
+  readonly source: ManifestSource;
+
+  constructor() {
+    this.httpSource = new HttpSource();
+    this.source = {
+      supports: (url) => this.supports(url),
+      read: async (url) => {
+        // The browser-safe source does the fetch; the Node-side egress policy
+        // is enforced here, on the host the read will actually hit.
+        await assertPublicEgress(url);
+        return this.httpSource.read(url);
+      },
+      resolveRelative: (base, relative) => this.httpSource.resolveRelative(base, relative),
+    };
+  }
+
+  supports(ref: string): boolean {
+    const { base } = splitIntegrity(ref);
+    return base.startsWith("http://") || base.startsWith("https://");
+  }
+
+  cacheCoords(ref: string): ManifestCacheCoords | null {
+    const url = splitIntegrity(ref).base;
+    if (!url.startsWith("http://") && !url.startsWith("https://")) return null;
+
+    let parsed: URL;
+    try {
+      parsed = new URL(url);
+    } catch {
+      return null;
+    }
+    const pathname = normalizePathname(url, parsed);
+
+    // `url` subtree, query-hash suffix on collision. No version segment: a URL
+    // addresses exactly one file, and the version it declares lives inside
+    // bytes the cache maps paths without.
+    const cleanPath = pathname.startsWith("/") ? pathname.slice(1) : pathname;
+    const segments = disambiguatePath(cleanPath, parsed.search, parsed.hash).split("/");
+    const file = segments.pop();
+    if (!file) return null;
+    return { transport: "url", host: parsed.host, path: segments.join("/"), file };
+  }
+
+  async listVersions(): Promise<string[] | null> {
+    // A direct `https://` URL has no version-list endpoint.
+    return null;
+  }
+
+  refVersion(): string | null {
+    // A direct `https://` URL has no version segment to bump.
+    return null;
+  }
+
+  withVersion(ref: string): string {
+    throw new Error(
+      `cannot set a version on '${ref}': a URL addresses one file and carries no version segment.`,
+    );
+  }
+
+  /** Mirrors the source's fetch-URL derivation: the URL points at (or contains)
+   *  the YAML file. `null` when this transport does not own the ref's shape. */
+  private manifestUrl(ref: string): string | null {
+    const { base } = splitIntegrity(ref);
+    if (!base.startsWith("http://") && !base.startsWith("https://")) return null;
+    return base.includes(".yaml") ? base : `${base}/${DEFAULT_MANIFEST_FILENAME}`;
+  }
+
+  async digest(ref: string): Promise<string | null> {
+    // The digest is Telo's canonical hash over the `telo.yaml` bytes — the same
+    // value `manifestHash` returns, but absent-is-null rather than a throw.
+    const fetchUrl = this.manifestUrl(ref);
+    if (!fetchUrl) return null;
+    await assertPublicEgress(fetchUrl);
+    const res = await fetchOrThrow(fetchUrl, undefined, { operation: "Module manifest read" });
+    if (res.status === 404) return null;
+    if (!res.ok) {
+      throw new Error(`${fetchUrl} returned ${res.status} ${res.statusText}`);
+    }
+    const bytes = new Uint8Array(await res.arrayBuffer());
+    return `sha256-${await sha256Base64Url(bytes)}`;
+  }
+
+  /** Hashes the **raw response bytes**, which is exactly what `verifiedFetch`
+   *  checks an inline `#sha256-…` pin against on the read path. */
+  async manifestHash(ref: string): Promise<string> {
+    const fetchUrl = this.manifestUrl(ref);
+    if (!fetchUrl) {
+      throw new Error(`cannot hash non-remote import '${ref}'`);
+    }
+    await assertPublicEgress(fetchUrl);
+    const res = await fetchOrThrow(fetchUrl, undefined, { operation: "Module manifest hash" });
+    if (!res.ok) {
+      throw new Error(`fetch ${fetchUrl}: ${res.status} ${res.statusText}`);
+    }
+    const bytes = new Uint8Array(await res.arrayBuffer());
+    return `sha256-${await sha256Base64Url(bytes)}`;
+  }
+
+  /** Layered artifacts are an OCI concept — a module reached over a plain URL is
+   *  manifest-only, and its controllers come from npm. */
+  async fetchLayer(ref: string, blobDigest: string): Promise<PayloadFile[]> {
+    throw new Error(
+      `Cannot fetch layer ${blobDigest} of ${ref}: a plain URL serves the manifest only. ` +
+        `A module with a bundled payload is published as an OCI artifact (oci://host/repo).`,
+    );
+  }
+
+  async layerIndex(layers: readonly PayloadLayer[]): Promise<ArtifactLayer[]> {
+    // Same boundary `fetchLayer` and `publish` draw: a plain URL serves the
+    // manifest only, so it frames no layer and can name no blob. An empty set is
+    // not a payload, so it answers rather than throws — a manifest-only module
+    // builds its payload through this transport during analysis.
+    if (layers.every((layer) => layer.files.length === 0)) return [];
+    throw new Error(
+      "A plain URL serves the manifest only, so it cannot index payload layers. " +
+        "A module with a bundled payload is published as an OCI artifact (oci://host/repo).",
+    );
+  }
+
+  async publish(
+    destination: string,
+    bundle: PublishBundle,
+    opts: PublishOptions = {},
+  ): Promise<PublishResult> {
+    // `telo publish` rejects a non-OCI destination up front, so this is only a
+    // guard for a direct programmatic call.
+    throw new Error(
+      "Publishing over HTTP has been removed. Publish to an OCI registry " +
+        "(oci://host/repo) instead.",
+    );
+  }
+
+  canonicalizeSiblingRef(destination: string, relativeSource: string, version: string): string {
+    // Canonicalizing a sibling is publish-path work, and this transport does not
+    // publish — so it refuses here for the same reason `publish` does, rather
+    // than computing a ref nothing could ever push. Silence would be worse than
+    // useless: an `https://host/` destination has no path to resolve `../lib`
+    // beside, so joining anyway yields a ref one segment short with no error.
+    throw new Error(
+      `Cannot canonicalize the relative import '${relativeSource}' against '${destination}': ` +
+        `publishing over plain HTTP has been removed. Publish to an OCI registry ` +
+        `(oci://host/repo) instead.`,
+    );
+  }
+}

package/src/transports/transport-registry.ts

@@ -1,8 +1,8 @@
 import type { ManifestCacheCoords, ManifestSource } from "@telorun/analyzer";
 
 import type { PayloadFile } from "../bundle/files-integrity.js";
+import { HttpTransport } from "./http-transport.js";
 import { OciTransport } from "./oci/oci-transport.js";
-import { RegistryTransport } from "./registry-transport.js";
 import type {
   PublishBundle,
   PublishOptions,
@@ -12,9 +12,9 @@ import type {
 
 /** Dispatches ref-scheme-specific operations to the transport that owns a ref.
  *  The loader, cache source, `upgrade`, and `publish` consult this instead of
- *  branching on ref shape. `RegistryTransport` is always last so it is the
- *  fallback for bare / `https` refs, and a scheme-owning transport (OCI, later
- *  S3) claims its refs via `supports()` before the fallback is reached. */
+ *  branching on ref shape. `HttpTransport` is always last so it is the fallback
+ *  for plain `https` refs, and a scheme-owning transport (OCI, later S3) claims
+ *  its refs via `supports()` before the fallback is reached. */
 export class TransportRegistry {
   constructor(private readonly transports: Transport[]) {}
 
@@ -73,27 +73,20 @@ export class TransportRegistry {
 }
 
 /** The default transport set. Scheme-owning transports come first; the
- *  `RegistryTransport` is last, the fallback for bare / `https` refs. OCI (and
- *  later S3) claim their `oci://` / `s3://` refs before the fallback is reached. */
-export function defaultTransports(registryUrl?: string): Transport[] {
-  return [new OciTransport(), new RegistryTransport(registryUrl)];
+ *  `HttpTransport` is last, the fallback for plain `https` refs. OCI (and later
+ *  S3) claim their `oci://` / `s3://` refs before the fallback is reached. */
+export function defaultTransports(): Transport[] {
+  return [new OciTransport(), new HttpTransport()];
 }
 
-const defaultRegistryCache = new Map<string, TransportRegistry>();
+let defaultRegistry: TransportRegistry | undefined;
 
-/** A `TransportRegistry` seeded with {@link defaultTransports}, memoized per
- *  `registryUrl`. The default transports hold no per-call state, so one shared
- *  instance per registry URL is safe — and avoids re-instantiating the whole set
- *  on hot paths like `cachePathForCanonical`. It is also what gives
- *  `OciTransport`'s per-instance read-client pool a process-wide lifetime here,
- *  so the bearer-token cache survives across operations without the pool having
- *  to be global. */
-export function defaultTransportRegistry(registryUrl?: string): TransportRegistry {
-  const key = registryUrl ?? "";
-  let cached = defaultRegistryCache.get(key);
-  if (!cached) {
-    cached = new TransportRegistry(defaultTransports(registryUrl));
-    defaultRegistryCache.set(key, cached);
-  }
-  return cached;
+/** A `TransportRegistry` seeded with {@link defaultTransports}, memoized. The
+ *  default transports hold no per-call state, so one shared instance is safe —
+ *  and avoids re-instantiating the whole set on hot paths like
+ *  `cachePathForCanonical`. It is also what gives `OciTransport`'s per-instance
+ *  read-client pool a process-wide lifetime here, so the bearer-token cache
+ *  survives across operations without the pool having to be global. */
+export function defaultTransportRegistry(): TransportRegistry {
+  return (defaultRegistry ??= new TransportRegistry(defaultTransports()));
 }