@telorun/kernel 0.84.0 → 0.85.0

package/dist/transports/registry-transport.js

@@ -1,282 +0,0 @@
-import { DEFAULT_MANIFEST_FILENAME, HttpSource, RegistrySource, isRegistryRef, parseModuleRef, parseVersionedRef, sha256Base64Url, withRefVersion, splitIntegrity, } from "@telorun/analyzer";
-import { fetchOrThrow } from "@telorun/sdk";
-import { createHash } from "crypto";
-import { assertPublicEgress } from "./egress-guard.js";
-const DEFAULT_REGISTRY_URL = "https://registry.telo.run";
-/** Throwaway origin that lets a bare registry ref use URL path resolution. */
-const JOIN_ORIGIN = "https://ref.invalid";
-/** True for an HTTP(S) destination that names a registry root rather than a
- *  module within it — no path segments to resolve a sibling beside. */
-function isRegistryBase(base) {
-    if (!base.startsWith("http://") && !base.startsWith("https://"))
-        return false;
-    try {
-        return new URL(base).pathname.replace(/\/+/g, "/").replace(/^\/|\/$/g, "") === "";
-    }
-    catch {
-        return false;
-    }
-}
-const QUERY_HASH_LENGTH = 12;
-/** Mirror `HttpSource.read`'s `fetchUrl` derivation: when the URL does not
- *  already point at a YAML file, append `/telo.yaml`, so a raw import URL and
- *  the canonical source it resolves to map to the same cache path. */
-function normalizePathname(rawUrl, parsed) {
-    let pathname = parsed.pathname;
-    if (!rawUrl.includes(".yaml")) {
-        pathname = pathname.endsWith("/")
-            ? `${pathname}${DEFAULT_MANIFEST_FILENAME}`
-            : `${pathname}/${DEFAULT_MANIFEST_FILENAME}`;
-    }
-    return pathname;
-}
-/** Short hash of `search + hash` so two URLs that differ only in query /
- *  fragment do not collide at the same cache path. */
-function disambiguatePath(pathname, search, hash) {
-    if (!search && !hash)
-        return pathname;
-    const digest = createHash("sha256")
-        .update(search + hash)
-        .digest("hex")
-        .slice(0, QUERY_HASH_LENGTH);
-    const dotIdx = pathname.lastIndexOf(".");
-    const slashIdx = pathname.lastIndexOf("/");
-    const ext = dotIdx > slashIdx ? pathname.slice(dotIdx) : "";
-    const base = pathname.slice(0, pathname.length - ext.length);
-    return `${base}.${digest}${ext}`;
-}
-/** The default HTTP transport: bare `namespace/name@version` registry refs and
- *  direct `https://…` URLs, resolving against `registry.telo.run` (or a
- *  configured registry). Its resolution `source` composes the browser-safe
- *  `RegistrySource` / `HttpSource` from `analyzer`; the Node-only management
- *  methods live here. This is the fallback transport for any ref that carries
- *  no owning scheme, so `oci://` (or a future `s3://`) never falls through to
- *  it — those refs are claimed by their own transport's `supports()`. */
-export class RegistryTransport {
-    registryUrl;
-    registrySource;
-    httpSource;
-    source;
-    constructor(registryUrl = DEFAULT_REGISTRY_URL) {
-        this.registryUrl = registryUrl;
-        this.registrySource = new RegistrySource(registryUrl);
-        this.httpSource = new HttpSource();
-        const pick = (ref) => this.httpSource.supports(ref) ? this.httpSource : this.registrySource;
-        this.source = {
-            supports: (url) => this.supports(url),
-            read: async (url) => {
-                // The browser-safe sources do the fetch; the Node-side egress policy
-                // is enforced here, on the host the read will actually hit.
-                await assertPublicEgress(this.httpSource.supports(url) ? url : this.registryUrl);
-                return pick(url).read(url);
-            },
-            resolveRelative: (base, relative) => pick(base).resolveRelative(base, relative),
-        };
-    }
-    supports(ref) {
-        const { base } = splitIntegrity(ref);
-        return base.startsWith("http://") || base.startsWith("https://") || isRegistryRef(ref);
-    }
-    cacheCoords(ref) {
-        const url = splitIntegrity(ref).base;
-        const trimmedRegistry = this.registryUrl.replace(/\/+$/, "");
-        const registryHost = this.registryHost();
-        // 1. Registry ref form: <path>@<version>. Keyed under the registry's host —
-        //    a ref says nothing about which registry serves it, so without the host
-        //    two registries' copies of the same path/version share one cache entry.
-        if (isRegistryRef(url)) {
-            if (!registryHost)
-                return null;
-            let parsed;
-            try {
-                parsed = parseModuleRef(url);
-            }
-            catch {
-                return null;
-            }
-            return {
-                transport: "registry",
-                host: registryHost,
-                path: parsed.modulePath,
-                version: parsed.version,
-            };
-        }
-        // 2. HTTP(S) URL — a direct registry URL or arbitrary external.
-        if (url.startsWith("http://") || url.startsWith("https://")) {
-            let parsed;
-            try {
-                parsed = new URL(url);
-            }
-            catch {
-                return null;
-            }
-            const pathname = normalizePathname(url, parsed);
-            // 2a. On the configured registry, no query/fragment: fold into the
-            //     registry layout so a ref and a direct URL land on the same file.
-            const normalizedUrl = `${parsed.protocol}//${parsed.host}${pathname}`;
-            if (registryHost &&
-                !parsed.search &&
-                !parsed.hash &&
-                normalizedUrl.startsWith(`${trimmedRegistry}/`)) {
-                // The registry serves `<path…>/<version>/<file>`, where `<file>` is the
-                // module manifest or one of its `include:` partials.
-                const segments = normalizedUrl.slice(trimmedRegistry.length + 1).split("/");
-                const file = segments.pop();
-                const version = segments.pop();
-                if (file && version && segments.length > 0) {
-                    return {
-                        transport: "registry",
-                        host: registryHost,
-                        path: segments.join("/"),
-                        version,
-                        file,
-                    };
-                }
-            }
-            // 2b. Arbitrary HTTP(S) → `url` subtree, query-hash suffix on collision.
-            //     No version segment: a URL addresses exactly one file, and the
-            //     version it declares lives inside bytes the cache maps paths without.
-            const cleanPath = pathname.startsWith("/") ? pathname.slice(1) : pathname;
-            const segments = disambiguatePath(cleanPath, parsed.search, parsed.hash).split("/");
-            const file = segments.pop();
-            if (!file)
-                return null;
-            return { transport: "url", host: parsed.host, path: segments.join("/"), file };
-        }
-        return null;
-    }
-    /** Host of the configured registry, or `null` when the URL is unparseable. */
-    registryHost() {
-        try {
-            return new URL(this.registryUrl).host || null;
-        }
-        catch {
-            return null;
-        }
-    }
-    async listVersions(ref) {
-        // Only bare registry refs are version-enumerable — a direct `https://` URL
-        // has no version-list endpoint.
-        if (!isRegistryRef(ref))
-            return null;
-        const { modulePath } = parseModuleRef(ref);
-        const url = `${this.registryUrl.replace(/\/+$/, "")}/${modulePath}`;
-        await assertPublicEgress(url);
-        const res = await fetchOrThrow(url, { headers: { accept: "application/json" } }, { operation: "Registry version list", setting: "--registry / TELO_REGISTRY" });
-        if (res.status === 404)
-            return null;
-        if (!res.ok) {
-            throw new Error(`Registry returned ${res.status} ${res.statusText} for ${modulePath}`);
-        }
-        const body = (await res.json());
-        return Array.isArray(body.versions) ? body.versions : [];
-    }
-    refVersion(ref) {
-        // Only bare `namespace/name@version` refs carry an upgradeable version — a
-        // direct `https://` URL has no version segment to bump.
-        return isRegistryRef(ref) ? (parseVersionedRef(ref)?.version ?? null) : null;
-    }
-    withVersion(ref, version) {
-        return withRefVersion(ref, version);
-    }
-    /** Mirrors the sources' fetch-URL derivation: a direct URL points at (or
-     *  contains) the YAML file; a bare registry ref folds into the registry
-     *  layout. `null` when this transport does not own the ref's shape. */
-    manifestUrl(ref) {
-        const { base } = splitIntegrity(ref);
-        if (base.startsWith("http://") || base.startsWith("https://")) {
-            return base.includes(".yaml") ? base : `${base}/${DEFAULT_MANIFEST_FILENAME}`;
-        }
-        if (isRegistryRef(ref)) {
-            const { modulePath, version } = parseModuleRef(ref);
-            return `${this.registryUrl.replace(/\/+$/, "")}/${modulePath}/${version}/${DEFAULT_MANIFEST_FILENAME}`;
-        }
-        return null;
-    }
-    async digest(ref) {
-        // The digest is Telo's canonical hash over the `telo.yaml` bytes — the same
-        // value `manifestHash` returns, but absent-is-null rather than a throw.
-        const fetchUrl = this.manifestUrl(ref);
-        if (!fetchUrl)
-            return null;
-        await assertPublicEgress(fetchUrl);
-        const res = await fetchOrThrow(fetchUrl, undefined, {
-            operation: "Registry manifest read",
-            setting: "--registry / TELO_REGISTRY",
-        });
-        if (res.status === 404)
-            return null;
-        if (!res.ok) {
-            throw new Error(`Registry returned ${res.status} ${res.statusText} for ${fetchUrl}`);
-        }
-        const bytes = new Uint8Array(await res.arrayBuffer());
-        return `sha256-${await sha256Base64Url(bytes)}`;
-    }
-    /** Hashes the **raw response bytes**, which is exactly what `verifiedFetch`
-     *  checks an inline `#sha256-…` pin against on the read path. */
-    async manifestHash(ref) {
-        const fetchUrl = this.manifestUrl(ref);
-        if (!fetchUrl) {
-            throw new Error(`cannot hash non-remote import '${ref}'`);
-        }
-        await assertPublicEgress(fetchUrl);
-        const res = await fetchOrThrow(fetchUrl, undefined, {
-            operation: "Registry manifest hash",
-            setting: "--registry / TELO_REGISTRY",
-        });
-        if (!res.ok) {
-            throw new Error(`fetch ${fetchUrl}: ${res.status} ${res.statusText}`);
-        }
-        const bytes = new Uint8Array(await res.arrayBuffer());
-        return `sha256-${await sha256Base64Url(bytes)}`;
-    }
-    /** Layered artifacts are an OCI concept, and the registry origin is read-only
-     *  — nothing has ever published a payload here, so there is no layer to pull.
-     *  A module reached over the registry is manifest-only, and its controllers
-     *  come from npm. */
-    async fetchLayer(ref, blobDigest) {
-        throw new Error(`Cannot fetch layer ${blobDigest} of ${ref}: the Telo registry serves manifests only. ` +
-            `A module with a bundled payload is published as an OCI artifact (oci://host/repo).`);
-    }
-    async layerIndex(layers) {
-        // Same boundary `fetchLayer` and `publish` draw: the HTTP registry serves
-        // manifests only, so it frames no layer and can name no blob. An empty set
-        // is not a payload, so it answers rather than throws — a manifest-only
-        // module builds its payload through this transport during analysis.
-        if (layers.every((layer) => layer.files.length === 0))
-            return [];
-        throw new Error("The Telo registry serves manifests only, so it cannot index payload layers. " +
-            "A module with a bundled payload is published as an OCI artifact (oci://host/repo).");
-    }
-    async publish(destination, bundle, opts = {}) {
-        // Publishing to the HTTP Telo registry has been removed — the registry
-        // origin stays read-only, and new versions publish to OCI. `telo publish`
-        // rejects a non-OCI destination up front, so this is only a guard for a
-        // direct programmatic call.
-        throw new Error("Publishing to the HTTP Telo registry has been removed. Publish to an OCI " +
-            "registry (oci://host/repo) instead.");
-    }
-    canonicalizeSiblingRef(destination, relativeSource, version) {
-        // The sibling sits beside the destination module: resolve the relative path
-        // against the destination's own path, then pin the sibling's version. A bare
-        // registry ref (`std/foo`) is a path, not a URL, so it borrows a throwaway
-        // origin for the join and drops it again.
-        const base = splitIntegrity(destination).base.replace(/@[^/@]*$/, "");
-        // A registry *base* (`https://registry.telo.run`) is not a module location,
-        // so there is nothing for `../lib` to resolve beside — joining anyway would
-        // silently produce a ref one path segment short.
-        if (isRegistryBase(base)) {
-            throw new Error(`cannot canonicalize the relative import '${relativeSource}': publish destination ` +
-                `'${destination}' is a registry base, not this module's own location. Pass the ` +
-                `module's full destination (e.g. '${base.replace(/\/+$/, "")}/<namespace>/<name>').`);
-        }
-        const isUrl = base.startsWith("http://") || base.startsWith("https://");
-        const origin = isUrl ? base : `${JOIN_ORIGIN}/${base.replace(/^\/+/, "")}`;
-        const resolved = new URL(relativeSource, `${origin.replace(/\/+$/, "")}/`);
-        const joined = isUrl
-            ? `${resolved.protocol}//${resolved.host}${resolved.pathname}`
-            : resolved.pathname.replace(/^\/+/, "");
-        return `${joined.replace(/\/+$/, "")}@${version}`;
-    }
-}
-//# sourceMappingURL=registry-transport.js.map

package/dist/transports/registry-transport.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"registry-transport.js","sourceRoot":"","sources":["../../src/transports/registry-transport.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,cAAc,EACd,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,cAAc,GAIf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAGpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AASvD,MAAM,oBAAoB,GAAG,2BAA2B,CAAC;AACzD,8EAA8E;AAC9E,MAAM,WAAW,GAAG,qBAAqB,CAAC;AAE1C;uEACuE;AACvE,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AACD,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;sEAEsE;AACtE,SAAS,iBAAiB,CAAC,MAAc,EAAE,MAAW;IACpD,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC/B,CAAC,CAAC,GAAG,QAAQ,GAAG,yBAAyB,EAAE;YAC3C,CAAC,CAAC,GAAG,QAAQ,IAAI,yBAAyB,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;sDACsD;AACtD,SAAS,gBAAgB,CAAC,QAAgB,EAAE,MAAc,EAAE,IAAY;IACtE,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC;IACtC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;SAChC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;SACrB,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7D,OAAO,GAAG,IAAI,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;AACnC,CAAC;AAMD;;;;;;yEAMyE;AACzE,MAAM,OAAO,iBAAiB;IAKC;IAJZ,cAAc,CAAiB;IAC/B,UAAU,CAAa;IAC/B,MAAM,CAAiB;IAEhC,YAA6B,cAAsB,oBAAoB;QAA1C,gBAAW,GAAX,WAAW,CAA+B;QACrE,IAAI,CAAC,cAAc,GAAG,IAAI,cAAc,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,CAAC,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,CAAC,GAAW,EAAkB,EAAE,CAC3C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;QACxE,IAAI,CAAC,MAAM,GAAG;YACZ,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YACrC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAClB,qEAAqE;gBACrE,4DAA4D;gBAC5D,MAAM,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBACjF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7B,CAAC;YACD,eAAe,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC;SAChF,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC;IACzF,CAAC;IAED,WAAW,CAAC,GAAW;QACrB,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACrC,MAAM,eAAe,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7D,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAEzC,4EAA4E;QAC5E,4EAA4E;QAC5E,4EAA4E;QAC5E,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,YAAY;gBAAE,OAAO,IAAI,CAAC;YAC/B,IAAI,MAAyC,CAAC;YAC9C,IAAI,CAAC;gBACH,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO;gBACL,SAAS,EAAE,UAAU;gBACrB,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,MAAM,CAAC,UAAU;gBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC;QACJ,CAAC;QAED,gEAAgE;QAChE,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5D,IAAI,MAAW,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAEhD,mEAAmE;YACnE,uEAAuE;YACvE,MAAM,aAAa,GAAG,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;YACtE,IACE,YAAY;gBACZ,CAAC,MAAM,CAAC,MAAM;gBACd,CAAC,MAAM,CAAC,IAAI;gBACZ,aAAa,CAAC,UAAU,CAAC,GAAG,eAAe,GAAG,CAAC,EAC/C,CAAC;gBACD,wEAAwE;gBACxE,qDAAqD;gBACrD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC5E,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC;gBAC5B,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC;gBAC/B,IAAI,IAAI,IAAI,OAAO,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC3C,OAAO;wBACL,SAAS,EAAE,UAAU;wBACrB,IAAI,EAAE,YAAY;wBAClB,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;wBACxB,OAAO;wBACP,IAAI;qBACL,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,yEAAyE;YACzE,oEAAoE;YACpE,2EAA2E;YAC3E,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC1E,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACpF,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;QACjF,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8EAA8E;IACtE,YAAY;QAClB,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAW;QAC5B,2EAA2E;QAC3E,gCAAgC;QAChC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,MAAM,EAAE,UAAU,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC;QACpE,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,MAAM,YAAY,CAC5B,GAAG,EACH,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,EAC3C,EAAE,SAAS,EAAE,uBAAuB,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAC9E,CAAC;QACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,QAAQ,UAAU,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAC;QACpD,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,CAAC;IAED,UAAU,CAAC,GAAW;QACpB,2EAA2E;QAC3E,wDAAwD;QACxD,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/E,CAAC;IAED,WAAW,CAAC,GAAW,EAAE,OAAe;QACtC,OAAO,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IAED;;2EAEuE;IAC/D,WAAW,CAAC,GAAW;QAC7B,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9D,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,yBAAyB,EAAE,CAAC;QAChF,CAAC;QACD,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YACpD,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,UAAU,IAAI,OAAO,IAAI,yBAAyB,EAAE,CAAC;QACzG,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE;YAClD,SAAS,EAAE,wBAAwB;YACnC,OAAO,EAAE,4BAA4B;SACtC,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,QAAQ,QAAQ,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACtD,OAAO,UAAU,MAAM,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;IAClD,CAAC;IAED;qEACiE;IACjE,KAAK,CAAC,YAAY,CAAC,GAAW;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,GAAG,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE;YAClD,SAAS,EAAE,wBAAwB;YACnC,OAAO,EAAE,4BAA4B;SACtC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,SAAS,QAAQ,KAAK,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACtD,OAAO,UAAU,MAAM,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;IAClD,CAAC;IAED;;;yBAGqB;IACrB,KAAK,CAAC,UAAU,CAAC,GAAW,EAAE,UAAkB;QAC9C,MAAM,IAAI,KAAK,CACb,sBAAsB,UAAU,OAAO,GAAG,6CAA6C;YACrF,oFAAoF,CACvF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAA+B;QAC9C,0EAA0E;QAC1E,2EAA2E;QAC3E,uEAAuE;QACvE,oEAAoE;QACpE,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CACb,8EAA8E;YAC5E,oFAAoF,CACvF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CACX,WAAmB,EACnB,MAAqB,EACrB,OAAuB,EAAE;QAEzB,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,4BAA4B;QAC5B,MAAM,IAAI,KAAK,CACb,2EAA2E;YACzE,qCAAqC,CACxC,CAAC;IACJ,CAAC;IAED,sBAAsB,CACpB,WAAmB,EACnB,cAAsB,EACtB,OAAe;QAEf,4EAA4E;QAC5E,6EAA6E;QAC7E,2EAA2E;QAC3E,0CAA0C;QAC1C,MAAM,IAAI,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACtE,4EAA4E;QAC5E,4EAA4E;QAC5E,iDAAiD;QACjD,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,4CAA4C,cAAc,yBAAyB;gBACjF,IAAI,WAAW,iEAAiE;gBAChF,oCAAoC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB,CACvF,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;QAC3E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,cAAc,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,KAAK;YAClB,CAAC,CAAC,GAAG,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE;YAC9D,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1C,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,OAAO,EAAE,CAAC;IACpD,CAAC;CACF"}

package/src/transports/registry-transport.ts

@@ -1,339 +0,0 @@
-import {
-  DEFAULT_MANIFEST_FILENAME,
-  HttpSource,
-  RegistrySource,
-  isRegistryRef,
-  parseModuleRef,
-  parseVersionedRef,
-  sha256Base64Url,
-  withRefVersion,
-  splitIntegrity,
-  type ArtifactLayer,
-  type ManifestCacheCoords,
-  type ManifestSource,
-} from "@telorun/analyzer";
-import { fetchOrThrow } from "@telorun/sdk";
-import { createHash } from "crypto";
-
-import type { PayloadFile } from "../bundle/files-integrity.js";
-import { assertPublicEgress } from "./egress-guard.js";
-import type {
-  PayloadLayer,
-  PublishBundle,
-  PublishOptions,
-  PublishResult,
-  Transport,
-} from "./transport.js";
-
-const DEFAULT_REGISTRY_URL = "https://registry.telo.run";
-/** Throwaway origin that lets a bare registry ref use URL path resolution. */
-const JOIN_ORIGIN = "https://ref.invalid";
-
-/** True for an HTTP(S) destination that names a registry root rather than a
- *  module within it — no path segments to resolve a sibling beside. */
-function isRegistryBase(base: string): boolean {
-  if (!base.startsWith("http://") && !base.startsWith("https://")) return false;
-  try {
-    return new URL(base).pathname.replace(/\/+/g, "/").replace(/^\/|\/$/g, "") === "";
-  } catch {
-    return false;
-  }
-}
-const QUERY_HASH_LENGTH = 12;
-
-/** Mirror `HttpSource.read`'s `fetchUrl` derivation: when the URL does not
- *  already point at a YAML file, append `/telo.yaml`, so a raw import URL and
- *  the canonical source it resolves to map to the same cache path. */
-function normalizePathname(rawUrl: string, parsed: URL): string {
-  let pathname = parsed.pathname;
-  if (!rawUrl.includes(".yaml")) {
-    pathname = pathname.endsWith("/")
-      ? `${pathname}${DEFAULT_MANIFEST_FILENAME}`
-      : `${pathname}/${DEFAULT_MANIFEST_FILENAME}`;
-  }
-  return pathname;
-}
-
-/** Short hash of `search + hash` so two URLs that differ only in query /
- *  fragment do not collide at the same cache path. */
-function disambiguatePath(pathname: string, search: string, hash: string): string {
-  if (!search && !hash) return pathname;
-  const digest = createHash("sha256")
-    .update(search + hash)
-    .digest("hex")
-    .slice(0, QUERY_HASH_LENGTH);
-  const dotIdx = pathname.lastIndexOf(".");
-  const slashIdx = pathname.lastIndexOf("/");
-  const ext = dotIdx > slashIdx ? pathname.slice(dotIdx) : "";
-  const base = pathname.slice(0, pathname.length - ext.length);
-  return `${base}.${digest}${ext}`;
-}
-
-interface VersionsResponse {
-  versions?: string[];
-}
-
-/** The default HTTP transport: bare `namespace/name@version` registry refs and
- *  direct `https://…` URLs, resolving against `registry.telo.run` (or a
- *  configured registry). Its resolution `source` composes the browser-safe
- *  `RegistrySource` / `HttpSource` from `analyzer`; the Node-only management
- *  methods live here. This is the fallback transport for any ref that carries
- *  no owning scheme, so `oci://` (or a future `s3://`) never falls through to
- *  it — those refs are claimed by their own transport's `supports()`. */
-export class RegistryTransport implements Transport {
-  private readonly registrySource: RegistrySource;
-  private readonly httpSource: HttpSource;
-  readonly source: ManifestSource;
-
-  constructor(private readonly registryUrl: string = DEFAULT_REGISTRY_URL) {
-    this.registrySource = new RegistrySource(registryUrl);
-    this.httpSource = new HttpSource();
-    const pick = (ref: string): ManifestSource =>
-      this.httpSource.supports(ref) ? this.httpSource : this.registrySource;
-    this.source = {
-      supports: (url) => this.supports(url),
-      read: async (url) => {
-        // The browser-safe sources do the fetch; the Node-side egress policy
-        // is enforced here, on the host the read will actually hit.
-        await assertPublicEgress(this.httpSource.supports(url) ? url : this.registryUrl);
-        return pick(url).read(url);
-      },
-      resolveRelative: (base, relative) => pick(base).resolveRelative(base, relative),
-    };
-  }
-
-  supports(ref: string): boolean {
-    const { base } = splitIntegrity(ref);
-    return base.startsWith("http://") || base.startsWith("https://") || isRegistryRef(ref);
-  }
-
-  cacheCoords(ref: string): ManifestCacheCoords | null {
-    const url = splitIntegrity(ref).base;
-    const trimmedRegistry = this.registryUrl.replace(/\/+$/, "");
-    const registryHost = this.registryHost();
-
-    // 1. Registry ref form: <path>@<version>. Keyed under the registry's host —
-    //    a ref says nothing about which registry serves it, so without the host
-    //    two registries' copies of the same path/version share one cache entry.
-    if (isRegistryRef(url)) {
-      if (!registryHost) return null;
-      let parsed: ReturnType<typeof parseModuleRef>;
-      try {
-        parsed = parseModuleRef(url);
-      } catch {
-        return null;
-      }
-      return {
-        transport: "registry",
-        host: registryHost,
-        path: parsed.modulePath,
-        version: parsed.version,
-      };
-    }
-
-    // 2. HTTP(S) URL — a direct registry URL or arbitrary external.
-    if (url.startsWith("http://") || url.startsWith("https://")) {
-      let parsed: URL;
-      try {
-        parsed = new URL(url);
-      } catch {
-        return null;
-      }
-      const pathname = normalizePathname(url, parsed);
-
-      // 2a. On the configured registry, no query/fragment: fold into the
-      //     registry layout so a ref and a direct URL land on the same file.
-      const normalizedUrl = `${parsed.protocol}//${parsed.host}${pathname}`;
-      if (
-        registryHost &&
-        !parsed.search &&
-        !parsed.hash &&
-        normalizedUrl.startsWith(`${trimmedRegistry}/`)
-      ) {
-        // The registry serves `<path…>/<version>/<file>`, where `<file>` is the
-        // module manifest or one of its `include:` partials.
-        const segments = normalizedUrl.slice(trimmedRegistry.length + 1).split("/");
-        const file = segments.pop();
-        const version = segments.pop();
-        if (file && version && segments.length > 0) {
-          return {
-            transport: "registry",
-            host: registryHost,
-            path: segments.join("/"),
-            version,
-            file,
-          };
-        }
-      }
-
-      // 2b. Arbitrary HTTP(S) → `url` subtree, query-hash suffix on collision.
-      //     No version segment: a URL addresses exactly one file, and the
-      //     version it declares lives inside bytes the cache maps paths without.
-      const cleanPath = pathname.startsWith("/") ? pathname.slice(1) : pathname;
-      const segments = disambiguatePath(cleanPath, parsed.search, parsed.hash).split("/");
-      const file = segments.pop();
-      if (!file) return null;
-      return { transport: "url", host: parsed.host, path: segments.join("/"), file };
-    }
-
-    return null;
-  }
-
-  /** Host of the configured registry, or `null` when the URL is unparseable. */
-  private registryHost(): string | null {
-    try {
-      return new URL(this.registryUrl).host || null;
-    } catch {
-      return null;
-    }
-  }
-
-  async listVersions(ref: string): Promise<string[] | null> {
-    // Only bare registry refs are version-enumerable — a direct `https://` URL
-    // has no version-list endpoint.
-    if (!isRegistryRef(ref)) return null;
-    const { modulePath } = parseModuleRef(ref);
-    const url = `${this.registryUrl.replace(/\/+$/, "")}/${modulePath}`;
-    await assertPublicEgress(url);
-    const res = await fetchOrThrow(
-      url,
-      { headers: { accept: "application/json" } },
-      { operation: "Registry version list", setting: "--registry / TELO_REGISTRY" },
-    );
-    if (res.status === 404) return null;
-    if (!res.ok) {
-      throw new Error(`Registry returned ${res.status} ${res.statusText} for ${modulePath}`);
-    }
-    const body = (await res.json()) as VersionsResponse;
-    return Array.isArray(body.versions) ? body.versions : [];
-  }
-
-  refVersion(ref: string): string | null {
-    // Only bare `namespace/name@version` refs carry an upgradeable version — a
-    // direct `https://` URL has no version segment to bump.
-    return isRegistryRef(ref) ? (parseVersionedRef(ref)?.version ?? null) : null;
-  }
-
-  withVersion(ref: string, version: string): string {
-    return withRefVersion(ref, version);
-  }
-
-  /** Mirrors the sources' fetch-URL derivation: a direct URL points at (or
-   *  contains) the YAML file; a bare registry ref folds into the registry
-   *  layout. `null` when this transport does not own the ref's shape. */
-  private manifestUrl(ref: string): string | null {
-    const { base } = splitIntegrity(ref);
-    if (base.startsWith("http://") || base.startsWith("https://")) {
-      return base.includes(".yaml") ? base : `${base}/${DEFAULT_MANIFEST_FILENAME}`;
-    }
-    if (isRegistryRef(ref)) {
-      const { modulePath, version } = parseModuleRef(ref);
-      return `${this.registryUrl.replace(/\/+$/, "")}/${modulePath}/${version}/${DEFAULT_MANIFEST_FILENAME}`;
-    }
-    return null;
-  }
-
-  async digest(ref: string): Promise<string | null> {
-    // The digest is Telo's canonical hash over the `telo.yaml` bytes — the same
-    // value `manifestHash` returns, but absent-is-null rather than a throw.
-    const fetchUrl = this.manifestUrl(ref);
-    if (!fetchUrl) return null;
-    await assertPublicEgress(fetchUrl);
-    const res = await fetchOrThrow(fetchUrl, undefined, {
-      operation: "Registry manifest read",
-      setting: "--registry / TELO_REGISTRY",
-    });
-    if (res.status === 404) return null;
-    if (!res.ok) {
-      throw new Error(`Registry returned ${res.status} ${res.statusText} for ${fetchUrl}`);
-    }
-    const bytes = new Uint8Array(await res.arrayBuffer());
-    return `sha256-${await sha256Base64Url(bytes)}`;
-  }
-
-  /** Hashes the **raw response bytes**, which is exactly what `verifiedFetch`
-   *  checks an inline `#sha256-…` pin against on the read path. */
-  async manifestHash(ref: string): Promise<string> {
-    const fetchUrl = this.manifestUrl(ref);
-    if (!fetchUrl) {
-      throw new Error(`cannot hash non-remote import '${ref}'`);
-    }
-    await assertPublicEgress(fetchUrl);
-    const res = await fetchOrThrow(fetchUrl, undefined, {
-      operation: "Registry manifest hash",
-      setting: "--registry / TELO_REGISTRY",
-    });
-    if (!res.ok) {
-      throw new Error(`fetch ${fetchUrl}: ${res.status} ${res.statusText}`);
-    }
-    const bytes = new Uint8Array(await res.arrayBuffer());
-    return `sha256-${await sha256Base64Url(bytes)}`;
-  }
-
-  /** Layered artifacts are an OCI concept, and the registry origin is read-only
-   *  — nothing has ever published a payload here, so there is no layer to pull.
-   *  A module reached over the registry is manifest-only, and its controllers
-   *  come from npm. */
-  async fetchLayer(ref: string, blobDigest: string): Promise<PayloadFile[]> {
-    throw new Error(
-      `Cannot fetch layer ${blobDigest} of ${ref}: the Telo registry serves manifests only. ` +
-        `A module with a bundled payload is published as an OCI artifact (oci://host/repo).`,
-    );
-  }
-
-  async layerIndex(layers: readonly PayloadLayer[]): Promise<ArtifactLayer[]> {
-    // Same boundary `fetchLayer` and `publish` draw: the HTTP registry serves
-    // manifests only, so it frames no layer and can name no blob. An empty set
-    // is not a payload, so it answers rather than throws — a manifest-only
-    // module builds its payload through this transport during analysis.
-    if (layers.every((layer) => layer.files.length === 0)) return [];
-    throw new Error(
-      "The Telo registry serves manifests only, so it cannot index payload layers. " +
-        "A module with a bundled payload is published as an OCI artifact (oci://host/repo).",
-    );
-  }
-
-  async publish(
-    destination: string,
-    bundle: PublishBundle,
-    opts: PublishOptions = {},
-  ): Promise<PublishResult> {
-    // Publishing to the HTTP Telo registry has been removed — the registry
-    // origin stays read-only, and new versions publish to OCI. `telo publish`
-    // rejects a non-OCI destination up front, so this is only a guard for a
-    // direct programmatic call.
-    throw new Error(
-      "Publishing to the HTTP Telo registry has been removed. Publish to an OCI " +
-        "registry (oci://host/repo) instead.",
-    );
-  }
-
-  canonicalizeSiblingRef(
-    destination: string,
-    relativeSource: string,
-    version: string,
-  ): string {
-    // The sibling sits beside the destination module: resolve the relative path
-    // against the destination's own path, then pin the sibling's version. A bare
-    // registry ref (`std/foo`) is a path, not a URL, so it borrows a throwaway
-    // origin for the join and drops it again.
-    const base = splitIntegrity(destination).base.replace(/@[^/@]*$/, "");
-    // A registry *base* (`https://registry.telo.run`) is not a module location,
-    // so there is nothing for `../lib` to resolve beside — joining anyway would
-    // silently produce a ref one path segment short.
-    if (isRegistryBase(base)) {
-      throw new Error(
-        `cannot canonicalize the relative import '${relativeSource}': publish destination ` +
-          `'${destination}' is a registry base, not this module's own location. Pass the ` +
-          `module's full destination (e.g. '${base.replace(/\/+$/, "")}/<namespace>/<name>').`,
-      );
-    }
-    const isUrl = base.startsWith("http://") || base.startsWith("https://");
-    const origin = isUrl ? base : `${JOIN_ORIGIN}/${base.replace(/^\/+/, "")}`;
-    const resolved = new URL(relativeSource, `${origin.replace(/\/+$/, "")}/`);
-    const joined = isUrl
-      ? `${resolved.protocol}//${resolved.host}${resolved.pathname}`
-      : resolved.pathname.replace(/^\/+/, "");
-    return `${joined.replace(/\/+$/, "")}@${version}`;
-  }
-}