@toa.io/norm 1.0.0-alpha.33 → 1.0.0-alpha.330

package/CHANGELOG.md

@@ -0,0 +1,381 @@
+# Change Log
+
+All notable changes to this project will be documented in this file.
+See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
+
+# [1.0.0-alpha.330](https://github.com/toa-io/toa/compare/v1.0.0-alpha.329...v1.0.0-alpha.330) (2026-10-15)
+
+**Note:** Version bump only for package @toa.io/norm
+
+
+
+
+
+# [1.0.0-alpha.329](https://github.com/toa-io/toa/compare/v1.0.0-alpha.328...v1.0.0-alpha.329) (2026-10-11)
+
+**Note:** Version bump only for package @toa.io/norm
+
+
+
+
+
+# [1.0.0-alpha.328](https://github.com/toa-io/toa/compare/v1.0.0-alpha.327...v1.0.0-alpha.328) (2026-10-10)
+
+**Note:** Version bump only for package @toa.io/norm
+
+
+
+
+
+# [1.0.0-alpha.327](https://github.com/toa-io/toa/compare/v1.0.0-alpha.326...v1.0.0-alpha.327) (2026-10-10)
+
+### Features
+
+* name a component without a namespace by its name ([abcdd9c](https://github.com/toa-io/toa/commit/abcdd9c9a3d3c5c1c68b74544791848e59a7e158))
+
+
+# [1.0.0-alpha.326](https://github.com/toa-io/toa/compare/v1.0.0-alpha.325...v1.0.0-alpha.326) (2026-10-06)
+
+* feat(core)!: deliver an operation's error as its code and its cause ([18d303b](https://github.com/toa-io/toa/commit/18d303b9143930735e4b093345db1dbf37f90052))
+
+### Bug Fixes
+
+* **deps:** find files with tinyglobby, which carries no braces ([ef951af](https://github.com/toa-io/toa/commit/ef951af26b5f93fec567033520c62ca01f397355))
+
+### BREAKING CHANGES
+
+* an error returned with a `code` field and no message is an exception,
+  and a property of an error other than `cause` no longer reaches the caller.
+
+
+# [1.0.0-alpha.325](https://github.com/toa-io/toa/compare/v1.0.0-alpha.324...v1.0.0-alpha.325) (2026-10-02)
+
+**Note:** Version bump only for package @toa.io/norm
+
+
+
+
+
+# [1.0.0-alpha.324](https://github.com/toa-io/toa/compare/v1.0.0-alpha.323...v1.0.0-alpha.324) (2026-10-02)
+
+**Note:** Version bump only for package @toa.io/norm
+
+
+
+
+
+# [1.0.0-alpha.323](https://github.com/toa-io/toa/compare/v1.0.0-alpha.322...v1.0.0-alpha.323) (2026-10-01)
+
+**Note:** Version bump only for package @toa.io/norm
+
+
+
+
+
+# [1.0.0-alpha.322](https://github.com/toa-io/toa/compare/v1.0.0-alpha.321...v1.0.0-alpha.322) (2026-09-29)
+
+### Features
+
+* **continuity:** give back what a continued effect was answered on an earlier attempt ([507145b](https://github.com/toa-io/toa/commit/507145beb635dad3d948b74630e34858537bf8ef))
+
+
+# [1.0.0-alpha.321](https://github.com/toa-io/toa/compare/v1.0.0-alpha.320...v1.0.0-alpha.321) (2026-09-28)
+
+### Features
+
+* **core:** let an operation declared unchained begin a chain of its own ([6d94324](https://github.com/toa-io/toa/commit/6d94324cb43ff4b12e1bc267d81498445b40a02e))
+
+
+# [1.0.0-alpha.320](https://github.com/toa-io/toa/compare/v1.0.0-alpha.319...v1.0.0-alpha.320) (2026-09-28)
+
+**Note:** Version bump only for package @toa.io/norm
+
+
+
+
+
+# [1.0.0-alpha.319](https://github.com/toa-io/toa/compare/v1.0.0-alpha.318...v1.0.0-alpha.319) (2026-09-27)
+
+**Note:** Version bump only for package @toa.io/norm
+
+
+
+
+
+# [1.0.0-alpha.318](https://github.com/toa-io/toa/compare/v1.0.0-alpha.317...v1.0.0-alpha.318) (2026-09-23)
+
+### Features
+
+* **norm:** hash what a component links into its version ([c01db29](https://github.com/toa-io/toa/commit/c01db29954efbda1a1787abaf20b727f2cbbe7e2))
+
+
+# [1.0.0-alpha.317](https://github.com/toa-io/toa/compare/v1.0.0-alpha.316...v1.0.0-alpha.317) (2026-09-23)
+
+**Note:** Version bump only for package @toa.io/norm
+
+
+
+
+
+# [1.0.0-alpha.316](https://github.com/toa-io/toa/compare/v1.0.0-alpha.315...v1.0.0-alpha.316) (2026-09-23)
+
+**Note:** Version bump only for package @toa.io/norm
+
+
+
+
+
+# [1.0.0-alpha.315](https://github.com/toa-io/toa/compare/v1.0.0-alpha.314...v1.0.0-alpha.315) (2026-09-23)
+
+* feat(map)!: leave out of a contract what the runtime gives every component ([b81837a](https://github.com/toa-io/toa/commit/b81837a3bc4771d7ee1c10fe613c9a1d7501bf1a))
+
+### BREAKING CHANGES
+
+* the deployed component map is `/etc/toa/.map.json.gz`.
+
+
+# [1.0.0-alpha.314](https://github.com/toa-io/toa/compare/v1.0.0-alpha.313...v1.0.0-alpha.314) (2026-09-19)
+
+* feat(core)!: let an operation state how long its calls are remembered ([af177c2](https://github.com/toa-io/toa/commit/af177c2ab3d00d475840b5ef9e612f04e82b72bd))
+* feat(core)!: rename trailers to the TRAILERS system property ([8d59ef9](https://github.com/toa-io/toa/commit/8d59ef90d04b7329578203fe10bd21fe41dfe2f5))
+
+### Features
+
+* **core:** a reference may name a declaration its package claims ([8040f60](https://github.com/toa-io/toa/commit/8040f60976549ab90497675bb54e664261f5b6bb))
+
+### BREAKING CHANGES
+
+* `inbox.retention` under 600 is refused. See
+  migrations/313.md.
+* `state._trailers` is `state.TRAILERS`; see migrations/313.md.
+
+
+# [1.0.0-alpha.313](https://github.com/toa-io/toa/compare/v1.0.0-alpha.312...v1.0.0-alpha.313) (2026-09-18)
+
+**Note:** Version bump only for package @toa.io/norm
+
+
+
+
+
+# [1.0.0-alpha.312](https://github.com/toa-io/toa/compare/v1.0.0-alpha.311...v1.0.0-alpha.312) (2026-09-18)
+
+### Features
+
+* **bindings.http:** carry a call that holds a stream ([c571793](https://github.com/toa-io/toa/commit/c571793b617e3d5ae1dce5b98b64d67d7d8224f6))
+* **cli:** write the property that carries a stream into a component's types ([8eae8ce](https://github.com/toa-io/toa/commit/8eae8cea011c0be78b27ed1380a1a6f17c9479f8))
+* **norm:** let an operation declare the input property that carries a stream ([85a8f1f](https://github.com/toa-io/toa/commit/85a8f1ff5b62f658e0527dcce7230d8388d28fe0))
+* **operations:** refuse to render a chart for a context with no version ([d6cd083](https://github.com/toa-io/toa/commit/d6cd083bfe8d7da9f3d451c2c25d821eb41ce958))
+
+
+# [1.0.0-alpha.311](https://github.com/toa-io/toa/compare/v1.0.0-alpha.310...v1.0.0-alpha.311) (2026-09-17)
+
+**Note:** Version bump only for package @toa.io/norm
+
+
+
+
+
+# [1.0.0-alpha.310](https://github.com/toa-io/toa/compare/v1.0.0-alpha.309...v1.0.0-alpha.310) (2026-09-16)
+
+**Note:** Version bump only for package @toa.io/norm
+
+
+
+
+
+# [1.0.0-alpha.309](https://github.com/toa-io/toa/compare/v1.0.0-alpha.308...v1.0.0-alpha.309) (2026-09-16)
+
+**Note:** Version bump only for package @toa.io/norm
+
+
+
+
+
+# [1.0.0-alpha.308](https://github.com/toa-io/toa/compare/v1.0.0-alpha.307...v1.0.0-alpha.308) (2026-09-15)
+
+**Note:** Version bump only for package @toa.io/norm
+
+
+
+
+
+# [1.0.0-alpha.307](https://github.com/toa-io/toa/compare/v1.0.0-alpha.306...v1.0.0-alpha.307) (2026-09-15)
+
+**Note:** Version bump only for package @toa.io/norm
+
+
+
+
+
+# [1.0.0-alpha.306](https://github.com/toa-io/toa/compare/v1.0.0-alpha.305...v1.0.0-alpha.306) (2026-09-14)
+
+**Note:** Version bump only for package @toa.io/norm
+
+
+
+
+
+# [1.0.0-alpha.305](https://github.com/toa-io/toa/compare/v1.0.0-alpha.304...v1.0.0-alpha.305) (2026-09-13)
+
+**Note:** Version bump only for package @toa.io/norm
+
+
+
+
+
+# [1.0.0-alpha.304](https://github.com/toa-io/toa/compare/v1.0.0-alpha.303...v1.0.0-alpha.304) (2026-09-13)
+
+**Note:** Version bump only for package @toa.io/norm
+
+
+
+
+
+# [1.0.0-alpha.303](https://github.com/toa-io/toa/compare/v1.0.0-alpha.302...v1.0.0-alpha.303) (2026-09-12)
+
+### Features
+
+* **operations:** a composition states how many replicas it runs ([4466f5a](https://github.com/toa-io/toa/commit/4466f5abcc22c6dceb2994a0143b6bf9d5201d9d))
+* **telemetry:** let a component declare its own metrics ([05aa3c7](https://github.com/toa-io/toa/commit/05aa3c72cd6a160e1cef99df6176a7f627075bc0))
+
+
+# [1.0.0-alpha.302](https://github.com/toa-io/toa/compare/v1.0.0-alpha.301...v1.0.0-alpha.302) (2026-09-11)
+
+**Note:** Version bump only for package @toa.io/norm
+
+
+
+
+
+# [1.0.0-alpha.301](https://github.com/toa-io/toa/compare/v1.0.0-alpha.300...v1.0.0-alpha.301) (2026-09-11)
+
+### Bug Fixes
+
+* **norm:** an operation that takes no input states none ([3b69b4c](https://github.com/toa-io/toa/commit/3b69b4c92b3f06361a3552f036a927f4ff32e58b))
+
+### Features
+
+* **norm:** an environment name may fall back along a colon-separated chain ([a267c1c](https://github.com/toa-io/toa/commit/a267c1caae816a75ada8352d5361b99817c72eb1))
+* **operations:** an evicted component is given its environment and configuration ([6cf7890](https://github.com/toa-io/toa/commit/6cf7890a632a2185d2b7d9790890a04187e5a897))
+
+
+# [1.0.0-alpha.300](https://github.com/toa-io/toa/compare/v1.0.0-alpha.299...v1.0.0-alpha.300) (2026-09-11)
+
+* feat(boot)!: a process is a thing, and an extension may keep something in one ([528d6cd](https://github.com/toa-io/toa/commit/528d6cdd307b45a6c30b6a184d7e06b3328cecf8))
+* feat(core)!: an operation may ask to run once ([dca616c](https://github.com/toa-io/toa/commit/dca616cb380a7a389e277875d3bd5ca55a6e4d45))
+
+### Features
+
+* **core:** a call may name the process it goes to, and wait for a set time ([7d8adb2](https://github.com/toa-io/toa/commit/7d8adb2772a95ff45ae5374efdedfb5a857fbbe9))
+* **core:** an assignment may ask to run once as well ([10fbcbd](https://github.com/toa-io/toa/commit/10fbcbd86a5e82960e65f62c09d0a465ae8d0353))
+* **norm:** a context says what it does not deploy ([135e6fd](https://github.com/toa-io/toa/commit/135e6fdfbc4270762028e9e5a0516766960ce59c))
+
+### BREAKING CHANGES
+
+* `Storage.store`, `.upsert` and `.ensure` take one more
+  argument, and `Storage` has two more members. A connector that ignores them
+  works exactly as it did; a component that asks it for `once` is refused at
+  boot. See migrations/299.md.
+* a composition booted directly has no readiness probe. Readiness is
+  the process's, and a composition is not a process. `stage.workload` boots one where a
+  suite needs it.
+
+
+# [1.0.0-alpha.299](https://github.com/toa-io/toa/compare/v1.0.0-alpha.298...v1.0.0-alpha.299) (2026-09-10)
+
+### Features
+
+* **convergence:** deployments of one context converge ([8a70343](https://github.com/toa-io/toa/commit/8a70343cf6953aab58d4a25bac215508ff8d9a37))
+* **convergence:** what an extension ships converges too ([b3be33d](https://github.com/toa-io/toa/commit/b3be33d2a1db45cfd844288467441aea2f4a722d))
+* **core:** a record carries the region that wrote it ([13ed187](https://github.com/toa-io/toa/commit/13ed187604f06dec66feec2e26ccf9dae30bb048))
+
+
+# [1.0.0-alpha.298](https://github.com/toa-io/toa/compare/v1.0.0-alpha.297...v1.0.0-alpha.298) (2026-09-08)
+
+**Note:** Version bump only for package @toa.io/norm
+
+
+
+
+
+# [1.0.0-alpha.297](https://github.com/toa-io/toa/compare/v1.0.0-alpha.296...v1.0.0-alpha.297) (2026-09-08)
+
+**Note:** Version bump only for package @toa.io/norm
+
+
+
+
+
+# [1.0.0-alpha.296](https://github.com/toa-io/toa/compare/v1.0.0-alpha.295...v1.0.0-alpha.296) (2026-09-08)
+
+**Note:** Version bump only for package @toa.io/norm
+
+
+
+
+
+# [1.0.0-alpha.295](https://github.com/toa-io/toa/compare/v1.0.0-alpha.294...v1.0.0-alpha.295) (2026-09-07)
+
+**Note:** Version bump only for package @toa.io/norm
+
+
+
+
+
+# [1.0.0-alpha.294](https://github.com/toa-io/toa/compare/v1.0.0-alpha.293...v1.0.0-alpha.294) (2026-09-07)
+
+**Note:** Version bump only for package @toa.io/norm
+
+
+
+
+
+# [1.0.0-alpha.293](https://github.com/toa-io/toa/compare/v1.0.0-alpha.292...v1.0.0-alpha.293) (2026-09-07)
+
+**Note:** Version bump only for package @toa.io/norm
+
+
+
+
+
+# [1.0.0-alpha.292](https://github.com/toa-io/toa/compare/v1.0.0-alpha.291...v1.0.0-alpha.292) (2026-09-07)
+
+### Features
+
+* **cli:** the deployment library is a peer, and the binary is the CLI's ([a923f81](https://github.com/toa-io/toa/commit/a923f8173a55ed1c091213a7c7db1863ca1d0ba6))
+* **definitions:** the version of Toa is the definitions package's ([3d0272e](https://github.com/toa-io/toa/commit/3d0272ea0ab862f4b6c2e58a2f003f92d0f8a87f))
+* **definitions:** what a package declares is read from one package ([7052341](https://github.com/toa-io/toa/commit/70523411b5d9e2b204c999aa02365173f3bb518d))
+* **norm:** a package's definition is read by one resolver ([bffd41c](https://github.com/toa-io/toa/commit/bffd41c8d18c42786b0bf321623088b9dabc4724))
+
+
+# [1.0.0-alpha.291](https://github.com/toa-io/toa/compare/v1.0.0-alpha.290...v1.0.0-alpha.291) (2026-09-07)
+
+**Note:** Version bump only for package @toa.io/norm
+
+
+
+
+
+# [1.0.0-alpha.289](https://github.com/toa-io/toa/compare/v1.0.0-alpha.288...v1.0.0-alpha.289) (2026-09-07)
+
+* A deploy moves only what changed, and a component sees none of the runtime's environment (#1073) ([f38e3db](https://github.com/toa-io/toa/commit/f38e3db533f24db866c57bfa1ef294eff1eaf499)), closes [#1073](https://github.com/toa-io/toa/issues/1073) [#1064](https://github.com/toa-io/toa/issues/1064) [#1066](https://github.com/toa-io/toa/issues/1066) [#1067](https://github.com/toa-io/toa/issues/1067) [#1068](https://github.com/toa-io/toa/issues/1068) [#1069](https://github.com/toa-io/toa/issues/1069) [#1071](https://github.com/toa-io/toa/issues/1071) [#1070](https://github.com/toa-io/toa/issues/1070) [#1072](https://github.com/toa-io/toa/issues/1072)
+
+### BREAKING CHANGES
+
+* a component that read `process.env.TOA_*` reads `context` instead;
+  `echo(input)` no longer substitutes from the environment; a bash operation sees no
+  `TOA_*`; images no longer set `USER node` — see migrations/289.md.
+
+
+# [1.0.0-alpha.288](https://github.com/toa-io/toa/compare/v1.0.0-alpha.287...v1.0.0-alpha.288) (2026-09-06)
+
+**Note:** Version bump only for package @toa.io/norm
+
+
+
+
+
+# [1.0.0-alpha.287](https://github.com/toa-io/toa/compare/v1.0.0-alpha.286...v1.0.0-alpha.287) (2026-09-06)
+
+**Note:** Version bump only for package @toa.io/norm

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@toa.io/norm",
-  "version": "1.0.0-alpha.33",
+  "version": "1.0.0-alpha.330",
+  "type": "module",
   "description": "Toa declarations normalization and validation",
   "author": "temich <tema.gurtovoy@gmail.com>",
   "homepage": "https://github.com/toa-io/toa#readme",
@@ -20,11 +21,12 @@
     "test": "echo \"Error: run tests from root\" && exit 1"
   },
   "dependencies": {
-    "@toa.io/core": "1.0.0-alpha.33",
-    "@toa.io/generic": "1.0.0-alpha.33",
-    "@toa.io/schema": "1.0.0-alpha.33",
-    "@toa.io/schemas": "1.0.0-alpha.33",
-    "@toa.io/yaml": "1.0.0-alpha.33"
+    "@toa.io/core": "1.0.0-alpha.330",
+    "@toa.io/definitions": "1.0.0-alpha.330",
+    "@toa.io/generic": "1.0.0-alpha.330",
+    "@toa.io/prototype": "1.0.0-alpha.327",
+    "@toa.io/schemas": "1.0.0-alpha.330",
+    "tinyglobby": "0.2.17"
   },
-  "gitHead": "ef81cea49d8f8b3b248adaba62d4548bbeb39f80"
+  "gitHead": "8d5b161d026b24ee1974005e1f418bc2b782fd3b"
 }

package/src/.component/.expand/bridge.js

@@ -1,9 +1,5 @@
-'use strict'
+import { resolve } from '../../shortcuts.js'
 
-const { resolve } = require('../../shortcuts')
-
-function bridge (manifest) {
+export function bridge(manifest) {
   manifest.bridge = resolve(manifest.bridge)
 }
-
-exports.bridge = bridge

package/src/.component/.expand/entity.js

@@ -1,14 +1,7 @@
-'use strict'
+import { resolve } from '../../shortcuts.js'
 
-const { expand } = require('@toa.io/schemas')
-
-const { resolve } = require('../../shortcuts')
-
-function entity (manifest) {
+export function entity(manifest) {
   if (!('entity' in manifest)) return
-  if ('schema' in manifest.entity) manifest.entity.schema = expand(manifest.entity.schema)
 
   manifest.entity.storage = resolve(manifest.entity.storage)
 }
-
-exports.entity = entity

package/src/.component/.expand/events.js

@@ -1,8 +1,6 @@
-'use strict'
+import { resolve } from '../../shortcuts.js'
 
-const { resolve } = require('../../shortcuts')
-
-function events (manifest) {
+export function events(manifest) {
   if (manifest.events === undefined) return
 
   for (const event of Object.values(manifest.events)) {
@@ -10,5 +8,3 @@ function events (manifest) {
     if (event.bridge !== undefined) event.bridge = resolve(event.bridge)
   }
 }
-
-exports.events = events

package/src/.component/.expand/extensions.js

@@ -1,20 +1,19 @@
-'use strict'
+import { recognize } from '../../shortcuts.js'
 
-const { recognize } = require('../../shortcuts')
-
-function extensions (manifest) {
+export function extensions(manifest) {
   recognize(SHORTCUTS, manifest, 'extensions')
   recognize(SHORTCUTS, manifest.extensions)
 }
 
 const SHORTCUTS = {
   exposition: '@toa.io/extensions.exposition',
-  realtime: '@toa.io/extensions.realtime',
-  origins: '@toa.io/extensions.origins',
+  realtime: '@toa.io/extensions.exposition#realtime',
   configuration: '@toa.io/extensions.configuration',
   state: '@toa.io/extensions.state',
   stash: '@toa.io/extensions.stash',
-  storages: '@toa.io/extensions.storages'
+  storages: '@toa.io/extensions.storages',
+  cadence: '@toa.io/extensions.cadence',
+  continuity: '@toa.io/extensions.continuity',
+  introspection: '@toa.io/extensions.introspection',
+  telemetry: '@toa.io/extensions.telemetry'
 }
-
-exports.extensions = extensions

package/src/.component/.expand/index.js

@@ -1,19 +1,7 @@
-'use strict'
-
-const { bridge } = require('./bridge')
-const { entity } = require('./entity')
-const { events } = require('./events')
-const { extensions } = require('./extensions')
-const { operations } = require('./operations')
-const { properties } = require('./properties')
-const { receivers } = require('./receivers')
-const { version } = require('./version')
-
-exports.bridge = bridge
-exports.entity = entity
-exports.events = events
-exports.extensions = extensions
-exports.operations = operations
-exports.properties = properties
-exports.receivers = receivers
-exports.version = version
+export { bridge } from './bridge.js'
+export { entity } from './entity.js'
+export { events } from './events.js'
+export { extensions } from './extensions.js'
+export { operations } from './operations.js'
+export { receivers } from './receivers.js'
+export { version } from './version.js'

package/src/.component/.expand/operations.js

@@ -1,14 +1,9 @@
-'use strict'
+import { resolve } from '../../shortcuts.js'
 
-const { expand } = require('@toa.io/schemas')
-const { resolve } = require('../../shortcuts')
-
-function operations (manifest) {
+export function operations(manifest) {
   if (manifest.operations === undefined) return
 
   for (const operation of Object.values(manifest.operations)) {
-    if (operation.input !== undefined) operation.input = expand(operation.input)
-    if (operation.output !== undefined) operation.output = expand(operation.output)
     if (operation.bridge !== undefined) operation.bridge = resolve(operation.bridge)
 
     if (operation.bindings !== undefined && operation.bindings !== null) {
@@ -16,5 +11,3 @@ function operations (manifest) {
     }
   }
 }
-
-exports.operations = operations

package/src/.component/.expand/receivers.js

@@ -1,16 +1,13 @@
-'use strict'
+import { resolve } from '../../shortcuts.js'
 
-const { resolve } = require('../../shortcuts')
-
-function receivers (manifest) {
+export function receivers(manifest) {
   if (manifest.receivers === undefined) return
 
   for (const [locator, receiver] of Object.entries(manifest.receivers)) {
-    if (typeof receiver === 'string') manifest.receivers[locator] = { operation: receiver }
+    if (typeof receiver === 'string')
+      manifest.receivers[locator] = { operation: receiver }
 
     if (receiver.binding !== undefined) receiver.binding = resolve(receiver.binding)
     if (receiver.bridge !== undefined) receiver.bridge = resolve(receiver.bridge)
   }
 }
-
-exports.receivers = receivers

package/src/.component/.expand/version.js

@@ -1,45 +1,89 @@
-'use strict'
+import { join } from 'node:path'
+import { createHash } from 'node:crypto'
+import fs from 'node:fs/promises'
+import { glob } from 'tinyglobby'
 
-const { join } = require('node:path')
-const { createHash } = require('node:crypto')
-const fs = require('node:fs/promises')
-const { createReadStream } = require('node:fs')
-const { once } = require('node:events')
+import { definition } from '../../definition.js'
 
-async function version (manifest) {
-  manifest.version ??= await hash(manifest.path)
+export async function version(manifest) {
+  manifest.version ??= await hash(manifest)
 }
 
-async function hash (path) {
-  const hash = await hashd(path)
+/**
+ * Identifies a build of a component: it becomes the tag of its image, so it must be the
+ * same for the same sources and different for different ones — on any machine, and whichever
+ * build produced them.
+ *
+ * What a build leaves out cannot change it: the bridge states what no build ships, a component
+ * adds to that with `ignore` and puts one back with `!`, and `files` names what its version is
+ * made of where a build copies only some of it. Its manifest is always one of them, because
+ * what it declares is what a caller is held to.
+ */
+async function hash(manifest) {
+  const files = (await list(manifest)).sort()
+  const digests = await Promise.all(
+    files.map((file) => digest(join(manifest.path, file)))
+  )
+  const total = createHash('sha256')
 
-  return hash.digest('hex').slice(0, 8)
+  // the path is part of it: moving a file changes the build even if no content did
+  for (let i = 0; i < files.length; i++) total.update(files[i]).update(digests[i])
+
+  return total.digest('hex').slice(0, 8)
 }
 
 /**
- * @param {string} path
- * @param {import('node:crypto').Hash} hash
+ * @param {toa.norm.Component} manifest
+ * @returns {Promise<string[]>} paths relative to the component
  */
-async function hashd (path, hash = createHash('sha256')) {
-  const stat = await fs.stat(path)
+async function list(manifest) {
+  const files = await glob(patterns(manifest.files), {
+    cwd: manifest.path,
+    dot: true,
+    onlyFiles: true,
+    expandDirectories: false,
+    // sources a component keeps outside its own directory are its own: what a link points to is
+    // hashed as the file it stands for, so changing it changes the version
+    followSymbolicLinks: true,
+    ignore: await ignore(manifest)
+  })
+
+  // what a component declares is what a caller is held to, so its manifest is always one of them
+  if (!files.includes(MANIFEST) && (await exists(join(manifest.path, MANIFEST))))
+    files.push(MANIFEST)
 
-  if (stat.isFile()) {
-    const stream = createReadStream(path)
+  return files
+}
 
-    stream.pipe(hash, { end: false })
+/** A path names what is under it, and a pattern is taken as it is. */
+function patterns(files = ['**']) {
+  return files.flatMap((file) => (file.includes('*') ? [file] : [file, file + '/**']))
+}
 
-    return await once(stream, 'end')
-  }
+async function ignore(manifest) {
+  const { module } = await definition(manifest.bridge)
+  const stated = manifest.ignore ?? []
+  const back = new Set(
+    stated.filter((pattern) => pattern[0] === '!').map((pattern) => pattern.slice(1))
+  )
 
-  if (stat.isDirectory()) {
-    const entries = await fs.opendir(path)
+  return [
+    ...(module.ignore ?? []).filter((pattern) => !back.has(pattern)),
+    ...stated.filter((pattern) => pattern[0] !== '!')
+  ]
+}
 
-    for await (const entry of entries) {
-      await hashd(join(path, entry.name), hash)
-    }
+async function exists(path) {
+  return await fs
+    .access(path)
+    .then(() => true)
+    .catch(() => false)
+}
 
-    return hash
-  }
+async function digest(path) {
+  return createHash('sha256')
+    .update(await fs.readFile(path))
+    .digest()
 }
 
-exports.version = version
+const MANIFEST = 'manifest.toa.yaml'