@telorun/analyzer 0.12.1 → 0.13.0

package/dist/kernel-globals.js

@@ -10,7 +10,7 @@ import { residualEntrySchemaMap } from "./residual-schema.js";
  * There is no `imports` namespace at runtime — import snapshots are stored
  * under `resources.<alias>`.
  */
-export const KERNEL_GLOBAL_NAMES = ["variables", "secrets", "resources", "env"];
+export const KERNEL_GLOBAL_NAMES = ["variables", "secrets", "resources", "ports", "env"];
 const SYSTEM_KINDS = new Set([
     "Telo.Definition",
     "Telo.Application",
@@ -55,10 +55,28 @@ export function buildKernelGlobalsSchema(manifests) {
                 properties: resourceProps,
                 additionalProperties: false,
             },
+            ports: buildPortsSchema(moduleManifest?.ports),
             env: { type: "object", additionalProperties: true },
         },
     };
 }
+/** Build the closed `ports` chain-access schema: each declared port is an
+ *  integer, so `ports.<name>` resolves and `ports.typo` (or member access past
+ *  a port, like `ports.http.foo`) is flagged. Falls back to an open map when
+ *  the module declares no ports. */
+function buildPortsSchema(ports) {
+    if (!ports || typeof ports !== "object" || Array.isArray(ports)) {
+        return { type: "object", additionalProperties: true };
+    }
+    const props = {};
+    for (const name of Object.keys(ports)) {
+        props[name] = { type: "integer" };
+    }
+    if (Object.keys(props).length === 0) {
+        return { type: "object", additionalProperties: true };
+    }
+    return { type: "object", properties: props, additionalProperties: false };
+}
 /** Wrap a JSON Schema property map (like `Telo.Application.variables`) into a
  *  closed object schema suitable for chain-access validation. For Application
  *  entries the per-entry shape carries kernel-specific keys (`env`, `default`)

package/dist/manifest-visitor.d.ts

@@ -0,0 +1,109 @@
+import type { ResourceDefinition, ResourceManifest } from "@telorun/sdk";
+import type { AliasResolver } from "./alias-resolver.js";
+import type { DefinitionRegistry } from "./definition-registry.js";
+import { type RefFieldEntry, type SchemaFromFieldEntry } from "./reference-field-map.js";
+/**
+ * One descent surface over a manifest's resources, emitting the annotation
+ * sites every analyzer pass needs. It replaces the iteration scaffolding that
+ * `validate-references`, `dependency-graph`, and the analyzer's CEL walk each
+ * reimplemented (field-map fetch, scope collection, ref/schema-from iteration,
+ * CEL expression walk + context matching).
+ *
+ * Two discovery mechanics ride one per-resource pass:
+ *
+ * - **Path-driven** — ref / scope / schema-from sites come from the resource's
+ *   per-kind field map (`RefSite`, `ScopeBoundary`, `SchemaFromSite`). This is
+ *   map iteration resolved against the resource value, not a node-by-node tree
+ *   descent; the field map already unifies all three annotation types.
+ * - **Value-tree-driven** — compiled `${{...}}` / `!cel` nodes are found by
+ *   scanning the resource value tree (`CelSite`). CEL can sit in any string
+ *   field, including ones the field map never lists, so its discovery is
+ *   fundamentally not path-driven; the field map only supplies the matched
+ *   `x-telo-context` schema at the enclosing path.
+ *
+ * Handlers are optional (Babel-style): the walker computes and emits only what
+ * the visitor subscribes to, and skips the work behind absent handlers.
+ *
+ * **Scope is per-resource.** `ScopeBoundary` is emitted once per resource at
+ * enter time, before that resource's `RefSite`s, carrying both the source
+ * enclosure prefixes (for refs written *inside* a scope) and the enclosed
+ * resource-name set (for consumers that drop edges to scoped targets). No
+ * cross-resource ordering or global enclosed-name union is implied — every
+ * consumer's scope decision is local to the resource being visited, matching
+ * the semantics each pass had before this walker existed.
+ */
+export interface ResourceEnterEvent {
+    source: ResourceManifest;
+    /** Resolved definition for the resource's kind, or undefined when unknown. */
+    definition?: ResourceDefinition;
+}
+export interface ResourceExitEvent {
+    source: ResourceManifest;
+}
+export interface ScopeBoundaryEvent {
+    source: ResourceManifest;
+    /** Dot-form prefixes of every `x-telo-scope` field on this resource. */
+    scopePrefixes: string[];
+    /** Scope-field JSON Pointer → manifests declared within that scope. */
+    manifestsByPointer: Map<string, ResourceManifest[]>;
+    /** Names of every resource declared inside this resource's scopes. Used by
+     *  the dependency graph to drop boot edges to scoped (on-demand) targets. */
+    enclosedNames: Set<string>;
+}
+export interface RefSiteEvent {
+    source: ResourceManifest;
+    /** Field-map path with `[]` / `{}` markers (e.g. `steps[].invoke`). */
+    fieldPath: string;
+    /** Concrete path with `[N]` / map keys, matching `buildPositionIndex` keys. */
+    concretePath: string;
+    /** The ref value at this concrete site (sentinel, string, or `{kind,name}`). */
+    value: unknown;
+    /** The ref constraint (`refs[]`, `isArray`, optional `context`). */
+    entry: RefFieldEntry;
+    /** True when `fieldPath` falls within one of this resource's scope prefixes —
+     *  source enclosure, used to scope a ref's candidate set. */
+    inScope: boolean;
+    /** Scope manifests visible to this ref path (non-empty only when `inScope`). */
+    visibleScopeManifests: ResourceManifest[];
+}
+export interface SchemaFromSiteEvent {
+    source: ResourceManifest;
+    /** Field-map path of the `x-telo-schema-from` slot. */
+    fieldPath: string;
+    entry: SchemaFromFieldEntry;
+}
+export interface CelSiteEvent {
+    source: ResourceManifest;
+    /** Concrete dotted path of the expression (from `walkCelExpressions`). */
+    path: string;
+    /** The CEL source expression. */
+    expr: string;
+    /** Engine that owns the expression (`cel`, `literal`, …). */
+    engineName: string;
+    /** Raw `x-telo-context` schema matched at the enclosing path, if any. The
+     *  consumer resolves `x-telo-context-*` annotations and merges its own
+     *  globals — the walker only does the path → context match. */
+    contextSchema?: Record<string, any>;
+    /** Scope of the matched context (e.g. `$.routes[*].handler`), if matched. */
+    matchedScope?: string;
+}
+export interface ManifestVisitor {
+    onResourceEnter?(e: ResourceEnterEvent): void;
+    onScope?(e: ScopeBoundaryEvent): void;
+    onRef?(e: RefSiteEvent): void;
+    onSchemaFrom?(e: SchemaFromSiteEvent): void;
+    onCel?(e: CelSiteEvent): void;
+    onResourceExit?(e: ResourceExitEvent): void;
+}
+export interface VisitOptions {
+    aliases?: AliasResolver;
+    aliasesByModule?: Map<string, AliasResolver>;
+    /** Resource kinds to skip entirely (kind blueprints, import metadata, …). */
+    skipKinds?: ReadonlySet<string>;
+    /** When true, ref / scope sites come from the schema-from-expanded field map
+     *  so refs nested behind `x-telo-schema-from` are surfaced. `SchemaFromSite`
+     *  events are always emitted from the base map regardless of this flag. */
+    expand?: boolean;
+}
+export declare function visitManifest(resources: ResourceManifest[], registry: DefinitionRegistry, visitor: ManifestVisitor, options?: VisitOptions): void;
+//# sourceMappingURL=manifest-visitor.d.ts.map

package/dist/manifest-visitor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-visitor.d.ts","sourceRoot":"","sources":["../src/manifest-visitor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAML,KAAK,aAAa,EAClB,KAAK,oBAAoB,EAC1B,MAAM,0BAA0B,CAAC;AAGlC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,gBAAgB,CAAC;IACzB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,kBAAkB,CAAC;CACjC;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,gBAAgB,CAAC;IACzB,wEAAwE;IACxE,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,uEAAuE;IACvE,kBAAkB,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACpD;iFAC6E;IAC7E,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC5B;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,gBAAgB,CAAC;IACzB,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,KAAK,EAAE,OAAO,CAAC;IACf,oEAAoE;IACpE,KAAK,EAAE,aAAa,CAAC;IACrB;iEAC6D;IAC7D,OAAO,EAAE,OAAO,CAAC;IACjB,gFAAgF;IAChF,qBAAqB,EAAE,gBAAgB,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,gBAAgB,CAAC;IACzB,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,oBAAoB,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,gBAAgB,CAAC;IACzB,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAC;IACnB;;mEAE+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACpC,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,CAAC,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC9C,OAAO,CAAC,CAAC,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACtC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC9B,YAAY,CAAC,CAAC,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAC5C,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC9B,cAAc,CAAC,CAAC,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;CAC7C;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC7C,6EAA6E;IAC7E,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAChC;;+EAE2E;IAC3E,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAUD,wBAAgB,aAAa,CAC3B,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,eAAe,EACxB,OAAO,GAAE,YAAiB,GACzB,IAAI,CA8GN"}

package/dist/manifest-visitor.js

@@ -0,0 +1,110 @@
+import { walkCelExpressions } from "@telorun/templating";
+import { isRefEntry, isSchemaFromEntry, isScopeEntry, resolveFieldEntries, resolveFieldValues, } from "./reference-field-map.js";
+import { extractContextsFromSchema, pathMatchesScope } from "./validate-cel-context.js";
+const scopePrefixOf = (pointer) => pointer.replace(/^\//, "").replace(/\//g, ".");
+const pathUnderPrefix = (fieldPath, prefix) => fieldPath === prefix ||
+    fieldPath.startsWith(prefix + ".") ||
+    fieldPath.startsWith(prefix + "[");
+export function visitManifest(resources, registry, visitor, options = {}) {
+    const { aliases, aliasesByModule, skipKinds, expand } = options;
+    const wantsRefs = !!visitor.onRef;
+    const wantsScope = !!visitor.onScope;
+    const wantsSchemaFrom = !!visitor.onSchemaFrom;
+    const wantsCel = !!visitor.onCel;
+    for (const r of resources) {
+        if (!r.metadata?.name || !r.kind)
+            continue;
+        if (skipKinds?.has(r.kind))
+            continue;
+        const resolvedKind = aliases?.resolveKind(r.kind);
+        const definition = registry.resolve(r.kind) ??
+            (resolvedKind ? registry.resolve(resolvedKind) : undefined);
+        visitor.onResourceEnter?.({ source: r, definition });
+        if (wantsRefs || wantsScope || wantsSchemaFrom) {
+            const baseMap = aliases
+                ? registry.getFieldMapForKind(r.kind, aliases)
+                : registry.getFieldMap(r.kind);
+            // Expanded map drives ref/scope sites when requested; schema-from sites
+            // come from the base map (expansion replaces them with nested refs).
+            const refScopeMap = expand && aliases && aliasesByModule
+                ? registry.expandedFieldMapForResource(r, aliases, aliasesByModule)
+                : baseMap;
+            if (refScopeMap && (wantsRefs || wantsScope)) {
+                const manifestsByPointer = new Map();
+                for (const [fieldPath, entry] of refScopeMap) {
+                    if (!isScopeEntry(entry))
+                        continue;
+                    const raw = resolveFieldValues(r, fieldPath)
+                        .flatMap((v) => (Array.isArray(v) ? v : [v]))
+                        .filter((v) => !!v && typeof v === "object");
+                    const pointers = Array.isArray(entry.scope) ? entry.scope : [entry.scope];
+                    for (const pointer of pointers)
+                        manifestsByPointer.set(pointer, raw);
+                }
+                const scopePrefixes = Array.from(manifestsByPointer.keys()).map(scopePrefixOf);
+                if (wantsScope) {
+                    const enclosedNames = new Set();
+                    for (const manifests of manifestsByPointer.values()) {
+                        for (const m of manifests) {
+                            const name = m.metadata?.name;
+                            if (typeof name === "string")
+                                enclosedNames.add(name);
+                        }
+                    }
+                    visitor.onScope({ source: r, scopePrefixes, manifestsByPointer, enclosedNames });
+                }
+                if (wantsRefs) {
+                    for (const [fieldPath, entry] of refScopeMap) {
+                        if (!isRefEntry(entry))
+                            continue;
+                        const inScope = scopePrefixes.some((prefix) => pathUnderPrefix(fieldPath, prefix));
+                        const visibleScopeManifests = [];
+                        if (inScope) {
+                            for (const [pointer, manifests] of manifestsByPointer) {
+                                if (pathUnderPrefix(fieldPath, scopePrefixOf(pointer))) {
+                                    visibleScopeManifests.push(...manifests);
+                                }
+                            }
+                        }
+                        for (const { value, path: concretePath } of resolveFieldEntries(r, fieldPath)) {
+                            if (!value)
+                                continue;
+                            visitor.onRef({
+                                source: r,
+                                fieldPath,
+                                concretePath,
+                                value,
+                                entry,
+                                inScope,
+                                visibleScopeManifests,
+                            });
+                        }
+                    }
+                }
+            }
+            if (wantsSchemaFrom && baseMap) {
+                for (const [fieldPath, entry] of baseMap) {
+                    if (!isSchemaFromEntry(entry))
+                        continue;
+                    visitor.onSchemaFrom({ source: r, fieldPath, entry });
+                }
+            }
+        }
+        if (wantsCel) {
+            const contexts = definition?.schema ? extractContextsFromSchema(definition.schema) : [];
+            walkCelExpressions(r, "", (expr, path, engineName) => {
+                let contextSchema;
+                let matchedScope;
+                for (const ctx of contexts) {
+                    if (pathMatchesScope(path, ctx.scope)) {
+                        contextSchema = ctx.schema;
+                        matchedScope = ctx.scope;
+                        break;
+                    }
+                }
+                visitor.onCel({ source: r, path, expr, engineName, contextSchema, matchedScope });
+            });
+        }
+        visitor.onResourceExit?.({ source: r });
+    }
+}

package/dist/schema-compat.d.ts

@@ -35,6 +35,16 @@ export declare function navigateJsonPointer(schema: unknown, pointer: string): u
  *  Stops and returns the current node when a union type (`anyOf`/`oneOf`) is reached.
  *  Returns `undefined` if any segment cannot be resolved. */
 export declare function navigateSchemaToExprPath(schema: Record<string, any>, path: string): Record<string, any> | undefined;
+/**
+ * Recognized `x-telo-type` value brands and the CEL primitive each refines.
+ * A brand is a nominal type the analyzer registers (see cel-environment.ts) so
+ * structurally-identical values (a `TcpPort` and a `UdpPort` are both integers)
+ * stay distinct for static wiring checks. Brands carry no runtime effect — the
+ * value flows as its base type. Add new brands here (e.g. `Url: "string"`).
+ */
+export declare const VALUE_BRAND_BASE: Record<string, string>;
+/** Read a recognized `x-telo-type` brand off a schema, or undefined. */
+export declare function brandOfSchema(schema: Record<string, any> | undefined): string | undefined;
 /** Map a JSON Schema type annotation to a CEL type string. */
 export declare function jsonSchemaToCelType(schema: Record<string, any> | undefined): string;
 /** Check whether a CEL return type is compatible with a JSON Schema type constraint. */

package/dist/schema-compat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-compat.d.ts","sourceRoot":"","sources":["../src/schema-compat.ts"],"names":[],"mappings":"AAIA,QAAA,MAAM,GAAG,KAA0C,CAAC;AAEpD;;;;;;;mCAOmC;AACnC,wBAAgB,SAAS,IAAI,YAAY,CAAC,OAAO,GAAG,CAAC,CAOpD;AAKD,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;oEAEoE;AACpE,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC1B,mBAAmB,CAIrB;AAiDD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAelD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAGxE;AAuBD,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;CACd;AAED,0GAA0G;AAC1G,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,WAAW,EAAE,CAmB/F;AAED;qFACqF;AACrF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAQ7E;AAED;;;;6DAI6D;AAC7D,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,EAAE,MAAM,GACX,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAsBjC;AAED,8DAA8D;AAC9D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,CAuBnF;AAED,wFAAwF;AACxF,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAqBhG;AAED,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAiB5E;AAID,0EAA0E;AAC1E,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAOtG;AAED,gGAAgG;AAChG,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAUlF;AAED;iGACiG;AACjG,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC/B,OAAO,CAqCT"}
+{"version":3,"file":"schema-compat.d.ts","sourceRoot":"","sources":["../src/schema-compat.ts"],"names":[],"mappings":"AAIA,QAAA,MAAM,GAAG,KAA0C,CAAC;AAEpD;;;;;;;mCAOmC;AACnC,wBAAgB,SAAS,IAAI,YAAY,CAAC,OAAO,GAAG,CAAC,CAOpD;AAKD,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;oEAEoE;AACpE,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC1B,mBAAmB,CAIrB;AAiDD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAelD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAGxE;AAuBD,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;CACd;AAED,0GAA0G;AAC1G,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,WAAW,EAAE,CAmB/F;AAED;qFACqF;AACrF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAQ7E;AAED;;;;6DAI6D;AAC7D,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,EAAE,MAAM,GACX,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAsBjC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGnD,CAAC;AAEF,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAGzF;AAED,8DAA8D;AAC9D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,CAyBnF;AAED,wFAAwF;AACxF,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAiChG;AAED,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAiB5E;AAID,0EAA0E;AAC1E,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAOtG;AAED,gGAAgG;AAChG,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAUlF;AAED;iGACiG;AACjG,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC/B,OAAO,CAqCT"}

package/dist/schema-compat.js

@@ -172,10 +172,29 @@ export function navigateSchemaToExprPath(schema, path) {
     }
     return current;
 }
+/**
+ * Recognized `x-telo-type` value brands and the CEL primitive each refines.
+ * A brand is a nominal type the analyzer registers (see cel-environment.ts) so
+ * structurally-identical values (a `TcpPort` and a `UdpPort` are both integers)
+ * stay distinct for static wiring checks. Brands carry no runtime effect — the
+ * value flows as its base type. Add new brands here (e.g. `Url: "string"`).
+ */
+export const VALUE_BRAND_BASE = {
+    TcpPort: "int",
+    UdpPort: "int",
+};
+/** Read a recognized `x-telo-type` brand off a schema, or undefined. */
+export function brandOfSchema(schema) {
+    const brand = schema?.["x-telo-type"];
+    return typeof brand === "string" && brand in VALUE_BRAND_BASE ? brand : undefined;
+}
 /** Map a JSON Schema type annotation to a CEL type string. */
 export function jsonSchemaToCelType(schema) {
     if (!schema || typeof schema !== "object")
         return "dyn";
+    const brand = brandOfSchema(schema);
+    if (brand)
+        return brand;
     if (schema.anyOf || schema.oneOf || schema.allOf)
         return "dyn";
     if (Array.isArray(schema.type))
@@ -206,6 +225,19 @@ export function jsonSchemaToCelType(schema) {
 export function celTypeSatisfiesJsonSchema(celType, schema) {
     if (celType === "dyn")
         return true;
+    // Nominal value brands: when the expression's type is a recognized brand,
+    // a branded consuming field must match exactly (a UdpPort wired into a
+    // TcpPort-branded field is the error we want). An unbranded field accepts
+    // the brand as its base type — gradual typing, so a TcpPort flows freely
+    // into a plain integer field. (A plain integer into a branded field is also
+    // allowed: only a *conflicting* brand is rejected.)
+    const sourceBase = VALUE_BRAND_BASE[celType];
+    if (sourceBase) {
+        const fieldBrand = brandOfSchema(schema);
+        if (fieldBrand)
+            return fieldBrand === celType;
+        celType = sourceBase;
+    }
     if (!schema.type && !schema.anyOf && !schema.oneOf && !schema.allOf)
         return true;
     if (schema.anyOf || schema.oneOf || schema.allOf)

package/dist/validate-cel-context.d.ts

@@ -83,4 +83,18 @@ export declare function resolveContextAnnotations(schema: Record<string, any>, m
  * e.g. exprPath="routes[0].inputs.q", scope="$.routes[*].inputs" → manifest.routes[0]
  */
 export declare function getManifestItem(exprPath: string, scope: string, manifest: Record<string, any>): Record<string, any>;
+/**
+ * Walk a JSON Schema tree and collect all `x-telo-context` annotations,
+ * returning them as `{ scope, schema }` pairs using JSONPath-style scopes —
+ * the same format the analyzer uses for CEL context validation.
+ *
+ * Result is sorted by scope specificity (longer scope first) so that the
+ * per-expression resolver's first-match-wins logic picks the most-specific
+ * context. Without this, a broader ancestor scope (e.g. `$.resources[*]`)
+ * could shadow a narrower descendant scope whose activation differs.
+ */
+export declare function extractContextsFromSchema(schema: Record<string, any>, path?: string): Array<{
+    scope: string;
+    schema: Record<string, any>;
+}>;
 //# sourceMappingURL=validate-cel-context.d.ts.map

package/dist/validate-cel-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAEtF,MAAM,WAAW,kBAAkB;IACjC;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC;;kDAE8C;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;KACxD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CA6BjC;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAChD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAqGrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB"}
+{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAEtF,MAAM,WAAW,kBAAkB;IACjC;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC;;kDAE8C;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;KACxD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CA6BjC;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAChD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAqGrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB;AAWD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,SAAM,GACT,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAC,CAGvD"}

package/dist/validate-cel-context.js

@@ -219,3 +219,41 @@ function navigatePath(obj, segments) {
     }
     return cur;
 }
+/**
+ * Walk a JSON Schema tree and collect all `x-telo-context` annotations,
+ * returning them as `{ scope, schema }` pairs using JSONPath-style scopes —
+ * the same format the analyzer uses for CEL context validation.
+ *
+ * Result is sorted by scope specificity (longer scope first) so that the
+ * per-expression resolver's first-match-wins logic picks the most-specific
+ * context. Without this, a broader ancestor scope (e.g. `$.resources[*]`)
+ * could shadow a narrower descendant scope whose activation differs.
+ */
+export function extractContextsFromSchema(schema, path = "$") {
+    const all = collectContexts(schema, path);
+    return all.sort((a, b) => b.scope.length - a.scope.length);
+}
+function collectContexts(schema, path) {
+    if (!schema || typeof schema !== "object")
+        return [];
+    const results = [];
+    if (schema["x-telo-context"]) {
+        results.push({ scope: path, schema: schema["x-telo-context"] });
+    }
+    if (schema.properties) {
+        for (const [key, value] of Object.entries(schema.properties)) {
+            results.push(...collectContexts(value, `${path}.${key}`));
+        }
+    }
+    if (schema.items && typeof schema.items === "object") {
+        results.push(...collectContexts(schema.items, `${path}[*]`));
+    }
+    for (const key of ["oneOf", "anyOf", "allOf"]) {
+        if (Array.isArray(schema[key])) {
+            for (const subschema of schema[key]) {
+                results.push(...collectContexts(subschema, path));
+            }
+        }
+    }
+    return results;
+}

package/dist/validate-references.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-references.d.ts","sourceRoot":"","sources":["../src/validate-references.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA4C/F;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,GACvB,kBAAkB,EAAE,CAsbtB"}
+{"version":3,"file":"validate-references.d.ts","sourceRoot":"","sources":["../src/validate-references.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAMrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA4C/F;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,GACvB,kBAAkB,EAAE,CA0YtB"}