@telorun/analyzer 0.13.0 → 0.14.0

package/dist/manifest-visitor.js

@@ -1,16 +1,59 @@
-import { walkCelExpressions } from "@telorun/templating";
+import { isRefSentinel, isTaggedSentinel, walkCelExpressions } from "@telorun/templating";
 import { isRefEntry, isSchemaFromEntry, isScopeEntry, resolveFieldEntries, resolveFieldValues, } from "./reference-field-map.js";
 import { extractContextsFromSchema, pathMatchesScope } from "./validate-cel-context.js";
+/** Synthetic entry for a value-tree-discovered ref — these carry no declared
+ *  x-telo-ref constraint. */
+const NESTED_REF_ENTRY = { refs: [], isArray: false };
+/** Scans a value tree for ref-shaped values, emitting each with its concrete
+ *  path. Recognizes `!ref <name>` sentinels and named `{kind, name}` reference
+ *  objects. Other tagged sentinels (`!cel`, `!literal`) and precompiled nodes
+ *  are leaves. Path format matches `resolveFieldEntries` / `walkCelExpressions`
+ *  (`a.b[0].c`).
+ *
+ *  Stops at every `{kind, …}` resource boundary: a named ref is emitted, an
+ *  inline resource (`{kind}` with no name) is left alone, and **neither is
+ *  descended into**. A nested resource's own refs belong to its inner topology,
+ *  not the enclosing node — e.g. an inline `Sql.Exec` step's `connection` is the
+ *  Exec's dependency, not the surrounding `Run.Sequence`'s. The scan is started
+ *  per top-level field (not on the resource object) so the resource's own
+ *  `kind` doesn't trip this boundary. */
+function walkRefValues(value, path, cb) {
+    if (isRefSentinel(value)) {
+        cb(value, path);
+        return;
+    }
+    if (isTaggedSentinel(value))
+        return;
+    if (Array.isArray(value)) {
+        value.forEach((v, i) => walkRefValues(v, `${path}[${i}]`, cb));
+        return;
+    }
+    if (value === null || typeof value !== "object")
+        return;
+    if (value.__compiled)
+        return;
+    const obj = value;
+    if (typeof obj.kind === "string") {
+        // Resource boundary — emit if it's a named ref, then stop descending.
+        if (typeof obj.name === "string")
+            cb(value, path);
+        return;
+    }
+    for (const [k, v] of Object.entries(obj)) {
+        walkRefValues(v, path ? `${path}.${k}` : k, cb);
+    }
+}
 const scopePrefixOf = (pointer) => pointer.replace(/^\//, "").replace(/\//g, ".");
 const pathUnderPrefix = (fieldPath, prefix) => fieldPath === prefix ||
     fieldPath.startsWith(prefix + ".") ||
     fieldPath.startsWith(prefix + "[");
 export function visitManifest(resources, registry, visitor, options = {}) {
-    const { aliases, aliasesByModule, skipKinds, expand } = options;
+    const { aliases, aliasesByModule, skipKinds, expand, discoverNestedRefs } = options;
     const wantsRefs = !!visitor.onRef;
     const wantsScope = !!visitor.onScope;
     const wantsSchemaFrom = !!visitor.onSchemaFrom;
     const wantsCel = !!visitor.onCel;
+    const wantsNested = wantsRefs && !!discoverNestedRefs;
     for (const r of resources) {
         if (!r.metadata?.name || !r.kind)
             continue;
@@ -20,6 +63,9 @@ export function visitManifest(resources, registry, visitor, options = {}) {
         const definition = registry.resolve(r.kind) ??
             (resolvedKind ? registry.resolve(resolvedKind) : undefined);
         visitor.onResourceEnter?.({ source: r, definition });
+        // Concrete paths emitted from the field map — so the value-tree scan below
+        // doesn't re-emit a ref the field map already covered.
+        const emittedRefPaths = wantsNested ? new Set() : null;
         if (wantsRefs || wantsScope || wantsSchemaFrom) {
             const baseMap = aliases
                 ? registry.getFieldMapForKind(r.kind, aliases)
@@ -69,6 +115,7 @@ export function visitManifest(resources, registry, visitor, options = {}) {
                         for (const { value, path: concretePath } of resolveFieldEntries(r, fieldPath)) {
                             if (!value)
                                 continue;
+                            emittedRefPaths?.add(concretePath);
                             visitor.onRef({
                                 source: r,
                                 fieldPath,
@@ -90,6 +137,30 @@ export function visitManifest(resources, registry, visitor, options = {}) {
                 }
             }
         }
+        // Value-tree-driven nested ref discovery — refs the field map can't reach
+        // because they sit behind a `$ref` it doesn't descend (e.g. Run.Sequence
+        // step `invoke`s). Deduped against the field-map sites by concrete path.
+        // Scanned per top-level field so the resource's own `kind` isn't treated as
+        // a resource boundary by `walkRefValues`.
+        if (wantsNested) {
+            const emitNested = (value, path) => {
+                if (emittedRefPaths.has(path))
+                    return;
+                visitor.onRef({
+                    source: r,
+                    fieldPath: path,
+                    concretePath: path,
+                    value,
+                    entry: NESTED_REF_ENTRY,
+                    inScope: false,
+                    visibleScopeManifests: [],
+                    nested: true,
+                });
+            };
+            for (const [key, value] of Object.entries(r)) {
+                walkRefValues(value, key, emitNested);
+            }
+        }
         if (wantsCel) {
             const contexts = definition?.schema ? extractContextsFromSchema(definition.schema) : [];
             walkCelExpressions(r, "", (expr, path, engineName) => {

package/dist/reference-field-map.js

@@ -157,6 +157,22 @@ function traverseNode(node, path, map, root, visitedRefs = new Set()) {
         if (node["x-telo-context"])
             entry.context = node["x-telo-context"];
         map.set(path, entry);
+        // A node can mix item-level ref branches (a bare string / `{kind, name}`)
+        // with object branches that carry their OWN nested refs — e.g. Application
+        // `targets`: a bare ref vs inline `{ invoke }` vs gated `{ ref }`. Descend
+        // into the variant objects so those nested slots register too (and their
+        // `!ref` sentinels resolve). Pure x-telo-ref branches have no properties
+        // and contribute nothing here.
+        for (const variantKey of ["oneOf", "anyOf", "allOf"]) {
+            const variants = node[variantKey];
+            if (!Array.isArray(variants))
+                continue;
+            for (const variant of variants) {
+                if (!variant || typeof variant !== "object")
+                    continue;
+                traverseVariant(variant, path, map, root, visitedRefs);
+            }
+        }
         return;
     }
     // Array — recurse into items

package/dist/resolve-ref-sentinels.d.ts

@@ -3,25 +3,23 @@ import type { AliasResolver } from "./alias-resolver.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
 /**
  * Walks every `x-telo-ref` slot in every non-system resource and rewrites
- * `!ref <name>` sentinels in-place to `{kind: <resolved-kind>, name}`.
+ * `!ref <name>` sentinels in-place to `{kind, name}` (local) or
+ * `{kind, name, alias}` (cross-module).
  *
- * The downstream pipeline (inline normalization, dependency graph, kernel
- * controllers) expects every ref-slot value to be either a `{kind, name}`
- * object, an inline-definition object, or a legacy bare string — resolving
- * sentinels here keeps that contract intact so each consumer doesn't need
- * its own sentinel branch.
+ * Reference grammar — the tag's source string is split on the FIRST dot:
+ *   - `!ref writeLine`          → local resource `writeLine`
+ *   - `!ref Self.writeLine`     → local resource `writeLine` (explicit self-qualifier)
+ *   - `!ref Console.writeLine`  → instance `writeLine` exported by the import aliased
+ *                                 `Console`, resolved against the forwarded foreign set
  *
- * The walker assigns `kind` by name lookup (resource names are unique
- * within a manifest scope). When the name doesn't resolve in the local
- * `byName` map, the sentinel is left in place so `validateReferences`
- * can emit the `UNRESOLVED_REFERENCE` diagnostic with full context.
+ * Aliases are PascalCase identifiers without dots and resource names carry no dots
+ * (enforced as a hard diagnostic), so the first-dot split is unambiguous. When the
+ * name doesn't resolve, the sentinel is left in place so `validateReferences` emits the
+ * `UNRESOLVED_REFERENCE` diagnostic with full context.
  *
- * Mutation strategy: the field-path walker descends the resource tree
- * directly and replaces the sentinel on its parent container. Re-parsing
- * a string-encoded concrete path (the earlier shape) coupled the writer
- * to the path-encoding rules of `resolveFieldEntries` — any new path
- * marker would silently break this writer. Descending directly avoids
- * that coupling.
+ * Forwarded foreign resources (an imported library's exported instances, carrying a
+ * `metadata.module` that isn't a root module) are resolution TARGETS only — they are not
+ * re-walked as sources here, since their own ref slots belong to their own module scope.
  */
-export declare function resolveRefSentinels(resources: ResourceManifest[], registry: DefinitionRegistry, aliases?: AliasResolver, aliasesByModule?: Map<string, AliasResolver>): void;
+export declare function resolveRefSentinels(resources: ResourceManifest[], registry: DefinitionRegistry, aliases?: AliasResolver, aliasesByModule?: Map<string, AliasResolver>, crossModuleTargets?: ResourceManifest[]): void;
 //# sourceMappingURL=resolve-ref-sentinels.d.ts.map

package/dist/resolve-ref-sentinels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-ref-sentinels.d.ts","sourceRoot":"","sources":["../src/resolve-ref-sentinels.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAInE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE,aAAa,EACvB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC3C,IAAI,CAsBN"}
+{"version":3,"file":"resolve-ref-sentinels.d.ts","sourceRoot":"","sources":["../src/resolve-ref-sentinels.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AASnE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE,aAAa,EACvB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAK5C,kBAAkB,GAAE,gBAAgB,EAAO,GAC1C,IAAI,CA8EN"}

package/dist/resolve-ref-sentinels.js

@@ -1,38 +1,99 @@
 import { isRefSentinel } from "@telorun/templating";
+import { isModuleKind } from "./module-kinds.js";
 import { isRefEntry } from "./reference-field-map.js";
 import { REF_RESOLUTION_SKIP_KINDS as SYSTEM_KINDS } from "./system-kinds.js";
 /**
  * Walks every `x-telo-ref` slot in every non-system resource and rewrites
- * `!ref <name>` sentinels in-place to `{kind: <resolved-kind>, name}`.
+ * `!ref <name>` sentinels in-place to `{kind, name}` (local) or
+ * `{kind, name, alias}` (cross-module).
  *
- * The downstream pipeline (inline normalization, dependency graph, kernel
- * controllers) expects every ref-slot value to be either a `{kind, name}`
- * object, an inline-definition object, or a legacy bare string — resolving
- * sentinels here keeps that contract intact so each consumer doesn't need
- * its own sentinel branch.
+ * Reference grammar — the tag's source string is split on the FIRST dot:
+ *   - `!ref writeLine`          → local resource `writeLine`
+ *   - `!ref Self.writeLine`     → local resource `writeLine` (explicit self-qualifier)
+ *   - `!ref Console.writeLine`  → instance `writeLine` exported by the import aliased
+ *                                 `Console`, resolved against the forwarded foreign set
  *
- * The walker assigns `kind` by name lookup (resource names are unique
- * within a manifest scope). When the name doesn't resolve in the local
- * `byName` map, the sentinel is left in place so `validateReferences`
- * can emit the `UNRESOLVED_REFERENCE` diagnostic with full context.
+ * Aliases are PascalCase identifiers without dots and resource names carry no dots
+ * (enforced as a hard diagnostic), so the first-dot split is unambiguous. When the
+ * name doesn't resolve, the sentinel is left in place so `validateReferences` emits the
+ * `UNRESOLVED_REFERENCE` diagnostic with full context.
  *
- * Mutation strategy: the field-path walker descends the resource tree
- * directly and replaces the sentinel on its parent container. Re-parsing
- * a string-encoded concrete path (the earlier shape) coupled the writer
- * to the path-encoding rules of `resolveFieldEntries` — any new path
- * marker would silently break this writer. Descending directly avoids
- * that coupling.
+ * Forwarded foreign resources (an imported library's exported instances, carrying a
+ * `metadata.module` that isn't a root module) are resolution TARGETS only — they are not
+ * re-walked as sources here, since their own ref slots belong to their own module scope.
  */
-export function resolveRefSentinels(resources, registry, aliases, aliasesByModule) {
+export function resolveRefSentinels(resources, registry, aliases, aliasesByModule, 
+// Extra foreign resources used only as cross-module resolution TARGETS (not mutated, not
+// walked as sources). The kernel passes the analyzer-flattened set here so the runtime
+// pass — which loads the entry module only — can still resolve `!ref Alias.name` against
+// imported libraries' exported instances.
+crossModuleTargets = []) {
+    const rootModules = new Set();
+    for (const r of resources) {
+        if (isModuleKind(r.kind) && typeof r.metadata?.name === "string") {
+            rootModules.add(r.metadata.name);
+        }
+    }
+    const moduleOf = (r) => r.metadata?.module;
+    const isForeign = (r) => {
+        const mod = moduleOf(r);
+        return typeof mod === "string" && !rootModules.has(mod);
+    };
+    // Local resources resolve a bare / `Self.`-qualified name; forwarded foreign exports
+    // resolve an `Alias.`-qualified name keyed by (module, name).
     const byName = new Map();
+    const byModuleName = new Map();
     for (const r of resources) {
-        if (r.metadata?.name && !SYSTEM_KINDS.has(r.kind)) {
-            byName.set(r.metadata.name, r);
+        if (!r.metadata?.name || SYSTEM_KINDS.has(r.kind))
+            continue;
+        const name = r.metadata.name;
+        if (isForeign(r)) {
+            byModuleName.set(`${moduleOf(r)}\0${name}`, r);
         }
+        else {
+            byName.set(name, r);
+        }
+    }
+    for (const r of crossModuleTargets) {
+        if (!r.metadata?.name || SYSTEM_KINDS.has(r.kind) || !isForeign(r))
+            continue;
+        byModuleName.set(`${moduleOf(r)}\0${r.metadata.name}`, r);
     }
+    const resolveTarget = (source) => {
+        const dot = source.indexOf(".");
+        if (dot === -1) {
+            const t = byName.get(source);
+            return t ? { kind: t.kind, name: source } : undefined;
+        }
+        const alias = source.slice(0, dot);
+        const name = source.slice(dot + 1);
+        if (alias === "Self") {
+            const t = byName.get(name);
+            return t ? { kind: t.kind, name } : undefined;
+        }
+        const module = aliases?.moduleForAlias(alias);
+        if (module) {
+            const t = byModuleName.get(`${module}\0${name}`);
+            if (t) {
+                // The foreign instance's `kind` is authored in ITS module's scope (e.g.
+                // `Self.WriteLine`); canonicalize to a scope-independent `<module>.<Kind>` for the
+                // consumer's kind check. `Self.` maps to the owning module directly — the forwarded
+                // library's Library doc (hence its `Self` alias) isn't in the consumer's manifest
+                // set — while other alias prefixes resolve via that module's forwarded import scope.
+                const rawKind = t.kind;
+                const foreignKind = rawKind.startsWith("Self.")
+                    ? `${module}.${rawKind.slice("Self.".length)}`
+                    : aliasesByModule?.get(module)?.resolveKind(rawKind) ?? rawKind;
+                return { kind: foreignKind, name, alias };
+            }
+        }
+        return undefined;
+    };
     for (const r of resources) {
         if (!r.metadata?.name || !r.kind || SYSTEM_KINDS.has(r.kind))
             continue;
+        if (isForeign(r))
+            continue;
         const fieldMap = aliases && aliasesByModule
             ? registry.expandedFieldMapForResource(r, aliases, aliasesByModule)
             : registry.getFieldMapForKind(r.kind, aliases);
@@ -41,37 +102,30 @@ export function resolveRefSentinels(resources, registry, aliases, aliasesByModul
         for (const [fieldPath, entry] of fieldMap) {
             if (!isRefEntry(entry))
                 continue;
-            replaceSentinelsAtPath(r, fieldPath, byName);
+            descend(r, fieldPath.split("."), resolveTarget);
         }
     }
 }
-/** Walks `obj` along `fieldPath` (dot notation with `[]` for arrays and
- *  `{}` for additionalProperties-typed maps) and replaces any `!ref`
- *  sentinel value at the terminal slot with `{kind, name}` looked up
- *  via `byName`. Mutates the parent container in place; no string-path
- *  round-trip. */
-function replaceSentinelsAtPath(obj, fieldPath, byName) {
-    const parts = fieldPath.split(".");
-    descend(obj, parts, byName);
-}
-function descend(obj, parts, byName) {
+/** Walks `obj` along `fieldPath` parts (dot notation with `[]` for arrays and `{}` for
+ *  additionalProperties-typed maps) and replaces any `!ref` sentinel at the terminal slot
+ *  with its resolved `{kind, name, alias?}`. Mutates the parent container in place. */
+function descend(obj, parts, resolve) {
     if (obj == null || typeof obj !== "object" || parts.length === 0)
         return;
     const [head, ...rest] = parts;
-    // Map iteration: descend into every value of the current object.
     if (head === "{}") {
         const container = obj;
         for (const key of Object.keys(container)) {
             const child = container[key];
             if (rest.length === 0) {
                 if (isRefSentinel(child)) {
-                    const target = byName.get(child.source);
+                    const target = resolve(child.source);
                     if (target)
-                        container[key] = { kind: target.kind, name: child.source };
+                        container[key] = target;
                 }
             }
             else {
-                descend(child, rest, byName);
+                descend(child, rest, resolve);
             }
         }
         return;
@@ -89,26 +143,26 @@ function descend(obj, parts, byName) {
             if (rest.length === 0) {
                 const elem = val[i];
                 if (isRefSentinel(elem)) {
-                    const target = byName.get(elem.source);
+                    const target = resolve(elem.source);
                     if (target)
-                        val[i] = { kind: target.kind, name: elem.source };
+                        val[i] = target;
                 }
             }
             else {
-                descend(val[i], rest, byName);
+                descend(val[i], rest, resolve);
             }
         }
     }
     else {
         if (rest.length === 0) {
             if (isRefSentinel(val)) {
-                const target = byName.get(val.source);
+                const target = resolve(val.source);
                 if (target)
-                    container[key] = { kind: target.kind, name: val.source };
+                    container[key] = target;
             }
         }
         else {
-            descend(val, rest, byName);
+            descend(val, rest, resolve);
         }
     }
 }

package/dist/resolve-throws-union.d.ts

@@ -4,6 +4,10 @@ import type { DefinitionRegistry } from "./definition-registry.js";
 export interface ThrowsCodeMeta {
     data?: Record<string, any>;
 }
+/** Code a non-`InvokeError` failure surfaces as inside a `catch` block. Mirrors
+ *  `PLAIN_ERROR_CODE` in `@telorun/run`'s `toSequenceError`: any invoke can throw
+ *  a plain error, which the catch sees as `error.code === "INTERNAL_ERROR"`. */
+export declare const PLAIN_ERROR_CODE = "INTERNAL_ERROR";
 export interface ThrowsUnion {
     /** Code → per-code metadata (data schema, etc). Keys are the declared codes. */
     codes: Map<string, ThrowsCodeMeta>;
@@ -12,6 +16,12 @@ export interface ThrowsUnion {
      *  an unknown kind was encountered, or a cycle short-circuited resolution.
      *  Callers must treat unbounded unions as requiring a catch-all entry. */
     unbounded: boolean;
+    /** True when the block can fail with a non-`InvokeError` (any `invoke:` step).
+     *  Such a failure surfaces inside an enclosing `catch` as `PLAIN_ERROR_CODE`,
+     *  so a `throw: { code: "${{ error.code }}" }` rethrow can propagate it. Not
+     *  injected into `codes` — only seeds `enclosingTryCodes` at a try/catch site,
+     *  leaving non-rethrow unions untouched. */
+    canThrowPlain?: boolean;
 }
 export interface ResolveCtx {
     allManifests: ResourceManifest[];

package/dist/resolve-throws-union.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-throws-union.d.ts","sourceRoot":"","sources":["../src/resolve-throws-union.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,gFAAgF;IAChF,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACnC;;;8EAG0E;IAC1E,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC/B,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACzB;AAED,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,gBAAgB,EAAE,EAChC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,GACrB,UAAU,CAQZ;AA+BD;;;;8CAI8C;AAC9C,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,gBAAgB,EAC1B,GAAG,EAAE,UAAU,GACd,WAAW,CA+Cb"}
+{"version":3,"file":"resolve-throws-union.d.ts","sourceRoot":"","sources":["../src/resolve-throws-union.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC5B;AAED;;gFAEgF;AAChF,eAAO,MAAM,gBAAgB,mBAAmB,CAAC;AAEjD,MAAM,WAAW,WAAW;IAC1B,gFAAgF;IAChF,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACnC;;;8EAG0E;IAC1E,SAAS,EAAE,OAAO,CAAC;IACnB;;;;gDAI4C;IAC5C,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC/B,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACzB;AAED,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,gBAAgB,EAAE,EAChC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,GACrB,UAAU,CAQZ;AAgCD;;;;8CAI8C;AAC9C,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,gBAAgB,EAC1B,GAAG,EAAE,UAAU,GACd,WAAW,CA+Cb"}

package/dist/resolve-throws-union.js

@@ -1,3 +1,8 @@
+import { isTaggedSentinel } from "@telorun/templating";
+/** Code a non-`InvokeError` failure surfaces as inside a `catch` block. Mirrors
+ *  `PLAIN_ERROR_CODE` in `@telorun/run`'s `toSequenceError`: any invoke can throw
+ *  a plain error, which the catch sees as `error.code === "INTERNAL_ERROR"`. */
+export const PLAIN_ERROR_CODE = "INTERNAL_ERROR";
 export function createResolveCtx(allManifests, defs, aliases) {
     return {
         allManifests,
@@ -17,6 +22,8 @@ function unionInto(target, src) {
     }
     if (src.unbounded)
         target.unbounded = true;
+    if (src.canThrowPlain)
+        target.canThrowPlain = true;
 }
 function definitionFor(kind, defs, aliases) {
     const resolved = aliases.resolveKind(kind);
@@ -115,7 +122,11 @@ function collectStepArrayThrows(steps, invokeField, enclosingTryCodes, ctx) {
  *  composers that reuse those shape conventions work without changes here. */
 function collectStepThrows(step, invokeField, enclosingTryCodes, ctx) {
     if (step[invokeField]) {
-        return resolveStepInvokeThrows(step, invokeField, enclosingTryCodes, ctx);
+        // Any invoked resource can throw a non-InvokeError at runtime, which an
+        // enclosing catch surfaces as PLAIN_ERROR_CODE — record that possibility.
+        const u = cloneUnion(resolveStepInvokeThrows(step, invokeField, enclosingTryCodes, ctx));
+        u.canThrowPlain = true;
+        return u;
     }
     if (step.throw && typeof step.throw === "object") {
         return resolveThrowStepCode(step.throw, enclosingTryCodes);
@@ -128,6 +139,11 @@ function collectStepThrows(step, invokeField, enclosingTryCodes, ctx) {
             // out instead. Sequence-specific subtraction — the plan explicitly
             // anchors this to Run.Sequence's try/catch schema shape.
             const tryCodes = new Set(tryUnion.codes.keys());
+            // A plain (non-InvokeError) failure in the try block reaches the catch as
+            // `error.code === PLAIN_ERROR_CODE`, so a `throw: { code: error.code }`
+            // rethrow can propagate it — seed the set the catch resolves against.
+            if (tryUnion.canThrowPlain)
+                tryCodes.add(PLAIN_ERROR_CODE);
             propagated = collectStepArrayThrows(step.catch, invokeField, tryCodes, ctx);
             // Unbounded in the try block still signals the caller to expect
             // arbitrary codes to flow through the catch (e.g. via passthrough).
@@ -179,6 +195,8 @@ function cloneUnion(u) {
     for (const [c, m] of u.codes)
         out.codes.set(c, m);
     out.unbounded = u.unbounded;
+    if (u.canThrowPlain)
+        out.canThrowPlain = true;
     return out;
 }
 function resolveStepInvokeThrows(step, invokeField, enclosingTryCodes, ctx) {
@@ -226,14 +244,24 @@ function resolveThrowStepCode(throwSpec, enclosingTryCodes) {
     return resolveCodeExpression(throwSpec.code, enclosingTryCodes);
 }
 function resolveCodeExpression(codeInput, enclosingTryCodes) {
-    if (typeof codeInput !== "string" || codeInput.length === 0) {
-        return { codes: new Map(), unbounded: true };
+    // A `!cel`-tagged sentinel and a `${{ … }}` string must resolve identically —
+    // normalize both to the inner CEL expression (or a bare literal code).
+    let expr;
+    if (isTaggedSentinel(codeInput)) {
+        if (codeInput.engine !== "cel")
+            return { codes: new Map(), unbounded: true };
+        expr = codeInput.source.trim();
     }
-    const match = codeInput.match(/^\s*\$\{\{\s*([\s\S]+?)\s*\}\}\s*$/);
-    if (!match) {
-        return { codes: new Map([[codeInput, {}]]), unbounded: false };
+    else if (typeof codeInput === "string" && codeInput.length > 0) {
+        const match = codeInput.match(/^\s*\$\{\{\s*([\s\S]+?)\s*\}\}\s*$/);
+        if (!match) {
+            return { codes: new Map([[codeInput, {}]]), unbounded: false };
+        }
+        expr = match[1].trim();
+    }
+    else {
+        return { codes: new Map(), unbounded: true };
     }
-    const expr = match[1].trim();
     const litMatch = expr.match(/^'([^']+)'$|^"([^"]+)"$/);
     if (litMatch) {
         const code = litMatch[1] ?? litMatch[2];

package/dist/validate-references.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-references.d.ts","sourceRoot":"","sources":["../src/validate-references.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAMrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA4C/F;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,GACvB,kBAAkB,EAAE,CA0YtB"}
+{"version":3,"file":"validate-references.d.ts","sourceRoot":"","sources":["../src/validate-references.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAMrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA6C/F;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,GACvB,kBAAkB,EAAE,CA2etB"}