@telorun/analyzer 0.23.1 → 0.23.2

package/dist/normalize-inline-resources.d.ts

@@ -15,8 +15,9 @@ import type { AliasResolver } from "./alias-resolver.js";
  *   e.g. TestBasicAddition_steps_AddTwoNumbers_invoke
  *        TestBasicAddition_steps_0_invoke  (when step has no name)
  *
- * Returns a new array containing the original manifests (mutated in-place) plus all
- * extracted manifests. The original array is not mutated.
+ * Returns a new array of deep-cloned manifests (the rewrites land on the clones)
+ * plus all extracted manifests. The caller's manifests — array and elements — are
+ * never mutated; this is the analyzer's immutability boundary.
  */
 export declare function normalizeInlineResources(resources: ResourceManifest[], registry: DefinitionRegistry, aliases?: AliasResolver, aliasesByModule?: Map<string, AliasResolver>): ResourceManifest[];
 //# sourceMappingURL=normalize-inline-resources.d.ts.map

package/dist/normalize-inline-resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"normalize-inline-resources.d.ts","sourceRoot":"","sources":["../src/normalize-inline-resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAczD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE,aAAa,EACvB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC3C,gBAAgB,EAAE,CA+DpB"}
+{"version":3,"file":"normalize-inline-resources.d.ts","sourceRoot":"","sources":["../src/normalize-inline-resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AA8BzD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE,aAAa,EACvB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC3C,gBAAgB,EAAE,CAsEpB"}

package/dist/normalize-inline-resources.js

@@ -9,6 +9,24 @@ const SYSTEM_KINDS = new Set([
 function sanitizeName(raw) {
     return raw.replace(/[^a-zA-Z0-9_]/g, "_");
 }
+/** Deep-clones a manifest value tree so the in-place rewrites this module and
+ *  `resolveRefSentinels` perform never reach caller-owned objects. Compiled-CEL
+ *  nodes (`{__compiled, source, call?}`) are opaque leaves carrying functions —
+ *  copied by reference, never descended into — matching how `resolveRefSentinels`
+ *  and `manifest-visitor` short-circuit on `__compiled`. */
+function cloneForMutation(value) {
+    if (value === null || typeof value !== "object")
+        return value;
+    if (value.__compiled)
+        return value;
+    if (Array.isArray(value))
+        return value.map(cloneForMutation);
+    const out = {};
+    for (const key of Object.keys(value)) {
+        out[key] = cloneForMutation(value[key]);
+    }
+    return out;
+}
 /**
  * Phase 2 — Inline resource normalization.
  *
@@ -23,13 +41,21 @@ function sanitizeName(raw) {
  *   e.g. TestBasicAddition_steps_AddTwoNumbers_invoke
  *        TestBasicAddition_steps_0_invoke  (when step has no name)
  *
- * Returns a new array containing the original manifests (mutated in-place) plus all
- * extracted manifests. The original array is not mutated.
+ * Returns a new array of deep-cloned manifests (the rewrites land on the clones)
+ * plus all extracted manifests. The caller's manifests — array and elements — are
+ * never mutated; this is the analyzer's immutability boundary.
  */
 export function normalizeInlineResources(resources, registry, aliases, aliasesByModule) {
-    const result = [...resources];
+    // Deep-clone the input so this pass — and `resolveRefSentinels`, which runs on
+    // this output — never mutate caller-owned manifests. `extractInlinesAtPath`
+    // rewrites inline ref slots in place, so without cloning we'd corrupt shared
+    // state such as the editor's `LoadedFile.manifests` parse cache (a reused
+    // sentinel would be rewritten to `{kind, name}`, later misread as an authored
+    // reference form). The clone is the analyzer's immutability boundary.
+    const result = resources.map(cloneForMutation);
     // Queue: all non-system resources with a name. Extracted resources are appended.
-    const queue = resources.filter((r) => typeof r.metadata?.name === "string" && !!r.kind && !SYSTEM_KINDS.has(r.kind));
+    // Filter the CLONES (not the originals) so traversal mutates copies.
+    const queue = result.filter((r) => typeof r.metadata?.name === "string" && !!r.kind && !SYSTEM_KINDS.has(r.kind));
     let i = 0;
     while (i < queue.length) {
         const resource = queue[i++];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.23.1",
+  "version": "0.23.2",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",

package/src/normalize-inline-resources.ts

@@ -15,6 +15,22 @@ function sanitizeName(raw: string): string {
   return raw.replace(/[^a-zA-Z0-9_]/g, "_");
 }
 
+/** Deep-clones a manifest value tree so the in-place rewrites this module and
+ *  `resolveRefSentinels` perform never reach caller-owned objects. Compiled-CEL
+ *  nodes (`{__compiled, source, call?}`) are opaque leaves carrying functions —
+ *  copied by reference, never descended into — matching how `resolveRefSentinels`
+ *  and `manifest-visitor` short-circuit on `__compiled`. */
+function cloneForMutation(value: unknown): unknown {
+  if (value === null || typeof value !== "object") return value;
+  if ((value as { __compiled?: unknown }).__compiled) return value;
+  if (Array.isArray(value)) return value.map(cloneForMutation);
+  const out: Record<string, unknown> = {};
+  for (const key of Object.keys(value)) {
+    out[key] = cloneForMutation((value as Record<string, unknown>)[key]);
+  }
+  return out;
+}
+
 /**
  * Phase 2 — Inline resource normalization.
  *
@@ -29,8 +45,9 @@ function sanitizeName(raw: string): string {
  *   e.g. TestBasicAddition_steps_AddTwoNumbers_invoke
  *        TestBasicAddition_steps_0_invoke  (when step has no name)
  *
- * Returns a new array containing the original manifests (mutated in-place) plus all
- * extracted manifests. The original array is not mutated.
+ * Returns a new array of deep-cloned manifests (the rewrites land on the clones)
+ * plus all extracted manifests. The caller's manifests — array and elements — are
+ * never mutated; this is the analyzer's immutability boundary.
  */
 export function normalizeInlineResources(
   resources: ResourceManifest[],
@@ -38,10 +55,17 @@ export function normalizeInlineResources(
   aliases?: AliasResolver,
   aliasesByModule?: Map<string, AliasResolver>,
 ): ResourceManifest[] {
-  const result = [...resources];
+  // Deep-clone the input so this pass — and `resolveRefSentinels`, which runs on
+  // this output — never mutate caller-owned manifests. `extractInlinesAtPath`
+  // rewrites inline ref slots in place, so without cloning we'd corrupt shared
+  // state such as the editor's `LoadedFile.manifests` parse cache (a reused
+  // sentinel would be rewritten to `{kind, name}`, later misread as an authored
+  // reference form). The clone is the analyzer's immutability boundary.
+  const result = resources.map(cloneForMutation) as ResourceManifest[];
 
   // Queue: all non-system resources with a name. Extracted resources are appended.
-  const queue = resources.filter(
+  // Filter the CLONES (not the originals) so traversal mutates copies.
+  const queue = result.filter(
     (r): r is ResourceManifest & { metadata: { name: string } } =>
       typeof r.metadata?.name === "string" && !!r.kind && !SYSTEM_KINDS.has(r.kind),
   );