@telorun/analyzer 0.28.0 → 0.28.1

package/dist/validate-cel-context.d.ts

@@ -20,7 +20,7 @@ export interface ContextResolveOpts {
  * - Object with `kind` + `schema`: inline type definition → return the `schema`
  * - Object with `type` or `properties`: raw JSON Schema, return as-is
  */
-export declare function resolveTypeFieldToSchema(value: unknown, allManifests: Record<string, any>[]): Record<string, any> | undefined;
+export declare function resolveTypeFieldToSchema(value: unknown, allManifests: Record<string, any>[], ancestry?: ReadonlySet<string>): Record<string, any> | undefined;
 /**
  * Returns true when a CEL expression path (from walkCelExpressions, e.g. "routes[0].inputs.q")
  * falls within the scope of a context (e.g. "$.routes[*].inputs").

package/dist/validate-cel-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAEtF,MAAM,WAAW,kBAAkB;IACjC;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC;;kDAE8C;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;KACxD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAkCjC;AA6DD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAChD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAgHrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB;AAWD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,SAAM,GACT,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAC,CAGvD"}
+{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAGtF,MAAM,WAAW,kBAAkB;IACjC;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC;;kDAE8C;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;KACxD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CA0CjC;AAuFD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAChD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAgHrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB;AAWD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,SAAM,GACT,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAC,CAGvD"}

package/dist/validate-cel-context.js

@@ -1,27 +1,33 @@
 export { extractAccessChains, validateChainAgainstSchema } from "@telorun/templating";
+import { mergeTypeSchemas } from "@telorun/sdk";
 /**
  * Resolve a type field value (string name, inline type, or raw schema) to a JSON Schema.
  * - String: look up the named type in allManifests (Type.JsonSchema resources)
  * - Object with `kind` + `schema`: inline type definition → return the `schema`
  * - Object with `type` or `properties`: raw JSON Schema, return as-is
  */
-export function resolveTypeFieldToSchema(value, allManifests) {
+export function resolveTypeFieldToSchema(value, allManifests, ancestry = new Set()) {
     if (!value)
         return undefined;
     if (typeof value === "string") {
+        // Cycle guard: a type already on the resolution path can't extend back into it.
+        if (ancestry.has(value))
+            return undefined;
         // Named type reference — find a Telo.Type resource by name
         const typeManifest = allManifests.find((m) => m.metadata?.name === value &&
             typeof m.kind === "string" &&
             /\bType\b/.test(m.kind) &&
             typeof m.schema === "object" &&
             m.schema !== null);
-        return typeManifest?.schema;
+        if (!typeManifest)
+            return undefined;
+        return applyExtends(typeManifest.schema, typeManifest.extends, allManifests, new Set(ancestry).add(value));
     }
     if (typeof value === "object" && value !== null) {
         const obj = value;
         // Inline type resource: { kind: "Type.JsonSchema", schema: {...} }
         if (obj.schema && typeof obj.schema === "object") {
-            return obj.schema;
+            return applyExtends(obj.schema, obj.extends, allManifests, ancestry);
         }
         // Raw JSON Schema (has type or properties)
         if (obj.type || obj.properties) {
@@ -30,11 +36,34 @@ export function resolveTypeFieldToSchema(value, allManifests) {
         // Named type reference resolved from a `!ref` → { kind, name } — resolve the
         // named Telo.Type the same way as the bare-string form.
         if (typeof obj.name === "string") {
-            return resolveTypeFieldToSchema(obj.name, allManifests);
+            return resolveTypeFieldToSchema(obj.name, allManifests, ancestry);
         }
     }
     return undefined;
 }
+/**
+ * Fold a `Type.JsonSchema`'s `extends` parents into its own schema, matching the
+ * runtime `type` controller exactly — both call the shared `mergeTypeSchemas`, so
+ * static analysis and runtime validation can never disagree on a type's effective
+ * shape. Without this the analyzer would see only a child type's own properties
+ * and reject valid access to an inherited field with a false `CEL_UNKNOWN_FIELD`.
+ * `ancestry` carries the resolution path for cycle detection (siblings share it
+ * unmutated, so diamond inheritance still re-includes a shared grandparent).
+ */
+function applyExtends(ownSchema, extendsField, allManifests, ancestry) {
+    if (!extendsField)
+        return ownSchema;
+    const parents = Array.isArray(extendsField) ? extendsField : [extendsField];
+    const resolved = [];
+    for (const parent of parents) {
+        const parentSchema = resolveTypeFieldToSchema(parent, allManifests, ancestry);
+        if (parentSchema)
+            resolved.push(parentSchema);
+    }
+    if (resolved.length === 0)
+        return ownSchema;
+    return mergeTypeSchemas([...resolved, ownSchema]);
+}
 /** Pull the raw expression source from a CEL field value — a compiled value
  *  (`{ source }`), or a string (`!cel "x"` or `"${{ x }}"`). Strips a lone
  *  `${{ }}` wrapper. Returns null when no source is recoverable. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.28.0",
+  "version": "0.28.1",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",
@@ -48,7 +48,7 @@
     "@types/node": "^20.0.0",
     "typescript": "^5.0.0",
     "vitest": "^2.1.8",
-    "@telorun/sdk": "0.36.0"
+    "@telorun/sdk": "0.38.0"
   },
   "peerDependencies": {
     "@telorun/sdk": "*"

package/src/validate-cel-context.ts

@@ -1,4 +1,5 @@
 export { extractAccessChains, validateChainAgainstSchema } from "@telorun/templating";
+import { mergeTypeSchemas } from "@telorun/sdk";
 
 export interface ContextResolveOpts {
   /** When provided, used to resolve `x-telo-context-from-root` annotations against the
@@ -25,10 +26,13 @@ export interface ContextResolveOpts {
 export function resolveTypeFieldToSchema(
   value: unknown,
   allManifests: Record<string, any>[],
+  ancestry: ReadonlySet<string> = new Set(),
 ): Record<string, any> | undefined {
   if (!value) return undefined;
 
   if (typeof value === "string") {
+    // Cycle guard: a type already on the resolution path can't extend back into it.
+    if (ancestry.has(value)) return undefined;
     // Named type reference — find a Telo.Type resource by name
     const typeManifest = allManifests.find(
       (m) =>
@@ -38,14 +42,20 @@ export function resolveTypeFieldToSchema(
         typeof m.schema === "object" &&
         m.schema !== null,
     );
-    return typeManifest?.schema as Record<string, any> | undefined;
+    if (!typeManifest) return undefined;
+    return applyExtends(
+      typeManifest.schema as Record<string, any>,
+      typeManifest.extends,
+      allManifests,
+      new Set(ancestry).add(value),
+    );
   }
 
   if (typeof value === "object" && value !== null) {
     const obj = value as Record<string, any>;
     // Inline type resource: { kind: "Type.JsonSchema", schema: {...} }
     if (obj.schema && typeof obj.schema === "object") {
-      return obj.schema as Record<string, any>;
+      return applyExtends(obj.schema as Record<string, any>, obj.extends, allManifests, ancestry);
     }
     // Raw JSON Schema (has type or properties)
     if (obj.type || obj.properties) {
@@ -54,13 +64,39 @@ export function resolveTypeFieldToSchema(
     // Named type reference resolved from a `!ref` → { kind, name } — resolve the
     // named Telo.Type the same way as the bare-string form.
     if (typeof obj.name === "string") {
-      return resolveTypeFieldToSchema(obj.name, allManifests);
+      return resolveTypeFieldToSchema(obj.name, allManifests, ancestry);
     }
   }
 
   return undefined;
 }
 
+/**
+ * Fold a `Type.JsonSchema`'s `extends` parents into its own schema, matching the
+ * runtime `type` controller exactly — both call the shared `mergeTypeSchemas`, so
+ * static analysis and runtime validation can never disagree on a type's effective
+ * shape. Without this the analyzer would see only a child type's own properties
+ * and reject valid access to an inherited field with a false `CEL_UNKNOWN_FIELD`.
+ * `ancestry` carries the resolution path for cycle detection (siblings share it
+ * unmutated, so diamond inheritance still re-includes a shared grandparent).
+ */
+function applyExtends(
+  ownSchema: Record<string, any>,
+  extendsField: unknown,
+  allManifests: Record<string, any>[],
+  ancestry: ReadonlySet<string>,
+): Record<string, any> {
+  if (!extendsField) return ownSchema;
+  const parents = Array.isArray(extendsField) ? extendsField : [extendsField];
+  const resolved: Record<string, any>[] = [];
+  for (const parent of parents) {
+    const parentSchema = resolveTypeFieldToSchema(parent, allManifests, ancestry);
+    if (parentSchema) resolved.push(parentSchema);
+  }
+  if (resolved.length === 0) return ownSchema;
+  return mergeTypeSchemas([...resolved, ownSchema]) as Record<string, any>;
+}
+
 /** Pull the raw expression source from a CEL field value — a compiled value
  *  (`{ source }`), or a string (`!cel "x"` or `"${{ x }}"`). Strips a lone
  *  `${{ }}` wrapper. Returns null when no source is recoverable. */