@telorun/analyzer 0.56.1 → 0.58.0

package/dist/analyzer.d.ts

@@ -40,6 +40,11 @@ export declare function gatherPropertySchemas(schema: Record<string, any>): Arra
  * hardcoded; recursion is driven entirely by the schema annotations.
  */
 export declare function walkStepArray(steps: unknown[], stepItemSchema: Record<string, any> | undefined, rootSchema: Record<string, any>, basePath: string, visit: (step: Record<string, any>, stepPath: string) => void): void;
+/** A pure-CEL leaf and the schema of the field it sits in. */
+export interface CelValueSlot {
+    readonly path: string;
+    readonly schema: Record<string, any>;
+}
 export interface StaticAnalyzerOptions {
     celHandlers?: CelHandlers;
 }

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIzE,OAAO,EACL,aAAa,EAEb,KAAK,YAAY,EAElB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EACL,KAAK,aAAa,EAGnB,MAAM,0BAA0B,CAAC;AAsBlC,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAiBvF,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAqF/F;;;;;uDAKuD;AACvD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,aAAa,GAAG;IAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAA;CAAE,CAO9F;AA6FD;0CAC0C;AAC1C,eAAO,MAAM,eAAe,GAAI,OAAO;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OACT,CAAC;AAErD;8EAC8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhD;AAuBD;2DAC2D;AAC3D,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACvC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CASjC;AAED;4EAC4E;AAC5E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAmBvG;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,OAAO,EAAE,EAChB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EAC/C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,GAC3D,IAAI,CAiDN;AA8mBD,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IA6wCvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAyBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAWzE,OAAO,EACL,aAAa,EAEb,KAAK,YAAY,EAElB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EACL,KAAK,aAAa,EAGnB,MAAM,0BAA0B,CAAC;AAsBlC,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAuBvF,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAsF/F;;;;;uDAKuD;AACvD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,aAAa,GAAG;IAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAA;CAAE,CAO9F;AA6FD;0CAC0C;AAC1C,eAAO,MAAM,eAAe,GAAI,OAAO;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OACT,CAAC;AAErD;8EAC8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhD;AAuBD;2DAC2D;AAC3D,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACvC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CASjC;AAED;4EAC4E;AAC5E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAmBvG;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,OAAO,EAAE,EAChB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EAC/C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,GAC3D,IAAI,CAiDN;AA6gBD,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACtC;AA6DD,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAk7CvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAyBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -1,5 +1,5 @@
 import { canonicalTypeSchemaId, OBSERVED_STATE_KEY } from "@telorun/sdk";
-import { defaultRegistry, isRefSentinel, isTaggedSentinel } from "@telorun/templating";
+import { defaultRegistry, isRefSentinel, isTaggedSentinel, plainChainOf, } from "@telorun/templating";
 import { AliasResolver, moduleScopedDefResolver, scopeResolverForModule, } from "./alias-resolver.js";
 import { buildCelEnvironment, buildImportInputCelEnvironment, buildTypedCelEnvironment, } from "./cel-environment.js";
 import { DefinitionRegistry } from "./definition-registry.js";
@@ -19,18 +19,20 @@ import { resolveSchemaRefKinds } from "./resolve-schema-ref-kinds.js";
 import { runZoneAnalysis } from "./resolve-zone-requirements.js";
 import { validateZoneSlotDeclarations } from "./validate-zone-slots.js";
 import { validateDynamicSelectors, validateRefSlotDeclarations, } from "./validate-ref-slots.js";
+import { validateValueTypeSlots, } from "./validate-value-type-slots.js";
 import { resolveSchemaTypeRefs } from "./resolve-schema-type-refs.js";
 import { validateSchemaTypeRefs } from "./validate-schema-type-refs.js";
 import { rewriteSyntheticOrigins } from "./rewrite-synthetic-origins.js";
-import { celTypeSatisfiesJsonSchema, substituteCelFields, validateAgainstSchema, } from "./schema-compat.js";
+import { celTypeSatisfiesJsonSchema, checkSchemaCompatibility, navigateSchemaToExprPath, substituteCelFields, validateAgainstSchema, } from "./schema-compat.js";
 import { collectValueSchemaIssues } from "./validate-value-schema.js";
 import { DiagnosticSeverity } from "./types.js";
-import { extractAccessChains, extractCelRegionScopes, extractContextsFromSchema, getManifestItem, pathMatchesScope, resolveContextAnnotations, resolveTypeFieldToSchema, } from "./validate-cel-context.js";
+import { extractAccessChains, extractCelRegionScopes, getManifestItem, pathMatchesScope, resolveContextAnnotations, resolveTypeFieldToSchema, } from "./validate-cel-context.js";
 import { buildEvalPaths, evalPathsCover } from "./eval-paths.js";
 import { BINDINGS_ANNOTATION, bindingContextProperties, bindingPathChain, CEL_RESERVED_WORDS, findBindingSites, resolveBindingOrder, schemaAtChain, } from "./cel-bindings.js";
 import { validateExtends } from "./validate-extends.js";
 import { validateLogging } from "./validate-logging.js";
 import { validateModuleArtifact } from "./validate-module-artifact.js";
+import { validateIncludePlacement } from "./validate-include-placement.js";
 import { validateModuleMetadata } from "./validate-module-metadata.js";
 import { validateBaseMapping } from "./validate-base-mapping.js";
 import { validateInvocationContract } from "./validate-invocation-contract.js";
@@ -735,68 +737,49 @@ function celAccessChains(env, expr) {
 }
 const CEL_PURE_RE = /^\s*\$\{\{[^}]*\}\}\s*$/;
 const CEL_EXPR_RE = /\$\{\{\s*([^}]+?)\s*\}\}/;
-/** Recursively walk `data`+`schema` together, type-checking every pure CEL template
- *  string via `env.check()`. Returns `SchemaIssue[]` for any type mismatches found. */
-function collectCelTypeIssues(data, schema, path, definition, manifest, baseTypedEnv, rootEnv, rootModuleManifest) {
-    const issues = [];
-    // A pure CEL value type-checks the same regardless of surface form: a
-    // `${{ … }}` string and a `!cel`-tagged sentinel must behave identically.
+/** Restore the delimiters an engine's fix was computed without, so the
+ *  replacement is the whole scalar rather than a bare expression that would be
+ *  read back as literal text. A tagged scalar carries no wrapper and passes
+ *  through untouched. */
+function rewrapFix(fix, wrapper) {
+    if (!fix || !wrapper)
+        return fix;
+    return { replacement: wrapper.prefix + fix.replacement + wrapper.suffix };
+}
+/** Recursively walk `data`+`schema` together, collecting every pure CEL leaf
+ *  with the schema of the field holding it.
+ *
+ *  Type *checking* is deliberately not done here. It belongs to the templating
+ *  engine, which owns the expression's syntax and now runs it once against the
+ *  environment typed for that path; checking again here would mean two verdicts
+ *  from two environments about one expression — which is exactly how an opaque
+ *  "no matching overload" used to survive next to the diagnostic that explained
+ *  it. What this walk supplies is the half the engine cannot know: the declared
+ *  type of the slot the value flows into. The comparison happens once both are
+ *  in hand (`reportCelReturnMismatches`). */
+function collectCelValueSlots(data, schema, path) {
+    const slots = [];
+    // A pure CEL value behaves the same regardless of surface form: a
+    // `${{ … }}` string and a `!cel`-tagged sentinel are the same expression.
     let celExpr;
     if (isTaggedSentinel(data)) {
         // Non-CEL engines (e.g. `!literal`) are analyzed by their own engine pass.
         if (data.engine !== "cel")
-            return issues;
+            return slots;
         celExpr = data.source;
     }
     else if (typeof data === "string" && CEL_PURE_RE.test(data)) {
         celExpr = data.match(CEL_EXPR_RE)?.[1]?.trim();
     }
     if (celExpr !== undefined) {
-        {
-            const expr = celExpr;
-            // Merge x-telo-context variables for this path if applicable
-            let typedEnv = baseTypedEnv;
-            if (definition.schema) {
-                for (const ctx of extractContextsFromSchema(definition.schema)) {
-                    if (!pathMatchesScope(path, ctx.scope))
-                        continue;
-                    typedEnv = buildTypedCelEnvironment(rootEnv, manifest, ctx.schema, rootModuleManifest);
-                    break;
-                }
-            }
-            let checkResult;
-            try {
-                checkResult = typedEnv.check(expr);
-            }
-            catch {
-                /* degrade gracefully */
-            }
-            if (checkResult?.valid === false && checkResult.error) {
-                // env.check() rejected the expression itself — e.g. wrong method, wrong
-                // argument types, wrong operator overload. Surface the first line of the
-                // error message; the tail is a source-code caret diagram we don't need.
-                const message = String(checkResult.error.message ?? checkResult.error)
-                    .split("\n")[0]
-                    .trim();
-                issues.push({ message: `CEL type error: ${message}`, path });
-            }
-            else if (checkResult?.valid && checkResult.type && schema) {
-                const celType = checkResult.type.split("<")[0];
-                if (!celTypeSatisfiesJsonSchema(celType, schema)) {
-                    const expected = schema["x-telo-type"] ?? schema.type ?? "unknown";
-                    issues.push({
-                        message: `CEL returns '${checkResult.type}' but field expects '${expected}'`,
-                        path,
-                    });
-                }
-            }
-        }
-        return issues;
+        if (schema)
+            slots.push({ path, schema });
+        return slots;
     }
     if (Array.isArray(data)) {
         const itemSchema = (schema.items ?? {});
         for (let i = 0; i < data.length; i++) {
-            issues.push(...collectCelTypeIssues(data[i], itemSchema, `${path}[${i}]`, definition, manifest, baseTypedEnv, rootEnv, rootModuleManifest));
+            slots.push(...collectCelValueSlots(data[i], itemSchema, `${path}[${i}]`));
         }
     }
     else if (data !== null && typeof data === "object") {
@@ -805,10 +788,10 @@ function collectCelTypeIssues(data, schema, path, definition, manifest, baseType
             ? schema.additionalProperties
             : {};
         for (const [k, v] of Object.entries(data)) {
-            issues.push(...collectCelTypeIssues(v, (props[k] ?? mapValueSchema), path ? `${path}.${k}` : k, definition, manifest, baseTypedEnv, rootEnv, rootModuleManifest));
+            slots.push(...collectCelValueSlots(v, (props[k] ?? mapValueSchema), path ? `${path}.${k}` : k));
         }
     }
-    return issues;
+    return slots;
 }
 export class StaticAnalyzer {
     celEnv;
@@ -1001,6 +984,18 @@ export class StaticAnalyzer {
         const refConstraintIssues = [];
         const refSlotIssues = [];
         const zoneSlotIssues = [];
+        // `x-telo-type` is checked on EVERY manifest, not only on definition docs: a
+        // schema fragment is written wherever a kind declares a schema-valued field,
+        // so an inline `inputType:` on an ordinary resource carries one just as a
+        // definition's `schema:` does. Same scoping as every other schema issue —
+        // the entry's own modules, since a dependency is not the consumer's to fix.
+        const valueTypeSlotIssues = [];
+        for (const m of manifests) {
+            const declaringModule = m.metadata?.module;
+            if (!declaringModule || rootModules.has(declaringModule)) {
+                valueTypeSlotIssues.push(...validateValueTypeSlots(m));
+            }
+        }
         for (const m of manifests) {
             if (m.kind !== "Telo.Definition" && m.kind !== "Telo.Abstract")
                 continue;
@@ -1135,6 +1130,26 @@ export class StaticAnalyzer {
             // mid-migration, and this reports what leniency would silently absorb.
             for (const issue of refSlotIssues)
                 diagnostics.push(refSlotIssueDiagnostic(issue));
+            // The same split for `x-telo-type`. Its reader returns a slot with no
+            // entry for a name it does not know, which is what an unrecognized brand
+            // used to do SILENTLY — the slot simply lost its identity.
+            for (const issue of valueTypeSlotIssues) {
+                diagnostics.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: issue.code,
+                    source: SOURCE,
+                    message: issue.message,
+                    data: {
+                        resource: {
+                            kind: issue.manifest.kind,
+                            name: issue.manifest.metadata?.name,
+                        },
+                        filePath: issue.manifest.metadata?.source,
+                        path: issue.path,
+                        ...(issue.fix ? { fix: issue.fix } : {}),
+                    },
+                });
+            }
             // Same split for the two zone annotations. Unreadable ones fail in
             // OPPOSITE directions — a dropped requirement is silently unenforced, a
             // dropped provision invents failures — so neither can be left to
@@ -1251,6 +1266,9 @@ export class StaticAnalyzer {
             // these fields, which is precisely why they need a check: a mistyped one
             // has no runtime failure mode that would ever surface it.
             diagnostics.push(...validateModuleMetadata(allManifests, defs, aliases));
+            // A file embed resolves at resource creation, so one written on a doc that
+            // is never instantiated is read by nothing and would ship silently.
+            diagnostics.push(...validateIncludePlacement(allManifests));
         }
         resolveSchemaTypeRefs(allManifests, aliases, aliasesByModule);
         // Trusted-input fast path: when the caller has already attested that
@@ -1381,6 +1399,19 @@ export class StaticAnalyzer {
         // the entry's; see `buildKernelGlobalsSchema`.
         const moduleManifest = allManifests.find((mm) => mm.kind === "Telo.Application") ??
             allManifests.find((mm) => mm.kind === "Telo.Library");
+        // Every pure-CEL leaf, with the slot it flows into. Compared against the
+        // type the engine walk resolves, once both halves exist — see
+        // `collectCelValueSlots`.
+        const celReturnSlots = [];
+        const celTypeByPath = new Map();
+        // The schema an expression RESOLVES TO, beside the CEL type it carries. Both
+        // are needed and neither replaces the other: the CEL type answers "does this
+        // fit the slot at all", the schema answers "do their type arguments agree",
+        // which cel-js cannot express because it types by constructor identity.
+        const celSourceSchemaByPath = new Map();
+        // Context-free typed environments, one per manifest. Reused across every
+        // expression in it — see the build site for why a matched context opts out.
+        const typedEnvByManifest = new Map();
         // Validate each non-definition, non-system resource
         for (const m of allManifests) {
             const filePath = m.metadata?.source;
@@ -1458,7 +1489,15 @@ export class StaticAnalyzer {
                     code: "UNDEFINED_KIND",
                     source: SOURCE,
                     message: `No Telo.Definition found for kind '${m.kind}'.${hint}`,
-                    data: { resource, filePath, path: "kind", suggestedKind },
+                    // `suggestedKind` is kept beside the generic `fix` because it names
+                    // what the replacement IS; the fix is how to apply it.
+                    data: {
+                        resource,
+                        filePath,
+                        path: "kind",
+                        suggestedKind,
+                        ...(suggestedKind ? { fix: { replacement: suggestedKind } } : {}),
+                    },
                 });
                 continue;
             }
@@ -1481,23 +1520,12 @@ export class StaticAnalyzer {
                         },
                     }
                     : authorSchema;
-                // Phase 1: CEL type checking — walk data+schema together, check env.check() return types.
-                // A Telo.Import's variables/secrets are a config-only contract evaluated against the
-                // IMPORTING module's scope, so type them from the owning module doc (matched by
-                // `metadata.module`) and drop `resources`/`env` so referencing them is an error. A
-                // library's own internal import is validated against that library in the library's
-                // standalone analysis; in this flattened app pass the library doc is absent, so the
-                // importer is undefined here and variables/secrets fall back to a permissive `map`
-                // (no false positives) while resources/env stay rejected.
-                const importerModule = m.kind === "Telo.Import"
-                    ? allManifests.find((mm) => (mm.kind === "Telo.Application" || mm.kind === "Telo.Library") &&
-                        mm.metadata?.name ===
-                            m.metadata?.module)
-                    : undefined;
-                const baseTypedEnv = m.kind === "Telo.Import"
-                    ? buildImportInputCelEnvironment(this.celEnv, importerModule)
-                    : buildTypedCelEnvironment(this.celEnv, m, undefined, moduleManifest);
-                const celIssues = collectCelTypeIssues(m, schema, "", definition, m, baseTypedEnv, this.celEnv, moduleManifest);
+                // Phase 1: collect the pure-CEL leaves and the schema of the slot each
+                // flows into. The expression's own type is resolved later, by the
+                // engine walk that owns type-checking; this half only knows the target.
+                for (const slot of collectCelValueSlots(m, schema, "")) {
+                    celReturnSlots.push({ manifest: m, resource, filePath, ...slot });
+                }
                 // Phase 2+3: AJV on substituted data — CEL fields replaced with typed placeholders
                 const ajvIssues = validateAgainstSchema(substituteCelFields(m, schema), schema);
                 // Phase 4: value slots that must satisfy a type declared elsewhere on
@@ -1505,7 +1533,7 @@ export class StaticAnalyzer {
                 // decision table against its declared `outputType`, so a mistyped branch
                 // is caught here rather than on the one input that selects it.
                 const valueSchemaIssues = collectValueSchemaIssues(m, schema, allManifests);
-                const issues = [...celIssues, ...ajvIssues, ...valueSchemaIssues];
+                const issues = [...ajvIssues, ...valueSchemaIssues];
                 for (const issue of issues) {
                     diagnostics.push({
                         severity: DiagnosticSeverity.Error,
@@ -1648,12 +1676,14 @@ export class StaticAnalyzer {
                 if (e.definition?.schema) {
                     const stepName = m.metadata?.name;
                     const stepFile = m.metadata?.source;
-                    for (const issue of collectStepInputIssues(m, e.definition.schema, allManifests, defs, aliases, { aliasesByModule, rootModules })) {
+                    for (const issue of collectStepInputIssues(m, e.definition.schema, allManifests, defs, aliases, { aliasesByModule, rootModules }, celStepContextSchema)) {
                         diagnostics.push({
                             severity: DiagnosticSeverity.Error,
-                            code: "CONTRACT_INPUTS_MISMATCH",
+                            code: issue.code ?? "CONTRACT_INPUTS_MISMATCH",
                             source: SOURCE,
-                            message: `${m.kind}/${stepName}: inputs at '${issue.path}' do not satisfy ${issue.targetLabel}'s declared inputType: ${issue.message}`,
+                            message: issue.code
+                                ? `${m.kind}/${stepName}: inputs at '${issue.path}' flow into ${issue.targetLabel} with disagreeing type arguments: ${issue.message}`
+                                : `${m.kind}/${stepName}: inputs at '${issue.path}' do not satisfy ${issue.targetLabel}'s declared inputType: ${issue.message}`,
                             data: {
                                 resource: { kind: m.kind, name: stepName ?? "" },
                                 filePath: stepFile,
@@ -1876,50 +1906,158 @@ export class StaticAnalyzer {
                     });
                     return;
                 }
-                const findings = engine.analyze(expr, { celEnv: this.celEnv, contextSchema: effectiveContext });
-                for (const f of findings) {
-                    if (f.code === "CEL_SYNTAX_ERROR") {
+                // The engine type-checks, so it gets the environment typed for THIS
+                // path — not the bare base one. A `Telo.Import`'s variables/secrets
+                // are a config-only contract evaluated in the IMPORTING module's
+                // scope, so they type from the owning module doc and drop
+                // `resources`/`env`, making a reference to either an error.
+                //
+                // Cached per manifest when no `x-telo-context` applied, which is most
+                // expressions: the environment then depends only on the manifest, so
+                // rebuilding it per expression is pure waste — a clone plus a
+                // re-registration of every variable, on every keystroke in the IDE.
+                // A matched context makes the environment path-specific (its schema is
+                // resolved against the enclosing array item), so those still build
+                // fresh rather than risk one item's types leaking into another's.
+                const cached = effectiveContext === null ? typedEnvByManifest.get(m) : undefined;
+                const typedEnv = cached ??
+                    (m.kind === "Telo.Import"
+                        ? buildImportInputCelEnvironment(this.celEnv, allManifests.find((mm) => (mm.kind === "Telo.Application" || mm.kind === "Telo.Library") &&
+                            mm.metadata?.name ===
+                                m.metadata?.module))
+                        : buildTypedCelEnvironment(this.celEnv, m, effectiveContext ?? undefined, moduleManifest));
+                if (effectiveContext === null && !cached)
+                    typedEnvByManifest.set(m, typedEnv);
+                const result = engine.analyze(expr, { celEnv: typedEnv, contextSchema: effectiveContext });
+                if (result.type !== undefined) {
+                    let byPath = celTypeByPath.get(m);
+                    if (!byPath)
+                        celTypeByPath.set(m, (byPath = new Map()));
+                    byPath.set(path, result.type);
+                }
+                // The producer half of the type-argument check. A CEL type is a bare
+                // name — cel-js types by constructor identity, so a byte stream and a
+                // string stream are one CEL type and always will be — so the argument
+                // comparison is a parallel pass over the SCHEMAS the analyzer already
+                // walks. This is where the producer's schema is in hand: navigating
+                // the expression's chain into its context schema is exactly "the
+                // producer's outputType at the expression's tail".
+                //
+                // Only a PLAIN CHAIN is navigated — `steps.encode.result.output`, the
+                // shape a wiring site actually takes. An expression that computes
+                // rather than names has no schema to read off the context, so it
+                // records nothing and no argument check fires: silence where the
+                // analyzer knows least is the conservative direction, and the same one
+                // `x-telo-step-context`'s pure-`value` typing takes.
+                const chain = effectiveContext ? plainChainOf(`\${{${expr}}}`) : undefined;
+                if (chain) {
+                    const produced = navigateSchemaToExprPath(effectiveContext, chain);
+                    if (produced) {
+                        let byPath = celSourceSchemaByPath.get(m);
+                        if (!byPath)
+                            celSourceSchemaByPath.set(m, (byPath = new Map()));
+                        byPath.set(path, produced);
+                    }
+                }
+                // A non-deterministic call in a compile-eval field is baked once at
+                // load: `nowIso()` there freezes at boot. Sometimes that is the
+                // intent (a boot timestamp, a run id), so it warns rather than
+                // blocking. The engine reports which calls re-evaluate; the eval mode
+                // is manifest policy and stays here.
+                if (celRuleApplies && evalPathsCover(celCompilePaths, path)) {
+                    const volatile = [
+                        ...new Set(result.calls.filter((c) => c.deterministic === false).map((c) => c.name)),
+                    ].sort();
+                    if (volatile.length > 0) {
                         diagnostics.push({
-                            severity: DiagnosticSeverity.Error,
-                            code: "CEL_SYNTAX_ERROR",
+                            severity: DiagnosticSeverity.Warning,
+                            code: "CEL_NONDETERMINISTIC_IN_COMPILE_FIELD",
                             source: SOURCE,
-                            message: `CEL syntax error at ${path}: ${f.message}`,
+                            message: `${m.kind}/${resource.name}: '${path}' is evaluated once at startup, so ${volatile.map((n) => `\`${n}()\``).join(", ")} ${volatile.length === 1 ? "is" : "are"} baked in at load and never re-evaluated. Move the expression to a field evaluated per call (x-telo-eval: runtime) if it should change over time.`,
                             data: { resource, filePath, path },
                         });
                     }
-                    else if (f.code === "CEL_UNKNOWN_FIELD") {
+                }
+                for (const f of result.diagnostics) {
+                    // A repair is applicable only when the analyzed expression covers
+                    // the whole scalar. For one `${{ }}` among literal text, replacing
+                    // the node would drop the text around it, so the correction stays
+                    // in the message and no fix is stamped.
+                    const fix = e.surface.whole ? rewrapFix(f.fix, e.surface.wrapper) : undefined;
+                    const data = { resource, filePath, path, ...(fix ? { fix } : {}) };
+                    if (f.code === "CEL_SYNTAX_ERROR") {
                         diagnostics.push({
                             severity: DiagnosticSeverity.Error,
-                            code: "CEL_UNKNOWN_FIELD",
+                            code: "CEL_SYNTAX_ERROR",
                             source: SOURCE,
-                            message: `${m.kind}/${resource.name}: CEL at '${path}': ${f.message}`,
-                            data: { resource, filePath, path },
+                            message: `CEL syntax error at ${path}: ${f.message}`,
+                            data,
                         });
                     }
-                    else if (f.code === "CEL_NULLABLE_ACCESS") {
+                    else if (f.code === undefined) {
+                        // No code from a future engine — pass the message through, tagged
+                        // with a generic ENGINE_DIAGNOSTIC code so downstream filters can
+                        // still bucket it.
                         diagnostics.push({
                             severity: DiagnosticSeverity.Error,
-                            code: "CEL_NULLABLE_ACCESS",
+                            code: "ENGINE_DIAGNOSTIC",
                             source: SOURCE,
-                            message: `${m.kind}/${resource.name}: CEL at '${path}': ${f.message}`,
-                            data: { resource, filePath, path },
+                            message: `${m.kind}/${resource.name}: !${engineName} at '${path}': ${f.message}`,
+                            data,
                         });
                     }
                     else {
-                        // Unknown code from a future engine — pass the message through,
-                        // tagged with a generic ENGINE_DIAGNOSTIC code so downstream
-                        // filters can still bucket it.
+                        // Named by ENGINE, not hardcoded to CEL: the seam exists so a
+                        // second engine can produce coded findings, and labelling them
+                        // `CEL` would misattribute the first one that does.
                         diagnostics.push({
                             severity: DiagnosticSeverity.Error,
-                            code: f.code ?? "ENGINE_DIAGNOSTIC",
+                            code: f.code,
                             source: SOURCE,
                             message: `${m.kind}/${resource.name}: !${engineName} at '${path}': ${f.message}`,
-                            data: { resource, filePath, path },
+                            data,
                         });
                     }
                 }
             },
         }, { aliases });
+        // The two halves of "does this expression fit the slot it flows into" meet
+        // here: the engine resolved the expression's type during the walk above,
+        // and the schema walk recorded the slot. An expression that failed to check
+        // recorded no type and is already reported by its own diagnostic.
+        for (const slot of celReturnSlots) {
+            const type = celTypeByPath.get(slot.manifest)?.get(slot.path);
+            if (type === undefined)
+                continue;
+            if (!celTypeSatisfiesJsonSchema(type.split("<")[0], slot.schema)) {
+                const expected = slot.schema["x-telo-type"] ?? slot.schema.type ?? "unknown";
+                diagnostics.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: "CEL_TYPE_ERROR",
+                    source: SOURCE,
+                    message: `${slot.resource.kind}/${slot.resource.name}: CEL at '${slot.path}' returns '${type}' but the field expects '${expected}'.`,
+                    data: { resource: slot.resource, filePath: slot.filePath, path: slot.path },
+                });
+                continue;
+            }
+            // The type fits; do its ARGUMENTS agree? Covariant and gradual — an
+            // omitted argument is *any* in both directions, so an unmigrated producer
+            // or consumer is never reported, and only a definite conflict is.
+            const produced = celSourceSchemaByPath.get(slot.manifest)?.get(slot.path);
+            if (!produced)
+                continue;
+            const { compatible, issues } = checkSchemaCompatibility(produced, slot.schema, (ref) => defs.schemaForId(ref));
+            if (compatible)
+                continue;
+            diagnostics.push({
+                severity: DiagnosticSeverity.Error,
+                code: "CEL_TYPE_ARGUMENT_MISMATCH",
+                source: SOURCE,
+                message: `${slot.resource.kind}/${slot.resource.name}: CEL at '${slot.path}' produces a value ` +
+                    `whose type arguments disagree with the field's: ${issues.join("; ")}.`,
+                data: { resource: slot.resource, filePath: slot.filePath, path: slot.path },
+            });
+        }
         // Validate resource references (Phase 3)
         diagnostics.push(...validateReferences(allManifests, { aliases, definitions: defs, aliasesByModule }));
         // Validate step `invoke` references — the slots the reference field map

package/dist/cel-environment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cel-environment.d.ts","sourceRoot":"","sources":["../src/cel-environment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAUrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;;;uEASuE;AACvE,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,gBAAgB,EAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,EAI/C,kBAAkB,CAAC,EAAE,gBAAgB,GACpC,WAAW,CAsEb;AAuBD;;;;;;8DAM8D;AAC9D,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,WAAW,EACpB,cAAc,EAAE,gBAAgB,GAAG,SAAS,GAC3C,WAAW,CAwBb"}
+{"version":3,"file":"cel-environment.d.ts","sourceRoot":"","sources":["../src/cel-environment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAarD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;;;uEASuE;AACvE,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,gBAAgB,EAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,EAI/C,kBAAkB,CAAC,EAAE,gBAAgB,GACpC,WAAW,CAsEb;AAuBD;;;;;;8DAM8D;AAC9D,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,WAAW,EACpB,cAAc,EAAE,gBAAgB,GAAG,SAAS,GAC3C,WAAW,CAwBb"}

package/dist/cel-environment.js

@@ -1,9 +1,12 @@
 import { jsonSchemaToCelType, VALUE_BRAND_BASE } from "./schema-compat.js";
 /** Transport protocol on a `ports` entry → the nominal CEL brand its resolved
- *  value carries. Mirrors the `protocol` enum in the Application schema. */
+ *  value carries. Mirrors the `protocol` enum in the Application schema, and
+ *  names the value types by their canonical `Telo.`-qualified names — the same
+ *  spelling an author writes at `x-telo-type`, so a branded port and a branded
+ *  field are comparable by name with nothing in between to translate. */
 const PORT_PROTOCOL_BRAND = {
-    tcp: "TcpPort",
-    udp: "UdpPort",
+    tcp: "Telo.TcpPort",
+    udp: "Telo.UdpPort",
 };
 export { buildCelEnvironment } from "@telorun/templating";
 /** Clone `baseEnv` and register typed variable declarations so that

package/dist/definition-registry.d.ts

@@ -55,6 +55,11 @@ export declare class DefinitionRegistry {
     /** True when a schema is registered under `id` (a canonical `telo://` type id
      *  or a definition `$id`). Used to flag schema `$ref`s that resolve to nothing. */
     hasSchemaId(id: string): boolean;
+    /** The schema registered under `id`, for a structural comparison that must see
+     *  THROUGH a named shape. Declaring a shape once and referencing it is the
+     *  sanctioned way to reuse one, so a comparator that cannot follow the
+     *  reference judges two opaque nodes and learns nothing. */
+    schemaForId(id: string): Record<string, any> | undefined;
     /** Validates data against a schema using this registry's AJV instance, which has all
      *  registered definition schemas loaded — enabling cross-module $ref resolution.
      *  A compile failure returns `[]` here; it is surfaced loudly (once, on the

package/dist/definition-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"definition-registry.d.ts","sourceRoot":"","sources":["../src/definition-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAIlC,+EAA+E;AAC/E,qBAAa,kBAAkB;;IAK7B;;sFAEkF;IAClF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IACzD;;mFAE+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IAEzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyC;IAC9D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D;;;;wEAIoE;IACpE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IAEzD,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI;IAoC9C,OAAO,CAAC,aAAa;IASrB;;;;;;;;;;;;;2FAauF;IACvF,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAK1E;;;;;;;;;;gFAU4E;IAC5E,uBAAuB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO;IAQzE;uFACmF;IACnF,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAIhC;;;;oFAIgF;IAChF,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE;IAWtE;;;;;;iCAM6B;IAC7B,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,GAAG,SAAS;IASnE;;;;4EAIwE;IACxE,OAAO,CAAC,iBAAiB;IAkBzB;;;;;;;;;;;;;;4BAcwB;IACxB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAShD,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAIrD;;;uCAGmC;IACnC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAWxD,gGAAgG;IAChG,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,GACvD,iBAAiB,GAAG,SAAS;IAOhC;;;;;;;;qFAQiF;IACjF,2BAA2B,CACzB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC1C,iBAAiB,GAAG,SAAS;IAkChC,OAAO,CAAC,uBAAuB;IA+B/B;;qEAEiE;IACjE,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAgBxD,KAAK,IAAI,MAAM,EAAE;CAGlB"}
+{"version":3,"file":"definition-registry.d.ts","sourceRoot":"","sources":["../src/definition-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAIlC,+EAA+E;AAC/E,qBAAa,kBAAkB;;IAK7B;;sFAEkF;IAClF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IACzD;;mFAE+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IAEzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyC;IAC9D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D;;;;wEAIoE;IACpE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IAEzD,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI;IAoC9C,OAAO,CAAC,aAAa;IASrB;;;;;;;;;;;;;2FAauF;IACvF,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAK1E;;;;;;;;;;gFAU4E;IAC5E,uBAAuB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO;IAQzE;uFACmF;IACnF,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAIhC;;;gEAG4D;IAC5D,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS;IAMxD;;;;oFAIgF;IAChF,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE;IAWtE;;;;;;iCAM6B;IAC7B,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,GAAG,SAAS;IASnE;;;;4EAIwE;IACxE,OAAO,CAAC,iBAAiB;IAkBzB;;;;;;;;;;;;;;4BAcwB;IACxB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAShD,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAIrD;;;uCAGmC;IACnC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAWxD,gGAAgG;IAChG,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,GACvD,iBAAiB,GAAG,SAAS;IAOhC;;;;;;;;qFAQiF;IACjF,2BAA2B,CACzB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC1C,iBAAiB,GAAG,SAAS;IAkChC,OAAO,CAAC,uBAAuB;IA+B/B;;qEAEiE;IACjE,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAgBxD,KAAK,IAAI,MAAM,EAAE;CAGlB"}

package/dist/definition-registry.js

@@ -117,6 +117,15 @@ export class DefinitionRegistry {
     hasSchemaId(id) {
         return this.registeredSchemaIds.has(id) || this.ajv.getSchema(id) !== undefined;
     }
+    /** The schema registered under `id`, for a structural comparison that must see
+     *  THROUGH a named shape. Declaring a shape once and referencing it is the
+     *  sanctioned way to reuse one, so a comparator that cannot follow the
+     *  reference judges two opaque nodes and learns nothing. */
+    schemaForId(id) {
+        const compiled = this.ajv.getSchema(id);
+        const schema = compiled?.schema;
+        return schema && typeof schema === "object" ? schema : undefined;
+    }
     /** Validates data against a schema using this registry's AJV instance, which has all
      *  registered definition schemas loaded — enabling cross-module $ref resolution.
      *  A compile failure returns `[]` here; it is surfaced loudly (once, on the

package/dist/index.d.ts

@@ -13,7 +13,7 @@ export { moduleScopedDefResolver, scopeResolverForModule } from "./alias-resolve
 export type { ModuleScopes } from "./alias-resolver.js";
 export { ancestorChain, contractDeclarer, controllerBearingAncestor, effectiveAuthorSchema, effectiveContractField, effectiveStatusSchema, hasOwnControllerOrTemplate, inheritedCapability, isInheritedDelegation, mappingFieldFor, needsContractMapping, resolveParent, } from "./extends-resolution.js";
 export type { ContractDirection, DefResolver } from "./extends-resolution.js";
-export { defaultBearingPaths, PERMISSIVE_CONTRACT, resolveContract, resolveContractSchema, withStreamPropertiesSkipped, } from "./invocation-contract.js";
+export { defaultBearingPaths, PERMISSIVE_CONTRACT, resolveContract, resolveContractSchema, withLiveValuesSkipped, } from "./invocation-contract.js";
 export type { ContractOrigin, ContractScope, ResolvedContract } from "./invocation-contract.js";
 export { hasIntermediateWildcard, parseRedactionPath, RedactionPathError, } from "./redaction-path.js";
 export type { RedactionSegment } from "./redaction-path.js";
@@ -23,7 +23,9 @@ export { buildReferenceFieldMap, isRefEntry, isScopeEntry } from "./reference-fi
 export type { ReferenceFieldMap, RefFieldEntry } from "./reference-field-map.js";
 export { hasDeclaredUse, isRefSlot, isRefUse, possibleUses, readRefSlot, REF_USES, refSlotAnnotation, rewriteRefSlotKinds, transfersControl, } from "./ref-slot.js";
 export type { RefSlot, RefUse, RefUseCases } from "./ref-slot.js";
-export { binaryKeyword, isBinarySlot, X_TELO_BINARY } from "./binary-slot.js";
+export { ANNOTATION_KEYWORDS, registerTeloKeywords, valueTypeKeyword, } from "./value-type-keyword.js";
+export { applyTextEdits, isPlainSafe, quoteStyleOf, renderFixReplacement, } from "./yaml-source-edit.js";
+export type { QuoteStyle, TextEdit } from "./yaml-source-edit.js";
 export { hasProvidesZone, hasRequiresZone, readProvidesZone, readRequiresZone, rewriteRequiresZoneKind, } from "./zone-slot.js";
 export type { ProvidesZoneSlot, RequiresZoneSlot } from "./zone-slot.js";
 export { deriveLibraryExportRequirements, projectZoneRequirements, runZoneAnalysis, zoneDocumentsSignature, } from "./resolve-zone-requirements.js";
@@ -33,6 +35,10 @@ export { validateZoneSlotDeclarations } from "./validate-zone-slots.js";
 export type { ZoneSlotIssue } from "./validate-zone-slots.js";
 export { validateDynamicSelectors, validateRefSlotDeclarations } from "./validate-ref-slots.js";
 export type { RefSlotIssue } from "./validate-ref-slots.js";
+export { validateValueTypeSlots } from "./validate-value-type-slots.js";
+export type { ValueTypeSlotIssue } from "./validate-value-type-slots.js";
+export { checkSchemaCompatibility } from "./schema-compat.js";
+export type { CompatibilityResult } from "./schema-compat.js";
 export { visitManifest } from "./manifest-visitor.js";
 export type { CelSiteEvent, ManifestVisitor, RefSiteEvent, ResourceEnterEvent, ResourceExitEvent, ScopeBoundaryEvent, SchemaFromSiteEvent, VisitOptions, } from "./manifest-visitor.js";
 export { Loader } from "./manifest-loader.js";
@@ -40,6 +46,8 @@ export { isModuleKind, MODULE_KINDS } from "./module-kinds.js";
 export type { ModuleKind } from "./module-kinds.js";
 export { parseLoadedFile } from "./parse-loaded-file.js";
 export type { ParseOptions } from "./parse-loaded-file.js";
+export { CORE_MIGRATIONS, migrateFileText, migrateManifests, NO_MIGRATIONS, parseMigrationEntry, remapMigratedPaths, } from "./migrations/index.js";
+export type { FileMigrations, MigrationEntry, MigrationRewrite } from "./migrations/index.js";
 export { desugarLoadedFile, inlineImportManifests } from "./inline-imports.js";
 export type { SyntheticImport } from "./inline-imports.js";
 export { compareModuleVersions, compareParsedModuleVersions, isNewerModuleVersion, isSameModuleVersion, newestModuleVersion, parseModuleVersion, } from "./module-version-order.js";
@@ -64,6 +72,8 @@ export { MANIFEST_CACHE_BASE_URL, ManifestCacheSource, isHttpsModuleRef, manifes
 export type { ManifestCacheCoords } from "./sources/manifest-cache.js";
 export { LAYER_ROLES, PLATFORM_AXES, ArtifactSelectorError, describeSelector, isLayerRole, normalizeSelector, selectorFromQualifiers, selectorKey, selectorMatches, } from "./artifact-selector.js";
 export type { ArtifactSelector, LayerRole, PlatformAxis, PlatformTarget, } from "./artifact-selector.js";
+export { collectModuleFileClaims } from "./module-file-claims.js";
+export type { ModuleFileClaim } from "./module-file-claims.js";
 export { LayerIndexError, matchControllerLayers, parseLayerIndex, singletonLayer, } from "./artifact-layer-index.js";
 export type { ArtifactLayer } from "./artifact-layer-index.js";
 export { validateModuleArtifact } from "./validate-module-artifact.js";
@@ -73,6 +83,6 @@ export { documentToAst, parseToAst } from "./yaml-ast.js";
 export type { AstDocument, AstMap, AstNode, AstPair, AstScalar, AstSeq } from "./yaml-ast.js";
 export { CelParseError, buildCelSegments, wrapCelAst } from "./cel-ast.js";
 export type { CelNode, CelSegment } from "./cel-ast.js";
-export { DEFAULT_MANIFEST_FILENAME, DiagnosticSeverity } from "./types.js";
-export type { AnalysisDiagnostic, AnalysisOptions, LoaderInitOptions, LoadOptions, ManifestSource, Position, PositionIndex, Range } from "./types.js";
+export { DEFAULT_MANIFEST_FILENAME, DiagnosticSeverity, diagnosticFix } from "./types.js";
+export type { AnalysisDiagnostic, AnalysisOptions, DiagnosticData, DiagnosticFix, LoaderInitOptions, LoadOptions, ManifestSource, Position, PositionIndex, Range } from "./types.js";
 //# sourceMappingURL=index.d.ts.map