@telorun/analyzer 0.57.0 → 0.58.0

package/src/validate-value-type-slots.ts

@@ -0,0 +1,182 @@
+/**
+ * Static validation of the `x-telo-type` annotation itself — the strict half of
+ * the accessor split, and the `validate-ref-slots.ts` precedent.
+ *
+ * `readValueTypeSlot` is deliberately lenient: it reports whatever it can read,
+ * returning a slot with no `entry` for a name it does not know. That leniency is
+ * what lets every surface keep working; this pass is what stops it becoming
+ * silence. Before the unification an unrecognized brand simply resolved to
+ * `undefined` and the slot quietly lost its identity — the same class of failure
+ * `X_TELO_REF_INVALID_USE` exists to prevent for `use` tokens.
+ *
+ * The vocabulary is CLOSED and `Telo.`-qualified, so there is nothing here to
+ * resolve against an alias scope: a name is a built-in or it is a mistake. A
+ * SHAPE is a different thing entirely and is named with the reference tag, which
+ * carries its own resolution and its own diagnostics — this pass never sees one,
+ * because `resolveSchemaTypeRefs` has already turned it into a `$ref`.
+ *
+ * Scoping follows `X_TELO_REF_UNRESOLVED`: reported only for manifests in the
+ * entry's own modules, since a published dependency is not the consumer's to fix.
+ *
+ * Browser-safe: no Node built-ins.
+ */
+import { readValueTypeSlot, VALUE_TYPES, X_TELO_TYPE, type ResourceManifest } from "@telorun/sdk";
+import { distance } from "./levenshtein.js";
+import { isInSchemaRegion } from "./schema-region.js";
+
+export interface ValueTypeSlotIssue {
+  code: "X_TELO_TYPE_UNKNOWN" | "X_TELO_TYPE_ARGUMENT_UNKNOWN";
+  manifest: ResourceManifest;
+  /** Dotted path to the annotated schema node, e.g. `schema.properties.body`. */
+  path: string;
+  message: string;
+  /** The whole-value replacement that repairs it, when one is derivable. A
+   *  misspelled name has a single correct spelling and the annotation's value is
+   *  that name, so the repair is the primitive `DiagnosticFix` already carries —
+   *  computing a suggestion and printing it in prose alone leaves the author to
+   *  retype what the analyzer already knows. Only for the bare-name spelling: the
+   *  object form's name is nested, and a whole-value replacement there would
+   *  discard the type arguments beside it. */
+  fix?: { replacement: string };
+}
+
+/** Schema regions are reached by ANCESTRY, not by root key — see
+ *  `schema-region.ts`. Walking a manifest's root fields covers only a fraction of
+ *  the sites an author writes a schema at: an API route's `request.schema.body`
+ *  sits under `routes`, and a check that never reaches it is a hole in exactly
+ *  the diagnostic that exists to stop an unknown name degrading silently. */
+
+/** The closest declared type name within an edit-distance threshold, or
+ *  undefined. Mirrors `computeSuggestKind`: case-sensitive, and silent on a tie,
+ *  because a coin-flip suggestion is worse than none. */
+function suggestValueType(name: string): string | undefined {
+  if (!name) return undefined;
+  const threshold = Math.min(3, Math.floor(name.length / 3));
+  if (threshold < 1) return undefined;
+  let best: string | undefined;
+  let bestDist = threshold + 1;
+  let tied = false;
+  for (const candidate of VALUE_TYPES.keys()) {
+    const d = distance(name, candidate);
+    if (d < bestDist) {
+      best = candidate;
+      bestDist = d;
+      tied = false;
+    } else if (d === bestDist) {
+      tied = true;
+    }
+  }
+  return !best || bestDist > threshold || tied ? undefined : best;
+}
+
+function declaredNames(): string {
+  return [...VALUE_TYPES.keys()].join(", ");
+}
+
+/** Report the annotation on one schema node. */
+function checkNode(
+  node: Record<string, unknown>,
+  manifest: ResourceManifest,
+  path: string,
+  issues: ValueTypeSlotIssue[],
+): void {
+  const slot = readValueTypeSlot(node);
+  if (!slot) return;
+
+  if (!slot.entry) {
+    const suggestion = suggestValueType(slot.name);
+    // Only the bare-name spelling can carry the repair: it IS the annotation's
+    // whole value, which is the only shape `DiagnosticFix` describes.
+    const bareName = typeof (node as Record<string, unknown>)[X_TELO_TYPE] === "string";
+    issues.push({
+      code: "X_TELO_TYPE_UNKNOWN",
+      manifest,
+      path,
+      message:
+        `'${slot.name || "(missing name)"}' is not a value type. ` +
+        (suggestion ? `Did you mean '${suggestion}'? ` : "") +
+        `Declared types: ${declaredNames()}. A value type names how a value is ` +
+        `REPRESENTED and is kernel-owned; to name a shape, reference it with !ref.`,
+      ...(suggestion && bareName ? { fix: { replacement: suggestion } } : {}),
+    });
+    return;
+  }
+
+  const declared = new Set(slot.entry.parameters.map((p) => p.name));
+  for (const argument of Object.keys(slot.args)) {
+    if (declared.has(argument)) continue;
+    issues.push({
+      code: "X_TELO_TYPE_ARGUMENT_UNKNOWN",
+      manifest,
+      path,
+      message:
+        `'${slot.entry.name}' declares no type parameter '${argument}'. ` +
+        (declared.size > 0
+          ? `Its parameters: ${[...declared].join(", ")}.`
+          : `It takes no type parameters.`),
+    });
+  }
+}
+
+/** Walk a schema value, reporting every annotation it carries.
+ *
+ *  Descends through every container rather than through a keyword list: a value
+ *  type is legal at any schema position — a property, an item, a union branch, a
+ *  `$defs` entry, a type argument — and enumerating positions is how a check
+ *  ends up not covering the one an author used. */
+function walk(
+  value: unknown,
+  manifest: ResourceManifest,
+  path: string,
+  segments: (string | number)[],
+  seen: Set<object>,
+  issues: ValueTypeSlotIssue[],
+): void {
+  if (value === null || typeof value !== "object") return;
+  if (seen.has(value)) return;
+  seen.add(value);
+  if (Array.isArray(value)) {
+    value.forEach((item, i) =>
+      walk(item, manifest, `${path}[${i}]`, [...segments, i], seen, issues),
+    );
+    return;
+  }
+  const node = value as Record<string, unknown>;
+  // Report only inside a schema region. The walk itself is unbounded — reporting
+  // is safe anywhere, unlike a rewrite — but an `x-telo-type` key sitting in a
+  // resource's own configuration is not a schema annotation and is not this
+  // check's to judge.
+  if (isInSchemaRegion([...segments, X_TELO_TYPE])) {
+    checkNode(node, manifest, path, issues);
+  }
+  for (const [key, child] of Object.entries(node)) {
+    // The annotation's own value is read by `checkNode`; descending into it
+    // would report the type ARGUMENTS as if they were annotated nodes of their
+    // own. Their turn comes below, as ordinary schema nodes.
+    if (key === X_TELO_TYPE) {
+      // Walk the NORMALIZED arguments, so a bare-name argument (`of: Telo.Bytes`)
+      // is checked exactly as its expanded form is — the sugar must not be a
+      // hole in the check that exists to catch a misspelled name.
+      const slot = readValueTypeSlot(node);
+      for (const [argName, argValue] of Object.entries(slot?.args ?? {})) {
+        walk(
+          argValue,
+          manifest,
+          `${path}.${X_TELO_TYPE}.${argName}`,
+          [...segments, X_TELO_TYPE, argName],
+          seen,
+          issues,
+        );
+      }
+      continue;
+    }
+    walk(child, manifest, path ? `${path}.${key}` : key, [...segments, key], seen, issues);
+  }
+}
+
+/** Every `x-telo-type` problem in one manifest, wherever a schema is written. */
+export function validateValueTypeSlots(manifest: ResourceManifest): ValueTypeSlotIssue[] {
+  const issues: ValueTypeSlotIssue[] = [];
+  walk(manifest, manifest, "", [], new Set<object>(), issues);
+  return issues;
+}

package/src/value-type-keyword.ts

@@ -0,0 +1,135 @@
+/** The AJV half of `x-telo-type`, and the single place any Telo keyword is
+ *  registered on an AJV instance.
+ *
+ *  WHY CODEGEN RATHER THAN A `validate` FUNCTION. The kernel compiles standalone
+ *  validators and caches them on disk; a function-valued keyword does not survive
+ *  that serialization, so the check would silently be absent from exactly the
+ *  validators the runtime uses. Codegen inlines instead.
+ *
+ *  WHY THE CODEGEN LIVES HERE AND THE VOCABULARY DOES NOT. The SDK cannot depend
+ *  on ajv, and an entry declares a REPRESENTATION rather than a code fragment —
+ *  which is what lets one JSON file be read by a Rust kernel that has no AJV at
+ *  all. The split is the whole point: `sdk/value-types/*.json` says *what a value
+ *  is*, `sdk/nodejs/src/value-type.ts` says *what that means in this runtime*,
+ *  and this file turns the pair into a check.
+ *
+ *  ONE REGISTRATION SITE. {@link registerTeloKeywords} replaced five drifted
+ *  ones — the analyzer's `createAjv` and the kernel's `schema-validator`,
+ *  `resource-context`, `observed-state` and `manifest-schemas` — which registered
+ *  overlapping lists of twelve, four, one and one. Drift there is not cosmetic: a
+ *  no-op registration is what keeps `strict` mode quiet about an annotation, and
+ *  a keyword that emits code is missing entirely from any instance that forgot
+ *  it, so the same schema validated two ways depending on which AJV saw it. */
+
+import * as AjvNS from "ajv";
+import type { KeywordDefinition } from "ajv";
+import {
+  VALUE_TYPE_BINDINGS,
+  X_TELO_TYPE,
+  readValueTypeSlot,
+  type ValueTypeEntry,
+} from "@telorun/sdk";
+
+// AJV's codegen template tag. The package is consumed in both ESM and CJS interop
+// shapes, so the named export may sit on the namespace or behind `.default` —
+// the same fallback `schema-compat` uses to reach the constructor. Skipping it
+// would leave `codegen` undefined under a loader that does not detect AJV's named
+// CJS re-exports, and the keyword would throw on its first compile.
+type CodegenTag = (s: TemplateStringsArray, ...a: unknown[]) => unknown;
+const ajvExports = (AjvNS as any).default ?? AjvNS;
+const codegen: CodegenTag = ajvExports._ ?? (AjvNS as any)._;
+
+/**
+ * Annotations that carry no validation at all: analyzer, editor and topology
+ * metadata. Registered as no-ops so AJV does not treat them as unknown keywords,
+ * and listed in one place so an instance cannot know about half of them.
+ *
+ * `x-telo-type` is deliberately absent — it is the one that emits code.
+ */
+export const ANNOTATION_KEYWORDS = [
+  "x-telo-bindings-from",
+  "x-telo-catches-for",
+  "x-telo-context",
+  "x-telo-context-element-from",
+  "x-telo-context-from",
+  "x-telo-context-from-ref-kind",
+  "x-telo-context-from-root",
+  "x-telo-context-ref-from",
+  "x-telo-error-context",
+  "x-telo-eval",
+  "x-telo-inline",
+  "x-telo-outcome-list",
+  "x-telo-provides-zone",
+  "x-telo-ref",
+  "x-telo-requires-zone",
+  "x-telo-schema-from",
+  "x-telo-scope",
+  "x-telo-step-context",
+  "x-telo-topology-role",
+  "x-telo-value-schema-from",
+  "x-telo-widget",
+] as const;
+
+/**
+ * The `x-telo-type` keyword.
+ *
+ * Three postures, decided by the entry and never by this code:
+ *
+ *  - a `json` representation validates through its own declared schema, so the
+ *    keyword emits nothing — the name carries nominal identity for static wiring
+ *    and has no runtime existence at all;
+ *  - a `live` instance is EXEMPT: its value is never traversed, because iterating
+ *    a stream to check it is precisely what the exemption is for;
+ *  - every other instance is ASSERTED against the constructor its binding names.
+ *
+ * An unknown name emits nothing here. It is a hard diagnostic in the analyzer
+ * (`X_TELO_TYPE_UNKNOWN`), which is where a name can be reported against the
+ * manifest that wrote it; failing compilation instead would take out every
+ * validator in a module for one typo in one slot.
+ */
+export function valueTypeKeyword(): KeywordDefinition {
+  return {
+    keyword: X_TELO_TYPE,
+    // Both spellings: a bare name, or the object form carrying type arguments.
+    schemaType: ["string", "object"],
+    code(cxt: any) {
+      const entry: ValueTypeEntry | undefined = readValueTypeSlot({
+        [X_TELO_TYPE]: cxt.schema,
+      })?.entry;
+      if (!entry || entry.representation !== "instance" || entry.live) return;
+      const binding = VALUE_TYPE_BINDINGS[entry.binding!];
+      if (!binding) return;
+      // The constructor reaches generated code through AJV's value scope, which
+      // is what keeps this general: `Uint8Array` happens to be a global, but a
+      // binding may name a class that is not, and inlining a bare identifier
+      // would compile to a reference that does not resolve.
+      const ctor = cxt.gen.scopeValue("obj", {
+        ref: binding.constructor,
+        code: codegen`require("@telorun/sdk").VALUE_TYPE_BINDINGS[${entry.binding!}].constructor`,
+      });
+      cxt.pass(codegen`${cxt.data} instanceof ${ctor}`);
+    },
+    error: {
+      message: (cxt: any) => {
+        const entry = readValueTypeSlot({ [X_TELO_TYPE]: cxt.schema })?.entry;
+        return entry?.binding === "bytes"
+          ? "must be raw bytes (a Uint8Array) — bytes cannot be written inline in a manifest"
+          : `must be a ${entry?.name ?? "declared value type"} — this value is not writable inline in a manifest`;
+      },
+    },
+  } as KeywordDefinition;
+}
+
+/**
+ * Register every Telo keyword on an AJV instance: the annotations as no-ops and
+ * `x-telo-type` as the one that checks.
+ *
+ * Every AJV instance in the runtime and the analyzer goes through this, so a
+ * schema means the same thing wherever it is validated.
+ */
+export function registerTeloKeywords(ajv: {
+  addKeyword: (keyword: any, definition?: any) => unknown;
+}): void {
+  for (const keyword of ANNOTATION_KEYWORDS) ajv.addKeyword(keyword);
+  ajv.addKeyword(valueTypeKeyword());
+}

package/src/yaml-source-edit.ts

@@ -0,0 +1,106 @@
+/** Writing a value back into YAML SOURCE — the two primitives every in-place
+ *  repair is built from, and the one place their rules are stated.
+ *
+ *  A repair is a byte splice over the author's own text, never
+ *  `Document.toString()`: re-serializing re-folds block scalars, drops
+ *  quote-style hints and reflows long strings, so a one-key edit would arrive
+ *  as a whole-file diff. That leaves two questions every writer has to answer
+ *  identically — how a value is re-quoted to occupy a span, and how overlapping
+ *  spans are spliced — and three surfaces asking them: the editors' quick fix
+ *  (`@telorun/ide-support`), `telo migrate` (the migration driver), and
+ *  `telo upgrade`'s pin rewrite.
+ *
+ *  They live HERE, in the lowest package of the three, because they are pure
+ *  string work with no Node dependency and because a copy per surface is a
+ *  silent-divergence risk of exactly the kind Telo's cross-cutting primitives
+ *  rule exists to prevent: two writers editing the same file from two copies of
+ *  a subtle quoting rule will eventually quote one value two ways, and nothing
+ *  would catch it. Same precedent as `ref-slot.ts` / `binary-slot.ts` — a rule
+ *  several surfaces must agree on gets one reader. */
+
+/** Characters that make a plain (unquoted) YAML scalar reparse as something
+ *  else. `-` and `?` are indicators only when followed by a space, so they are
+ *  handled by the leading-token check rather than listed here. */
+const PLAIN_UNSAFE_LEAD = new Set([
+  "&", "*", "!", "|", ">", "%", "@", "`", "#", "'", '"', "{", "[", "}", "]", ",",
+]);
+
+/** Whether `value` can be written as a plain scalar without changing meaning. */
+export function isPlainSafe(value: string): boolean {
+  if (value === "" || value.trim() !== value) return false;
+  if (PLAIN_UNSAFE_LEAD.has(value[0]!)) return false;
+  // `-`/`?`/`:` lead only matter when a space follows — `-x` is a scalar,
+  // `- x` is a sequence entry.
+  if (/^[-?:]\s/.test(value)) return false;
+  // A colon-space anywhere opens a mapping; a space-hash opens a comment.
+  if (value.includes(": ") || value.includes(" #")) return false;
+  if (value.endsWith(":")) return false;
+  return !/[\n\r]/.test(value);
+}
+
+/** Quote style of the source text a repair is replacing. */
+export type QuoteStyle = "double" | "single" | "plain";
+
+export function quoteStyleOf(source: string): QuoteStyle {
+  if (source.length >= 2 && source.startsWith('"') && source.endsWith('"')) return "double";
+  if (source.length >= 2 && source.startsWith("'") && source.endsWith("'")) return "single";
+  return "plain";
+}
+
+/** Render `replacement` so it occupies `originalSource`'s span as the same
+ *  scalar the author would have written by hand, or `undefined` when the span
+ *  cannot be rewritten safely.
+ *
+ *  A plain original is kept plain when it can be — rewriting `Run.Sequenc` to
+ *  `"Run.Sequence"` would be a correct but noisy diff on a kind name — and
+ *  promoted to double quotes when the new value would not survive unquoted.
+ *
+ *  **A multi-line span is refused.** A block scalar's span covers its `|`/`>-`
+ *  indicator AND its trailing newline, so writing a single-line scalar over it
+ *  deletes the line break that ended the mapping entry and glues the next key
+ *  onto the value — the document stops parsing. Re-emitting a block scalar
+ *  correctly needs the node's indentation, which no consumer of this function
+ *  has. A multi-line REPLACEMENT is refused for the mirror reason: its
+ *  continuation lines would land at column 0, which is not a legal mapping
+ *  value. A quick fix promises a repair that can be applied without review, so
+ *  the only honest answer for these is no repair. */
+export function renderFixReplacement(
+  originalSource: string,
+  replacement: string,
+): string | undefined {
+  if (/[\n\r]/.test(originalSource) || /[\n\r]/.test(replacement)) return undefined;
+  const style = quoteStyleOf(originalSource);
+
+  if (style === "single") {
+    // A single-quoted YAML scalar escapes only the quote, by doubling it. CEL
+    // string literals use single quotes constantly, so this is the common case
+    // for an expression written in a single-quoted scalar.
+    return `'${replacement.replaceAll("'", "''")}'`;
+  }
+  if (style === "double" || !isPlainSafe(replacement)) {
+    return `"${replacement.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+  }
+  return replacement;
+}
+
+/** A splice over a source file: replace `[start, end)` with `newText`. An empty
+ *  span is a pure insertion. */
+export interface TextEdit {
+  /** Byte offset of the first replaced character (inclusive). */
+  readonly start: number;
+  /** Byte offset one past the last replaced character. */
+  readonly end: number;
+  readonly newText: string;
+}
+
+/** Splice `edits` into `text`, right to left so earlier offsets stay valid.
+ *  Callers are responsible for edits not overlapping; two splices contending
+ *  for the same bytes cannot both be honoured, and this does not arbitrate. */
+export function applyTextEdits(text: string, edits: readonly TextEdit[]): string {
+  if (edits.length === 0) return text;
+  let out = text;
+  for (const edit of [...edits].sort((a, b) => b.start - a.start)) {
+    out = out.slice(0, edit.start) + edit.newText + out.slice(edit.end);
+  }
+  return out;
+}

package/dist/binary-slot.d.ts

@@ -1,39 +0,0 @@
-import type { KeywordDefinition } from "ajv";
-/**
- * `x-telo-binary: true` — the annotation that gives a byte buffer a declared
- * identity, and the single accessor every surface reads it through (the
- * `ref-slot.ts` precedent).
- *
- * WHY AN ANNOTATION RATHER THAN A TYPE. Bytes are not expressible in JSON
- * Schema's type vocabulary. `type: object` is the closest fit and it is a lie
- * that costs a real check: every arbitrary object satisfies it, so a mistyped
- * `content: { foo: bar }` reaches the controller instead of failing statically.
- * `type: binary` would fix the honesty and break everything else — AJV refuses
- * to compile an unknown type at all (`type must be JSONType or JSONType[]`),
- * with no option to allow it, so the schema would produce no validator; and a
- * published `telo.yaml` would stop being JSON Schema, which is what the hub, the
- * editor and any third-party reader consume. An `x-` keyword is ignored by
- * unaware tooling BY SPECIFICATION, so it degrades to "unconstrained" rather
- * than to "cannot validate this kind at all".
- *
- * ONE RULE, BOTH HALVES. The keyword is implemented as AJV CODEGEN rather than a
- * `validate` function so it inlines into standalone-compiled validators — the
- * kernel compiles and caches those, and a function-valued keyword would not
- * survive serialization. The analyzer registers the identical keyword, and
- * `celPlaceholderForSchema` hands a real `Uint8Array` to a CEL leaf at a binary
- * slot, so static and runtime agree by construction instead of by two rules kept
- * in step. What falls out is the check the annotation exists for: **bytes can
- * never be manifest-authored** — no YAML literal is a `Uint8Array` — so a literal
- * at a binary slot is rejected while a value arriving by reference passes.
- */
-export declare const X_TELO_BINARY = "x-telo-binary";
-/** True when this schema node declares its value to be raw bytes. */
-export declare function isBinarySlot(schema: unknown): boolean;
-/**
- * The AJV keyword. `Uint8Array` is the structural test rather than any richer
- * notion of "binary": it is what every byte producer in the runtime hands over
- * (`Buffer` extends it, so Node buffers pass), and it is the one check that means
- * the same thing in a browser-side analyzer and in the kernel.
- */
-export declare function binaryKeyword(): KeywordDefinition;
-//# sourceMappingURL=binary-slot.d.ts.map

package/dist/binary-slot.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"binary-slot.d.ts","sourceRoot":"","sources":["../src/binary-slot.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,KAAK,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAE7C,qEAAqE;AACrE,wBAAgB,YAAY,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAMrD;AAWD;;;;;GAKG;AACH,wBAAgB,aAAa,IAAI,iBAAiB,CAajD"}

package/dist/binary-slot.js

@@ -1,58 +0,0 @@
-import * as AjvNS from "ajv";
-/**
- * `x-telo-binary: true` — the annotation that gives a byte buffer a declared
- * identity, and the single accessor every surface reads it through (the
- * `ref-slot.ts` precedent).
- *
- * WHY AN ANNOTATION RATHER THAN A TYPE. Bytes are not expressible in JSON
- * Schema's type vocabulary. `type: object` is the closest fit and it is a lie
- * that costs a real check: every arbitrary object satisfies it, so a mistyped
- * `content: { foo: bar }` reaches the controller instead of failing statically.
- * `type: binary` would fix the honesty and break everything else — AJV refuses
- * to compile an unknown type at all (`type must be JSONType or JSONType[]`),
- * with no option to allow it, so the schema would produce no validator; and a
- * published `telo.yaml` would stop being JSON Schema, which is what the hub, the
- * editor and any third-party reader consume. An `x-` keyword is ignored by
- * unaware tooling BY SPECIFICATION, so it degrades to "unconstrained" rather
- * than to "cannot validate this kind at all".
- *
- * ONE RULE, BOTH HALVES. The keyword is implemented as AJV CODEGEN rather than a
- * `validate` function so it inlines into standalone-compiled validators — the
- * kernel compiles and caches those, and a function-valued keyword would not
- * survive serialization. The analyzer registers the identical keyword, and
- * `celPlaceholderForSchema` hands a real `Uint8Array` to a CEL leaf at a binary
- * slot, so static and runtime agree by construction instead of by two rules kept
- * in step. What falls out is the check the annotation exists for: **bytes can
- * never be manifest-authored** — no YAML literal is a `Uint8Array` — so a literal
- * at a binary slot is rejected while a value arriving by reference passes.
- */
-export const X_TELO_BINARY = "x-telo-binary";
-/** True when this schema node declares its value to be raw bytes. */
-export function isBinarySlot(schema) {
-    return (typeof schema === "object" &&
-        schema !== null &&
-        schema[X_TELO_BINARY] === true);
-}
-const ajvExports = AjvNS.default ?? AjvNS;
-const codegen = ajvExports._ ?? AjvNS._;
-/**
- * The AJV keyword. `Uint8Array` is the structural test rather than any richer
- * notion of "binary": it is what every byte producer in the runtime hands over
- * (`Buffer` extends it, so Node buffers pass), and it is the one check that means
- * the same thing in a browser-side analyzer and in the kernel.
- */
-export function binaryKeyword() {
-    return {
-        keyword: X_TELO_BINARY,
-        schemaType: "boolean",
-        code(cxt) {
-            // `x-telo-binary: false` states nothing, so it constrains nothing.
-            if (cxt.schema !== true)
-                return;
-            cxt.pass(codegen `${cxt.data} instanceof Uint8Array`);
-        },
-        error: {
-            message: "must be raw bytes (a Uint8Array) — bytes cannot be written inline in a manifest",
-        },
-    };
-}

package/src/binary-slot.ts

@@ -1,71 +0,0 @@
-import * as AjvNS from "ajv";
-import type { KeywordDefinition } from "ajv";
-
-/**
- * `x-telo-binary: true` — the annotation that gives a byte buffer a declared
- * identity, and the single accessor every surface reads it through (the
- * `ref-slot.ts` precedent).
- *
- * WHY AN ANNOTATION RATHER THAN A TYPE. Bytes are not expressible in JSON
- * Schema's type vocabulary. `type: object` is the closest fit and it is a lie
- * that costs a real check: every arbitrary object satisfies it, so a mistyped
- * `content: { foo: bar }` reaches the controller instead of failing statically.
- * `type: binary` would fix the honesty and break everything else — AJV refuses
- * to compile an unknown type at all (`type must be JSONType or JSONType[]`),
- * with no option to allow it, so the schema would produce no validator; and a
- * published `telo.yaml` would stop being JSON Schema, which is what the hub, the
- * editor and any third-party reader consume. An `x-` keyword is ignored by
- * unaware tooling BY SPECIFICATION, so it degrades to "unconstrained" rather
- * than to "cannot validate this kind at all".
- *
- * ONE RULE, BOTH HALVES. The keyword is implemented as AJV CODEGEN rather than a
- * `validate` function so it inlines into standalone-compiled validators — the
- * kernel compiles and caches those, and a function-valued keyword would not
- * survive serialization. The analyzer registers the identical keyword, and
- * `celPlaceholderForSchema` hands a real `Uint8Array` to a CEL leaf at a binary
- * slot, so static and runtime agree by construction instead of by two rules kept
- * in step. What falls out is the check the annotation exists for: **bytes can
- * never be manifest-authored** — no YAML literal is a `Uint8Array` — so a literal
- * at a binary slot is rejected while a value arriving by reference passes.
- */
-
-export const X_TELO_BINARY = "x-telo-binary";
-
-/** True when this schema node declares its value to be raw bytes. */
-export function isBinarySlot(schema: unknown): boolean {
-  return (
-    typeof schema === "object" &&
-    schema !== null &&
-    (schema as Record<string, unknown>)[X_TELO_BINARY] === true
-  );
-}
-
-// AJV's codegen template tag. The package is consumed in both ESM and CJS interop
-// shapes, so the named export may sit on the namespace or behind `.default` —
-// the same fallback `schema-compat` uses to reach the constructor. Skipping it
-// would leave `codegen` undefined under a loader that does not detect AJV's named
-// CJS re-exports, and the keyword would throw on its first compile.
-type CodegenTag = (s: TemplateStringsArray, ...a: unknown[]) => unknown;
-const ajvExports = (AjvNS as any).default ?? AjvNS;
-const codegen: CodegenTag = ajvExports._ ?? (AjvNS as any)._;
-
-/**
- * The AJV keyword. `Uint8Array` is the structural test rather than any richer
- * notion of "binary": it is what every byte producer in the runtime hands over
- * (`Buffer` extends it, so Node buffers pass), and it is the one check that means
- * the same thing in a browser-side analyzer and in the kernel.
- */
-export function binaryKeyword(): KeywordDefinition {
-  return {
-    keyword: X_TELO_BINARY,
-    schemaType: "boolean",
-    code(cxt: any) {
-      // `x-telo-binary: false` states nothing, so it constrains nothing.
-      if (cxt.schema !== true) return;
-      cxt.pass(codegen`${cxt.data} instanceof Uint8Array`);
-    },
-    error: {
-      message: "must be raw bytes (a Uint8Array) — bytes cannot be written inline in a manifest",
-    },
-  } as KeywordDefinition;
-}