@telorun/analyzer 0.57.0 → 0.58.0

package/dist/schema-compat.js

@@ -1,7 +1,8 @@
 import AjvModule from "ajv";
 import addFormats from "ajv-formats";
-import { INCLUDE_BYTES_ENGINE, INCLUDE_ENGINE_NAMES, isRefSentinel, isTaggedSentinel, ManifestRootSchema, normalizeRefSlots, } from "@telorun/templating";
-import { binaryKeyword, isBinarySlot } from "./binary-slot.js";
+import { isRefSentinel, isTaggedSentinel, ManifestRootSchema, producedTypeOf, } from "@telorun/templating";
+import { celBaseOfValueType, celTypeOfValueType, readValueTypeSlot, valueBrandBases, valueTypeOf, valueTypePlaceholder, } from "@telorun/sdk";
+import { registerTeloKeywords } from "./value-type-keyword.js";
 const Ajv = AjvModule.default ?? AjvModule;
 /** Creates a configured AJV instance (allErrors, strict: false, with formats).
  *  Also registers the kernel manifest root schema under `telo://manifest` so
@@ -16,53 +17,144 @@ export function createAjv() {
     addFormats.default
         ? addFormats.default(instance)
         : addFormats(instance);
-    // Bytes have no JSON Schema type, so the annotation carries the check. Registered
-    // here and in the kernel's validators from one definition, so a literal at a byte
-    // slot is rejected statically and at dispatch by the identical rule.
-    instance.addKeyword(binaryKeyword());
+    // One registration site for every Telo keyword — the annotations as no-ops and
+    // `x-telo-type` as the one that checks. Registered here and in the kernel's
+    // validators from one definition, so a literal at an instance-typed slot is
+    // rejected statically and at dispatch by the identical rule.
+    registerTeloKeywords(instance);
     instance.addSchema(ManifestRootSchema);
     return instance;
 }
 const ajv = createAjv();
 const compiledSchemaValidators = new WeakMap();
-/** Conservative structural JSON Schema compatibility check.
- *  Only flags definite mismatches: missing required fields and primitive type conflicts.
- *  Ambiguous cases (anyOf/oneOf/etc.) are treated as compatible. */
-export function checkSchemaCompatibility(source, target) {
+/**
+ * Conservative structural JSON Schema compatibility check — is a value shaped
+ * like `source` acceptable where `target` is declared?
+ *
+ * COVARIANT, because the values this compares are consumed by reading: a
+ * narrower element satisfies a slot declaring a wider one. Only DEFINITE
+ * mismatches are flagged — a missing required field, a primitive type conflict,
+ * a disagreeing type argument. Anything ambiguous (`anyOf` / `oneOf` / `allOf`,
+ * an absent `type`, an undeclared argument) is treated as compatible, so an
+ * unmigrated producer and consumer keep checking exactly as they did.
+ *
+ * The traversal is written here rather than reused: the function this replaced
+ * compared only `type` for the names in `target.required` and descended only
+ * into objects, so a stream of arrays of strings and a stream of arrays of
+ * integers both read as `array` and passed — leaving argument checking inert on
+ * exactly the nested shapes it exists for. What survives from it is its posture.
+ *
+ * `resolveRef` sees through a named shape. Declaring a shape once and
+ * referencing it is the sanctioned way to reuse one, so without it two such
+ * arguments present as opaque nodes carrying no information — the same reason
+ * {@link withLiveValuesSkipped} takes one.
+ */
+export function checkSchemaCompatibility(source, target, resolveRef) {
     const issues = [];
-    checkObject(source, target, "", issues);
+    compare(source, target, "", issues, resolveRef, new Set());
     return { compatible: issues.length === 0, issues };
 }
-function checkObject(source, target, path, issues) {
-    const targetRequired = target.required ?? [];
+function deref(schema, resolveRef) {
+    if (!resolveRef || typeof schema.$ref !== "string")
+        return schema;
+    return resolveRef(schema.$ref) ?? schema;
+}
+function compare(rawSource, rawTarget, path, issues, resolveRef, seen) {
+    if (!rawSource || !rawTarget || typeof rawSource !== "object" || typeof rawTarget !== "object") {
+        return;
+    }
+    // A recursive shape reached through the same pair of references twice is the
+    // same question again; answering it once terminates and loses nothing.
+    //
+    // The key is the REFERENCE PAIR and deliberately not the path. A path grows on
+    // every descent, so a key containing it is new every time and the guard never
+    // fires — which is a stack overflow on the first self-referential shape, taking
+    // every other diagnostic in the file with it. It also has to be this way to be
+    // correct rather than merely terminating: comparing two schemas gives the same
+    // answer wherever they are reached from, so the second visit has nothing to add.
+    if (typeof rawSource.$ref === "string" && typeof rawTarget.$ref === "string") {
+        const key = `${rawSource.$ref}|${rawTarget.$ref}`;
+        if (seen.has(key))
+            return;
+        seen.add(key);
+    }
+    const source = deref(rawSource, resolveRef);
+    const target = deref(rawTarget, resolveRef);
+    // Value types first: an `instance` representation has no JSON `type` to
+    // compare, so its identity IS the comparison — and its arguments are where the
+    // real information lives.
+    const sourceType = readValueTypeSlot(source);
+    const targetType = readValueTypeSlot(target);
+    if (sourceType && targetType) {
+        if (sourceType.name !== targetType.name) {
+            issues.push(`${path || "/"}: value type mismatch — source is '${sourceType.name}', target expects '${targetType.name}'`);
+            return;
+        }
+        for (const [argument, targetArg] of Object.entries(targetType.args)) {
+            const sourceArg = sourceType.args[argument];
+            // An omitted argument is *any*, in BOTH directions. That is what keeps a
+            // bare `Telo.Stream` flowing into a typed slot and vice versa, so nothing
+            // that does not declare its element is forced to.
+            if (sourceArg === undefined)
+                continue;
+            compare(sourceArg, targetArg, `${path}<${argument}>`, issues, resolveRef, seen);
+        }
+        return;
+    }
+    // One side declares a value type and the other does not. A `json`
+    // representation refines a base type, so it is compared through that base — a
+    // `Telo.TcpPort` into a plain `integer` slot is gradual typing working. An
+    // `instance` is not JSON at all, so ANY declared JSON type on the other side is
+    // a definite conflict; a side declaring no type at all is still saying nothing
+    // and stays compatible.
+    if (Boolean(sourceType) !== Boolean(targetType)) {
+        const declared = (sourceType ?? targetType);
+        const other = sourceType ? target : source;
+        if (declared.entry && typeof other.type === "string") {
+            const base = celBaseOfValueType(declared.entry);
+            const asJson = base === undefined ? undefined : declared.entry.base;
+            if (asJson !== other.type) {
+                issues.push(`${path || "/"}: value type mismatch — ${sourceType ? "source is" : "target expects"} '${declared.name}', ${sourceType ? "target expects" : "source is"} '${other.type}'`);
+                return;
+            }
+        }
+    }
+    // Only flag definite primitive type clashes; an absent or union `type` says
+    // too little to judge.
+    if (typeof source.type === "string" &&
+        typeof target.type === "string" &&
+        source.type !== target.type) {
+        issues.push(`${path || "/"}: type mismatch — source is '${source.type}', target expects '${target.type}'`);
+        return;
+    }
+    if (source.anyOf || source.oneOf || source.allOf)
+        return;
+    if (target.anyOf || target.oneOf || target.allOf)
+        return;
+    // An array's element, which the old comparison never looked at — so every
+    // nested shape passed regardless of what it contained.
+    if (target.items && source.items) {
+        compare(source.items, target.items, `${path}[]`, issues, resolveRef, seen);
+    }
+    const targetRequired = Array.isArray(target.required) ? target.required : [];
     const sourceProps = source.properties ?? {};
     const targetProps = target.properties ?? {};
     for (const field of targetRequired) {
         if (!(field in sourceProps)) {
+            // Only when the source describes an object at all: a schema with no
+            // `properties` is saying nothing about its shape, not saying it is empty.
+            if (source.properties === undefined)
+                continue;
             issues.push(`${path}/${field}: required by target but missing from source`);
             continue;
         }
         const srcProp = sourceProps[field];
         const tgtProp = targetProps[field];
         if (tgtProp && srcProp) {
-            checkProperty(srcProp, tgtProp, `${path}/${field}`, issues);
+            compare(srcProp, tgtProp, `${path}/${field}`, issues, resolveRef, seen);
         }
     }
 }
-function checkProperty(source, target, path, issues) {
-    // Only flag definite primitive type clashes; skip anyOf/oneOf/allOf
-    if (source.type &&
-        target.type &&
-        typeof source.type === "string" &&
-        typeof target.type === "string" &&
-        source.type !== target.type) {
-        issues.push(`${path}: type mismatch — source is '${source.type}', target expects '${target.type}'`);
-        return;
-    }
-    if (target.type === "object" && source.type === "object") {
-        checkObject(source, target, path, issues);
-    }
-}
 export function formatSingleError(err) {
     const p = err.instancePath || "/";
     const params = err.params ?? {};
@@ -120,13 +212,8 @@ function schemaCompiles(schema) {
 export function validateAgainstSchema(data, schema) {
     let validate = compiledSchemaValidators.get(schema);
     if (!validate) {
-        // Normalize outside the try: a fault in our own ref-slot normalization must
-        // surface, never be mistaken for the module author's schema being malformed.
-        // Drop the legacy scalar `type` an older published module may still pin on
-        // its `x-telo-ref` slots so a resolved reference object validates.
-        const normalized = normalizeRefSlots(schema);
         try {
-            validate = ajv.compile(normalized);
+            validate = ajv.compile(schema);
         }
         catch (err) {
             // The normalized schema didn't compile. If the original schema is itself
@@ -198,28 +285,36 @@ export function navigateSchemaToExprPath(schema, path) {
     return current;
 }
 /**
- * Recognized `x-telo-type` value brands and the CEL primitive each refines.
+ * Every `json`-represented value type's CEL brand → the primitive it refines.
+ *
  * A brand is a nominal type the analyzer registers (see cel-environment.ts) so
- * structurally-identical values (a `TcpPort` and a `UdpPort` are both integers)
- * stay distinct for static wiring checks. Brands carry no runtime effect — the
- * value flows as its base type. Add new brands here (e.g. `Url: "string"`).
+ * structurally-identical values (a `Telo.TcpPort` and a `Telo.UdpPort` are both
+ * integers) stay distinct for static wiring checks. Brands carry no runtime
+ * effect — the value flows as its base type.
+ *
+ * DERIVED from the value-type vocabulary, never hand-written: a new brand is a
+ * new entry file, and a table here would be a second place to edit that could
+ * silently disagree with the one the runtime reads.
  */
-export const VALUE_BRAND_BASE = {
-    TcpPort: "int",
-    UdpPort: "int",
-};
-/** Read a recognized `x-telo-type` brand off a schema, or undefined. */
+export const VALUE_BRAND_BASE = valueBrandBases();
+/** Read a `json`-represented value type's brand off a schema, or undefined.
+ *  An `instance` type is not a brand — it replaces the JSON layer rather than
+ *  refining it, so it carries its binding's CEL type instead. */
 export function brandOfSchema(schema) {
-    const brand = schema?.["x-telo-type"];
-    return typeof brand === "string" && brand in VALUE_BRAND_BASE ? brand : undefined;
+    const entry = valueTypeOf(schema);
+    return entry && entry.representation === "json" ? entry.name : undefined;
 }
 /** Map a JSON Schema type annotation to a CEL type string. */
 export function jsonSchemaToCelType(schema) {
     if (!schema || typeof schema !== "object")
         return "dyn";
-    const brand = brandOfSchema(schema);
-    if (brand)
-        return brand;
+    // A declared value type IS the type — for an `instance` representation it is
+    // the only thing that says so, since bytes and streams have no JSON Schema
+    // type at all. Before the three annotations were unified, a byte slot's
+    // expression typed as `dyn` because nothing here consulted `x-telo-binary`.
+    const entry = valueTypeOf(schema);
+    if (entry)
+        return celTypeOfValueType(entry);
     if (schema.anyOf || schema.oneOf || schema.allOf)
         return "dyn";
     if (Array.isArray(schema.type))
@@ -263,6 +358,16 @@ export function celTypeSatisfiesJsonSchema(celType, schema) {
             return fieldBrand === celType;
         celType = sourceBase;
     }
+    // An `instance` representation has no JSON Schema type to compare against, so
+    // an expression carrying its binding's CEL type is accepted on that ground
+    // alone. This ADDS a case and never removes one: a mismatch falls through to
+    // the rules below rather than being rejected here, so nothing that checks
+    // today stops checking, and the `bytes` row still accepts a byte expression at
+    // a plain `type: string` slot.
+    const slotEntry = valueTypeOf(schema);
+    if (slotEntry?.representation === "instance" && celTypeOfValueType(slotEntry) === celType) {
+        return true;
+    }
     if (!schema.type && !schema.anyOf && !schema.oneOf && !schema.allOf)
         return true;
     if (schema.anyOf || schema.oneOf || schema.allOf)
@@ -357,12 +462,16 @@ function foldedConstraints(schema) {
 }
 export function celPlaceholderForSchema(rawSchema) {
     const schema = foldedConstraints(rawSchema);
-    // A byte slot's placeholder must BE bytes: the same keyword validates statically
-    // and at dispatch, so a CEL leaf standing in for a runtime buffer has to satisfy
-    // it. This is what keeps the rule single — a literal is rejected because no YAML
-    // literal is a Uint8Array, while a value arriving by reference passes.
-    if (isBinarySlot(schema))
-        return new Uint8Array();
+    // An instance-typed slot's placeholder must BE an instance: the same keyword
+    // validates statically and at dispatch, so a CEL leaf standing in for a runtime
+    // value has to satisfy it. This is what keeps the rule single — a literal is
+    // rejected because no YAML literal is a byte buffer, while a value arriving by
+    // reference passes. The stand-in comes from the binding table, so a new
+    // instance type brings its own rather than adding a branch here; a `live` type
+    // declares none, because nothing validates it.
+    const placeholder = valueTypePlaceholder(schema);
+    if (placeholder !== undefined)
+        return placeholder;
     if (schema.default !== undefined)
         return schema.default;
     // An enum-constrained field needs a placeholder drawn from the enum: the
@@ -537,16 +646,23 @@ onSubstitute, path = "") {
     if (isRefSentinel(data)) {
         return data;
     }
-    // A file embed's type is a CONSTANT of the tag, not a function of the slot:
-    // `!include-text` always produces a string and `!include-bytes` always
-    // produces bytes. Collapsing them to a slot-shaped placeholder like a CEL
-    // expression would make every slot accept both, so a byte embed at a
-    // `type: string` field passed `telo check` and failed at resource creation —
-    // and the reverse (text at an `x-telo-binary` slot) did too. Substituting the
-    // real type lets AJV and the `x-telo-binary` keyword reject both directions
-    // statically, with no new diagnostic code.
-    if (isTaggedSentinel(data) && INCLUDE_ENGINE_NAMES.has(data.engine)) {
-        return data.engine === INCLUDE_BYTES_ENGINE ? new Uint8Array() : "";
+    // A tag whose produced type is a CONSTANT of the tag rather than a function of
+    // the slot substitutes a placeholder of THAT type: `!include-text` always
+    // produces a string and `!include-bytes` always produces bytes. Collapsing
+    // them to a slot-shaped placeholder like a CEL expression would make every
+    // slot accept both, so a byte embed at a `type: string` field passed
+    // `telo check` and failed at resource creation — and the reverse did too.
+    // Substituting the real type lets AJV and the `x-telo-type` keyword reject
+    // both directions statically, with no new diagnostic code.
+    //
+    // The engine is what says so. This used to branch on two tag names, which was
+    // the only place a tag's produced type was written down and it was written in
+    // the consumer — so a future tag producing bytes had to be added to a set here
+    // rather than declaring it.
+    if (isTaggedSentinel(data)) {
+        const produced = producedTypeOf(data.engine);
+        if (produced)
+            return celPlaceholderForSchema(produced);
     }
     if (isTaggedSentinel(data)) {
         mark();

package/dist/schema-region.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Where author-written JSON Schema lives in a manifest — one definition, read by
+ * every surface that has to bound itself to schema.
+ *
+ * The keys are the KERNEL's own schema-valued manifest keys, which no resource
+ * kind owns. That is what makes the rule generic: a surface using it learns no
+ * resource kind, and a module that invents a schema-bearing field of its own
+ * reaches it through one of these or not at all — against the topology-driven
+ * constraint, an enumeration of the standard library's kinds would be both
+ * incomplete and knowledge the analyzer must not hold.
+ *
+ * A schema fragment is NOT confined to kind documents. An inline `inputType:` /
+ * `outputType:` sits on any kind that declares one, an API route carries
+ * `request.schema.body`, a `Telo.JsonSchema` carries `schema`. So a check that
+ * walks a manifest's ROOT keys covers a fraction of the sites an author writes —
+ * which is a silent hole in exactly the checks that exist to stop a silent
+ * degrade. Containment is by ANCESTRY instead: a node is in a schema region when
+ * some key on the path to it is one of these.
+ *
+ * Browser-safe: no Node built-ins.
+ */
+/** The kernel's schema-valued manifest keys. */
+export declare const SCHEMA_REGION_KEYS: readonly string[];
+/**
+ * True when `path` reaches into a schema region — some ANCESTOR segment is a
+ * schema-valued key.
+ *
+ * Ancestors only, so a rule keyed on a region key itself still means "inside a
+ * schema" rather than "is one". `path` is the walk's own segment list; numeric
+ * segments (array indices) never equal a key name, so they need no special case.
+ */
+export declare function isInSchemaRegion(path: readonly (string | number)[]): boolean;
+//# sourceMappingURL=schema-region.d.ts.map

package/dist/schema-region.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-region.d.ts","sourceRoot":"","sources":["../src/schema-region.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,gDAAgD;AAChD,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAM/C,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,OAAO,CAM5E"}

package/dist/schema-region.js

@@ -0,0 +1,45 @@
+/**
+ * Where author-written JSON Schema lives in a manifest — one definition, read by
+ * every surface that has to bound itself to schema.
+ *
+ * The keys are the KERNEL's own schema-valued manifest keys, which no resource
+ * kind owns. That is what makes the rule generic: a surface using it learns no
+ * resource kind, and a module that invents a schema-bearing field of its own
+ * reaches it through one of these or not at all — against the topology-driven
+ * constraint, an enumeration of the standard library's kinds would be both
+ * incomplete and knowledge the analyzer must not hold.
+ *
+ * A schema fragment is NOT confined to kind documents. An inline `inputType:` /
+ * `outputType:` sits on any kind that declares one, an API route carries
+ * `request.schema.body`, a `Telo.JsonSchema` carries `schema`. So a check that
+ * walks a manifest's ROOT keys covers a fraction of the sites an author writes —
+ * which is a silent hole in exactly the checks that exist to stop a silent
+ * degrade. Containment is by ANCESTRY instead: a node is in a schema region when
+ * some key on the path to it is one of these.
+ *
+ * Browser-safe: no Node built-ins.
+ */
+/** The kernel's schema-valued manifest keys. */
+export const SCHEMA_REGION_KEYS = [
+    "schema",
+    "status",
+    "inputType",
+    "outputType",
+    "itemType",
+];
+/**
+ * True when `path` reaches into a schema region — some ANCESTOR segment is a
+ * schema-valued key.
+ *
+ * Ancestors only, so a rule keyed on a region key itself still means "inside a
+ * schema" rather than "is one". `path` is the walk's own segment list; numeric
+ * segments (array indices) never equal a key name, so they need no special case.
+ */
+export function isInSchemaRegion(path) {
+    for (let i = 0; i < path.length - 1; i++) {
+        const segment = path[i];
+        if (typeof segment === "string" && SCHEMA_REGION_KEYS.includes(segment))
+            return true;
+    }
+    return false;
+}

package/dist/types.d.ts

@@ -101,11 +101,28 @@ export interface LoadOptions {
      *  pairs manifests to YAML nodes by index. Folded into the file cache key so a
      *  desugared and a raw load of the same file never collide. */
     desugarImports?: boolean;
+    /** When true, the loader's migration phase rewrites legacy spellings in each
+     *  parsed document before anything else reads the tree. On for every resolved
+     *  consumer — the kernel's analysis and runtime loads, `telo check`, the
+     *  analyzer — so one rewrite serves the definition registry, the runtime and
+     *  the editor's analysis alike.
+     *
+     *  **Off for a round-trip view.** The editor pairs manifests to YAML nodes by
+     *  index and writes the pair back on save; migrating one half of that pair
+     *  would silently change the author's file. `telo migrate` is likewise a raw
+     *  consumer — it rewrites the YAML itself and must see the legacy spelling to
+     *  find it. Folded into the file cache key so a migrated and a raw load of
+     *  the same file never collide. */
+    migrate?: boolean;
 }
 export interface LoaderInitOptions {
     /** Handlers for CEL stdlib functions (e.g. `sha256`). Analyzer-only callers may
      *  omit this and get throwing stubs; runtime callers (kernel) must supply real impls. */
     celHandlers?: import("./cel-environment.js").CelHandlers;
+    /** Migration set for `LoadOptions.migrate` loads. Defaults to the analyzer's
+     *  own `CORE_MIGRATIONS`. A host supplies its own once module-shipped entries
+     *  are aggregated alongside the core ones. */
+    migrations?: readonly import("./migrations/types.js").MigrationEntry[];
 }
 export interface AnalysisOptions {
     strictContexts?: boolean;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE;qHACqH;AACrH,eAAO,MAAM,kBAAkB;;;;;CAKrB,CAAC;AACX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAC;AAE9F,gFAAgF;AAChF,eAAO,MAAM,yBAAyB,cAAc,CAAC;AAErD,MAAM,WAAW,QAAQ;IACvB,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,KAAK;IACpB,KAAK,EAAE,QAAQ,CAAC;IAChB,GAAG,EAAE,QAAQ,CAAC;CACf;AAED;;oDAEoD;AACpD,MAAM,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAE/C;6EAC6E;AAC7E;;;;;;;;;;;;;;kEAckE;AAClE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;kEACkE;AAClE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,aAAa,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,2BAA2B;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;8BAC8B;AAC9B,wBAAgB,aAAa,CAAC,CAAC,EAAE,kBAAkB,GAAG,aAAa,GAAG,SAAS,CAG9E;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAExD;;qEAEiE;IACjE,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEjE;;qEAEiE;IACjE,cAAc,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,WAAW;IAC1B;;;+EAG2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;mEAO+D;IAC/D,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC;6FACyF;IACzF,WAAW,CAAC,EAAE,OAAO,sBAAsB,EAAE,WAAW,CAAC;CAC1D;AAED,MAAM,WAAW,eAAe;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;oCAKgC;IAChC,eAAe,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACxC;;;;;;;;;;sDAUkD;IAClD,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;gEAKgE;AAChE,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,OAAO,qBAAqB,EAAE,aAAa,CAAC;IACtD,WAAW,CAAC,EAAE,OAAO,0BAA0B,EAAE,kBAAkB,CAAC;IACpE;;;;+EAI2E;IAC3E,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,qBAAqB,EAAE,aAAa,CAAC,CAAC;CAC5E"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE;qHACqH;AACrH,eAAO,MAAM,kBAAkB;;;;;CAKrB,CAAC;AACX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAC;AAE9F,gFAAgF;AAChF,eAAO,MAAM,yBAAyB,cAAc,CAAC;AAErD,MAAM,WAAW,QAAQ;IACvB,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,KAAK;IACpB,KAAK,EAAE,QAAQ,CAAC;IAChB,GAAG,EAAE,QAAQ,CAAC;CACf;AAED;;oDAEoD;AACpD,MAAM,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAE/C;6EAC6E;AAC7E;;;;;;;;;;;;;;kEAckE;AAClE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;kEACkE;AAClE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,aAAa,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,2BAA2B;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;8BAC8B;AAC9B,wBAAgB,aAAa,CAAC,CAAC,EAAE,kBAAkB,GAAG,aAAa,GAAG,SAAS,CAG9E;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAExD;;qEAEiE;IACjE,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEjE;;qEAEiE;IACjE,cAAc,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,WAAW;IAC1B;;;+EAG2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;mEAO+D;IAC/D,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;;;;;;uCAWmC;IACnC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC;6FACyF;IACzF,WAAW,CAAC,EAAE,OAAO,sBAAsB,EAAE,WAAW,CAAC;IACzD;;kDAE8C;IAC9C,UAAU,CAAC,EAAE,SAAS,OAAO,uBAAuB,EAAE,cAAc,EAAE,CAAC;CACxE;AAED,MAAM,WAAW,eAAe;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;oCAKgC;IAChC,eAAe,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACxC;;;;;;;;;;sDAUkD;IAClD,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;gEAKgE;AAChE,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,OAAO,qBAAqB,EAAE,aAAa,CAAC;IACtD,WAAW,CAAC,EAAE,OAAO,0BAA0B,EAAE,kBAAkB,CAAC;IACpE;;;;+EAI2E;IAC3E,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,qBAAqB,EAAE,aAAa,CAAC,CAAC;CAC5E"}

package/dist/validate-cel-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAItF,MAAM,WAAW,kBAAkB;IACjC;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC;;kDAE8C;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;KACxD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AA4CD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAyCjC;AAuFD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAChD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAiJrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB;AAWD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,SAAM,GACT,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAC,CAGvD;AAUD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,SAAM,GAAG,MAAM,EAAE,CAqBxF"}
+{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAItF,MAAM,WAAW,kBAAkB;IACjC;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC;;kDAE8C;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;KACxD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AA4CD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CA0EjC;AAuFD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAChD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAiJrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB;AAWD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,SAAM,GACT,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAC,CAGvD;AAUD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,SAAM,GAAG,MAAM,EAAE,CAqBxF"}

package/dist/validate-cel-context.js

@@ -1,5 +1,5 @@
 export { extractAccessChains, validateChainAgainstSchema } from "@telorun/templating";
-import { mergeTypeSchemas } from "@telorun/sdk";
+import { mergeTypeSchemas, parseCanonicalTypeSchemaId } from "@telorun/sdk";
 import { KERNEL_BUILTINS } from "./builtins.js";
 /**
  * Resolve a type field value (string name, inline type, or raw schema) to a JSON Schema.
@@ -63,6 +63,31 @@ export function resolveTypeFieldToSchema(value, allManifests, ancestry = new Set
     }
     if (typeof value === "object" && value !== null) {
         const obj = value;
+        // A canonical, module-scoped id — what `resolveSchemaTypeRefs` normalizes
+        // both the reference tag and the legacy `telo://` authority form into.
+        //
+        // This is the ALIAS-AWARE path, and it is why the canonical form exists:
+        // the id names the OWNING MODULE, so two libraries declaring a shape of the
+        // same name stay distinct. The bare-name lookup below cannot do that — it
+        // matches the first manifest with that `metadata.name` in a flattened list,
+        // which is how an alias got silently dropped.
+        const canonical = parseCanonicalTypeSchemaId(obj.$ref);
+        if (canonical) {
+            if (ancestry.has(obj.$ref))
+                return undefined;
+            const owned = allManifests.find((m) => m.metadata?.name === canonical.typeName &&
+                m.metadata?.module === canonical.moduleName &&
+                isTypeKind(m.kind, allManifests) &&
+                typeof m.schema === "object" &&
+                m.schema !== null);
+            if (owned) {
+                return applyExtends(owned.schema, owned.extends, allManifests, new Set(ancestry).add(obj.$ref));
+            }
+            // A module that is not in this set — a single-file analysis, or an import
+            // whose library was not forwarded. Fall through to the bare name, which is
+            // what this resolved before the canonical form existed.
+            return resolveTypeFieldToSchema(canonical.typeName, allManifests, ancestry);
+        }
         // Inline type resource: { kind: "Type.JsonSchema", schema: {...} }
         if (obj.schema && typeof obj.schema === "object") {
             return applyExtends(obj.schema, obj.extends, allManifests, ancestry);
@@ -71,8 +96,9 @@ export function resolveTypeFieldToSchema(value, allManifests, ancestry = new Set
         if (obj.type || obj.properties) {
             return obj;
         }
-        // Named type reference resolved from a `!ref` → { kind, name } — resolve the
-        // named Telo.Type the same way as the bare-string form.
+        // Named type reference resolved from a `!ref` → { kind, name }. Reached only
+        // where the canonical rewrite could not run (a scope whose aliases are not in
+        // hand); resolves by bare name, as it always has.
         if (typeof obj.name === "string") {
             return resolveTypeFieldToSchema(obj.name, allManifests, ancestry);
         }

package/dist/validate-step-inputs.d.ts

@@ -4,6 +4,9 @@ export interface StepInputIssue {
     path: string;
     targetLabel: string;
     message: string;
+    /** Set when the issue is a type-argument disagreement rather than a contract
+     *  shape violation — the two read differently and deserve their own code. */
+    code?: "CEL_TYPE_ARGUMENT_MISMATCH";
 }
 /**
  * Validate every step's `inputs:` against the invoked target's declared input
@@ -20,5 +23,9 @@ export interface StepInputIssue {
  * from `x-telo-step-context`, and the paired inputs field from whichever sibling
  * property carries `x-telo-topology-role: inputs`.
  */
-export declare function collectStepInputIssues(manifest: Record<string, any>, defSchema: Record<string, any>, allManifests: Record<string, any>[], defs: DefinitionRegistry, aliases: AliasResolver, scopes: ModuleScopes): StepInputIssue[];
+export declare function collectStepInputIssues(manifest: Record<string, any>, defSchema: Record<string, any>, allManifests: Record<string, any>[], defs: DefinitionRegistry, aliases: AliasResolver, scopes: ModuleScopes, 
+/** The typed `steps.<name>.result` context for this resource. Supplied by the
+ *  caller because building it is analyzer state; without it the contract check
+ *  still runs and only the type-argument comparison is skipped. */
+stepContext?: Record<string, any>): StepInputIssue[];
 //# sourceMappingURL=validate-step-inputs.d.ts.map

package/dist/validate-step-inputs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-step-inputs.d.ts","sourceRoot":"","sources":["../src/validate-step-inputs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAanE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC7B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC9B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY,GACnB,cAAc,EAAE,CAyElB"}
+{"version":3,"file":"validate-step-inputs.d.ts","sourceRoot":"","sources":["../src/validate-step-inputs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAoBnE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB;iFAC6E;IAC7E,IAAI,CAAC,EAAE,4BAA4B,CAAC;CACrC;AAGD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC7B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC9B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY;AACpB;;mEAEmE;AACnE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAChC,cAAc,EAAE,CAiHlB"}

package/dist/validate-step-inputs.js

@@ -1,5 +1,7 @@
 import { resolveContract } from "./invocation-contract.js";
-import { substituteCelFields, validateAgainstSchema } from "./schema-compat.js";
+import { checkSchemaCompatibility, navigateSchemaToExprPath, substituteCelFields, validateAgainstSchema, } from "./schema-compat.js";
+import { plainChainOf } from "@telorun/templating";
+import { valueTypeOf } from "@telorun/sdk";
 import { analyzerContractScope, containerOf, gatherPropertySchemas, missingRequired, resolveLocalRef, walkStepArray, } from "./analyzer.js";
 /**
  * Validate every step's `inputs:` against the invoked target's declared input
@@ -16,7 +18,11 @@ import { analyzerContractScope, containerOf, gatherPropertySchemas, missingRequi
  * from `x-telo-step-context`, and the paired inputs field from whichever sibling
  * property carries `x-telo-topology-role: inputs`.
  */
-export function collectStepInputIssues(manifest, defSchema, allManifests, defs, aliases, scopes) {
+export function collectStepInputIssues(manifest, defSchema, allManifests, defs, aliases, scopes, 
+/** The typed `steps.<name>.result` context for this resource. Supplied by the
+ *  caller because building it is analyzer state; without it the contract check
+ *  still runs and only the type-argument comparison is skipped. */
+stepContext) {
     const out = [];
     const props = defSchema.properties;
     if (!props)
@@ -67,6 +73,45 @@ export function collectStepInputIssues(manifest, defSchema, allManifests, defs,
             // container and survive the filter.
             const celPaths = new Set();
             const substituted = substituteCelFields(values, contract.schema, undefined, (p) => celPaths.add(p));
+            // The type-argument check, at the one site where a produced value's schema
+            // meets a consuming slot's. A CEL leaf's placeholder says nothing about
+            // what the expression yields, so AJV above is silent here by design — and
+            // that silence is exactly where a stream of the wrong element used to
+            // flow. The comparison is covariant and gradual: an omitted argument is
+            // *any* in both directions, so only a definite conflict is reported.
+            if (stepContext) {
+                for (const [inputName, inputValue] of Object.entries(values)) {
+                    const chain = plainChainOf(inputValue);
+                    // The step context is rooted at the STEP MAP, so a `steps.` prefix is
+                    // the namespace name and not a property of it. Only that namespace is
+                    // navigated: `inputs.` and a named binding resolve elsewhere, and
+                    // guessing at a root this does not hold would compare the wrong schema.
+                    if (!chain?.startsWith("steps."))
+                        continue;
+                    const produced = navigateSchemaToExprPath(stepContext, chain.slice("steps.".length));
+                    const slotSchema = contract.schema.properties?.[inputName];
+                    if (!produced || !slotSchema)
+                        continue;
+                    // ONLY a type-argument disagreement, which is what the code says. The
+                    // comparator is a general structural comparison, so running it on any
+                    // pair would report a missing required property as "disagreeing type
+                    // arguments" — and would turn every plain-chain wiring site into a
+                    // broad new Error-severity check hidden behind an argument-specific
+                    // name. Both sides must declare a value type for the question to be
+                    // about arguments at all.
+                    if (!valueTypeOf(produced) || !valueTypeOf(slotSchema))
+                        continue;
+                    const { compatible, issues } = checkSchemaCompatibility(produced, slotSchema, (ref) => defs.schemaForId(ref));
+                    if (compatible)
+                        continue;
+                    out.push({
+                        path: `${stepPath}.${inputsField}.${inputName}`,
+                        targetLabel: invokedName ?? invokedKind ?? "the invoked resource",
+                        message: issues.join("; "),
+                        code: "CEL_TYPE_ARGUMENT_MISMATCH",
+                    });
+                }
+            }
             for (const issue of validateAgainstSchema(substituted, contract.schema)) {
                 if (celPaths.has(issue.path))
                     continue;