@telorun/analyzer 0.57.0 → 0.59.0

package/dist/schema-region.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Where author-written JSON Schema lives in a manifest — one definition, read by
+ * every surface that has to bound itself to schema.
+ *
+ * The keys are the KERNEL's own schema-valued manifest keys, which no resource
+ * kind owns. That is what makes the rule generic: a surface using it learns no
+ * resource kind, and a module that invents a schema-bearing field of its own
+ * reaches it through one of these or not at all — against the topology-driven
+ * constraint, an enumeration of the standard library's kinds would be both
+ * incomplete and knowledge the analyzer must not hold.
+ *
+ * A schema fragment is NOT confined to kind documents. An inline `inputType:` /
+ * `outputType:` sits on any kind that declares one, an API route carries
+ * `request.schema.body`, a `Telo.JsonSchema` carries `schema`. So a check that
+ * walks a manifest's ROOT keys covers a fraction of the sites an author writes —
+ * which is a silent hole in exactly the checks that exist to stop a silent
+ * degrade. Containment is by ANCESTRY instead: a node is in a schema region when
+ * some key on the path to it is one of these.
+ *
+ * Browser-safe: no Node built-ins.
+ */
+/** The kernel's schema-valued manifest keys. */
+export declare const SCHEMA_REGION_KEYS: readonly string[];
+/**
+ * True when `path` reaches into a schema region — some ANCESTOR segment is a
+ * schema-valued key.
+ *
+ * Ancestors only, so a rule keyed on a region key itself still means "inside a
+ * schema" rather than "is one". `path` is the walk's own segment list; numeric
+ * segments (array indices) never equal a key name, so they need no special case.
+ */
+export declare function isInSchemaRegion(path: readonly (string | number)[]): boolean;
+//# sourceMappingURL=schema-region.d.ts.map

package/dist/schema-region.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-region.d.ts","sourceRoot":"","sources":["../src/schema-region.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,gDAAgD;AAChD,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAM/C,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,OAAO,CAM5E"}

package/dist/schema-region.js

@@ -0,0 +1,45 @@
+/**
+ * Where author-written JSON Schema lives in a manifest — one definition, read by
+ * every surface that has to bound itself to schema.
+ *
+ * The keys are the KERNEL's own schema-valued manifest keys, which no resource
+ * kind owns. That is what makes the rule generic: a surface using it learns no
+ * resource kind, and a module that invents a schema-bearing field of its own
+ * reaches it through one of these or not at all — against the topology-driven
+ * constraint, an enumeration of the standard library's kinds would be both
+ * incomplete and knowledge the analyzer must not hold.
+ *
+ * A schema fragment is NOT confined to kind documents. An inline `inputType:` /
+ * `outputType:` sits on any kind that declares one, an API route carries
+ * `request.schema.body`, a `Telo.JsonSchema` carries `schema`. So a check that
+ * walks a manifest's ROOT keys covers a fraction of the sites an author writes —
+ * which is a silent hole in exactly the checks that exist to stop a silent
+ * degrade. Containment is by ANCESTRY instead: a node is in a schema region when
+ * some key on the path to it is one of these.
+ *
+ * Browser-safe: no Node built-ins.
+ */
+/** The kernel's schema-valued manifest keys. */
+export const SCHEMA_REGION_KEYS = [
+    "schema",
+    "status",
+    "inputType",
+    "outputType",
+    "itemType",
+];
+/**
+ * True when `path` reaches into a schema region — some ANCESTOR segment is a
+ * schema-valued key.
+ *
+ * Ancestors only, so a rule keyed on a region key itself still means "inside a
+ * schema" rather than "is one". `path` is the walk's own segment list; numeric
+ * segments (array indices) never equal a key name, so they need no special case.
+ */
+export function isInSchemaRegion(path) {
+    for (let i = 0; i < path.length - 1; i++) {
+        const segment = path[i];
+        if (typeof segment === "string" && SCHEMA_REGION_KEYS.includes(segment))
+            return true;
+    }
+    return false;
+}

package/dist/types.d.ts

@@ -101,11 +101,28 @@ export interface LoadOptions {
      *  pairs manifests to YAML nodes by index. Folded into the file cache key so a
      *  desugared and a raw load of the same file never collide. */
     desugarImports?: boolean;
+    /** When true, the loader's migration phase rewrites legacy spellings in each
+     *  parsed document before anything else reads the tree. On for every resolved
+     *  consumer — the kernel's analysis and runtime loads, `telo check`, the
+     *  analyzer — so one rewrite serves the definition registry, the runtime and
+     *  the editor's analysis alike.
+     *
+     *  **Off for a round-trip view.** The editor pairs manifests to YAML nodes by
+     *  index and writes the pair back on save; migrating one half of that pair
+     *  would silently change the author's file. `telo migrate` is likewise a raw
+     *  consumer — it rewrites the YAML itself and must see the legacy spelling to
+     *  find it. Folded into the file cache key so a migrated and a raw load of
+     *  the same file never collide. */
+    migrate?: boolean;
 }
 export interface LoaderInitOptions {
     /** Handlers for CEL stdlib functions (e.g. `sha256`). Analyzer-only callers may
      *  omit this and get throwing stubs; runtime callers (kernel) must supply real impls. */
     celHandlers?: import("./cel-environment.js").CelHandlers;
+    /** Migration set for `LoadOptions.migrate` loads. Defaults to the analyzer's
+     *  own `CORE_MIGRATIONS`. A host supplies its own once module-shipped entries
+     *  are aggregated alongside the core ones. */
+    migrations?: readonly import("./migrations/types.js").MigrationEntry[];
 }
 export interface AnalysisOptions {
     strictContexts?: boolean;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE;qHACqH;AACrH,eAAO,MAAM,kBAAkB;;;;;CAKrB,CAAC;AACX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAC;AAE9F,gFAAgF;AAChF,eAAO,MAAM,yBAAyB,cAAc,CAAC;AAErD,MAAM,WAAW,QAAQ;IACvB,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,KAAK;IACpB,KAAK,EAAE,QAAQ,CAAC;IAChB,GAAG,EAAE,QAAQ,CAAC;CACf;AAED;;oDAEoD;AACpD,MAAM,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAE/C;6EAC6E;AAC7E;;;;;;;;;;;;;;kEAckE;AAClE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;kEACkE;AAClE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,aAAa,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,2BAA2B;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;8BAC8B;AAC9B,wBAAgB,aAAa,CAAC,CAAC,EAAE,kBAAkB,GAAG,aAAa,GAAG,SAAS,CAG9E;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAExD;;qEAEiE;IACjE,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEjE;;qEAEiE;IACjE,cAAc,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,WAAW;IAC1B;;;+EAG2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;mEAO+D;IAC/D,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC;6FACyF;IACzF,WAAW,CAAC,EAAE,OAAO,sBAAsB,EAAE,WAAW,CAAC;CAC1D;AAED,MAAM,WAAW,eAAe;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;oCAKgC;IAChC,eAAe,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACxC;;;;;;;;;;sDAUkD;IAClD,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;gEAKgE;AAChE,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,OAAO,qBAAqB,EAAE,aAAa,CAAC;IACtD,WAAW,CAAC,EAAE,OAAO,0BAA0B,EAAE,kBAAkB,CAAC;IACpE;;;;+EAI2E;IAC3E,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,qBAAqB,EAAE,aAAa,CAAC,CAAC;CAC5E"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE;qHACqH;AACrH,eAAO,MAAM,kBAAkB;;;;;CAKrB,CAAC;AACX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAC;AAE9F,gFAAgF;AAChF,eAAO,MAAM,yBAAyB,cAAc,CAAC;AAErD,MAAM,WAAW,QAAQ;IACvB,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,KAAK;IACpB,KAAK,EAAE,QAAQ,CAAC;IAChB,GAAG,EAAE,QAAQ,CAAC;CACf;AAED;;oDAEoD;AACpD,MAAM,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAE/C;6EAC6E;AAC7E;;;;;;;;;;;;;;kEAckE;AAClE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;kEACkE;AAClE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,aAAa,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,2BAA2B;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;8BAC8B;AAC9B,wBAAgB,aAAa,CAAC,CAAC,EAAE,kBAAkB,GAAG,aAAa,GAAG,SAAS,CAG9E;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAExD;;qEAEiE;IACjE,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEjE;;qEAEiE;IACjE,cAAc,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,WAAW;IAC1B;;;+EAG2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;mEAO+D;IAC/D,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;;;;;;uCAWmC;IACnC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC;6FACyF;IACzF,WAAW,CAAC,EAAE,OAAO,sBAAsB,EAAE,WAAW,CAAC;IACzD;;kDAE8C;IAC9C,UAAU,CAAC,EAAE,SAAS,OAAO,uBAAuB,EAAE,cAAc,EAAE,CAAC;CACxE;AAED,MAAM,WAAW,eAAe;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;oCAKgC;IAChC,eAAe,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACxC;;;;;;;;;;sDAUkD;IAClD,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;gEAKgE;AAChE,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,OAAO,qBAAqB,EAAE,aAAa,CAAC;IACtD,WAAW,CAAC,EAAE,OAAO,0BAA0B,EAAE,kBAAkB,CAAC;IACpE;;;;+EAI2E;IAC3E,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,qBAAqB,EAAE,aAAa,CAAC,CAAC;CAC5E"}

package/dist/validate-cel-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAItF,MAAM,WAAW,kBAAkB;IACjC;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC;;kDAE8C;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;KACxD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AA4CD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAyCjC;AAuFD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAChD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAiJrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB;AAWD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,SAAM,GACT,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAC,CAGvD;AAUD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,SAAM,GAAG,MAAM,EAAE,CAqBxF"}
+{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAStF,MAAM,WAAW,kBAAkB;IACjC;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC;;kDAE8C;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;KACxD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AA4CD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CA0EjC;AAyID;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAChD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CA+JrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB;AAWD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,SAAM,GACT,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAC,CAGvD;AAUD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,SAAM,GAAG,MAAM,EAAE,CAqBxF"}

package/dist/validate-cel-context.js

@@ -1,5 +1,5 @@
 export { extractAccessChains, validateChainAgainstSchema } from "@telorun/templating";
-import { mergeTypeSchemas } from "@telorun/sdk";
+import { elementSchemaOf, isLiveSlot, mergeTypeSchemas, parseCanonicalTypeSchemaId, } from "@telorun/sdk";
 import { KERNEL_BUILTINS } from "./builtins.js";
 /**
  * Resolve a type field value (string name, inline type, or raw schema) to a JSON Schema.
@@ -63,6 +63,31 @@ export function resolveTypeFieldToSchema(value, allManifests, ancestry = new Set
     }
     if (typeof value === "object" && value !== null) {
         const obj = value;
+        // A canonical, module-scoped id — what `resolveSchemaTypeRefs` normalizes
+        // both the reference tag and the legacy `telo://` authority form into.
+        //
+        // This is the ALIAS-AWARE path, and it is why the canonical form exists:
+        // the id names the OWNING MODULE, so two libraries declaring a shape of the
+        // same name stay distinct. The bare-name lookup below cannot do that — it
+        // matches the first manifest with that `metadata.name` in a flattened list,
+        // which is how an alias got silently dropped.
+        const canonical = parseCanonicalTypeSchemaId(obj.$ref);
+        if (canonical) {
+            if (ancestry.has(obj.$ref))
+                return undefined;
+            const owned = allManifests.find((m) => m.metadata?.name === canonical.typeName &&
+                m.metadata?.module === canonical.moduleName &&
+                isTypeKind(m.kind, allManifests) &&
+                typeof m.schema === "object" &&
+                m.schema !== null);
+            if (owned) {
+                return applyExtends(owned.schema, owned.extends, allManifests, new Set(ancestry).add(obj.$ref));
+            }
+            // A module that is not in this set — a single-file analysis, or an import
+            // whose library was not forwarded. Fall through to the bare name, which is
+            // what this resolved before the canonical form existed.
+            return resolveTypeFieldToSchema(canonical.typeName, allManifests, ancestry);
+        }
         // Inline type resource: { kind: "Type.JsonSchema", schema: {...} }
         if (obj.schema && typeof obj.schema === "object") {
             return applyExtends(obj.schema, obj.extends, allManifests, ancestry);
@@ -71,8 +96,9 @@ export function resolveTypeFieldToSchema(value, allManifests, ancestry = new Set
         if (obj.type || obj.properties) {
             return obj;
         }
-        // Named type reference resolved from a `!ref` → { kind, name } — resolve the
-        // named Telo.Type the same way as the bare-string form.
+        // Named type reference resolved from a `!ref` → { kind, name }. Reached only
+        // where the canonical rewrite could not run (a scope whose aliases are not in
+        // hand); resolves by bare name, as it always has.
         if (typeof obj.name === "string") {
             return resolveTypeFieldToSchema(obj.name, allManifests, ancestry);
         }
@@ -142,22 +168,64 @@ function schemaAtChain(chain, root) {
     }
     return cur && typeof cur === "object" ? cur : undefined;
 }
-/** The element schema of a sibling collection expression, when statically known.
- *  Resolves `inputs.*` chains against the resource's `inputs:` contract and
- *  returns the array's `items`. Returns undefined for non-chain or untyped
- *  collections (caller substitutes `dyn`). */
-function resolveCollectionElementSchema(manifestRoot, field) {
+/**
+ * The schema of a sibling collection expression, when statically known.
+ *
+ * Resolves `inputs.*` chains against the resource's DECLARED contract, falling
+ * back to the legacy `inputs:` property map some kinds still carry. Reading the
+ * contract is what makes this work at all for a kind that declares `inputType:`
+ * — resolving only the property map left `item` untyped in every such kind,
+ * silently, which reads as "element typing is permissive here" rather than as a
+ * gap. Returns undefined for a non-chain or untyped collection, and the caller
+ * substitutes `dyn` rather than inventing an element type.
+ */
+function resolveCollectionSchema(manifestRoot, field, allManifests) {
     const chain = purePathChain(manifestRoot?.[field]);
     if (!chain || chain[0] !== "inputs")
         return undefined;
-    const contract = manifestRoot.inputs;
-    if (!contract || typeof contract !== "object")
+    const declared = resolveTypeFieldToSchema(manifestRoot.inputType, allManifests ?? []);
+    const root = declared && typeof declared === "object"
+        ? declared
+        : manifestRoot.inputs && typeof manifestRoot.inputs === "object"
+            ? { type: "object", properties: manifestRoot.inputs }
+            : undefined;
+    if (!root)
         return undefined;
-    const terminal = schemaAtChain(chain.slice(1), { type: "object", properties: contract });
-    if (terminal && terminal.type === "array" && terminal.items && typeof terminal.items === "object") {
-        return terminal.items;
+    return schemaAtChain(chain.slice(1), root);
+}
+/**
+ * What ITERATING a collection schema yields.
+ *
+ * An array answers with `items`; anything else answers through the value-type
+ * vocabulary, which is where "what is the element of this" is declared. No type
+ * is named here on purpose: a future iterable value type is covered by declaring
+ * `element` on one of its parameters, with nothing to change in the analyzer.
+ */
+function elementOfCollection(collection) {
+    if (!collection || typeof collection !== "object")
+        return undefined;
+    if (collection.type === "array") {
+        return collection.items && typeof collection.items === "object"
+            ? collection.items
+            : undefined;
     }
-    return undefined;
+    const element = elementSchemaOf(collection);
+    return element && typeof element === "object" ? element : undefined;
+}
+/**
+ * True when a context binding naming this collection must NOT be bound.
+ *
+ * A binding that re-exposes the collection can only hand over the value the
+ * consumer is already draining, and passing that on is an ordinary
+ * pass-through no member-access rule catches — so the drain is silent. `live` is
+ * exactly the property that makes a value unsafe to re-expose, and it is already
+ * in the vocabulary, so no consumer names a type to decide this.
+ */
+function collectionBindingWithheld(schema, manifestRoot, allManifests) {
+    const from = schema?.["x-telo-context-collection-from"];
+    if (!from)
+        return false;
+    return isLiveSlot(resolveCollectionSchema(manifestRoot, from, allManifests));
 }
 /**
  * Returns true when a CEL expression path (from walkCelExpressions, e.g. "routes[0].inputs.q")
@@ -271,9 +339,18 @@ export function resolveContextAnnotations(schema, manifestItem, opts) {
     // untyped sources fall back to `dyn` so a wrong element type is never invented.
     const elementFrom = schema["x-telo-context-element-from"];
     if (elementFrom) {
-        const items = resolveCollectionElementSchema(manifestRoot, elementFrom);
+        const items = elementOfCollection(resolveCollectionSchema(manifestRoot, elementFrom, allManifests));
         return items ?? {};
     }
+    // The collection itself, as opposed to its element. Typed from whatever the
+    // sibling resolves to, so an array binding keeps the precision it has today
+    // instead of degrading to `dyn` now that the slot admits more than one shape.
+    // A `live` collection never reaches here — the property is dropped before
+    // recursion, so the name is simply not in scope.
+    const collectionFrom = schema["x-telo-context-collection-from"];
+    if (collectionFrom) {
+        return resolveCollectionSchema(manifestRoot, collectionFrom, allManifests) ?? {};
+    }
     const fromRoot = schema["x-telo-context-from-root"];
     const fromRefKindRaw = schema["x-telo-context-from-ref-kind"];
     const fromRefKinds = fromRefKindRaw == null
@@ -358,6 +435,11 @@ export function resolveContextAnnotations(schema, manifestItem, opts) {
     if (schema.properties) {
         const props = {};
         for (const [k, v] of Object.entries(schema.properties)) {
+            // Withholding happens HERE rather than inside the child resolver, because
+            // this is the only level that owns the property map — a child can return a
+            // schema but cannot remove itself from one.
+            if (collectionBindingWithheld(v, manifestRoot, allManifests))
+                continue;
             props[k] = resolveContextAnnotations(v, manifestItem, normalizedOpts);
         }
         return { ...schema, properties: props };

package/dist/validate-step-inputs.d.ts

@@ -4,6 +4,9 @@ export interface StepInputIssue {
     path: string;
     targetLabel: string;
     message: string;
+    /** Set when the issue is a type-argument disagreement rather than a contract
+     *  shape violation — the two read differently and deserve their own code. */
+    code?: "CEL_TYPE_ARGUMENT_MISMATCH";
 }
 /**
  * Validate every step's `inputs:` against the invoked target's declared input
@@ -20,5 +23,9 @@ export interface StepInputIssue {
  * from `x-telo-step-context`, and the paired inputs field from whichever sibling
  * property carries `x-telo-topology-role: inputs`.
  */
-export declare function collectStepInputIssues(manifest: Record<string, any>, defSchema: Record<string, any>, allManifests: Record<string, any>[], defs: DefinitionRegistry, aliases: AliasResolver, scopes: ModuleScopes): StepInputIssue[];
+export declare function collectStepInputIssues(manifest: Record<string, any>, defSchema: Record<string, any>, allManifests: Record<string, any>[], defs: DefinitionRegistry, aliases: AliasResolver, scopes: ModuleScopes, 
+/** The typed `steps.<name>.result` context for this resource. Supplied by the
+ *  caller because building it is analyzer state; without it the contract check
+ *  still runs and only the type-argument comparison is skipped. */
+stepContext?: Record<string, any>): StepInputIssue[];
 //# sourceMappingURL=validate-step-inputs.d.ts.map

package/dist/validate-step-inputs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-step-inputs.d.ts","sourceRoot":"","sources":["../src/validate-step-inputs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAanE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC7B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC9B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY,GACnB,cAAc,EAAE,CAyElB"}
+{"version":3,"file":"validate-step-inputs.d.ts","sourceRoot":"","sources":["../src/validate-step-inputs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAoBnE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB;iFAC6E;IAC7E,IAAI,CAAC,EAAE,4BAA4B,CAAC;CACrC;AAGD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC7B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC9B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY;AACpB;;mEAEmE;AACnE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAChC,cAAc,EAAE,CAiHlB"}

package/dist/validate-step-inputs.js

@@ -1,5 +1,7 @@
 import { resolveContract } from "./invocation-contract.js";
-import { substituteCelFields, validateAgainstSchema } from "./schema-compat.js";
+import { checkSchemaCompatibility, navigateSchemaToExprPath, substituteCelFields, validateAgainstSchema, } from "./schema-compat.js";
+import { plainChainOf } from "@telorun/templating";
+import { valueTypeOf } from "@telorun/sdk";
 import { analyzerContractScope, containerOf, gatherPropertySchemas, missingRequired, resolveLocalRef, walkStepArray, } from "./analyzer.js";
 /**
  * Validate every step's `inputs:` against the invoked target's declared input
@@ -16,7 +18,11 @@ import { analyzerContractScope, containerOf, gatherPropertySchemas, missingRequi
  * from `x-telo-step-context`, and the paired inputs field from whichever sibling
  * property carries `x-telo-topology-role: inputs`.
  */
-export function collectStepInputIssues(manifest, defSchema, allManifests, defs, aliases, scopes) {
+export function collectStepInputIssues(manifest, defSchema, allManifests, defs, aliases, scopes, 
+/** The typed `steps.<name>.result` context for this resource. Supplied by the
+ *  caller because building it is analyzer state; without it the contract check
+ *  still runs and only the type-argument comparison is skipped. */
+stepContext) {
     const out = [];
     const props = defSchema.properties;
     if (!props)
@@ -67,6 +73,45 @@ export function collectStepInputIssues(manifest, defSchema, allManifests, defs,
             // container and survive the filter.
             const celPaths = new Set();
             const substituted = substituteCelFields(values, contract.schema, undefined, (p) => celPaths.add(p));
+            // The type-argument check, at the one site where a produced value's schema
+            // meets a consuming slot's. A CEL leaf's placeholder says nothing about
+            // what the expression yields, so AJV above is silent here by design — and
+            // that silence is exactly where a stream of the wrong element used to
+            // flow. The comparison is covariant and gradual: an omitted argument is
+            // *any* in both directions, so only a definite conflict is reported.
+            if (stepContext) {
+                for (const [inputName, inputValue] of Object.entries(values)) {
+                    const chain = plainChainOf(inputValue);
+                    // The step context is rooted at the STEP MAP, so a `steps.` prefix is
+                    // the namespace name and not a property of it. Only that namespace is
+                    // navigated: `inputs.` and a named binding resolve elsewhere, and
+                    // guessing at a root this does not hold would compare the wrong schema.
+                    if (!chain?.startsWith("steps."))
+                        continue;
+                    const produced = navigateSchemaToExprPath(stepContext, chain.slice("steps.".length));
+                    const slotSchema = contract.schema.properties?.[inputName];
+                    if (!produced || !slotSchema)
+                        continue;
+                    // ONLY a type-argument disagreement, which is what the code says. The
+                    // comparator is a general structural comparison, so running it on any
+                    // pair would report a missing required property as "disagreeing type
+                    // arguments" — and would turn every plain-chain wiring site into a
+                    // broad new Error-severity check hidden behind an argument-specific
+                    // name. Both sides must declare a value type for the question to be
+                    // about arguments at all.
+                    if (!valueTypeOf(produced) || !valueTypeOf(slotSchema))
+                        continue;
+                    const { compatible, issues } = checkSchemaCompatibility(produced, slotSchema, (ref) => defs.schemaForId(ref));
+                    if (compatible)
+                        continue;
+                    out.push({
+                        path: `${stepPath}.${inputsField}.${inputName}`,
+                        targetLabel: invokedName ?? invokedKind ?? "the invoked resource",
+                        message: issues.join("; "),
+                        code: "CEL_TYPE_ARGUMENT_MISMATCH",
+                    });
+                }
+            }
             for (const issue of validateAgainstSchema(substituted, contract.schema)) {
                 if (celPaths.has(issue.path))
                     continue;

package/dist/validate-value-type-slots.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Static validation of the `x-telo-type` annotation itself — the strict half of
+ * the accessor split, and the `validate-ref-slots.ts` precedent.
+ *
+ * `readValueTypeSlot` is deliberately lenient: it reports whatever it can read,
+ * returning a slot with no `entry` for a name it does not know. That leniency is
+ * what lets every surface keep working; this pass is what stops it becoming
+ * silence. Before the unification an unrecognized brand simply resolved to
+ * `undefined` and the slot quietly lost its identity — the same class of failure
+ * `X_TELO_REF_INVALID_USE` exists to prevent for `use` tokens.
+ *
+ * The vocabulary is CLOSED and `Telo.`-qualified, so there is nothing here to
+ * resolve against an alias scope: a name is a built-in or it is a mistake. A
+ * SHAPE is a different thing entirely and is named with the reference tag, which
+ * carries its own resolution and its own diagnostics — this pass never sees one,
+ * because `resolveSchemaTypeRefs` has already turned it into a `$ref`.
+ *
+ * Scoping follows `X_TELO_REF_UNRESOLVED`: reported only for manifests in the
+ * entry's own modules, since a published dependency is not the consumer's to fix.
+ *
+ * Browser-safe: no Node built-ins.
+ */
+import { type ResourceManifest } from "@telorun/sdk";
+export interface ValueTypeSlotIssue {
+    code: "X_TELO_TYPE_UNKNOWN" | "X_TELO_TYPE_ARGUMENT_UNKNOWN";
+    manifest: ResourceManifest;
+    /** Dotted path to the annotated schema node, e.g. `schema.properties.body`. */
+    path: string;
+    message: string;
+    /** The whole-value replacement that repairs it, when one is derivable. A
+     *  misspelled name has a single correct spelling and the annotation's value is
+     *  that name, so the repair is the primitive `DiagnosticFix` already carries —
+     *  computing a suggestion and printing it in prose alone leaves the author to
+     *  retype what the analyzer already knows. Only for the bare-name spelling: the
+     *  object form's name is nested, and a whole-value replacement there would
+     *  discard the type arguments beside it. */
+    fix?: {
+        replacement: string;
+    };
+}
+/** Every `x-telo-type` problem in one manifest, wherever a schema is written. */
+export declare function validateValueTypeSlots(manifest: ResourceManifest): ValueTypeSlotIssue[];
+//# sourceMappingURL=validate-value-type-slots.d.ts.map

package/dist/validate-value-type-slots.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-value-type-slots.d.ts","sourceRoot":"","sources":["../src/validate-value-type-slots.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAA+C,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIlG,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,qBAAqB,GAAG,8BAA8B,CAAC;IAC7D,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;gDAM4C;IAC5C,GAAG,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/B;AAwID,iFAAiF;AACjF,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,kBAAkB,EAAE,CAIvF"}

package/dist/validate-value-type-slots.js

@@ -0,0 +1,142 @@
+/**
+ * Static validation of the `x-telo-type` annotation itself — the strict half of
+ * the accessor split, and the `validate-ref-slots.ts` precedent.
+ *
+ * `readValueTypeSlot` is deliberately lenient: it reports whatever it can read,
+ * returning a slot with no `entry` for a name it does not know. That leniency is
+ * what lets every surface keep working; this pass is what stops it becoming
+ * silence. Before the unification an unrecognized brand simply resolved to
+ * `undefined` and the slot quietly lost its identity — the same class of failure
+ * `X_TELO_REF_INVALID_USE` exists to prevent for `use` tokens.
+ *
+ * The vocabulary is CLOSED and `Telo.`-qualified, so there is nothing here to
+ * resolve against an alias scope: a name is a built-in or it is a mistake. A
+ * SHAPE is a different thing entirely and is named with the reference tag, which
+ * carries its own resolution and its own diagnostics — this pass never sees one,
+ * because `resolveSchemaTypeRefs` has already turned it into a `$ref`.
+ *
+ * Scoping follows `X_TELO_REF_UNRESOLVED`: reported only for manifests in the
+ * entry's own modules, since a published dependency is not the consumer's to fix.
+ *
+ * Browser-safe: no Node built-ins.
+ */
+import { readValueTypeSlot, VALUE_TYPES, X_TELO_TYPE } from "@telorun/sdk";
+import { distance } from "./levenshtein.js";
+import { isInSchemaRegion } from "./schema-region.js";
+/** Schema regions are reached by ANCESTRY, not by root key — see
+ *  `schema-region.ts`. Walking a manifest's root fields covers only a fraction of
+ *  the sites an author writes a schema at: an API route's `request.schema.body`
+ *  sits under `routes`, and a check that never reaches it is a hole in exactly
+ *  the diagnostic that exists to stop an unknown name degrading silently. */
+/** The closest declared type name within an edit-distance threshold, or
+ *  undefined. Mirrors `computeSuggestKind`: case-sensitive, and silent on a tie,
+ *  because a coin-flip suggestion is worse than none. */
+function suggestValueType(name) {
+    if (!name)
+        return undefined;
+    const threshold = Math.min(3, Math.floor(name.length / 3));
+    if (threshold < 1)
+        return undefined;
+    let best;
+    let bestDist = threshold + 1;
+    let tied = false;
+    for (const candidate of VALUE_TYPES.keys()) {
+        const d = distance(name, candidate);
+        if (d < bestDist) {
+            best = candidate;
+            bestDist = d;
+            tied = false;
+        }
+        else if (d === bestDist) {
+            tied = true;
+        }
+    }
+    return !best || bestDist > threshold || tied ? undefined : best;
+}
+function declaredNames() {
+    return [...VALUE_TYPES.keys()].join(", ");
+}
+/** Report the annotation on one schema node. */
+function checkNode(node, manifest, path, issues) {
+    const slot = readValueTypeSlot(node);
+    if (!slot)
+        return;
+    if (!slot.entry) {
+        const suggestion = suggestValueType(slot.name);
+        // Only the bare-name spelling can carry the repair: it IS the annotation's
+        // whole value, which is the only shape `DiagnosticFix` describes.
+        const bareName = typeof node[X_TELO_TYPE] === "string";
+        issues.push({
+            code: "X_TELO_TYPE_UNKNOWN",
+            manifest,
+            path,
+            message: `'${slot.name || "(missing name)"}' is not a value type. ` +
+                (suggestion ? `Did you mean '${suggestion}'? ` : "") +
+                `Declared types: ${declaredNames()}. A value type names how a value is ` +
+                `REPRESENTED and is kernel-owned; to name a shape, reference it with !ref.`,
+            ...(suggestion && bareName ? { fix: { replacement: suggestion } } : {}),
+        });
+        return;
+    }
+    const declared = new Set(slot.entry.parameters.map((p) => p.name));
+    for (const argument of Object.keys(slot.args)) {
+        if (declared.has(argument))
+            continue;
+        issues.push({
+            code: "X_TELO_TYPE_ARGUMENT_UNKNOWN",
+            manifest,
+            path,
+            message: `'${slot.entry.name}' declares no type parameter '${argument}'. ` +
+                (declared.size > 0
+                    ? `Its parameters: ${[...declared].join(", ")}.`
+                    : `It takes no type parameters.`),
+        });
+    }
+}
+/** Walk a schema value, reporting every annotation it carries.
+ *
+ *  Descends through every container rather than through a keyword list: a value
+ *  type is legal at any schema position — a property, an item, a union branch, a
+ *  `$defs` entry, a type argument — and enumerating positions is how a check
+ *  ends up not covering the one an author used. */
+function walk(value, manifest, path, segments, seen, issues) {
+    if (value === null || typeof value !== "object")
+        return;
+    if (seen.has(value))
+        return;
+    seen.add(value);
+    if (Array.isArray(value)) {
+        value.forEach((item, i) => walk(item, manifest, `${path}[${i}]`, [...segments, i], seen, issues));
+        return;
+    }
+    const node = value;
+    // Report only inside a schema region. The walk itself is unbounded — reporting
+    // is safe anywhere, unlike a rewrite — but an `x-telo-type` key sitting in a
+    // resource's own configuration is not a schema annotation and is not this
+    // check's to judge.
+    if (isInSchemaRegion([...segments, X_TELO_TYPE])) {
+        checkNode(node, manifest, path, issues);
+    }
+    for (const [key, child] of Object.entries(node)) {
+        // The annotation's own value is read by `checkNode`; descending into it
+        // would report the type ARGUMENTS as if they were annotated nodes of their
+        // own. Their turn comes below, as ordinary schema nodes.
+        if (key === X_TELO_TYPE) {
+            // Walk the NORMALIZED arguments, so a bare-name argument (`of: Telo.Bytes`)
+            // is checked exactly as its expanded form is — the sugar must not be a
+            // hole in the check that exists to catch a misspelled name.
+            const slot = readValueTypeSlot(node);
+            for (const [argName, argValue] of Object.entries(slot?.args ?? {})) {
+                walk(argValue, manifest, `${path}.${X_TELO_TYPE}.${argName}`, [...segments, X_TELO_TYPE, argName], seen, issues);
+            }
+            continue;
+        }
+        walk(child, manifest, path ? `${path}.${key}` : key, [...segments, key], seen, issues);
+    }
+}
+/** Every `x-telo-type` problem in one manifest, wherever a schema is written. */
+export function validateValueTypeSlots(manifest) {
+    const issues = [];
+    walk(manifest, manifest, "", [], new Set(), issues);
+    return issues;
+}

package/dist/value-type-keyword.d.ts

@@ -0,0 +1,60 @@
+/** The AJV half of `x-telo-type`, and the single place any Telo keyword is
+ *  registered on an AJV instance.
+ *
+ *  WHY CODEGEN RATHER THAN A `validate` FUNCTION. The kernel compiles standalone
+ *  validators and caches them on disk; a function-valued keyword does not survive
+ *  that serialization, so the check would silently be absent from exactly the
+ *  validators the runtime uses. Codegen inlines instead.
+ *
+ *  WHY THE CODEGEN LIVES HERE AND THE VOCABULARY DOES NOT. The SDK cannot depend
+ *  on ajv, and an entry declares a REPRESENTATION rather than a code fragment —
+ *  which is what lets one JSON file be read by a Rust kernel that has no AJV at
+ *  all. The split is the whole point: `sdk/value-types/*.json` says *what a value
+ *  is*, `sdk/nodejs/src/value-type.ts` says *what that means in this runtime*,
+ *  and this file turns the pair into a check.
+ *
+ *  ONE REGISTRATION SITE. {@link registerTeloKeywords} replaced five drifted
+ *  ones — the analyzer's `createAjv` and the kernel's `schema-validator`,
+ *  `resource-context`, `observed-state` and `manifest-schemas` — which registered
+ *  overlapping lists of twelve, four, one and one. Drift there is not cosmetic: a
+ *  no-op registration is what keeps `strict` mode quiet about an annotation, and
+ *  a keyword that emits code is missing entirely from any instance that forgot
+ *  it, so the same schema validated two ways depending on which AJV saw it. */
+import type { KeywordDefinition } from "ajv";
+/**
+ * Annotations that carry no validation at all: analyzer, editor and topology
+ * metadata. Registered as no-ops so AJV does not treat them as unknown keywords,
+ * and listed in one place so an instance cannot know about half of them.
+ *
+ * `x-telo-type` is deliberately absent — it is the one that emits code.
+ */
+export declare const ANNOTATION_KEYWORDS: readonly ["x-telo-bindings-from", "x-telo-catches-for", "x-telo-context", "x-telo-context-element-from", "x-telo-context-from", "x-telo-context-from-ref-kind", "x-telo-context-from-root", "x-telo-context-ref-from", "x-telo-error-context", "x-telo-eval", "x-telo-inline", "x-telo-outcome-list", "x-telo-provides-zone", "x-telo-ref", "x-telo-requires-zone", "x-telo-schema-from", "x-telo-scope", "x-telo-step-context", "x-telo-topology-role", "x-telo-value-schema-from", "x-telo-widget"];
+/**
+ * The `x-telo-type` keyword.
+ *
+ * Three postures, decided by the entry and never by this code:
+ *
+ *  - a `json` representation validates through its own declared schema, so the
+ *    keyword emits nothing — the name carries nominal identity for static wiring
+ *    and has no runtime existence at all;
+ *  - a `live` instance is EXEMPT: its value is never traversed, because iterating
+ *    a stream to check it is precisely what the exemption is for;
+ *  - every other instance is ASSERTED against the constructor its binding names.
+ *
+ * An unknown name emits nothing here. It is a hard diagnostic in the analyzer
+ * (`X_TELO_TYPE_UNKNOWN`), which is where a name can be reported against the
+ * manifest that wrote it; failing compilation instead would take out every
+ * validator in a module for one typo in one slot.
+ */
+export declare function valueTypeKeyword(): KeywordDefinition;
+/**
+ * Register every Telo keyword on an AJV instance: the annotations as no-ops and
+ * `x-telo-type` as the one that checks.
+ *
+ * Every AJV instance in the runtime and the analyzer goes through this, so a
+ * schema means the same thing wherever it is validated.
+ */
+export declare function registerTeloKeywords(ajv: {
+    addKeyword: (keyword: any, definition?: any) => unknown;
+}): void;
+//# sourceMappingURL=value-type-keyword.d.ts.map