@telorun/analyzer 0.58.0 → 0.59.0

package/dist/index.d.ts

@@ -13,8 +13,8 @@ export { moduleScopedDefResolver, scopeResolverForModule } from "./alias-resolve
 export type { ModuleScopes } from "./alias-resolver.js";
 export { ancestorChain, contractDeclarer, controllerBearingAncestor, effectiveAuthorSchema, effectiveContractField, effectiveStatusSchema, hasOwnControllerOrTemplate, inheritedCapability, isInheritedDelegation, mappingFieldFor, needsContractMapping, resolveParent, } from "./extends-resolution.js";
 export type { ContractDirection, DefResolver } from "./extends-resolution.js";
-export { defaultBearingPaths, PERMISSIVE_CONTRACT, resolveContract, resolveContractSchema, withLiveValuesSkipped, } from "./invocation-contract.js";
-export type { ContractOrigin, ContractScope, ResolvedContract } from "./invocation-contract.js";
+export { defaultBearingPaths, declaredScalarPaths, PERMISSIVE_CONTRACT, resolveContract, resolveContractSchema, withLiveValuesSkipped, } from "./invocation-contract.js";
+export type { ContractOrigin, ContractScope, DeclaredScalarForm, DeclaredScalarPath, ResolvedContract, } from "./invocation-contract.js";
 export { hasIntermediateWildcard, parseRedactionPath, RedactionPathError, } from "./redaction-path.js";
 export type { RedactionSegment } from "./redaction-path.js";
 export { buildCallGraph, projectToPairs, resourceId } from "./call-graph.js";
@@ -37,7 +37,7 @@ export { validateDynamicSelectors, validateRefSlotDeclarations } from "./validat
 export type { RefSlotIssue } from "./validate-ref-slots.js";
 export { validateValueTypeSlots } from "./validate-value-type-slots.js";
 export type { ValueTypeSlotIssue } from "./validate-value-type-slots.js";
-export { checkSchemaCompatibility } from "./schema-compat.js";
+export { checkSchemaCompatibility, selectUnionBranch } from "./schema-compat.js";
 export type { CompatibilityResult } from "./schema-compat.js";
 export { visitManifest } from "./manifest-visitor.js";
 export type { CelSiteEvent, ManifestVisitor, RefSiteEvent, ResourceEnterEvent, ResourceExitEvent, ScopeBoundaryEvent, SchemaFromSiteEvent, VisitOptions, } from "./manifest-visitor.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACjF,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,0BAA0B,EAC1B,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,iCAAiC,EACjC,wBAAwB,EACxB,iBAAiB,EACjB,iCAAiC,EACjC,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACxF,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACtF,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,oBAAoB,EACpB,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAChG,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7E,YAAY,EACV,qBAAqB,EACrB,SAAS,EACT,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC5F,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EACL,cAAc,EACd,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,cAAc,EACd,WAAW,EACX,YAAY,EACZ,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EACL,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,EACvB,eAAe,EACf,sBAAsB,GACvB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAChG,YAAY,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,YAAY,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,YAAY,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EACL,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACnB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC/E,YAAY,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EACL,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,sBAAsB,EACtB,WAAW,EACX,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,SAAS,EACT,YAAY,EACZ,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,eAAe,EACf,cAAc,GACf,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAIvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC3E,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC1F,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACjF,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,0BAA0B,EAC1B,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,iCAAiC,EACjC,wBAAwB,EACxB,iBAAiB,EACjB,iCAAiC,EACjC,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACxF,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACtF,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,oBAAoB,EACpB,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7E,YAAY,EACV,qBAAqB,EACrB,SAAS,EACT,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC5F,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EACL,cAAc,EACd,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,cAAc,EACd,WAAW,EACX,YAAY,EACZ,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EACL,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,EACvB,eAAe,EACf,sBAAsB,GACvB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAChG,YAAY,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,YAAY,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACjF,YAAY,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EACL,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACnB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC/E,YAAY,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EACL,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,sBAAsB,EACtB,WAAW,EACX,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,SAAS,EACT,YAAY,EACZ,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,eAAe,EACf,cAAc,GACf,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAIvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC3E,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC1F,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -7,7 +7,7 @@ export { BINDINGS_ANNOTATION, bindingContextProperties, bindingDependencies, fin
 export { applyObservedStateNode, buildObservedStateIndex, buildObservedStateResourcesSchema, collectRunReachableNames, observedStateRead, validateObservedStateDeclarations, OBSERVED_STATE_SCHEMA, } from "./validate-observed-state.js";
 export { moduleScopedDefResolver, scopeResolverForModule } from "./alias-resolver.js";
 export { ancestorChain, contractDeclarer, controllerBearingAncestor, effectiveAuthorSchema, effectiveContractField, effectiveStatusSchema, hasOwnControllerOrTemplate, inheritedCapability, isInheritedDelegation, mappingFieldFor, needsContractMapping, resolveParent, } from "./extends-resolution.js";
-export { defaultBearingPaths, PERMISSIVE_CONTRACT, resolveContract, resolveContractSchema, withLiveValuesSkipped, } from "./invocation-contract.js";
+export { defaultBearingPaths, declaredScalarPaths, PERMISSIVE_CONTRACT, resolveContract, resolveContractSchema, withLiveValuesSkipped, } from "./invocation-contract.js";
 export { hasIntermediateWildcard, parseRedactionPath, RedactionPathError, } from "./redaction-path.js";
 export { buildCallGraph, projectToPairs, resourceId } from "./call-graph.js";
 export { buildReferenceFieldMap, isRefEntry, isScopeEntry } from "./reference-field-map.js";
@@ -19,7 +19,7 @@ export { deriveLibraryExportRequirements, projectZoneRequirements, runZoneAnalys
 export { validateZoneSlotDeclarations } from "./validate-zone-slots.js";
 export { validateDynamicSelectors, validateRefSlotDeclarations } from "./validate-ref-slots.js";
 export { validateValueTypeSlots } from "./validate-value-type-slots.js";
-export { checkSchemaCompatibility } from "./schema-compat.js";
+export { checkSchemaCompatibility, selectUnionBranch } from "./schema-compat.js";
 export { visitManifest } from "./manifest-visitor.js";
 export { Loader } from "./manifest-loader.js";
 export { isModuleKind, MODULE_KINDS } from "./module-kinds.js";

package/dist/invocation-contract.d.ts

@@ -105,4 +105,41 @@ export declare function defaultBearingPaths(schema: Record<string, any>,
  *  declares its defaults behind the reference, and a walk that cannot follow
  *  it would report none, leaving the caller's data shared where a fill lands. */
 resolveRef?: (ref: string) => Record<string, any> | undefined): string[][];
+/** The scalar form a declared node's value takes at runtime. `int64` and
+ *  `double` are the two JSON scalars whose runtime representation is NOT decided
+ *  by the value that arrives: a CEL integer is a BigInt and a CEL double a JS
+ *  number, and both are `typeof "number" | "bigint"` away from what a declaration
+ *  says they are. Everything else — string, boolean, object, array, and every
+ *  `instance` value type — is already its own representation, so it is not
+ *  listed and never rewritten. */
+export type DeclaredScalarForm = "int64" | "double";
+export interface DeclaredScalarPath {
+    readonly path: string[];
+    readonly form: DeclaredScalarForm;
+}
+/** Every path in `schema` whose declared type fixes a scalar representation —
+ *  the leaves a value must carry in that form for the contract to be TRUE, not
+ *  merely to pass.
+ *
+ *  A declared shape says what the value IS, the same service a JSON Schema gives
+ *  an HTTP response serializer. Telo's CEL layer takes it literally:
+ *  `jsonSchemaToCelType` maps `integer` to CEL `int` and `number` to `double`,
+ *  and a CEL int IS a BigInt — so a controller handing back a plain JS number at
+ *  an `integer` slot makes the declaration a lie that surfaces nowhere until an
+ *  expression composes it, as `result.n + 1` type-checking statically and then
+ *  dying at dispatch with `no such overload: dyn<double> + int`.
+ *
+ *  A VALUE TYPE is read through the same rule rather than beside it: a `json`
+ *  representation refines a JSON type and contributes its `base` (so
+ *  `Telo.TcpPort` is an `int64` slot), while an `instance` representation
+ *  REPLACES the JSON layer — a byte buffer and a stream handle are already their
+ *  own representation, nothing converts to them, and the walk stops there rather
+ *  than descending into a value that is not a plain container.
+ *
+ *  Bounded by the schema's declarations rather than by the size of the payload,
+ *  exactly as {@link defaultBearingPaths} is: a contract declaring no such
+ *  scalar walks nothing at dispatch. A union counts when it names exactly one of
+ *  the two — `["integer", "null"]` is still the integer branch, while
+ *  `["integer", "number"]` fixes nothing and is left alone. */
+export declare function declaredScalarPaths(schema: Record<string, any>, resolveRef?: (ref: string) => Record<string, any> | undefined): DeclaredScalarPath[];
 //# sourceMappingURL=invocation-contract.d.ts.map

package/dist/invocation-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"invocation-contract.d.ts","sourceRoot":"","sources":["../src/invocation-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EACL,KAAK,iBAAiB,EAEtB,KAAK,WAAW,EAEjB,MAAM,yBAAyB,CAAC;AAGjC,YAAY,EAAE,iBAAiB,EAAE,CAAC;AAElC;;;;;;;;;;;;GAYG;AAEH;;oCAEoC;AACpC,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,MAAM,CAAC;AAEjD,MAAM,WAAW,gBAAgB;IAC/B,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5B,MAAM,EAAE,cAAc,CAAC;IACvB;gFAC4E;IAC5E,UAAU,CAAC,EAAE,kBAAkB,CAAC;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B;;kEAE8D;IAC9D,iBAAiB,EAAE,WAAW,CAAC;IAC/B;;;;;;;;;OASG;IACH,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CAC9E;AAED;;uCAEuC;AACvC,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAGnD,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,iBAAiB,EAC5B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACzC,UAAU,EAAE,kBAAkB,GAAG,SAAS,EAC1C,KAAK,EAAE,aAAa,GACnB,gBAAgB,GAAG,SAAS,CAa9B;AAED;;mDAEmD;AACnD,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,iBAAiB,EAC5B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACzC,UAAU,EAAE,kBAAkB,GAAG,SAAS,EAC1C,KAAK,EAAE,aAAa,GACnB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAErB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;AAC3B;;;;6CAI6C;AAC7C,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAC5D,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAErB;AAoFD;;;;;gEAKgE;AAChE,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;AAC3B;;iFAEiF;AACjF,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAC5D,MAAM,EAAE,EAAE,CA+BZ"}
+{"version":3,"file":"invocation-contract.d.ts","sourceRoot":"","sources":["../src/invocation-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,kBAAkB,EAAe,MAAM,cAAc,CAAC;AAChF,OAAO,EACL,KAAK,iBAAiB,EAEtB,KAAK,WAAW,EAEjB,MAAM,yBAAyB,CAAC;AAGjC,YAAY,EAAE,iBAAiB,EAAE,CAAC;AAElC;;;;;;;;;;;;GAYG;AAEH;;oCAEoC;AACpC,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,MAAM,CAAC;AAEjD,MAAM,WAAW,gBAAgB;IAC/B,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5B,MAAM,EAAE,cAAc,CAAC;IACvB;gFAC4E;IAC5E,UAAU,CAAC,EAAE,kBAAkB,CAAC;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B;;kEAE8D;IAC9D,iBAAiB,EAAE,WAAW,CAAC;IAC/B;;;;;;;;;OASG;IACH,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CAC9E;AAED;;uCAEuC;AACvC,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAGnD,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,iBAAiB,EAC5B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACzC,UAAU,EAAE,kBAAkB,GAAG,SAAS,EAC1C,KAAK,EAAE,aAAa,GACnB,gBAAgB,GAAG,SAAS,CAa9B;AAED;;mDAEmD;AACnD,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,iBAAiB,EAC5B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACzC,UAAU,EAAE,kBAAkB,GAAG,SAAS,EAC1C,KAAK,EAAE,aAAa,GACnB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAErB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;AAC3B;;;;6CAI6C;AAC7C,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAC5D,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAErB;AAoFD;;;;;gEAKgE;AAChE,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;AAC3B;;iFAEiF;AACjF,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAC5D,MAAM,EAAE,EAAE,CA+BZ;AAED;;;;;;kCAMkC;AAClC,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEpD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;;;;+DAuB+D;AAC/D,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAC5D,kBAAkB,EAAE,CAoCtB"}

package/dist/invocation-contract.js

@@ -1,4 +1,4 @@
-import { isLiveSlot } from "@telorun/sdk";
+import { isLiveSlot, valueTypeOf } from "@telorun/sdk";
 import { contractDeclarer, effectiveContractField, } from "./extends-resolution.js";
 import { resolveTypeFieldToSchema } from "./validate-cel-context.js";
 /** The fallback for a target that declares no contract: anything goes. Not
@@ -203,3 +203,83 @@ resolveRef) {
     walk(schema, [], []);
     return out;
 }
+/** Every path in `schema` whose declared type fixes a scalar representation —
+ *  the leaves a value must carry in that form for the contract to be TRUE, not
+ *  merely to pass.
+ *
+ *  A declared shape says what the value IS, the same service a JSON Schema gives
+ *  an HTTP response serializer. Telo's CEL layer takes it literally:
+ *  `jsonSchemaToCelType` maps `integer` to CEL `int` and `number` to `double`,
+ *  and a CEL int IS a BigInt — so a controller handing back a plain JS number at
+ *  an `integer` slot makes the declaration a lie that surfaces nowhere until an
+ *  expression composes it, as `result.n + 1` type-checking statically and then
+ *  dying at dispatch with `no such overload: dyn<double> + int`.
+ *
+ *  A VALUE TYPE is read through the same rule rather than beside it: a `json`
+ *  representation refines a JSON type and contributes its `base` (so
+ *  `Telo.TcpPort` is an `int64` slot), while an `instance` representation
+ *  REPLACES the JSON layer — a byte buffer and a stream handle are already their
+ *  own representation, nothing converts to them, and the walk stops there rather
+ *  than descending into a value that is not a plain container.
+ *
+ *  Bounded by the schema's declarations rather than by the size of the payload,
+ *  exactly as {@link defaultBearingPaths} is: a contract declaring no such
+ *  scalar walks nothing at dispatch. A union counts when it names exactly one of
+ *  the two — `["integer", "null"]` is still the integer branch, while
+ *  `["integer", "number"]` fixes nothing and is left alone. */
+export function declaredScalarPaths(schema, resolveRef) {
+    const out = [];
+    const walk = (node, path, chain) => {
+        if (!node || typeof node !== "object")
+            return;
+        let s = node;
+        if (chain.includes(s))
+            return;
+        if (resolveRef && typeof s.$ref === "string") {
+            const target = resolveRef(s.$ref);
+            if (!target || chain.includes(target))
+                return;
+            s = { ...target, ...s, $ref: undefined };
+        }
+        const here = [...chain, node];
+        const entry = valueTypeOf(s);
+        // An `instance` representation replaces the JSON layer: it is its own
+        // representation, so there is nothing to normalize to and nothing below it
+        // that is a plain container to walk.
+        if (entry && entry.representation === "instance")
+            return;
+        const form = scalarFormOf(entry && entry.base !== undefined ? entry.base : s.type);
+        if (form && path.length > 0)
+            out.push({ path, form });
+        const properties = s.properties;
+        if (properties) {
+            for (const [key, child] of Object.entries(properties))
+                walk(child, [...path, key], here);
+        }
+        for (const branch of ["allOf", "anyOf", "oneOf"]) {
+            const list = s[branch];
+            if (Array.isArray(list))
+                for (const child of list)
+                    walk(child, path, here);
+        }
+        if (s.items)
+            walk(s.items, [...path, "[]"], here);
+    };
+    walk(schema, [], []);
+    return out;
+}
+function scalarFormOf(declared) {
+    if (declared === "integer")
+        return "int64";
+    if (declared === "number")
+        return "double";
+    if (!Array.isArray(declared))
+        return undefined;
+    const integer = declared.includes("integer");
+    const number = declared.includes("number");
+    // A union naming both fixes nothing — either representation satisfies it, so
+    // rewriting one into the other would be a choice the declaration never made.
+    if (integer === number)
+        return undefined;
+    return integer ? "int64" : "double";
+}

package/dist/schema-compat.d.ts

@@ -78,6 +78,24 @@ export declare function celTypeSatisfiesJsonSchema(celType: string, schema: Reco
 export declare function celPlaceholderForSchema(rawSchema: Record<string, any>): unknown;
 /** Resolve a `$ref` (only `#/$defs/...` form) against the root schema. */
 export declare function resolveRef(schema: Record<string, any>, root: Record<string, any>): Record<string, any>;
+/** Collect property schemas from top-level `properties` and all `oneOf`/`anyOf` sub-schemas. */
+/**
+ * The `oneOf` / `anyOf` branch a value is written against, when exactly one fits.
+ *
+ * A union carries no `type` / `properties` / `items` of its own, so a walker that
+ * ignores it descends with an empty schema and hands every CEL leaf underneath a
+ * `null` placeholder — which then fails every branch and reports a pile of
+ * violations against a value that is perfectly valid. Picking the branch first
+ * is what lets the leaves be typed.
+ *
+ * Selection is structural and conservative: a branch must agree with the data's
+ * kind, and for an object every `required` key must be present (which is what
+ * separates a `{type, text}` part from a `{type, data, mediaType}` one). If that
+ * leaves anything other than exactly one branch, the union is returned unchanged
+ * — an ambiguous union is one the analyzer should not resolve on the author's
+ * behalf.
+ */
+export declare function selectUnionBranch(schema: Record<string, any>, data: unknown, root: Record<string, any>): Record<string, any>;
 export declare function collectProperties(schema: Record<string, any>): Record<string, any>;
 /** Deep-clone `data`, replacing every pure CEL template string (`${{ expr }}`) with a
  *  schema-appropriate placeholder so AJV can validate non-CEL fields without false positives. */

package/dist/schema-compat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-compat.d.ts","sourceRoot":"","sources":["../src/schema-compat.ts"],"names":[],"mappings":"AAkBA,QAAA,MAAM,GAAG,KAA0C,CAAC;AAEpD;;;;;;;mCAOmC;AACnC,wBAAgB,SAAS,IAAI,YAAY,CAAC,OAAO,GAAG,CAAC,CAYpD;AAKD,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAC5D,mBAAmB,CAIrB;AAyID,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAelD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAGxE;AAuBD,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;CACd;AAaD,0GAA0G;AAC1G,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,WAAW,EAAE,CAsB/F;AAED;qFACqF;AACrF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAQ7E;AAED;;;;6DAI6D;AAC7D,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,EAAE,MAAM,GACX,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAsBjC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAqB,CAAC;AAE1E;;iEAEiE;AACjE,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAGzF;AAED,8DAA8D;AAC9D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,CA6BnF;AAED,wFAAwF;AACxF,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CA2ChG;AAkED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CA8C/E;AAqBD,0EAA0E;AAC1E,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAOtG;AAyDD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAwBlF;AAED;iGACiG;AACjG,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;AAChC;;;;;;;;6DAQ6D;AAC7D,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EACrC,IAAI,SAAK,GACR,OAAO,CAiET"}
+{"version":3,"file":"schema-compat.d.ts","sourceRoot":"","sources":["../src/schema-compat.ts"],"names":[],"mappings":"AAkBA,QAAA,MAAM,GAAG,KAA0C,CAAC;AAEpD;;;;;;;mCAOmC;AACnC,wBAAgB,SAAS,IAAI,YAAY,CAAC,OAAO,GAAG,CAAC,CAYpD;AAKD,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAYD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAC5D,mBAAmB,CAIrB;AAuKD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAelD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAGxE;AAuBD,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;CACd;AAaD,0GAA0G;AAC1G,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,WAAW,EAAE,CAsB/F;AAED;qFACqF;AACrF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAQ7E;AAED;;;;6DAI6D;AAC7D,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,EAAE,MAAM,GACX,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAsBjC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAqB,CAAC;AAE1E;;iEAEiE;AACjE,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAGzF;AAED,8DAA8D;AAC9D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,CA6BnF;AAED,wFAAwF;AACxF,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAkDhG;AAkED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CA+D/E;AAqBD,0EAA0E;AAC1E,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAOtG;AAED,gGAAgG;AAChG;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,EAAE,OAAO,EACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAgCrB;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAwBlF;AAED;iGACiG;AACjG,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;AAChC;;;;;;;;6DAQ6D;AAC7D,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EACrC,IAAI,SAAK,GACR,OAAO,CAiET"}

package/dist/schema-compat.js

@@ -27,6 +27,16 @@ export function createAjv() {
 }
 const ajv = createAjv();
 const compiledSchemaValidators = new WeakMap();
+/** The alternatives a union node declares, or undefined when it is not one.
+ *  `anyOf` and `oneOf` are one question here — which branches could accept this
+ *  value — and their difference (exactly-one vs at-least-one) is a validation
+ *  rule, not a compatibility one. */
+function unionBranches(schema) {
+    const branches = schema.anyOf ?? schema.oneOf;
+    if (!Array.isArray(branches) || branches.length === 0)
+        return undefined;
+    return branches.filter((b) => b && typeof b === "object");
+}
 /**
  * Conservative structural JSON Schema compatibility check — is a value shaped
  * like `source` acceptable where `target` is declared?
@@ -80,6 +90,37 @@ function compare(rawSource, rawTarget, path, issues, resolveRef, seen) {
     }
     const source = deref(rawSource, resolveRef);
     const target = deref(rawTarget, resolveRef);
+    // A union is ALTERNATIVES, so it is compared by distributing over branches on
+    // both sides: a definite conflict is one where no source-branch/target-branch
+    // pair agrees. Returning silently the moment either side was a union — which
+    // is what this did — switched the whole comparison off for any slot that
+    // accepts more than one shape, and those are exactly the slots where a value
+    // type carries the only information distinguishing the branches.
+    //
+    // `allOf` is a conjunction rather than a choice, so it keeps the old posture:
+    // it says too little to judge and stays compatible.
+    if (source.allOf || target.allOf)
+        return;
+    const sourceBranches = unionBranches(source);
+    const targetBranches = unionBranches(target);
+    if (sourceBranches || targetBranches) {
+        const lefts = sourceBranches ?? [source];
+        const rights = targetBranches ?? [target];
+        const reasons = [];
+        for (const left of lefts) {
+            for (const right of rights) {
+                const probe = [];
+                // A fresh `seen` per probe: a pair rejected on one branch must not mark
+                // a reference pair visited for the next, which would silently pass it.
+                compare(left, right, path, probe, resolveRef, new Set(seen));
+                if (probe.length === 0)
+                    return;
+                reasons.push(...probe);
+            }
+        }
+        issues.push(`${path || "/"}: no alternative matches — ${[...new Set(reasons)].join("; ")}`);
+        return;
+    }
     // Value types first: an `instance` representation has no JSON `type` to
     // compare, so its identity IS the comparison — and its arguments are where the
     // real information lives.
@@ -127,10 +168,6 @@ function compare(rawSource, rawTarget, path, issues, resolveRef, seen) {
         issues.push(`${path || "/"}: type mismatch — source is '${source.type}', target expects '${target.type}'`);
         return;
     }
-    if (source.anyOf || source.oneOf || source.allOf)
-        return;
-    if (target.anyOf || target.oneOf || target.allOf)
-        return;
     // An array's element, which the old comparison never looked at — so every
     // nested shape passed regardless of what it contained.
     if (target.items && source.items) {
@@ -370,8 +407,16 @@ export function celTypeSatisfiesJsonSchema(celType, schema) {
     }
     if (!schema.type && !schema.anyOf && !schema.oneOf && !schema.allOf)
         return true;
-    if (schema.anyOf || schema.oneOf || schema.allOf)
+    // `allOf` is a conjunction and says too little to judge from a single CEL
+    // type. A union is a CHOICE, so it is satisfied by satisfying any branch —
+    // distributed for the same reason `compare` does it: accepting every union
+    // outright turns the check off for exactly the slots that admit more than one
+    // shape, and those are the ones where the branches carry the information.
+    if (schema.allOf)
         return true;
+    const branches = unionBranches(schema);
+    if (branches)
+        return branches.some((branch) => celTypeSatisfiesJsonSchema(celType, branch));
     const schemaTypes = Array.isArray(schema.type) ? schema.type : [schema.type];
     const accepted = {
         int: ["integer", "number"],
@@ -482,6 +527,24 @@ export function celPlaceholderForSchema(rawSchema) {
     // the real value is checked at runtime once the expression resolves.
     if (Array.isArray(schema.enum) && schema.enum.length > 0)
         return schema.enum[0];
+    // A UNION with no `type` of its own. Without this, a whole-field CEL leaf at
+    // such a slot gets `null`, which every branch then rejects — so a field
+    // declared `anyOf: [array, boolean]` could not be written as an expression at
+    // all, while one whose union happens to contain a `live` branch escaped by
+    // accident (nothing validates a live value, so `null` passed). The first
+    // branch that yields a placeholder wins: the same conservative posture
+    // `selectUnionBranch` takes, and enough for AJV, whose question is only
+    // whether SOME branch accepts the stand-in.
+    if (schema.type === undefined) {
+        const branches = unionBranches(schema);
+        if (branches) {
+            for (const branch of branches) {
+                const candidate = celPlaceholderForSchema(branch);
+                if (candidate !== null)
+                    return candidate;
+            }
+        }
+    }
     switch (schema.type) {
         case "integer":
         case "number":
@@ -553,7 +616,7 @@ export function resolveRef(schema, root) {
  * — an ambiguous union is one the analyzer should not resolve on the author's
  * behalf.
  */
-function selectUnionBranch(schema, data, root) {
+export function selectUnionBranch(schema, data, root) {
     const branches = (schema.oneOf ?? schema.anyOf);
     if (!Array.isArray(branches) || branches.length === 0)
         return schema;

package/dist/validate-cel-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAItF,MAAM,WAAW,kBAAkB;IACjC;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC;;kDAE8C;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;KACxD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AA4CD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CA0EjC;AAuFD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAChD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAiJrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB;AAWD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,SAAM,GACT,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAC,CAGvD;AAUD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,SAAM,GAAG,MAAM,EAAE,CAqBxF"}
+{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAStF,MAAM,WAAW,kBAAkB;IACjC;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC;;kDAE8C;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;KACxD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AA4CD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CA0EjC;AAyID;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAChD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CA+JrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB;AAWD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,SAAM,GACT,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAC,CAGvD;AAUD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,SAAM,GAAG,MAAM,EAAE,CAqBxF"}

package/dist/validate-cel-context.js

@@ -1,5 +1,5 @@
 export { extractAccessChains, validateChainAgainstSchema } from "@telorun/templating";
-import { mergeTypeSchemas, parseCanonicalTypeSchemaId } from "@telorun/sdk";
+import { elementSchemaOf, isLiveSlot, mergeTypeSchemas, parseCanonicalTypeSchemaId, } from "@telorun/sdk";
 import { KERNEL_BUILTINS } from "./builtins.js";
 /**
  * Resolve a type field value (string name, inline type, or raw schema) to a JSON Schema.
@@ -168,22 +168,64 @@ function schemaAtChain(chain, root) {
     }
     return cur && typeof cur === "object" ? cur : undefined;
 }
-/** The element schema of a sibling collection expression, when statically known.
- *  Resolves `inputs.*` chains against the resource's `inputs:` contract and
- *  returns the array's `items`. Returns undefined for non-chain or untyped
- *  collections (caller substitutes `dyn`). */
-function resolveCollectionElementSchema(manifestRoot, field) {
+/**
+ * The schema of a sibling collection expression, when statically known.
+ *
+ * Resolves `inputs.*` chains against the resource's DECLARED contract, falling
+ * back to the legacy `inputs:` property map some kinds still carry. Reading the
+ * contract is what makes this work at all for a kind that declares `inputType:`
+ * — resolving only the property map left `item` untyped in every such kind,
+ * silently, which reads as "element typing is permissive here" rather than as a
+ * gap. Returns undefined for a non-chain or untyped collection, and the caller
+ * substitutes `dyn` rather than inventing an element type.
+ */
+function resolveCollectionSchema(manifestRoot, field, allManifests) {
     const chain = purePathChain(manifestRoot?.[field]);
     if (!chain || chain[0] !== "inputs")
         return undefined;
-    const contract = manifestRoot.inputs;
-    if (!contract || typeof contract !== "object")
+    const declared = resolveTypeFieldToSchema(manifestRoot.inputType, allManifests ?? []);
+    const root = declared && typeof declared === "object"
+        ? declared
+        : manifestRoot.inputs && typeof manifestRoot.inputs === "object"
+            ? { type: "object", properties: manifestRoot.inputs }
+            : undefined;
+    if (!root)
+        return undefined;
+    return schemaAtChain(chain.slice(1), root);
+}
+/**
+ * What ITERATING a collection schema yields.
+ *
+ * An array answers with `items`; anything else answers through the value-type
+ * vocabulary, which is where "what is the element of this" is declared. No type
+ * is named here on purpose: a future iterable value type is covered by declaring
+ * `element` on one of its parameters, with nothing to change in the analyzer.
+ */
+function elementOfCollection(collection) {
+    if (!collection || typeof collection !== "object")
         return undefined;
-    const terminal = schemaAtChain(chain.slice(1), { type: "object", properties: contract });
-    if (terminal && terminal.type === "array" && terminal.items && typeof terminal.items === "object") {
-        return terminal.items;
+    if (collection.type === "array") {
+        return collection.items && typeof collection.items === "object"
+            ? collection.items
+            : undefined;
     }
-    return undefined;
+    const element = elementSchemaOf(collection);
+    return element && typeof element === "object" ? element : undefined;
+}
+/**
+ * True when a context binding naming this collection must NOT be bound.
+ *
+ * A binding that re-exposes the collection can only hand over the value the
+ * consumer is already draining, and passing that on is an ordinary
+ * pass-through no member-access rule catches — so the drain is silent. `live` is
+ * exactly the property that makes a value unsafe to re-expose, and it is already
+ * in the vocabulary, so no consumer names a type to decide this.
+ */
+function collectionBindingWithheld(schema, manifestRoot, allManifests) {
+    const from = schema?.["x-telo-context-collection-from"];
+    if (!from)
+        return false;
+    return isLiveSlot(resolveCollectionSchema(manifestRoot, from, allManifests));
 }
 /**
  * Returns true when a CEL expression path (from walkCelExpressions, e.g. "routes[0].inputs.q")
@@ -297,9 +339,18 @@ export function resolveContextAnnotations(schema, manifestItem, opts) {
     // untyped sources fall back to `dyn` so a wrong element type is never invented.
     const elementFrom = schema["x-telo-context-element-from"];
     if (elementFrom) {
-        const items = resolveCollectionElementSchema(manifestRoot, elementFrom);
+        const items = elementOfCollection(resolveCollectionSchema(manifestRoot, elementFrom, allManifests));
         return items ?? {};
     }
+    // The collection itself, as opposed to its element. Typed from whatever the
+    // sibling resolves to, so an array binding keeps the precision it has today
+    // instead of degrading to `dyn` now that the slot admits more than one shape.
+    // A `live` collection never reaches here — the property is dropped before
+    // recursion, so the name is simply not in scope.
+    const collectionFrom = schema["x-telo-context-collection-from"];
+    if (collectionFrom) {
+        return resolveCollectionSchema(manifestRoot, collectionFrom, allManifests) ?? {};
+    }
     const fromRoot = schema["x-telo-context-from-root"];
     const fromRefKindRaw = schema["x-telo-context-from-ref-kind"];
     const fromRefKinds = fromRefKindRaw == null
@@ -384,6 +435,11 @@ export function resolveContextAnnotations(schema, manifestItem, opts) {
     if (schema.properties) {
         const props = {};
         for (const [k, v] of Object.entries(schema.properties)) {
+            // Withholding happens HERE rather than inside the child resolver, because
+            // this is the only level that owns the property map — a child can return a
+            // schema but cannot remove itself from one.
+            if (collectionBindingWithheld(v, manifestRoot, allManifests))
+                continue;
             props[k] = resolveContextAnnotations(v, manifestItem, normalizedOpts);
         }
         return { ...schema, properties: props };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.58.0",
+  "version": "0.59.0",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",
@@ -43,13 +43,13 @@
     "jsonpath-plus": "^10.3.0",
     "packageurl-js": "^2.0.1",
     "yaml": "^2.8.3",
-    "@telorun/templating": "0.14.0"
+    "@telorun/templating": "0.15.0"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",
     "typescript": "^5.0.0",
     "vitest": "^2.1.8",
-    "@telorun/sdk": "0.73.0"
+    "@telorun/sdk": "0.74.0"
   },
   "peerDependencies": {
     "@telorun/sdk": "*"

package/src/index.ts

@@ -62,12 +62,19 @@ export {
 export type { ContractDirection, DefResolver } from "./extends-resolution.js";
 export {
   defaultBearingPaths,
+  declaredScalarPaths,
   PERMISSIVE_CONTRACT,
   resolveContract,
   resolveContractSchema,
   withLiveValuesSkipped,
 } from "./invocation-contract.js";
-export type { ContractOrigin, ContractScope, ResolvedContract } from "./invocation-contract.js";
+export type {
+  ContractOrigin,
+  ContractScope,
+  DeclaredScalarForm,
+  DeclaredScalarPath,
+  ResolvedContract,
+} from "./invocation-contract.js";
 export {
   hasIntermediateWildcard,
   parseRedactionPath,
@@ -136,7 +143,7 @@ export { validateDynamicSelectors, validateRefSlotDeclarations } from "./validat
 export type { RefSlotIssue } from "./validate-ref-slots.js";
 export { validateValueTypeSlots } from "./validate-value-type-slots.js";
 export type { ValueTypeSlotIssue } from "./validate-value-type-slots.js";
-export { checkSchemaCompatibility } from "./schema-compat.js";
+export { checkSchemaCompatibility, selectUnionBranch } from "./schema-compat.js";
 export type { CompatibilityResult } from "./schema-compat.js";
 export { visitManifest } from "./manifest-visitor.js";
 export type {

package/src/invocation-contract.ts

@@ -1,4 +1,4 @@
-import { isLiveSlot, type ResourceDefinition } from "@telorun/sdk";
+import { isLiveSlot, type ResourceDefinition, valueTypeOf } from "@telorun/sdk";
 import {
   type ContractDirection,
   contractDeclarer,
@@ -268,3 +268,94 @@ export function defaultBearingPaths(
   walk(schema, [], []);
   return out;
 }
+
+/** The scalar form a declared node's value takes at runtime. `int64` and
+ *  `double` are the two JSON scalars whose runtime representation is NOT decided
+ *  by the value that arrives: a CEL integer is a BigInt and a CEL double a JS
+ *  number, and both are `typeof "number" | "bigint"` away from what a declaration
+ *  says they are. Everything else — string, boolean, object, array, and every
+ *  `instance` value type — is already its own representation, so it is not
+ *  listed and never rewritten. */
+export type DeclaredScalarForm = "int64" | "double";
+
+export interface DeclaredScalarPath {
+  readonly path: string[];
+  readonly form: DeclaredScalarForm;
+}
+
+/** Every path in `schema` whose declared type fixes a scalar representation —
+ *  the leaves a value must carry in that form for the contract to be TRUE, not
+ *  merely to pass.
+ *
+ *  A declared shape says what the value IS, the same service a JSON Schema gives
+ *  an HTTP response serializer. Telo's CEL layer takes it literally:
+ *  `jsonSchemaToCelType` maps `integer` to CEL `int` and `number` to `double`,
+ *  and a CEL int IS a BigInt — so a controller handing back a plain JS number at
+ *  an `integer` slot makes the declaration a lie that surfaces nowhere until an
+ *  expression composes it, as `result.n + 1` type-checking statically and then
+ *  dying at dispatch with `no such overload: dyn<double> + int`.
+ *
+ *  A VALUE TYPE is read through the same rule rather than beside it: a `json`
+ *  representation refines a JSON type and contributes its `base` (so
+ *  `Telo.TcpPort` is an `int64` slot), while an `instance` representation
+ *  REPLACES the JSON layer — a byte buffer and a stream handle are already their
+ *  own representation, nothing converts to them, and the walk stops there rather
+ *  than descending into a value that is not a plain container.
+ *
+ *  Bounded by the schema's declarations rather than by the size of the payload,
+ *  exactly as {@link defaultBearingPaths} is: a contract declaring no such
+ *  scalar walks nothing at dispatch. A union counts when it names exactly one of
+ *  the two — `["integer", "null"]` is still the integer branch, while
+ *  `["integer", "number"]` fixes nothing and is left alone. */
+export function declaredScalarPaths(
+  schema: Record<string, any>,
+  resolveRef?: (ref: string) => Record<string, any> | undefined,
+): DeclaredScalarPath[] {
+  const out: DeclaredScalarPath[] = [];
+
+  const walk = (node: unknown, path: string[], chain: readonly object[]): void => {
+    if (!node || typeof node !== "object") return;
+    let s = node as Record<string, any>;
+    if (chain.includes(s)) return;
+    if (resolveRef && typeof s.$ref === "string") {
+      const target = resolveRef(s.$ref);
+      if (!target || chain.includes(target)) return;
+      s = { ...target, ...s, $ref: undefined };
+    }
+    const here = [...chain, node as object];
+
+    const entry = valueTypeOf(s);
+    // An `instance` representation replaces the JSON layer: it is its own
+    // representation, so there is nothing to normalize to and nothing below it
+    // that is a plain container to walk.
+    if (entry && entry.representation === "instance") return;
+
+    const form = scalarFormOf(entry && entry.base !== undefined ? entry.base : s.type);
+    if (form && path.length > 0) out.push({ path, form });
+
+    const properties = s.properties as Record<string, any> | undefined;
+    if (properties) {
+      for (const [key, child] of Object.entries(properties)) walk(child, [...path, key], here);
+    }
+    for (const branch of ["allOf", "anyOf", "oneOf"] as const) {
+      const list = s[branch];
+      if (Array.isArray(list)) for (const child of list) walk(child, path, here);
+    }
+    if (s.items) walk(s.items, [...path, "[]"], here);
+  };
+
+  walk(schema, [], []);
+  return out;
+}
+
+function scalarFormOf(declared: unknown): DeclaredScalarForm | undefined {
+  if (declared === "integer") return "int64";
+  if (declared === "number") return "double";
+  if (!Array.isArray(declared)) return undefined;
+  const integer = declared.includes("integer");
+  const number = declared.includes("number");
+  // A union naming both fixes nothing — either representation satisfies it, so
+  // rewriting one into the other would be a choice the declaration never made.
+  if (integer === number) return undefined;
+  return integer ? "int64" : "double";
+}

package/src/schema-compat.ts

@@ -48,6 +48,16 @@ export interface CompatibilityResult {
   issues: string[];
 }
 
+/** The alternatives a union node declares, or undefined when it is not one.
+ *  `anyOf` and `oneOf` are one question here — which branches could accept this
+ *  value — and their difference (exactly-one vs at-least-one) is a validation
+ *  rule, not a compatibility one. */
+function unionBranches(schema: Record<string, any>): Record<string, any>[] | undefined {
+  const branches = schema.anyOf ?? schema.oneOf;
+  if (!Array.isArray(branches) || branches.length === 0) return undefined;
+  return branches.filter((b) => b && typeof b === "object") as Record<string, any>[];
+}
+
 /**
  * Conservative structural JSON Schema compatibility check — is a value shaped
  * like `source` acceptable where `target` is declared?
@@ -115,6 +125,38 @@ function compare(
   const source = deref(rawSource, resolveRef);
   const target = deref(rawTarget, resolveRef);
 
+  // A union is ALTERNATIVES, so it is compared by distributing over branches on
+  // both sides: a definite conflict is one where no source-branch/target-branch
+  // pair agrees. Returning silently the moment either side was a union — which
+  // is what this did — switched the whole comparison off for any slot that
+  // accepts more than one shape, and those are exactly the slots where a value
+  // type carries the only information distinguishing the branches.
+  //
+  // `allOf` is a conjunction rather than a choice, so it keeps the old posture:
+  // it says too little to judge and stays compatible.
+  if (source.allOf || target.allOf) return;
+  const sourceBranches = unionBranches(source);
+  const targetBranches = unionBranches(target);
+  if (sourceBranches || targetBranches) {
+    const lefts = sourceBranches ?? [source];
+    const rights = targetBranches ?? [target];
+    const reasons: string[] = [];
+    for (const left of lefts) {
+      for (const right of rights) {
+        const probe: string[] = [];
+        // A fresh `seen` per probe: a pair rejected on one branch must not mark
+        // a reference pair visited for the next, which would silently pass it.
+        compare(left, right, path, probe, resolveRef, new Set(seen));
+        if (probe.length === 0) return;
+        reasons.push(...probe);
+      }
+    }
+    issues.push(
+      `${path || "/"}: no alternative matches — ${[...new Set(reasons)].join("; ")}`,
+    );
+    return;
+  }
+
   // Value types first: an `instance` representation has no JSON `type` to
   // compare, so its identity IS the comparison — and its arguments are where the
   // real information lives.
@@ -180,8 +222,6 @@ function compare(
     );
     return;
   }
-  if (source.anyOf || source.oneOf || source.allOf) return;
-  if (target.anyOf || target.oneOf || target.allOf) return;
 
   // An array's element, which the old comparison never looked at — so every
   // nested shape passed regardless of what it contained.
@@ -425,7 +465,14 @@ export function celTypeSatisfiesJsonSchema(celType: string, schema: Record<strin
     return true;
   }
   if (!schema.type && !schema.anyOf && !schema.oneOf && !schema.allOf) return true;
-  if (schema.anyOf || schema.oneOf || schema.allOf) return true;
+  // `allOf` is a conjunction and says too little to judge from a single CEL
+  // type. A union is a CHOICE, so it is satisfied by satisfying any branch —
+  // distributed for the same reason `compare` does it: accepting every union
+  // outright turns the check off for exactly the slots that admit more than one
+  // shape, and those are the ones where the branches carry the information.
+  if (schema.allOf) return true;
+  const branches = unionBranches(schema);
+  if (branches) return branches.some((branch) => celTypeSatisfiesJsonSchema(celType, branch));
   const schemaTypes = Array.isArray(schema.type) ? schema.type : [schema.type];
   const accepted: Record<string, string[]> = {
     int: ["integer", "number"],
@@ -528,6 +575,23 @@ export function celPlaceholderForSchema(rawSchema: Record<string, any>): unknown
   // member chosen is irrelevant — only its acceptability to AJV matters, since
   // the real value is checked at runtime once the expression resolves.
   if (Array.isArray(schema.enum) && schema.enum.length > 0) return schema.enum[0];
+  // A UNION with no `type` of its own. Without this, a whole-field CEL leaf at
+  // such a slot gets `null`, which every branch then rejects — so a field
+  // declared `anyOf: [array, boolean]` could not be written as an expression at
+  // all, while one whose union happens to contain a `live` branch escaped by
+  // accident (nothing validates a live value, so `null` passed). The first
+  // branch that yields a placeholder wins: the same conservative posture
+  // `selectUnionBranch` takes, and enough for AJV, whose question is only
+  // whether SOME branch accepts the stand-in.
+  if (schema.type === undefined) {
+    const branches = unionBranches(schema);
+    if (branches) {
+      for (const branch of branches) {
+        const candidate = celPlaceholderForSchema(branch);
+        if (candidate !== null) return candidate;
+      }
+    }
+  }
   switch (schema.type) {
     case "integer":
     case "number":
@@ -603,7 +667,7 @@ export function resolveRef(schema: Record<string, any>, root: Record<string, any
  * — an ambiguous union is one the analyzer should not resolve on the author's
  * behalf.
  */
-function selectUnionBranch(
+export function selectUnionBranch(
   schema: Record<string, any>,
   data: unknown,
   root: Record<string, any>,

package/src/validate-cel-context.ts

@@ -1,5 +1,10 @@
 export { extractAccessChains, validateChainAgainstSchema } from "@telorun/templating";
-import { mergeTypeSchemas, parseCanonicalTypeSchemaId } from "@telorun/sdk";
+import {
+  elementSchemaOf,
+  isLiveSlot,
+  mergeTypeSchemas,
+  parseCanonicalTypeSchemaId,
+} from "@telorun/sdk";
 import { KERNEL_BUILTINS } from "./builtins.js";
 
 export interface ContextResolveOpts {
@@ -206,23 +211,73 @@ function schemaAtChain(
   return cur && typeof cur === "object" ? cur : undefined;
 }
 
-/** The element schema of a sibling collection expression, when statically known.
- *  Resolves `inputs.*` chains against the resource's `inputs:` contract and
- *  returns the array's `items`. Returns undefined for non-chain or untyped
- *  collections (caller substitutes `dyn`). */
-function resolveCollectionElementSchema(
+/**
+ * The schema of a sibling collection expression, when statically known.
+ *
+ * Resolves `inputs.*` chains against the resource's DECLARED contract, falling
+ * back to the legacy `inputs:` property map some kinds still carry. Reading the
+ * contract is what makes this work at all for a kind that declares `inputType:`
+ * — resolving only the property map left `item` untyped in every such kind,
+ * silently, which reads as "element typing is permissive here" rather than as a
+ * gap. Returns undefined for a non-chain or untyped collection, and the caller
+ * substitutes `dyn` rather than inventing an element type.
+ */
+function resolveCollectionSchema(
   manifestRoot: Record<string, any>,
   field: string,
+  allManifests: Record<string, any>[] | undefined,
 ): Record<string, any> | undefined {
   const chain = purePathChain(manifestRoot?.[field]);
   if (!chain || chain[0] !== "inputs") return undefined;
-  const contract = manifestRoot.inputs;
-  if (!contract || typeof contract !== "object") return undefined;
-  const terminal = schemaAtChain(chain.slice(1), { type: "object", properties: contract });
-  if (terminal && terminal.type === "array" && terminal.items && typeof terminal.items === "object") {
-    return terminal.items as Record<string, any>;
+  const declared = resolveTypeFieldToSchema(manifestRoot.inputType, allManifests ?? []);
+  const root =
+    declared && typeof declared === "object"
+      ? declared
+      : manifestRoot.inputs && typeof manifestRoot.inputs === "object"
+        ? { type: "object", properties: manifestRoot.inputs }
+        : undefined;
+  if (!root) return undefined;
+  return schemaAtChain(chain.slice(1), root);
+}
+
+/**
+ * What ITERATING a collection schema yields.
+ *
+ * An array answers with `items`; anything else answers through the value-type
+ * vocabulary, which is where "what is the element of this" is declared. No type
+ * is named here on purpose: a future iterable value type is covered by declaring
+ * `element` on one of its parameters, with nothing to change in the analyzer.
+ */
+function elementOfCollection(
+  collection: Record<string, any> | undefined,
+): Record<string, any> | undefined {
+  if (!collection || typeof collection !== "object") return undefined;
+  if (collection.type === "array") {
+    return collection.items && typeof collection.items === "object"
+      ? (collection.items as Record<string, any>)
+      : undefined;
   }
-  return undefined;
+  const element = elementSchemaOf(collection);
+  return element && typeof element === "object" ? (element as Record<string, any>) : undefined;
+}
+
+/**
+ * True when a context binding naming this collection must NOT be bound.
+ *
+ * A binding that re-exposes the collection can only hand over the value the
+ * consumer is already draining, and passing that on is an ordinary
+ * pass-through no member-access rule catches — so the drain is silent. `live` is
+ * exactly the property that makes a value unsafe to re-expose, and it is already
+ * in the vocabulary, so no consumer names a type to decide this.
+ */
+function collectionBindingWithheld(
+  schema: Record<string, any>,
+  manifestRoot: Record<string, any>,
+  allManifests: Record<string, any>[] | undefined,
+): boolean {
+  const from = schema?.["x-telo-context-collection-from"] as string | undefined;
+  if (!from) return false;
+  return isLiveSlot(resolveCollectionSchema(manifestRoot, from, allManifests));
 }
 
 /**
@@ -342,10 +397,20 @@ export function resolveContextAnnotations(
   // untyped sources fall back to `dyn` so a wrong element type is never invented.
   const elementFrom = schema["x-telo-context-element-from"] as string | undefined;
   if (elementFrom) {
-    const items = resolveCollectionElementSchema(manifestRoot, elementFrom);
+    const items = elementOfCollection(resolveCollectionSchema(manifestRoot, elementFrom, allManifests));
     return items ?? {};
   }
 
+  // The collection itself, as opposed to its element. Typed from whatever the
+  // sibling resolves to, so an array binding keeps the precision it has today
+  // instead of degrading to `dyn` now that the slot admits more than one shape.
+  // A `live` collection never reaches here — the property is dropped before
+  // recursion, so the name is simply not in scope.
+  const collectionFrom = schema["x-telo-context-collection-from"] as string | undefined;
+  if (collectionFrom) {
+    return resolveCollectionSchema(manifestRoot, collectionFrom, allManifests) ?? {};
+  }
+
   const fromRoot = schema["x-telo-context-from-root"] as string | undefined;
   const fromRefKindRaw = schema["x-telo-context-from-ref-kind"] as
     | string
@@ -445,6 +510,10 @@ export function resolveContextAnnotations(
   if (schema.properties) {
     const props: Record<string, any> = {};
     for (const [k, v] of Object.entries(schema.properties)) {
+      // Withholding happens HERE rather than inside the child resolver, because
+      // this is the only level that owns the property map — a child can return a
+      // schema but cannot remove itself from one.
+      if (collectionBindingWithheld(v as Record<string, any>, manifestRoot, allManifests)) continue;
       props[k] = resolveContextAnnotations(v as Record<string, any>, manifestItem, normalizedOpts);
     }
     return { ...schema, properties: props };