@telorun/analyzer 0.58.0 → 0.60.0

package/dist/release/workspace-config.d.ts

@@ -0,0 +1,41 @@
+/**
+ * `telo-workspace.yaml` — the release anchor.
+ *
+ * Every path the release system names — a module key, a ledger entry, a
+ * fragment's `modules:` — is relative to this file's directory. That is the
+ * whole of its job: **its location is the anchor**, and its one field names the
+ * subtrees that may hold modules, which is not derivable (a whole-tree scan
+ * would read every example and every cached `.telo/manifests` copy as a released
+ * module).
+ *
+ * The file is **optional and read only by `telo release`**. Nothing else — not
+ * `run`, `check`, `publish`, `install`, `upgrade`, `migrate`, `module`, and not
+ * the kernel — looks for it, so a single-manifest repo, a bare `examples/`
+ * directory and a third-party module checkout keep working with nothing added.
+ * Any field added later must be true of the whole tree, not derivable from it,
+ * and harmless by its absence.
+ *
+ * Parsing lives here, in the browser-safe half, because the editor answers
+ * "what does changing this library bump?" from the same model. Finding the file
+ * on disk is the CLI's half — this side takes text.
+ */
+export declare const WORKSPACE_FILENAME = "telo-workspace.yaml";
+export interface WorkspaceConfig {
+    /**
+     * Gitignore-style patterns, workspace-relative, naming the subtrees that may
+     * hold modules (`modules/*`, `apps/*`). A pattern names a place to look, never
+     * a module: what makes a directory a module is its `telo.yaml`.
+     */
+    readonly modules: readonly string[];
+}
+export declare class WorkspaceConfigError extends Error {
+}
+/**
+ * Parse the marker file's text.
+ *
+ * Strict about its one field, because there is nothing here to be lenient with:
+ * an empty or absent `modules:` names no subtree, so discovery would find no
+ * module and every gate would silently pass over a whole repo.
+ */
+export declare function parseWorkspaceConfig(text: string, where: string): WorkspaceConfig;
+//# sourceMappingURL=workspace-config.d.ts.map

package/dist/release/workspace-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-config.d.ts","sourceRoot":"","sources":["../../src/release/workspace-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AAExD,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,qBAAa,oBAAqB,SAAQ,KAAK;CAAG;AAElD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,eAAe,CAoCjF"}

package/dist/release/workspace-config.js

@@ -0,0 +1,60 @@
+/**
+ * `telo-workspace.yaml` — the release anchor.
+ *
+ * Every path the release system names — a module key, a ledger entry, a
+ * fragment's `modules:` — is relative to this file's directory. That is the
+ * whole of its job: **its location is the anchor**, and its one field names the
+ * subtrees that may hold modules, which is not derivable (a whole-tree scan
+ * would read every example and every cached `.telo/manifests` copy as a released
+ * module).
+ *
+ * The file is **optional and read only by `telo release`**. Nothing else — not
+ * `run`, `check`, `publish`, `install`, `upgrade`, `migrate`, `module`, and not
+ * the kernel — looks for it, so a single-manifest repo, a bare `examples/`
+ * directory and a third-party module checkout keep working with nothing added.
+ * Any field added later must be true of the whole tree, not derivable from it,
+ * and harmless by its absence.
+ *
+ * Parsing lives here, in the browser-safe half, because the editor answers
+ * "what does changing this library bump?" from the same model. Finding the file
+ * on disk is the CLI's half — this side takes text.
+ */
+import { parseDocument } from "yaml";
+export const WORKSPACE_FILENAME = "telo-workspace.yaml";
+export class WorkspaceConfigError extends Error {
+}
+/**
+ * Parse the marker file's text.
+ *
+ * Strict about its one field, because there is nothing here to be lenient with:
+ * an empty or absent `modules:` names no subtree, so discovery would find no
+ * module and every gate would silently pass over a whole repo.
+ */
+export function parseWorkspaceConfig(text, where) {
+    let value;
+    try {
+        value = parseDocument(text).toJSON();
+    }
+    catch (err) {
+        throw new WorkspaceConfigError(`${where} is not valid YAML: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        throw new WorkspaceConfigError(`${where} must be a YAML mapping.`);
+    }
+    const record = value;
+    for (const key of Object.keys(record)) {
+        if (key !== "modules") {
+            throw new WorkspaceConfigError(`${where}: unknown field '${key}'. The workspace marker carries only 'modules:' — ` +
+                `the subtrees that may hold modules.`);
+        }
+    }
+    const modules = record.modules;
+    if (!Array.isArray(modules) || modules.some((entry) => typeof entry !== "string")) {
+        throw new WorkspaceConfigError(`${where}: 'modules' must be a list of path patterns, e.g. [modules/*, apps/*].`);
+    }
+    if (modules.length === 0) {
+        throw new WorkspaceConfigError(`${where}: 'modules' is empty, so no directory can ever be discovered as a module. ` +
+            `List the subtrees that hold them, e.g. [modules/*, apps/*].`);
+    }
+    return { modules: modules };
+}

package/dist/schema-compat.d.ts

@@ -78,6 +78,24 @@ export declare function celTypeSatisfiesJsonSchema(celType: string, schema: Reco
 export declare function celPlaceholderForSchema(rawSchema: Record<string, any>): unknown;
 /** Resolve a `$ref` (only `#/$defs/...` form) against the root schema. */
 export declare function resolveRef(schema: Record<string, any>, root: Record<string, any>): Record<string, any>;
+/** Collect property schemas from top-level `properties` and all `oneOf`/`anyOf` sub-schemas. */
+/**
+ * The `oneOf` / `anyOf` branch a value is written against, when exactly one fits.
+ *
+ * A union carries no `type` / `properties` / `items` of its own, so a walker that
+ * ignores it descends with an empty schema and hands every CEL leaf underneath a
+ * `null` placeholder — which then fails every branch and reports a pile of
+ * violations against a value that is perfectly valid. Picking the branch first
+ * is what lets the leaves be typed.
+ *
+ * Selection is structural and conservative: a branch must agree with the data's
+ * kind, and for an object every `required` key must be present (which is what
+ * separates a `{type, text}` part from a `{type, data, mediaType}` one). If that
+ * leaves anything other than exactly one branch, the union is returned unchanged
+ * — an ambiguous union is one the analyzer should not resolve on the author's
+ * behalf.
+ */
+export declare function selectUnionBranch(schema: Record<string, any>, data: unknown, root: Record<string, any>): Record<string, any>;
 export declare function collectProperties(schema: Record<string, any>): Record<string, any>;
 /** Deep-clone `data`, replacing every pure CEL template string (`${{ expr }}`) with a
  *  schema-appropriate placeholder so AJV can validate non-CEL fields without false positives. */

package/dist/schema-compat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-compat.d.ts","sourceRoot":"","sources":["../src/schema-compat.ts"],"names":[],"mappings":"AAkBA,QAAA,MAAM,GAAG,KAA0C,CAAC;AAEpD;;;;;;;mCAOmC;AACnC,wBAAgB,SAAS,IAAI,YAAY,CAAC,OAAO,GAAG,CAAC,CAYpD;AAKD,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAC5D,mBAAmB,CAIrB;AAyID,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAelD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAGxE;AAuBD,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;CACd;AAaD,0GAA0G;AAC1G,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,WAAW,EAAE,CAsB/F;AAED;qFACqF;AACrF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAQ7E;AAED;;;;6DAI6D;AAC7D,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,EAAE,MAAM,GACX,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAsBjC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAqB,CAAC;AAE1E;;iEAEiE;AACjE,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAGzF;AAED,8DAA8D;AAC9D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,CA6BnF;AAED,wFAAwF;AACxF,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CA2ChG;AAkED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CA8C/E;AAqBD,0EAA0E;AAC1E,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAOtG;AAyDD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAwBlF;AAED;iGACiG;AACjG,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;AAChC;;;;;;;;6DAQ6D;AAC7D,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EACrC,IAAI,SAAK,GACR,OAAO,CAiET"}
+{"version":3,"file":"schema-compat.d.ts","sourceRoot":"","sources":["../src/schema-compat.ts"],"names":[],"mappings":"AAkBA,QAAA,MAAM,GAAG,KAA0C,CAAC;AAEpD;;;;;;;mCAOmC;AACnC,wBAAgB,SAAS,IAAI,YAAY,CAAC,OAAO,GAAG,CAAC,CAYpD;AAKD,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAYD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAC5D,mBAAmB,CAIrB;AAuKD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAelD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAGxE;AAuBD,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;CACd;AAaD,0GAA0G;AAC1G,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,WAAW,EAAE,CAsB/F;AAED;qFACqF;AACrF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAQ7E;AAED;;;;6DAI6D;AAC7D,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,EAAE,MAAM,GACX,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAsBjC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAqB,CAAC;AAE1E;;iEAEiE;AACjE,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAGzF;AAED,8DAA8D;AAC9D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,CA6BnF;AAED,wFAAwF;AACxF,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAkDhG;AAkED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CA+D/E;AAqBD,0EAA0E;AAC1E,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAOtG;AAED,gGAAgG;AAChG;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,EAAE,OAAO,EACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAgCrB;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAwBlF;AAED;iGACiG;AACjG,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;AAChC;;;;;;;;6DAQ6D;AAC7D,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EACrC,IAAI,SAAK,GACR,OAAO,CAiET"}

package/dist/schema-compat.js

@@ -1,7 +1,8 @@
 import AjvModule from "ajv";
 import addFormats from "ajv-formats";
-import { isRefSentinel, isTaggedSentinel, ManifestRootSchema, producedTypeOf, } from "@telorun/templating";
+import { isRefSentinel, isTaggedSentinel, producedTypeOf, } from "@telorun/templating";
 import { celBaseOfValueType, celTypeOfValueType, readValueTypeSlot, valueBrandBases, valueTypeOf, valueTypePlaceholder, } from "@telorun/sdk";
+import { ManifestRootSchema } from "./manifest-schemas.js";
 import { registerTeloKeywords } from "./value-type-keyword.js";
 const Ajv = AjvModule.default ?? AjvModule;
 /** Creates a configured AJV instance (allErrors, strict: false, with formats).
@@ -27,6 +28,16 @@ export function createAjv() {
 }
 const ajv = createAjv();
 const compiledSchemaValidators = new WeakMap();
+/** The alternatives a union node declares, or undefined when it is not one.
+ *  `anyOf` and `oneOf` are one question here — which branches could accept this
+ *  value — and their difference (exactly-one vs at-least-one) is a validation
+ *  rule, not a compatibility one. */
+function unionBranches(schema) {
+    const branches = schema.anyOf ?? schema.oneOf;
+    if (!Array.isArray(branches) || branches.length === 0)
+        return undefined;
+    return branches.filter((b) => b && typeof b === "object");
+}
 /**
  * Conservative structural JSON Schema compatibility check — is a value shaped
  * like `source` acceptable where `target` is declared?
@@ -80,6 +91,37 @@ function compare(rawSource, rawTarget, path, issues, resolveRef, seen) {
     }
     const source = deref(rawSource, resolveRef);
     const target = deref(rawTarget, resolveRef);
+    // A union is ALTERNATIVES, so it is compared by distributing over branches on
+    // both sides: a definite conflict is one where no source-branch/target-branch
+    // pair agrees. Returning silently the moment either side was a union — which
+    // is what this did — switched the whole comparison off for any slot that
+    // accepts more than one shape, and those are exactly the slots where a value
+    // type carries the only information distinguishing the branches.
+    //
+    // `allOf` is a conjunction rather than a choice, so it keeps the old posture:
+    // it says too little to judge and stays compatible.
+    if (source.allOf || target.allOf)
+        return;
+    const sourceBranches = unionBranches(source);
+    const targetBranches = unionBranches(target);
+    if (sourceBranches || targetBranches) {
+        const lefts = sourceBranches ?? [source];
+        const rights = targetBranches ?? [target];
+        const reasons = [];
+        for (const left of lefts) {
+            for (const right of rights) {
+                const probe = [];
+                // A fresh `seen` per probe: a pair rejected on one branch must not mark
+                // a reference pair visited for the next, which would silently pass it.
+                compare(left, right, path, probe, resolveRef, new Set(seen));
+                if (probe.length === 0)
+                    return;
+                reasons.push(...probe);
+            }
+        }
+        issues.push(`${path || "/"}: no alternative matches — ${[...new Set(reasons)].join("; ")}`);
+        return;
+    }
     // Value types first: an `instance` representation has no JSON `type` to
     // compare, so its identity IS the comparison — and its arguments are where the
     // real information lives.
@@ -127,10 +169,6 @@ function compare(rawSource, rawTarget, path, issues, resolveRef, seen) {
         issues.push(`${path || "/"}: type mismatch — source is '${source.type}', target expects '${target.type}'`);
         return;
     }
-    if (source.anyOf || source.oneOf || source.allOf)
-        return;
-    if (target.anyOf || target.oneOf || target.allOf)
-        return;
     // An array's element, which the old comparison never looked at — so every
     // nested shape passed regardless of what it contained.
     if (target.items && source.items) {
@@ -370,8 +408,16 @@ export function celTypeSatisfiesJsonSchema(celType, schema) {
     }
     if (!schema.type && !schema.anyOf && !schema.oneOf && !schema.allOf)
         return true;
-    if (schema.anyOf || schema.oneOf || schema.allOf)
+    // `allOf` is a conjunction and says too little to judge from a single CEL
+    // type. A union is a CHOICE, so it is satisfied by satisfying any branch —
+    // distributed for the same reason `compare` does it: accepting every union
+    // outright turns the check off for exactly the slots that admit more than one
+    // shape, and those are the ones where the branches carry the information.
+    if (schema.allOf)
         return true;
+    const branches = unionBranches(schema);
+    if (branches)
+        return branches.some((branch) => celTypeSatisfiesJsonSchema(celType, branch));
     const schemaTypes = Array.isArray(schema.type) ? schema.type : [schema.type];
     const accepted = {
         int: ["integer", "number"],
@@ -482,6 +528,24 @@ export function celPlaceholderForSchema(rawSchema) {
     // the real value is checked at runtime once the expression resolves.
     if (Array.isArray(schema.enum) && schema.enum.length > 0)
         return schema.enum[0];
+    // A UNION with no `type` of its own. Without this, a whole-field CEL leaf at
+    // such a slot gets `null`, which every branch then rejects — so a field
+    // declared `anyOf: [array, boolean]` could not be written as an expression at
+    // all, while one whose union happens to contain a `live` branch escaped by
+    // accident (nothing validates a live value, so `null` passed). The first
+    // branch that yields a placeholder wins: the same conservative posture
+    // `selectUnionBranch` takes, and enough for AJV, whose question is only
+    // whether SOME branch accepts the stand-in.
+    if (schema.type === undefined) {
+        const branches = unionBranches(schema);
+        if (branches) {
+            for (const branch of branches) {
+                const candidate = celPlaceholderForSchema(branch);
+                if (candidate !== null)
+                    return candidate;
+            }
+        }
+    }
     switch (schema.type) {
         case "integer":
         case "number":
@@ -553,7 +617,7 @@ export function resolveRef(schema, root) {
  * — an ambiguous union is one the analyzer should not resolve on the author's
  * behalf.
  */
-function selectUnionBranch(schema, data, root) {
+export function selectUnionBranch(schema, data, root) {
     const branches = (schema.oneOf ?? schema.anyOf);
     if (!Array.isArray(branches) || branches.length === 0)
         return schema;

package/dist/validate-cel-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAItF,MAAM,WAAW,kBAAkB;IACjC;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC;;kDAE8C;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;KACxD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AA4CD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CA0EjC;AAuFD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAChD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAiJrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB;AAWD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,SAAM,GACT,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAC,CAGvD;AAUD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,SAAM,GAAG,MAAM,EAAE,CAqBxF"}
+{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAStF,MAAM,WAAW,kBAAkB;IACjC;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC;;kDAE8C;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;KACxD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AA4CD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CA0EjC;AAyID;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAChD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CA+JrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB;AAWD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,SAAM,GACT,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAC,CAGvD;AAUD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,SAAM,GAAG,MAAM,EAAE,CAqBxF"}

package/dist/validate-cel-context.js

@@ -1,5 +1,5 @@
 export { extractAccessChains, validateChainAgainstSchema } from "@telorun/templating";
-import { mergeTypeSchemas, parseCanonicalTypeSchemaId } from "@telorun/sdk";
+import { elementSchemaOf, isLiveSlot, mergeTypeSchemas, parseCanonicalTypeSchemaId, } from "@telorun/sdk";
 import { KERNEL_BUILTINS } from "./builtins.js";
 /**
  * Resolve a type field value (string name, inline type, or raw schema) to a JSON Schema.
@@ -168,22 +168,64 @@ function schemaAtChain(chain, root) {
     }
     return cur && typeof cur === "object" ? cur : undefined;
 }
-/** The element schema of a sibling collection expression, when statically known.
- *  Resolves `inputs.*` chains against the resource's `inputs:` contract and
- *  returns the array's `items`. Returns undefined for non-chain or untyped
- *  collections (caller substitutes `dyn`). */
-function resolveCollectionElementSchema(manifestRoot, field) {
+/**
+ * The schema of a sibling collection expression, when statically known.
+ *
+ * Resolves `inputs.*` chains against the resource's DECLARED contract, falling
+ * back to the legacy `inputs:` property map some kinds still carry. Reading the
+ * contract is what makes this work at all for a kind that declares `inputType:`
+ * — resolving only the property map left `item` untyped in every such kind,
+ * silently, which reads as "element typing is permissive here" rather than as a
+ * gap. Returns undefined for a non-chain or untyped collection, and the caller
+ * substitutes `dyn` rather than inventing an element type.
+ */
+function resolveCollectionSchema(manifestRoot, field, allManifests) {
     const chain = purePathChain(manifestRoot?.[field]);
     if (!chain || chain[0] !== "inputs")
         return undefined;
-    const contract = manifestRoot.inputs;
-    if (!contract || typeof contract !== "object")
+    const declared = resolveTypeFieldToSchema(manifestRoot.inputType, allManifests ?? []);
+    const root = declared && typeof declared === "object"
+        ? declared
+        : manifestRoot.inputs && typeof manifestRoot.inputs === "object"
+            ? { type: "object", properties: manifestRoot.inputs }
+            : undefined;
+    if (!root)
+        return undefined;
+    return schemaAtChain(chain.slice(1), root);
+}
+/**
+ * What ITERATING a collection schema yields.
+ *
+ * An array answers with `items`; anything else answers through the value-type
+ * vocabulary, which is where "what is the element of this" is declared. No type
+ * is named here on purpose: a future iterable value type is covered by declaring
+ * `element` on one of its parameters, with nothing to change in the analyzer.
+ */
+function elementOfCollection(collection) {
+    if (!collection || typeof collection !== "object")
         return undefined;
-    const terminal = schemaAtChain(chain.slice(1), { type: "object", properties: contract });
-    if (terminal && terminal.type === "array" && terminal.items && typeof terminal.items === "object") {
-        return terminal.items;
+    if (collection.type === "array") {
+        return collection.items && typeof collection.items === "object"
+            ? collection.items
+            : undefined;
     }
-    return undefined;
+    const element = elementSchemaOf(collection);
+    return element && typeof element === "object" ? element : undefined;
+}
+/**
+ * True when a context binding naming this collection must NOT be bound.
+ *
+ * A binding that re-exposes the collection can only hand over the value the
+ * consumer is already draining, and passing that on is an ordinary
+ * pass-through no member-access rule catches — so the drain is silent. `live` is
+ * exactly the property that makes a value unsafe to re-expose, and it is already
+ * in the vocabulary, so no consumer names a type to decide this.
+ */
+function collectionBindingWithheld(schema, manifestRoot, allManifests) {
+    const from = schema?.["x-telo-context-collection-from"];
+    if (!from)
+        return false;
+    return isLiveSlot(resolveCollectionSchema(manifestRoot, from, allManifests));
 }
 /**
  * Returns true when a CEL expression path (from walkCelExpressions, e.g. "routes[0].inputs.q")
@@ -297,9 +339,18 @@ export function resolveContextAnnotations(schema, manifestItem, opts) {
     // untyped sources fall back to `dyn` so a wrong element type is never invented.
     const elementFrom = schema["x-telo-context-element-from"];
     if (elementFrom) {
-        const items = resolveCollectionElementSchema(manifestRoot, elementFrom);
+        const items = elementOfCollection(resolveCollectionSchema(manifestRoot, elementFrom, allManifests));
         return items ?? {};
     }
+    // The collection itself, as opposed to its element. Typed from whatever the
+    // sibling resolves to, so an array binding keeps the precision it has today
+    // instead of degrading to `dyn` now that the slot admits more than one shape.
+    // A `live` collection never reaches here — the property is dropped before
+    // recursion, so the name is simply not in scope.
+    const collectionFrom = schema["x-telo-context-collection-from"];
+    if (collectionFrom) {
+        return resolveCollectionSchema(manifestRoot, collectionFrom, allManifests) ?? {};
+    }
     const fromRoot = schema["x-telo-context-from-root"];
     const fromRefKindRaw = schema["x-telo-context-from-ref-kind"];
     const fromRefKinds = fromRefKindRaw == null
@@ -384,6 +435,11 @@ export function resolveContextAnnotations(schema, manifestItem, opts) {
     if (schema.properties) {
         const props = {};
         for (const [k, v] of Object.entries(schema.properties)) {
+            // Withholding happens HERE rather than inside the child resolver, because
+            // this is the only level that owns the property map — a child can return a
+            // schema but cannot remove itself from one.
+            if (collectionBindingWithheld(v, manifestRoot, allManifests))
+                continue;
             props[k] = resolveContextAnnotations(v, manifestItem, normalizedOpts);
         }
         return { ...schema, properties: props };

package/dist/validate-step-inputs.d.ts

@@ -6,7 +6,7 @@ export interface StepInputIssue {
     message: string;
     /** Set when the issue is a type-argument disagreement rather than a contract
      *  shape violation — the two read differently and deserve their own code. */
-    code?: "CEL_TYPE_ARGUMENT_MISMATCH";
+    code?: "CEL_TYPE_ARGUMENT_MISMATCH" | "LIVE_VALUE_RETRIED";
 }
 /**
  * Validate every step's `inputs:` against the invoked target's declared input

package/dist/validate-step-inputs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-step-inputs.d.ts","sourceRoot":"","sources":["../src/validate-step-inputs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAoBnE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB;iFAC6E;IAC7E,IAAI,CAAC,EAAE,4BAA4B,CAAC;CACrC;AAGD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC7B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC9B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY;AACpB;;mEAEmE;AACnE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAChC,cAAc,EAAE,CAiHlB"}
+{"version":3,"file":"validate-step-inputs.d.ts","sourceRoot":"","sources":["../src/validate-step-inputs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAqBnE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB;iFAC6E;IAC7E,IAAI,CAAC,EAAE,4BAA4B,GAAG,oBAAoB,CAAC;CAC5D;AAGD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC7B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC9B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY;AACpB;;mEAEmE;AACnE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAChC,cAAc,EAAE,CAsJlB"}

package/dist/validate-step-inputs.js

@@ -1,7 +1,8 @@
 import { resolveContract } from "./invocation-contract.js";
 import { checkSchemaCompatibility, navigateSchemaToExprPath, substituteCelFields, validateAgainstSchema, } from "./schema-compat.js";
 import { plainChainOf } from "@telorun/templating";
-import { valueTypeOf } from "@telorun/sdk";
+import { isLiveSlot, valueTypeOf } from "@telorun/sdk";
+import { manifestFragmentOf } from "./manifest-schemas.js";
 import { analyzerContractScope, containerOf, gatherPropertySchemas, missingRequired, resolveLocalRef, walkStepArray, } from "./analyzer.js";
 /**
  * Validate every step's `inputs:` against the invoked target's declared input
@@ -79,16 +80,27 @@ stepContext) {
             // that silence is exactly where a stream of the wrong element used to
             // flow. The comparison is covariant and gradual: an omitted argument is
             // *any* in both directions, so only a definite conflict is reported.
-            if (stepContext) {
+            // The roots a plain chain may name here, each paired with the schema it is
+            // navigated against. `steps.` is the step map (analyzer state, supplied by
+            // the caller). `inputs.` is the ENCLOSING kind's own declared inputType,
+            // which is how a value produced OUTSIDE this resource reaches a step at
+            // all: an HTTP route maps `request.body` into its handler's inputs, and the
+            // handler forwards `inputs.body` onward — the shape a live value most often
+            // arrives in, and the one covering only `steps.` missed entirely. A root
+            // this cannot resolve contributes nothing rather than guessing at a schema.
+            const roots = [];
+            if (stepContext)
+                roots.push(["steps.", stepContext]);
+            const ownContract = resolveContract("inputType", manifest, contractScope.resolveIn(manifest.kind, readingModule), contractScope);
+            if (ownContract)
+                roots.push(["inputs.", ownContract.schema]);
+            if (roots.length > 0) {
                 for (const [inputName, inputValue] of Object.entries(values)) {
                     const chain = plainChainOf(inputValue);
-                    // The step context is rooted at the STEP MAP, so a `steps.` prefix is
-                    // the namespace name and not a property of it. Only that namespace is
-                    // navigated: `inputs.` and a named binding resolve elsewhere, and
-                    // guessing at a root this does not hold would compare the wrong schema.
-                    if (!chain?.startsWith("steps."))
+                    const root = chain ? roots.find(([prefix]) => chain.startsWith(prefix)) : undefined;
+                    if (!chain || !root)
                         continue;
-                    const produced = navigateSchemaToExprPath(stepContext, chain.slice("steps.".length));
+                    const produced = navigateSchemaToExprPath(root[1], chain.slice(root[0].length));
                     const slotSchema = contract.schema.properties?.[inputName];
                     if (!produced || !slotSchema)
                         continue;
@@ -99,6 +111,27 @@ stepContext) {
                     // broad new Error-severity check hidden behind an argument-specific
                     // name. Both sides must declare a value type for the question to be
                     // about arguments at all.
+                    // A LIVE value is consumed by reading, so it exists exactly once —
+                    // that is what `live` says in the vocabulary, and re-attempting a
+                    // dispatch that already read it re-sends nothing. Reported here rather
+                    // than through a slot-specific annotation because both facts are
+                    // already declared: the value's liveness by its value type, and the
+                    // re-attempt by the retry policy. No kind is named.
+                    if (isLiveSlot(produced)) {
+                        const retry = declaredRetry(step, stepItemSchema, invokedManifest, invokedDef);
+                        if (retry !== undefined) {
+                            out.push({
+                                path: `${stepPath}.${inputsField}.${inputName}`,
+                                targetLabel: invokedName ?? invokedKind ?? "the invoked resource",
+                                message: `'${inputName}' is a live value, which is consumed by reading and so exists ` +
+                                    `once — but ${retry} re-attempts the dispatch, and a re-attempt would pass ` +
+                                    `nothing. Collect it to a value first, or chunk the work so each attempt ` +
+                                    `carries its own replayable piece.`,
+                                code: "LIVE_VALUE_RETRIED",
+                            });
+                            continue;
+                        }
+                    }
                     if (!valueTypeOf(produced) || !valueTypeOf(slotSchema))
                         continue;
                     const { compatible, issues } = checkSchemaCompatibility(produced, slotSchema, (ref) => defs.schemaForId(ref));
@@ -130,3 +163,61 @@ stepContext) {
     }
     return out;
 }
+/**
+ * Where a re-attempt is declared for this dispatch, described for a diagnostic,
+ * or undefined when none is.
+ *
+ * A field declares one when its schema was expanded from a shared retry fragment
+ * — the shape the author pointed at, rather than a marker they had to remember to
+ * write beside it. Which fragment also says WHERE the budget is, so the two
+ * spellings a kind may carry (a policy object, or the deprecated bare count) need
+ * no guessing between them and no rule about which one wins.
+ *
+ * Two sites are consulted because there are two real ones: the STEP's own policy
+ * — `retry` on the kernel-owned dispatch site — and the TARGET's, a field on an
+ * arbitrary kind, because `Http.Request` re-attempts inside its own `invoke()`
+ * where only it can tell a 429 from a 500. A live value is equally doomed by
+ * either. EVERY retry-bearing field at a site is checked, not the first, since
+ * `Http.Request` carries both spellings and property order must not decide which
+ * is seen.
+ *
+ * Only a STATICALLY KNOWN non-zero budget counts. An `attempts` written as CEL
+ * says nothing here, and guessing would report a conflict against a manifest that
+ * may never retry — the same posture the `use` case-map selector takes.
+ */
+function declaredRetry(step, stepItemSchema, invokedManifest, invokedDef) {
+    for (const [field, budget] of retryFields(stepItemSchema)) {
+        if (budget(step?.[field]) > 0)
+            return `the step's \`${field}\``;
+    }
+    for (const [field, budget] of retryFields(invokedDef?.schema)) {
+        if (budget(invokedManifest?.[field]) > 0)
+            return `the target's \`${field}\``;
+    }
+    return undefined;
+}
+/** How each shared retry fragment carries its budget. Keyed on fragment name —
+ *  the analyzer's own built-ins, never a module's kind — so a kind that adopts a
+ *  shape is covered without naming it here. */
+const RETRY_BUDGET = {
+    RetryPolicy: (value) => {
+        if (!value || typeof value !== "object")
+            return 0;
+        const attempts = value.attempts;
+        return typeof attempts === "number" ? attempts : 0;
+    },
+    RetryAttempts: (value) => (typeof value === "number" ? value : 0),
+};
+/** Every property of `schema` whose shape came from a retry fragment, paired with
+ *  the reader for that fragment's budget. */
+function retryFields(schema) {
+    if (!schema)
+        return [];
+    const out = [];
+    for (const [key, sub] of gatherPropertySchemas(schema)) {
+        const budget = RETRY_BUDGET[manifestFragmentOf(sub) ?? ""];
+        if (budget)
+            out.push([key, budget]);
+    }
+    return out;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.58.0",
+  "version": "0.60.0",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",
@@ -43,13 +43,13 @@
     "jsonpath-plus": "^10.3.0",
     "packageurl-js": "^2.0.1",
     "yaml": "^2.8.3",
-    "@telorun/templating": "0.14.0"
+    "@telorun/templating": "0.16.0"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",
     "typescript": "^5.0.0",
     "vitest": "^2.1.8",
-    "@telorun/sdk": "0.73.0"
+    "@telorun/sdk": "0.75.0"
   },
   "peerDependencies": {
     "@telorun/sdk": "*"