@telorun/analyzer 0.62.0 → 0.63.0

package/dist/validate-zone-violations.js

@@ -0,0 +1,169 @@
+/**
+ * `ZONE_ATTRIBUTE_VIOLATED` — a resource inside a region whose guarantee it
+ * declares it cannot honour.
+ *
+ * The third leg of the zone-attribute mechanism, and the one that makes the
+ * other two enforceable. `x-telo-provides-zone` says what a region guarantees
+ * about its contents and `x-telo-requires-zone` says what a resource needs of
+ * the region around it — but neither says *this resource breaks that
+ * guarantee*, so until now an attribute could be declared, resolved and read
+ * with nothing able to report the one thing it exists to prevent.
+ *
+ * **Generic over the whole vocabulary, and it names no kind.** The rule is one
+ * sentence — *a region declaring attribute A must not contain a resource
+ * declaring it violates A* — and it is run once per attribute in
+ * `sdk/zone-attributes/`. So `noSuspend` (a parking kind inside a lease) and any
+ * attribute added later are covered by the same traversal, and `modules/durable`
+ * stays outside the analyzer's surface exactly as the topology-driven constraint
+ * requires.
+ *
+ * **Both sentences are their authors' own.** The diagnostic prints the region's
+ * declared reason and the violating kind's declared reason side by side, because
+ * the useful message is the collision between two written claims — "this
+ * transaction holds a connection a parked run would lose" against "this waits
+ * for a delivery that may be days away" — and neither half is anything the
+ * analyzer could generate.
+ *
+ * **Enforced at runtime, warned early**, like every other containment rule: the
+ * walk under-approximates (an edge the call graph cannot see is invisible here),
+ * and the runtime check in the violating controller is the real enforcement. It
+ * is an ERROR rather than a warning nonetheless: where the walk *can* see the
+ * path, the placement is decidably wrong — the region's promise and the
+ * resource's rebuttal are both declarations, so nothing about the runtime can
+ * reconcile them.
+ *
+ * Browser-safe: no Node built-ins.
+ */
+import { SUSPENDING_BACKOFF_MS, ZONE_ATTRIBUTES, retryBackoffMs, } from "@telorun/sdk";
+import { findZoneRegions } from "./resolve-zone-containment.js";
+import { DiagnosticSeverity } from "./types.js";
+import { readViolatesZone } from "./zone-slot.js";
+const SOURCE = "telo";
+export function validateZoneViolations(args) {
+    const { graph, resolveDef, reportModules } = args;
+    const diagnostics = [];
+    const reported = new Set();
+    // What each kind in the graph declares it cannot honour, resolved once. A
+    // graph holds many instances of few kinds, and this is a schema read.
+    const violationsOf = new Map();
+    const violations = (kind, module) => {
+        const key = `${module ?? ""}\0${kind}`;
+        let found = violationsOf.get(key);
+        if (!found) {
+            const def = resolveDef(kind, module);
+            found = readViolatesZone(def?.schema);
+            violationsOf.set(key, found);
+        }
+        return found;
+    };
+    for (const attribute of ZONE_ATTRIBUTES.keys()) {
+        for (const region of findZoneRegions(graph, resolveDef, attribute)) {
+            for (const contained of region.contents.values()) {
+                // The one step-level rule, and it is separate because it is a property
+                // of the STEP rather than of its target: a retry whose backoff is long
+                // enough to park suspends the run from inside a region that promised
+                // nothing in it would. Only `noSuspend` has such a rule, because only
+                // `noSuspend` is broken by waiting.
+                if (attribute === "noSuspend" && contained.node.type === "step") {
+                    const ownerNode = graph.nodes.get(contained.node.owner);
+                    const owner = ownerNode?.type === "resource" ? ownerNode : undefined;
+                    if (owner &&
+                        owned(owner.manifest, reportModules) &&
+                        suspendingBackoff(contained.node.step.retry)) {
+                        const dedupe = `retry\0${contained.node.id}`;
+                        if (!reported.has(dedupe)) {
+                            reported.add(dedupe);
+                            diagnostics.push({
+                                severity: DiagnosticSeverity.Error,
+                                code: "ZONE_ATTRIBUTE_VIOLATED",
+                                source: SOURCE,
+                                message: `Step '${contained.node.name ?? contained.node.path}' declares a retry ` +
+                                    `whose last backoff reaches ${SUSPENDING_BACKOFF_MS}ms, at which point a ` +
+                                    `re-attempt waits by PARKING the run rather than by sleeping — but it is ` +
+                                    `inside a ${region.provider.kind} ` +
+                                    `'${region.provider.name}' region that declares 'noSuspend' ` +
+                                    `(${region.reason}). Shorten the backoff, or move the retry outside the ` +
+                                    `region so it re-attempts the region as a whole.`,
+                                data: {
+                                    resource: { kind: owner.kind, name: owner.name },
+                                    filePath: owner.manifest.metadata?.source,
+                                    path: contained.node.path,
+                                },
+                            });
+                        }
+                    }
+                }
+                // A step node is a dispatch site, not a resource — whatever it reaches
+                // is in `contents` in its own right, so judging the step too would
+                // report one placement twice.
+                if (contained.node.type !== "resource")
+                    continue;
+                const manifest = contained.node.manifest;
+                const module = manifest.metadata?.module;
+                const rebuttal = violations(contained.node.kind, module)[attribute];
+                if (!rebuttal)
+                    continue;
+                if (!owned(manifest, reportModules))
+                    continue;
+                const dedupe = `${region.provider.id}\0${region.slot}\0${contained.node.id}\0${attribute}`;
+                if (reported.has(dedupe))
+                    continue;
+                reported.add(dedupe);
+                const path = [`${region.provider.name}.${region.slot}`, ...contained.via].join(" → ");
+                diagnostics.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: "ZONE_ATTRIBUTE_VIOLATED",
+                    source: SOURCE,
+                    message: `${contained.node.kind} '${contained.node.name}' is inside a ` +
+                        `${region.provider.kind} '${region.provider.name}' region that declares ` +
+                        `'${attribute}' (${region.reason}), but ${contained.node.kind} cannot honour ` +
+                        `it: ${rebuttal}. Reached by ${path}. Move it outside the region, or use a ` +
+                        `region that does not make that promise.`,
+                    data: {
+                        resource: { kind: contained.node.kind, name: contained.node.name },
+                        filePath: manifest.metadata?.source,
+                    },
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+/**
+ * Does this declared retry policy back off far enough to park?
+ *
+ * EXACT, not an estimate, and it is the runtime's own arithmetic
+ * (`retryBackoffMs`) rather than a second copy of it — a static rule that
+ * re-derives what it describes drifts from the behaviour the first time either
+ * side gains a knob. It is exact for a second reason too: the runtime branches
+ * on the UN-JITTERED backoff, so there is no coin flip for this to
+ * approximate. The last attempt has the largest backoff, so it decides.
+ *
+ * Only a STATICALLY KNOWN policy is judged — the `LIVE_VALUE_RETRIED` posture,
+ * and for its reason: a CEL budget says nothing, and guessing would report a
+ * conflict against a manifest that may never wait that long. An unreadable
+ * policy is left to the runtime check, which sees the real number.
+ */
+function suspendingBackoff(raw) {
+    if (!raw || typeof raw !== "object")
+        return false;
+    const policy = raw;
+    if (!Object.values(policy).every(isStaticValue))
+        return false;
+    const attempts = policy.attempts;
+    if (typeof attempts !== "number" || attempts <= 0)
+        return false;
+    return retryBackoffMs(policy, attempts - 1) >= SUSPENDING_BACKOFF_MS;
+}
+/** A CEL leaf reaches here as a compiled value or a tagged sentinel, and either
+ *  way the policy is not statically known. Refusing the whole policy rather than
+ *  the one field is the conservative direction: `maxDelay` alone decides the
+ *  answer, so reading around an unresolved one would report a bound the manifest
+ *  may never reach. */
+function isStaticValue(value) {
+    return value === undefined || typeof value === "number" || typeof value === "string";
+}
+function owned(manifest, reportModules) {
+    const module = manifest.metadata?.module;
+    return !module || reportModules.size === 0 || reportModules.has(module);
+}

package/dist/value-type-keyword.d.ts

@@ -28,7 +28,7 @@ import type { KeywordDefinition } from "ajv";
  *
  * `x-telo-type` is deliberately absent — it is the one that emits code.
  */
-export declare const ANNOTATION_KEYWORDS: readonly ["x-telo-bindings-from", "x-telo-catches-for", "x-telo-context", "x-telo-context-collection-from", "x-telo-context-element-from", "x-telo-context-from", "x-telo-context-from-ref-kind", "x-telo-context-from-root", "x-telo-context-ref-from", "x-telo-error-context", "x-telo-eval", "x-telo-inline", "x-telo-outcome-list", "x-telo-provides-zone", "x-telo-ref", "x-telo-requires-zone", "x-telo-schema-from", "x-telo-scope", "x-telo-step-context", "x-telo-topology-role", "x-telo-value-schema-from", "x-telo-widget"];
+export declare const ANNOTATION_KEYWORDS: readonly ["x-telo-bindings-from", "x-telo-catches-for", "x-telo-context", "x-telo-context-collection-from", "x-telo-context-element-from", "x-telo-context-from", "x-telo-context-from-ref-kind", "x-telo-context-from-root", "x-telo-context-ref-from", "x-telo-error-context", "x-telo-eval", "x-telo-inline", "x-telo-outcome-list", "x-telo-provides-zone", "x-telo-ref", "x-telo-requires-zone", "x-telo-resource-rules", "x-telo-schema-from", "x-telo-schema-map", "x-telo-schema-projection", "x-telo-schema-projection-from", "x-telo-scope", "x-telo-step-context", "x-telo-topology-role", "x-telo-value-schema-from", "x-telo-widget"];
 /**
  * The `x-telo-type` keyword.
  *

package/dist/value-type-keyword.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"value-type-keyword.d.ts","sourceRoot":"","sources":["../src/value-type-keyword.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;+EAqB+E;AAG/E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,KAAK,CAAC;AAiB7C;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,ygBAuBtB,CAAC;AAEX;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,IAAI,iBAAiB,CA+BpD;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE;IACxC,UAAU,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC;CACzD,GAAG,IAAI,CAGP"}
+{"version":3,"file":"value-type-keyword.d.ts","sourceRoot":"","sources":["../src/value-type-keyword.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;+EAqB+E;AAG/E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,KAAK,CAAC;AAiB7C;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,onBA2BtB,CAAC;AAEX;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,IAAI,iBAAiB,CA+BpD;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE;IACxC,UAAU,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC;CACzD,GAAG,IAAI,CAGP"}

package/dist/value-type-keyword.js

@@ -48,7 +48,11 @@ export const ANNOTATION_KEYWORDS = [
     "x-telo-provides-zone",
     "x-telo-ref",
     "x-telo-requires-zone",
+    "x-telo-resource-rules",
     "x-telo-schema-from",
+    "x-telo-schema-map",
+    "x-telo-schema-projection",
+    "x-telo-schema-projection-from",
     "x-telo-scope",
     "x-telo-step-context",
     "x-telo-topology-role",

package/dist/zone-slot.d.ts

@@ -10,6 +10,13 @@
  *
  *   x-telo-provides-zone: true            # uncorrelated — the zone is the kind
  *   x-telo-provides-zone: /connection     # correlation-key pointer (own field)
+ *   x-telo-provides-zone:                 # correlation key + zone attributes
+ *     key: /connection
+ *     atomic: a rollback erases writes a journal recorded as done
+ *     noSuspend: the transaction holds a connection a parked run would lose
+ *
+ *   x-telo-violates-zone:                 # what this kind cannot honour
+ *     noSuspend: this waits for a delivery that may be days away
  *
  *   x-telo-requires-zone: Self.Transaction        # uncorrelated string form
  *   x-telo-requires-zone:                          # object form
@@ -17,6 +24,7 @@
  *     key: [/connection, /transaction/connection]  # ordered, first hit wins
  *     reason: the statement would execute outside any transaction
  */
+import { type ZoneAttributes } from "@telorun/sdk";
 /** A body slot that establishes the declaring kind's zone when dispatched
  *  through. The zone's identity is always the declaring kind — the annotation
  *  never names one, so provision-on-behalf-of is unrepresentable. */
@@ -25,6 +33,16 @@ export interface ProvidesZoneSlot {
      *  reference the zone carries as its correlation payload. Absent =
      *  uncorrelated (`true`). */
     key?: string;
+    /** What this zone declares about everything executed inside it, keyed by the
+     *  closed vocabulary's bare names with the author's REASON as each value (see
+     *  `sdk/zone-attributes/`). Empty for the two scalar spellings, which say
+     *  nothing about their contents.
+     *
+     *  Read here and interpreted nowhere in this file: an attribute's meaning is
+     *  entirely its consumer's — the containment walk, the step engine's collapse
+     *  rule, the parking kinds — exactly as `readRefSlot` hands back `use` without
+     *  acting on it. */
+    attributes: ZoneAttributes;
 }
 /** A field declaring that its resource must be reached through a zone. */
 export interface RequiresZoneSlot {
@@ -38,16 +56,59 @@ export interface RequiresZoneSlot {
     key: string[];
     /** The runtime consequence, quoted after the path in diagnostics. */
     reason?: string;
+    /**
+     * Zone attributes the satisfying zone must DECLARE — what it must guarantee,
+     * as opposed to which kind it is.
+     *
+     * The two are different questions and the kind test alone cannot answer the
+     * second. A kind may extend the required abstract, and so satisfy every kind
+     * check, while its body slot omits the attribute the requirer actually depends
+     * on — a durable workflow whose body does not declare `replayed` is a zone the
+     * durable checks never look inside, and a run parking there parks against
+     * nothing. Naming the attribute is what makes the requirement say what it
+     * means.
+     *
+     * Names come from the closed vocabulary (`sdk/zone-attributes/`), so the
+     * analyzer reads its own words here and no module's kind is named.
+     */
+    attributes: string[];
 }
 /** Reads a schema node's provides-zone declaration, or undefined when it has
  *  none or the value is malformed (`validate-zone-slots` reports those). */
 export declare function readProvidesZone(node: Record<string, any> | undefined): ProvidesZoneSlot | undefined;
+/** The attributes the zone a slot provides declares, or an empty record when the
+ *  node provides no zone. The shape every containment consumer wants, so none of
+ *  them repeats the `readProvidesZone(...)?.attributes ?? {}` dance. */
+export declare function providedZoneAttributes(node: Record<string, any> | undefined): ZoneAttributes;
 /** True when the node carries `x-telo-provides-zone` in any shape, valid or not
  *  — the recognition test validation needs before it judges the value. */
 export declare function hasProvidesZone(node: Record<string, any> | undefined): boolean;
 /** Reads a schema node's requires-zone declaration, or undefined when it has
  *  none or the value is malformed (`validate-zone-slots` reports those). */
 export declare function readRequiresZone(node: Record<string, any> | undefined): RequiresZoneSlot | undefined;
+/**
+ * What this kind CANNOT honour about a region it is placed inside.
+ *
+ * The third relation, and the one the other two cannot express. `provides`
+ * declares what a region guarantees about its contents; `requires` declares what
+ * a resource needs of the region around it. Neither says *this resource breaks
+ * that guarantee* — and without it a zone attribute has a promise and no way to
+ * name what falsifies it: `noSuspend` would be enforced only when a parking kind
+ * happened to reach its runtime check, and `Durable.Sleep` would be
+ * indistinguishable from `Durable.Value`, which needs the same journal and parks
+ * nothing.
+ *
+ * Declared at the kind's SCHEMA ROOT, because it is a property of the kind
+ * rather than of one of its slots — a kind that suspends suspends however it is
+ * configured.
+ *
+ * Values are the author's REASON, exactly as on `provides`: a diagnostic prints
+ * the region's promise and this resource's rebuttal side by side, and both are
+ * their own authors' words.
+ */
+export declare function readViolatesZone(node: Record<string, any> | undefined): ZoneAttributes;
+/** True when the node carries `x-telo-violates-zone` in any shape, valid or not. */
+export declare function hasViolatesZone(node: Record<string, any> | undefined): boolean;
 /** True when the node carries `x-telo-requires-zone` in any shape. */
 export declare function hasRequiresZone(node: Record<string, any> | undefined): boolean;
 /**

package/dist/zone-slot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zone-slot.d.ts","sourceRoot":"","sources":["../src/zone-slot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH;;qEAEqE;AACrE,MAAM,WAAW,gBAAgB;IAC/B;;iCAE6B;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAC/B;;2EAEuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb;;gCAE4B;IAC5B,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAYD;4EAC4E;AAC5E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,gBAAgB,GAAG,SAAS,CAKpG;AAED;0EAC0E;AAC1E,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,OAAO,CAE9E;AAED;4EAC4E;AAC5E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,gBAAgB,GAAG,SAAS,CAWpG;AAED,sEAAsE;AACtE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,OAAO,CAE9E;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACrC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACxC,IAAI,CAaN"}
+{"version":3,"file":"zone-slot.d.ts","sourceRoot":"","sources":["../src/zone-slot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAmB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAMpE;;qEAEqE;AACrE,MAAM,WAAW,gBAAgB;IAC/B;;iCAE6B;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;wBAQoB;IACpB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAC/B;;2EAEuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb;;gCAE4B;IAC5B,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;;;;;OAcG;IACH,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAYD;4EAC4E;AAC5E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,gBAAgB,GAAG,SAAS,CAyBpG;AAED;;wEAEwE;AACxE,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,cAAc,CAE5F;AAED;0EAC0E;AAC1E,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,OAAO,CAE9E;AAED;4EAC4E;AAC5E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,gBAAgB,GAAG,SAAS,CAkBpG;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,cAAc,CAYtF;AAED,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,OAAO,CAE9E;AAED,sEAAsE;AACtE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,OAAO,CAE9E;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACrC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACxC,IAAI,CAaN"}

package/dist/zone-slot.js

@@ -10,6 +10,13 @@
  *
  *   x-telo-provides-zone: true            # uncorrelated — the zone is the kind
  *   x-telo-provides-zone: /connection     # correlation-key pointer (own field)
+ *   x-telo-provides-zone:                 # correlation key + zone attributes
+ *     key: /connection
+ *     atomic: a rollback erases writes a journal recorded as done
+ *     noSuspend: the transaction holds a connection a parked run would lose
+ *
+ *   x-telo-violates-zone:                 # what this kind cannot honour
+ *     noSuspend: this waits for a delivery that may be days away
  *
  *   x-telo-requires-zone: Self.Transaction        # uncorrelated string form
  *   x-telo-requires-zone:                          # object form
@@ -17,8 +24,10 @@
  *     key: [/connection, /transaction/connection]  # ordered, first hit wins
  *     reason: the statement would execute outside any transaction
  */
+import { ZONE_ATTRIBUTES } from "@telorun/sdk";
 const PROVIDES = "x-telo-provides-zone";
 const REQUIRES = "x-telo-requires-zone";
+const VIOLATES = "x-telo-violates-zone";
 /** A self-relative JSON Pointer — the only correlation-key spelling the
  *  analyzer and the kernel read identically. Applied to BOTH the scalar and the
  *  list form: the kernel's walk splits on `/` and drops empty segments, so a
@@ -33,10 +42,38 @@ function isPointer(value) {
 export function readProvidesZone(node) {
     const raw = node?.[PROVIDES];
     if (raw === true)
-        return {};
+        return { attributes: {} };
     if (isPointer(raw))
-        return { key: raw };
-    return undefined;
+        return { key: raw, attributes: {} };
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return undefined;
+    const obj = raw;
+    // A `key` that is present but unreadable makes the object form MEAN something
+    // different to the two halves — the correlation the author wrote is dropped
+    // here while the kernel's walk still resolves a bare name — so the whole
+    // annotation is refused rather than read as uncorrelated. Absent `key` is the
+    // legitimate uncorrelated case.
+    if (obj.key !== undefined && !isPointer(obj.key))
+        return undefined;
+    const attributes = {};
+    for (const [name, value] of Object.entries(obj)) {
+        if (name === "key")
+            continue;
+        // Unknown names and wrong-shaped values are reported by
+        // `validate-zone-slots`; skipped here so a typo degrades to an attribute
+        // this zone does not declare rather than to a consumer reading a name that
+        // means nothing to it.
+        if (!ZONE_ATTRIBUTES.has(name) || typeof value !== "string" || !value)
+            continue;
+        attributes[name] = value;
+    }
+    return { ...(isPointer(obj.key) ? { key: obj.key } : {}), attributes: attributes };
+}
+/** The attributes the zone a slot provides declares, or an empty record when the
+ *  node provides no zone. The shape every containment consumer wants, so none of
+ *  them repeats the `readProvidesZone(...)?.attributes ?? {}` dance. */
+export function providedZoneAttributes(node) {
+    return readProvidesZone(node)?.attributes ?? {};
 }
 /** True when the node carries `x-telo-provides-zone` in any shape, valid or not
  *  — the recognition test validation needs before it judges the value. */
@@ -48,7 +85,7 @@ export function hasProvidesZone(node) {
 export function readRequiresZone(node) {
     const raw = node?.[REQUIRES];
     if (typeof raw === "string" && raw)
-        return { zone: raw, key: [] };
+        return { zone: raw, key: [], attributes: [] };
     if (!raw || typeof raw !== "object" || Array.isArray(raw))
         return undefined;
     const obj = raw;
@@ -56,11 +93,55 @@ export function readRequiresZone(node) {
         return undefined;
     // One filter for both spellings — see `isPointer`.
     const key = (Array.isArray(obj.key) ? obj.key : [obj.key]).filter(isPointer);
-    const slot = { zone: obj.zone, key };
+    // Unknown names are dropped here and reported by `validate-zone-slots`, the
+    // lenient-reader / strict-validator split this file has throughout: a typo
+    // degrades to a guarantee this requirement does not ask for, never to a
+    // consumer matching against a name that means nothing.
+    const attributes = (Array.isArray(obj.attributes) ? obj.attributes : []).filter((a) => typeof a === "string" && ZONE_ATTRIBUTES.has(a));
+    const slot = { zone: obj.zone, key, attributes };
     if (typeof obj.reason === "string")
         slot.reason = obj.reason;
     return slot;
 }
+/**
+ * What this kind CANNOT honour about a region it is placed inside.
+ *
+ * The third relation, and the one the other two cannot express. `provides`
+ * declares what a region guarantees about its contents; `requires` declares what
+ * a resource needs of the region around it. Neither says *this resource breaks
+ * that guarantee* — and without it a zone attribute has a promise and no way to
+ * name what falsifies it: `noSuspend` would be enforced only when a parking kind
+ * happened to reach its runtime check, and `Durable.Sleep` would be
+ * indistinguishable from `Durable.Value`, which needs the same journal and parks
+ * nothing.
+ *
+ * Declared at the kind's SCHEMA ROOT, because it is a property of the kind
+ * rather than of one of its slots — a kind that suspends suspends however it is
+ * configured.
+ *
+ * Values are the author's REASON, exactly as on `provides`: a diagnostic prints
+ * the region's promise and this resource's rebuttal side by side, and both are
+ * their own authors' words.
+ */
+export function readViolatesZone(node) {
+    const raw = node?.[VIOLATES];
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return {};
+    const out = {};
+    for (const [name, value] of Object.entries(raw)) {
+        // Lenient, like every reader here: `validate-zone-slots` reports a typo, and
+        // dropping it degrades to a violation nobody declared rather than to a
+        // consumer matching a name that means nothing.
+        if (!ZONE_ATTRIBUTES.has(name) || typeof value !== "string" || !value)
+            continue;
+        out[name] = value;
+    }
+    return out;
+}
+/** True when the node carries `x-telo-violates-zone` in any shape, valid or not. */
+export function hasViolatesZone(node) {
+    return node?.[VIOLATES] !== undefined;
+}
 /** True when the node carries `x-telo-requires-zone` in any shape. */
 export function hasRequiresZone(node) {
     return node?.[REQUIRES] !== undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.62.0",
+  "version": "0.63.0",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",
@@ -49,7 +49,7 @@
     "@types/node": "^20.0.0",
     "typescript": "^5.0.0",
     "vitest": "^2.1.8",
-    "@telorun/sdk": "0.77.0"
+    "@telorun/sdk": "0.79.0"
   },
   "peerDependencies": {
     "@telorun/sdk": "*"

package/src/analysis-registry.ts

@@ -174,6 +174,12 @@ export class AnalysisRegistry {
   ): Record<string, unknown> | undefined {
     const def = this.resolveDefinition(kind);
     if (!def) return undefined;
+    // A KIND-level query: there is no instance, so a DECLARATION-derived slot
+    // (`x-telo-schema-projection-from`) has no reference to project from and is
+    // left as the kind declared it. That is the honest answer here — the
+    // projected shape is a property of one instance, not of the kind — and it is
+    // why passing no manifest cannot silently drop a projection: the per-resource
+    // analysis pass is what resolves and reports them.
     return resolveContract(direction, undefined, def, {
       resolveDefinition: this.scopedDefResolver(),
       typeManifestsFor: () => [],