@telorun/analyzer 0.62.0 → 0.63.0

package/dist/referrer-rule.d.ts

@@ -0,0 +1,67 @@
+/**
+ * The single reader for `x-telo-referrer-rules` — a kind declaring, as data,
+ * what must be true of whoever REFERENCES one of its resources.
+ *
+ * `x-telo-resource-rules` relates the fields of one resource; this relates a
+ * resource to the one that reached it. `Http.Reference` renders the OpenAPI
+ * document its server collects, so a server mounting it without an `openapi:`
+ * block has nothing to render — a disagreement neither kind can state alone,
+ * and one that otherwise surfaces only at boot, after the port is bound.
+ *
+ * Declared by the kind that HAS the requirement, never by the kind that must
+ * satisfy it. That is what lets a third-party mount carry its own requirement
+ * without `Http.Server` knowing the kind exists — and it is what keeps the rule
+ * free of a kind literal on the subject side, where the spelling would be the
+ * consumer's import alias rather than anything the rule author controls.
+ *
+ * The CEL scope is `self` (the declaring resource) and `referrer` (the one that
+ * references it). Deliberately NOT `this`: in a resource rule `this` is an
+ * ELEMENT of a collection, and binding it to a whole foreign manifest would give
+ * one word two meanings across the two families.
+ *
+ * Lenient by design, the `ref-slot.ts` precedent: anything unreadable here reads
+ * as absent, and `validate-referrer-rules.ts` is the strict half that reports it.
+ *
+ * Browser-safe: no Node built-ins.
+ */
+import { type ResourceRuleSeverity } from "./resource-rule.js";
+export declare const REFERRER_RULES_ANNOTATION = "x-telo-referrer-rules";
+export interface ReferrerRule {
+    /**
+     * Kind the referring resource must be for this rule to apply, in the
+     * alias-qualified grammar `extends:` and `x-telo-ref` use — canonicalized in
+     * the declaring module's scope at registration, so evaluation never sees an
+     * alias. Absent = any referrer, which conflates "references me" with the
+     * relation the rule is about, so a kind should write it.
+     */
+    readonly referrer?: string;
+    /** CEL source. TRUE when the rule holds. */
+    readonly condition: string;
+    /** The rule's own name, carried in `data.rule`. Never a diagnostic code —
+     *  every violation reports under the analyzer-owned envelope. */
+    readonly code: string;
+    readonly message: string;
+    readonly severity: ResourceRuleSeverity;
+    /** Position in the annotation array — the anchor for a declaration defect. */
+    readonly index: number;
+}
+/** The annotation exactly as written, for the strict half. `undefined` when the
+ *  kind declares none; a non-array is returned as-is so the shape can be
+ *  reported rather than silently skipped. */
+export declare function readRawReferrerRules(schema: unknown): unknown;
+/** Every rule this kind declares that is well-formed enough to run. */
+export declare function readReferrerRules(schema: unknown): ReferrerRule[];
+/** True when this node carries the annotation — the recognizer the schema-kind
+ *  canonicalization walk tests, so shape knowledge stays in this file. */
+export declare function hasReferrerRules(node: Record<string, unknown>): boolean;
+/**
+ * Rewrite each rule's `referrer:` kind through `rewrite`, in place.
+ *
+ * The mirror of `rewriteRequiresZoneKind`: the alias→canonical rule lives in
+ * `resolve-schema-ref-kinds.ts` and the shape lives here, so a filter is
+ * canonical everywhere downstream and a name that resolves to nothing is
+ * reported once, at the kind that wrote it. A rewrite returning `undefined`
+ * leaves the value as written — the caller reports it.
+ */
+export declare function rewriteReferrerRuleKinds(node: Record<string, unknown>, rewrite: (kind: string) => string | undefined): void;
+//# sourceMappingURL=referrer-rule.d.ts.map

package/dist/referrer-rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"referrer-rule.d.ts","sourceRoot":"","sources":["../src/referrer-rule.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAe,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE5E,eAAO,MAAM,yBAAyB,0BAA0B,CAAC;AAEjE,MAAM,WAAW,YAAY;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,4CAA4C;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;qEACiE;IACjE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAMD;;6CAE6C;AAC7C,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAG7D;AAED,uEAAuE;AACvE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,GAAG,YAAY,EAAE,CAwBjE;AAED;0EAC0E;AAC1E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAEvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GAC5C,IAAI,CAQN"}

package/dist/referrer-rule.js

@@ -0,0 +1,96 @@
+/**
+ * The single reader for `x-telo-referrer-rules` — a kind declaring, as data,
+ * what must be true of whoever REFERENCES one of its resources.
+ *
+ * `x-telo-resource-rules` relates the fields of one resource; this relates a
+ * resource to the one that reached it. `Http.Reference` renders the OpenAPI
+ * document its server collects, so a server mounting it without an `openapi:`
+ * block has nothing to render — a disagreement neither kind can state alone,
+ * and one that otherwise surfaces only at boot, after the port is bound.
+ *
+ * Declared by the kind that HAS the requirement, never by the kind that must
+ * satisfy it. That is what lets a third-party mount carry its own requirement
+ * without `Http.Server` knowing the kind exists — and it is what keeps the rule
+ * free of a kind literal on the subject side, where the spelling would be the
+ * consumer's import alias rather than anything the rule author controls.
+ *
+ * The CEL scope is `self` (the declaring resource) and `referrer` (the one that
+ * references it). Deliberately NOT `this`: in a resource rule `this` is an
+ * ELEMENT of a collection, and binding it to a whole foreign manifest would give
+ * one word two meanings across the two families.
+ *
+ * Lenient by design, the `ref-slot.ts` precedent: anything unreadable here reads
+ * as absent, and `validate-referrer-rules.ts` is the strict half that reports it.
+ *
+ * Browser-safe: no Node built-ins.
+ */
+import { celSourceOf } from "./resource-rule.js";
+export const REFERRER_RULES_ANNOTATION = "x-telo-referrer-rules";
+function isObject(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
+/** The annotation exactly as written, for the strict half. `undefined` when the
+ *  kind declares none; a non-array is returned as-is so the shape can be
+ *  reported rather than silently skipped. */
+export function readRawReferrerRules(schema) {
+    if (!isObject(schema))
+        return undefined;
+    return schema[REFERRER_RULES_ANNOTATION];
+}
+/** Every rule this kind declares that is well-formed enough to run. */
+export function readReferrerRules(schema) {
+    const raw = readRawReferrerRules(schema);
+    if (!Array.isArray(raw))
+        return [];
+    const rules = [];
+    raw.forEach((entry, index) => {
+        if (!isObject(entry))
+            return;
+        const condition = celSourceOf(entry.condition);
+        const { code, message, referrer } = entry;
+        if (!condition || typeof code !== "string" || typeof message !== "string")
+            return;
+        if (code.length === 0 || message.length === 0)
+            return;
+        if (referrer !== undefined && typeof referrer !== "string")
+            return;
+        if (entry.severity !== undefined && entry.severity !== "warning" && entry.severity !== "error") {
+            return;
+        }
+        rules.push({
+            ...(referrer === undefined ? {} : { referrer }),
+            condition,
+            code,
+            message,
+            severity: entry.severity === "warning" ? "warning" : "error",
+            index,
+        });
+    });
+    return rules;
+}
+/** True when this node carries the annotation — the recognizer the schema-kind
+ *  canonicalization walk tests, so shape knowledge stays in this file. */
+export function hasReferrerRules(node) {
+    return Array.isArray(node[REFERRER_RULES_ANNOTATION]);
+}
+/**
+ * Rewrite each rule's `referrer:` kind through `rewrite`, in place.
+ *
+ * The mirror of `rewriteRequiresZoneKind`: the alias→canonical rule lives in
+ * `resolve-schema-ref-kinds.ts` and the shape lives here, so a filter is
+ * canonical everywhere downstream and a name that resolves to nothing is
+ * reported once, at the kind that wrote it. A rewrite returning `undefined`
+ * leaves the value as written — the caller reports it.
+ */
+export function rewriteReferrerRuleKinds(node, rewrite) {
+    const raw = node[REFERRER_RULES_ANNOTATION];
+    if (!Array.isArray(raw))
+        return;
+    for (const entry of raw) {
+        if (!isObject(entry) || typeof entry.referrer !== "string")
+            continue;
+        const rewritten = rewrite(entry.referrer);
+        if (rewritten !== undefined)
+            entry.referrer = rewritten;
+    }
+}

package/dist/release/index.d.ts

@@ -20,7 +20,7 @@ export { LOCALLY_DERIVED_LAYERS, MANIFEST_LAYER, diffLayerDigests, layerDigestKe
 export type { LayerChange, LayerDigests } from "./payload-digest.js";
 export { orderByImports, planRelease } from "./release-plan.js";
 export type { ArtifactKind, BumpReason, ChangelogEntry, ModuleEvidence, PlannedModule, ReleaseDiagnostic, ReleaseEvidence, ReleasePlan, } from "./release-plan.js";
-export { VersionStampError, readManifestVersion, stampCrateVersion, stampManifestVersion, stampPackageVersion, } from "./version-stamp.js";
+export { VersionStampError, readManifestVersion, stampCrateVersion, stampManifestVersion, stampSelfNpmPins, stampPackageVersion, } from "./version-stamp.js";
 export { WORKSPACE_FILENAME, WorkspaceConfigError, parseWorkspaceConfig } from "./workspace-config.js";
 export type { WorkspaceConfig } from "./workspace-config.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/release/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/release/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,SAAS,EACT,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,QAAQ,GACT,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/D,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACpG,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnG,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,gBAAgB,EAChB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAErE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChE,YAAY,EACV,YAAY,EACZ,UAAU,EACV,cAAc,EACd,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,WAAW,GACZ,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AACvG,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/release/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,SAAS,EACT,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,QAAQ,GACT,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/D,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACpG,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnG,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,gBAAgB,EAChB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAErE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChE,YAAY,EACV,YAAY,EACZ,UAAU,EACV,cAAc,EACd,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,WAAW,GACZ,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AACvG,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/release/index.js

@@ -14,5 +14,5 @@ export { FragmentError, normalizeModuleKey, parseFragment, serializeFragment } f
 export { EMPTY_LEDGER, LEDGER_PATH, LedgerError, parseLedger, serializeLedger } from "./ledger.js";
 export { LOCALLY_DERIVED_LAYERS, MANIFEST_LAYER, diffLayerDigests, layerDigestKey, } from "./payload-digest.js";
 export { orderByImports, planRelease } from "./release-plan.js";
-export { VersionStampError, readManifestVersion, stampCrateVersion, stampManifestVersion, stampPackageVersion, } from "./version-stamp.js";
+export { VersionStampError, readManifestVersion, stampCrateVersion, stampManifestVersion, stampSelfNpmPins, stampPackageVersion, } from "./version-stamp.js";
 export { WORKSPACE_FILENAME, WorkspaceConfigError, parseWorkspaceConfig } from "./workspace-config.js";

package/dist/release/payload-digest.d.ts

@@ -25,9 +25,13 @@ export declare const MANIFEST_LAYER = "manifest";
  * Exactly one today, and for a structural reason rather than an omission: the
  * published `layers:` index lives *inside* `telo.yaml`, so it cannot carry that
  * file's own digest — the entry would have to be computed over bytes containing
- * it. Nor can the digest be recovered by hashing what the registry serves, since
- * the transport injects the index at push time and the published text is
- * therefore not the text the payload builder produced.
+ * it. `readPublishedDigests` reads that index, so it has no answer for this key.
+ *
+ * It is no longer *unknowable*, though, only absent from the index: the payload
+ * builder now writes the index, so its manifest is the published text and this
+ * digest is what hashing the served `telo.yaml` yields. Reconciling it would
+ * mean fetching the manifest per module rather than reading one index — worth
+ * doing, and a separate change from the one that made it possible.
  *
  * It stays in the ledger regardless, because it is the only thing that sees a
  * **manifest-only change**: a schema edit, a new kind, a description, a

package/dist/release/payload-digest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload-digest.d.ts","sourceRoot":"","sources":["../../src/release/payload-digest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAiB,KAAK,gBAAgB,EAAE,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAE/F,sDAAsD;AACtD,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAE5D,yDAAyD;AACzD,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAA6B,CAAC;AAErF;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,EAAE,QAAQ,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAM5F;AAED;;;mBAGmB;AACnB,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;mCACmC;AACnC,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,GAAG,WAAW,EAAE,CAQzF"}
+{"version":3,"file":"payload-digest.d.ts","sourceRoot":"","sources":["../../src/release/payload-digest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAiB,KAAK,gBAAgB,EAAE,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAE/F,sDAAsD;AACtD,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAE5D,yDAAyD;AACzD,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAA6B,CAAC;AAErF;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,EAAE,QAAQ,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAM5F;AAED;;;mBAGmB;AACnB,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;mCACmC;AACnC,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,GAAG,WAAW,EAAE,CAQzF"}

package/dist/release/payload-digest.js

@@ -23,9 +23,13 @@ export const MANIFEST_LAYER = "manifest";
  * Exactly one today, and for a structural reason rather than an omission: the
  * published `layers:` index lives *inside* `telo.yaml`, so it cannot carry that
  * file's own digest — the entry would have to be computed over bytes containing
- * it. Nor can the digest be recovered by hashing what the registry serves, since
- * the transport injects the index at push time and the published text is
- * therefore not the text the payload builder produced.
+ * it. `readPublishedDigests` reads that index, so it has no answer for this key.
+ *
+ * It is no longer *unknowable*, though, only absent from the index: the payload
+ * builder now writes the index, so its manifest is the published text and this
+ * digest is what hashing the served `telo.yaml` yields. Reconciling it would
+ * mean fetching the manifest per module rather than reading one index — worth
+ * doing, and a separate change from the one that made it possible.
  *
  * It stays in the ledger regardless, because it is the only thing that sees a
  * **manifest-only change**: a schema edit, a new kind, a description, a

package/dist/release/version-stamp.d.ts

@@ -25,6 +25,22 @@ export declare class VersionStampError extends Error {
  * of how many lines it was allowed to hit.
  */
 export declare function stampManifestVersion(text: string, version: string, where: string): string | undefined;
+/**
+ * `pkg:npm/<name>@<version>` candidates naming the module's OWN package.
+ *
+ * A module has one version, and its manifest pins the package it ships itself —
+ * so the pin has to move with the rest of it. Left behind, the manifest names a
+ * tarball older than the module describing it, which is exactly how an
+ * npm-delivered module came to point at a years-old version of itself.
+ *
+ * Anchored on the `controllers:` SCALARS the YAML actually holds, not on a free
+ * text match: this file's whole rule is find the scalar, splice its span, touch
+ * nothing else, and a bare regex over the document would also reach a PURL
+ * written in a description, an example or a comment. Matched by exact package
+ * name, so a PURL naming a DIFFERENT package — a real dependency, pinned
+ * deliberately — is untouched.
+ */
+export declare function stampSelfNpmPins(text: string, packageName: string, version: string, where?: string): string;
 /** Read the module doc's `metadata.version` without rewriting it. */
 export declare function readManifestVersion(text: string): string | undefined;
 /**

package/dist/release/version-stamp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"version-stamp.d.ts","sourceRoot":"","sources":["../../src/release/version-stamp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,qBAAa,iBAAkB,SAAQ,KAAK;CAAG;AAqB/C;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ,MAAM,GAAG,SAAS,CAYpB;AAED,qEAAqE;AACrE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMpE;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ,MAAM,GAAG,SAAS,CAKpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ,MAAM,GAAG,SAAS,CA+BpB"}
+{"version":3,"file":"version-stamp.d.ts","sourceRoot":"","sources":["../../src/release/version-stamp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,qBAAa,iBAAkB,SAAQ,KAAK;CAAG;AAqB/C;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ,MAAM,GAAG,SAAS,CAYpB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,KAAK,SAAgB,GACpB,MAAM,CAoCR;AAED,qEAAqE;AACrE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMpE;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ,MAAM,GAAG,SAAS,CAKpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ,MAAM,GAAG,SAAS,CA+BpB"}

package/dist/release/version-stamp.js

@@ -56,6 +56,58 @@ export function stampManifestVersion(text, version, where) {
         return undefined;
     return spliceScalar(text, node, version, where);
 }
+/**
+ * `pkg:npm/<name>@<version>` candidates naming the module's OWN package.
+ *
+ * A module has one version, and its manifest pins the package it ships itself —
+ * so the pin has to move with the rest of it. Left behind, the manifest names a
+ * tarball older than the module describing it, which is exactly how an
+ * npm-delivered module came to point at a years-old version of itself.
+ *
+ * Anchored on the `controllers:` SCALARS the YAML actually holds, not on a free
+ * text match: this file's whole rule is find the scalar, splice its span, touch
+ * nothing else, and a bare regex over the document would also reach a PURL
+ * written in a description, an example or a comment. Matched by exact package
+ * name, so a PURL naming a DIFFERENT package — a real dependency, pinned
+ * deliberately — is untouched.
+ */
+export function stampSelfNpmPins(text, packageName, version, where = "controllers") {
+    const docs = parseAllDocuments(text, { customTags: defaultCustomTags() });
+    const prefix = `pkg:npm/${packageName}@`;
+    const edits = [];
+    for (const doc of docs) {
+        const controllers = doc.get("controllers", true);
+        const items = controllers?.items;
+        if (!Array.isArray(items))
+            continue;
+        for (const item of items) {
+            if (!isScalar(item) || typeof item.value !== "string")
+                continue;
+            const purl = item.value;
+            if (!purl.startsWith(prefix))
+                continue;
+            // Everything from the version up to the first qualifier or fragment is the
+            // pin; the rest of the PURL (`?local_path=…#Export`) is carried through.
+            const rest = purl.slice(prefix.length);
+            const tail = rest.search(/[?#]/);
+            const rewritten = `${prefix}${version}${tail === -1 ? "" : rest.slice(tail)}`;
+            if (rewritten === purl)
+                continue;
+            const range = item.range;
+            if (!range) {
+                throw new VersionStampError(`${where}: a controller PURL carries no source range.`);
+            }
+            const [start, end] = range;
+            const replacement = renderFixReplacement(text.slice(start, end), rewritten);
+            if (replacement === undefined) {
+                throw new VersionStampError(`${where}: the controller PURL '${purl}' cannot be rewritten in place. ` +
+                    `Write it as a plain or quoted scalar on one line.`);
+            }
+            edits.push({ start, end, newText: replacement });
+        }
+    }
+    return edits.length === 0 ? text : applyTextEdits(text, edits);
+}
 /** Read the module doc's `metadata.version` without rewriting it. */
 export function readManifestVersion(text) {
     const docs = parseAllDocuments(text, { customTags: defaultCustomTags() });

package/dist/release/workspace-config.d.ts

@@ -8,12 +8,16 @@
  * would read every example and every cached `.telo/manifests` copy as a released
  * module).
  *
- * The file is **optional and read only by `telo release`**. Nothing else — not
- * `run`, `check`, `publish`, `install`, `upgrade`, `migrate`, `module`, and not
- * the kernel — looks for it, so a single-manifest repo, a bare `examples/`
- * directory and a third-party module checkout keep working with nothing added.
- * Any field added later must be true of the whole tree, not derivable from it,
- * and harmless by its absence.
+ * The file is **optional**, and everything reading it is harmless without one.
+ * `telo release` requires one. `telo run` uses its LOCATION — never `modules:`,
+ * which is release scope — as the bound on the walk-up that collects `.env` /
+ * `.env.local`, and with no marker reads the manifest's own directory alone, as
+ * it did before this file existed; a bound is what keeps that walk out of a
+ * user's home directory. Nothing else — not `check`, `publish`, `install`,
+ * `upgrade`, `migrate`, `module`, and not the kernel — looks for it, so a
+ * single-manifest repo, a bare `examples/` directory and a third-party module
+ * checkout keep working with nothing added. Any field added later must be true
+ * of the whole tree, not derivable from it, and harmless by its absence.
  *
  * Parsing lives here, in the browser-safe half, because the editor answers
  * "what does changing this library bump?" from the same model. Finding the file

package/dist/release/workspace-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-config.d.ts","sourceRoot":"","sources":["../../src/release/workspace-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AAExD,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,qBAAa,oBAAqB,SAAQ,KAAK;CAAG;AAElD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,eAAe,CAoCjF"}
+{"version":3,"file":"workspace-config.d.ts","sourceRoot":"","sources":["../../src/release/workspace-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AAExD,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,qBAAa,oBAAqB,SAAQ,KAAK;CAAG;AAElD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,eAAe,CAoCjF"}

package/dist/release/workspace-config.js

@@ -8,12 +8,16 @@
  * would read every example and every cached `.telo/manifests` copy as a released
  * module).
  *
- * The file is **optional and read only by `telo release`**. Nothing else — not
- * `run`, `check`, `publish`, `install`, `upgrade`, `migrate`, `module`, and not
- * the kernel — looks for it, so a single-manifest repo, a bare `examples/`
- * directory and a third-party module checkout keep working with nothing added.
- * Any field added later must be true of the whole tree, not derivable from it,
- * and harmless by its absence.
+ * The file is **optional**, and everything reading it is harmless without one.
+ * `telo release` requires one. `telo run` uses its LOCATION — never `modules:`,
+ * which is release scope — as the bound on the walk-up that collects `.env` /
+ * `.env.local`, and with no marker reads the manifest's own directory alone, as
+ * it did before this file existed; a bound is what keeps that walk out of a
+ * user's home directory. Nothing else — not `check`, `publish`, `install`,
+ * `upgrade`, `migrate`, `module`, and not the kernel — looks for it, so a
+ * single-manifest repo, a bare `examples/` directory and a third-party module
+ * checkout keep working with nothing added. Any field added later must be true
+ * of the whole tree, not derivable from it, and harmless by its absence.
  *
  * Parsing lives here, in the browser-safe half, because the editor answers
  * "what does changing this library bump?" from the same model. Finding the file

package/dist/resolve-schema-ref-kinds.d.ts

@@ -21,9 +21,10 @@ export interface RefConstraintIssue {
     manifest: ResourceManifest;
     reason: RefConstraintReason;
     /** Which annotation carried the unresolved name: an `x-telo-ref` constraint
-     *  (the default) or an `x-telo-requires-zone` provider kind — the caller
-     *  reports the latter as ZONE_PROVIDER_UNRESOLVED. */
-    annotation?: "ref" | "zone";
+     *  (the default), an `x-telo-requires-zone` provider kind, or an
+     *  `x-telo-referrer-rules` `referrer:` filter — the caller reports those as
+     *  ZONE_PROVIDER_UNRESOLVED and REFERRER_RULE_INVALID. */
+    annotation?: "ref" | "zone" | "referrer";
     /** For `gated`: the target module and the kinds it does export. */
     gate?: {
         module: string;

package/dist/resolve-schema-ref-kinds.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-schema-ref-kinds.d.ts","sourceRoot":"","sources":["../src/resolve-schema-ref-kinds.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAMzD;;;;;;;;sDAQsD;AACtD,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;AAEjE,4DAA4D;AAC5D,MAAM,WAAW,kBAAkB;IACjC,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ;sFACkF;IAClF,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,MAAM,EAAE,mBAAmB,CAAC;IAC5B;;0DAEsD;IACtD,UAAU,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IAC5B,mEAAmE;IACnE,IAAI,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC9C;+BAC2B;IAC3B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,sFAAsF;AACtF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,gBAAgB,EAC5B,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,mBAAmB,GAAG,cAAc,CAAC,GAClE,kBAAkB,EAAE,CAsEtB"}
+{"version":3,"file":"resolve-schema-ref-kinds.d.ts","sourceRoot":"","sources":["../src/resolve-schema-ref-kinds.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAWzD;;;;;;;;sDAQsD;AACtD,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;AAEjE,4DAA4D;AAC5D,MAAM,WAAW,kBAAkB;IACjC,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ;sFACkF;IAClF,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,MAAM,EAAE,mBAAmB,CAAC;IAC5B;;;8DAG0D;IAC1D,UAAU,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,UAAU,CAAC;IACzC,mEAAmE;IACnE,IAAI,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC9C;+BAC2B;IAC3B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,sFAAsF;AACtF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,gBAAgB,EAC5B,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,mBAAmB,GAAG,cAAc,CAAC,GAClE,kBAAkB,EAAE,CAwFtB"}

package/dist/resolve-schema-ref-kinds.js

@@ -1,4 +1,5 @@
 import { rewriteRefSlotKinds } from "./ref-slot.js";
+import { REFERRER_RULES_ANNOTATION, hasReferrerRules, rewriteReferrerRuleKinds, } from "./referrer-rule.js";
 import { hasRequiresZone, rewriteRequiresZoneKind } from "./zone-slot.js";
 const REF_ANNOTATION = "x-telo-ref";
 /** True for the legacy identity form, which is split on `#` by the identity table. */
@@ -95,6 +96,21 @@ export function resolveSchemaRefKinds(definition, resolver) {
                 return undefined;
             });
         }
+        if (hasReferrerRules(obj)) {
+            // A referrer rule's `referrer:` filter names a kind through the identical
+            // alias-qualified grammar, resolved in the same declaring scope — so the
+            // evaluation pass compares canonical kinds and never has to know which
+            // alias the CONSUMER happened to import the kind under. That is the whole
+            // reason such a rule can be sound where the same test written on the
+            // referring kind cannot.
+            rewriteReferrerRuleKinds(obj, (kind) => {
+                const result = resolver.resolveKindResult(kind);
+                if (result.status === "ok")
+                    return result.kind;
+                record(kind, `${path}.${REFERRER_RULES_ANNOTATION}`, "referrer");
+                return undefined;
+            });
+        }
         for (const key of Object.keys(obj)) {
             walk(obj[key], path ? `${path}.${key}` : key);
         }

package/dist/resolve-throws-union.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-throws-union.d.ts","sourceRoot":"","sources":["../src/resolve-throws-union.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,EAA0B,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC5B;AAED;;gFAEgF;AAChF,eAAO,MAAM,gBAAgB,mBAAmB,CAAC;AAEjD,MAAM,WAAW,WAAW;IAC1B,gFAAgF;IAChF,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACnC;;;8EAG0E;IAC1E,SAAS,EAAE,OAAO,CAAC;IACnB;;;;gDAI4C;IAC5C,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB;;;wFAGoF;IACpF,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC5C,0FAA0F;IAC1F,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC/B,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACzB;AAED,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,gBAAgB,EAAE,EAChC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,eAAe,GAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAa,EACvD,WAAW,GAAE,GAAG,CAAC,MAAM,CAAa,GACnC,UAAU,CAUZ;AA6CD;;;;8CAI8C;AAC9C,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,gBAAgB,EAC1B,GAAG,EAAE,UAAU,GACd,WAAW,CAiDb"}
+{"version":3,"file":"resolve-throws-union.d.ts","sourceRoot":"","sources":["../src/resolve-throws-union.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,EAA0B,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAGnE,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC5B;AAED;;gFAEgF;AAChF,eAAO,MAAM,gBAAgB,mBAAmB,CAAC;AAEjD,MAAM,WAAW,WAAW;IAC1B,gFAAgF;IAChF,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACnC;;;8EAG0E;IAC1E,SAAS,EAAE,OAAO,CAAC;IACnB;;;;gDAI4C;IAC5C,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB;;;wFAGoF;IACpF,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC5C,0FAA0F;IAC1F,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC/B,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACzB;AAED,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,gBAAgB,EAAE,EAChC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,eAAe,GAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAa,EACvD,WAAW,GAAE,GAAG,CAAC,MAAM,CAAa,GACnC,UAAU,CAUZ;AA6CD;;;;8CAI8C;AAC9C,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,gBAAgB,EAC1B,GAAG,EAAE,UAAU,GACd,WAAW,CAiDb"}

package/dist/resolve-throws-union.js

@@ -1,5 +1,6 @@
 import { isTaggedSentinel } from "@telorun/templating";
 import { scopeResolverForModule } from "./alias-resolver.js";
+import { readStepSlot } from "./step-slot.js";
 /** Code a non-`InvokeError` failure surfaces as inside a `catch` block. Mirrors
  *  `PLAIN_ERROR_CODE` in `@telorun/run`'s `toSequenceError`: any invoke can throw
  *  a plain error, which the catch sees as `error.code === "INTERNAL_ERROR"`. */
@@ -114,8 +115,8 @@ function resolveInherited(manifest, definition, ctx, ownerModule) {
     if (!props)
         return result;
     for (const [fieldName, fieldSchema] of Object.entries(props)) {
-        const stepCtx = fieldSchema["x-telo-step-context"];
-        if (!stepCtx?.invoke)
+        const stepCtx = readStepSlot(fieldSchema);
+        if (!stepCtx)
             continue;
         const steps = manifest[fieldName];
         if (!Array.isArray(steps))
@@ -136,7 +137,7 @@ function collectStepArrayThrows(steps, invokeField, enclosingTryCodes, ctx, owne
 /** Walk one step, dispatching by shape. Generic for any Run.Sequence-style
  *  composer: the step keys it recognises (`try` / `catch` / `finally` / `then`
  *  / `else` / `elseif` / `do` / `cases` / `default`) are the same set already
- *  traversed by the analyzer's `x-telo-step-context` schema builder, so future
+ *  traversed by the analyzer's step-body walk, so future
  *  composers that reuse those shape conventions work without changes here. */
 function collectStepThrows(step, invokeField, enclosingTryCodes, ctx, ownerModule) {
     if (step[invokeField]) {

package/dist/resolve-zone-containment.d.ts

@@ -0,0 +1,99 @@
+/**
+ * Zone containment — *what is inside this zone*, which is the opposite question
+ * from the one `resolve-zone-requirements.ts` answers.
+ *
+ * The landed projection propagates a requirement callee→caller and asks *is this
+ * requirement satisfied*. Every check built on zone ATTRIBUTES asks the reverse:
+ * a `noSuspend` region has to know what it contains before it can forbid parking
+ * inside it, a `replayed` region before it can reject a detached dispatch, an
+ * `idempotent` region before it can call impure CEL a broken promise. So this is
+ * a DOWNWARD walk from a providing slot to everything its body reaches.
+ *
+ * It is a second consumer of the shared call graph, not a second graph, and it
+ * is **parameterized over the attribute that opens the region** — so the durable
+ * zone (`replayed`) and the constraint zones (`noSuspend`, `atomic`,
+ * `idempotent`) share one traversal. It resolves an attribute NAME and nothing
+ * else: no kind is named here, which is what keeps `modules/durable` out of the
+ * analyzer's surface and satisfies the topology-driven constraint.
+ *
+ * **Two shapes of body slot, one region.** A slot may hold its body as a
+ * reference to an executable (`Sql.Transaction.steps`) or carry a step array
+ * natively (the shared `Step` fragment, which any kind may point at). Both are
+ * regions; the first is entered through the slot's edge, the second through the
+ * step nodes the slot declares. Handling only the first would have made the
+ * checks silently vacuous on exactly the kinds written after the grammar became
+ * shared vocabulary.
+ *
+ * **The walk under-approximates, and that is the safe direction — for a CHECK.**
+ * A dynamically dispatched edge is invisible here, so a check over the result
+ * may stay silent where it should have spoken, and the runtime enforcement is
+ * what closes it. A consumer at the OPPOSITE polarity — the durable manifest
+ * digest, whose blind spot is silent replay against changed code rather than a
+ * missed diagnostic — must not inherit this tolerance, and verifies its coverage
+ * against the journal instead of trusting this set.
+ *
+ * Browser-safe: no Node built-ins.
+ */
+import type { ResourceDefinition, ResourceManifest } from "@telorun/sdk";
+import type { CallGraph, CallGraphEdge, CallGraphNode, ResourceGraphNode } from "./call-graph.js";
+/** One node the region reaches, with the route taken to it. */
+export interface ContainedNode {
+    node: CallGraphNode;
+    /** Labels of the hops from the body slot to this node, for a diagnostic that
+     *  names the path rather than only the endpoint. */
+    via: string[];
+}
+/** A dispatch that leaves the region without extending it.
+ *
+ *  Recorded rather than followed, because the two facts are different and both
+ *  are wanted: the zone's lifetime does NOT reach the target (so nothing inside
+ *  it is contained), while the dispatch itself is a site inside the region that
+ *  a check may forbid outright — `DURABLE_DETACH_FORBIDDEN` is exactly that. */
+export interface RegionBoundary {
+    edge: CallGraphEdge;
+    /** The resource whose slot dispatches this way. */
+    from: ResourceGraphNode;
+    via: string[];
+    /** Why the zone stops here: the uses that do not extend it. */
+    escaping: string[];
+}
+/** A region opened by one providing slot carrying the requested attribute. */
+export interface ZoneRegion {
+    /** The attribute that opened it — the one the walk was asked for. */
+    attribute: string;
+    /** The author's reason, quoted verbatim by every diagnostic over this region.
+     *  Present by construction: an attribute's value IS the reason. */
+    reason: string;
+    /** The resource whose slot establishes the zone. */
+    provider: ResourceGraphNode;
+    /** Field-map path of the body slot (`steps`, `invoke`). */
+    slot: string;
+    /** Every attribute the slot declares, not only the requested one — a consumer
+     *  deciding collapse reads `atomic` and `idempotent` off one region. */
+    attributes: Readonly<Record<string, string>>;
+    /** Everything control reaches from the body, keyed by node id. Includes the
+     *  step nodes of a native body, since a step is where a check anchors. */
+    contents: ReadonlyMap<string, ContainedNode>;
+    /** Dispatches inside the region that the zone does not extend through. */
+    boundaries: readonly RegionBoundary[];
+}
+/** Resolves a kind name to its definition in the scope of the module that
+ *  DECLARED it — the same resolver the projection takes, passed in rather than
+ *  rebuilt so both walks agree about what a kind means. */
+export type DefinitionLookup = (kind: string, module?: string) => ResourceDefinition | undefined;
+/**
+ * Every region in the graph opened by a slot declaring `attribute`.
+ *
+ * The provider itself is NOT in `contents` — a zone constrains what runs inside
+ * its body, not the resource that establishes it. A transaction's own
+ * `connection:` dependency is outside the region it opens, and a rule that
+ * treated the provider as contained would report the provider against its own
+ * constraint.
+ */
+export declare function findZoneRegions(graph: CallGraph, resolveDef: DefinitionLookup, attribute: string): ZoneRegion[];
+/** Convenience for a consumer that only wants membership: every node id inside
+ *  any region opened by `attribute`, mapped to the region that contains it. */
+export declare function containmentIndex(regions: readonly ZoneRegion[]): ReadonlyMap<string, ZoneRegion>;
+/** The manifests a region's contents belong to — what a diagnostic anchors on. */
+export declare function regionManifests(region: ZoneRegion): ResourceManifest[];
+//# sourceMappingURL=resolve-zone-containment.d.ts.map

package/dist/resolve-zone-containment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-zone-containment.d.ts","sourceRoot":"","sources":["../src/resolve-zone-containment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAKlG,+DAA+D;AAC/D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,aAAa,CAAC;IACpB;wDACoD;IACpD,GAAG,EAAE,MAAM,EAAE,CAAC;CACf;AAED;;;;;gFAKgF;AAChF,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,aAAa,CAAC;IACpB,mDAAmD;IACnD,IAAI,EAAE,iBAAiB,CAAC;IACxB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB;uEACmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb;4EACwE;IACxE,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7C;8EAC0E;IAC1E,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC7C,0EAA0E;IAC1E,UAAU,EAAE,SAAS,cAAc,EAAE,CAAC;CACvC;AAED;;2DAE2D;AAC3D,MAAM,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,kBAAkB,GAAG,SAAS,CAAC;AA4GjG;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,SAAS,EAChB,UAAU,EAAE,gBAAgB,EAC5B,SAAS,EAAE,MAAM,GAChB,UAAU,EAAE,CA6Dd;AAoCD;+EAC+E;AAC/E,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,SAAS,UAAU,EAAE,GAC7B,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAQjC;AAED,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,gBAAgB,EAAE,CAMtE"}