@telorun/analyzer 0.62.0 → 0.63.0

package/dist/schema-projection.js

@@ -0,0 +1,317 @@
+/**
+ * The schema-projection annotations' single reader — the `ref-slot.ts` /
+ * `zone-slot.ts` precedent.
+ *
+ * A kind whose configuration is a COLLECTION OF TYPED ENTRIES can say what that
+ * collection means as a JSON Schema object, so a consumer can type the values
+ * it will read without the analyzer learning anything about the domain. A SQL
+ * table's columns are the first consumer; nothing in either annotation says
+ * SQL, column or table.
+ *
+ * Two halves, because the two facts have different owners:
+ *
+ * - `x-telo-schema-map`, on the field a projection keys on, gives the schema
+ *   node each of its values means (`citext → {type: string}`). It sits with the
+ *   field because that is where the value vocabulary is declared.
+ * - `x-telo-schema-projection`, on the KIND DOCUMENT (a sibling of `schema:`,
+ *   not a keyword inside it), names the entry collection, the keying field, and
+ *   the fields that MODIFY the mapped node. It sits on the document because it
+ *   describes the kind's whole declaration rather than one field of it — but
+ *   `schema:` is where every other `x-telo-*` keyword lives, so the reader
+ *   accepts it in both positions and `validate-schema-projection.ts` reports the
+ *   inner one. Silently ignoring a misplaced annotation is the exact failure the
+ *   strict half exists to prevent: the projection stops typing its consumers and
+ *   the diagnostic lands on the CONSUMER, blaming the wrong author.
+ *
+ * It is a declared LOOKUP, never a computed expression. The analyzer
+ * type-checks CEL and substitutes placeholders; it never evaluates, and a
+ * `base:`-style mapping is evaluated by the kernel at `create()` — too late for
+ * `telo check` to type the rows a consumer reads, which is the projection's
+ * whole purpose.
+ *
+ * Distinct from `x-telo-schema-from`, which derives a field's schema from a
+ * referenced KIND's definition schema. A projection is DECLARATION-derived: the
+ * row shape lives in one instance's own `columns:`, which no definition-level
+ * derivation can reach.
+ */
+function isObject(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
+/** The projection a kind declares, or undefined. Invalid shapes read as absent;
+ *  `validate-schema-projection.ts` is the half that reports them. */
+export function readSchemaProjection(definition) {
+    if (!isObject(definition))
+        return undefined;
+    const raw = rawSchemaProjection(definition);
+    if (!isObject(raw))
+        return undefined;
+    const entries = raw.entries;
+    const key = raw.key;
+    if (typeof entries !== "string" || typeof key !== "string")
+        return undefined;
+    return {
+        entries,
+        key,
+        nameField: typeof raw.name === "string" ? raw.name : undefined,
+        nullable: typeof raw.nullable === "string" ? raw.nullable : undefined,
+        array: typeof raw.array === "string" ? raw.array : undefined,
+    };
+}
+/** The annotation as written, from either position — the document (canonical)
+ *  or `schema:` (accepted, and reported by the strict half). The document wins:
+ *  a kind spelling it in both places is describing its own document. */
+export function rawSchemaProjection(definition) {
+    if (!isObject(definition))
+        return undefined;
+    const own = definition["x-telo-schema-projection"];
+    if (own !== undefined)
+        return own;
+    const schema = definition.schema;
+    return isObject(schema) ? schema["x-telo-schema-projection"] : undefined;
+}
+/** True when the annotation was found inside `schema:` rather than on the
+ *  document — the misplacement the strict half reports. */
+export function schemaProjectionIsMisplaced(definition) {
+    if (!isObject(definition))
+        return false;
+    if (definition["x-telo-schema-projection"] !== undefined)
+        return false;
+    const schema = definition.schema;
+    return isObject(schema) && schema["x-telo-schema-projection"] !== undefined;
+}
+export function readSchemaMap(node) {
+    if (!isObject(node))
+        return undefined;
+    const raw = node["x-telo-schema-map"];
+    if (!isObject(raw))
+        return undefined;
+    const entries = Object.entries(raw).filter(([, value]) => isObject(value));
+    if (entries.length === 0)
+        return undefined;
+    return Object.fromEntries(entries);
+}
+/** The consumer-side annotation: a JSON Pointer to this resource's ref slot
+ *  whose target declares the projection. */
+export function readProjectionFrom(node) {
+    if (!isObject(node))
+        return undefined;
+    const raw = node["x-telo-schema-projection-from"];
+    return typeof raw === "string" ? raw : undefined;
+}
+function navigate(root, pointer) {
+    let current = root;
+    for (const segment of pointer.split("/")) {
+        if (segment === "")
+            continue;
+        if (!isObject(current))
+            return undefined;
+        current = current[segment];
+    }
+    return current;
+}
+/**
+ * Find the `x-telo-schema-map` a projection keys on. The map sits on the entry
+ * field's schema, which is reached through the collection's own schema — a
+ * keyed map's `additionalProperties`, or an array's `items`.
+ */
+export function projectionKeyMap(kindSchema, projection) {
+    let node = kindSchema;
+    for (const segment of projection.entries.split("/")) {
+        if (segment === "")
+            continue;
+        if (!isObject(node) || !isObject(node.properties))
+            return undefined;
+        node = node.properties[segment];
+    }
+    if (!isObject(node))
+        return undefined;
+    const entry = isObject(node.additionalProperties)
+        ? node.additionalProperties
+        : isObject(node.items)
+            ? node.items
+            : undefined;
+    if (!isObject(entry) || !isObject(entry.properties))
+        return undefined;
+    return readSchemaMap(entry.properties[projection.key]);
+}
+/**
+ * Project one declaration to an object schema.
+ *
+ * Modifiers are a CLOSED set applied in a FIXED order — `array` wraps, then
+ * `nullable` widens. Closed because each changes how the schema is assembled,
+ * so a third-party modifier would be a name nothing acts on; ordered because
+ * leaving it implicit is how two implementations come to disagree.
+ *
+ * The projection is deliberately LOSSY. Length, precision, collation and check
+ * constraints do not reach it: a consumer needs the type, its nullability and
+ * its repetition, and the database enforces the rest. A per-entry schema rich
+ * enough to double as a validator would move the domain's semantics into the
+ * type layer.
+ */
+export function projectEntries(manifest, projection, map) {
+    const entries = navigate(manifest, projection.entries);
+    if (entries === undefined)
+        return undefined;
+    const pairs = [];
+    const consider = (name, entry) => {
+        if (!isObject(entry) || name === undefined)
+            return;
+        const key = entry[projection.key];
+        const mapped = typeof key === "string" ? map[key] : undefined;
+        // A value with no map entry projects to nothing rather than to `any`: the
+        // vocabulary is the kind's own enum, so an unmapped value is a gap in the
+        // kind's declaration, not a shape to guess at.
+        if (!mapped)
+            return;
+        let node = { ...mapped };
+        if (projection.array && entry[projection.array] === true) {
+            node = { type: "array", items: node };
+        }
+        if (projection.nullable && entry[projection.nullable] !== false) {
+            node = { anyOf: [node, { type: "null" }] };
+        }
+        pairs.push([name, node]);
+    };
+    if (Array.isArray(entries)) {
+        for (const entry of entries) {
+            const name = isObject(entry) && projection.nameField
+                ? entry[projection.nameField]
+                : undefined;
+            consider(name, entry);
+        }
+    }
+    else if (isObject(entries)) {
+        for (const [name, entry] of Object.entries(entries))
+            consider(name, entry);
+    }
+    else {
+        return undefined;
+    }
+    return {
+        type: "object",
+        properties: Object.fromEntries(pairs),
+        additionalProperties: false,
+    };
+}
+/** The `{kind, name, alias?}` reference a value holds, or undefined. Exported so
+ *  a host whose slot may hold EITHER shape can fall back to this reading. */
+export function readProjectionRef(value) {
+    if (!isObject(value))
+        return undefined;
+    const name = value.name;
+    if (typeof name !== "string")
+        return undefined;
+    return {
+        name,
+        kind: typeof value.kind === "string" ? value.kind : undefined,
+        alias: typeof value.alias === "string" ? value.alias : undefined,
+    };
+}
+/**
+ * The resolver for a FLATTENED manifest list — the analyzer's own shape.
+ *
+ * An alias narrows to the manifests forwarded from that import (stamped
+ * `metadata.alias` by flatten), so two libraries each exporting a `users` table
+ * stay distinguishable. Only when nothing carries the alias does it fall back to
+ * matching by name alone, which is the pre-flatten shape a standalone module
+ * analysis has.
+ */
+export function manifestListScope(manifests, resolveDefinition) {
+    return {
+        resolveDefinition,
+        resolveManifest(value) {
+            const ref = readProjectionRef(value);
+            if (!ref)
+                return undefined;
+            const byName = manifests.filter((candidate) => candidate?.metadata?.name === ref.name &&
+                (typeof ref.kind !== "string" || candidate.kind === ref.kind));
+            const aliased = ref.alias && ref.alias !== "Self"
+                ? byName.filter((candidate) => candidate?.metadata?.alias === ref.alias)
+                : byName;
+            // A name that matches SEVERAL manifests is REFUSED rather than resolved to
+            // the first: picking one by flatten order would type the consumer's rows
+            // against the wrong declaration — a wrong answer, which is worse than no
+            // answer. Reported, so the author is told to disambiguate.
+            const matches = aliased.length > 0 ? aliased : byName;
+            if (matches.length === 0)
+                return undefined;
+            if (matches.length > 1)
+                return { ambiguous: true };
+            return { manifest: matches[0] };
+        },
+    };
+}
+function refTarget(value, scope, pointer) {
+    if (!isObject(value))
+        return { reason: "no-ref", pointer };
+    const name = typeof value.name === "string" ? value.name : "<unnamed>";
+    const found = scope.resolveManifest(value);
+    if (!found)
+        return { reason: "unresolved", pointer, name };
+    if ("ambiguous" in found)
+        return { reason: "ambiguous", pointer, name };
+    const manifest = found.manifest;
+    if (typeof manifest.kind !== "string")
+        return { reason: "unresolved", pointer, name };
+    const definition = scope.resolveDefinition(manifest.kind);
+    if (!definition)
+        return { reason: "no-projection", pointer, kind: manifest.kind };
+    return { manifest, definition };
+}
+export function describeProjectionFailure(failure) {
+    switch (failure.reason) {
+        case "no-ref":
+            return `'${failure.pointer}' does not hold a reference, so there is no declaration to project.`;
+        case "unresolved":
+            return `'${failure.pointer}' references '${failure.name}', which resolves to no resource.`;
+        case "ambiguous":
+            return (`'${failure.pointer}' references '${failure.name}', which matches more than one resource ` +
+                `in scope. Rename one of them so the reference names exactly one declaration.`);
+        case "no-projection":
+            return (`'${failure.pointer}' references a resource of kind '${failure.kind}', which declares no ` +
+                `'x-telo-schema-projection' — so there is nothing for this slot to be typed from.`);
+    }
+}
+/**
+ * Replace every `x-telo-schema-projection-from` node with the projection of the
+ * declaration it points at.
+ *
+ * Structural: returns a new schema and never mutates the one handed in. A node
+ * that cannot be projected is left exactly as it was — degrading to the slot's
+ * own schema rather than to a wrong one — and the reason is pushed to
+ * `failures`, because degrading SILENTLY is the failure this whole mechanism
+ * exists to move earlier: the consumer's contract quietly reopens and a
+ * misspelled field passes `telo check` exactly as it did before.
+ */
+export function resolveSchemaProjections(schema, manifest, scope, failures) {
+    if (Array.isArray(schema)) {
+        return schema.map((item) => resolveSchemaProjections(item, manifest, scope, failures));
+    }
+    if (!isObject(schema))
+        return schema;
+    const pointer = readProjectionFrom(schema);
+    if (pointer && manifest) {
+        const target = refTarget(navigate(manifest, pointer), scope, pointer);
+        if ("reason" in target) {
+            failures?.push(target);
+        }
+        else {
+            const projection = readSchemaProjection(target.definition);
+            const map = projection && projectionKeyMap(target.definition.schema, projection);
+            const projected = projection && map ? projectEntries(target.manifest, projection, map) : undefined;
+            if (projected) {
+                const { ["x-telo-schema-projection-from"]: _dropped, ...rest } = schema;
+                return { ...rest, ...projected };
+            }
+            failures?.push({
+                reason: "no-projection",
+                pointer,
+                kind: String(target.manifest.kind ?? "<unknown>"),
+            });
+        }
+    }
+    return Object.fromEntries(Object.entries(schema).map(([key, value]) => [
+        key,
+        key.startsWith("x-telo-") ? value : resolveSchemaProjections(value, manifest, scope, failures),
+    ]));
+}

package/dist/step-slot.d.ts

@@ -0,0 +1,39 @@
+/**
+ * "Does this array hold steps, and where does a step keep what the analyzer
+ * reads?" — one accessor, the `ref-slot.ts` / `zone-slot.ts` precedent.
+ *
+ * TWO SPELLINGS, one answer. A kind declares a step body by pointing its items
+ * at the shared grammar (`$ref: "telo://manifest#/$defs/Step"`), which fragment
+ * expansion stamps `x-telo-fragment: Step`; the field names are then constants
+ * of that grammar and nothing states them. Before the fragment existed the shape
+ * was each kind's own, so the kind had to say where its dispatch ref, output
+ * type and pure-value fields lived — `x-telo-step-context`. That annotation
+ * stays READ, permanently: published artifacts carry it and no migration entry
+ * can synthesize a `$ref` (the patch vocabulary writes scalars), so it has the
+ * standing of the legacy `x-telo-ref` string form.
+ *
+ * The annotation WINS where both are present. A kind that spells its own shape
+ * is describing its own manifest, and a stamp says only which grammar the items
+ * point at.
+ *
+ * Browser-safe: no Node built-ins.
+ */
+/** The name a step-bearing array's items carry once expanded. */
+export declare const STEP_FRAGMENT = "Step";
+/** Where a step keeps what the analyzer reads. */
+export interface StepSlot {
+    /** Field on a step naming the resource to dispatch. */
+    invoke: string;
+    /** Field on the INVOKED resource's manifest that narrows its result type.
+     *  Absent for a composer that allows no per-instance narrowing. */
+    outputType?: string;
+    /** Field that produces a result without dispatching. Only a grammar with pure
+     *  steps has one. */
+    value?: string;
+}
+/** The step slot an array property declares, or undefined when it holds no
+ *  steps. `fieldSchema` is the ARRAY's schema — the stamp sits on its `items`. */
+export declare function readStepSlot(fieldSchema: unknown): StepSlot | undefined;
+/** True when the property holds a step body. */
+export declare function isStepSlot(fieldSchema: unknown): boolean;
+//# sourceMappingURL=step-slot.d.ts.map

package/dist/step-slot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-slot.d.ts","sourceRoot":"","sources":["../src/step-slot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,iEAAiE;AACjE,eAAO,MAAM,aAAa,SAAS,CAAC;AAEpC,kDAAkD;AAClD,MAAM,WAAW,QAAQ;IACvB,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;IACf;uEACmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;yBACqB;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAMD;kFACkF;AAClF,wBAAgB,YAAY,CAAC,WAAW,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,CAcvE;AAED,gDAAgD;AAChD,wBAAgB,UAAU,CAAC,WAAW,EAAE,OAAO,GAAG,OAAO,CAExD"}

package/dist/step-slot.js

@@ -0,0 +1,49 @@
+/**
+ * "Does this array hold steps, and where does a step keep what the analyzer
+ * reads?" — one accessor, the `ref-slot.ts` / `zone-slot.ts` precedent.
+ *
+ * TWO SPELLINGS, one answer. A kind declares a step body by pointing its items
+ * at the shared grammar (`$ref: "telo://manifest#/$defs/Step"`), which fragment
+ * expansion stamps `x-telo-fragment: Step`; the field names are then constants
+ * of that grammar and nothing states them. Before the fragment existed the shape
+ * was each kind's own, so the kind had to say where its dispatch ref, output
+ * type and pure-value fields lived — `x-telo-step-context`. That annotation
+ * stays READ, permanently: published artifacts carry it and no migration entry
+ * can synthesize a `$ref` (the patch vocabulary writes scalars), so it has the
+ * standing of the legacy `x-telo-ref` string form.
+ *
+ * The annotation WINS where both are present. A kind that spells its own shape
+ * is describing its own manifest, and a stamp says only which grammar the items
+ * point at.
+ *
+ * Browser-safe: no Node built-ins.
+ */
+import { manifestFragmentOf } from "./manifest-schemas.js";
+/** The name a step-bearing array's items carry once expanded. */
+export const STEP_FRAGMENT = "Step";
+/** The shared grammar's own field names — constants, since the shape is no
+ *  longer the kind's to choose. */
+const STEP_FRAGMENT_SLOT = { invoke: "invoke", outputType: "outputType", value: "value" };
+/** The step slot an array property declares, or undefined when it holds no
+ *  steps. `fieldSchema` is the ARRAY's schema — the stamp sits on its `items`. */
+export function readStepSlot(fieldSchema) {
+    if (!fieldSchema || typeof fieldSchema !== "object")
+        return undefined;
+    const declared = fieldSchema["x-telo-step-context"];
+    if (declared && typeof declared === "object") {
+        const { invoke, outputType, value } = declared;
+        if (typeof invoke !== "string" || invoke.length === 0)
+            return undefined;
+        return {
+            invoke,
+            ...(typeof outputType === "string" ? { outputType } : {}),
+            ...(typeof value === "string" ? { value } : {}),
+        };
+    }
+    const items = fieldSchema.items;
+    return manifestFragmentOf(items) === STEP_FRAGMENT ? STEP_FRAGMENT_SLOT : undefined;
+}
+/** True when the property holds a step body. */
+export function isStepSlot(fieldSchema) {
+    return readStepSlot(fieldSchema) !== undefined;
+}

package/dist/telo-version.d.ts

@@ -1,3 +1,3 @@
 /** The surface generation this analyzer implements. */
-export declare const TELO_SURFACE_VERSION = "0.77.0";
+export declare const TELO_SURFACE_VERSION = "0.79.0";
 //# sourceMappingURL=telo-version.d.ts.map

package/dist/telo-version.js

@@ -5,4 +5,4 @@
 // its release identity, this is the scale a module's `requires.telo` range is
 // written against, and every kernel in every language reports the same scale.
 /** The surface generation this analyzer implements. */
-export const TELO_SURFACE_VERSION = "0.77.0";
+export const TELO_SURFACE_VERSION = "0.79.0";

package/dist/validate-cel-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAStF,MAAM,WAAW,kBAAkB;IACjC;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC;;kDAE8C;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;KACxD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AA4CD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CA0EjC;AAyID;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAChD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CA+JrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB;AAWD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,SAAM,GACT,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAC,CAGvD;AAUD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,SAAM,GAAG,MAAM,EAAE,CAqBxF"}
+{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAWtF,MAAM,WAAW,kBAAkB;IACjC;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC;;kDAE8C;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;KACxD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AA4CD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CA0EjC;AAyID;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAChD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAyKrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB;AAWD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,SAAM,GACT,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAC,CAGvD;AAYD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,SAAM,GAAG,MAAM,EAAE,CAqBxF"}

package/dist/validate-cel-context.js

@@ -1,6 +1,8 @@
 export { extractAccessChains, validateChainAgainstSchema } from "@telorun/templating";
 import { elementSchemaOf, isLiveSlot, mergeTypeSchemas, parseCanonicalTypeSchemaId, } from "@telorun/sdk";
 import { KERNEL_BUILTINS } from "./builtins.js";
+import { isStepSlot } from "./step-slot.js";
+import { withRefSlotsAsReadings } from "./ref-slot-reading.js";
 /**
  * Resolve a type field value (string name, inline type, or raw schema) to a JSON Schema.
  * - String: look up the named type in allManifests (Type.JsonSchema resources)
@@ -367,7 +369,17 @@ export function resolveContextAnnotations(schema, manifestItem, opts) {
                 // so the variable is typed by the CONTRACT rather than by the wrapper
                 // around it. A raw JSON Schema resolves to itself, and a plain property
                 // map (a transport scope) resolves to nothing and is used verbatim.
-                return resolveTypeFieldToSchema(navigated, allManifests ?? []) ?? navigated;
+                const resolved = resolveTypeFieldToSchema(navigated, allManifests ?? []) ?? navigated;
+                // A ref slot inside it holds a live instance at runtime, which the
+                // kernel substitutes with that resource's published reading before
+                // evaluating (`celSelfView`). Type it the same way, or `self.<ref>` is
+                // the annotation node — a shape nothing can be read off.
+                return defs
+                    ? withRefSlotsAsReadings(resolved, {
+                        resolve: (kind) => defs.resolve(kind),
+                        resolveKind: (kind) => aliases?.resolveKind(kind),
+                    })
+                    : resolved;
             }
         }
         if (defs) {
@@ -485,7 +497,9 @@ export function extractContextsFromSchema(schema, path = "$") {
     return all.sort((a, b) => b.scope.length - a.scope.length);
 }
 /** Schema keys that declare a CEL-bearing region: a field carrying any of these
- *  is evaluated at runtime, so a `!cel` inside it (or a descendant) is live. */
+ *  is evaluated at runtime, so a `!cel` inside it (or a descendant) is live. A
+ *  STEP BODY is one too, and says so through the grammar its items point at
+ *  rather than through a key — {@link isStepSlot} reads either spelling. */
 const CEL_REGION_KEYS = [
     "x-telo-context",
     "x-telo-step-context",
@@ -503,7 +517,7 @@ export function extractCelRegionScopes(schema, path = "$") {
     if (!schema || typeof schema !== "object")
         return [];
     const out = [];
-    if (CEL_REGION_KEYS.some((k) => schema[k]))
+    if (CEL_REGION_KEYS.some((k) => schema[k]) || isStepSlot(schema))
         out.push(path);
     if (schema.properties) {
         for (const [key, value] of Object.entries(schema.properties)) {

package/dist/validate-durable-regions.d.ts

@@ -0,0 +1,15 @@
+import type { CallGraph } from "./call-graph.js";
+import { type AnalysisDiagnostic } from "./types.js";
+import { type DefinitionLookup, type ZoneRegion } from "./resolve-zone-containment.js";
+export interface DurableRegionArgs {
+    graph: CallGraph;
+    resolveDef: DefinitionLookup;
+    /** Only report against modules the entry owns — a published dependency's body
+     *  is not the consumer's to fix, the `X_TELO_REF_UNRESOLVED` precedent. */
+    reportModules: ReadonlySet<string>;
+}
+/** Every durable-region diagnostic, over one graph. */
+export declare function validateDurableRegions(args: DurableRegionArgs): AnalysisDiagnostic[];
+/** Re-exported so a consumer can name a region without importing two files. */
+export type { ZoneRegion };
+//# sourceMappingURL=validate-durable-regions.d.ts.map

package/dist/validate-durable-regions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-durable-regions.d.ts","sourceRoot":"","sources":["../src/validate-durable-regions.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,SAAS,EAAgC,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,UAAU,EAChB,MAAM,+BAA+B,CAAC;AAsVvC,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,SAAS,CAAC;IACjB,UAAU,EAAE,gBAAgB,CAAC;IAC7B;+EAC2E;IAC3E,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACpC;AAED,uDAAuD;AACvD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,iBAAiB,GAAG,kBAAkB,EAAE,CAkBpF;AAED,+EAA+E;AAC/E,YAAY,EAAE,UAAU,EAAE,CAAC"}