@telorun/analyzer 0.63.0 → 0.65.0

package/dist/schema-walk.js

@@ -0,0 +1,126 @@
+/**
+ * Structural traversal over a kind's JSON Schema and the step arrays it
+ * declares. Nothing here analyzes: these answer "what does this schema node
+ * point at" and "how do steps nest", the two questions every analyzer pass
+ * asks before it can say anything.
+ *
+ * Its own file so the CEL scope rule (`cel-scope.ts`) and the analysis pass
+ * (`analyzer.ts`) can both reach it without either importing the other — the
+ * scope rule is consumed by the IDE, which must not pull the pass in behind it.
+ */
+import { MANIFEST_SCHEMA_URI, ManifestRootSchema } from "./manifest-schemas.js";
+/** Resolve a local `$ref` (only `#/$defs/<name>` form) against the root schema.
+ *  Non-refs and unresolved refs pass through unchanged. */
+export function resolveLocalRef(schema, root) {
+    if (!schema)
+        return undefined;
+    const ref = schema.$ref;
+    if (typeof ref === "string" && ref.startsWith("#/$defs/")) {
+        const defName = ref.slice("#/$defs/".length);
+        const resolved = root.$defs?.[defName];
+        if (resolved && typeof resolved === "object")
+            return resolved;
+    }
+    // A kernel-owned structural fragment (`telo://manifest#/$defs/InvokeStep`).
+    // Resolved HERE rather than by each walker: this is the one chokepoint every
+    // structural walk already goes through — the step-array walks, the call graph,
+    // the zone projection, the eval-path collector — so a composer that points at a
+    // shared shape stays legible to all of them at once. Nothing is inlined into
+    // the stored schema, which keeps validator-cache identity stable and matches
+    // what `resolveSchemaTypeRefs` does for a named user type.
+    if (typeof ref === "string" && ref.startsWith(BUILTIN_FRAGMENT_PREFIX)) {
+        const defName = ref.slice(BUILTIN_FRAGMENT_PREFIX.length);
+        const resolved = ManifestRootSchema.$defs[defName];
+        if (resolved && typeof resolved === "object")
+            return resolved;
+    }
+    return schema;
+}
+const BUILTIN_FRAGMENT_PREFIX = `${MANIFEST_SCHEMA_URI}#/$defs/`;
+/** Gather property schemas from a (possibly variant-bearing) object schema:
+ *  top-level `properties` plus every `oneOf` / `anyOf` / `allOf` branch.
+ *
+ *  Each branch is resolved through {@link resolveLocalRef} first, so a branch
+ *  that points at a shared shape — a `oneOf` arm that IS the kernel's dispatch
+ *  site — contributes its properties like an inline one. Without that, pointing a
+ *  composer at a shared shape would silently empty every role-driven lookup that
+ *  reads this (the inputs slot, the retry policy, the eval paths), which is a
+ *  failure with no diagnostic attached to it. */
+export function gatherPropertySchemas(schema, root) {
+    const out = [];
+    const base = resolveLocalRef(schema, root ?? schema) ?? schema;
+    if (base.properties && typeof base.properties === "object") {
+        for (const [k, v] of Object.entries(base.properties)) {
+            out.push([k, v]);
+        }
+    }
+    for (const variantKey of ["oneOf", "anyOf", "allOf"]) {
+        const arr = base[variantKey];
+        if (!Array.isArray(arr))
+            continue;
+        for (const raw of arr) {
+            if (!raw || typeof raw !== "object")
+                continue;
+            const variant = resolveLocalRef(raw, root ?? schema) ?? raw;
+            if (variant.properties) {
+                for (const [k, v] of Object.entries(variant.properties)) {
+                    out.push([k, v]);
+                }
+            }
+        }
+    }
+    return out;
+}
+/**
+ * Generic, role-driven walk over a step array. Calls
+ * `visit(step, stepPath)` for every step — top-level and nested through the
+ * `x-telo-topology-role` forms (`branch`, `branch-list`, `case-map`). This is
+ * the single definition of how steps nest, shared by `buildStepContextSchema`
+ * (which types `steps.<name>.result`) and `validateStepInvokeReferences` (which
+ * checks invoke refs), so the topology contract lives in one place — adding a
+ * role or nesting form updates both consumers at once. No resource kind is
+ * hardcoded; recursion is driven entirely by the schema annotations.
+ */
+export function walkStepArray(steps, stepItemSchema, rootSchema, basePath, visit) {
+    const dispatchRole = (data, role, itemsSchema, path) => {
+        if (role === "branch" && Array.isArray(data)) {
+            walkStepArray(data, stepItemSchema, rootSchema, path, visit);
+        }
+        else if (role === "case-map" && data && typeof data === "object" && !Array.isArray(data)) {
+            for (const [caseKey, arr] of Object.entries(data)) {
+                if (Array.isArray(arr))
+                    walkStepArray(arr, stepItemSchema, rootSchema, `${path}.${caseKey}`, visit);
+            }
+        }
+        else if (role === "branch-list" && Array.isArray(data)) {
+            const entrySchema = resolveLocalRef(itemsSchema, rootSchema);
+            if (!entrySchema)
+                return;
+            data.forEach((entry, i) => {
+                if (!entry || typeof entry !== "object")
+                    return;
+                for (const [subKey, subSchema] of gatherPropertySchemas(entrySchema)) {
+                    const subRole = subSchema["x-telo-topology-role"];
+                    if (typeof subRole !== "string")
+                        continue;
+                    dispatchRole(entry[subKey], subRole, subSchema.items, `${path}[${i}].${subKey}`);
+                }
+            });
+        }
+    };
+    steps.forEach((step, i) => {
+        if (!step || typeof step !== "object")
+            return;
+        const s = step;
+        const stepPath = `${basePath}[${i}]`;
+        visit(s, stepPath);
+        if (!stepItemSchema)
+            return;
+        for (const [propKey, propSchema] of gatherPropertySchemas(stepItemSchema)) {
+            const role = propSchema["x-telo-topology-role"];
+            if (typeof role !== "string")
+                continue;
+            dispatchRole(s[propKey], role, propSchema.items, `${stepPath}.${propKey}`);
+        }
+    });
+}

package/dist/telo-version.d.ts

@@ -1,3 +1,3 @@
 /** The surface generation this analyzer implements. */
-export declare const TELO_SURFACE_VERSION = "0.79.0";
+export declare const TELO_SURFACE_VERSION = "0.82.0";
 //# sourceMappingURL=telo-version.d.ts.map

package/dist/telo-version.js

@@ -5,4 +5,4 @@
 // its release identity, this is the scale a module's `requires.telo` range is
 // written against, and every kernel in every language reports the same scale.
 /** The surface generation this analyzer implements. */
-export const TELO_SURFACE_VERSION = "0.79.0";
+export const TELO_SURFACE_VERSION = "0.82.0";

package/dist/validate-nested-inline.d.ts

@@ -1,4 +1,6 @@
 import type { ResourceManifest } from "@telorun/sdk";
+import type { ExternalSchemaResolver } from "./schema-compat.js";
+import type { SchemaIssue } from "./schema-error-report.js";
 import { type AnalysisDiagnostic } from "./types.js";
 /** Minimal view of a definition needed to validate an inline resource's config. */
 export interface InlineDefinitionLookup {
@@ -6,6 +8,21 @@ export interface InlineDefinitionLookup {
         schema?: Record<string, any>;
     } | undefined;
 }
+/**
+ * The validator this pass checks an inline resource's config with, and the
+ * resolver that lets both it and the stand-in walk see through a named shape.
+ *
+ * Passed in rather than reached for: the module-level AJV this used has no
+ * registered shapes, so a kind whose `schema:` references one compiled nowhere
+ * and every inline declaration of it was silently unchecked — while the
+ * identical resource written standalone was checked, and the kernel rejected
+ * both at boot. Two validators answering one question is what allowed that, so
+ * the caller supplies the one that holds the shapes.
+ */
+export interface InlineConfigValidator {
+    validate(data: unknown, schema: Record<string, any>): SchemaIssue[];
+    external: ExternalSchemaResolver;
+}
 /**
  * Validates inline resources nested inside a resource body against their kind's
  * config schema. The per-resource walk in `analyze()` validates a resource's
@@ -28,5 +45,9 @@ export interface InlineDefinitionLookup {
  */
 export declare function validateNestedInlineResources(manifest: ResourceManifest, rootSchema: Record<string, any>, lookupDefinition: InlineDefinitionLookup, 
 /** Needed to resolve a `telo#Type` field a value slot is validated against. */
-allManifests?: Record<string, any>[]): AnalysisDiagnostic[];
+allManifests: Record<string, any>[], 
+/** REQUIRED, and deliberately not defaulted: a default would be a second
+ *  validator answering the same question, and omitting it would silently stop
+ *  checking rather than fail. */
+validator: InlineConfigValidator): AnalysisDiagnostic[];
 //# sourceMappingURL=validate-nested-inline.d.ts.map

package/dist/validate-nested-inline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-nested-inline.d.ts","sourceRoot":"","sources":["../src/validate-nested-inline.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAQrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAKzE,mFAAmF;AACnF,MAAM,WAAW,sBAAsB;IACrC,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;KAAE,GAAG,SAAS,CAAC;CAC9D;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,gBAAgB,EAC1B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,gBAAgB,EAAE,sBAAsB;AACxC,+EAA+E;AAC/E,YAAY,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAO,GACvC,kBAAkB,EAAE,CA6HtB"}
+{"version":3,"file":"validate-nested-inline.d.ts","sourceRoot":"","sources":["../src/validate-nested-inline.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAEjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAKzE,mFAAmF;AACnF,MAAM,WAAW,sBAAsB;IACrC,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;KAAE,GAAG,SAAS,CAAC;CAC9D;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,WAAW,EAAE,CAAC;IACpE,QAAQ,EAAE,sBAAsB,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,gBAAgB,EAC1B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,gBAAgB,EAAE,sBAAsB;AACxC,+EAA+E;AAC/E,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE;AACnC;;iCAEiC;AACjC,SAAS,EAAE,qBAAqB,GAC/B,kBAAkB,EAAE,CAiItB"}

package/dist/validate-nested-inline.js

@@ -1,5 +1,5 @@
 import { collectRefs, isInlineResource } from "./reference-field-map.js";
-import { collectProperties, resolveRef, substituteCelFields, validateAgainstSchema, } from "./schema-compat.js";
+import { collectProperties, resolveRef, substituteCelFields } from "./schema-compat.js";
 import { DiagnosticSeverity } from "./types.js";
 import { collectValueSchemaIssues } from "./validate-value-schema.js";
 const SOURCE = "telo-analyzer";
@@ -25,7 +25,11 @@ const SOURCE = "telo-analyzer";
  */
 export function validateNestedInlineResources(manifest, rootSchema, lookupDefinition, 
 /** Needed to resolve a `telo#Type` field a value slot is validated against. */
-allManifests = []) {
+allManifests, 
+/** REQUIRED, and deliberately not defaulted: a default would be a second
+ *  validator answering the same question, and omitting it would silently stop
+ *  checking rather than fail. */
+validator) {
     const diagnostics = [];
     const resource = { kind: manifest.kind, name: manifest.metadata?.name };
     const filePath = manifest.metadata?.source;
@@ -70,14 +74,18 @@ allManifests = []) {
             ? inline.metadata
             : {};
         const data = { ...inline, metadata: { name: "__inline__", ...existingMeta } };
-        const substituted = substituteCelFields(data, effectiveSchema, effectiveSchema);
-        // The same two passes the top-level resource loop runs, so a kind's
-        // guarantees don't depend on whether the author wrote it standalone or
-        // inline (under a step's `invoke:`, or in a `with:` scope). `data` carries
-        // the synthesized metadata; `x-telo-value-schema-from` reads sibling fields
-        // off the resource, which are present either way.
+        const substituted = substituteCelFields(data, effectiveSchema, effectiveSchema, {
+            external: validator.external,
+        });
+        // The same two passes the top-level resource loop runs, on the same
+        // validator, so a kind's guarantees don't depend on whether the author wrote
+        // it standalone or inline (under a step's `invoke:`, or in a `with:` scope)
+        // — and CLAUDE.md mandates inline for a single-use resource, so inline is
+        // the common shape rather than the exception. `data` carries the synthesized
+        // metadata; `x-telo-value-schema-from` reads sibling fields off the
+        // resource, which are present either way.
         const inlineIssues = [
-            ...validateAgainstSchema(substituted, effectiveSchema),
+            ...validator.validate(substituted, effectiveSchema),
             ...collectValueSchemaIssues(data, schema, allManifests),
         ];
         for (const issue of inlineIssues) {

package/dist/validate-step-inputs.d.ts

@@ -1,5 +1,6 @@
 import type { AliasResolver, ModuleScopes } from "./alias-resolver.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
+import { type ReferenceFieldMap } from "./reference-field-map.js";
 export interface StepInputIssue {
     path: string;
     targetLabel: string;
@@ -29,4 +30,20 @@ export declare function collectStepInputIssues(manifest: Record<string, any>, de
  *  caller because building it is analyzer state; without it the contract check
  *  still runs and only the type-argument comparison is skipped. */
 stepContext?: Record<string, any>): StepInputIssue[];
+/**
+ * Validate the argument map of every call this resource makes through a
+ * REFERENCE SLOT, as opposed to a step.
+ *
+ * A slot that transfers control names its argument slot on its own `x-telo-ref`
+ * (`inputs:`, a JSON Pointer relative to the object enclosing the slot). That
+ * annotation is the only thing tying an otherwise-open `inputs:` map to the
+ * resource it holds arguments for — an HTTP route's `handler:` + `inputs:` pair
+ * is exactly this shape, and nothing about it is a step.
+ *
+ * Discovery is driven by the annotation rather than by any kind's topology, so
+ * a composer that names its argument slot gets its call sites checked without
+ * the analyzer learning what a route is. It is the same check the step driver
+ * runs, because it is the same question.
+ */
+export declare function collectRefInputIssues(manifest: Record<string, any>, fieldMap: ReferenceFieldMap | undefined, allManifests: Record<string, any>[], defs: DefinitionRegistry, aliases: AliasResolver, scopes: ModuleScopes): StepInputIssue[];
 //# sourceMappingURL=validate-step-inputs.d.ts.map

package/dist/validate-step-inputs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-step-inputs.d.ts","sourceRoot":"","sources":["../src/validate-step-inputs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAsBnE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB;iFAC6E;IAC7E,IAAI,CAAC,EAAE,4BAA4B,GAAG,oBAAoB,CAAC;CAC5D;AAGD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC7B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC9B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY;AACpB;;mEAEmE;AACnE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAChC,cAAc,EAAE,CAsJlB"}
+{"version":3,"file":"validate-step-inputs.d.ts","sourceRoot":"","sources":["../src/validate-step-inputs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAsBnE,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAElC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB;iFAC6E;IAC7E,IAAI,CAAC,EAAE,4BAA4B,GAAG,oBAAoB,CAAC;CAC5D;AAGD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC7B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC9B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY;AACpB;;mEAEmE;AACnE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAChC,cAAc,EAAE,CA4DlB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC7B,QAAQ,EAAE,iBAAiB,GAAG,SAAS,EACvC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY,GACnB,cAAc,EAAE,CAoClB"}

package/dist/validate-step-inputs.js

@@ -1,10 +1,12 @@
 import { resolveContract } from "./invocation-contract.js";
-import { checkSchemaCompatibility, navigateSchemaToExprPath, substituteCelFields, validateAgainstSchema, } from "./schema-compat.js";
+import { checkSchemaCompatibility, navigateSchemaToExprPath, substituteCelFields, } from "./schema-compat.js";
 import { plainChainOf } from "@telorun/templating";
 import { isLiveSlot, valueTypeOf } from "@telorun/sdk";
 import { manifestFragmentOf } from "./manifest-schemas.js";
 import { analyzerContractScope, containerOf, gatherPropertySchemas, missingRequired, resolveLocalRef, walkStepArray, } from "./analyzer.js";
 import { readStepSlot } from "./step-slot.js";
+import { navigateConcretePath } from "./manifest-path.js";
+import { isRefEntry, resolveFieldEntries, } from "./reference-field-map.js";
 /**
  * Validate every step's `inputs:` against the invoked target's declared input
  * contract — the static half of what the kernel enforces at dispatch.
@@ -32,6 +34,14 @@ stepContext) {
         return out;
     const contractScope = analyzerContractScope(defs, aliases, scopes, allManifests);
     const readingModule = manifest.metadata?.module;
+    const ctx = {
+        manifest,
+        allManifests,
+        defs,
+        contractScope,
+        readingModule,
+        stepContext,
+    };
     for (const [fieldName, fieldSchema] of Object.entries(props)) {
         const stepCtx = readStepSlot(fieldSchema);
         if (!stepCtx)
@@ -58,6 +68,87 @@ stepContext) {
                 return;
             if (!values || typeof values !== "object" || Array.isArray(values))
                 return;
+            out.push(...checkCallSite({
+                inputsPath: `${stepPath}.${inputsField}`,
+                values: values,
+                invoke,
+                // Only a step declares a re-attempt policy, so only a step can carry
+                // the live-value-retried finding.
+                declaredRetryFor: (invokedManifest, invokedDef) => declaredRetry(step, stepItemSchema, invokedManifest, invokedDef),
+            }, ctx));
+        });
+    }
+    return out;
+}
+/**
+ * Validate the argument map of every call this resource makes through a
+ * REFERENCE SLOT, as opposed to a step.
+ *
+ * A slot that transfers control names its argument slot on its own `x-telo-ref`
+ * (`inputs:`, a JSON Pointer relative to the object enclosing the slot). That
+ * annotation is the only thing tying an otherwise-open `inputs:` map to the
+ * resource it holds arguments for — an HTTP route's `handler:` + `inputs:` pair
+ * is exactly this shape, and nothing about it is a step.
+ *
+ * Discovery is driven by the annotation rather than by any kind's topology, so
+ * a composer that names its argument slot gets its call sites checked without
+ * the analyzer learning what a route is. It is the same check the step driver
+ * runs, because it is the same question.
+ */
+export function collectRefInputIssues(manifest, fieldMap, allManifests, defs, aliases, scopes) {
+    const out = [];
+    if (!fieldMap)
+        return out;
+    const contractScope = analyzerContractScope(defs, aliases, scopes, allManifests);
+    const ctx = {
+        manifest,
+        allManifests,
+        defs,
+        contractScope,
+        readingModule: manifest.metadata?.module,
+    };
+    for (const [fieldPath, entry] of fieldMap) {
+        if (!isRefEntry(entry) || !entry.inputs)
+            continue;
+        const pointer = pointerSegments(entry.inputs);
+        if (!pointer)
+            continue;
+        for (const { value: invoke, path: slotPath } of resolveFieldEntries(manifest, fieldPath)) {
+            if (!invoke || typeof invoke !== "object" || Array.isArray(invoke))
+                continue;
+            // Relative to the object ENCLOSING the slot, which is the annotation's
+            // documented anchor.
+            const enclosing = slotPath.slice(0, Math.max(0, slotPath.lastIndexOf(".")));
+            const inputsPath = [enclosing, ...pointer].filter(Boolean).join(".");
+            const values = navigateConcretePath(manifest, inputsPath);
+            if (!values || typeof values !== "object" || Array.isArray(values))
+                continue;
+            out.push(...checkCallSite({ inputsPath, values: values, invoke: invoke }, ctx));
+        }
+    }
+    return out;
+}
+/** A JSON Pointer naming a sibling FIELD path. An array index is not a field,
+ *  so a pointer carrying one names nothing this can resolve. */
+function pointerSegments(pointer) {
+    if (!pointer.startsWith("/"))
+        return undefined;
+    const segments = pointer
+        .slice(1)
+        .split("/")
+        .map((s) => s.replace(/~1/g, "/").replace(/~0/g, "~"));
+    return segments.every((s) => s.length > 0 && !/^\d+$/.test(s)) ? segments : undefined;
+}
+/**
+ * The check itself, shared by both drivers: the arguments written at a call site
+ * against the contract the target declares.
+ */
+function checkCallSite(site, ctx) {
+    const out = [];
+    const { manifest, allManifests, defs, contractScope, readingModule, stepContext } = ctx;
+    const { invoke, values } = site;
+    {
+        {
             const invokedKind = invoke.kind;
             const invokedName = invoke.name;
             const invokedManifest = invokedName
@@ -68,14 +159,22 @@ stepContext) {
                 : undefined;
             const contract = resolveContract("inputType", invokedManifest, invokedDef, contractScope);
             if (!contract)
-                return;
+                return out;
             // Findings AT a substituted path are about a placeholder, not about
             // anything the author wrote — a `pattern`-constrained string or a `oneOf`
             // of unrelated shapes cannot be satisfied by any stand-in. Structural
             // findings (missing required, unknown property) are located at the
             // container and survive the filter.
             const celPaths = new Set();
-            const substituted = substituteCelFields(values, contract.schema, undefined, (p) => celPaths.add(p));
+            const substituted = substituteCelFields(values, contract.schema, undefined, {
+                onSubstitute: (p) => celPaths.add(p),
+                // A contract may name a shape declared elsewhere. Both halves need the
+                // resolver or they disagree about the same slot: the stand-in walk hands
+                // its expressions a typeless value, and the check below compiles nothing
+                // at all — so a step's arguments went unchecked against exactly the
+                // contracts that describe them most precisely.
+                external: (ref) => defs.schemaForId(ref),
+            });
             // The type-argument check, at the one site where a produced value's schema
             // meets a consuming slot's. A CEL leaf's placeholder says nothing about
             // what the expression yields, so AJV above is silent here by design — and
@@ -120,10 +219,10 @@ stepContext) {
                     // already declared: the value's liveness by its value type, and the
                     // re-attempt by the retry policy. No kind is named.
                     if (isLiveSlot(produced)) {
-                        const retry = declaredRetry(step, stepItemSchema, invokedManifest, invokedDef);
+                        const retry = site.declaredRetryFor?.(invokedManifest, invokedDef);
                         if (retry !== undefined) {
                             out.push({
-                                path: `${stepPath}.${inputsField}.${inputName}`,
+                                path: `${site.inputsPath}.${inputName}`,
                                 targetLabel: invokedName ?? invokedKind ?? "the invoked resource",
                                 message: `'${inputName}' is a live value, which is consumed by reading and so exists ` +
                                     `once — but ${retry} re-attempts the dispatch, and a re-attempt would pass ` +
@@ -140,14 +239,14 @@ stepContext) {
                     if (compatible)
                         continue;
                     out.push({
-                        path: `${stepPath}.${inputsField}.${inputName}`,
+                        path: `${site.inputsPath}.${inputName}`,
                         targetLabel: invokedName ?? invokedKind ?? "the invoked resource",
                         message: issues.join("; "),
                         code: "CEL_TYPE_ARGUMENT_MISMATCH",
                     });
                 }
             }
-            for (const issue of validateAgainstSchema(substituted, contract.schema)) {
+            for (const issue of defs.validateResourceConfig(substituted, contract.schema)) {
                 if (celPaths.has(issue.path))
                     continue;
                 // A missing-required issue names the property that ISN'T there, so
@@ -156,12 +255,12 @@ stepContext) {
                 // container that should have held it, which does exist.
                 const anchor = missingRequired(issue) ? containerOf(issue.path) : issue.path;
                 out.push({
-                    path: anchor ? `${stepPath}.${inputsField}.${anchor}` : `${stepPath}.${inputsField}`,
+                    path: anchor ? `${site.inputsPath}.${anchor}` : site.inputsPath,
                     targetLabel: invokedName ?? invokedKind ?? "the invoked resource",
                     message: issue.message,
                 });
             }
-        });
+        }
     }
     return out;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.63.0",
+  "version": "0.65.0",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",
@@ -49,7 +49,7 @@
     "@types/node": "^20.0.0",
     "typescript": "^5.0.0",
     "vitest": "^2.1.8",
-    "@telorun/sdk": "0.79.0"
+    "@telorun/sdk": "0.82.0"
   },
   "peerDependencies": {
     "@telorun/sdk": "*"

package/src/analysis-registry.ts

@@ -1,6 +1,7 @@
 import type { ResourceDefinition, ResourceManifest } from "@telorun/sdk";
 import { AliasResolver } from "./alias-resolver.js";
 import { KERNEL_BUILTINS } from "./builtins.js";
+import { ManifestAnalysis } from "./manifest-analysis.js";
 import { DefinitionRegistry } from "./definition-registry.js";
 import { computeSuggestKind, computeValidUserFacingKinds } from "./kind-suggest.js";
 import { visitManifest as runVisitManifest, type ManifestVisitor } from "./manifest-visitor.js";
@@ -242,6 +243,42 @@ export class AnalysisRegistry {
     });
   }
 
+  /**
+   * Resolves an `x-telo-schema-from` annotation to the schema node it derives,
+   * in the scope of the kind that DECLARED it — anchors are alias-qualified, and
+   * the declaring definition's module is where those aliases mean something.
+   *
+   * The seam an IDE walks a schema through: a slot shaped entirely by this
+   * annotation (an `Http.Api` route's `request:`) carries no `properties` of its
+   * own, so a walker that only reads `properties` finds nothing there and
+   * silently offers no keys and no hover — a whole field of the standard library
+   * looking like an unknown one.
+   */
+  resolveSchemaFrom(schemaFrom: string, declaringKind: string): Record<string, any> | undefined {
+    const def = this.resolveDefinition(declaringKind);
+    const ownerModule = (def?.metadata as { module?: string } | undefined)?.module;
+    const scope = (ownerModule ? this.aliasesByModule.get(ownerModule) : undefined) ?? this.aliases;
+    return this.defs.resolveSchemaFromNode(schemaFrom, scope);
+  }
+
+  /**
+   * The queries that need this registry AND a manifest set: what CEL sees at a
+   * site, where a binding was declared, what a reference's contract is.
+   *
+   * The seam an IDE reaches all of them through, and one object rather than a
+   * factory per question — each answer has to be the one the analysis pass
+   * computed, or a completion list stops being a claim about what `telo check`
+   * accepts. Built per analysis, not per keystroke: the indices behind it are a
+   * function of the whole manifest set.
+   */
+  analysisOf(manifests: ResourceManifest[]): ManifestAnalysis {
+    return new ManifestAnalysis(manifests, {
+      defs: this.defs,
+      aliases: this.aliases,
+      aliasesByModule: this.aliasesByModule,
+    });
+  }
+
   /**
    * Returns the built-in kernel definitions. The underlying DefinitionRegistry already
    * seeds these on construction; this method exposes them so callers (e.g. the kernel's