@telorun/analyzer 0.64.0 → 0.65.0

package/dist/schema-error-report.d.ts

@@ -0,0 +1,68 @@
+/**
+ * The one renderer for AJV validation failures.
+ *
+ * Browser-safe and re-imported by the kernel — the split `buildEvalPaths` and
+ * the redaction path parser already use — so a failure is phrased identically
+ * under `telo check` and at runtime. Three implementations used to answer this
+ * (the analyzer's keyword prose, the kernel's raw `instancePath + message`
+ * join, and observed state's own inline variant), so a developer who fixed what
+ * the analyzer told them met a different sentence describing the same thing.
+ *
+ * UNION REDUCTION is the second half. A union must attempt every branch, and
+ * AJV cannot know which one was intended — `discriminator: true` works only
+ * against an explicit OpenAPI-style discriminator property, which would mean
+ * changing what every module's authors write. So branch selection is a
+ * reporting concern and lives here.
+ *
+ * It narrows the error SET, never just the sentence: every consumer maps the
+ * surviving errors to manifest paths to anchor a diagnostic, so reducing at the
+ * prose layer alone would move the soup out of the message and into the
+ * problems list, one entry per branch on a different line.
+ *
+ * Selection is made from the ERRORS ALONE, never from the schema. A branch
+ * whose discriminating key is present emits no complaint at the union's own
+ * instancePath; one whose key is absent says `required`, and one that forbids a
+ * key the value carries says `additionalProperties`. That is the whole signal,
+ * and reading it off the errors is what lets reduction work across a `$ref`
+ * into another registered schema, where navigating to the branch subschema
+ * would mean re-implementing AJV's resolution.
+ */
+/** An AJV error object. Structurally typed — the analyzer and the kernel hand
+ *  over errors from their own AJV instances. */
+export interface AjvErrorLike {
+    keyword?: string;
+    instancePath?: string;
+    schemaPath?: string;
+    message?: string;
+    params?: Record<string, any>;
+    data?: unknown;
+}
+/** A schema validation issue with a dotted-path pointer to the offending field. */
+export interface SchemaIssue {
+    message: string;
+    /** Dotted path to the field (e.g. "config.handler"). Empty string means root. */
+    path: string;
+}
+export declare function formatSingleError(err: AjvErrorLike): string;
+/**
+ * Replace each failing union with the errors of the branch the author plainly
+ * meant, recursively, outside in.
+ *
+ * Attribution runs to the DEEPEST occurrence that could own an error, which is
+ * what keeps a container's own complaint apart from its child's when both carry
+ * the same `schemaPath`. An occurrence reached through a branch becomes a
+ * candidate branch of its own — it raised nothing at the parent's node, so it is
+ * plausible exactly when the value really did take that shape and fail further
+ * in, and reducing it recursively is what stops an inner union's alternatives
+ * from surviving inside the outer one's selection.
+ */
+export declare function reduceSchemaErrors(errors: AjvErrorLike[] | null | undefined): AjvErrorLike[];
+/** Converts an AJV error to a dotted path compatible with PositionIndex keys.
+ *  e.g. instancePath "/config/routes/0/handler" → "config.routes[0].handler"
+ *  For "required" keyword errors, appends the missing property to the parent path. */
+export declare function ajvErrorToPath(err: AjvErrorLike): string;
+/** Reduced, path-anchored issues — what a diagnostic list is built from. */
+export declare function schemaIssues(errors: AjvErrorLike[] | null | undefined): SchemaIssue[];
+/** Reduced, rendered as one sentence — what a thrown runtime error carries. */
+export declare function formatAjvErrors(errors: AjvErrorLike[] | null | undefined): string;
+//# sourceMappingURL=schema-error-report.d.ts.map

package/dist/schema-error-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-error-report.d.ts","sourceRoot":"","sources":["../src/schema-error-report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;gDACgD;AAChD,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;CACd;AAWD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,YAAY,GAAG,MAAM,CAe3D;AAkGD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,YAAY,EAAE,CAsF5F;AAqHD;;sFAEsF;AACtF,wBAAgB,cAAc,CAAC,GAAG,EAAE,YAAY,GAAG,MAAM,CAaxD;AAED,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,WAAW,EAAE,CAKrF;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAIjF"}

package/dist/schema-error-report.js

@@ -0,0 +1,356 @@
+/**
+ * The one renderer for AJV validation failures.
+ *
+ * Browser-safe and re-imported by the kernel — the split `buildEvalPaths` and
+ * the redaction path parser already use — so a failure is phrased identically
+ * under `telo check` and at runtime. Three implementations used to answer this
+ * (the analyzer's keyword prose, the kernel's raw `instancePath + message`
+ * join, and observed state's own inline variant), so a developer who fixed what
+ * the analyzer told them met a different sentence describing the same thing.
+ *
+ * UNION REDUCTION is the second half. A union must attempt every branch, and
+ * AJV cannot know which one was intended — `discriminator: true` works only
+ * against an explicit OpenAPI-style discriminator property, which would mean
+ * changing what every module's authors write. So branch selection is a
+ * reporting concern and lives here.
+ *
+ * It narrows the error SET, never just the sentence: every consumer maps the
+ * surviving errors to manifest paths to anchor a diagnostic, so reducing at the
+ * prose layer alone would move the soup out of the message and into the
+ * problems list, one entry per branch on a different line.
+ *
+ * Selection is made from the ERRORS ALONE, never from the schema. A branch
+ * whose discriminating key is present emits no complaint at the union's own
+ * instancePath; one whose key is absent says `required`, and one that forbids a
+ * key the value carries says `additionalProperties`. That is the whole signal,
+ * and reading it off the errors is what lets reduction work across a `$ref`
+ * into another registered schema, where navigating to the branch subschema
+ * would mean re-implementing AJV's resolution.
+ */
+const UNION_KEYWORDS = new Set(["anyOf", "oneOf"]);
+/** Keywords a branch raises at the union's OWN instancePath when the value is
+ *  not of that branch's shape at all — as opposed to being that shape and wrong
+ *  further in. These are what make a branch implausible. */
+const SHAPE_KEYWORDS = new Set(["required", "type", "additionalProperties", "enum", "const"]);
+/* ------------------------------------------------------------------ prose */
+export function formatSingleError(err) {
+    const p = err.instancePath || "/";
+    const params = err.params ?? {};
+    switch (err.keyword) {
+        case "additionalProperties":
+            return `${p} must NOT have additional properties ('${params.additionalProperty}' is not allowed)`;
+        case "required":
+            return `${p} is missing required property '${params.missingProperty}'`;
+        case "enum":
+            return `${p} ${err.message ?? "is invalid"} (${params.allowedValues?.join(" | ")})`;
+        case "type":
+            return `${p} must be ${params.type}${describeActual(err)}`;
+        default:
+            return `${p} ${err.message ?? "is invalid"}`;
+    }
+}
+/** ` (got string)`, or nothing when the value is not in hand. AJV carries
+ *  `data` only under `verbose`, and a reducer that navigated the root value
+ *  would have to be given it at every call site; an absent actual type is worth
+ *  less than a wrong one. */
+function describeActual(err) {
+    if (!("data" in err))
+        return "";
+    const d = err.data;
+    if (d === null)
+        return " (got null)";
+    if (Array.isArray(d))
+        return " (got array)";
+    return ` (got ${typeof d})`;
+}
+/* -------------------------------------------------------------- reduction */
+/** The branch index a `schemaPath` sits under, for a union whose own schemaPath
+ *  is `unionPath` (`…/anyOf`): a child is `…/anyOf/<i>/…` and nothing else can
+ *  collide with it. */
+function branchIndexUnder(unionPath, schemaPath) {
+    if (!schemaPath || !schemaPath.startsWith(unionPath + "/"))
+        return undefined;
+    const rest = schemaPath.slice(unionPath.length + 1);
+    const slash = rest.indexOf("/");
+    const head = slash === -1 ? rest : rest.slice(0, slash);
+    const index = Number(head);
+    return Number.isInteger(index) ? index : undefined;
+}
+function instanceDepth(path) {
+    if (!path)
+        return 0;
+    return path.split("/").filter((s) => s !== "").length;
+}
+/**
+ * How the alternatives at a union node are described, one phrase each.
+ *
+ * Read off the complaints made at the union's own node, and deliberately ONE
+ * PHRASE PER MISSING KEY rather than one per error group. AJV inlines most
+ * `$ref` branches and reports them all under the same bare `schemaPath`, so
+ * several branches are genuinely indistinguishable in the error set — joining
+ * their keys into a single phrase would read as one alternative demanding all
+ * of them, which is a claim about the schema that is simply false. Listing them
+ * separately under-specifies a branch that requires two keys at once, and each
+ * clause is still a true necessary condition; asserting a conjunction that does
+ * not exist is not.
+ */
+function describeAlternatives(errors, unionInstancePath) {
+    const own = errors.filter((e) => (e.instancePath || "") === unionInstancePath);
+    const phrases = [];
+    for (const e of own) {
+        if (e.keyword === "required")
+            phrases.push(`one with '${e.params?.missingProperty}'`);
+        else if (e.keyword === "type")
+            phrases.push(`a ${e.params?.type}`);
+        else if (e.keyword === "enum") {
+            phrases.push(`one of ${e.params?.allowedValues?.join(" | ")}`);
+        }
+    }
+    return phrases.length > 0 ? phrases : ["another shape"];
+}
+/** Is this branch a plausible reading of the value — does it accept the value's
+ *  shape at the union node itself, and only disagree further in? */
+function isPlausible(errors, unionInstancePath) {
+    return !errors.some((e) => (e.instancePath || "") === unionInstancePath && SHAPE_KEYWORDS.has(e.keyword ?? ""));
+}
+function isUnder(child, parent) {
+    return parent === "" ? child !== "" : child.startsWith(parent + "/");
+}
+/** The value path one level up, or undefined at the root. `""` is the root, so
+ *  a non-empty path with no separator has the root as its parent. */
+function parentPath(path) {
+    if (path === "")
+        return undefined;
+    const cut = path.lastIndexOf("/");
+    return cut <= 0 ? "" : path.slice(0, cut);
+}
+/**
+ * Replace each failing union with the errors of the branch the author plainly
+ * meant, recursively, outside in.
+ *
+ * Attribution runs to the DEEPEST occurrence that could own an error, which is
+ * what keeps a container's own complaint apart from its child's when both carry
+ * the same `schemaPath`. An occurrence reached through a branch becomes a
+ * candidate branch of its own — it raised nothing at the parent's node, so it is
+ * plausible exactly when the value really did take that shape and fail further
+ * in, and reducing it recursively is what stops an inner union's alternatives
+ * from surviving inside the outer one's selection.
+ */
+export function reduceSchemaErrors(errors) {
+    if (!errors || errors.length === 0)
+        return [];
+    const occurrences = errors
+        .filter((e) => UNION_KEYWORDS.has(e.keyword ?? "") && typeof e.schemaPath === "string")
+        .map((e) => ({
+        error: e,
+        schemaPath: e.schemaPath,
+        instancePath: e.instancePath || "",
+        owned: [],
+        children: [],
+    }));
+    if (occurrences.length === 0)
+        return errors;
+    // The VALUE NODE is the claim, not the schemaPath. A branch written as a
+    // `$ref` is reported by AJV under the TARGET's schemaPath — and AJV inlines
+    // some of them, reporting several branches under one identical path — so
+    // nothing in such an error points back at the union that dispatched to it. A
+    // large union is written exactly that way, a branch per `$defs` entry, so
+    // claiming by schemaPath alone would leave the biggest unions unreduced.
+    //
+    // Indexed by instancePath rather than scanned: an error is claimed by the
+    // DEEPEST occurrence enclosing it, which is found by walking that error's own
+    // path upwards — bounded by the path's depth instead of by the number of
+    // unions. The scan this replaced was O(errors × occurrences), and both grow
+    // with nesting depth on a recursive shape, on a path the editor runs per
+    // keystroke.
+    const byPath = new Map();
+    const isOccurrence = new Set();
+    for (const o of occurrences) {
+        isOccurrence.add(o.error);
+        // Several unions can occur at ONE value node (a union inside a union
+        // branch); the first is kept, and the rest nest under it below.
+        if (!byPath.has(o.instancePath))
+            byPath.set(o.instancePath, o);
+    }
+    /** The nearest occurrence at or above `path`, excluding `path` itself when
+     *  `strict` — which is how an occurrence finds its parent rather than itself. */
+    const enclosing = (path, strict) => {
+        let current = strict ? parentPath(path) : path;
+        while (current !== undefined) {
+            const hit = byPath.get(current);
+            if (hit)
+                return hit;
+            current = parentPath(current);
+        }
+        return undefined;
+    };
+    const owner = new Map();
+    for (const err of errors) {
+        if (isOccurrence.has(err))
+            continue;
+        const best = enclosing(err.instancePath || "", false);
+        if (best) {
+            best.owned.push(err);
+            owner.set(err, best);
+        }
+    }
+    // Nest occurrences the same way: an occurrence deeper in the value was reached
+    // through some branch of the nearest one enclosing it.
+    const roots = [];
+    for (const o of occurrences) {
+        const parent = o === byPath.get(o.instancePath)
+            ? enclosing(o.instancePath, true)
+            : byPath.get(o.instancePath);
+        if (parent && parent !== o)
+            parent.children.push(o);
+        else
+            roots.push(o);
+    }
+    const replaced = new Map();
+    for (const root of roots)
+        replaced.set(root.error, resolveOccurrence(root));
+    const out = [];
+    for (const err of errors) {
+        const replacement = replaced.get(err);
+        if (replacement) {
+            out.push(...replacement);
+            continue;
+        }
+        // Everything an occurrence owns is spoken for by whichever branch survived,
+        // and a nested occurrence is carried inside its parent's selection.
+        if (owner.has(err))
+            continue;
+        if (occurrences.some((o) => o.error === err))
+            continue;
+        out.push(err);
+    }
+    return out;
+}
+/** Groups one union's complaints into candidate readings of the value.
+ *
+ *  The branch INDEX is used wherever the error carries it. It does not when the
+ *  branch is a `$ref` — AJV reports under the target's schemaPath — so the
+ *  fallback groups by the VALUE NODE each complaint is about: everything said
+ *  about the union node itself is one candidate (those are the branches that
+ *  rejected the value's shape outright), and each child node complained about is
+ *  its own. That is the same question asked of the data instead of the schema,
+ *  and it is what the ordering below actually reads. */
+function groupCandidates(occurrence) {
+    const byIndex = new Map();
+    const byNode = new Map();
+    for (const err of occurrence.owned) {
+        const index = branchIndexUnder(occurrence.schemaPath, err.schemaPath);
+        const bucket = index === undefined
+            ? mapBucket(byNode, childSegment(err.instancePath || "", occurrence.instancePath))
+            : mapBucket(byIndex, index);
+        bucket.push(err);
+    }
+    return [...byIndex]
+        .map(([index, errs]) => ({ index, errors: errs, nested: false }))
+        .concat([...byNode].map(([, errs]) => ({ index: Number.MAX_SAFE_INTEGER, errors: errs, nested: false })))
+        .concat(occurrence.children.map((child) => ({
+        index: Number.POSITIVE_INFINITY,
+        errors: resolveOccurrence(child),
+        nested: true,
+    })));
+}
+function mapBucket(map, key) {
+    const existing = map.get(key);
+    if (existing)
+        return existing;
+    const created = [];
+    map.set(key, created);
+    return created;
+}
+/** The first value-path segment below `parent`, or "" for the node itself. */
+function childSegment(instancePath, parent) {
+    if (!isUnder(instancePath, parent))
+        return "";
+    const rest = instancePath.slice(parent.length + 1);
+    const slash = rest.indexOf("/");
+    return slash === -1 ? rest : rest.slice(0, slash);
+}
+function resolveOccurrence(occurrence) {
+    const candidates = groupCandidates(occurrence);
+    // `oneOf` matching SEVERAL branches emits the union error with no branch
+    // errors at all — nothing was rejected, so there is no branch to select.
+    if (candidates.length === 0)
+        return [occurrence.error];
+    const plausible = candidates.filter((c) => c.nested || isPlausible(c.errors, occurrence.instancePath));
+    if (plausible.length === 0) {
+        return [alternativesError(candidates, occurrence)];
+    }
+    // Deepest agreement first — a branch that matched further into the value is
+    // the one the author was writing — then the fewest complaints, then the
+    // declaration order, so the choice is stable.
+    plausible.sort((a, b) => {
+        const depth = maxDepth(b.errors) - maxDepth(a.errors);
+        if (depth !== 0)
+            return depth;
+        if (a.errors.length !== b.errors.length)
+            return a.errors.length - b.errors.length;
+        return a.index - b.index;
+    });
+    const winner = plausible[0];
+    return winner.nested ? winner.errors : reduceSchemaErrors(winner.errors);
+}
+function maxDepth(errors) {
+    let max = 0;
+    for (const e of errors)
+        max = Math.max(max, instanceDepth(e.instancePath));
+    return max;
+}
+/** One error anchored at the union node, listing what could have gone there.
+ *  The honest fallback: a confident wrong message is worse than the
+ *  concatenation this replaces, so when no branch is a plausible reading the
+ *  reader is told what the alternatives are rather than shown one branch's
+ *  complaints as if it were the intended one. */
+function alternativesError(candidates, occurrence) {
+    const seen = new Set();
+    const described = [];
+    for (const text of describeAlternatives(candidates.flatMap((c) => c.errors), occurrence.instancePath)) {
+        if (seen.has(text))
+            continue;
+        seen.add(text);
+        described.push(text);
+    }
+    return {
+        ...occurrence.error,
+        instancePath: occurrence.instancePath,
+        message: `matches no alternative — expected ${described.join(", or ")}`,
+    };
+}
+/* --------------------------------------------------------------- rendering */
+/** Converts an AJV error to a dotted path compatible with PositionIndex keys.
+ *  e.g. instancePath "/config/routes/0/handler" → "config.routes[0].handler"
+ *  For "required" keyword errors, appends the missing property to the parent path. */
+export function ajvErrorToPath(err) {
+    const instancePath = err.instancePath ?? "";
+    const parts = instancePath.split("/").filter((p) => p !== "");
+    let result = "";
+    for (const part of parts) {
+        if (/^\d+$/.test(part))
+            result += `[${part}]`;
+        else
+            result += result ? `.${part}` : part;
+    }
+    if (err.keyword === "required" && err.params?.missingProperty) {
+        const missing = err.params.missingProperty;
+        result += result ? `.${missing}` : missing;
+    }
+    return result;
+}
+/** Reduced, path-anchored issues — what a diagnostic list is built from. */
+export function schemaIssues(errors) {
+    return reduceSchemaErrors(errors).map((err) => ({
+        message: formatSingleError(err),
+        path: ajvErrorToPath(err),
+    }));
+}
+/** Reduced, rendered as one sentence — what a thrown runtime error carries. */
+export function formatAjvErrors(errors) {
+    const reduced = reduceSchemaErrors(errors);
+    if (reduced.length === 0)
+        return "Unknown schema error";
+    return reduced.map(formatSingleError).join("; ");
+}

package/dist/telo-version.d.ts

@@ -1,3 +1,3 @@
 /** The surface generation this analyzer implements. */
-export declare const TELO_SURFACE_VERSION = "0.80.0";
+export declare const TELO_SURFACE_VERSION = "0.82.0";
 //# sourceMappingURL=telo-version.d.ts.map

package/dist/telo-version.js

@@ -5,4 +5,4 @@
 // its release identity, this is the scale a module's `requires.telo` range is
 // written against, and every kernel in every language reports the same scale.
 /** The surface generation this analyzer implements. */
-export const TELO_SURFACE_VERSION = "0.80.0";
+export const TELO_SURFACE_VERSION = "0.82.0";

package/dist/validate-nested-inline.d.ts

@@ -1,4 +1,6 @@
 import type { ResourceManifest } from "@telorun/sdk";
+import type { ExternalSchemaResolver } from "./schema-compat.js";
+import type { SchemaIssue } from "./schema-error-report.js";
 import { type AnalysisDiagnostic } from "./types.js";
 /** Minimal view of a definition needed to validate an inline resource's config. */
 export interface InlineDefinitionLookup {
@@ -6,6 +8,21 @@ export interface InlineDefinitionLookup {
         schema?: Record<string, any>;
     } | undefined;
 }
+/**
+ * The validator this pass checks an inline resource's config with, and the
+ * resolver that lets both it and the stand-in walk see through a named shape.
+ *
+ * Passed in rather than reached for: the module-level AJV this used has no
+ * registered shapes, so a kind whose `schema:` references one compiled nowhere
+ * and every inline declaration of it was silently unchecked — while the
+ * identical resource written standalone was checked, and the kernel rejected
+ * both at boot. Two validators answering one question is what allowed that, so
+ * the caller supplies the one that holds the shapes.
+ */
+export interface InlineConfigValidator {
+    validate(data: unknown, schema: Record<string, any>): SchemaIssue[];
+    external: ExternalSchemaResolver;
+}
 /**
  * Validates inline resources nested inside a resource body against their kind's
  * config schema. The per-resource walk in `analyze()` validates a resource's
@@ -28,5 +45,9 @@ export interface InlineDefinitionLookup {
  */
 export declare function validateNestedInlineResources(manifest: ResourceManifest, rootSchema: Record<string, any>, lookupDefinition: InlineDefinitionLookup, 
 /** Needed to resolve a `telo#Type` field a value slot is validated against. */
-allManifests?: Record<string, any>[]): AnalysisDiagnostic[];
+allManifests: Record<string, any>[], 
+/** REQUIRED, and deliberately not defaulted: a default would be a second
+ *  validator answering the same question, and omitting it would silently stop
+ *  checking rather than fail. */
+validator: InlineConfigValidator): AnalysisDiagnostic[];
 //# sourceMappingURL=validate-nested-inline.d.ts.map

package/dist/validate-nested-inline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-nested-inline.d.ts","sourceRoot":"","sources":["../src/validate-nested-inline.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAQrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAKzE,mFAAmF;AACnF,MAAM,WAAW,sBAAsB;IACrC,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;KAAE,GAAG,SAAS,CAAC;CAC9D;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,gBAAgB,EAC1B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,gBAAgB,EAAE,sBAAsB;AACxC,+EAA+E;AAC/E,YAAY,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAO,GACvC,kBAAkB,EAAE,CA6HtB"}
+{"version":3,"file":"validate-nested-inline.d.ts","sourceRoot":"","sources":["../src/validate-nested-inline.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAEjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAKzE,mFAAmF;AACnF,MAAM,WAAW,sBAAsB;IACrC,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;KAAE,GAAG,SAAS,CAAC;CAC9D;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,WAAW,EAAE,CAAC;IACpE,QAAQ,EAAE,sBAAsB,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,gBAAgB,EAC1B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,gBAAgB,EAAE,sBAAsB;AACxC,+EAA+E;AAC/E,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE;AACnC;;iCAEiC;AACjC,SAAS,EAAE,qBAAqB,GAC/B,kBAAkB,EAAE,CAiItB"}

package/dist/validate-nested-inline.js

@@ -1,5 +1,5 @@
 import { collectRefs, isInlineResource } from "./reference-field-map.js";
-import { collectProperties, resolveRef, substituteCelFields, validateAgainstSchema, } from "./schema-compat.js";
+import { collectProperties, resolveRef, substituteCelFields } from "./schema-compat.js";
 import { DiagnosticSeverity } from "./types.js";
 import { collectValueSchemaIssues } from "./validate-value-schema.js";
 const SOURCE = "telo-analyzer";
@@ -25,7 +25,11 @@ const SOURCE = "telo-analyzer";
  */
 export function validateNestedInlineResources(manifest, rootSchema, lookupDefinition, 
 /** Needed to resolve a `telo#Type` field a value slot is validated against. */
-allManifests = []) {
+allManifests, 
+/** REQUIRED, and deliberately not defaulted: a default would be a second
+ *  validator answering the same question, and omitting it would silently stop
+ *  checking rather than fail. */
+validator) {
     const diagnostics = [];
     const resource = { kind: manifest.kind, name: manifest.metadata?.name };
     const filePath = manifest.metadata?.source;
@@ -70,14 +74,18 @@ allManifests = []) {
             ? inline.metadata
             : {};
         const data = { ...inline, metadata: { name: "__inline__", ...existingMeta } };
-        const substituted = substituteCelFields(data, effectiveSchema, effectiveSchema);
-        // The same two passes the top-level resource loop runs, so a kind's
-        // guarantees don't depend on whether the author wrote it standalone or
-        // inline (under a step's `invoke:`, or in a `with:` scope). `data` carries
-        // the synthesized metadata; `x-telo-value-schema-from` reads sibling fields
-        // off the resource, which are present either way.
+        const substituted = substituteCelFields(data, effectiveSchema, effectiveSchema, {
+            external: validator.external,
+        });
+        // The same two passes the top-level resource loop runs, on the same
+        // validator, so a kind's guarantees don't depend on whether the author wrote
+        // it standalone or inline (under a step's `invoke:`, or in a `with:` scope)
+        // — and CLAUDE.md mandates inline for a single-use resource, so inline is
+        // the common shape rather than the exception. `data` carries the synthesized
+        // metadata; `x-telo-value-schema-from` reads sibling fields off the
+        // resource, which are present either way.
         const inlineIssues = [
-            ...validateAgainstSchema(substituted, effectiveSchema),
+            ...validator.validate(substituted, effectiveSchema),
             ...collectValueSchemaIssues(data, schema, allManifests),
         ];
         for (const issue of inlineIssues) {

package/dist/validate-step-inputs.js

@@ -1,5 +1,5 @@
 import { resolveContract } from "./invocation-contract.js";
-import { checkSchemaCompatibility, navigateSchemaToExprPath, substituteCelFields, validateAgainstSchema, } from "./schema-compat.js";
+import { checkSchemaCompatibility, navigateSchemaToExprPath, substituteCelFields, } from "./schema-compat.js";
 import { plainChainOf } from "@telorun/templating";
 import { isLiveSlot, valueTypeOf } from "@telorun/sdk";
 import { manifestFragmentOf } from "./manifest-schemas.js";
@@ -166,7 +166,15 @@ function checkCallSite(site, ctx) {
             // findings (missing required, unknown property) are located at the
             // container and survive the filter.
             const celPaths = new Set();
-            const substituted = substituteCelFields(values, contract.schema, undefined, (p) => celPaths.add(p));
+            const substituted = substituteCelFields(values, contract.schema, undefined, {
+                onSubstitute: (p) => celPaths.add(p),
+                // A contract may name a shape declared elsewhere. Both halves need the
+                // resolver or they disagree about the same slot: the stand-in walk hands
+                // its expressions a typeless value, and the check below compiles nothing
+                // at all — so a step's arguments went unchecked against exactly the
+                // contracts that describe them most precisely.
+                external: (ref) => defs.schemaForId(ref),
+            });
             // The type-argument check, at the one site where a produced value's schema
             // meets a consuming slot's. A CEL leaf's placeholder says nothing about
             // what the expression yields, so AJV above is silent here by design — and
@@ -238,7 +246,7 @@ function checkCallSite(site, ctx) {
                     });
                 }
             }
-            for (const issue of validateAgainstSchema(substituted, contract.schema)) {
+            for (const issue of defs.validateResourceConfig(substituted, contract.schema)) {
                 if (celPaths.has(issue.path))
                     continue;
                 // A missing-required issue names the property that ISN'T there, so

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.64.0",
+  "version": "0.65.0",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",
@@ -49,7 +49,7 @@
     "@types/node": "^20.0.0",
     "typescript": "^5.0.0",
     "vitest": "^2.1.8",
-    "@telorun/sdk": "0.80.0"
+    "@telorun/sdk": "0.82.0"
   },
   "peerDependencies": {
     "@telorun/sdk": "*"

package/src/analyzer.ts

@@ -1476,6 +1476,17 @@ export class StaticAnalyzer {
       diagnostics.push(...validateIncludePlacement(allManifests));
     }
     resolveSchemaTypeRefs(allManifests, aliases, aliasesByModule);
+    // ...and over the manifests the DEFINITION REGISTRY holds, which are not
+    // these. `normalizeInlineResources` deep-clones — that clone is the
+    // analyzer's immutability boundary — while `defs.register` ran before it, on
+    // the originals. So a kind whose `schema:` references a named shape kept the
+    // authored `telo://Self/<Type>` spelling everywhere the registry is read,
+    // which is where a resource's configuration is validated: the schema failed
+    // to compile, the failure was swallowed, and `telo check` reported nothing
+    // about a resource the kernel then rejected at boot. The pass is idempotent
+    // — a canonical id parses as no authority and is left alone — so running it
+    // over both is the whole repair.
+    resolveSchemaTypeRefs(manifests, aliases, aliasesByModule);
 
     // Trusted-input fast path: when the caller has already attested that
     // this exact manifest set passes analysis (e.g. via the kernel's
@@ -1765,8 +1776,13 @@ export class StaticAnalyzer {
         for (const slot of collectCelValueSlots(m, schema, "")) {
           celReturnSlots.push({ manifest: m, resource, filePath, ...slot });
         }
-        // Phase 2+3: AJV on substituted data — CEL fields replaced with typed placeholders
-        const ajvIssues = validateAgainstSchema(substituteCelFields(m, schema), schema);
+        // Phase 2+3: AJV on substituted data — CEL fields replaced with typed
+        // placeholders. Through the REGISTRY, so a kind whose schema references
+        // a shape declared elsewhere is checked on the instance that holds it.
+        const ajvIssues = defs.validateResourceConfig(
+          substituteCelFields(m, schema, undefined, { external: (ref) => defs.schemaForId(ref) }),
+          schema,
+        );
         // Phase 4: value slots that must satisfy a type declared elsewhere on
         // the resource (`x-telo-value-schema-from`) — e.g. every row of a
         // decision table against its declared `outputType`, so a mistyped branch
@@ -1879,6 +1895,10 @@ export class StaticAnalyzer {
               return viaRoot ? defs.resolve(viaRoot) : undefined;
             },
             allManifests as Record<string, any>[],
+            {
+              validate: (data, target) => defs.validateResourceConfig(data, target),
+              external: (ref) => defs.schemaForId(ref),
+            },
           ),
         );
       }