@telorun/analyzer 0.64.0 → 0.66.0

package/dist/cel-scope.js

@@ -293,10 +293,16 @@ export class CelScopeResolver {
     enterResource(m, definition) {
         const { allManifests, defs, aliases, scopes } = this.inputs;
         this.invocationContext = m.metadata?.xTeloInvocationContext;
-        this.stepContext = definition?.schema
-            ? buildStepContextSchema(m, definition.schema, allManifests, defs, aliases, scopes)
+        // The INHERITANCE-RESOLVED schema at both sites, for the reason the CEL
+        // context regions use it: an `extends` child is authored against
+        // merge(parent, own), so a step body or a `catch:` region the parent
+        // declares is in force on the child. All three consumers share one memo so
+        // they cannot come to disagree about which schema a kind means.
+        const authorSchema = defs.effectiveSchemaOf(definition);
+        this.stepContext = authorSchema
+            ? buildStepContextSchema(m, authorSchema, allManifests, defs, aliases, scopes)
             : undefined;
-        this.errorScopes = collectErrorContextScopes(definition?.schema);
+        this.errorScopes = collectErrorContextScopes(authorSchema);
     }
     /**
      * What the expression at `site` is typed against.
@@ -337,7 +343,21 @@ export class CelScopeResolver {
             const base = matched ?? { type: "object", properties: {}, additionalProperties: true };
             matched = {
                 ...base,
-                properties: { ...(base.properties ?? {}), steps: this.stepContext },
+                properties: {
+                    // `inputs` is in scope beside `steps` wherever a step body runs — the
+                    // step engine evaluates a step against the enclosing kind's own
+                    // arguments, which is what `steps[0].inputs.x` reads. Modelled here
+                    // because it was modelled NOWHERE: the step context is open, so a
+                    // chain through it was never checked and the name's absence went
+                    // unnoticed until something asked whether the root existed.
+                    //
+                    // OPEN, not typed from the kind's `inputType`: closing it would newly
+                    // reject every read of an argument the contract does not spell out,
+                    // which is a separate decision from knowing the name is legal.
+                    inputs: { type: "object", additionalProperties: true },
+                    ...(base.properties ?? {}),
+                    steps: this.stepContext,
+                },
             };
         }
         // `error` is only in scope inside an error-bearing branch (e.g. a

package/dist/definition-registry.d.ts

@@ -1,7 +1,7 @@
 import type { ResourceDefinition, ResourceManifest } from "@telorun/sdk";
 import type { AliasResolver } from "./alias-resolver.js";
 import { type ReferenceFieldMap } from "./reference-field-map.js";
-/** Pure kind → ResourceDefinition map. No controller loading, no lifecycle. */
+import { type SchemaIssue } from "./schema-error-report.js";
 export declare class DefinitionRegistry {
     constructor();
     /** Per-instance AJV for cross-module $ref resolution. Isolated so each registry
@@ -9,6 +9,7 @@ export declare class DefinitionRegistry {
      *  across analyze() calls and no unbounded growth across the process lifetime. */
     private readonly ajv;
     private readonly registeredSchemaIds;
+    private readonly compiledValidators;
     /** The subset of `registeredSchemaIds` claimed by a kind's schema. Kinds and
      *  named `Telo.Type`s share one `telo://<module>/<Name>` id space, so this is
      *  what lets a colliding type name be reported instead of silently dropped. */
@@ -17,6 +18,9 @@ export declare class DefinitionRegistry {
     private readonly fieldMaps;
     /** Reverse inheritance index: parent kind → direct child kinds. */
     private readonly extendedBy;
+    /** Memoized inheritance-resolved schemas. `null` records "resolved to
+     *  nothing", so a kind with no schema is not re-walked on every resource. */
+    private readonly effectiveSchemas;
     /** DEPRECATED module identity table: identity string → canonical module name
      *  ("std/pipeline" → "pipeline"). Serves only the legacy
      *  `<namespace>/<module>#<Kind>` form of `x-telo-ref`, kept resolvable for
@@ -77,12 +81,28 @@ export declare class DefinitionRegistry {
      *  sanctioned way to reuse one, so a comparator that cannot follow the
      *  reference judges two opaque nodes and learns nothing. */
     schemaForId(id: string): Record<string, any> | undefined;
-    /** Validates data against a schema using this registry's AJV instance, which has all
-     *  registered definition schemas loaded — enabling cross-module $ref resolution.
-     *  A compile failure returns `[]` here; it is surfaced loudly (once, on the
-     *  owning definition) by `schemaCompileError` via the analyzer's
-     *  definition-schema compile check, so resources are never silently skipped. */
+    /**
+     * Validates a resource's configuration against its kind's schema, with the
+     * offending field's path — what a `SCHEMA_VIOLATION` diagnostic is built from.
+     *
+     * On THIS registry's AJV, which is the point: it holds every registered
+     * definition schema and every named `Telo.Type`, so a kind whose schema
+     * references a shape declared elsewhere is checked rather than skipped. The
+     * module-level instance this used to run on had none of them registered, so
+     * such a schema failed to compile and the failure was swallowed — a resource
+     * could be arbitrarily wrong and `telo check` reported nothing, while the
+     * kernel (whose validator does resolve the reference) rejected it at boot.
+     * Two AJVs answering one question is what made that possible; there is now
+     * one, and it is the same one `schemaCompileError` reports through.
+     */
     validateWithRefs(data: unknown, schema: Record<string, any>): string[];
+    /** {@link validateWithRefs}, with the path each issue is anchored at. */
+    validateResourceConfig(data: unknown, schema: Record<string, any>): SchemaIssue[];
+    /** Memoized per schema OBJECT — the analyzer validates every resource of a
+     *  kind against the same one, and this runs at keystroke time in an editor.
+     *  A schema AJV refuses compiles to `undefined`; that is reported once,
+     *  anchored on the owning definition, by `schemaCompileError`. */
+    private compiledFor;
     /** Returns the AJV compile error for `schema`, or `undefined` when it compiles.
      *  Compiles on this registry's instance, which has every loaded module schema
      *  plus the manifest root registered, so local `#/$defs`, `telo://manifest`,
@@ -114,6 +134,27 @@ export declare class DefinitionRegistry {
      *  never registered. */
     resolveRef(xTeloRef: string): string | undefined;
     resolve(kind: string): ResourceDefinition | undefined;
+    /**
+     * The kind's AUTHOR-FACING schema — its own merged with everything it
+     * inherits along `extends` — memoized per kind.
+     *
+     * This is what every consumer reading a kind's schema to interpret an
+     * INSTANCE must use, because that is the schema the instance was authored
+     * against and the one the kernel stamps at definition registration. Reading
+     * `resolve(kind).schema` instead sees only what the leaf declared, so an
+     * annotation on a parent — a CEL context region, a step body, an error
+     * context — is invisible on every child, silently and per consumer. Sharing
+     * one memo is what keeps those consumers from drifting apart.
+     *
+     * Lazy for the same reason `getFieldMap` is: a child registered before its
+     * parent still sees the inherited half once both are present.
+     */
+    effectiveSchema(kind: string): Record<string, unknown> | undefined;
+    /** The effective schema for a definition, by the kind it is registered under.
+     *  Falls back to the definition's own schema when it is not in this registry
+     *  (a synthesized or not-yet-registered kind), which is the pre-inheritance
+     *  behaviour and the safe direction: it types less, never wrongly. */
+    effectiveSchemaOf(definition: ResourceDefinition | undefined): Record<string, unknown> | undefined;
     /** Returns the reference field map for the given kind, computed lazily from the
      *  kind's AUTHOR-FACING (inheritance-resolved) schema and memoized. Lazy so a
      *  child registered before its parent still sees the parent's inherited ref

package/dist/definition-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"definition-registry.d.ts","sourceRoot":"","sources":["../src/definition-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAIlC,+EAA+E;AAC/E,qBAAa,kBAAkB;;IAK7B;;sFAEkF;IAClF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IACzD;;mFAE+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IAEzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyC;IAC9D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D;;;;wEAIoE;IACpE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IAEzD,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI;IAoC9C,OAAO,CAAC,aAAa;IASrB;;;;;;;;;;;;;2FAauF;IACvF,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAK1E;;;;;;;;;;gFAU4E;IAC5E,uBAAuB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO;IAQzE;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,YAAY;IASpB;uFACmF;IACnF,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAIhC;;;gEAG4D;IAC5D,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS;IAMxD;;;;oFAIgF;IAChF,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE;IAWtE;;;;;;iCAM6B;IAC7B,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,GAAG,SAAS;IASnE;;;;4EAIwE;IACxE,OAAO,CAAC,iBAAiB;IAqBzB;;;;;;;;;;;;;;4BAcwB;IACxB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAShD,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAIrD;;;uCAGmC;IACnC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAWxD,gGAAgG;IAChG,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,GACvD,iBAAiB,GAAG,SAAS;IAOhC;;;;;;;;qFAQiF;IACjF,2BAA2B,CACzB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC1C,iBAAiB,GAAG,SAAS;IAkChC;;;;;;;;;;;;;OAaG;IACH,qBAAqB,CACnB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,aAAa,GACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS;IAsBlC,OAAO,CAAC,uBAAuB;IAU/B;;qEAEiE;IACjE,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAgBxD,KAAK,IAAI,MAAM,EAAE;CAGlB"}
+{"version":3,"file":"definition-registry.d.ts","sourceRoot":"","sources":["../src/definition-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,0BAA0B,CAAC;AAOlC,qBAAa,kBAAkB;;IAK7B;;sFAEkF;IAClF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IACzD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAyD;IAC5F;;mFAE+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IAEzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyC;IAC9D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D;iFAC6E;IAC7E,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqD;IACtF;;;;wEAIoE;IACpE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IAEzD,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI;IAqC9C,OAAO,CAAC,aAAa;IASrB;;;;;;;;;;;;;2FAauF;IACvF,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAK1E;;;;;;;;;;gFAU4E;IAC5E,uBAAuB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO;IAQzE;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,YAAY;IASpB;uFACmF;IACnF,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAIhC;;;gEAG4D;IAC5D,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS;IAMxD;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE;IAMtE,yEAAyE;IACzE,sBAAsB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,WAAW,EAAE;IAMjF;;;sEAGkE;IAClE,OAAO,CAAC,WAAW;IAYnB;;;;;;iCAM6B;IAC7B,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,GAAG,SAAS;IASnE;;;;4EAIwE;IACxE,OAAO,CAAC,iBAAiB;IAqBzB;;;;;;;;;;;;;;4BAcwB;IACxB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAShD,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAIrD;;;;;;;;;;;;;;OAcG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAYlE;;;0EAGsE;IACtE,iBAAiB,CAAC,UAAU,EAAE,kBAAkB,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAOlG;;;uCAGmC;IACnC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAWxD,gGAAgG;IAChG,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,GACvD,iBAAiB,GAAG,SAAS;IAOhC;;;;;;;;qFAQiF;IACjF,2BAA2B,CACzB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC1C,iBAAiB,GAAG,SAAS;IAkChC;;;;;;;;;;;;;OAaG;IACH,qBAAqB,CACnB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,aAAa,GACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS;IAsBlC,OAAO,CAAC,uBAAuB;IAU/B;;qEAEiE;IACjE,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAgBxD,KAAK,IAAI,MAAM,EAAE;CAGlB"}

package/dist/definition-registry.js

@@ -1,9 +1,9 @@
 import { canonicalTypeSchemaId } from "@telorun/sdk";
 import { KERNEL_BUILTINS } from "./builtins.js";
 import { buildFieldMapAtPath, buildReferenceFieldMap, isSchemaFromEntry, } from "./reference-field-map.js";
-import { createAjv, formatSingleError, navigateJsonPointer } from "./schema-compat.js";
+import { createAjv, navigateJsonPointer } from "./schema-compat.js";
+import { formatSingleError, reduceSchemaErrors, schemaIssues, } from "./schema-error-report.js";
 import { effectiveAuthorSchema } from "./extends-resolution.js";
-/** Pure kind → ResourceDefinition map. No controller loading, no lifecycle. */
 export class DefinitionRegistry {
     constructor() {
         for (const def of KERNEL_BUILTINS)
@@ -14,6 +14,7 @@ export class DefinitionRegistry {
      *  across analyze() calls and no unbounded growth across the process lifetime. */
     ajv = createAjv();
     registeredSchemaIds = new Set();
+    compiledValidators = new WeakMap();
     /** The subset of `registeredSchemaIds` claimed by a kind's schema. Kinds and
      *  named `Telo.Type`s share one `telo://<module>/<Name>` id space, so this is
      *  what lets a colliding type name be reported instead of silently dropped. */
@@ -22,6 +23,9 @@ export class DefinitionRegistry {
     fieldMaps = new Map();
     /** Reverse inheritance index: parent kind → direct child kinds. */
     extendedBy = new Map();
+    /** Memoized inheritance-resolved schemas. `null` records "resolved to
+     *  nothing", so a kind with no schema is not re-walked on every resource. */
+    effectiveSchemas = new Map();
     /** DEPRECATED module identity table: identity string → canonical module name
      *  ("std/pipeline" → "pipeline"). Serves only the legacy
      *  `<namespace>/<module>#<Kind>` form of `x-telo-ref`, kept resolvable for
@@ -37,6 +41,7 @@ export class DefinitionRegistry {
         // so any already-computed map recomputes against the now-larger def set; the
         // maps rebuild lazily on first `getFieldMap` (after all defs are registered).
         this.fieldMaps.clear();
+        this.effectiveSchemas.clear();
         // `capability` populates extendedBy for backward-compat with the legacy pattern where
         // a concrete definition overloaded `capability: <AbstractKind>` to mean "implements
         // this abstract." The canonical pattern is `extends` (below). Both populate the index,
@@ -152,22 +157,49 @@ export class DefinitionRegistry {
         const schema = compiled?.schema;
         return schema && typeof schema === "object" ? schema : undefined;
     }
-    /** Validates data against a schema using this registry's AJV instance, which has all
-     *  registered definition schemas loaded — enabling cross-module $ref resolution.
-     *  A compile failure returns `[]` here; it is surfaced loudly (once, on the
-     *  owning definition) by `schemaCompileError` via the analyzer's
-     *  definition-schema compile check, so resources are never silently skipped. */
+    /**
+     * Validates a resource's configuration against its kind's schema, with the
+     * offending field's path — what a `SCHEMA_VIOLATION` diagnostic is built from.
+     *
+     * On THIS registry's AJV, which is the point: it holds every registered
+     * definition schema and every named `Telo.Type`, so a kind whose schema
+     * references a shape declared elsewhere is checked rather than skipped. The
+     * module-level instance this used to run on had none of them registered, so
+     * such a schema failed to compile and the failure was swallowed — a resource
+     * could be arbitrarily wrong and `telo check` reported nothing, while the
+     * kernel (whose validator does resolve the reference) rejected it at boot.
+     * Two AJVs answering one question is what made that possible; there is now
+     * one, and it is the same one `schemaCompileError` reports through.
+     */
     validateWithRefs(data, schema) {
-        let validate;
+        const validate = this.compiledFor(schema);
+        if (!validate || validate(data))
+            return [];
+        return reduceSchemaErrors(validate.errors).map(formatSingleError);
+    }
+    /** {@link validateWithRefs}, with the path each issue is anchored at. */
+    validateResourceConfig(data, schema) {
+        const validate = this.compiledFor(schema);
+        if (!validate || validate(data))
+            return [];
+        return schemaIssues(validate.errors);
+    }
+    /** Memoized per schema OBJECT — the analyzer validates every resource of a
+     *  kind against the same one, and this runs at keystroke time in an editor.
+     *  A schema AJV refuses compiles to `undefined`; that is reported once,
+     *  anchored on the owning definition, by `schemaCompileError`. */
+    compiledFor(schema) {
+        const cached = this.compiledValidators.get(schema);
+        if (cached)
+            return cached;
         try {
-            validate = this.ajv.compile(schema);
+            const validate = this.ajv.compile(schema);
+            this.compiledValidators.set(schema, validate);
+            return validate;
         }
         catch {
-            return [];
+            return undefined;
         }
-        if (validate(data))
-            return [];
-        return (validate.errors ?? []).map(formatSingleError);
     }
     /** Returns the AJV compile error for `schema`, or `undefined` when it compiles.
      *  Compiles on this registry's instance, which has every loaded module schema
@@ -235,6 +267,43 @@ export class DefinitionRegistry {
     resolve(kind) {
         return this.defs.get(kind);
     }
+    /**
+     * The kind's AUTHOR-FACING schema — its own merged with everything it
+     * inherits along `extends` — memoized per kind.
+     *
+     * This is what every consumer reading a kind's schema to interpret an
+     * INSTANCE must use, because that is the schema the instance was authored
+     * against and the one the kernel stamps at definition registration. Reading
+     * `resolve(kind).schema` instead sees only what the leaf declared, so an
+     * annotation on a parent — a CEL context region, a step body, an error
+     * context — is invisible on every child, silently and per consumer. Sharing
+     * one memo is what keeps those consumers from drifting apart.
+     *
+     * Lazy for the same reason `getFieldMap` is: a child registered before its
+     * parent still sees the inherited half once both are present.
+     */
+    effectiveSchema(kind) {
+        const cached = this.effectiveSchemas.get(kind);
+        if (cached !== undefined)
+            return cached ?? undefined;
+        const def = this.defs.get(kind);
+        if (!def)
+            return undefined;
+        const schema = effectiveAuthorSchema(def, (k) => this.resolve(k));
+        this.effectiveSchemas.set(kind, schema ?? null);
+        return schema;
+    }
+    /** The effective schema for a definition, by the kind it is registered under.
+     *  Falls back to the definition's own schema when it is not in this registry
+     *  (a synthesized or not-yet-registered kind), which is the pre-inheritance
+     *  behaviour and the safe direction: it types less, never wrongly. */
+    effectiveSchemaOf(definition) {
+        if (!definition)
+            return undefined;
+        const { name, module: mod } = definition.metadata;
+        const resolved = this.effectiveSchema(mod ? `${mod}.${name}` : name);
+        return resolved ?? definition.schema;
+    }
     /** Returns the reference field map for the given kind, computed lazily from the
      *  kind's AUTHOR-FACING (inheritance-resolved) schema and memoized. Lazy so a
      *  child registered before its parent still sees the parent's inherited ref

package/dist/eval-paths.d.ts

@@ -1,3 +1,24 @@
+/**
+ * WHERE IS CEL EVALUATED — the one reader, and the one decision built on it.
+ *
+ * Two independent ways a value is evaluated, and every consumer needs both:
+ * `x-telo-eval` names a field directly, while a REGION annotation
+ * (`x-telo-context` / `x-telo-step-context` / `x-telo-error-context`, or a step
+ * body) covers everything beneath it — which is how `Run.Choice`'s rows and an
+ * `Http.Api` route's `returns:` entries hold expressions while declaring no
+ * annotation of their own.
+ *
+ * The consumers are on both sides of the runtime: `telo check` decides whether a
+ * `!cel` here is live (`CEL_IN_NON_EVAL_FIELD`) or resolved at startup
+ * (`OBSERVED_STATE_IN_STARTUP_FIELD`), the kernel decides what to expand, and
+ * the editor decides whether to offer an expression at all. The editor's answer
+ * is a CLAIM that `telo check` will accept what it writes, so a second
+ * implementation there is a promise nothing keeps — it read `x-telo-eval` alone
+ * and left every predicate inside a region as a bare checkbox, with no way to
+ * write the expression the field exists to hold.
+ *
+ * Browser-safe: no Node built-ins.
+ */
 /**
  * The single containment rule for `x-telo-eval` paths, shared by every matcher so
  * the analyzer's coverage decision and the kernel's expansion/exclusion can't
@@ -22,4 +43,51 @@ export declare function buildEvalPaths(schema: Record<string, any>): {
     compile: string[];
     runtime: string[];
 };
+/** True when this schema node declares a CEL-bearing region. Node-level, so a
+ *  consumer holding one schema (an editor rendering one field) asks it directly
+ *  rather than deriving scopes it would then have to match against. */
+export declare function declaresCelRegion(schema: unknown): boolean;
+/**
+ * Walk a JSON Schema tree and collect the JSONPath scopes of every field that
+ * declares a CEL-bearing region (`x-telo-context` / `x-telo-step-context` /
+ * `x-telo-error-context`). Used — alongside `x-telo-eval` paths — to decide
+ * whether a `!cel` expression sits in a slot the runtime actually evaluates.
+ * Scopes use the same `$.a.b[*]` form as `extractContextsFromSchema`, matched
+ * against expression paths with `pathMatchesScope`.
+ */
+export declare function extractCelRegionScopes(schema: Record<string, any>, path?: string): string[];
+/**
+ * Returns true when a CEL expression path (from walkCelExpressions, e.g. "routes[0].inputs.q")
+ * falls within the scope of a context (e.g. "$.routes[*].inputs").
+ *
+ * The scope is matched directly (no sibling sharing): a context at "$.routes[*].inputs" only
+ * applies to expressions whose path starts with "routes[N].inputs", not to other sibling fields.
+ */
+export declare function pathMatchesScope(exprPath: string, scope: string): boolean;
+/** Every place a schema says its values are evaluated: the `x-telo-eval` paths,
+ *  by mode, plus the scopes of the regions that cover their contents. */
+export interface CelEvalSites {
+    compile: readonly string[];
+    runtime: readonly string[];
+    regions: readonly string[];
+}
+export declare const NO_CEL_EVAL_SITES: CelEvalSites;
+export declare function celEvalSites(schema: Record<string, any> | undefined): CelEvalSites;
+/** The union of several schemas' sites — a kind's own and its capability
+ *  abstract's, which is how a `Telo.Provider`'s implicit compile-eval reaches
+ *  fields the provider never annotated. */
+export declare function mergeCelEvalSites(...sites: CelEvalSites[]): CelEvalSites;
+/**
+ * Whether the value at `path` is evaluated, and when — null for a field whose
+ * value is read as a literal.
+ *
+ * `compile` wins over `runtime`, and both win over a region: a field's own
+ * annotation is more specific than the region it sits in, which is the same
+ * precedence a nested annotation has over an enclosing one. A region resolves to
+ * `runtime` because that is what a region IS — a per-invocation scope naming
+ * what its expressions can read.
+ *
+ * `path` is the `walkCelExpressions` spelling (`routes[0].returns[1].when`).
+ */
+export declare function celEvalModeAt(sites: CelEvalSites, path: string): "compile" | "runtime" | null;
 //# sourceMappingURL=eval-paths.d.ts.map

package/dist/eval-paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"eval-paths.d.ts","sourceRoot":"","sources":["../src/eval-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAKxE;AAED;+BAC+B;AAC/B,wBAAgB,cAAc,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEtF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG;IAC3D,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAcA"}
+{"version":3,"file":"eval-paths.d.ts","sourceRoot":"","sources":["../src/eval-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAKxE;AAED;+BAC+B;AAC/B,wBAAgB,cAAc,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEtF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG;IAC3D,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAcA;AAiCD;;uEAEuE;AACvE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAI1D;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,SAAM,GAAG,MAAM,EAAE,CAqBxF;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;yEACyE;AACzE,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B;AAED,eAAO,MAAM,iBAAiB,EAAE,YAAwD,CAAC;AAEzF,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,YAAY,CAIlF;AAED;;2CAE2C;AAC3C,wBAAgB,iBAAiB,CAAC,GAAG,KAAK,EAAE,YAAY,EAAE,GAAG,YAAY,CAMxE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,YAAY,EACnB,IAAI,EAAE,MAAM,GACX,SAAS,GAAG,SAAS,GAAG,IAAI,CAK9B"}

package/dist/eval-paths.js

@@ -1,3 +1,25 @@
+/**
+ * WHERE IS CEL EVALUATED — the one reader, and the one decision built on it.
+ *
+ * Two independent ways a value is evaluated, and every consumer needs both:
+ * `x-telo-eval` names a field directly, while a REGION annotation
+ * (`x-telo-context` / `x-telo-step-context` / `x-telo-error-context`, or a step
+ * body) covers everything beneath it — which is how `Run.Choice`'s rows and an
+ * `Http.Api` route's `returns:` entries hold expressions while declaring no
+ * annotation of their own.
+ *
+ * The consumers are on both sides of the runtime: `telo check` decides whether a
+ * `!cel` here is live (`CEL_IN_NON_EVAL_FIELD`) or resolved at startup
+ * (`OBSERVED_STATE_IN_STARTUP_FIELD`), the kernel decides what to expand, and
+ * the editor decides whether to offer an expression at all. The editor's answer
+ * is a CLAIM that `telo check` will accept what it writes, so a second
+ * implementation there is a promise nothing keeps — it read `x-telo-eval` alone
+ * and left every predicate inside a region as a bare checkbox, with no way to
+ * write the expression the field exists to hold.
+ *
+ * Browser-safe: no Node built-ins.
+ */
+import { isStepSlot } from "./step-slot.js";
 /**
  * The single containment rule for `x-telo-eval` paths, shared by every matcher so
  * the analyzer's coverage decision and the kernel's expansion/exclusion can't
@@ -53,3 +75,119 @@ function collectEvalPathsNode(node, path, compile, runtime) {
         }
     }
 }
+/** Schema keys that declare a CEL-bearing region: a field carrying any of these
+ *  is evaluated at runtime, so a `!cel` inside it (or a descendant) is live. A
+ *  STEP BODY is one too, and says so through the grammar its items point at
+ *  rather than through a key — {@link isStepSlot} reads either spelling. */
+const CEL_REGION_KEYS = [
+    "x-telo-context",
+    "x-telo-step-context",
+    "x-telo-error-context",
+];
+/** True when this schema node declares a CEL-bearing region. Node-level, so a
+ *  consumer holding one schema (an editor rendering one field) asks it directly
+ *  rather than deriving scopes it would then have to match against. */
+export function declaresCelRegion(schema) {
+    if (!schema || typeof schema !== "object")
+        return false;
+    const node = schema;
+    return CEL_REGION_KEYS.some((key) => node[key] !== undefined) || isStepSlot(node);
+}
+/**
+ * Walk a JSON Schema tree and collect the JSONPath scopes of every field that
+ * declares a CEL-bearing region (`x-telo-context` / `x-telo-step-context` /
+ * `x-telo-error-context`). Used — alongside `x-telo-eval` paths — to decide
+ * whether a `!cel` expression sits in a slot the runtime actually evaluates.
+ * Scopes use the same `$.a.b[*]` form as `extractContextsFromSchema`, matched
+ * against expression paths with `pathMatchesScope`.
+ */
+export function extractCelRegionScopes(schema, path = "$") {
+    if (!schema || typeof schema !== "object")
+        return [];
+    const out = [];
+    if (declaresCelRegion(schema))
+        out.push(path);
+    if (schema.properties) {
+        for (const [key, value] of Object.entries(schema.properties)) {
+            out.push(...extractCelRegionScopes(value, `${path}.${key}`));
+        }
+    }
+    if (schema.items && typeof schema.items === "object") {
+        out.push(...extractCelRegionScopes(schema.items, `${path}[*]`));
+    }
+    for (const key of ["oneOf", "anyOf", "allOf"]) {
+        if (Array.isArray(schema[key])) {
+            for (const subschema of schema[key])
+                out.push(...extractCelRegionScopes(subschema, path));
+        }
+    }
+    return out;
+}
+/**
+ * Returns true when a CEL expression path (from walkCelExpressions, e.g. "routes[0].inputs.q")
+ * falls within the scope of a context (e.g. "$.routes[*].inputs").
+ *
+ * The scope is matched directly (no sibling sharing): a context at "$.routes[*].inputs" only
+ * applies to expressions whose path starts with "routes[N].inputs", not to other sibling fields.
+ */
+export function pathMatchesScope(exprPath, scope) {
+    const stripped = scope.startsWith("$.") ? scope.slice(2) : scope;
+    if (!stripped)
+        return false;
+    // Split on wildcard array segments; each [*] must match a concrete [N] in exprPath
+    const parts = stripped.split("[*]");
+    let remaining = exprPath;
+    for (let i = 0; i < parts.length; i++) {
+        const part = parts[i];
+        if (!remaining.startsWith(part))
+            return false;
+        remaining = remaining.slice(part.length);
+        if (i < parts.length - 1) {
+            // Expect a concrete array index like [0], [12], ...
+            const m = remaining.match(/^\[\d+\]/);
+            if (!m)
+                return false;
+            remaining = remaining.slice(m[0].length);
+        }
+    }
+    // Expression must end here or continue into a child path
+    return remaining === "" || remaining[0] === "." || remaining[0] === "[";
+}
+export const NO_CEL_EVAL_SITES = { compile: [], runtime: [], regions: [] };
+export function celEvalSites(schema) {
+    if (!schema)
+        return NO_CEL_EVAL_SITES;
+    const { compile, runtime } = buildEvalPaths(schema);
+    return { compile, runtime, regions: extractCelRegionScopes(schema) };
+}
+/** The union of several schemas' sites — a kind's own and its capability
+ *  abstract's, which is how a `Telo.Provider`'s implicit compile-eval reaches
+ *  fields the provider never annotated. */
+export function mergeCelEvalSites(...sites) {
+    return {
+        compile: sites.flatMap((s) => s.compile),
+        runtime: sites.flatMap((s) => s.runtime),
+        regions: sites.flatMap((s) => s.regions),
+    };
+}
+/**
+ * Whether the value at `path` is evaluated, and when — null for a field whose
+ * value is read as a literal.
+ *
+ * `compile` wins over `runtime`, and both win over a region: a field's own
+ * annotation is more specific than the region it sits in, which is the same
+ * precedence a nested annotation has over an enclosing one. A region resolves to
+ * `runtime` because that is what a region IS — a per-invocation scope naming
+ * what its expressions can read.
+ *
+ * `path` is the `walkCelExpressions` spelling (`routes[0].returns[1].when`).
+ */
+export function celEvalModeAt(sites, path) {
+    if (evalPathsCover(sites.compile, path))
+        return "compile";
+    if (evalPathsCover(sites.runtime, path))
+        return "runtime";
+    if (sites.regions.some((scope) => pathMatchesScope(path, scope)))
+        return "runtime";
+    return null;
+}

package/dist/flatten-for-analyzer.d.ts

@@ -15,7 +15,7 @@ export interface ParsedExportEntry {
  *  the empty prefix isn't a valid alias. */
 export declare function parseExportEntry(entry: string): ParsedExportEntry;
 /** The import-boundary forwarding rule, shared by `flattenForAnalyzer` (the
- *  CLI / kernel loader path) and the telo-editor's workspace projection so the
+ *  CLI / kernel loader path) and telo studio's workspace projection so the
  *  two cannot drift. Given one module's stamped manifests and whether that
  *  module is the analysis entry (root), returns the manifests that cross into
  *  the consumer's flat analysis list:

package/dist/flatten-for-analyzer.js

@@ -9,7 +9,7 @@ export function parseExportEntry(entry) {
     return dot > 0 ? { name: entry.slice(dot + 1), alias: entry.slice(0, dot) } : { name: entry };
 }
 /** The import-boundary forwarding rule, shared by `flattenForAnalyzer` (the
- *  CLI / kernel loader path) and the telo-editor's workspace projection so the
+ *  CLI / kernel loader path) and telo studio's workspace projection so the
  *  two cannot drift. Given one module's stamped manifests and whether that
  *  module is the analysis entry (root), returns the manifests that cross into
  *  the consumer's flat analysis list:

package/dist/import-resolution-diagnostics.d.ts

@@ -3,7 +3,7 @@ import { type AnalysisDiagnostic } from "./types.js";
 /**
  * Convert a graph's import failures (`graph.errors`) into structured, coded
  * diagnostics. This is the single source of truth for surfacing a broken
- * import — every host (CLI, VS Code, telo-editor) routes these instead of each
+ * import — every host (CLI, VS Code, telo studio) routes these instead of each
  * re-deriving the channel and drifting (the VS Code extension used to drop it
  * entirely, showing nothing for a broken import).
  *

package/dist/import-resolution-diagnostics.js

@@ -38,7 +38,7 @@ function messageFor(e, code) {
 /**
  * Convert a graph's import failures (`graph.errors`) into structured, coded
  * diagnostics. This is the single source of truth for surfacing a broken
- * import — every host (CLI, VS Code, telo-editor) routes these instead of each
+ * import — every host (CLI, VS Code, telo studio) routes these instead of each
  * re-deriving the channel and drifting (the VS Code extension used to drop it
  * entirely, showing nothing for a broken import).
  *

package/dist/index.d.ts

@@ -4,7 +4,8 @@ export { StaticAnalyzer } from "./analyzer.js";
 export { importResolutionDiagnostics } from "./import-resolution-diagnostics.js";
 export type { GraphLoadError, ImportEdge, LoadedFile, LoadedGraph, LoadedModule, ParseError, } from "./loaded-types.js";
 export { collectZoneModuleDocuments, flattenForAnalyzer, flattenLoadedModule, forwardReExportManifests, parseExportEntry, reExportSpecsFromExports, resolveExportedKinds, selectModuleManifestsForAnalysis, stampExportedKinds, stampReExportedKinds, type ParsedExportEntry, type ReExportSpec, } from "./flatten-for-analyzer.js";
-export { buildEvalPaths, evalPathCovers } from "./eval-paths.js";
+export { buildEvalPaths, celEvalModeAt, celEvalSites, declaresCelRegion, evalPathCovers, mergeCelEvalSites, NO_CEL_EVAL_SITES, } from "./eval-paths.js";
+export type { CelEvalSites } from "./eval-paths.js";
 export { BINDINGS_ANNOTATION, bindingContextProperties, bindingDependencies, findBindingSites, resolveBindingOrder, } from "./cel-bindings.js";
 export type { BindingSites } from "./cel-bindings.js";
 export { CEL_RESERVED_WORDS, TYPE_LEVEL_DOC_KINDS, checkName, } from "./identifier-name.js";
@@ -21,8 +22,8 @@ export { hasIntermediateWildcard, parseRedactionPath, RedactionPathError, } from
 export type { RedactionSegment } from "./redaction-path.js";
 export { buildCallGraph, projectToPairs, resourceId } from "./call-graph.js";
 export type { BuildCallGraphOptions, CallGraph, CallGraphEdge, CallGraphNode, ResourceGraphNode, StepGraphNode, } from "./call-graph.js";
-export { buildReferenceFieldMap, isRefEntry, isScopeEntry } from "./reference-field-map.js";
-export type { ReferenceFieldMap, RefFieldEntry } from "./reference-field-map.js";
+export { buildReferenceFieldMap, isRefEntry, isScopeEntry, satisfiesValueBranch, } from "./reference-field-map.js";
+export type { ReferenceFieldMap, RefFieldEntry, ValueBranchValidator, } from "./reference-field-map.js";
 export { hasDeclaredUse, isRefSlot, isRefUse, possibleUses, readRefSlot, REF_USES, refSlotAnnotation, rewriteRefSlotKinds, transfersControl, } from "./ref-slot.js";
 export type { RefSlot, RefUse, RefUseCases } from "./ref-slot.js";
 export { isStepSlot, readStepSlot, STEP_FRAGMENT } from "./step-slot.js";
@@ -45,12 +46,13 @@ export { deriveLibraryExportRequirements, projectZoneRequirements, runZoneAnalys
 export type { ZoneExportCache, ZoneExportCacheEntry, ZoneExportRequirements, ZoneRequirementSpec, } from "./resolve-zone-requirements.js";
 export type { ZoneModuleDocuments } from "./zone-module-documents.js";
 export { validateZoneSlotDeclarations } from "./validate-zone-slots.js";
-export { RESOURCE_RULES_ANNOTATION, readResourceRules, readRawResourceRules, resolveRuleSubjects, findDynamicLeaf, type ResourceRule, type ResourceRuleSeverity, type RuleSubject, } from "./resource-rule.js";
+export { RESOURCE_RULES_ANNOTATION, readResourceRules, readRawResourceRules, resolveRuleSubjects, findDynamicLeaf, dynamicNode, type DynamicLeaf, type ResourceRule, type ResourceRuleSeverity, type RuleSubject, } from "./resource-rule.js";
 export { validateResourceRuleDeclarations, evaluateResourceRules, ruleExercised, RESOURCE_RULE_BUDGET_MS, type ResourceRuleIssue, type ResourceRuleFinding, } from "./validate-resource-rules.js";
 export { REFERRER_RULES_ANNOTATION, readReferrerRules, readRawReferrerRules, hasReferrerRules, rewriteReferrerRuleKinds, type ReferrerRule, } from "./referrer-rule.js";
-export { validateReferrerRuleDeclarations, evaluateReferrerRules, referrerRuleExercised, reportReferrerRules, reportUnexercisedReferrerRule, type Referrer, type ReferrerRuleIssue, type ReferrerRuleFinding, type ReferrerRuleDiagnostic, } from "./validate-referrer-rules.js";
-export { RULE_BUDGET_MS } from "./rule-condition.js";
-export { readSchemaProjection, readSchemaMap, readProjectionFrom, readProjectionRef, manifestListScope, projectionKeyMap, projectEntries, resolveSchemaProjections, describeProjectionFailure, type SchemaProjection, type SchemaMap, type ProjectionRef, type ProjectionLookup, type ProjectionScope, type ProjectionFailure, } from "./schema-projection.js";
+export { validateReferrerRuleDeclarations, evaluateReferrerRules, referrerRuleExercised, reportReferrerRules, reportUnexercisedReferrerRule, type Referrer, type ReferrerRuleIssue, type ReferrerRuleFinding, type ReferrerRuleDiagnostic, type ReferrerRuleContext, type ReferrerRuleDeclarationContext, } from "./validate-referrer-rules.js";
+export { PeerBinder, analyzerPeerBinder, analyzerPeersTarget, entryBoundary, navigatePath, referenceValueOf, shapeMatches, type DeclarationLookup, type PeerAliasScope, type PeerBinderEnv, type PeerBinderRegistry, type PeerBinding, type PeerBindingFailure, type PeerBindingResult, type PeersTarget, } from "./peer-binding.js";
+export { RULE_BUDGET_MS, UNTAGGED_CONDITION } from "./rule-condition.js";
+export { readSchemaProjection, type ProjectionReference, readSchemaMap, schemaMapBranch, readProjectionFrom, readProjectionRef, manifestListScope, projectionKeyMap, projectEntries, resolveSchemaProjections, describeProjectionFailure, type SchemaProjection, type SchemaMap, type ProjectionRef, type ProjectionLookup, type ProjectionScope, type ProjectionFailure, } from "./schema-projection.js";
 export { validateSchemaProjection, type SchemaProjectionIssue } from "./validate-schema-projection.js";
 export { validateDurableRegions } from "./validate-durable-regions.js";
 export { validateZoneViolations } from "./validate-zone-violations.js";
@@ -60,8 +62,10 @@ export { validateDynamicSelectors, validateRefSlotDeclarations } from "./validat
 export type { RefSlotIssue } from "./validate-ref-slots.js";
 export { validateValueTypeSlots } from "./validate-value-type-slots.js";
 export type { ValueTypeSlotIssue } from "./validate-value-type-slots.js";
-export { checkSchemaCompatibility, selectUnionBranch } from "./schema-compat.js";
-export type { CompatibilityResult } from "./schema-compat.js";
+export { checkSchemaCompatibility, resolveRefIn, selectUnionBranch } from "./schema-compat.js";
+export type { CompatibilityResult, ExternalSchemaResolver } from "./schema-compat.js";
+export { ajvErrorToPath, formatAjvErrors, formatSingleError, reduceSchemaErrors, schemaIssues, } from "./schema-error-report.js";
+export type { AjvErrorLike, SchemaIssue } from "./schema-error-report.js";
 export { visitManifest } from "./manifest-visitor.js";
 export type { CelSiteEvent, ManifestVisitor, RefSiteEvent, ResourceEnterEvent, ResourceExitEvent, ScopeBoundaryEvent, SchemaFromSiteEvent, VisitOptions, } from "./manifest-visitor.js";
 export { Loader } from "./manifest-loader.js";