@telorun/analyzer 0.64.0 → 0.66.0

package/dist/peer-binding.js

@@ -0,0 +1,418 @@
+import { isRefEntry } from "./reference-field-map.js";
+import { dynamicNode, findDynamicLeaf, pointerToPath, resolvePointer, } from "./resource-rule.js";
+import { isIterableSchema, schemaAtPointer } from "./validate-resource-rules.js";
+function isObject(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
+/** The reference a value holds, in either shape, or `undefined`. Read only at a
+ *  path the field map declares to be a reference slot. */
+export function referenceValueOf(value) {
+    if (!isObject(value))
+        return undefined;
+    if (value.__tagged === true && value.engine === "ref" && typeof value.source === "string") {
+        const dot = value.source.indexOf(".");
+        return dot > 0
+            ? { alias: value.source.slice(0, dot), name: value.source.slice(dot + 1) }
+            : { name: value.source };
+    }
+    if (typeof value.name === "string" && typeof value.kind === "string") {
+        return {
+            name: value.name,
+            kind: value.kind,
+            ...(typeof value.alias === "string" ? { alias: value.alias } : {}),
+        };
+    }
+    return undefined;
+}
+/** True when a concrete path is an instance of a field-map shape — `tables[2]`
+ *  of `tables[]`, `mounts[1].mount` of `mounts[].mount`, `tables.orders` of
+ *  `tables.{}`. A map key containing a dot is not distinguishable here, the same
+ *  ambiguity the concrete path itself carries. */
+export function shapeMatches(concrete, shape) {
+    const c = concrete.split(".");
+    const s = shape.split(".");
+    if (c.length !== s.length)
+        return false;
+    return s.every((segment, i) => {
+        if (segment === "{}")
+            return true;
+        if (segment.endsWith("[]")) {
+            const base = segment.slice(0, -2);
+            return c[i].startsWith(`${base}[`) && /^\[\d+\]$/.test(c[i].slice(base.length));
+        }
+        return segment === c[i];
+    });
+}
+/** The concrete path of the ENTRY a slot path sits in, truncated at the first
+ *  `[]` / `{}` marker of the shape it matches — which is where an entry begins,
+ *  everything after it being the entry's own shape. */
+export function entryBoundary(concrete, shape) {
+    const c = concrete.split(".");
+    const s = shape.split(".");
+    for (let i = 0; i < s.length; i++) {
+        if (s[i] === "{}" || s[i].endsWith("[]"))
+            return c.slice(0, i + 1).join(".");
+    }
+    return concrete;
+}
+/** Navigate a dotted/bracketed path (`mounts[1].mount`) within a value — the
+ *  spelling the call graph gives an edge, so an edge's own path is what reads
+ *  the entry it came from. */
+export function navigatePath(value, path) {
+    if (path === "")
+        return value;
+    let current = value;
+    for (const segment of path.split(".")) {
+        const parsed = /^([^[\]]*)((?:\[\d+\])*)$/.exec(segment);
+        if (!parsed)
+            return undefined;
+        const [, key, indices] = parsed;
+        if (key !== "") {
+            if (!isObject(current))
+                return undefined;
+            current = current[key];
+        }
+        for (const index of indices.match(/\d+/g) ?? []) {
+            if (!Array.isArray(current))
+                return undefined;
+            current = current[Number(index)];
+        }
+        if (current === undefined)
+            return undefined;
+    }
+    return current;
+}
+/**
+ * The entry shape a collection's items take — `tables[]` for an array,
+ * `tables.{}` for a map — as the field map spells it.
+ *
+ * Chosen by the collection's RUNTIME type rather than by whichever shape the map
+ * lists first: the two spell an entry's concrete path differently (`tables[2]`
+ * versus `tables.orders`), so taking the wrong one leaves every entry unable to
+ * recognise itself.
+ */
+function entryShapeOf(shapes, collectionPath, isArray) {
+    const wanted = isArray ? `${collectionPath}[]` : `${collectionPath}.{}`;
+    return shapes.some((shape) => shape === wanted || shape.startsWith(`${wanted}.`))
+        ? wanted
+        : undefined;
+}
+/** Which paths inside one entry hold a reference: the item itself, or the named
+ *  properties one level in. */
+function entryRefsOf(shapes, entryShape) {
+    const properties = new Set();
+    let itemIsRef = false;
+    for (const shape of shapes) {
+        if (shape === entryShape) {
+            itemIsRef = true;
+            continue;
+        }
+        if (!shape.startsWith(`${entryShape}.`))
+            continue;
+        const rest = shape.slice(entryShape.length + 1);
+        if (!rest.includes("."))
+            properties.add(rest);
+    }
+    return { itemIsRef, properties };
+}
+/**
+ * The first `!cel` among the fields of a resolved DECLARATION that a peer rule
+ * can actually COMPARE — its own top-level scalars.
+ *
+ * Which fields a condition reads off an element cannot be recovered from the
+ * parse: cel-js emits no access chain for a comprehension variable, so
+ * `peers.exists(p, p.table == …)` yields only `peers` and nothing about `table`.
+ * The bound is drawn structurally instead, and top-level scalars are the honest
+ * line: a physical name, a type name, a marker — the identities a peer rule
+ * compares. Reaching deeper needs a comprehension over nested config, and a rule
+ * of that shape has an unbounded subject anyway.
+ *
+ * Scanning the whole declaration was tried first and is what this replaced: it
+ * disabled every rule over a table the moment any nested field held an
+ * expression — a seed's `when:`, a column default — which is noise where the
+ * rule was about a physical name.
+ */
+function dynamicInDeclaration(declaration) {
+    for (const [key, value] of Object.entries(declaration)) {
+        if (key === "metadata")
+            continue;
+        const dynamic = dynamicNode(value, key);
+        if (dynamic)
+            return dynamic;
+    }
+    return undefined;
+}
+/** One entry with the references INSIDE it resolved — the declaration itself for
+ *  a bare `!ref`, or the entry with each declared reference property replaced. */
+function resolveEntry(value, at, refs, lookup) {
+    if (refs.itemIsRef) {
+        const reference = referenceValueOf(value);
+        // An inline declaration (`{kind, …config}` with no name) is not a reference;
+        // it binds as written, exactly as any other non-reference entry does.
+        if (reference) {
+            const declaration = lookup(reference);
+            if (!declaration)
+                return { ok: false, failure: { reason: "unresolved", at } };
+            const dynamic = dynamicInDeclaration(declaration);
+            if (dynamic) {
+                return {
+                    ok: false,
+                    failure: { reason: "dynamic", at: `${at} → ${dynamic.path}`, what: dynamic.what },
+                };
+            }
+            return { ok: true, value: declaration };
+        }
+    }
+    if (!isObject(value))
+        return { ok: true, value };
+    const out = {};
+    for (const [key, child] of Object.entries(value)) {
+        if (!refs.properties.has(key)) {
+            // The author's OWN entry data beside the reference (`prefix` next to
+            // `mount`) — small, and read directly by a rule, so it is scanned whole.
+            const dynamic = findDynamicLeaf(child, `${at}.${key}`);
+            if (dynamic !== undefined) {
+                return { ok: false, failure: { reason: "dynamic", at: dynamic.path, what: dynamic.what } };
+            }
+            out[key] = child;
+            continue;
+        }
+        const reference = referenceValueOf(child);
+        if (!reference) {
+            out[key] = child;
+            continue;
+        }
+        const declaration = lookup(reference);
+        if (!declaration)
+            return { ok: false, failure: { reason: "unresolved", at: `${at}.${key}` } };
+        const dynamic = dynamicInDeclaration(declaration);
+        if (dynamic) {
+            return {
+                ok: false,
+                failure: { reason: "dynamic", at: `${at}.${key} → ${dynamic.path}`, what: dynamic.what },
+            };
+        }
+        out[key] = declaration;
+    }
+    return { ok: true, value: out };
+}
+/**
+ * Binds `peers` and `entry`, resolving each referrer's collection once.
+ *
+ * One binder per analysis: the cache is what keeps a rule over an n-entry
+ * collection linear in resolution work rather than quadratic, and it is shared
+ * by the evaluation and the exercised check, which ask the same question.
+ */
+export class PeerBinder {
+    env;
+    constructor(env) {
+        this.env = env;
+    }
+    collections = new WeakMap();
+    /**
+     * @param slotPath concrete path of the edge that reached the referenced
+     *   resource, e.g. `tables[2]` or `mounts[1].mount`.
+     */
+    bind(referrer, referrerKind, pointer, slotPath) {
+        const collectionPath = pointerToPath(pointer);
+        const shapes = this.env.refSlotsOf(referrerKind);
+        if (!shapes)
+            return { ok: false, failure: { reason: "unknown-shape", at: collectionPath } };
+        const resolved = this.collection(referrer, pointer, collectionPath, shapes);
+        if (!resolved.ok)
+            return resolved;
+        const mine = resolved.entryShape
+            ? this.entryKey(slotPath, collectionPath, resolved.entryShape)
+            : undefined;
+        const at = mine === undefined ? -1 : resolved.keys.indexOf(mine);
+        const peers = at === -1 ? resolved.values : resolved.values.filter((_, i) => i !== at);
+        if (at !== -1)
+            return { ok: true, binding: { peers, entry: resolved.values[at] } };
+        // The edge runs through a DIFFERENT collection than the one `peers:` names
+        // (a rule over a schema's `enums:` while my own entry sits in `tables:`), so
+        // the entry is found through the shape this slot path matches.
+        const shape = shapes.find((candidate) => shapeMatches(slotPath, candidate));
+        if (!shape)
+            return { ok: false, failure: { reason: "unknown-shape", at: slotPath } };
+        const boundary = entryBoundary(slotPath, shape);
+        const entryShape = entryBoundary(shape, shape);
+        const entry = resolveEntry(navigatePath(referrer, boundary), boundary, entryRefsOf(shapes, entryShape), this.env.declarationOf);
+        if (!entry.ok)
+            return entry;
+        return { ok: true, binding: { peers, entry: entry.value } };
+    }
+    /** True when the rule has something to compare — the input to the
+     *  never-exercised report, asked through the same cache. */
+    hasPeers(referrer, referrerKind, pointer, slotPath) {
+        const bound = this.bind(referrer, referrerKind, pointer, slotPath);
+        return bound.ok && bound.binding.peers.length > 0;
+    }
+    collection(referrer, pointer, collectionPath, shapes) {
+        let byPointer = this.collections.get(referrer);
+        if (!byPointer) {
+            byPointer = new Map();
+            this.collections.set(referrer, byPointer);
+        }
+        const cached = byPointer.get(pointer);
+        if (cached)
+            return cached;
+        const resolved = this.resolveCollection(referrer, pointer, collectionPath, shapes);
+        byPointer.set(pointer, resolved);
+        return resolved;
+    }
+    resolveCollection(referrer, pointer, collectionPath, shapes) {
+        const raw = resolvePointer(referrer, pointer);
+        // An ABSENT collection is an EMPTY one, not an unbindable one — the line
+        // `resolveRuleSubjects` already draws for a resource rule's `in:`. A resource
+        // that simply declares none is the loudest case a peer rule has (a column
+        // naming an enum its schema lists nowhere), so degrading it to a skip would
+        // silence exactly the manifest the rule exists for.
+        if (raw === undefined || raw === null)
+            return { ok: true, keys: [], values: [] };
+        if (!Array.isArray(raw) && !isObject(raw)) {
+            return { ok: false, failure: { reason: "no-collection", at: collectionPath } };
+        }
+        const entryShape = entryShapeOf(shapes, collectionPath, Array.isArray(raw));
+        if (!entryShape) {
+            return { ok: false, failure: { reason: "unknown-shape", at: collectionPath } };
+        }
+        const refs = entryRefsOf(shapes, entryShape);
+        const keys = Array.isArray(raw) ? raw.map((_, i) => String(i)) : Object.keys(raw);
+        const items = Array.isArray(raw) ? raw : Object.values(raw);
+        const values = [];
+        for (let i = 0; i < items.length; i++) {
+            const at = Array.isArray(raw) ? `${collectionPath}[${keys[i]}]` : `${collectionPath}.${keys[i]}`;
+            const resolved = resolveEntry(items[i], at, refs, this.env.declarationOf);
+            if (!resolved.ok)
+                return resolved;
+            values.push(resolved.value);
+        }
+        return { ok: true, keys, values, entryShape };
+    }
+    /** The array index or map key `slotPath` occupies in the peers collection, or
+     *  `undefined` when the path does not run through it at all. */
+    entryKey(slotPath, collectionPath, entryShape) {
+        if (entryShape.endsWith("[]")) {
+            if (!slotPath.startsWith(`${collectionPath}[`))
+                return undefined;
+            const match = /^\[(\d+)\]/.exec(slotPath.slice(collectionPath.length));
+            return match ? match[1] : undefined;
+        }
+        if (!slotPath.startsWith(`${collectionPath}.`))
+            return undefined;
+        const rest = slotPath.slice(collectionPath.length + 1);
+        const dot = rest.indexOf(".");
+        return dot === -1 ? rest : rest.slice(0, dot);
+    }
+}
+/**
+ * The binder for one analysis run.
+ *
+ * ONE per run: it caches each referrer's resolved collection, which is what
+ * keeps a rule over an n-entry collection from re-resolving that collection once
+ * per entry — and both the evaluation and the exercised check ask for it.
+ *
+ * Built here rather than assembled at the analysis site, the
+ * `analyzerContractScope` precedent: both halves are the binding's own rule
+ * expressed against the analyzer's registry, and inline they were 40 lines of a
+ * 2700-line pass, using two different field-map accessors for one question.
+ */
+export function analyzerPeerBinder(registry, aliases, manifests) {
+    const byName = new Map();
+    const byModuleAndName = new Map();
+    for (const m of manifests) {
+        const name = m.metadata?.name;
+        if (!name)
+            continue;
+        byName.set(name, m);
+        const mod = m.metadata.module;
+        if (mod)
+            byModuleAndName.set(`${mod}\0${name}`, m);
+    }
+    /**
+     * An alias RESOLVES OR NOTHING DOES. Resource names are module-scoped, so two
+     * libraries each exporting a `users` share one bucket in `byName`; falling
+     * back to it when the alias names a module this analysis cannot resolve would
+     * compare against a declaration from somewhere else entirely — a confident
+     * wrong verdict, which is worse than the reported skip an absent binding
+     * produces.
+     */
+    const declarationOf = (ref) => {
+        if (ref.alias && ref.alias !== "Self") {
+            const module = aliases.moduleForAlias(ref.alias);
+            return module ? byModuleAndName.get(`${module}\0${ref.name}`) : undefined;
+        }
+        return byName.get(ref.name);
+    };
+    /**
+     * Which paths of a referrer kind hold references — the field map, which is the
+     * authority. A binder that sniffed for `{kind, name}` instead would resolve
+     * author data carrying those two keys to an unrelated manifest.
+     */
+    const refSlotsOf = (kind) => {
+        const map = registry.getFieldMapForKind(kind, aliases);
+        if (!map)
+            return undefined;
+        return [...map].filter(([, entry]) => isRefEntry(entry)).map(([path]) => path);
+    };
+    return new PeerBinder({ declarationOf, refSlotsOf });
+}
+/**
+ * The strict half's resolver for a `peers:` pointer.
+ *
+ * Liskov in BOTH directions, which is what the check has to be: the filter is
+ * usually an abstract (`Sql.Schema`, so one rule serves every backend) while the
+ * collection is declared by the backends that implement it, so a pointer
+ * resolving on any candidate resolves the rule. Reported only when NO candidate
+ * declares it, or when every candidate that does holds plain data — the two
+ * shapes where the rule would see no declaration at all.
+ *
+ * Takes only the registry: it is answered after the registration loop and before
+ * the manifest list exists, which is also why it is a separate function rather
+ * than a method on one environment object.
+ */
+export function analyzerPeersTarget(registry) {
+    return (referrerKind, pointer) => {
+        const implementations = registry
+            .getByExtends(referrerKind)
+            .map((d) => d.metadata.module ? `${d.metadata.module}.${d.metadata.name}` : String(d.metadata.name));
+        const candidates = [referrerKind, ...implementations];
+        const path = pointerToPath(pointer);
+        let sawSchema = false;
+        let sawCollection = false;
+        for (const kind of candidates) {
+            const schema = registry.effectiveSchema(kind);
+            if (!schema)
+                continue;
+            sawSchema = true;
+            const node = schemaAtPointer(schema, pointer);
+            if (node === undefined || !isIterableSchema(node))
+                continue;
+            sawCollection = true;
+            const map = registry.getFieldMap(kind);
+            if (!map)
+                continue;
+            for (const [fieldPath, entry] of map) {
+                if (!isRefEntry(entry))
+                    continue;
+                if (fieldPath === `${path}[]` ||
+                    fieldPath.startsWith(`${path}[].`) ||
+                    fieldPath === `${path}.{}` ||
+                    fieldPath.startsWith(`${path}.{}.`)) {
+                    return "ok";
+                }
+            }
+        }
+        if (!sawSchema)
+            return "unknown";
+        // An ABSTRACT filter with no implementations in this analysis says nothing:
+        // the abstract declares the collection structurally and each backend
+        // restates the entry as a reference to its OWN kind, so checking a library
+        // on its own would report every such rule as pointing at plain data. The
+        // consumer's app analysis holds the backends and answers properly there.
+        const filter = registry.resolve(referrerKind);
+        if (implementations.length === 0 && filter?.kind === "Telo.Abstract")
+            return "unknown";
+        return sawCollection ? "plain" : "absent";
+    };
+}

package/dist/ref-slot.d.ts

@@ -80,6 +80,19 @@ export interface RefSlot {
     /** `x-telo-inline: true` on the slot or any `anyOf` branch — accepts an inline
      *  `{kind, ...config}` definition, not only a `!ref`. */
     inline: boolean;
+    /** The slot's VALUE branches — `anyOf` / `oneOf` alternatives that carry no
+     *  `x-telo-ref`, present only when the reference constraint is itself a
+     *  *branch* rather than the node's own annotation.
+     *
+     *  That narrowing is the whole point. A node-level `x-telo-ref` with branches
+     *  beneath it (an Application `targets` entry) uses those branches to describe
+     *  the POST-RESOLUTION structural forms a reference takes — a bare string
+     *  there is the removed string-reference spelling, and admitting it as a value
+     *  would retire `INVALID_REFERENCE_FORM` exactly where it still applies. A
+     *  branch-level constraint says something different: this slot holds either a
+     *  value of one shape or a reference, and a scalar is then a value, not a
+     *  malformed reference. */
+    valueBranches: Record<string, any>[];
 }
 /** Every use a slot can take, flattening a case map. The conservative reading
  *  for a consumer that does not resolve the selector. */

package/dist/ref-slot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ref-slot.d.ts","sourceRoot":"","sources":["../src/ref-slot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;mDAEmD;AACnD,MAAM,MAAM,MAAM;AAChB,sEAAsE;AACpE,QAAQ;AACV,oEAAoE;GAClE,YAAY;AACd,gEAAgE;GAC9D,MAAM;AACR;oCACoC;GAClC,UAAU;AACZ;8EAC8E;GAC5E,iBAAiB;AACnB;kDACkD;GAChD,kBAAkB,CAAC;AAEvB,eAAO,MAAM,QAAQ,EAAE,SAAS,MAAM,EAOrC,CAAC;AAEF,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAExD;AAED;qCACqC;AACrC,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;0DAE0D;AAC1D,MAAM,WAAW,WAAW;IAC1B;;8DAE0D;IAC1D,EAAE,EAAE,MAAM,CAAC;IACX,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACjC;AAED,4EAA4E;AAC5E,MAAM,WAAW,OAAO;IACtB;;;yDAGqD;IACrD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;;6DAIyD;IACzD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,yEAAyE;IACzE,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB;;0CAEsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;6DACyD;IACzD,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;yDACyD;AACzD,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,EAAE,CAOpD;AAED;kDACkD;AAClD,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAErD;AA2DD;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CA6BtF;AAED;+DAC+D;AAC/D,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,OAAO,CAExE;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASxE;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACrC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACxC,IAAI,CAiBN"}
+{"version":3,"file":"ref-slot.d.ts","sourceRoot":"","sources":["../src/ref-slot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;mDAEmD;AACnD,MAAM,MAAM,MAAM;AAChB,sEAAsE;AACpE,QAAQ;AACV,oEAAoE;GAClE,YAAY;AACd,gEAAgE;GAC9D,MAAM;AACR;oCACoC;GAClC,UAAU;AACZ;8EAC8E;GAC5E,iBAAiB;AACnB;kDACkD;GAChD,kBAAkB,CAAC;AAEvB,eAAO,MAAM,QAAQ,EAAE,SAAS,MAAM,EAOrC,CAAC;AAEF,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAExD;AAED;qCACqC;AACrC,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;0DAE0D;AAC1D,MAAM,WAAW,WAAW;IAC1B;;8DAE0D;IAC1D,EAAE,EAAE,MAAM,CAAC;IACX,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACjC;AAED,4EAA4E;AAC5E,MAAM,WAAW,OAAO;IACtB;;;yDAGqD;IACrD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;;6DAIyD;IACzD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,yEAAyE;IACzE,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB;;0CAEsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;6DACyD;IACzD,MAAM,EAAE,OAAO,CAAC;IAChB;;;;;;;;;;;+BAW2B;IAC3B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AAED;yDACyD;AACzD,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,EAAE,CAOpD;AAED;kDACkD;AAClD,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAErD;AAiFD;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CA8BtF;AAED;+DAC+D;AAC/D,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,OAAO,CAExE;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASxE;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACrC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACxC,IAAI,CAiBN"}

package/dist/ref-slot.js

@@ -121,6 +121,31 @@ function annotationNodes(node) {
     }
     return out;
 }
+/** The branches of a value-or-reference union — see {@link RefSlot.valueBranches}.
+ *  Empty unless the node delegates its reference constraint to a branch. */
+function valueBranchesOf(node) {
+    if (!node || typeof node !== "object")
+        return [];
+    if (node["x-telo-ref"] !== undefined)
+        return [];
+    const out = [];
+    for (const key of ["anyOf", "oneOf"]) {
+        const branches = node[key];
+        if (!Array.isArray(branches))
+            continue;
+        const carriesRef = branches.some((b) => b && typeof b === "object" && b["x-telo-ref"] !== undefined);
+        if (!carriesRef)
+            continue;
+        for (const branch of branches) {
+            if (!branch || typeof branch !== "object")
+                continue;
+            if (branch["x-telo-ref"] !== undefined)
+                continue;
+            out.push(branch);
+        }
+    }
+    return out;
+}
 /**
  * Reads a schema node as a reference slot, or `undefined` when it declares none.
  *
@@ -160,6 +185,7 @@ export function readRefSlot(node) {
         kinds,
         uses: [...uses],
         inline: node?.["x-telo-inline"] === true || nodes.some((n) => n["x-telo-inline"] === true),
+        valueBranches: valueBranchesOf(node),
     };
     if (useCases)
         slot.useCases = useCases;

package/dist/reference-field-map.d.ts

@@ -17,6 +17,10 @@ export interface RefFieldEntry {
     inputs?: string;
     /** True when the field path traversed through at least one array (path contains "[]"). */
     isArray: boolean;
+    /** The slot's non-reference branches, when the reference constraint is a
+     *  branch of a union — see {@link RefSlot.valueBranches}. A value satisfying
+     *  one of these is a value, not a malformed reference. */
+    valueBranches?: Record<string, any>[];
     /** x-telo-context schema declared on this ref slot, if any. Describes the CEL invocation
      *  context available to resources placed in this slot. */
     context?: Record<string, any>;
@@ -52,6 +56,30 @@ export type FieldMapEntry = RefFieldEntry | ScopeFieldEntry | SchemaFromFieldEnt
  *  Paths use dot notation; array traversal is denoted by `[]` (e.g. "steps[].invoke"). */
 export type ReferenceFieldMap = Map<string, FieldMapEntry>;
 export declare function isRefEntry(entry: FieldMapEntry): entry is RefFieldEntry;
+/** The half of a definition registry this question needs — structural, so the
+ *  field map keeps depending on nothing. */
+export interface ValueBranchValidator {
+    schemaCompileError(schema: Record<string, any>): string | undefined;
+    validateWithRefs(data: unknown, schema: Record<string, any>): string[];
+}
+/**
+ * True when a value at a ref slot satisfies one of the slot's VALUE branches —
+ * a storage class beside a `!ref`, so it is a value and not a malformed
+ * reference.
+ *
+ * One implementation, because BOTH reference passes have to narrow the same way:
+ * `validateReferenceForms` would otherwise call it a removed string reference,
+ * and `validateReferences` a reference missing `kind` and `name`. Two copies of
+ * the rule would eventually disagree about which of the two reported a value.
+ *
+ * A branch AJV cannot COMPILE is not a branch the value satisfies.
+ * `validateWithRefs` returns no issues for one — it swallows the compile failure
+ * by design, so one bad schema does not abort the pass — and reading that as
+ * "no issues, therefore a value" would switch the reference-form rule off for
+ * the slot silently. The uncompilable schema is reported on its own definition
+ * by `schemaCompileError`.
+ */
+export declare function satisfiesValueBranch(value: unknown, branches: readonly Record<string, any>[] | undefined, registry: ValueBranchValidator): boolean;
 export declare function isScopeEntry(entry: FieldMapEntry): entry is ScopeFieldEntry;
 export declare function isSchemaFromEntry(entry: FieldMapEntry): entry is SchemaFromFieldEntry;
 /** Keys that a named reference object may have. Values beyond these indicate an inline resource. */

package/dist/reference-field-map.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reference-field-map.d.ts","sourceRoot":"","sources":["../src/reference-field-map.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,MAAM,EAAE,KAAK,WAAW,EAAe,MAAM,eAAe,CAAC;AAEzF,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACvE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAElE,4EAA4E;AAC5E,MAAM,WAAW,aAAa;IAC5B;;6EAEyE;IACzE,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;0DACsD;IACtD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB;0CACsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,OAAO,EAAE,OAAO,CAAC;IACjB;8DAC0D;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9B;;;;;;;;;;kCAU8B;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAC9B;2CACuC;IACvC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC1B;AAED;8CAC8C;AAC9C,MAAM,WAAW,oBAAoB;IACnC;;qFAEiF;IACjF,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,eAAe,GAAG,oBAAoB,CAAC;AAEnF;0FAC0F;AAC1F,MAAM,MAAM,iBAAiB,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAE3D,wBAAgB,UAAU,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,IAAI,aAAa,CAEvE;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,IAAI,eAAe,CAE3E;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,IAAI,oBAAoB,CAErF;AAED,oGAAoG;AACpG,eAAO,MAAM,cAAc,aAAwC,CAAC;AAEpE;;;;;;;;;2EAS2E;AAC3E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAItE;AAED;;;;sEAIsE;AACtE,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;wDAUwD;AACxD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAoCpF;AAED;+DAC+D;AAC/D,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,EAAE,CAExE;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,iBAAiB,CAQrF;AAED;;6CAE6C;AAC7C,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE,CAE/D;AAED;;;8CAG8C;AAC9C,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,EAAE,MAAM,GACjB,iBAAiB,CAInB"}
+{"version":3,"file":"reference-field-map.d.ts","sourceRoot":"","sources":["../src/reference-field-map.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,MAAM,EAAE,KAAK,WAAW,EAAe,MAAM,eAAe,CAAC;AAEzF,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACvE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAElE,4EAA4E;AAC5E,MAAM,WAAW,aAAa;IAC5B;;6EAEyE;IACzE,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;0DACsD;IACtD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB;0CACsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,OAAO,EAAE,OAAO,CAAC;IACjB;;8DAE0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;IACtC;8DAC0D;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9B;;;;;;;;;;kCAU8B;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAC9B;2CACuC;IACvC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC1B;AAED;8CAC8C;AAC9C,MAAM,WAAW,oBAAoB;IACnC;;qFAEiF;IACjF,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,eAAe,GAAG,oBAAoB,CAAC;AAEnF;0FAC0F;AAC1F,MAAM,MAAM,iBAAiB,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAE3D,wBAAgB,UAAU,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,IAAI,aAAa,CAEvE;AAED;4CAC4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,GAAG,SAAS,CAAC;IACpE,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC;CACxE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,SAAS,EACpD,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAOT;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,IAAI,eAAe,CAE3E;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,IAAI,oBAAoB,CAErF;AAED,oGAAoG;AACpG,eAAO,MAAM,cAAc,aAAwC,CAAC;AAEpE;;;;;;;;;2EAS2E;AAC3E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAItE;AAED;;;;sEAIsE;AACtE,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;wDAUwD;AACxD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAoCpF;AAED;+DAC+D;AAC/D,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,EAAE,CAExE;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,iBAAiB,CAQrF;AAED;;6CAE6C;AAC7C,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE,CAE/D;AAED;;;8CAG8C;AAC9C,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,EAAE,MAAM,GACjB,iBAAiB,CAInB"}

package/dist/reference-field-map.js

@@ -3,6 +3,29 @@ export { readRefSlot, isRefSlot, hasDeclaredUse } from "./ref-slot.js";
 export function isRefEntry(entry) {
     return "refs" in entry;
 }
+/**
+ * True when a value at a ref slot satisfies one of the slot's VALUE branches —
+ * a storage class beside a `!ref`, so it is a value and not a malformed
+ * reference.
+ *
+ * One implementation, because BOTH reference passes have to narrow the same way:
+ * `validateReferenceForms` would otherwise call it a removed string reference,
+ * and `validateReferences` a reference missing `kind` and `name`. Two copies of
+ * the rule would eventually disagree about which of the two reported a value.
+ *
+ * A branch AJV cannot COMPILE is not a branch the value satisfies.
+ * `validateWithRefs` returns no issues for one — it swallows the compile failure
+ * by design, so one bad schema does not abort the pass — and reading that as
+ * "no issues, therefore a value" would switch the reference-form rule off for
+ * the slot silently. The uncompilable schema is reported on its own definition
+ * by `schemaCompileError`.
+ */
+export function satisfiesValueBranch(value, branches, registry) {
+    if (!branches?.length)
+        return false;
+    return branches.some((branch) => registry.schemaCompileError(branch) === undefined &&
+        registry.validateWithRefs(value, branch).length === 0);
+}
 export function isScopeEntry(entry) {
     return "scope" in entry;
 }
@@ -155,6 +178,8 @@ function traverseNode(node, path, map, root, visitedRefs = new Set()) {
             entry.useCases = slot.useCases;
         if (slot.inputs !== undefined)
             entry.inputs = slot.inputs;
+        if (slot.valueBranches.length > 0)
+            entry.valueBranches = slot.valueBranches;
         if (node["x-telo-context"])
             entry.context = node["x-telo-context"];
         if (slot.inline)

package/dist/referrer-rule.d.ts

@@ -35,6 +35,23 @@ export interface ReferrerRule {
      * relation the rule is about, so a kind should write it.
      */
     readonly referrer?: string;
+    /**
+     * JSON Pointer to a collection OF THE REFERRER to resolve — the binding that
+     * lets a rule state a relation between SIBLING declarations, which neither a
+     * resource rule (one resource) nor a plain referrer rule (a pair joined by one
+     * reference) can reach.
+     *
+     * Declaring it binds `peers` (the collection's OTHER entries) and `entry` (my
+     * own), and makes the rule evaluate once per entry rather than once per
+     * referrer: a rule reading `entry` is about the entry, and a resource listed
+     * twice has two entries to answer for.
+     *
+     * Entries bind AS WRITTEN with the references *inside them* resolved one level
+     * — `p` is the declaration where the entry is a bare `!ref`, `p.mount` is the
+     * declaration with `p.prefix` beside it where it is not. Nothing is guessed
+     * from the item schema and there is no second pointer to write.
+     */
+    readonly peers?: string;
     /** CEL source. TRUE when the rule holds. */
     readonly condition: string;
     /** The rule's own name, carried in `data.rule`. Never a diagnostic code —

package/dist/referrer-rule.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"referrer-rule.d.ts","sourceRoot":"","sources":["../src/referrer-rule.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAe,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE5E,eAAO,MAAM,yBAAyB,0BAA0B,CAAC;AAEjE,MAAM,WAAW,YAAY;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,4CAA4C;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;qEACiE;IACjE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAMD;;6CAE6C;AAC7C,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAG7D;AAED,uEAAuE;AACvE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,GAAG,YAAY,EAAE,CAwBjE;AAED;0EAC0E;AAC1E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAEvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GAC5C,IAAI,CAQN"}
+{"version":3,"file":"referrer-rule.d.ts","sourceRoot":"","sources":["../src/referrer-rule.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAe,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE5E,eAAO,MAAM,yBAAyB,0BAA0B,CAAC;AAEjE,MAAM,WAAW,YAAY;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,4CAA4C;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;qEACiE;IACjE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAMD;;6CAE6C;AAC7C,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAG7D;AAED,uEAAuE;AACvE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,GAAG,YAAY,EAAE,CA0BjE;AAED;0EAC0E;AAC1E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAEvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GAC5C,IAAI,CAQN"}

package/dist/referrer-rule.js

@@ -47,18 +47,21 @@ export function readReferrerRules(schema) {
         if (!isObject(entry))
             return;
         const condition = celSourceOf(entry.condition);
-        const { code, message, referrer } = entry;
+        const { code, message, referrer, peers } = entry;
         if (!condition || typeof code !== "string" || typeof message !== "string")
             return;
         if (code.length === 0 || message.length === 0)
             return;
         if (referrer !== undefined && typeof referrer !== "string")
             return;
+        if (peers !== undefined && typeof peers !== "string")
+            return;
         if (entry.severity !== undefined && entry.severity !== "warning" && entry.severity !== "error") {
             return;
         }
         rules.push({
             ...(referrer === undefined ? {} : { referrer }),
+            ...(peers === undefined ? {} : { peers }),
             condition,
             code,
             message,

package/dist/release/index.d.ts

@@ -2,7 +2,7 @@
  * The release model: module identity, fragments, the ledger, the edge graph,
  * level propagation and version planning.
  *
- * Browser-safe by construction — pure data in, plan out — so the telo editor can
+ * Browser-safe by construction — pure data in, plan out — so telo studio can
  * answer "what does changing this library bump?" from the same model the CLI
  * releases from. Everything Node-shaped (finding the workspace, running the
  * controller builder, building payloads, reading git, writing files) is

package/dist/release/index.js

@@ -2,7 +2,7 @@
  * The release model: module identity, fragments, the ledger, the edge graph,
  * level propagation and version planning.
  *
- * Browser-safe by construction — pure data in, plan out — so the telo editor can
+ * Browser-safe by construction — pure data in, plan out — so telo studio can
  * answer "what does changing this library bump?" from the same model the CLI
  * releases from. Everything Node-shaped (finding the workspace, running the
  * controller builder, building payloads, reading git, writing files) is