@telorun/analyzer 0.65.0 → 0.66.0

package/dist/validate-referrer-rules.d.ts

@@ -24,6 +24,8 @@
  */
 import type { ResourceManifest } from "@telorun/sdk";
 import { type ReferrerRule } from "./referrer-rule.js";
+import type { PeerBinder, PeerBindingFailure, PeersTarget } from "./peer-binding.js";
+import { type DynamicLeaf } from "./resource-rule.js";
 export interface ReferrerRuleIssue {
     code: "REFERRER_RULE_INVALID";
     manifest: ResourceManifest;
@@ -48,7 +50,12 @@ export type ReferrerRuleFinding = {
     kind: "skipped";
     rule: ReferrerRule;
     referrer: Referrer;
-    dynamicAt: string;
+    dynamic: DynamicLeaf;
+} | {
+    kind: "unbound";
+    rule: ReferrerRule;
+    referrer: Referrer;
+    failure: PeerBindingFailure;
 } | {
     kind: "failed";
     rule: ReferrerRule;
@@ -60,6 +67,28 @@ export type ReferrerRuleFinding = {
     referrer: Referrer;
     elapsedMs: number;
 };
+/** What a peer rule needs beyond the referrers themselves: the binder that
+ *  resolves a referrer's collection into declarations. Absent for a host that
+ *  cannot resolve one — a rule declaring `peers:` then reports as unbound rather
+ *  than running with the binding missing, which would evaluate a condition
+ *  against names that are simply not there.
+ *
+ *  ONE binder per analysis, because it caches each referrer's resolved
+ *  collection and both the evaluation and the exercised check ask for it. */
+export interface ReferrerRuleContext {
+    readonly peerBinder?: PeerBinder;
+}
+/** What a `peers:` pointer names in the referrer kind it is filtered to. Defined
+ *  with the binding vocabulary; re-exported here because this is the surface
+ *  that consumes it. The caller resolves it — only it holds the definition
+ *  registry, and only after every kind is registered, since a rule may name a
+ *  kind declared later in the same file. */
+export type { PeersTarget };
+export interface ReferrerRuleDeclarationContext {
+    /** Resolves a rule's `peers:` against its `referrer:` kind. Omit to skip the
+     *  check — the safe direction for a host with no registry. */
+    readonly peersTarget?: (referrerKind: string, pointer: string) => PeersTarget;
+}
 /**
  * Report every way a kind's referrer-rule declarations are malformed. Runs on
  * the `Telo.Definition` / `Telo.Abstract` doc, so a defect lands on the line the
@@ -69,7 +98,7 @@ export type ReferrerRuleFinding = {
  * declaring module's scope by `resolveSchemaRefKinds`, the only pass holding
  * that scope, and a name resolving to nothing is reported from there.
  */
-export declare function validateReferrerRuleDeclarations(manifest: ResourceManifest): ReferrerRuleIssue[];
+export declare function validateReferrerRuleDeclarations(manifest: ResourceManifest, context?: ReferrerRuleDeclarationContext): ReferrerRuleIssue[];
 /**
  * Run a kind's referrer rules against every resource that references one of its
  * resources.
@@ -79,16 +108,21 @@ export declare function validateReferrerRuleDeclarations(manifest: ResourceManif
  * manifest identity, since a name alone is module-scoped — because the condition
  * reads the two manifests and nothing about the site, so a second site could only
  * produce the identical verdict at a different path.
+ *
+ * **A rule declaring `peers:` is the exception, and evaluates once per ENTRY.**
+ * That is a deliberate departure from judge-once rather than an inconsistency: a
+ * rule that binds `entry` is about the entry, so a resource listed twice has two
+ * entries to answer for, and the two sites can genuinely disagree.
  */
 export declare function evaluateReferrerRules(manifest: ResourceManifest, definitionSchema: unknown, referrers: readonly Referrer[], 
 /** Whether a referrer of `kind` satisfies a rule's `referrer:` filter —
  *  Liskov-substitutable, so a child of the named kind matches. Supplied by the
  *  caller, which holds the definition registry. */
-kindMatches: (filter: string, kind: string) => boolean): ReferrerRuleFinding[];
+kindMatches: (filter: string, kind: string) => boolean, context?: ReferrerRuleContext): ReferrerRuleFinding[];
 /** Whether a rule found any referrer to judge — the input to the never-exercised
  *  report, which is how a mistyped `referrer:` filter would otherwise disable a
  *  check in silence. */
-export declare function referrerRuleExercised(rule: ReferrerRule, referrers: readonly Referrer[], kindMatches: (filter: string, kind: string) => boolean): boolean;
+export declare function referrerRuleExercised(rule: ReferrerRule, referrers: readonly Referrer[], kindMatches: (filter: string, kind: string) => boolean, context?: ReferrerRuleContext): boolean;
 /** Where a referrer-rule finding is reported, and how loudly. Plain data, so the
  *  caller pushes it exactly as it does for the resource-rule reports. */
 export interface ReferrerRuleDiagnostic {

package/dist/validate-referrer-rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-referrer-rules.d.ts","sourceRoot":"","sources":["../src/validate-referrer-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,oBAAoB,CAAC;AAI5B,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,+EAA+E;AAC/E,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kFAAkF;IAClF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,0CAA0C;AAC1C,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC9E;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC9E;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3E;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAMvF;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAAC,QAAQ,EAAE,gBAAgB,GAAG,iBAAiB,EAAE,CA2EhG;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,gBAAgB,EAC1B,gBAAgB,EAAE,OAAO,EACzB,SAAS,EAAE,SAAS,QAAQ,EAAE;AAC9B;;mDAEmD;AACnD,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,GACrD,mBAAmB,EAAE,CAmEvB;AAED;;wBAEwB;AACxB,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,YAAY,EAClB,SAAS,EAAE,SAAS,QAAQ,EAAE,EAC9B,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,GACrD,OAAO,CAIT;AAED;yEACyE;AACzE,MAAM,WAAW,sBAAsB;IACrC,IAAI,EACA,wBAAwB,GACxB,uBAAuB,GACvB,uBAAuB,GACvB,2BAA2B,CAAC;IAChC,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,aAAa,CAAC;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB;oEACgE;IAChE,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAKD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,gBAAgB,EAC1B,UAAU,EAAE,gBAAgB,GAAG,SAAS,EACxC,QAAQ,EAAE,SAAS,mBAAmB,EAAE;AACxC,0EAA0E;AAC1E,iBAAiB,EAAE,OAAO,GACzB,sBAAsB,EAAE,CAmE1B;AAED;;kDAEkD;AAClD,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,gBAAgB,EAC5B,IAAI,EAAE,YAAY,GACjB,sBAAsB,CAexB"}
+{"version":3,"file":"validate-referrer-rules.d.ts","sourceRoot":"","sources":["../src/validate-referrer-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrF,OAAO,EAGL,KAAK,WAAW,EAKjB,MAAM,oBAAoB,CAAC;AAQ5B,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,+EAA+E;AAC/E,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kFAAkF;IAClF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,0CAA0C;AAC1C,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC9E;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GACjF;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,kBAAkB,CAAA;CAAE,GACxF;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3E;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvF;;;;;;;6EAO6E;AAC7E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;CAClC;AAMD;;;;4CAI4C;AAC5C,YAAY,EAAE,WAAW,EAAE,CAAC;AAE5B,MAAM,WAAW,8BAA8B;IAC7C;kEAC8D;IAC9D,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,WAAW,CAAC;CAC/E;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,GAAE,8BAAmC,GAC3C,iBAAiB,EAAE,CAiFrB;AAuDD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,gBAAgB,EAC1B,gBAAgB,EAAE,OAAO,EACzB,SAAS,EAAE,SAAS,QAAQ,EAAE;AAC9B;;mDAEmD;AACnD,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,EACtD,OAAO,GAAE,mBAAwB,GAChC,mBAAmB,EAAE,CAyFvB;AAED;;wBAEwB;AACxB,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,YAAY,EAClB,SAAS,EAAE,SAAS,QAAQ,EAAE,EAC9B,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,EACtD,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAgBT;AAED;yEACyE;AACzE,MAAM,WAAW,sBAAsB;IACrC,IAAI,EACA,wBAAwB,GACxB,uBAAuB,GACvB,uBAAuB,GACvB,2BAA2B,CAAC;IAChC,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,aAAa,CAAC;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB;oEACgE;IAChE,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AA4BD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,gBAAgB,EAC1B,UAAU,EAAE,gBAAgB,GAAG,SAAS,EACxC,QAAQ,EAAE,SAAS,mBAAmB,EAAE;AACxC,0EAA0E;AAC1E,iBAAiB,EAAE,OAAO,GACzB,sBAAsB,EAAE,CAkF1B;AAED;;kDAEkD;AAClD,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,gBAAgB,EAC5B,IAAI,EAAE,YAAY,GACjB,sBAAsB,CAqBxB"}

package/dist/validate-referrer-rules.js

@@ -1,6 +1,6 @@
 import { REFERRER_RULES_ANNOTATION, readRawReferrerRules, readReferrerRules, } from "./referrer-rule.js";
-import { celSourceOf, findDynamicLeaf, readNodes } from "./resource-rule.js";
-import { RULE_BUDGET_MS, compileRuleCondition, conditionRefusals } from "./rule-condition.js";
+import { celSourceOf, findDynamicLeaf, isTaggedCondition, pointerSegments, pointerToPath, readNodes, } from "./resource-rule.js";
+import { RULE_BUDGET_MS, UNTAGGED_CONDITION, compileRuleCondition, conditionRefusals, } from "./rule-condition.js";
 function isObject(value) {
     return !!value && typeof value === "object" && !Array.isArray(value);
 }
@@ -13,7 +13,7 @@ function isObject(value) {
  * declaring module's scope by `resolveSchemaRefKinds`, the only pass holding
  * that scope, and a name resolving to nothing is reported from there.
  */
-export function validateReferrerRuleDeclarations(manifest) {
+export function validateReferrerRuleDeclarations(manifest, context = {}) {
     const own = manifest.schema;
     const raw = readRawReferrerRules(own);
     if (raw === undefined)
@@ -65,6 +65,10 @@ export function validateReferrerRuleDeclarations(manifest) {
         if (entry.severity !== undefined && entry.severity !== "error" && entry.severity !== "warning") {
             issue(`${at}.severity`, "'severity' must be 'error' or 'warning'.");
         }
+        if (condition !== undefined && condition.length > 0 && !isTaggedCondition(entry.condition)) {
+            issue(`${at}.condition`, UNTAGGED_CONDITION);
+        }
+        validatePeersDeclaration(entry, at, issue, context);
         if (condition) {
             for (const refusal of conditionRefusals(condition))
                 issue(`${at}.condition`, refusal);
@@ -72,6 +76,40 @@ export function validateReferrerRuleDeclarations(manifest) {
     });
     return issues;
 }
+/** The strict half of `peers:` — the binding that lets a rule reach a referrer's
+ *  OTHER entries, which is also the one that fails invisibly: a pointer naming a
+ *  collection nothing in resolves would leave the rule seeing no declaration at
+ *  all, and a check that never sees its subject reads as passing. */
+function validatePeersDeclaration(entry, at, issue, context) {
+    const { peers } = entry;
+    if (peers === undefined)
+        return;
+    if (typeof peers !== "string") {
+        issue(`${at}.peers`, "'peers' is a JSON Pointer naming a collection OF THE REFERRER (e.g. /tables), whose " +
+            "other entries bind as 'peers' and whose own entry binds as 'entry'.");
+        return;
+    }
+    if (pointerSegments(peers) === undefined || peers === "" || peers === "/") {
+        issue(`${at}.peers`, `'peers' must be a JSON Pointer to a collection, e.g. /tables — '${peers}' is not one.`);
+        return;
+    }
+    if (typeof entry.referrer !== "string" || entry.referrer.length === 0) {
+        issue(`${at}.peers`, "'peers' names a collection of the REFERRER, so the rule must also declare 'referrer:' — " +
+            "without a kind there is nothing to check the pointer against, and a pointer that " +
+            "resolves to nothing disables the rule in silence.");
+        return;
+    }
+    const target = context.peersTarget?.(entry.referrer, peers);
+    if (target === "absent") {
+        issue(`${at}.peers`, `'${entry.referrer}' declares no collection at '${peers}'. A pointer that resolves to ` +
+            "nothing binds no peers, so the rule would never see a sibling declaration.");
+    }
+    else if (target === "plain") {
+        issue(`${at}.peers`, `'${peers}' on '${entry.referrer}' holds plain data — nothing in it is a reference, so ` +
+            "no entry resolves to a declaration and the rule would run against values it cannot " +
+            "compare. Name a collection whose items are, or contain, a reference.");
+    }
+}
 /**
  * Run a kind's referrer rules against every resource that references one of its
  * resources.
@@ -81,19 +119,25 @@ export function validateReferrerRuleDeclarations(manifest) {
  * manifest identity, since a name alone is module-scoped — because the condition
  * reads the two manifests and nothing about the site, so a second site could only
  * produce the identical verdict at a different path.
+ *
+ * **A rule declaring `peers:` is the exception, and evaluates once per ENTRY.**
+ * That is a deliberate departure from judge-once rather than an inconsistency: a
+ * rule that binds `entry` is about the entry, so a resource listed twice has two
+ * entries to answer for, and the two sites can genuinely disagree.
  */
 export function evaluateReferrerRules(manifest, definitionSchema, referrers, 
 /** Whether a referrer of `kind` satisfies a rule's `referrer:` filter —
  *  Liskov-substitutable, so a child of the named kind matches. Supplied by the
  *  caller, which holds the definition registry. */
-kindMatches) {
+kindMatches, context = {}) {
     const rules = readReferrerRules(definitionSchema);
     if (rules.length === 0)
         return [];
     const self = manifest;
     const findings = [];
     for (const rule of rules) {
-        const compiled = compileRuleCondition(rule.condition, ["self", "referrer"]);
+        const perEntry = rule.peers !== undefined;
+        const compiled = compileRuleCondition(rule.condition, perEntry ? ["self", "referrer", "entry", "peers"] : ["self", "referrer"]);
         if ("reason" in compiled) {
             findings.push({ kind: "failed", rule, reason: compiled.reason });
             continue;
@@ -108,29 +152,46 @@ kindMatches) {
         for (const referrer of referrers) {
             if (rule.referrer !== undefined && !kindMatches(rule.referrer, referrer.kind))
                 continue;
-            if (seen.has(referrer.manifest))
-                continue;
-            seen.add(referrer.manifest);
+            if (!perEntry) {
+                if (seen.has(referrer.manifest))
+                    continue;
+                seen.add(referrer.manifest);
+            }
+            const scope = {
+                self,
+                referrer: referrer.manifest,
+            };
+            if (perEntry) {
+                const bound = context.peerBinder
+                    ? context.peerBinder.bind(referrer.manifest, referrer.kind, rule.peers, referrer.path)
+                    : {
+                        ok: false,
+                        failure: { reason: "unknown-shape", at: pointerToPath(rule.peers) },
+                    };
+                if (!bound.ok) {
+                    findings.push({ kind: "unbound", rule, referrer, failure: bound.failure });
+                    continue;
+                }
+                scope.peers = bound.binding.peers;
+                scope.entry = bound.binding.entry;
+            }
             // Only the nodes this condition READS decide whether it can run — the
             // resource-rule reasoning, and it bites harder here: the referrer is a
             // whole manifest, so scanning all of it would disable the rule for any
             // server carrying one unrelated expression.
-            let dynamicAt;
-            for (const node of readNodes(chains, {
-                self,
-                referrer: referrer.manifest,
-            })) {
-                dynamicAt = findDynamicLeaf(node);
-                if (dynamicAt !== undefined)
+            let dynamic;
+            for (const node of readNodes(chains, scope)) {
+                dynamic = findDynamicLeaf(node);
+                if (dynamic !== undefined)
                     break;
             }
-            if (dynamicAt !== undefined) {
-                findings.push({ kind: "skipped", rule, referrer, dynamicAt });
+            if (dynamic !== undefined) {
+                findings.push({ kind: "skipped", rule, referrer, dynamic });
                 continue;
             }
             let held;
             try {
-                held = parsed({ self, referrer: referrer.manifest });
+                held = parsed(scope);
             }
             catch (err) {
                 findings.push({
@@ -156,11 +217,38 @@ kindMatches) {
 /** Whether a rule found any referrer to judge — the input to the never-exercised
  *  report, which is how a mistyped `referrer:` filter would otherwise disable a
  *  check in silence. */
-export function referrerRuleExercised(rule, referrers, kindMatches) {
-    if (rule.referrer === undefined)
-        return referrers.length > 0;
-    const filter = rule.referrer;
-    return referrers.some((referrer) => kindMatches(filter, referrer.kind));
+export function referrerRuleExercised(rule, referrers, kindMatches, context = {}) {
+    const matching = rule.referrer === undefined
+        ? referrers
+        : referrers.filter((referrer) => kindMatches(rule.referrer, referrer.kind));
+    if (matching.length === 0)
+        return false;
+    if (rule.peers === undefined)
+        return true;
+    // A peer rule that ran against an EMPTY peer set proved nothing — and an empty
+    // set everywhere is exactly what a typo in `peers:` looks like from outside,
+    // which is silence that reads as passing. Asked through the binder, so it
+    // shares the resolution the evaluation already paid for.
+    const binder = context.peerBinder;
+    if (!binder)
+        return false;
+    return matching.some((referrer) => binder.hasPeers(referrer.manifest, referrer.kind, rule.peers, referrer.path));
+}
+/** Why a peer binding could not be produced, as the sentence a reader acts on. */
+function peerBindingReason(failure) {
+    switch (failure.reason) {
+        case "no-collection":
+            return `'${failure.at}' holds no collection to bind 'peers' from.`;
+        case "unresolved":
+            return (`a reference at '${failure.at}' names a declaration this analysis does not hold, ` +
+                "so a peer would bind to nothing.");
+        case "dynamic":
+            return (`a value at '${failure.at}' holds ${failure.what ?? "a value"}, which is not known ` +
+                "until the resource is created, so the comparison would run against a placeholder.");
+        case "unknown-shape":
+            return (`which paths under '${failure.at}' hold references is not known here, so nothing ` +
+                "could be resolved into a declaration.");
+    }
 }
 const nameOf = (manifest) => manifest.metadata?.name ?? "<unnamed>";
 /**
@@ -196,8 +284,8 @@ declarationIsOurs) {
                 severity: "information",
                 message: `${finding.referrer.kind}/${nameOf(finding.referrer.manifest)}: rule ` +
                     `'${finding.rule.code}' from ${declaringKind} did not run at ` +
-                    `'${finding.referrer.path}' — the value holds a CEL expression at ` +
-                    `'${finding.dynamicAt}', which is not known until the resource is created. ` +
+                    `'${finding.referrer.path}' — the value holds ${finding.dynamic.what} at ` +
+                    `'${finding.dynamic.path}', which is not known until the resource is created. ` +
                     "Reported rather than dropped: a check whose coverage varies invisibly reads as passing.",
                 manifest: finding.referrer.manifest,
                 path: finding.referrer.path,
@@ -205,6 +293,20 @@ declarationIsOurs) {
             });
             continue;
         }
+        if (finding.kind === "unbound") {
+            out.push({
+                code: "REFERRER_RULE_SKIPPED",
+                severity: "information",
+                message: `${finding.referrer.kind}/${nameOf(finding.referrer.manifest)}: rule ` +
+                    `'${finding.rule.code}' from ${declaringKind} did not run at ` +
+                    `'${finding.referrer.path}' — ${peerBindingReason(finding.failure)}` +
+                    " Reported rather than dropped: a check whose coverage varies invisibly reads as passing.",
+                manifest: finding.referrer.manifest,
+                path: finding.referrer.path,
+                rule: finding.rule.code,
+            });
+            continue;
+        }
         const because = finding.kind === "failed"
             ? `failed to evaluate: ${finding.reason}. Guard an optional field with 'in' or '.?'.`
             : `exceeded its evaluation budget (${finding.elapsedMs}ms) and was stopped, so ` +
@@ -242,12 +344,18 @@ export function reportUnexercisedReferrerRule(definition, rule) {
     return {
         code: "REFERRER_RULE_UNEXERCISED",
         severity: "information",
-        message: `Referrer rule '${rule.code}' never ran: nothing` +
-            (rule.referrer === undefined ? "" : ` of kind '${rule.referrer}'`) +
-            " references a resource of this kind, so nothing has proven the condition." +
-            (rule.referrer === undefined
-                ? ""
-                : " A 'referrer' naming a kind no manifest uses disables the rule in silence."),
+        message: rule.peers !== undefined
+            ? `Referrer rule '${rule.code}' never ran with peers to compare: nothing` +
+                (rule.referrer === undefined ? "" : ` of kind '${rule.referrer}'`) +
+                ` references a resource of this kind while '${rule.peers}' held another ` +
+                "declaration, so nothing has proven the condition. An empty peer set " +
+                "everywhere is what a typo in 'peers:' looks like from outside."
+            : `Referrer rule '${rule.code}' never ran: nothing` +
+                (rule.referrer === undefined ? "" : ` of kind '${rule.referrer}'`) +
+                " references a resource of this kind, so nothing has proven the condition." +
+                (rule.referrer === undefined
+                    ? ""
+                    : " A 'referrer' naming a kind no manifest uses disables the rule in silence."),
         manifest: definition,
         path: `schema.${REFERRER_RULES_ANNOTATION}[${rule.index}]`,
         rule: rule.code,

package/dist/validate-resource-rules.d.ts

@@ -22,7 +22,7 @@
  * Browser-safe: no Node built-ins.
  */
 import type { ResourceManifest } from "@telorun/sdk";
-import { type ResourceRule } from "./resource-rule.js";
+import { type DynamicLeaf, type ResourceRule } from "./resource-rule.js";
 /** Published name for the shared budget — see `rule-condition.ts`. */
 export declare const RESOURCE_RULE_BUDGET_MS = 50;
 export interface ResourceRuleIssue {
@@ -42,7 +42,7 @@ export type ResourceRuleFinding = {
     kind: "skipped";
     rule: ResourceRule;
     path: string;
-    dynamicAt: string;
+    dynamic: DynamicLeaf;
 } | {
     kind: "failed";
     rule: ResourceRule;
@@ -54,6 +54,15 @@ export type ResourceRuleFinding = {
     path: string;
     elapsedMs: number;
 };
+/** Navigate a kind's own schema to the node describing what a pointer names, so
+ *  an `in:` naming a field the kind does not declare is caught at the kind.
+ *  Exported because the peer-rule strict half asks the same question of the
+ *  REFERRER's schema, and two navigators would eventually disagree about what a
+ *  pointer names. */
+export declare function schemaAtPointer(schema: unknown, pointer: string): unknown;
+/** True when a schema node describes something a rule can iterate. Unknown or
+ *  absent `type` passes: an open schema is not evidence of a defect. */
+export declare function isIterableSchema(node: unknown): boolean;
 /**
  * Report every way a kind's rule declarations are malformed. Runs on the
  * `Telo.Definition` / `Telo.Abstract` doc, so a defect lands on the line the

package/dist/validate-resource-rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-resource-rules.d.ts","sourceRoot":"","sources":["../src/validate-resource-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,EASL,KAAK,YAAY,EAClB,MAAM,oBAAoB,CAAC;AAE5B,sEAAsE;AACtE,eAAO,MAAM,uBAAuB,KAAiB,CAAC;AAEtD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,0CAA0C;AAC1C,MAAM,MAAM,mBAAmB,GAC3B;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,YAAY,CAAC;IACnB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB,GACD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACxE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAmCjF;;;;GAIG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,gBAAgB;AAC1B;;;;;;;;;GASG;AACH,eAAe,CAAC,EAAE,OAAO,GACxB,iBAAiB,EAAE,CA+FrB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,gBAAgB,EAC1B,gBAAgB,EAAE,OAAO,GACxB,mBAAmB,EAAE,CA4DvB;AAED;iFACiF;AACjF,wBAAgB,aAAa,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAIrF;AAED;;gFAEgF;AAChF,MAAM,WAAW,sBAAsB;IACrC,IAAI,EACA,wBAAwB,GACxB,uBAAuB,GACvB,uBAAuB,GACvB,2BAA2B,CAAC;IAChC,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,aAAa,CAAC;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB;+EAC2E;IAC3E,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,gBAAgB,EAC1B,UAAU,EAAE,gBAAgB,GAAG,SAAS,EACxC,QAAQ,EAAE,SAAS,mBAAmB,EAAE;AACxC,0EAA0E;AAC1E,iBAAiB,EAAE,OAAO,GACzB,sBAAsB,EAAE,CA2D1B;AAED;+CAC+C;AAC/C,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,gBAAgB,EAC5B,IAAI,EAAE,YAAY,GACjB,sBAAsB,CAYxB"}
+{"version":3,"file":"validate-resource-rules.d.ts","sourceRoot":"","sources":["../src/validate-resource-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAOrD,OAAO,EAIL,KAAK,WAAW,EAOhB,KAAK,YAAY,EAClB,MAAM,oBAAoB,CAAC;AAE5B,sEAAsE;AACtE,eAAO,MAAM,uBAAuB,KAAiB,CAAC;AAEtD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,0CAA0C;AAC1C,MAAM,MAAM,mBAAmB,GAC3B;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,YAAY,CAAC;IACnB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB,GACD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GAC3E;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAMjF;;;;qBAIqB;AACrB,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAezE;AAED;wEACwE;AACxE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAMvD;AAED;;;;GAIG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,gBAAgB;AAC1B;;;;;;;;;GASG;AACH,eAAe,CAAC,EAAE,OAAO,GACxB,iBAAiB,EAAE,CAmGrB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,gBAAgB,EAC1B,gBAAgB,EAAE,OAAO,GACxB,mBAAmB,EAAE,CA4DvB;AAED;iFACiF;AACjF,wBAAgB,aAAa,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAIrF;AAED;;gFAEgF;AAChF,MAAM,WAAW,sBAAsB;IACrC,IAAI,EACA,wBAAwB,GACxB,uBAAuB,GACvB,uBAAuB,GACvB,2BAA2B,CAAC;IAChC,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,aAAa,CAAC;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB;+EAC2E;IAC3E,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,gBAAgB,EAC1B,UAAU,EAAE,gBAAgB,GAAG,SAAS,EACxC,QAAQ,EAAE,SAAS,mBAAmB,EAAE;AACxC,0EAA0E;AAC1E,iBAAiB,EAAE,OAAO,GACzB,sBAAsB,EAAE,CA2D1B;AAED;+CAC+C;AAC/C,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,gBAAgB,EAC5B,IAAI,EAAE,YAAY,GACjB,sBAAsB,CAYxB"}

package/dist/validate-resource-rules.js

@@ -1,13 +1,16 @@
-import { RULE_BUDGET_MS, compileRuleCondition, conditionRefusals } from "./rule-condition.js";
-import { RESOURCE_RULES_ANNOTATION, celSourceOf, findDynamicLeaf, pointerSegments, readRawResourceRules, readResourceRules, readNodes, resolveRuleSubjects, } from "./resource-rule.js";
+import { RULE_BUDGET_MS, UNTAGGED_CONDITION, compileRuleCondition, conditionRefusals, } from "./rule-condition.js";
+import { RESOURCE_RULES_ANNOTATION, celSourceOf, findDynamicLeaf, isTaggedCondition, pointerSegments, readRawResourceRules, readResourceRules, readNodes, resolveRuleSubjects, } from "./resource-rule.js";
 /** Published name for the shared budget — see `rule-condition.ts`. */
 export const RESOURCE_RULE_BUDGET_MS = RULE_BUDGET_MS;
 function isObject(value) {
     return !!value && typeof value === "object" && !Array.isArray(value);
 }
 /** Navigate a kind's own schema to the node describing what a pointer names, so
- *  an `in:` naming a field the kind does not declare is caught at the kind. */
-function schemaAtPointer(schema, pointer) {
+ *  an `in:` naming a field the kind does not declare is caught at the kind.
+ *  Exported because the peer-rule strict half asks the same question of the
+ *  REFERRER's schema, and two navigators would eventually disagree about what a
+ *  pointer names. */
+export function schemaAtPointer(schema, pointer) {
     const segments = pointerSegments(pointer);
     if (!segments)
         return undefined;
@@ -27,7 +30,7 @@ function schemaAtPointer(schema, pointer) {
 }
 /** True when a schema node describes something a rule can iterate. Unknown or
  *  absent `type` passes: an open schema is not evidence of a defect. */
-function isIterableSchema(node) {
+export function isIterableSchema(node) {
     if (!isObject(node))
         return true;
     const type = node.type;
@@ -121,6 +124,9 @@ effectiveSchema) {
                 }
             }
         }
+        if (condition !== undefined && condition.length > 0 && !isTaggedCondition(entry.condition)) {
+            issue(`${at}.condition`, UNTAGGED_CONDITION);
+        }
         if (condition) {
             for (const refusal of conditionRefusals(condition))
                 issue(`${at}.condition`, refusal);
@@ -159,14 +165,14 @@ export function evaluateResourceRules(manifest, definitionSchema) {
             // Only the nodes this condition READS decide whether it can run — see
             // `readNodes`. Scanning the whole subject would disable every
             // resource-wide rule on any manifest containing one unrelated expression.
-            let dynamicAt;
+            let dynamic;
             for (const node of readNodes(chains, { self, this: subject.value })) {
-                dynamicAt = findDynamicLeaf(node);
-                if (dynamicAt !== undefined)
+                dynamic = findDynamicLeaf(node);
+                if (dynamic !== undefined)
                     break;
             }
-            if (dynamicAt !== undefined) {
-                findings.push({ kind: "skipped", rule, path: subject.path, dynamicAt });
+            if (dynamic !== undefined) {
+                findings.push({ kind: "skipped", rule, path: subject.path, dynamic });
                 continue;
             }
             let held;
@@ -239,8 +245,8 @@ declarationIsOurs) {
                 code: "RESOURCE_RULE_SKIPPED",
                 severity: "information",
                 message: `${manifest.kind}/${name}: rule '${finding.rule.code}' did not run` +
-                    `${at ? ` at '${at}'` : ""} — the value holds a CEL expression at ` +
-                    `'${finding.dynamicAt}', which is not known until the resource is created. ` +
+                    `${at ? ` at '${at}'` : ""} — the value holds ${finding.dynamic.what} at ` +
+                    `'${finding.dynamic.path}', which is not known until the resource is created. ` +
                     "Reported rather than dropped: a check whose coverage varies invisibly reads as passing.",
                 manifest,
                 path: at,

package/dist/validate-schema-projection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-schema-projection.d.ts","sourceRoot":"","sources":["../src/validate-schema-projection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAQrD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,2BAA2B,GAAG,uBAAuB,CAAC;IAC5D,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAQD,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,qBAAqB,EAAE,CA2G5F"}
+{"version":3,"file":"validate-schema-projection.d.ts","sourceRoot":"","sources":["../src/validate-schema-projection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AASrD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,2BAA2B,GAAG,uBAAuB,CAAC;IAC5D,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAQD,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,qBAAqB,EAAE,CAqJ5F"}

package/dist/validate-schema-projection.js

@@ -1,4 +1,4 @@
-import { projectionKeyMap, rawSchemaProjection, readSchemaProjection, schemaProjectionIsMisplaced, } from "./schema-projection.js";
+import { projectionKeyMap, rawSchemaProjection, readSchemaProjection, schemaMapBranch, schemaProjectionIsMisplaced, } from "./schema-projection.js";
 const PROJECTION = "x-telo-schema-projection";
 function isObject(value) {
     return !!value && typeof value === "object" && !Array.isArray(value);
@@ -52,6 +52,30 @@ export function validateSchemaProjection(manifest) {
                 `entry's identity — without it the projection yields a schema that rejects every value.`),
         ];
     }
+    const reference = raw.reference;
+    if (reference !== undefined) {
+        if (!isObject(reference)) {
+            issues.push(issue("SCHEMA_PROJECTION_INVALID", `${base}.reference`, `'reference' says how an entry whose '${projection.key}' holds a REFERENCE projects. ` +
+                `It is an object naming 'from' (the target field to read), 'keyword' (the schema ` +
+                `keyword its values become) and one of 'base' / 'baseFrom'.`));
+        }
+        else {
+            const absent = ["from", "keyword"].filter((f) => typeof reference[f] !== "string");
+            if (absent.length > 0) {
+                issues.push(issue("SCHEMA_PROJECTION_INVALID", `${base}.reference`, `'reference' is missing ${absent.map((f) => `'${f}'`).join(" and ")}. Without them a ` +
+                    `referenced entry projects to nothing, so it vanishes from every consumer's view.`));
+            }
+            const bases = ["base", "baseFrom"].filter((f) => reference[f] !== undefined);
+            if (bases.length !== 1) {
+                issues.push(issue("SCHEMA_PROJECTION_INVALID", `${base}.reference`, bases.length === 0
+                    ? `'reference' declares neither 'base' nor 'baseFrom', so the projected node has no ` +
+                        `type. Write 'base' where the named type IS its own base type, or 'baseFrom' ` +
+                        `naming the target field that holds a value of this kind's own map.`
+                    : `'reference' declares both 'base' and 'baseFrom'. They are two answers to one ` +
+                        `question — where the projected node's type comes from — so declare exactly one.`));
+            }
+        }
+    }
     const map = projectionKeyMap(schema, projection);
     if (!map) {
         return [
@@ -106,5 +130,12 @@ function keySchema(schema, entries, key) {
     if (!isObject(entry) || !isObject(entry.properties))
         return undefined;
     const field = entry.properties[key];
-    return isObject(field) ? field : undefined;
+    if (!isObject(field))
+        return undefined;
+    // The vocabulary may sit on a BRANCH — a slot unioning a closed value set with
+    // a reference — and the branch carrying the map is the one whose `enum` the map
+    // has to answer for. Reading the union node instead finds no `enum` at all, so
+    // the completeness check would silently stop running exactly where the two
+    // halves can disagree. Asked through the single reader, never re-derived here.
+    return schemaMapBranch(field) ?? field;
 }

package/dist/with-synthetic-positions.d.ts

@@ -8,7 +8,7 @@ import type { ResourceManifest } from "@telorun/sdk";
  * manifest (the dedup that backs `DUPLICATE_RESOURCE_NAME` reads
  * `(source, sourceLine)` to distinguish pipeline echoes from real
  * collisions). Production callers — the `Loader`, `flattenForAnalyzer`,
- * the telo-editor's `emitDocsFor`, the VSCode extension — all stamp
+ * telo studio's `emitDocsFor`, the VSCode extension — all stamp
  * positions already. This helper is the escape hatch for **programmatic
  * callers** (tests, ad-hoc scripts) that construct `ResourceManifest`
  * literals without going through a loader: it gives every otherwise-naked

package/dist/with-synthetic-positions.js

@@ -8,7 +8,7 @@ import { REF_VALIDATION_SKIP_KINDS } from "./system-kinds.js";
  * manifest (the dedup that backs `DUPLICATE_RESOURCE_NAME` reads
  * `(source, sourceLine)` to distinguish pipeline echoes from real
  * collisions). Production callers — the `Loader`, `flattenForAnalyzer`,
- * the telo-editor's `emitDocsFor`, the VSCode extension — all stamp
+ * telo studio's `emitDocsFor`, the VSCode extension — all stamp
  * positions already. This helper is the escape hatch for **programmatic
  * callers** (tests, ad-hoc scripts) that construct `ResourceManifest`
  * literals without going through a loader: it gives every otherwise-naked

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.65.0",
+  "version": "0.66.0",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",
@@ -43,13 +43,13 @@
     "jsonpath-plus": "^10.3.0",
     "packageurl-js": "^2.0.1",
     "yaml": "^2.8.3",
-    "@telorun/templating": "0.16.0"
+    "@telorun/templating": "0.17.0"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",
     "typescript": "^5.0.0",
     "vitest": "^2.1.8",
-    "@telorun/sdk": "0.82.0"
+    "@telorun/sdk": "0.82.1"
   },
   "peerDependencies": {
     "@telorun/sdk": "*"