@telorun/analyzer 0.65.0 → 0.67.0

package/dist/analyzer.d.ts

@@ -33,7 +33,7 @@ export declare class StaticAnalyzer {
      * `DUPLICATE_RESOURCE_NAME` reads those fields to tell a pipeline echo
      * apart from a genuine collision, and downstream diagnostic positioning
      * depends on them too. Real callers stamp positions already (the `Loader`,
-     * `flattenForAnalyzer`, the telo-editor's `emitDocsFor`, the VSCode
+     * `flattenForAnalyzer`, telo studio's `emitDocsFor`, the VSCode
      * extension). Programmatic callers — tests, ad-hoc scripts — should pass
      * their inputs through `withSyntheticPositions(...)` before calling
      * `analyze()`. A missing position throws a clear error rather than

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAiBzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AA8B9B,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAWvF,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAoDjE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA2F/F;0CAC0C;AAC1C,eAAO,MAAM,eAAe,GAAI,OAAO;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OACT,CAAC;AAErD;8EAC8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhD;AAqUD,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACtC;AA6DD,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAkFD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAqxDvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAyBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAiBzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AA8B9B,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAWvF,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAwDjE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAkG/F;0CAC0C;AAC1C,eAAO,MAAM,eAAe,GAAI,OAAO;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OACT,CAAC;AAErD;8EAC8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhD;AAqUD,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACtC;AA6DD,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAkFD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IA+6DvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAyBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -1,7 +1,7 @@
 import { canonicalTypeSchemaId, OBSERVED_STATE_KEY } from "@telorun/sdk";
 import { defaultRegistry, isRefSentinel, isTaggedSentinel, plainChainOf, } from "@telorun/templating";
 import { AliasResolver, scopeResolverForModule, } from "./alias-resolver.js";
-import { buildCelEnvironment, } from "./cel-environment.js";
+import { buildCelEnvironment, isKindDocument, } from "./cel-environment.js";
 import { DefinitionRegistry } from "./definition-registry.js";
 import { effectiveAuthorSchema } from "./extends-resolution.js";
 import { analyzerContractScope, resolveContract, } from "./invocation-contract.js";
@@ -30,10 +30,11 @@ export { analyzerContractScope } from "./invocation-contract.js";
 import { validateZoneSlotDeclarations } from "./validate-zone-slots.js";
 import { validateSchemaProjection, } from "./validate-schema-projection.js";
 import { evaluateResourceRules, reportResourceRules, reportUnexercisedRule, ruleExercised, validateResourceRuleDeclarations, } from "./validate-resource-rules.js";
-import { readResourceRules } from "./resource-rule.js";
+import { pointerToPath, readResourceRules } from "./resource-rule.js";
 import { readReferrerRules } from "./referrer-rule.js";
 import { evaluateReferrerRules, referrerRuleExercised, reportReferrerRules, reportUnexercisedReferrerRule, validateReferrerRuleDeclarations, } from "./validate-referrer-rules.js";
-import { describeProjectionFailure, } from "./schema-projection.js";
+import { analyzerPeerBinder, analyzerPeersTarget } from "./peer-binding.js";
+import { describeProjectionFailure, manifestListScope, resolveSchemaProjections, } from "./schema-projection.js";
 import { validateDynamicSelectors, validateRefSlotDeclarations, } from "./validate-ref-slots.js";
 import { validateValueTypeSlots, } from "./validate-value-type-slots.js";
 import { resolveSchemaTypeRefs } from "./resolve-schema-type-refs.js";
@@ -42,8 +43,8 @@ import { rewriteSyntheticOrigins } from "./rewrite-synthetic-origins.js";
 import { celTypeSatisfiesJsonSchema, checkSchemaCompatibility, navigateSchemaToExprPath, substituteCelFields, validateAgainstSchema, } from "./schema-compat.js";
 import { collectValueSchemaIssues } from "./validate-value-schema.js";
 import { DiagnosticSeverity } from "./types.js";
-import { extractAccessChains, extractCelRegionScopes, pathMatchesScope, } from "./validate-cel-context.js";
-import { buildEvalPaths, evalPathsCover } from "./eval-paths.js";
+import { extractAccessChains, } from "./validate-cel-context.js";
+import { celEvalModeAt, celEvalSites, mergeCelEvalSites, NO_CEL_EVAL_SITES, } from "./eval-paths.js";
 import { BINDINGS_ANNOTATION, findBindingSites, resolveBindingOrder, } from "./cel-bindings.js";
 import { CEL_RESERVED_WORDS, checkName } from "./identifier-name.js";
 import { validateIdentifierNames } from "./validate-identifier-names.js";
@@ -58,8 +59,11 @@ import { validateInvocationContract } from "./validate-invocation-contract.js";
 import { collectRefInputIssues, collectStepInputIssues } from "./validate-step-inputs.js";
 import { validateNestedInlineResources } from "./validate-nested-inline.js";
 import { validateProviderCoherence } from "./validate-provider-coherence.js";
-import { validateReferences } from "./validate-references.js";
+import { kindSatisfies, validateReferences } from "./validate-references.js";
 import { validateReferenceForms } from "./validate-reference-forms.js";
+import { isInjectedDeclaration } from "./resource-input.js";
+import { validateResourceInputs } from "./validate-resource-inputs.js";
+import { validateTemplateDispatch } from "./validate-template-dispatch.js";
 import { validateUnusedDeclarations } from "./validate-unused-declarations.js";
 import { validateThrowsCoverage } from "./validate-throws-coverage.js";
 import { readStepSlot } from "./step-slot.js";
@@ -554,7 +558,7 @@ export class StaticAnalyzer {
      * `DUPLICATE_RESOURCE_NAME` reads those fields to tell a pipeline echo
      * apart from a genuine collision, and downstream diagnostic positioning
      * depends on them too. Real callers stamp positions already (the `Loader`,
-     * `flattenForAnalyzer`, the telo-editor's `emitDocsFor`, the VSCode
+     * `flattenForAnalyzer`, telo studio's `emitDocsFor`, the VSCode
      * extension). Programmatic callers — tests, ad-hoc scripts — should pass
      * their inputs through `withSyntheticPositions(...)` before calling
      * `analyze()`. A missing position throws a clear error rather than
@@ -776,6 +780,11 @@ export class StaticAnalyzer {
         const projectionIssues = [];
         const resourceRuleIssues = [];
         const referrerRuleIssues = [];
+        /** Definition docs of the entry's own modules that may declare rules. Their
+         *  referrer-rule declarations are checked after every kind is registered,
+         *  because a `peers:` pointer is checked against the REFERRER kind's schema
+         *  and that kind may be declared later in the same file. */
+        const ownRuleDeclarers = [];
         // A rule that never had anything to iterate is never proven — the second way
         // coverage varies invisibly, beside the dynamic-leaf skip. Tracked across the
         // whole run and reported once, since "empty on every resource" is not a fact
@@ -822,7 +831,10 @@ export class StaticAnalyzer {
                 // inherited field resolves — which is what lets a rule shared by every
                 // backend be declared once on the abstract they extend.
                 resourceRuleIssues.push(...validateResourceRuleDeclarations(m, effectiveAuthorSchema(m, (k) => defs.resolve(aliases.resolveKind(k) ?? k) ?? defs.resolve(k))));
-                referrerRuleIssues.push(...validateReferrerRuleDeclarations(m));
+                // Deferred to after the registration loop: the `peers:` half is checked
+                // against the REFERRER kind's schema, and a rule may name a kind
+                // declared later in the same file.
+                ownRuleDeclarers.push(m);
                 for (const rule of readReferrerRules(m.schema)) {
                     referrerRuleExercise.set(`${m.metadata?.module}.${m.metadata?.name}#${rule.code}`, {
                         manifest: m,
@@ -873,6 +885,23 @@ export class StaticAnalyzer {
                 : def;
             defs.register(normalized);
         }
+        /**
+         * What a peer rule's `peers:` pointer names in the kind its `referrer:`
+         * filters to.
+         *
+         * Liskov in BOTH directions, which is what the check has to be: the filter
+         * is usually an abstract (`Sql.Schema`, so one rule serves every backend)
+         * while the collection is declared by the backends that implement it, so a
+         * pointer resolving on any candidate resolves the rule. Reported only when
+         * NO candidate declares it, or when every candidate that does holds plain
+         * data — the two shapes where the rule would see no declaration at all.
+         */
+        const peersTarget = analyzerPeersTarget(defs);
+        if (!options?.skipValidation) {
+            for (const declarer of ownRuleDeclarers) {
+                referrerRuleIssues.push(...validateReferrerRuleDeclarations(declarer, { peersTarget }));
+            }
+        }
         // Reference-form validation — enforce `!ref` as the only reference shape.
         // Runs on the RAW manifests, BEFORE inline extraction and sentinel
         // resolution, while an author-written `{kind, name}` is still
@@ -1277,13 +1306,12 @@ export class StaticAnalyzer {
         if (options?.skipValidation) {
             return suppressUnreadableModuleDiagnostics(diagnostics, unreadableFiles);
         }
-        // Build a name→manifest map for looking up referenced resources
-        const byName = new Map();
-        for (const m of allManifests) {
-            if (m.metadata?.name) {
-                byName.set(m.metadata.name, m);
-            }
-        }
+        // ONE binder for the whole run, built beside the binding it serves: it caches
+        // each referrer's resolved collection, which is what keeps a rule over an
+        // n-entry collection from re-resolving that collection once per entry.
+        const referrerRuleContext = {
+            peerBinder: analyzerPeerBinder(defs, aliases, allManifests),
+        };
         // Fail loud on definition schemas AJV cannot compile. `validateAgainstSchema`
         // and `validateWithRefs` swallow compile failures (returning no issues),
         // which would silently skip schema validation for every resource of that
@@ -1374,6 +1402,17 @@ export class StaticAnalyzer {
         const runReachable = reportsObservedState
             ? collectRunReachableNames(getCallGraph())
             : new Set();
+        // "Nothing starts this" is DECLARATION-derived, and a library does not
+        // declare its injected inputs — whether the application starts the instance
+        // it hands down is answerable only where that instance is declared. Inside
+        // the library the question has no answer, so the name is treated as
+        // reachable rather than reported on a `targets:` list the author cannot
+        // write. The check still runs at the injection site, against the real
+        // declaration.
+        for (const m of allManifests) {
+            if (isInjectedDeclaration(m))
+                runReachable.add(m.metadata?.name);
+        }
         // Build typed kernel globals schema so x-telo-context chain validation
         // recognises variables, secrets, resources, env automatically
         const kernelGlobals = buildKernelGlobalsIndex(allManifests, observedState);
@@ -1420,6 +1459,44 @@ export class StaticAnalyzer {
             moduleManifest,
             observedStateContext,
         });
+        /**
+         * The schema a resource of this kind is validated against, per DEFINITION.
+         *
+         * Both halves derive a fresh object — `effectiveAuthorSchema` merges along
+         * `extends`, and the closed-schema branch spreads `kind` / `metadata` in —
+         * so asking per resource handed `validateResourceConfig` a schema object it
+         * had never seen. That registry memoizes its compiled AJV validator by
+         * object IDENTITY, precisely because every resource of a kind is checked
+         * against the same one at keystroke time, so a fresh object per resource
+         * recompiled the whole kind schema per resource. Keyed on the definition,
+         * which is stable for the run.
+         */
+        const authorSchemaCache = new WeakMap();
+        const validationSchemaFor = (def) => {
+            const cached = authorSchemaCache.get(def);
+            if (cached)
+                return cached;
+            const authorSchema = effectiveAuthorSchema(def, (k) => defs.resolve(aliases.resolveKind(k) ?? k) ?? defs.resolve(k));
+            // `kind` and `metadata` are implicit on every resource — inject them so
+            // module authors don't have to repeat them under `additionalProperties:
+            // false`.
+            const schema = authorSchema.additionalProperties === false
+                ? {
+                    ...authorSchema,
+                    properties: {
+                        kind: { type: "string" },
+                        metadata: { type: "object" },
+                        ...authorSchema.properties,
+                    },
+                }
+                : authorSchema;
+            authorSchemaCache.set(def, schema);
+            return schema;
+        };
+        // One scope for the whole run: it closes over the manifest list and the
+        // registry, neither of which changes per resource, and it is asked once per
+        // schema-valued slot that carries a projection.
+        const resourceProjectionScope = manifestListScope(allManifests, (kind) => (defs.resolve(kind) ?? defs.resolve(aliases.resolveKind(kind) ?? kind)));
         // Validate each non-definition, non-system resource
         for (const m of allManifests) {
             const filePath = m.metadata?.source;
@@ -1448,6 +1525,15 @@ export class StaticAnalyzer {
             if (m.metadata?.forwardedExport === true) {
                 continue;
             }
+            // A kind-only stand-in for a `resources:` entry is a DECLARATION, not an
+            // instantiation: its kind is routinely an abstract and its configuration
+            // is the importer's to supply, so validating it here would report a
+            // non-instantiable kind and a page of missing required fields against a
+            // block that is correct. Its kind is checked where it was written, by
+            // `validate-resource-inputs`; it participates here only as a resolution
+            // target and as a CEL type.
+            if (isInjectedDeclaration(m))
+                continue;
             const resource = { kind: m.kind, name: m.metadata?.name };
             // Resolve kind through alias if needed; direct lookup takes priority so that
             // aliases whose name matches the module name (the common case) work without
@@ -1510,34 +1596,53 @@ export class StaticAnalyzer {
                 continue;
             }
             // Validate resource config against the definition's AUTHOR-FACING schema —
-            // inheritance-resolved: with `base:` the child's own schema (parent config
-            // is internal), else `merge(parent, own)` so a `base:`-less `extends` child
-            // is validated against the inherited fields it may set. For a definition
-            // that neither extends nor uses `base:` this is exactly its own schema.
-            // `kind` and `metadata` are implicit on every resource — inject them so module
-            // authors don't have to repeat them when using additionalProperties: false.
-            const authorSchema = effectiveAuthorSchema(definition, (k) => defs.resolve(aliases.resolveKind(k) ?? k) ?? defs.resolve(k));
-            if (authorSchema && Object.keys(authorSchema).length > 0) {
-                const schema = authorSchema.additionalProperties === false
-                    ? {
-                        ...authorSchema,
-                        properties: {
-                            kind: { type: "string" },
-                            metadata: { type: "object" },
-                            ...authorSchema.properties,
-                        },
-                    }
-                    : authorSchema;
+            // inheritance-resolved, with `kind` / `metadata` injected. See
+            // `validationSchemaFor`, which is where both derivations and the reason
+            // they are memoized per definition live.
+            const schema = validationSchemaFor(definition);
+            if (Object.keys(schema).length > 0) {
                 // Phase 1: collect the pure-CEL leaves and the schema of the slot each
                 // flows into. The expression's own type is resolved later, by the
                 // engine walk that owns type-checking; this half only knows the target.
                 for (const slot of collectCelValueSlots(m, schema, "")) {
                     celReturnSlots.push({ manifest: m, resource, filePath, ...slot });
                 }
+                // A kind's own schema may point a slot at a PROJECTION — of a resource it
+                // references, or (the empty pointer) of this very declaration, which is
+                // what types a table's seed rows against its own `columns:`. Resolved
+                // PER RESOURCE, because a projection is declaration-derived: the same
+                // kind schema yields a different row shape for every table.
+                //
+                // A failure here is REPORTED, never dropped. An entry that could not be
+                // read vanishes from the projected shape, so the slot typed from it then
+                // rejects a field the author did declare ("'status' is not allowed") with
+                // nothing saying why — the projection's own failure mode, blaming the
+                // wrong line. Entry-module-scoped, like every other schema issue.
+                const projectionFailures = [];
+                const projected = resolveSchemaProjections(schema, m, resourceProjectionScope, projectionFailures);
+                if (!ownModule || rootModules.has(ownModule)) {
+                    for (const failure of projectionFailures) {
+                        // A projection through a library's own resource INPUT is
+                        // unanswerable here — the entries belong to the declaration the
+                        // importer supplies — so it is not a defect in the block that named
+                        // it. The check runs at the injection site instead.
+                        if (failure.reason === "injected")
+                            continue;
+                        diagnostics.push({
+                            severity: DiagnosticSeverity.Error,
+                            code: "SCHEMA_PROJECTION_FROM_UNRESOLVED",
+                            source: SOURCE,
+                            message: `${m.kind}/${resource.name}: ${describeProjectionFailure(failure)}`,
+                            data: { resource, filePath, path: pointerToPath(failure.pointer) },
+                        });
+                    }
+                }
                 // Phase 2+3: AJV on substituted data — CEL fields replaced with typed
                 // placeholders. Through the REGISTRY, so a kind whose schema references
                 // a shape declared elsewhere is checked on the instance that holds it.
-                const ajvIssues = defs.validateResourceConfig(substituteCelFields(m, schema, undefined, { external: (ref) => defs.schemaForId(ref) }), schema);
+                const ajvIssues = defs.validateResourceConfig(substituteCelFields(m, projected, undefined, {
+                    external: (ref) => defs.schemaForId(ref),
+                }), projected);
                 // Phase 4: value slots that must satisfy a type declared elsewhere on
                 // the resource (`x-telo-value-schema-from`) — e.g. every row of a
                 // decision table against its declared `outputType`, so a mistyped branch
@@ -1563,10 +1668,10 @@ export class StaticAnalyzer {
             // `validate-resource-rules.ts`, the shape every neighbouring pass uses:
             // issues out, one emit here.
             const ruleDeclarer = definition.metadata?.module;
-            for (const report of reportResourceRules(m, definition, evaluateResourceRules(m, authorSchema), !ruleDeclarer || rootModules.has(ruleDeclarer))) {
+            for (const report of reportResourceRules(m, definition, evaluateResourceRules(m, schema), !ruleDeclarer || rootModules.has(ruleDeclarer))) {
                 diagnostics.push(resourceRuleDiagnostic(report));
             }
-            for (const rule of readResourceRules(authorSchema)) {
+            for (const rule of readResourceRules(schema)) {
                 const key = `${definition.metadata?.module}.${definition.metadata?.name}#${rule.code}`;
                 const tracked = ruleExercise.get(key);
                 if (!tracked)
@@ -1581,10 +1686,10 @@ export class StaticAnalyzer {
             // literal appears on the referring side, where the spelling would be the
             // consumer's import alias rather than anything the rule's author controls.
             // A consumer of the shared call graph, never a second traversal.
-            const referrerRules = readReferrerRules(authorSchema);
+            const referrerRules = readReferrerRules(schema);
             if (referrerRules.length > 0) {
                 const referrers = referrersOf(m, getCallGraph());
-                for (const report of reportReferrerRules(m, definition, evaluateReferrerRules(m, authorSchema, referrers, kindMatches), !ruleDeclarer || rootModules.has(ruleDeclarer))) {
+                for (const report of reportReferrerRules(m, definition, evaluateReferrerRules(m, schema, referrers, kindMatches, referrerRuleContext), !ruleDeclarer || rootModules.has(ruleDeclarer))) {
                     // A VIOLATION is the referrer's data, so it is reported only when that
                     // manifest is the entry's own — the same direction a resource-rule
                     // violation takes, one hop further out.
@@ -1593,6 +1698,15 @@ export class StaticAnalyzer {
                         continue;
                     }
                     diagnostics.push(referrerRuleDiagnostic(report));
+                    // A rule that VIOLATED plainly ran, whatever its peer set held. The
+                    // unexercised report exists to catch silence — a `peers:` naming
+                    // nothing makes every `!peers.exists(…)` pass vacuously — so a finding
+                    // is exactly the evidence it asks for.
+                    if (report.code === "REFERRER_RULE_VIOLATED") {
+                        const violated = referrerRuleExercise.get(`${definition.metadata?.module}.${definition.metadata?.name}#${report.rule}`);
+                        if (violated)
+                            violated.exercised = true;
+                    }
                 }
                 for (const rule of referrerRules) {
                     const key = `${definition.metadata?.module}.${definition.metadata?.name}#${rule.code}`;
@@ -1600,8 +1714,9 @@ export class StaticAnalyzer {
                     if (!tracked)
                         continue;
                     tracked.seen = true;
-                    if (referrerRuleExercised(rule, referrers, kindMatches))
+                    if (referrerRuleExercised(rule, referrers, kindMatches, referrerRuleContext)) {
                         tracked.exercised = true;
+                    }
                 }
             }
             // Validate inline resources nested inside this resource's body (e.g. a
@@ -1769,18 +1884,15 @@ export class StaticAnalyzer {
         // same schema an expression is typed against.
         let celStepContextSchema;
         let celErrorScopes = new Map();
-        // Region coverage for the "CEL in a non-eval field" check: the union of
-        // `x-telo-eval` paths (own + capability) and `x-telo-context` /
-        // `x-telo-step-context` / `x-telo-error-context` scopes. A `!cel` outside
-        // every region is read as a literal — the runtime never evaluates it.
-        let celEvalPaths = [];
+        // Where this kind says its values are evaluated — `x-telo-eval` paths (own +
+        // capability) and the regions covering their contents. A `!cel` outside every
+        // one of them is read as a literal, and one under a compile path resolves at
+        // startup, where observed state cannot exist yet. Both questions are
+        // `celEvalModeAt`, which the editor asks of the same sites.
+        let celSites = NO_CEL_EVAL_SITES;
         // The bindings field this kind declares (if any), read by the CEL sites that
         // see the names it introduces.
         let celBindingSites;
-        // The compile half alone: a field that resolves at startup, where observed
-        // state cannot exist yet.
-        let celCompilePaths = [];
-        let celRegionScopes = [];
         let celRuleApplies = false;
         visitManifest(allManifests, defs, {
             onResourceEnter: (e) => {
@@ -1912,23 +2024,23 @@ export class StaticAnalyzer {
                 celRuleApplies =
                     !!e.definition?.schema && capability !== undefined && capability !== "Telo.Template";
                 if (celRuleApplies) {
-                    const ownSchema = e.definition.schema;
-                    const own = buildEvalPaths(ownSchema);
+                    // The INHERITANCE-RESOLVED schema, not the kind's own: without
+                    // `base:`, an `extends` child is authored against merge(parent, own),
+                    // so a CEL-bearing field the parent declares is a legal field on the
+                    // child and the kernel expands it — it stamps the merged schema at
+                    // definition registration and builds eval paths from that. Reading
+                    // the own schema here reported `CEL_IN_NON_EVAL_FIELD` for an
+                    // expression the runtime evaluates correctly, which is the two halves
+                    // disagreeing about what the manifest means.
+                    const ownSchema = effectiveAuthorSchema(e.definition, (k) => defs.resolve(aliases.resolveKind(k) ?? k) ?? defs.resolve(k));
                     const capabilityDef = capability ? defs.resolve(capability) : undefined;
-                    const parent = capabilityDef?.schema
-                        ? buildEvalPaths(capabilityDef.schema)
-                        : { compile: [], runtime: [] };
-                    celEvalPaths = [...own.compile, ...own.runtime, ...parent.compile, ...parent.runtime];
                     // A `Telo.Provider`'s fields are implicitly compile-eval — the
                     // capability abstract carries the root annotation — so its reads are
                     // covered here without the provider restating anything.
-                    celCompilePaths = [...own.compile, ...parent.compile];
-                    celRegionScopes = extractCelRegionScopes(ownSchema);
+                    celSites = mergeCelEvalSites(celEvalSites(ownSchema), celEvalSites(capabilityDef?.schema));
                 }
                 else {
-                    celEvalPaths = [];
-                    celCompilePaths = [];
-                    celRegionScopes = [];
+                    celSites = NO_CEL_EVAL_SITES;
                 }
             },
             onCel: (e) => {
@@ -1944,8 +2056,7 @@ export class StaticAnalyzer {
                 if (celRuleApplies &&
                     engineName === "cel" &&
                     celScope.invocationContextSchema === undefined &&
-                    !evalPathsCover(celEvalPaths, path) &&
-                    !celRegionScopes.some((scope) => pathMatchesScope(path, scope)) &&
+                    celEvalModeAt(celSites, path) === null &&
                     !pathCrossesNestedResource(m, path)) {
                     diagnostics.push({
                         severity: DiagnosticSeverity.Error,
@@ -1969,7 +2080,7 @@ export class StaticAnalyzer {
                         // the two-level shape it publishes under, so a cross-module read
                         // is checked exactly like a local one.
                         const reported = observedState.get(read.alias ? `${read.alias}.${read.name}` : read.name);
-                        if (celRuleApplies && evalPathsCover(celCompilePaths, path)) {
+                        if (celRuleApplies && celEvalModeAt(celSites, path) === "compile") {
                             diagnostics.push({
                                 severity: DiagnosticSeverity.Error,
                                 code: "OBSERVED_STATE_IN_STARTUP_FIELD",
@@ -2013,7 +2124,19 @@ export class StaticAnalyzer {
                     contextSchema: e.contextSchema,
                     matchedScope,
                 });
-                const result = engine.analyze(expr, { celEnv: typedEnv, contextSchema: effectiveContext });
+                const result = engine.analyze(expr, {
+                    celEnv: typedEnv,
+                    contextSchema: effectiveContext,
+                    // `scopeFor` registers every kernel global and every name the site's
+                    // context declares, so a root this environment does not know is one
+                    // nothing puts in scope. Two places where the CEL belongs to another
+                    // scope, both already recognised by the non-eval-field check: a kind
+                    // document, whose CEL is written for whoever instantiates the kind,
+                    // and anything below a nested inline `{ kind }`, whose CEL the
+                    // nested kind evaluates — and which is analyzed again, in its own
+                    // scope, as the resource it was extracted into.
+                    rootsDeclared: !isKindDocument(m) && !pathCrossesNestedResource(m, path),
+                });
                 if (result.type !== undefined) {
                     let byPath = celTypeByPath.get(m);
                     if (!byPath)
@@ -2049,7 +2172,7 @@ export class StaticAnalyzer {
                 // intent (a boot timestamp, a run id), so it warns rather than
                 // blocking. The engine reports which calls re-evaluate; the eval mode
                 // is manifest policy and stays here.
-                if (celRuleApplies && evalPathsCover(celCompilePaths, path)) {
+                if (celRuleApplies && celEvalModeAt(celSites, path) === "compile") {
                     const volatile = [
                         ...new Set(result.calls.filter((c) => c.deterministic === false).map((c) => c.name)),
                     ].sort();
@@ -2105,7 +2228,7 @@ export class StaticAnalyzer {
                     }
                 }
             },
-        }, { aliases });
+        }, { aliases, aliasesByModule, rootModules });
         // The two halves of "does this expression fit the slot it flows into" meet
         // here: the engine resolved the expression's type during the walk above,
         // and the schema walk recorded the slot. An expression that failed to check
@@ -2175,6 +2298,12 @@ export class StaticAnalyzer {
         diagnostics.push(...validateThrowsCoverage(allManifests, defs, aliases, this.celEnv, aliasesByModule, rootModules));
         // Warn about declared variables / secrets / ports that no CEL references.
         diagnostics.push(...validateUnusedDeclarations(allManifests, this.celEnv));
+        // A `!ref` at a definition's dispatch slot must name a sibling `resources:`
+        // entry — the slot no reference pass reaches, so the tag would otherwise
+        // advertise a resolution nothing performs.
+        diagnostics.push(...validateTemplateDispatch(allManifests, rootModules));
+        // A library's declared resource inputs, and every import that supplies them.
+        diagnostics.push(...validateResourceInputs(allManifests, defs, aliases, rootModules, (supplied, required) => kindSatisfies(supplied, required, defs)));
         // Reroute diagnostics on synthetic (inline-extracted) resources back to
         // the chain root so position-index lookups land on the parent doc.
         return rewriteSyntheticOrigins(suppressUnreadableModuleDiagnostics(diagnostics, unreadableFiles), allManifests);

package/dist/builtins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAiNvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EAusB/C,CAAC"}
+{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AA8OvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EA+tB/C,CAAC"}

package/dist/builtins.js

@@ -215,6 +215,33 @@ const ROOT_LOGGING_SCHEMA = {
     },
     additionalProperties: false,
 };
+/** A `Telo.Library`'s declared resource inputs — the instances it requires from
+ *  whoever imports it, the inward half of the symmetry `exports.resources`
+ *  already had outward. Each entry is constrained by KIND ONLY, through the same
+ *  alias-qualified grammar `extends:` and `x-telo-ref` use; there is no `use:`,
+ *  because the boundary is a dependency edge for init order whatever the library
+ *  does with the instance. See `analyzer/nodejs/src/resource-input.ts`. */
+const LIBRARY_RESOURCE_INPUTS_SCHEMA = {
+    type: "object",
+    additionalProperties: {
+        type: "object",
+        required: ["kind"],
+        properties: {
+            kind: { type: "string" },
+            description: { type: "string" },
+        },
+        additionalProperties: false,
+    },
+};
+/** The importer's side of the same block: entry name → `!ref` to the instance
+ *  supplied for it. Left open because the accepted KIND is declared by the
+ *  target library, not by this schema — the constraint is checked by
+ *  `validate-resource-inputs.ts`, which reads the target's declared block off
+ *  the `metadata.requiredResources` stamp. */
+const IMPORT_RESOURCE_INPUTS_SCHEMA = {
+    type: "object",
+    additionalProperties: {},
+};
 export const KERNEL_BUILTINS = [
     { kind: "Telo.Abstract", metadata: { name: "Template", module: "Telo" } },
     // "Control can be transferred to this" — the parent of Invocable and Runnable,
@@ -408,28 +435,26 @@ export const KERNEL_BUILTINS = [
                     items: {
                         type: "object",
                         additionalProperties: true,
-                        // Resource bodies are `self`-only for config: per-call `inputs` is
-                        // NOT in scope here. Each entry is a persistent child created once at
-                        // init() and reused, so its config cannot depend on call-time data —
-                        // that flows through the top-level `inputs:` sibling into the dispatch
-                        // target's invoke().
+                        // A `resources:` entry is a DECLARATION of another kind, so the
+                        // CEL inside it belongs to THAT kind: its `x-telo-context` regions
+                        // are rebased under this entry's path and take precedence (they are
+                        // deeper), which is what puts `inputs`, `item`, `request`, `steps`
+                        // and a `catch:`'s `error` in scope exactly where the nested kind
+                        // declares them — see `analyzer/nodejs/src/template-body.ts`.
                         //
-                        // The exception is CEL the child's OWN controller evaluates later
-                        // against a runtime context it owns (e.g. an Http.Api evaluating route
-                        // CEL per request). Those `request` / `result` / `steps` / `error`
-                        // variables are deferred — the template controller preserves them
-                        // untouched (see resource-template-controller.ts) — so they are
-                        // exposed here permissively. Their deep shape is the child kind's
-                        // concern, not the template's, so they type as open values.
+                        // What stays here is `self` alone, in force throughout the entry:
+                        // it is how a body reaches the configuration its enclosing template
+                        // was given, and no nested kind knows about it. The four names that
+                        // used to sit beside it (`request` / `result` / `steps` / `error`)
+                        // were a fixed permissive stand-in for the nested kind's own
+                        // regions — which is why `error` was offered outside every `catch:`
+                        // while `inputs` and `item` were undefined wherever a body actually
+                        // reads them.
                         "x-telo-context": {
                             type: "object",
                             additionalProperties: false,
                             properties: {
                                 self: { "x-telo-context-from-root": "schema" },
-                                request: {},
-                                result: {},
-                                steps: {},
-                                error: {},
                             },
                         },
                     },
@@ -592,6 +617,7 @@ export const KERNEL_BUILTINS = [
                 integrity: { type: "string" },
                 variables: { type: "object" },
                 secrets: { type: "object" },
+                resources: IMPORT_RESOURCE_INPUTS_SCHEMA,
                 runtime: {
                     oneOf: [
                         { type: "string" },
@@ -738,6 +764,7 @@ export const KERNEL_BUILTINS = [
                                     integrity: { type: "string" },
                                     variables: { type: "object" },
                                     secrets: { type: "object" },
+                                    resources: IMPORT_RESOURCE_INPUTS_SCHEMA,
                                     runtime: {
                                         oneOf: [
                                             { type: "string" },
@@ -853,6 +880,29 @@ export const KERNEL_BUILTINS = [
                 },
                 variables: { type: "object" },
                 secrets: { type: "object" },
+                // How many times this library is instantiated in one application.
+                //
+                // `isolated` (the default) is what every published module was written
+                // against: each import declaration builds its own child scope with its
+                // own instances, so two libraries importing a third get two of
+                // everything in it. `shared` makes the library a SINGLETON — every
+                // import of it resolves to one instantiation, owned by the root and
+                // torn down after everything that borrowed it.
+                //
+                // Default `isolated` rather than `shared` — the opposite of the
+                // Application field's — because flipping it would silently collapse
+                // every existing app's resource graph and turn per-import `variables:`
+                // into a conflict. The `exports.kinds` precedent: private-by-default is
+                // the better end state and still needs the ecosystem republished first.
+                lifecycle: {
+                    type: "string",
+                    enum: ["shared", "isolated"],
+                    default: "isolated",
+                },
+                // The inward half of `exports.resources`: instances this library
+                // requires from whoever imports it. Library-only — an Application is a
+                // root with no importer, so it owns its instances outright.
+                resources: LIBRARY_RESOURCE_INPUTS_SCHEMA,
                 include: {
                     type: "array",
                     items: { type: "string" },
@@ -883,6 +933,7 @@ export const KERNEL_BUILTINS = [
                                     integrity: { type: "string" },
                                     variables: { type: "object" },
                                     secrets: { type: "object" },
+                                    resources: IMPORT_RESOURCE_INPUTS_SCHEMA,
                                     runtime: {
                                         oneOf: [
                                             { type: "string" },

package/dist/call-graph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"call-graph.d.ts","sourceRoot":"","sources":["../src/call-graph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAOnE,OAAO,EAIL,KAAK,MAAM,EACX,KAAK,WAAW,EACjB,MAAM,eAAe,CAAC;AAKvB,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,UAAU,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,gBAAgB,CAAC;IAC3B;;yEAEqE;IACrE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,MAAM,aAAa,GAAG,iBAAiB,GAAG,aAAa,CAAC;AAE9D,MAAM,WAAW,aAAa;IAC5B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb;;;+CAG2C;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf;;;iCAG6B;IAC7B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,GAAG,EAAE,MAAM,EAAE,CAAC;IACd;0EACsE;IACtE,UAAU,CAAC,EAAE,WAAW,CAAC;IACzB;;mEAE+D;IAC/D,gBAAgB,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC;IACtD,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;+BAM2B;IAC3B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;wEACoE;IACpE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;gBAGY;IACZ,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC1C,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;IAChC,kDAAkD;IAClD,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,aAAa,EAAE,CAAC;IACvC,yCAAyC;IACzC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,aAAa,EAAE,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAAC;IACpE,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAAC;IAC5D,2DAA2D;IAC3D,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,aAAa,EAAE,CAAC;IAC3C;yFACqF;IACrF,YAAY,IAAI,aAAa,EAAE,CAAC;CACjC;AAED,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,EAAE,MAAM,MAAM,KAAG,MAA4B,CAAC;AAiTrF,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CAC9C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,GAAE,qBAA0B,GAClC,SAAS,CA4QX;AAYD,MAAM,WAAW,qBAAqB;IACpC,yEAAyE;IACzE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IACrC;0EACsE;IACtE,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,SAAS,EAChB,OAAO,GAAE,qBAA0B,GAClC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAmB1B"}
+{"version":3,"file":"call-graph.d.ts","sourceRoot":"","sources":["../src/call-graph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAOnE,OAAO,EAIL,KAAK,MAAM,EACX,KAAK,WAAW,EACjB,MAAM,eAAe,CAAC;AAKvB,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,UAAU,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,gBAAgB,CAAC;IAC3B;;yEAEqE;IACrE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,MAAM,aAAa,GAAG,iBAAiB,GAAG,aAAa,CAAC;AAE9D,MAAM,WAAW,aAAa;IAC5B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb;;;+CAG2C;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf;;;iCAG6B;IAC7B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,GAAG,EAAE,MAAM,EAAE,CAAC;IACd;0EACsE;IACtE,UAAU,CAAC,EAAE,WAAW,CAAC;IACzB;;mEAE+D;IAC/D,gBAAgB,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC;IACtD,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;+BAM2B;IAC3B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;wEACoE;IACpE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;gBAGY;IACZ,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC1C,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;IAChC,kDAAkD;IAClD,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,aAAa,EAAE,CAAC;IACvC,yCAAyC;IACzC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,aAAa,EAAE,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAAC;IACpE,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAAC;IAC5D,2DAA2D;IAC3D,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,aAAa,EAAE,CAAC;IAC3C;yFACqF;IACrF,YAAY,IAAI,aAAa,EAAE,CAAC;CACjC;AAED,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,EAAE,MAAM,MAAM,KAAG,MAA4B,CAAC;AAuTrF,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CAC9C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,GAAE,qBAA0B,GAClC,SAAS,CA4QX;AAYD,MAAM,WAAW,qBAAqB;IACpC,yEAAyE;IACzE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IACrC;0EACsE;IACtE,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,SAAS,EAChB,OAAO,GAAE,qBAA0B,GAClC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAmB1B"}