@telorun/analyzer 0.65.0 → 0.67.0

package/dist/validate-resource-rules.js

@@ -1,13 +1,16 @@
-import { RULE_BUDGET_MS, compileRuleCondition, conditionRefusals } from "./rule-condition.js";
-import { RESOURCE_RULES_ANNOTATION, celSourceOf, findDynamicLeaf, pointerSegments, readRawResourceRules, readResourceRules, readNodes, resolveRuleSubjects, } from "./resource-rule.js";
+import { RULE_BUDGET_MS, UNTAGGED_CONDITION, compileRuleCondition, conditionRefusals, } from "./rule-condition.js";
+import { RESOURCE_RULES_ANNOTATION, celSourceOf, findDynamicLeaf, isTaggedCondition, pointerSegments, readRawResourceRules, readResourceRules, readNodes, resolveRuleSubjects, } from "./resource-rule.js";
 /** Published name for the shared budget — see `rule-condition.ts`. */
 export const RESOURCE_RULE_BUDGET_MS = RULE_BUDGET_MS;
 function isObject(value) {
     return !!value && typeof value === "object" && !Array.isArray(value);
 }
 /** Navigate a kind's own schema to the node describing what a pointer names, so
- *  an `in:` naming a field the kind does not declare is caught at the kind. */
-function schemaAtPointer(schema, pointer) {
+ *  an `in:` naming a field the kind does not declare is caught at the kind.
+ *  Exported because the peer-rule strict half asks the same question of the
+ *  REFERRER's schema, and two navigators would eventually disagree about what a
+ *  pointer names. */
+export function schemaAtPointer(schema, pointer) {
     const segments = pointerSegments(pointer);
     if (!segments)
         return undefined;
@@ -27,7 +30,7 @@ function schemaAtPointer(schema, pointer) {
 }
 /** True when a schema node describes something a rule can iterate. Unknown or
  *  absent `type` passes: an open schema is not evidence of a defect. */
-function isIterableSchema(node) {
+export function isIterableSchema(node) {
     if (!isObject(node))
         return true;
     const type = node.type;
@@ -121,6 +124,9 @@ effectiveSchema) {
                 }
             }
         }
+        if (condition !== undefined && condition.length > 0 && !isTaggedCondition(entry.condition)) {
+            issue(`${at}.condition`, UNTAGGED_CONDITION);
+        }
         if (condition) {
             for (const refusal of conditionRefusals(condition))
                 issue(`${at}.condition`, refusal);
@@ -159,14 +165,14 @@ export function evaluateResourceRules(manifest, definitionSchema) {
             // Only the nodes this condition READS decide whether it can run — see
             // `readNodes`. Scanning the whole subject would disable every
             // resource-wide rule on any manifest containing one unrelated expression.
-            let dynamicAt;
+            let dynamic;
             for (const node of readNodes(chains, { self, this: subject.value })) {
-                dynamicAt = findDynamicLeaf(node);
-                if (dynamicAt !== undefined)
+                dynamic = findDynamicLeaf(node);
+                if (dynamic !== undefined)
                     break;
             }
-            if (dynamicAt !== undefined) {
-                findings.push({ kind: "skipped", rule, path: subject.path, dynamicAt });
+            if (dynamic !== undefined) {
+                findings.push({ kind: "skipped", rule, path: subject.path, dynamic });
                 continue;
             }
             let held;
@@ -239,8 +245,8 @@ declarationIsOurs) {
                 code: "RESOURCE_RULE_SKIPPED",
                 severity: "information",
                 message: `${manifest.kind}/${name}: rule '${finding.rule.code}' did not run` +
-                    `${at ? ` at '${at}'` : ""} — the value holds a CEL expression at ` +
-                    `'${finding.dynamicAt}', which is not known until the resource is created. ` +
+                    `${at ? ` at '${at}'` : ""} — the value holds ${finding.dynamic.what} at ` +
+                    `'${finding.dynamic.path}', which is not known until the resource is created. ` +
                     "Reported rather than dropped: a check whose coverage varies invisibly reads as passing.",
                 manifest,
                 path: at,

package/dist/validate-schema-projection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-schema-projection.d.ts","sourceRoot":"","sources":["../src/validate-schema-projection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAQrD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,2BAA2B,GAAG,uBAAuB,CAAC;IAC5D,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAQD,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,qBAAqB,EAAE,CA2G5F"}
+{"version":3,"file":"validate-schema-projection.d.ts","sourceRoot":"","sources":["../src/validate-schema-projection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AASrD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,2BAA2B,GAAG,uBAAuB,CAAC;IAC5D,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAQD,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,qBAAqB,EAAE,CAqJ5F"}

package/dist/validate-schema-projection.js

@@ -1,4 +1,4 @@
-import { projectionKeyMap, rawSchemaProjection, readSchemaProjection, schemaProjectionIsMisplaced, } from "./schema-projection.js";
+import { projectionKeyMap, rawSchemaProjection, readSchemaProjection, schemaMapBranch, schemaProjectionIsMisplaced, } from "./schema-projection.js";
 const PROJECTION = "x-telo-schema-projection";
 function isObject(value) {
     return !!value && typeof value === "object" && !Array.isArray(value);
@@ -52,6 +52,30 @@ export function validateSchemaProjection(manifest) {
                 `entry's identity — without it the projection yields a schema that rejects every value.`),
         ];
     }
+    const reference = raw.reference;
+    if (reference !== undefined) {
+        if (!isObject(reference)) {
+            issues.push(issue("SCHEMA_PROJECTION_INVALID", `${base}.reference`, `'reference' says how an entry whose '${projection.key}' holds a REFERENCE projects. ` +
+                `It is an object naming 'from' (the target field to read), 'keyword' (the schema ` +
+                `keyword its values become) and one of 'base' / 'baseFrom'.`));
+        }
+        else {
+            const absent = ["from", "keyword"].filter((f) => typeof reference[f] !== "string");
+            if (absent.length > 0) {
+                issues.push(issue("SCHEMA_PROJECTION_INVALID", `${base}.reference`, `'reference' is missing ${absent.map((f) => `'${f}'`).join(" and ")}. Without them a ` +
+                    `referenced entry projects to nothing, so it vanishes from every consumer's view.`));
+            }
+            const bases = ["base", "baseFrom"].filter((f) => reference[f] !== undefined);
+            if (bases.length !== 1) {
+                issues.push(issue("SCHEMA_PROJECTION_INVALID", `${base}.reference`, bases.length === 0
+                    ? `'reference' declares neither 'base' nor 'baseFrom', so the projected node has no ` +
+                        `type. Write 'base' where the named type IS its own base type, or 'baseFrom' ` +
+                        `naming the target field that holds a value of this kind's own map.`
+                    : `'reference' declares both 'base' and 'baseFrom'. They are two answers to one ` +
+                        `question — where the projected node's type comes from — so declare exactly one.`));
+            }
+        }
+    }
     const map = projectionKeyMap(schema, projection);
     if (!map) {
         return [
@@ -106,5 +130,12 @@ function keySchema(schema, entries, key) {
     if (!isObject(entry) || !isObject(entry.properties))
         return undefined;
     const field = entry.properties[key];
-    return isObject(field) ? field : undefined;
+    if (!isObject(field))
+        return undefined;
+    // The vocabulary may sit on a BRANCH — a slot unioning a closed value set with
+    // a reference — and the branch carrying the map is the one whose `enum` the map
+    // has to answer for. Reading the union node instead finds no `enum` at all, so
+    // the completeness check would silently stop running exactly where the two
+    // halves can disagree. Asked through the single reader, never re-derived here.
+    return schemaMapBranch(field) ?? field;
 }

package/dist/validate-template-dispatch.d.ts

@@ -0,0 +1,27 @@
+import type { ResourceManifest } from "@telorun/sdk";
+import { type AnalysisDiagnostic } from "./types.js";
+/**
+ * A `!ref` at a definition's dispatch slot must name a sibling `resources:`
+ * entry.
+ *
+ * `!ref` is the one spelling an author — and the editor's rename, completion and
+ * go-to-definition — expects to be RESOLVED. But a `Telo.Definition` is in both
+ * `REF_VALIDATION_SKIP_KINDS` and `REF_RESOLUTION_SKIP_KINDS`, and the dispatch
+ * slots carry no `x-telo-ref` (the accepted targets are the definition's own
+ * template-internal entries, not resources of any module), so no reference pass
+ * reaches them. Introducing the tag at a slot nothing resolves would be worse
+ * than the string form it replaces: a typo that used to be an obvious runtime
+ * miss becomes a typo in a construct that advertises static resolution.
+ *
+ * Decidable only when every sibling name is LITERAL. A template routinely names
+ * its entries with CEL (`name: !cel "self.name + '-query'"`), and an expression
+ * could expand to the referenced name — so one dynamic sibling switches the
+ * check off for that definition rather than inventing a miss.
+ *
+ * Entry-module-scoped, like every other declaration check: a published
+ * dependency's template body is not the consumer's to fix.
+ *
+ * Browser-safe.
+ */
+export declare function validateTemplateDispatch(manifests: ResourceManifest[], rootModules: ReadonlySet<string>): AnalysisDiagnostic[];
+//# sourceMappingURL=validate-template-dispatch.d.ts.map

package/dist/validate-template-dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-template-dispatch.d.ts","sourceRoot":"","sources":["../src/validate-template-dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AASzE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,GAC/B,kBAAkB,EAAE,CAgDtB"}

package/dist/validate-template-dispatch.js

@@ -0,0 +1,95 @@
+import { isRefSentinel } from "@telorun/templating";
+import { distance } from "./levenshtein.js";
+import { DiagnosticSeverity } from "./types.js";
+const SOURCE = "telo-analyzer";
+/** The four slots a `Telo.Definition` names its dispatch target in. Each takes
+ *  the same grammar; which one is legal for a given capability is
+ *  `validate-provider-coherence`'s question, not this one's. */
+const DISPATCH_FIELDS = ["invoke", "run", "provide", "mount"];
+/**
+ * A `!ref` at a definition's dispatch slot must name a sibling `resources:`
+ * entry.
+ *
+ * `!ref` is the one spelling an author — and the editor's rename, completion and
+ * go-to-definition — expects to be RESOLVED. But a `Telo.Definition` is in both
+ * `REF_VALIDATION_SKIP_KINDS` and `REF_RESOLUTION_SKIP_KINDS`, and the dispatch
+ * slots carry no `x-telo-ref` (the accepted targets are the definition's own
+ * template-internal entries, not resources of any module), so no reference pass
+ * reaches them. Introducing the tag at a slot nothing resolves would be worse
+ * than the string form it replaces: a typo that used to be an obvious runtime
+ * miss becomes a typo in a construct that advertises static resolution.
+ *
+ * Decidable only when every sibling name is LITERAL. A template routinely names
+ * its entries with CEL (`name: !cel "self.name + '-query'"`), and an expression
+ * could expand to the referenced name — so one dynamic sibling switches the
+ * check off for that definition rather than inventing a miss.
+ *
+ * Entry-module-scoped, like every other declaration check: a published
+ * dependency's template body is not the consumer's to fix.
+ *
+ * Browser-safe.
+ */
+export function validateTemplateDispatch(manifests, rootModules) {
+    const out = [];
+    for (const m of manifests) {
+        if (m.kind !== "Telo.Definition")
+            continue;
+        const meta = m.metadata;
+        const name = meta?.name;
+        if (!name)
+            continue;
+        if (meta?.module && !rootModules.has(meta.module))
+            continue;
+        const bodies = m.resources;
+        if (!Array.isArray(bodies))
+            continue;
+        const siblings = [];
+        let anyDynamic = false;
+        for (const entry of bodies) {
+            const entryName = entry?.metadata?.name;
+            if (typeof entryName === "string" && !entryName.includes("${{"))
+                siblings.push(entryName);
+            else if (entryName !== undefined)
+                anyDynamic = true;
+        }
+        if (anyDynamic)
+            continue;
+        for (const field of DISPATCH_FIELDS) {
+            const value = m[field];
+            if (!isRefSentinel(value))
+                continue;
+            const source = value.source;
+            const target = source.startsWith("Self.") ? source.slice("Self.".length) : source;
+            if (siblings.includes(target))
+                continue;
+            const suggestion = nearest(target, siblings);
+            out.push({
+                severity: DiagnosticSeverity.Error,
+                code: "TEMPLATE_DISPATCH_UNKNOWN",
+                source: SOURCE,
+                message: `${m.kind}/${name}: '${field}: !ref ${source}' names no entry in 'resources:'. ` +
+                    `Available: ${siblings.join(", ") || "(none)"}.` +
+                    (suggestion ? ` Did you mean '${suggestion}'?` : ""),
+                data: {
+                    resource: { kind: m.kind, name },
+                    filePath: meta?.source,
+                    path: field,
+                    ...(suggestion ? { fix: { replacement: suggestion } } : {}),
+                },
+            });
+        }
+    }
+    return out;
+}
+/** The closest sibling name, when one is close enough to be a typo rather than a
+ *  different name. */
+function nearest(target, candidates) {
+    let best;
+    for (const candidate of candidates) {
+        const d = distance(target, candidate);
+        if (!best || d < best.d)
+            best = { name: candidate, d };
+    }
+    const limit = Math.max(1, Math.floor(target.length / 3));
+    return best && best.d <= limit ? best.name : undefined;
+}

package/dist/with-synthetic-positions.d.ts

@@ -8,7 +8,7 @@ import type { ResourceManifest } from "@telorun/sdk";
  * manifest (the dedup that backs `DUPLICATE_RESOURCE_NAME` reads
  * `(source, sourceLine)` to distinguish pipeline echoes from real
  * collisions). Production callers — the `Loader`, `flattenForAnalyzer`,
- * the telo-editor's `emitDocsFor`, the VSCode extension — all stamp
+ * telo studio's `emitDocsFor`, the VSCode extension — all stamp
  * positions already. This helper is the escape hatch for **programmatic
  * callers** (tests, ad-hoc scripts) that construct `ResourceManifest`
  * literals without going through a loader: it gives every otherwise-naked

package/dist/with-synthetic-positions.js

@@ -8,7 +8,7 @@ import { REF_VALIDATION_SKIP_KINDS } from "./system-kinds.js";
  * manifest (the dedup that backs `DUPLICATE_RESOURCE_NAME` reads
  * `(source, sourceLine)` to distinguish pipeline echoes from real
  * collisions). Production callers — the `Loader`, `flattenForAnalyzer`,
- * the telo-editor's `emitDocsFor`, the VSCode extension — all stamp
+ * telo studio's `emitDocsFor`, the VSCode extension — all stamp
  * positions already. This helper is the escape hatch for **programmatic
  * callers** (tests, ad-hoc scripts) that construct `ResourceManifest`
  * literals without going through a loader: it gives every otherwise-naked

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.65.0",
+  "version": "0.67.0",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",
@@ -43,13 +43,13 @@
     "jsonpath-plus": "^10.3.0",
     "packageurl-js": "^2.0.1",
     "yaml": "^2.8.3",
-    "@telorun/templating": "0.16.0"
+    "@telorun/templating": "0.18.0"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",
     "typescript": "^5.0.0",
     "vitest": "^2.1.8",
-    "@telorun/sdk": "0.82.0"
+    "@telorun/sdk": "0.83.0"
   },
   "peerDependencies": {
     "@telorun/sdk": "*"