@telorun/analyzer 0.65.0 → 0.67.0

package/dist/release/index.d.ts

@@ -2,7 +2,7 @@
  * The release model: module identity, fragments, the ledger, the edge graph,
  * level propagation and version planning.
  *
- * Browser-safe by construction — pure data in, plan out — so the telo editor can
+ * Browser-safe by construction — pure data in, plan out — so telo studio can
  * answer "what does changing this library bump?" from the same model the CLI
  * releases from. Everything Node-shaped (finding the workspace, running the
  * controller builder, building payloads, reading git, writing files) is

package/dist/release/index.js

@@ -2,7 +2,7 @@
  * The release model: module identity, fragments, the ledger, the edge graph,
  * level propagation and version planning.
  *
- * Browser-safe by construction — pure data in, plan out — so the telo editor can
+ * Browser-safe by construction — pure data in, plan out — so telo studio can
  * answer "what does changing this library bump?" from the same model the CLI
  * releases from. Everything Node-shaped (finding the workspace, running the
  * controller builder, building payloads, reading git, writing files) is

package/dist/resolve-ref-sentinels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-ref-sentinels.d.ts","sourceRoot":"","sources":["../src/resolve-ref-sentinels.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAGlC;+CAC+C;AAC/C,MAAM,WAAW,mBAAmB;IAClC,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,GACvD,iBAAiB,GAAG,SAAS,CAAC;CAClC;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,aAAa,EACvB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAK5C,kBAAkB,GAAE,gBAAgB,EAAO;AAC3C;;+CAE+C;AAC/C,IAAI,CAAC,EAAE,mBAAmB,GACzB,IAAI,CA8HN"}
+{"version":3,"file":"resolve-ref-sentinels.d.ts","sourceRoot":"","sources":["../src/resolve-ref-sentinels.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAGlC;+CAC+C;AAC/C,MAAM,WAAW,mBAAmB;IAClC,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,GACvD,iBAAiB,GAAG,SAAS,CAAC;CAClC;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,aAAa,EACvB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAK5C,kBAAkB,GAAE,gBAAgB,EAAO;AAC3C;;+CAE+C;AAC/C,IAAI,CAAC,EAAE,mBAAmB,GACzB,IAAI,CAyIN"}

package/dist/resolve-ref-sentinels.js

@@ -172,7 +172,20 @@ defs) {
     for (const r of resources) {
         if (isForeign(r))
             continue;
-        if (!r.metadata?.name || !r.kind || SYSTEM_KINDS.has(r.kind))
+        if (!r.metadata?.name || !r.kind)
+            continue;
+        // A `Telo.Import` is import-time metadata, not a resource instance — except
+        // for its `resources:` block, which supplies the instances the target
+        // library declared it needs. Those are `!ref`s to the importer's OWN
+        // resources and resolve exactly like any other reference; nothing else on
+        // the document is a reference slot, so only that subtree is walked.
+        if (r.kind === "Telo.Import") {
+            const supplied = r.resources;
+            if (supplied)
+                r.resources = walk(supplied);
+            continue;
+        }
+        if (SYSTEM_KINDS.has(r.kind))
             continue;
         walk(r);
     }

package/dist/resource-input.d.ts

@@ -0,0 +1,75 @@
+import type { ResourceManifest } from "@telorun/sdk";
+/**
+ * The `resources:` block on a `Telo.Library` — the instances a library requires
+ * from whoever imports it, beside the scalar `variables:` / `secrets:` blocks.
+ * Instances used to flow up only (`exports.resources`); this is the inward half.
+ *
+ * THE SINGLE READER of the block, in both halves (the analyzer's passes and the
+ * kernel's import controller), on the `ref-slot.ts` precedent: a boundary whose
+ * shape two runtimes must agree about is read in one place, so the next shape
+ * change is a one-file edit rather than four surfaces recognising a block by
+ * pattern-matching it.
+ *
+ * Browser-safe — no I/O, no Node built-ins.
+ */
+/** One declared input. */
+export interface ResourceInput {
+    /** The entry key. Inside the library the instance is named exactly as a
+     *  locally declared resource: `!ref <name>` at a ref slot, `resources.<name>`
+     *  in CEL. */
+    name: string;
+    /** The alias-qualified kind constraint, as written in the DECLARING library's
+     *  own scope (`Sql.Connection`, `Self.Store`, `Telo.LogSink`). There is no
+     *  `use:` here: the boundary is a dependency edge for init order whatever the
+     *  library does with the instance, and the flattened application analysis
+     *  drops the library doc, so an app-level claim about internal call sites is
+     *  one nothing could check. */
+    kind: string;
+    description?: string;
+}
+/** Read a module document's `resources:` block. Returns `[]` for an
+ *  `Telo.Application` (which has no such block), for a library that declares
+ *  none, and for a malformed entry — the document's own schema validation
+ *  reports the shape against the precise `resources.<name>` path. */
+export declare function readResourceInputs(moduleDoc: unknown): ResourceInput[];
+/** The values an import supplies for a target library's declared inputs, keyed
+ *  by entry name. Read off a `Telo.Import` (authored or desugared from an
+ *  `imports:` entry). Values are `!ref` sentinels before Phase 2.5 and
+ *  `{kind, name}` after it — this reader does not interpret them. */
+export declare function readSuppliedResources(importDoc: unknown): Record<string, unknown>;
+/** True when `manifest` is a synthesized kind-only declaration standing in for a
+ *  library's `resources:` entry rather than a resource the author declared. */
+export declare function isInjectedDeclaration(manifest: ResourceManifest | undefined): boolean;
+/**
+ * Synthesize a kind-only declaration per `resources:` entry, in the declaring
+ * library's own scope.
+ *
+ * That model has to exist because a library's internals are validated in the
+ * library's own pass — the flattened application analysis drops the library doc
+ * — so with nothing behind `connection`, `!ref connection` would have nothing to
+ * resolve against.
+ *
+ * Kind-only is enough because it is already what a ref slot gets: a reading
+ * types its `status:` half from the kind, closed so a typo below it is
+ * `CEL_UNKNOWN_FIELD`, and leaves the flat half open, since no manifest declares
+ * what `snapshot()` returned. So `!ref connection` at a ref slot and
+ * `resources.connection.<field>` in CEL answer exactly as they do for a locally
+ * declared resource.
+ *
+ * The declaration is a stand-in, never an instantiation: the per-resource
+ * validation loop skips it (its kind is routinely an abstract, and its config is
+ * the importer's to supply), and the kernel's import controller filters it out
+ * of the manifests it registers, binding the borrowed instance under the name
+ * instead.
+ */
+export declare function injectedDeclarations(moduleDoc: ResourceManifest, ownModule: string | undefined): ResourceManifest[];
+/** How many times a library is instantiated in one application. `isolated` —
+ *  the default, and what every published module was written against — gives
+ *  each import declaration its own child scope with its own instances;
+ *  `shared` makes the library a singleton every import resolves to. */
+export type LibraryLifecycle = "isolated" | "shared";
+/** Read a module document's `lifecycle:`. `Telo.Application` has a field of the
+ *  same name with a different default and no reader; this is the LIBRARY
+ *  question only, so it answers `isolated` for anything else. */
+export declare function readLibraryLifecycle(moduleDoc: unknown): LibraryLifecycle;
+//# sourceMappingURL=resource-input.d.ts.map

package/dist/resource-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-input.d.ts","sourceRoot":"","sources":["../src/resource-input.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD;;;;;;;;;;;;GAYG;AAEH,0BAA0B;AAC1B,MAAM,WAAW,aAAa;IAC5B;;kBAEc;IACd,IAAI,EAAE,MAAM,CAAC;IACb;;;;;mCAK+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAOD;;;qEAGqE;AACrE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,OAAO,GAAG,aAAa,EAAE,CAgBtE;AAED;;;qEAGqE;AACrE,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAIjF;AAED;+EAC+E;AAC/E,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,SAAS,GAAG,OAAO,CAErF;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,gBAAgB,EAC3B,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,gBAAgB,EAAE,CAgBpB;AAED;;;uEAGuE;AACvE,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,QAAQ,CAAC;AAErD;;iEAEiE;AACjE,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,OAAO,GAAG,gBAAgB,CAIzE"}

package/dist/resource-input.js

@@ -0,0 +1,90 @@
+/** Marker stamped on a synthesized kind-only declaration (see
+ *  {@link injectedDeclarations}). Read through {@link isInjectedDeclaration} —
+ *  never by testing the field. */
+const INJECTED = "xTeloInjected";
+/** Read a module document's `resources:` block. Returns `[]` for an
+ *  `Telo.Application` (which has no such block), for a library that declares
+ *  none, and for a malformed entry — the document's own schema validation
+ *  reports the shape against the precise `resources.<name>` path. */
+export function readResourceInputs(moduleDoc) {
+    const raw = moduleDoc?.resources;
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return [];
+    const out = [];
+    for (const [name, value] of Object.entries(raw)) {
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            continue;
+        const kind = value.kind;
+        if (typeof kind !== "string" || kind.length === 0)
+            continue;
+        const description = value.description;
+        out.push({
+            name,
+            kind,
+            ...(typeof description === "string" ? { description } : {}),
+        });
+    }
+    return out;
+}
+/** The values an import supplies for a target library's declared inputs, keyed
+ *  by entry name. Read off a `Telo.Import` (authored or desugared from an
+ *  `imports:` entry). Values are `!ref` sentinels before Phase 2.5 and
+ *  `{kind, name}` after it — this reader does not interpret them. */
+export function readSuppliedResources(importDoc) {
+    const raw = importDoc?.resources;
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return {};
+    return raw;
+}
+/** True when `manifest` is a synthesized kind-only declaration standing in for a
+ *  library's `resources:` entry rather than a resource the author declared. */
+export function isInjectedDeclaration(manifest) {
+    return manifest?.metadata?.[INJECTED] === true;
+}
+/**
+ * Synthesize a kind-only declaration per `resources:` entry, in the declaring
+ * library's own scope.
+ *
+ * That model has to exist because a library's internals are validated in the
+ * library's own pass — the flattened application analysis drops the library doc
+ * — so with nothing behind `connection`, `!ref connection` would have nothing to
+ * resolve against.
+ *
+ * Kind-only is enough because it is already what a ref slot gets: a reading
+ * types its `status:` half from the kind, closed so a typo below it is
+ * `CEL_UNKNOWN_FIELD`, and leaves the flat half open, since no manifest declares
+ * what `snapshot()` returned. So `!ref connection` at a ref slot and
+ * `resources.connection.<field>` in CEL answer exactly as they do for a locally
+ * declared resource.
+ *
+ * The declaration is a stand-in, never an instantiation: the per-resource
+ * validation loop skips it (its kind is routinely an abstract, and its config is
+ * the importer's to supply), and the kernel's import controller filters it out
+ * of the manifests it registers, binding the borrowed instance under the name
+ * instead.
+ */
+export function injectedDeclarations(moduleDoc, ownModule) {
+    const inputs = readResourceInputs(moduleDoc);
+    if (inputs.length === 0)
+        return [];
+    const meta = moduleDoc.metadata;
+    return inputs.map((input) => ({
+        kind: input.kind,
+        metadata: {
+            name: input.name,
+            ...(ownModule ? { module: ownModule } : {}),
+            source: meta?.source ?? "",
+            sourceLine: meta?.sourceLine ?? 0,
+            [INJECTED]: true,
+        },
+    }));
+}
+/** Read a module document's `lifecycle:`. `Telo.Application` has a field of the
+ *  same name with a different default and no reader; this is the LIBRARY
+ *  question only, so it answers `isolated` for anything else. */
+export function readLibraryLifecycle(moduleDoc) {
+    const doc = moduleDoc;
+    if (doc?.kind !== "Telo.Library")
+        return "isolated";
+    return doc.lifecycle === "shared" ? "shared" : "isolated";
+}

package/dist/resource-rule.d.ts

@@ -1,26 +1,3 @@
-/**
- * The single reader for `x-telo-resource-rules` — a kind declaring, as data,
- * relationships between the fields of one resource that JSON Schema cannot
- * state: an index naming a column its table does not declare, a foreign key
- * whose two sides differ in length, a rename whose source is still declared.
- *
- * The predicate is CEL over `self` (the whole resource) and `this` (the element
- * under test), so correlating two collections is a comprehension closure rather
- * than a path language with wildcard bindings to design. `in:` names the
- * collection to iterate and IS the diagnostic anchor: iterating what the pointer
- * names is what makes a reported path exist by construction.
- *
- * Vocabulary borrowed from `Telo.JsonSchema.rules` — `condition` true when the
- * rule HOLDS, the subject bound as `this`, plus `code` and `message` — because
- * two CEL rule vocabularies with opposite polarity is a trap an author falls
- * into once per rule. The two mechanisms stay separate: a `Telo.JsonSchema` rule
- * runs at dispatch against a value, this one at `telo check` against a manifest.
- *
- * Lenient by design, the `ref-slot.ts` precedent: anything unreadable here reads
- * as absent, and `validate-resource-rules.ts` is the strict half that reports it.
- *
- * Browser-safe: no Node built-ins.
- */
 export declare const RESOURCE_RULES_ANNOTATION = "x-telo-resource-rules";
 export type ResourceRuleSeverity = "error" | "warning";
 export interface ResourceRule {
@@ -45,6 +22,22 @@ export interface RuleSubject {
     /** Present when the collection is a map: the entry's key. */
     readonly key?: string;
 }
+/** The engine of a non-CEL tagged sentinel — a `!ref`, an `!include-*` — or
+ *  `undefined`. A reference is comparable and never blocks a rule; the other
+ *  tags hold a value only known once the resource is created, so they do, and
+ *  the diagnostic has to name the tag rather than claim CEL. */
+export declare function deferredTagOf(value: unknown): string | undefined;
+/**
+ * True when a condition was written with the `!cel` tag.
+ *
+ * The readers stay lenient and take a bare string — a rule still runs either
+ * way. What an untagged condition loses is everything outside evaluation: to the
+ * editor's colouring, completion and hover it is a plain string, so a rule author
+ * writes CEL with no help and gets none of the checks a `!cel` scalar gets.
+ * Losing that silently is exactly what a strict half exists to move earlier, so
+ * the tag is reported by the strict halves and never enforced by the readers.
+ */
+export declare function isTaggedCondition(value: unknown): boolean;
 /** A precompiled `!cel` node keeps its author-written text on `source`; a plain
  *  string is taken verbatim so a rule reads the same however the loader was
  *  configured (a round-trip view runs with `compile` off). */
@@ -73,15 +66,35 @@ export declare function pointerToPath(pointer: string): string;
  * declaration defect the strict half reports, and an empty list would hide it.
  */
 export declare function resolveRuleSubjects(config: unknown, pointer: string): RuleSubject[] | undefined;
+/** The first leaf a rule cannot compare, and what it is. `what` is a noun
+ *  phrase the diagnostic quotes verbatim, because "a CEL expression" printed
+ *  over an `!include-bytes` embed sends its author looking for an expression
+ *  that is not there. */
+export interface DynamicLeaf {
+    readonly path: string;
+    readonly what: string;
+}
+/** Classify ONE node, without descending. Exported because a caller that draws
+ *  its own bound on how far to look (`peer-binding`'s top-level-scalar scan)
+ *  must classify by the same rule as the recursive walk, or a `!ref` is a
+ *  reference to one of them and an expression to the other. */
+export declare function dynamicNode(value: unknown, path: string): DynamicLeaf | undefined;
 /**
- * Path of the first CEL leaf inside a value, or `undefined` when every leaf is
- * literal. A rule reading an expression would be evaluating a placeholder, so
- * the subject is skipped — and the skip is reported, never silent.
+ * The first leaf inside a value whose contents are not known until the resource
+ * is created, or `undefined` when every leaf is literal. A rule reading one
+ * would be comparing against a placeholder, so the subject is skipped — and the
+ * skip is reported, never silent.
+ *
+ * A `!ref` is NOT one of them. It is a tagged sentinel like `!cel`, and testing
+ * `__tagged` alone read every reference as an expression: a column whose `type:`
+ * holds a `!ref` switched off every rule touching `self.columns` and reported a
+ * CEL expression in a manifest containing none. A reference names a declaration
+ * — a value a rule compares perfectly well, and the one peer rules are built on.
  *
  * Stops at nested inline `{ kind }` declarations for the reason every other walk
  * does: that CEL belongs to the nested kind, evaluated in its own scope.
  */
-export declare function findDynamicLeaf(value: unknown, base?: string): string | undefined;
+export declare function findDynamicLeaf(value: unknown, base?: string): DynamicLeaf | undefined;
 /**
  * The nodes a condition actually READS, resolved against the resource and the
  * element under test — the input to the dynamic-leaf check.

package/dist/resource-rule.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource-rule.d.ts","sourceRoot":"","sources":["../src/resource-rule.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,eAAO,MAAM,yBAAyB,0BAA0B,CAAC;AAEjE,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,SAAS,CAAC;AAEvD,MAAM,WAAW,YAAY;IAC3B;yEACqE;IACrE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,4CAA4C;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;qEACiE;IACjE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,+CAA+C;AAC/C,MAAM,WAAW,WAAW;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,6DAA6D;IAC7D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAeD;;8DAE8D;AAC9D,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAI9D;AAED;;6CAE6C;AAC7C,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAG7D;AAED,uEAAuE;AACvE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,GAAG,YAAY,EAAE,CA0BjE;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAOrE;AAED;;yEAEyE;AACzE,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAiBvE;AAED;+EAC+E;AAC/E,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAMrD;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,MAAM,GACd,WAAW,EAAE,GAAG,SAAS,CAe3B;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAK,GAAG,MAAM,GAAG,SAAS,CAiB7E;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE;AACtC;;2BAE2B;AAC3B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,EAAE,CAqBX"}
+{"version":3,"file":"resource-rule.d.ts","sourceRoot":"","sources":["../src/resource-rule.ts"],"names":[],"mappings":"AAyBA,eAAO,MAAM,yBAAyB,0BAA0B,CAAC;AAEjE,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,SAAS,CAAC;AAEvD,MAAM,WAAW,YAAY;IAC3B;yEACqE;IACrE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,4CAA4C;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;qEACiE;IACjE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,+CAA+C;AAC/C,MAAM,WAAW,WAAW;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,6DAA6D;IAC7D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAyBD;;;gEAGgE;AAChE,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAGhE;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEzD;AAED;;8DAE8D;AAC9D,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAI9D;AAED;;6CAE6C;AAC7C,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAG7D;AAED,uEAAuE;AACvE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,GAAG,YAAY,EAAE,CA0BjE;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAOrE;AAED;;yEAEyE;AACzE,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAiBvE;AAED;+EAC+E;AAC/E,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAMrD;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,MAAM,GACd,WAAW,EAAE,GAAG,SAAS,CAe3B;AAED;;;yBAGyB;AACzB,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;+DAG+D;AAC/D,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAKjF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAK,GAAG,WAAW,GAAG,SAAS,CAkBlF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE;AACtC;;2BAE2B;AAC3B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,EAAE,CAqBX"}

package/dist/resource-rule.js

@@ -21,6 +21,7 @@
  *
  * Browser-safe: no Node built-ins.
  */
+import { CEL_ENGINE, isRefSentinel, isTaggedSentinel } from "@telorun/templating";
 export const RESOURCE_RULES_ANNOTATION = "x-telo-resource-rules";
 function isObject(value) {
     return !!value && typeof value === "object" && !Array.isArray(value);
@@ -29,9 +30,43 @@ function isObject(value) {
  *  Both markers are tested because they are not always both present: a
  *  registered definition's schema reaches the analyzer with `call` and
  *  `__compiled` dropped, keeping only `__tagged` + `source`. Testing one would
- *  make a rule readable on some paths and invisible on others. */
+ *  make a rule readable on some paths and invisible on others.
+ *
+ *  A tagged sentinel of ANOTHER engine is not one. `__tagged` marks every tag
+ *  the loader parses — `!ref` above all — so testing it alone read a reference
+ *  as an expression: a column whose `type:` holds a `!ref` skipped every rule
+ *  that touched `self.columns`, and said "the value holds a CEL expression" about
+ *  a manifest containing none. A reference names a declaration and is a
+ *  perfectly comparable value; what a rule cannot compare is a value COMPUTED at
+ *  create time, which is what this predicate exists to find. */
 function isCelNode(value) {
-    return isObject(value) && (value.__compiled === true || value.__tagged === true);
+    if (!isObject(value))
+        return false;
+    if (value.__compiled === true)
+        return true;
+    return value.__tagged === true && value.engine === CEL_ENGINE;
+}
+/** The engine of a non-CEL tagged sentinel — a `!ref`, an `!include-*` — or
+ *  `undefined`. A reference is comparable and never blocks a rule; the other
+ *  tags hold a value only known once the resource is created, so they do, and
+ *  the diagnostic has to name the tag rather than claim CEL. */
+export function deferredTagOf(value) {
+    if (!isTaggedSentinel(value) || isRefSentinel(value))
+        return undefined;
+    return value.engine === CEL_ENGINE ? undefined : value.engine;
+}
+/**
+ * True when a condition was written with the `!cel` tag.
+ *
+ * The readers stay lenient and take a bare string — a rule still runs either
+ * way. What an untagged condition loses is everything outside evaluation: to the
+ * editor's colouring, completion and hover it is a plain string, so a rule author
+ * writes CEL with no help and gets none of the checks a `!cel` scalar gets.
+ * Losing that silently is exactly what a strict half exists to move earlier, so
+ * the tag is reported by the strict halves and never enforced by the readers.
+ */
+export function isTaggedCondition(value) {
+    return isCelNode(value);
 }
 /** A precompiled `!cel` node keeps its author-written text on `source`; a plain
  *  string is taken verbatim so a rule reads the same however the loader was
@@ -156,18 +191,37 @@ export function resolveRuleSubjects(config, pointer) {
     }
     return undefined;
 }
+/** Classify ONE node, without descending. Exported because a caller that draws
+ *  its own bound on how far to look (`peer-binding`'s top-level-scalar scan)
+ *  must classify by the same rule as the recursive walk, or a `!ref` is a
+ *  reference to one of them and an expression to the other. */
+export function dynamicNode(value, path) {
+    const at = path || "(value)";
+    if (isCelNode(value))
+        return { path: at, what: "a CEL expression" };
+    const tag = deferredTagOf(value);
+    return tag ? { path: at, what: `an !${tag} embed` } : undefined;
+}
 /**
- * Path of the first CEL leaf inside a value, or `undefined` when every leaf is
- * literal. A rule reading an expression would be evaluating a placeholder, so
- * the subject is skipped — and the skip is reported, never silent.
+ * The first leaf inside a value whose contents are not known until the resource
+ * is created, or `undefined` when every leaf is literal. A rule reading one
+ * would be comparing against a placeholder, so the subject is skipped — and the
+ * skip is reported, never silent.
+ *
+ * A `!ref` is NOT one of them. It is a tagged sentinel like `!cel`, and testing
+ * `__tagged` alone read every reference as an expression: a column whose `type:`
+ * holds a `!ref` switched off every rule touching `self.columns` and reported a
+ * CEL expression in a manifest containing none. A reference names a declaration
+ * — a value a rule compares perfectly well, and the one peer rules are built on.
  *
  * Stops at nested inline `{ kind }` declarations for the reason every other walk
  * does: that CEL belongs to the nested kind, evaluated in its own scope.
  */
 export function findDynamicLeaf(value, base = "") {
     if (isObject(value)) {
-        if (isCelNode(value))
-            return base || "(value)";
+        const own = dynamicNode(value, base);
+        if (own)
+            return own;
         if (typeof value.kind === "string" && base !== "")
             return undefined;
         for (const [key, child] of Object.entries(value)) {

package/dist/rule-condition.d.ts

@@ -25,6 +25,17 @@ import { buildCelEnvironment } from "@telorun/templating";
  * as defective rather than truncating coverage silently.
  */
 export declare const RULE_BUDGET_MS = 50;
+/**
+ * The one message for an untagged `condition:`, shared by every rule family so
+ * all of them say the same thing about the same defect.
+ *
+ * The readers stay lenient and a bare string still runs. What it loses is
+ * everything outside evaluation — to the editor's colouring, completion and
+ * hover an untagged condition is a plain string, so its author writes CEL with
+ * no help and none of the checks a `!cel` scalar gets. Losing that silently is
+ * the failure a strict half exists to move earlier.
+ */
+export declare const UNTAGGED_CONDITION: string;
 /** The analyzer's own environment — no host handlers, so every `hostBacked`
  *  entry is a throwing stub. Built once; it is stateless. */
 export declare function ruleEnv(): ReturnType<typeof buildCelEnvironment>;

package/dist/rule-condition.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rule-condition.d.ts","sourceRoot":"","sources":["../src/rule-condition.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAEL,mBAAmB,EAGpB,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,KAAK,CAAC;AAQjC;6DAC6D;AAC7D,wBAAgB,OAAO,IAAI,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAGhE;AAED,MAAM,MAAM,YAAY,GACpB;IAAE,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC;IAAC,MAAM,EAAE,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAA;CAAE,GAC7F;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAsBvB,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM;AACjB;wEACwE;AACxE,aAAa,EAAE,SAAS,MAAM,EAAE,GAC/B,YAAY,CAoBd;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAmB7D"}
+{"version":3,"file":"rule-condition.d.ts","sourceRoot":"","sources":["../src/rule-condition.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAEL,mBAAmB,EAGpB,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,KAAK,CAAC;AAEjC;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,QAGgD,CAAC;AAQhF;6DAC6D;AAC7D,wBAAgB,OAAO,IAAI,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAGhE;AAED,MAAM,MAAM,YAAY,GACpB;IAAE,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC;IAAC,MAAM,EAAE,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAA;CAAE,GAC7F;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAsBvB,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM;AACjB;wEACwE;AACxE,aAAa,EAAE,SAAS,MAAM,EAAE,GAC/B,YAAY,CAoBd;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAmB7D"}

package/dist/rule-condition.js

@@ -25,6 +25,19 @@ import { CEL_FUNCTIONS, buildCelEnvironment, celEngine, extractAccessChains, } f
  * as defective rather than truncating coverage silently.
  */
 export const RULE_BUDGET_MS = 50;
+/**
+ * The one message for an untagged `condition:`, shared by every rule family so
+ * all of them say the same thing about the same defect.
+ *
+ * The readers stay lenient and a bare string still runs. What it loses is
+ * everything outside evaluation — to the editor's colouring, completion and
+ * hover an untagged condition is a plain string, so its author writes CEL with
+ * no help and none of the checks a `!cel` scalar gets. Losing that silently is
+ * the failure a strict half exists to move earlier.
+ */
+export const UNTAGGED_CONDITION = "Write 'condition' with the !cel tag. The reader is lenient and a bare string still " +
+    "runs, but untagged the expression is not CEL to the editor's colouring, completion " +
+    "or hover, so a rule silently stops being CEL to every surface but this one.";
 const HOST_BACKED = new Set(CEL_FUNCTIONS.filter((f) => f.hostBacked).map((f) => f.name));
 const NON_DETERMINISTIC = new Set(CEL_FUNCTIONS.filter((f) => !f.deterministic).map((f) => f.name));
 let sharedEnv;

package/dist/schema-projection.d.ts

@@ -47,6 +47,32 @@ export interface SchemaProjection {
     readonly nullable?: string;
     /** Entry field that wraps the mapped node in an array. */
     readonly array?: string;
+    /**
+     * How an entry whose keyed field holds a REFERENCE projects.
+     *
+     * The map is keyed on the field's VALUE, and a reference is not a key, so a
+     * `type:` holding one falls through to this path. It is declared as data by the
+     * backend, which is what keeps the analyzer from learning that an enum exists:
+     * `from` names the field of the target declaration to read, `keyword` the
+     * schema keyword its values become, and `base` / `baseFrom` where the node's
+     * own type comes from — a literal for an engine whose named type IS its own
+     * base, a field of the target for one that declares a storage class.
+     *
+     * A backend that declares none projects exactly as it did before.
+     */
+    readonly reference?: ProjectionReference;
+}
+/** The reference path of a projection — see {@link SchemaProjection.reference}. */
+export interface ProjectionReference {
+    /** Field of the TARGET declaration whose value the keyword takes. */
+    readonly from: string;
+    /** The JSON Schema keyword those values become (`enum`). */
+    readonly keyword: string;
+    /** The node the keyword is added to, written literally. */
+    readonly base?: Record<string, unknown>;
+    /** Field of the target declaration naming a value in the kind's own
+     *  `x-telo-schema-map`, whose mapped node is the base. */
+    readonly baseFrom?: string;
 }
 export type SchemaMap = Readonly<Record<string, Record<string, unknown>>>;
 /** The projection a kind declares, or undefined. Invalid shapes read as absent;
@@ -59,6 +85,18 @@ export declare function rawSchemaProjection(definition: unknown): unknown;
 /** True when the annotation was found inside `schema:` rather than on the
  *  document — the misplacement the strict half reports. */
 export declare function schemaProjectionIsMisplaced(definition: unknown): boolean;
+/**
+ * The schema node that CARRIES the value vocabulary — the node itself, or the
+ * branch of a union that declares the map.
+ *
+ * A slot unioning a closed value vocabulary with a reference keeps its map on the
+ * value branch, exactly as the ref-slot reader peels the same union for its
+ * constraint. Exported because the strict half checks the map against the same
+ * branch's `enum`, and two implementations of "which branch is the value one"
+ * would eventually disagree — silently, since the failure of missing one is a
+ * completeness check that quietly stops running.
+ */
+export declare function schemaMapBranch(node: unknown): Record<string, unknown> | undefined;
 export declare function readSchemaMap(node: unknown): SchemaMap | undefined;
 /** The consumer-side annotation: a JSON Pointer to this resource's ref slot
  *  whose target declares the projection. */
@@ -83,7 +121,16 @@ export declare function projectionKeyMap(kindSchema: unknown, projection: Schema
  * enough to double as a validator would move the domain's semantics into the
  * type layer.
  */
-export declare function projectEntries(manifest: unknown, projection: SchemaProjection, map: SchemaMap): Record<string, unknown> | undefined;
+export declare function projectEntries(manifest: unknown, projection: SchemaProjection, map: SchemaMap, 
+/** What a REFERENCE at the keyed field is resolved through, and where a
+ *  failure to resolve one is reported. A caller with no scope cannot resolve
+ *  one, so such an entry projects OPEN — present, untyped — rather than
+ *  vanishing from the row. */
+options?: {
+    readonly scope?: ProjectionScope;
+    readonly pointer?: string;
+    readonly failures?: ProjectionFailure[];
+}): Record<string, unknown> | undefined;
 /** A reference as the analyzer sees it: the internal `{kind, name, alias?}`
  *  shape `resolveRefSentinels` rewrites `!ref` to. */
 export interface ProjectionRef {
@@ -91,8 +138,17 @@ export interface ProjectionRef {
     readonly kind?: string;
     readonly alias?: string;
 }
-/** The `{kind, name, alias?}` reference a value holds, or undefined. Exported so
- *  a host whose slot may hold EITHER shape can fall back to this reading. */
+/**
+ * The `{kind, name, alias?}` reference a value holds, or undefined. Exported so
+ * a host whose slot may hold EITHER shape can fall back to this reading.
+ *
+ * The unresolved `!ref` SENTINEL is read too. `resolveRefSentinels` normally
+ * rewrites one before this pass, but not when the reference names nothing — and
+ * that is exactly when a projection failure is reported, so reading only the
+ * resolved shape made the diagnostic name the target `<unnamed>`, which is the
+ * one fact the author needed from it. A round-trip host (`compile` off) carries
+ * the sentinel for every reference, resolved or not.
+ */
 export declare function readProjectionRef(value: unknown): ProjectionRef | undefined;
 /** What a reference resolved to. `"ambiguous"` is distinct from `undefined`
  *  because the two need different advice: one says disambiguate, the other says
@@ -139,6 +195,16 @@ export interface ProjectionScope {
  * analysis has.
  */
 export declare function manifestListScope(manifests: readonly Record<string, any>[], resolveDefinition: (kind: string) => Record<string, any> | undefined): ProjectionScope;
+/**
+ * Why a slot could not be typed from a projection.
+ *
+ * Each reason is a DIFFERENT repair, which is why the three ways a target can
+ * carry no usable projection are kept apart rather than collapsed into
+ * `no-projection`: that one message ("declares no 'x-telo-schema-projection'")
+ * was printed for a kind that declares one whose key field carries no map, and
+ * for a declaration whose entry collection is simply absent — accusing the wrong
+ * author of the wrong omission in both.
+ */
 export type ProjectionFailure = {
     readonly reason: "no-ref";
     readonly pointer: string;
@@ -150,10 +216,49 @@ export type ProjectionFailure = {
     readonly reason: "ambiguous";
     readonly pointer: string;
     readonly name: string;
-} | {
+}
+/** The target's KIND declares no `x-telo-schema-projection` at all. */
+ | {
     readonly reason: "no-projection";
     readonly pointer: string;
     readonly kind: string;
+}
+/** It declares one, but the field it keys on carries no `x-telo-schema-map`. */
+ | {
+    readonly reason: "no-projection-map";
+    readonly pointer: string;
+    readonly kind: string;
+}
+/** Both are declared and the DECLARATION holds no entry collection to project
+ *  — an absent `columns:`, or a value that is not a collection. */
+ | {
+    readonly reason: "no-entries";
+    readonly pointer: string;
+    readonly kind: string;
+    readonly entries: string;
+}
+/** The slot names a resource the module does not DECLARE — a library's
+ *  `resources:` input, standing in for an instance its importer supplies. A
+ *  projection is DECLARATION-derived, so it cannot be answered here at all;
+ *  the stand-in has no entries, and reporting that would tell the library
+ *  author their block is wrong when it is correct. Resolution moves to the
+ *  injection site, where the real declaration is. Carried as its own reason
+ *  rather than as `no-entries` so a consumer can tell "unanswerable here"
+ *  from "answered, and empty". */
+ | {
+    readonly reason: "injected";
+    readonly pointer: string;
+    readonly name: string;
+}
+/** An ENTRY of the projected declaration references a shape that could not be
+ *  read. Reported rather than dropped: the entry would silently vanish from
+ *  the projected row, so a consumer naming it would be told the property does
+ *  not exist. */
+ | {
+    readonly reason: "entry-reference";
+    readonly pointer: string;
+    readonly entry: string;
+    readonly name: string;
 };
 export declare function describeProjectionFailure(failure: ProjectionFailure): string;
 /**
@@ -166,6 +271,16 @@ export declare function describeProjectionFailure(failure: ProjectionFailure): s
  * `failures`, because degrading SILENTLY is the failure this whole mechanism
  * exists to move earlier: the consumer's contract quietly reopens and a
  * misspelled field passes `telo check` exactly as it did before.
+ *
+ * **A node that projected NOTHING is returned by IDENTITY**, and that is a
+ * correctness property of the caller rather than a micro-optimization:
+ * `DefinitionRegistry` memoizes a compiled AJV validator per schema OBJECT,
+ * because every resource of a kind is checked against the same one at keystroke
+ * time. Rebuilding each node unconditionally — which this did — misses that memo
+ * for every resource in the analysis, so AJV recompiled the whole kind schema
+ * once per resource: on `apps/hub` that was 197 compiles instead of 54, and 723
+ * ms instead of 97. Returning the input where nothing changed restores it for
+ * every kind that declares no projection at all, which is nearly all of them.
  */
 export declare function resolveSchemaProjections(schema: unknown, manifest: Record<string, any> | undefined, scope: ProjectionScope, failures?: ProjectionFailure[]): unknown;
 //# sourceMappingURL=schema-projection.d.ts.map