@telorun/analyzer 0.65.0 → 0.67.0

package/dist/validate-cel-context.js

@@ -1,8 +1,35 @@
 export { extractAccessChains, validateChainAgainstSchema } from "@telorun/templating";
 import { elementSchemaOf, isLiveSlot, mergeTypeSchemas, parseCanonicalTypeSchemaId, } from "@telorun/sdk";
 import { KERNEL_BUILTINS } from "./builtins.js";
-import { isStepSlot } from "./step-slot.js";
 import { withRefSlotsAsReadings } from "./ref-slot-reading.js";
+// Where CEL is evaluated is one reader (`eval-paths.ts`), and the region half of
+// it moved there so the scope walk and the `x-telo-eval` walk answer the same
+// question in one place. Re-exported: this module is where every existing
+// consumer imports them from.
+export { extractCelRegionScopes, pathMatchesScope } from "./eval-paths.js";
+/** True when a node's value is decided at load or dispatch rather than written
+ *  — a tagged sentinel (`!cel`, `!sql`, an embed) or an already-compiled value.
+ *  A schema position holding one declares a shape nothing static can read. */
+function isDynamicNode(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const node = value;
+    return node.__tagged === true || node.__compiled !== undefined;
+}
+/** Replace every dynamically-valued property with an OPEN schema, so the name is
+ *  in scope with its members unconstrained. */
+function openDynamicProperties(props) {
+    if (!props || typeof props !== "object")
+        return props;
+    let out;
+    for (const [key, value] of Object.entries(props)) {
+        if (!isDynamicNode(value))
+            continue;
+        out ??= { ...props };
+        out[key] = {};
+    }
+    return out ?? props;
+}
 /**
  * Resolve a type field value (string name, inline type, or raw schema) to a JSON Schema.
  * - String: look up the named type in allManifests (Type.JsonSchema resources)
@@ -229,36 +256,6 @@ function collectionBindingWithheld(schema, manifestRoot, allManifests) {
         return false;
     return isLiveSlot(resolveCollectionSchema(manifestRoot, from, allManifests));
 }
-/**
- * Returns true when a CEL expression path (from walkCelExpressions, e.g. "routes[0].inputs.q")
- * falls within the scope of a context (e.g. "$.routes[*].inputs").
- *
- * The scope is matched directly (no sibling sharing): a context at "$.routes[*].inputs" only
- * applies to expressions whose path starts with "routes[N].inputs", not to other sibling fields.
- */
-export function pathMatchesScope(exprPath, scope) {
-    const stripped = scope.startsWith("$.") ? scope.slice(2) : scope;
-    if (!stripped)
-        return false;
-    // Split on wildcard array segments; each [*] must match a concrete [N] in exprPath
-    const parts = stripped.split("[*]");
-    let remaining = exprPath;
-    for (let i = 0; i < parts.length; i++) {
-        const part = parts[i];
-        if (!remaining.startsWith(part))
-            return false;
-        remaining = remaining.slice(part.length);
-        if (i < parts.length - 1) {
-            // Expect a concrete array index like [0], [12], ...
-            const m = remaining.match(/^\[\d+\]/);
-            if (!m)
-                return false;
-            remaining = remaining.slice(m[0].length);
-        }
-    }
-    // Expression must end here or continue into a child path
-    return remaining === "" || remaining[0] === "." || remaining[0] === "[";
-}
 /**
  * Resolves `x-telo-context-*` annotations in a context schema using the concrete
  * manifest item (per-scope) and the manifest root.
@@ -324,8 +321,19 @@ export function resolveContextAnnotations(schema, manifestItem, opts) {
         // to be resolved first: the standard library writes it as the inline
         // `{ kind: Type.JsonSchema, schema: … }` wrapper, so merging it verbatim
         // would type the variable as `{ kind, schema }` instead of its properties.
+        // The navigated node — or one of the properties in it — may itself be an
+        // expression: a route whose `request.schema.body` is `!cel "self.model.schema"`
+        // declares a body whose SHAPE is only known once the template is
+        // instantiated. Such a name types as OPEN rather than as nothing, and a
+        // wholly dynamic map leaves the whole node open. Resolving it to nothing
+        // reports `request.body` as undefined, which blames the reader for the
+        // writer's dynamism — the same posture a rule takes when a value it reads
+        // is dynamic: skip the judgement, never invert it.
+        if (isDynamicNode(navigated)) {
+            return { ...schema, properties: { ...(schema.properties ?? {}) }, additionalProperties: true };
+        }
         const asType = resolveTypeFieldToSchema(navigated, allManifests ?? []);
-        const resolved = asType?.properties ?? navigated;
+        const resolved = openDynamicProperties(asType?.properties ?? navigated);
         const required = Array.isArray(asType?.required) ? asType.required : undefined;
         return {
             ...schema,
@@ -464,14 +472,40 @@ export function resolveContextAnnotations(schema, manifestItem, opts) {
  */
 export function getManifestItem(exprPath, scope, manifest) {
     const stripped = scope.startsWith("$.") ? scope.slice(2) : scope;
-    const wildcardIdx = stripped.indexOf("[*]");
-    if (wildcardIdx === -1)
-        return manifest;
-    const arrayProp = stripped.slice(0, wildcardIdx); // e.g. "routes"
-    const m = exprPath.match(new RegExp(`^${arrayProp}\\[(\\d+)\\]`));
-    if (!m)
+    const parts = stripped.split("[*]");
+    if (parts.length === 1)
         return manifest;
-    return manifest[arrayProp]?.[Number(m[1])] ?? manifest;
+    // Resolve each `[*]` against the concrete index the expression path carries at
+    // the same position, accumulating up to the LAST wildcard: that node is the
+    // per-scope item (`routes[2]`), which is what `x-telo-context-from` navigates
+    // from. Built by walking the pattern rather than by a regex over the scope —
+    // a scope is a path, not a pattern, and its own `[4]` segments are regex
+    // character classes, which is what silently made every nested scope resolve
+    // to the whole document instead of the item.
+    let remaining = exprPath;
+    let concrete = "";
+    for (let i = 0; i < parts.length - 1; i++) {
+        const part = parts[i];
+        if (!remaining.startsWith(part))
+            return manifest;
+        remaining = remaining.slice(part.length);
+        const index = remaining.match(/^\[(\d+)\]/);
+        if (!index)
+            return manifest;
+        remaining = remaining.slice(index[0].length);
+        concrete += `${part}${index[0]}`;
+    }
+    return navigateConcretePath(manifest, concrete) ?? manifest;
+}
+/** Walk a concrete dotted path with `[N]` indices (`resources[4].routes[2]`). */
+function navigateConcretePath(root, path) {
+    let cur = root;
+    for (const segment of path.match(/[^.[\]]+/g) ?? []) {
+        if (cur === null || typeof cur !== "object")
+            return undefined;
+        cur = cur[segment];
+    }
+    return cur;
 }
 function navigatePath(obj, segments) {
     let cur = obj;
@@ -496,45 +530,6 @@ export function extractContextsFromSchema(schema, path = "$") {
     const all = collectContexts(schema, path);
     return all.sort((a, b) => b.scope.length - a.scope.length);
 }
-/** Schema keys that declare a CEL-bearing region: a field carrying any of these
- *  is evaluated at runtime, so a `!cel` inside it (or a descendant) is live. A
- *  STEP BODY is one too, and says so through the grammar its items point at
- *  rather than through a key — {@link isStepSlot} reads either spelling. */
-const CEL_REGION_KEYS = [
-    "x-telo-context",
-    "x-telo-step-context",
-    "x-telo-error-context",
-];
-/**
- * Walk a JSON Schema tree and collect the JSONPath scopes of every field that
- * declares a CEL-bearing region (`x-telo-context` / `x-telo-step-context` /
- * `x-telo-error-context`). Used — alongside `x-telo-eval` paths — to decide
- * whether a `!cel` expression sits in a slot the runtime actually evaluates.
- * Scopes use the same `$.a.b[*]` form as `extractContextsFromSchema`, matched
- * against expression paths with `pathMatchesScope`.
- */
-export function extractCelRegionScopes(schema, path = "$") {
-    if (!schema || typeof schema !== "object")
-        return [];
-    const out = [];
-    if (CEL_REGION_KEYS.some((k) => schema[k]) || isStepSlot(schema))
-        out.push(path);
-    if (schema.properties) {
-        for (const [key, value] of Object.entries(schema.properties)) {
-            out.push(...extractCelRegionScopes(value, `${path}.${key}`));
-        }
-    }
-    if (schema.items && typeof schema.items === "object") {
-        out.push(...extractCelRegionScopes(schema.items, `${path}[*]`));
-    }
-    for (const key of ["oneOf", "anyOf", "allOf"]) {
-        if (Array.isArray(schema[key])) {
-            for (const subschema of schema[key])
-                out.push(...extractCelRegionScopes(subschema, path));
-        }
-    }
-    return out;
-}
 function collectContexts(schema, path) {
     if (!schema || typeof schema !== "object")
         return [];

package/dist/validate-identifier-names.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-identifier-names.d.ts","sourceRoot":"","sources":["../src/validate-identifier-names.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAOnE,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIrD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,EACtB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EACxB,KAAK,EAAE,SAAS,GACf,kBAAkB,EAAE,CAgEtB"}
+{"version":3,"file":"validate-identifier-names.d.ts","sourceRoot":"","sources":["../src/validate-identifier-names.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAQnE,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIrD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,EACtB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EACxB,KAAK,EAAE,SAAS,GACf,kBAAkB,EAAE,CAwEtB"}

package/dist/validate-identifier-names.js

@@ -1,4 +1,5 @@
 import { TYPE_LEVEL_DOC_KINDS, checkName, } from "./identifier-name.js";
+import { isInjectedDeclaration } from "./resource-input.js";
 const SOURCE = "telo-analyzer";
 /**
  * Every author-written name in one pass — resource instances, kinds, modules,
@@ -36,6 +37,11 @@ export function validateIdentifierNames(manifests, registry, aliases, rootModule
         // would blame them for a spelling this pass's own pipeline chose.
         if (metadata?.xTeloOrigin)
             continue;
+        // A kind-only stand-in for a `resources:` entry carries the name the author
+        // wrote in that block, and the block's own keys are checked below — on the
+        // module doc, where the name is written and a squiggle can land.
+        if (isInjectedDeclaration(manifest))
+            continue;
         const ownModule = metadata?.module;
         if (ownModule && !rootModules.has(ownModule))
             continue;
@@ -53,7 +59,10 @@ export function validateIdentifierNames(manifests, registry, aliases, rootModule
         // keys are the imported library's declarations, so a violation there is
         // the library author's, reported when their module is analyzed as a root.
         if (manifest.kind === "Telo.Application" || manifest.kind === "Telo.Library") {
-            for (const field of ["variables", "secrets", "ports"]) {
+            // `resources:` joins them: a library's resource inputs are named in the
+            // same identifier space (`!ref connection`, `resources.connection`) and
+            // break the same way.
+            for (const field of ["variables", "secrets", "ports", "resources"]) {
                 const block = manifest[field];
                 if (!block || typeof block !== "object" || Array.isArray(block))
                     continue;
@@ -125,7 +134,13 @@ function surfaceFor(kind) {
     }
 }
 function singular(field) {
-    return field === "variables" ? "variable" : field === "secrets" ? "secret" : "port";
+    return field === "variables"
+        ? "variable"
+        : field === "secrets"
+            ? "secret"
+            : field === "ports"
+                ? "port"
+                : "resource input";
 }
 function push(out, violation, at) {
     if (!violation)

package/dist/validate-reference-forms.d.ts

@@ -23,6 +23,16 @@ import { type AnalysisDiagnostic } from "./types.js";
  * Rejected, each with an actionable diagnostic pointing at `!ref`:
  *   - the object form `{ kind, name }` (the old reference object), and
  *   - a bare string (the old name / dotted-FQN reference).
+ *
+ * **A value-or-reference union slot is the one exception**, and it is decided by
+ * the value rather than by a new spelling: where the reference constraint is a
+ * *branch* of a union (`type:` on a column, holding either a storage class or a
+ * `!ref` to a declared enum), a SCALAR is a value and is left to that branch,
+ * while an object is still checked for the removed `{kind, name}` form unless a
+ * branch describes it. The rule guards a REMOVED spelling — a bare string is
+ * simply not a reference in Telo — so admitting one takes nothing away: what it
+ * costs is the answer when an author meant a reference and wrote a bare name,
+ * which against a closed branch AJV reports as an unknown value.
  */
 export declare function validateReferenceForms(resources: ResourceManifest[], registry: DefinitionRegistry, aliases?: AliasResolver, aliasesByModule?: Map<string, AliasResolver>): AnalysisDiagnostic[];
 //# sourceMappingURL=validate-reference-forms.d.ts.map

package/dist/validate-reference-forms.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-reference-forms.d.ts","sourceRoot":"","sources":["../src/validate-reference-forms.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAGnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE,aAAa,EACvB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC3C,kBAAkB,EAAE,CA+DtB"}
+{"version":3,"file":"validate-reference-forms.d.ts","sourceRoot":"","sources":["../src/validate-reference-forms.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAInE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE,aAAa,EACvB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC3C,kBAAkB,EAAE,CA0EtB"}

package/dist/validate-reference-forms.js

@@ -1,5 +1,6 @@
 import { isTaggedSentinel } from "@telorun/templating";
 import { visitManifest } from "./manifest-visitor.js";
+import { satisfiesValueBranch } from "./reference-field-map.js";
 import { REF_VALIDATION_SKIP_KINDS as SYSTEM_KINDS } from "./system-kinds.js";
 import { DiagnosticSeverity } from "./types.js";
 const SOURCE = "telo-analyzer";
@@ -24,6 +25,16 @@ const SOURCE = "telo-analyzer";
  * Rejected, each with an actionable diagnostic pointing at `!ref`:
  *   - the object form `{ kind, name }` (the old reference object), and
  *   - a bare string (the old name / dotted-FQN reference).
+ *
+ * **A value-or-reference union slot is the one exception**, and it is decided by
+ * the value rather than by a new spelling: where the reference constraint is a
+ * *branch* of a union (`type:` on a column, holding either a storage class or a
+ * `!ref` to a declared enum), a SCALAR is a value and is left to that branch,
+ * while an object is still checked for the removed `{kind, name}` form unless a
+ * branch describes it. The rule guards a REMOVED spelling — a bare string is
+ * simply not a reference in Telo — so admitting one takes nothing away: what it
+ * costs is the answer when an author meant a reference and wrote a bare name,
+ * which against a closed branch AJV reports as an unknown value.
  */
 export function validateReferenceForms(resources, registry, aliases, aliasesByModule) {
     if (!aliases)
@@ -37,6 +48,18 @@ export function validateReferenceForms(resources, registry, aliases, aliasesByMo
             // `!ref` and `!cel`/`${{ }}` sentinels are the supported shapes.
             if (isTaggedSentinel(value))
                 return;
+            // A SCALAR at a slot whose union has a value branch is a value, and the
+            // value branch is what judges it. Reporting a mistyped storage class as
+            // a malformed reference — "write it as '!ref txt'" — instructs the author
+            // to convert a typo into a reference, and AJV has already said what the
+            // value must be one of. The object form below is not ambiguous the same
+            // way: `{kind, name}` is the removed reference object, so it is still
+            // reported unless a branch genuinely describes that shape.
+            const hasValueBranch = (e.entry.valueBranches?.length ?? 0) > 0;
+            if (hasValueBranch && typeof value !== "object")
+                return;
+            if (satisfiesValueBranch(value, e.entry.valueBranches, registry))
+                return;
             const r = e.source;
             const resourceLabel = `${r.kind}/${r.metadata.name}`;
             const resourceData = { kind: r.kind, name: r.metadata.name };

package/dist/validate-references.d.ts

@@ -1,5 +1,22 @@
 import type { ResourceManifest } from "@telorun/sdk";
 import { type AnalysisDiagnostic, type AnalysisContext } from "./types.js";
+import type { DefinitionRegistry } from "./definition-registry.js";
+/**
+ * Liskov substitutability at a kind constraint: is `resolved` (a canonical
+ * `<module>.<Kind>`) accepted where `targetKind` is required?
+ *
+ * THE one implementation — `checkKind` below builds a MESSAGE from it and adds
+ * nothing to the rule, so a resource input's injection site and an ordinary ref
+ * slot cannot come to disagree about what satisfies a constraint.
+ *
+ * A value satisfies the slot when it transitively extends the target kind, or —
+ * for a CONCRETE target — IS that kind; `getByExtends` is the same transitive
+ * subtype index for both, and an abstract is satisfied only by an implementer,
+ * never by the abstract itself (which is non-instantiable). Accepts a constraint
+ * that resolves to nothing, and an abstract with no loaded implementations:
+ * partial context, where a rejection would be a guess.
+ */
+export declare function kindSatisfies(resolved: string, targetKind: string, registry: DefinitionRegistry): boolean;
 /**
  * Phase 3 — Reference validation.
  *

package/dist/validate-references.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-references.d.ts","sourceRoot":"","sources":["../src/validate-references.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAOrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAuD/F;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,GACvB,kBAAkB,EAAE,CAogBtB"}
+{"version":3,"file":"validate-references.d.ts","sourceRoot":"","sources":["../src/validate-references.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAarD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAE/F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAInE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,kBAAkB,GAC3B,OAAO,CAwBT;AA8DD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,GACvB,kBAAkB,EAAE,CA2gBtB"}

package/dist/validate-references.js

@@ -1,19 +1,73 @@
 import { isRefSentinel } from "@telorun/templating";
 import { visitManifest } from "./manifest-visitor.js";
-import { isInlineResource, resolveFieldEntries, resolveFieldValues } from "./reference-field-map.js";
+import { isInlineResource, resolveFieldEntries, resolveFieldValues, satisfiesValueBranch, } from "./reference-field-map.js";
 import { navigateJsonPointer, substituteCelFields } from "./schema-compat.js";
 import { REF_VALIDATION_SKIP_KINDS as SYSTEM_KINDS } from "./system-kinds.js";
 import { resolveTypeFieldToSchema } from "./validate-cel-context.js";
 import { DiagnosticSeverity } from "./types.js";
 const SOURCE = "telo-analyzer";
 /**
- * Checks whether `kind` satisfies the ref constraint in `entry`.
- * Returns an empty array when valid, or mismatch error strings when not.
- * Returns an empty array immediately when the ref identity is not registered
- * (partial context — skip check rather than false-positive).
+ * Liskov substitutability at a kind constraint: is `resolved` (a canonical
+ * `<module>.<Kind>`) accepted where `targetKind` is required?
+ *
+ * THE one implementation — `checkKind` below builds a MESSAGE from it and adds
+ * nothing to the rule, so a resource input's injection site and an ordinary ref
+ * slot cannot come to disagree about what satisfies a constraint.
+ *
+ * A value satisfies the slot when it transitively extends the target kind, or —
+ * for a CONCRETE target — IS that kind; `getByExtends` is the same transitive
+ * subtype index for both, and an abstract is satisfied only by an implementer,
+ * never by the abstract itself (which is non-instantiable). Accepts a constraint
+ * that resolves to nothing, and an abstract with no loaded implementations:
+ * partial context, where a rejection would be a guess.
  */
+export function kindSatisfies(resolved, targetKind, registry) {
+    const canonical = registry.resolveRef(targetKind) ?? targetKind;
+    const targetDef = registry.resolve(canonical);
+    if (!targetDef)
+        return true;
+    if (targetDef.kind !== "Telo.Abstract" && resolved === canonical)
+        return true;
+    const subtypes = registry.getByExtends(canonical);
+    if (subtypes.some((d) => `${d.metadata.module}.${d.metadata.name}` === resolved))
+        return true;
+    // Leniency is about the CANDIDATE, not about the population, and it is the
+    // same question for an abstract target and a concrete one. Accepting whenever
+    // no subtype happened to be loaded silenced the check exactly where it was
+    // needed: an app whose imports declare no `Telo.Runnable` is an app whose boot
+    // targets are all wrong, and every one of them passed.
+    //
+    // An UNREGISTERED candidate is not partial context, and the distinction is
+    // load-bearing: a kind nobody declared is an unknown kind or an unimported
+    // alias prefix (`NotAnAlias.Script`), which is precisely what this check
+    // exists to report. Only a kind that IS declared, whose ancestry reaches
+    // something this analysis never saw, is undecidable — there the missing hop is
+    // where the target it appears not to reach could have been declared.
+    // A candidate the registry never saw cannot be judged on what it implements —
+    // the analysis simply does not hold it. Whether its NAME is resolvable is a
+    // different question, asked of the alias scope by the caller.
+    if (!registry.resolve(resolved))
+        return true;
+    return !registry.ancestryResolved(resolved);
+}
+/** {@link kindSatisfies} at every kind a slot accepts, rendered as messages.
+ *  The acceptance rule is not restated here — only what to say when it fails,
+ *  which needs the slot's alternatives and the target's flavour. */
 function checkKind(kind, entry, registry, aliases) {
     const resolved = aliases.resolveKind(kind) ?? kind;
+    // A qualified kind whose prefix names no import in this scope is a bad NAME
+    // rather than a bad type — `{kind: NotAnAlias.Script}` where only `Lib` is
+    // imported — and this check is the only place it surfaces, so it is never
+    // waved through as partial context. Asked of the resolver, which reports
+    // `unknown` for exactly that case: a kind reached through a DECLARED alias
+    // resolves (`ok`) even when the target's definitions are not loaded, and a
+    // gated one says so separately.
+    const unknownAlias = kind.includes(".") &&
+        aliases.resolveKindResult(kind).status === "unknown" &&
+        // …and the registry does not hold it under the name as written either. A
+        // manifest may carry a canonical `<module>.<Kind>`, which no alias resolves
+        // and which is nonetheless perfectly identified.
+        registry.resolve(resolved) === undefined;
     const errors = [];
     for (const refStr of entry.refs) {
         const targetKind = registry.resolveRef(refStr);
@@ -22,20 +76,11 @@ function checkKind(kind, entry, registry, aliases) {
         const targetDef = registry.resolve(targetKind);
         if (!targetDef)
             return [];
-        // Liskov substitutability: a value satisfies the slot when it transitively
-        // extends the target kind, or — for a CONCRETE target — IS that kind.
-        // `getByExtends` is the same transitive subtype index for abstract and
-        // concrete targets alike; an abstract is satisfied only by an implementer,
-        // never by the abstract kind itself (which is non-instantiable).
-        if (targetDef.kind !== "Telo.Abstract" && resolved === targetKind)
+        if (!unknownAlias && kindSatisfies(resolved, targetKind, registry))
             return [];
         const subtypes = registry.getByExtends(targetKind);
         const subtypeKinds = new Set(subtypes.map((d) => `${d.metadata.module}.${d.metadata.name}`));
-        if (subtypeKinds.has(resolved))
-            return [];
         if (targetDef.kind === "Telo.Abstract") {
-            if (subtypes.length === 0)
-                return []; // partial context — no implementations loaded yet
             // Suggest only what an author can actually wire: with abstract-extends-
             // abstract real (Telo.Executable over Invocable/Runnable), the transitive
             // subtype list contains abstracts, which are non-instantiable and would
@@ -43,8 +88,15 @@ function checkKind(kind, entry, registry, aliases) {
             const concrete = subtypes
                 .filter((d) => d.kind !== "Telo.Abstract")
                 .map((d) => `${d.metadata.module}.${d.metadata.name}`);
-            const options = (concrete.length > 0 ? concrete : [...subtypeKinds]).join(", ");
-            errors.push(`'${kind}' does not implement '${targetKind}' (known implementations: ${options})`);
+            const options = concrete.length > 0 ? concrete : [...subtypeKinds];
+            // With nothing loaded that implements the target there is no list to
+            // offer, so the message says what this kind IS instead — which is the
+            // half the author can act on ("it declares 'Telo.Invocable'" points
+            // straight at a boot target that should have been an invoke step).
+            const declared = registry.resolve(resolved)?.capability;
+            errors.push(options.length > 0
+                ? `'${kind}' does not implement '${targetKind}' (known implementations: ${options.join(", ")})`
+                : `'${kind}' does not implement '${targetKind}'${declared ? ` — it declares '${declared}'` : ""}`);
         }
         else {
             const options = subtypeKinds.size > 0 ? ` or a subtype (${[...subtypeKinds].join(", ")})` : "";
@@ -91,7 +143,7 @@ export function validateReferences(resources, context) {
     // Group manifests by name to detect collisions. Two subtleties:
     //
     //   1. Some analyzer hosts emit the SAME physical document twice through
-    //      their pipeline — e.g. the telo-editor's `toAnalysisManifests` walks
+    //      their pipeline — e.g. telo studio's `toAnalysisManifests` walks
     //      each workspace module's documents independently, and a file
     //      reachable from two angles (entry module + `include:` partial)
     //      shows up twice. The fingerprint includes `sourceLine` so identical
@@ -278,6 +330,13 @@ export function validateReferences(resources, context) {
             if (typeof val !== "object")
                 return;
             const refVal = val;
+            // A value the slot's own union describes is a value, not a reference —
+            // the same narrowing `validateReferenceForms` applies, through the same
+            // function, because it has to be applied here too: an OBJECT-shaped value
+            // branch would otherwise reach the structural check below and be reported
+            // as a reference missing 'kind' and 'name'.
+            if (satisfiesValueBranch(val, entry.valueBranches, registry))
+                return;
             // Skip inline resources — Phase 2 normalization hasn't run yet.
             if (isInlineResource(refVal))
                 return;

package/dist/validate-referrer-rules.d.ts

@@ -24,6 +24,8 @@
  */
 import type { ResourceManifest } from "@telorun/sdk";
 import { type ReferrerRule } from "./referrer-rule.js";
+import type { PeerBinder, PeerBindingFailure, PeersTarget } from "./peer-binding.js";
+import { type DynamicLeaf } from "./resource-rule.js";
 export interface ReferrerRuleIssue {
     code: "REFERRER_RULE_INVALID";
     manifest: ResourceManifest;
@@ -48,7 +50,12 @@ export type ReferrerRuleFinding = {
     kind: "skipped";
     rule: ReferrerRule;
     referrer: Referrer;
-    dynamicAt: string;
+    dynamic: DynamicLeaf;
+} | {
+    kind: "unbound";
+    rule: ReferrerRule;
+    referrer: Referrer;
+    failure: PeerBindingFailure;
 } | {
     kind: "failed";
     rule: ReferrerRule;
@@ -60,6 +67,28 @@ export type ReferrerRuleFinding = {
     referrer: Referrer;
     elapsedMs: number;
 };
+/** What a peer rule needs beyond the referrers themselves: the binder that
+ *  resolves a referrer's collection into declarations. Absent for a host that
+ *  cannot resolve one — a rule declaring `peers:` then reports as unbound rather
+ *  than running with the binding missing, which would evaluate a condition
+ *  against names that are simply not there.
+ *
+ *  ONE binder per analysis, because it caches each referrer's resolved
+ *  collection and both the evaluation and the exercised check ask for it. */
+export interface ReferrerRuleContext {
+    readonly peerBinder?: PeerBinder;
+}
+/** What a `peers:` pointer names in the referrer kind it is filtered to. Defined
+ *  with the binding vocabulary; re-exported here because this is the surface
+ *  that consumes it. The caller resolves it — only it holds the definition
+ *  registry, and only after every kind is registered, since a rule may name a
+ *  kind declared later in the same file. */
+export type { PeersTarget };
+export interface ReferrerRuleDeclarationContext {
+    /** Resolves a rule's `peers:` against its `referrer:` kind. Omit to skip the
+     *  check — the safe direction for a host with no registry. */
+    readonly peersTarget?: (referrerKind: string, pointer: string) => PeersTarget;
+}
 /**
  * Report every way a kind's referrer-rule declarations are malformed. Runs on
  * the `Telo.Definition` / `Telo.Abstract` doc, so a defect lands on the line the
@@ -69,7 +98,7 @@ export type ReferrerRuleFinding = {
  * declaring module's scope by `resolveSchemaRefKinds`, the only pass holding
  * that scope, and a name resolving to nothing is reported from there.
  */
-export declare function validateReferrerRuleDeclarations(manifest: ResourceManifest): ReferrerRuleIssue[];
+export declare function validateReferrerRuleDeclarations(manifest: ResourceManifest, context?: ReferrerRuleDeclarationContext): ReferrerRuleIssue[];
 /**
  * Run a kind's referrer rules against every resource that references one of its
  * resources.
@@ -79,16 +108,21 @@ export declare function validateReferrerRuleDeclarations(manifest: ResourceManif
  * manifest identity, since a name alone is module-scoped — because the condition
  * reads the two manifests and nothing about the site, so a second site could only
  * produce the identical verdict at a different path.
+ *
+ * **A rule declaring `peers:` is the exception, and evaluates once per ENTRY.**
+ * That is a deliberate departure from judge-once rather than an inconsistency: a
+ * rule that binds `entry` is about the entry, so a resource listed twice has two
+ * entries to answer for, and the two sites can genuinely disagree.
  */
 export declare function evaluateReferrerRules(manifest: ResourceManifest, definitionSchema: unknown, referrers: readonly Referrer[], 
 /** Whether a referrer of `kind` satisfies a rule's `referrer:` filter —
  *  Liskov-substitutable, so a child of the named kind matches. Supplied by the
  *  caller, which holds the definition registry. */
-kindMatches: (filter: string, kind: string) => boolean): ReferrerRuleFinding[];
+kindMatches: (filter: string, kind: string) => boolean, context?: ReferrerRuleContext): ReferrerRuleFinding[];
 /** Whether a rule found any referrer to judge — the input to the never-exercised
  *  report, which is how a mistyped `referrer:` filter would otherwise disable a
  *  check in silence. */
-export declare function referrerRuleExercised(rule: ReferrerRule, referrers: readonly Referrer[], kindMatches: (filter: string, kind: string) => boolean): boolean;
+export declare function referrerRuleExercised(rule: ReferrerRule, referrers: readonly Referrer[], kindMatches: (filter: string, kind: string) => boolean, context?: ReferrerRuleContext): boolean;
 /** Where a referrer-rule finding is reported, and how loudly. Plain data, so the
  *  caller pushes it exactly as it does for the resource-rule reports. */
 export interface ReferrerRuleDiagnostic {

package/dist/validate-referrer-rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-referrer-rules.d.ts","sourceRoot":"","sources":["../src/validate-referrer-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,oBAAoB,CAAC;AAI5B,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,+EAA+E;AAC/E,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kFAAkF;IAClF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,0CAA0C;AAC1C,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC9E;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC9E;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3E;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAMvF;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAAC,QAAQ,EAAE,gBAAgB,GAAG,iBAAiB,EAAE,CA2EhG;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,gBAAgB,EAC1B,gBAAgB,EAAE,OAAO,EACzB,SAAS,EAAE,SAAS,QAAQ,EAAE;AAC9B;;mDAEmD;AACnD,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,GACrD,mBAAmB,EAAE,CAmEvB;AAED;;wBAEwB;AACxB,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,YAAY,EAClB,SAAS,EAAE,SAAS,QAAQ,EAAE,EAC9B,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,GACrD,OAAO,CAIT;AAED;yEACyE;AACzE,MAAM,WAAW,sBAAsB;IACrC,IAAI,EACA,wBAAwB,GACxB,uBAAuB,GACvB,uBAAuB,GACvB,2BAA2B,CAAC;IAChC,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,aAAa,CAAC;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB;oEACgE;IAChE,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAKD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,gBAAgB,EAC1B,UAAU,EAAE,gBAAgB,GAAG,SAAS,EACxC,QAAQ,EAAE,SAAS,mBAAmB,EAAE;AACxC,0EAA0E;AAC1E,iBAAiB,EAAE,OAAO,GACzB,sBAAsB,EAAE,CAmE1B;AAED;;kDAEkD;AAClD,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,gBAAgB,EAC5B,IAAI,EAAE,YAAY,GACjB,sBAAsB,CAexB"}
+{"version":3,"file":"validate-referrer-rules.d.ts","sourceRoot":"","sources":["../src/validate-referrer-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrF,OAAO,EAGL,KAAK,WAAW,EAKjB,MAAM,oBAAoB,CAAC;AAQ5B,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,+EAA+E;AAC/E,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kFAAkF;IAClF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,0CAA0C;AAC1C,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC9E;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GACjF;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,kBAAkB,CAAA;CAAE,GACxF;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3E;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvF;;;;;;;6EAO6E;AAC7E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;CAClC;AAMD;;;;4CAI4C;AAC5C,YAAY,EAAE,WAAW,EAAE,CAAC;AAE5B,MAAM,WAAW,8BAA8B;IAC7C;kEAC8D;IAC9D,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,WAAW,CAAC;CAC/E;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,GAAE,8BAAmC,GAC3C,iBAAiB,EAAE,CAiFrB;AAuDD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,gBAAgB,EAC1B,gBAAgB,EAAE,OAAO,EACzB,SAAS,EAAE,SAAS,QAAQ,EAAE;AAC9B;;mDAEmD;AACnD,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,EACtD,OAAO,GAAE,mBAAwB,GAChC,mBAAmB,EAAE,CAyFvB;AAED;;wBAEwB;AACxB,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,YAAY,EAClB,SAAS,EAAE,SAAS,QAAQ,EAAE,EAC9B,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,EACtD,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAgBT;AAED;yEACyE;AACzE,MAAM,WAAW,sBAAsB;IACrC,IAAI,EACA,wBAAwB,GACxB,uBAAuB,GACvB,uBAAuB,GACvB,2BAA2B,CAAC;IAChC,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,aAAa,CAAC;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB;oEACgE;IAChE,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AA4BD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,gBAAgB,EAC1B,UAAU,EAAE,gBAAgB,GAAG,SAAS,EACxC,QAAQ,EAAE,SAAS,mBAAmB,EAAE;AACxC,0EAA0E;AAC1E,iBAAiB,EAAE,OAAO,GACzB,sBAAsB,EAAE,CAkF1B;AAED;;kDAEkD;AAClD,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,gBAAgB,EAC5B,IAAI,EAAE,YAAY,GACjB,sBAAsB,CAqBxB"}