@telorun/analyzer 0.65.0 → 0.67.0

package/dist/validate-referrer-rules.js

@@ -1,6 +1,6 @@
 import { REFERRER_RULES_ANNOTATION, readRawReferrerRules, readReferrerRules, } from "./referrer-rule.js";
-import { celSourceOf, findDynamicLeaf, readNodes } from "./resource-rule.js";
-import { RULE_BUDGET_MS, compileRuleCondition, conditionRefusals } from "./rule-condition.js";
+import { celSourceOf, findDynamicLeaf, isTaggedCondition, pointerSegments, pointerToPath, readNodes, } from "./resource-rule.js";
+import { RULE_BUDGET_MS, UNTAGGED_CONDITION, compileRuleCondition, conditionRefusals, } from "./rule-condition.js";
 function isObject(value) {
     return !!value && typeof value === "object" && !Array.isArray(value);
 }
@@ -13,7 +13,7 @@ function isObject(value) {
  * declaring module's scope by `resolveSchemaRefKinds`, the only pass holding
  * that scope, and a name resolving to nothing is reported from there.
  */
-export function validateReferrerRuleDeclarations(manifest) {
+export function validateReferrerRuleDeclarations(manifest, context = {}) {
     const own = manifest.schema;
     const raw = readRawReferrerRules(own);
     if (raw === undefined)
@@ -65,6 +65,10 @@ export function validateReferrerRuleDeclarations(manifest) {
         if (entry.severity !== undefined && entry.severity !== "error" && entry.severity !== "warning") {
             issue(`${at}.severity`, "'severity' must be 'error' or 'warning'.");
         }
+        if (condition !== undefined && condition.length > 0 && !isTaggedCondition(entry.condition)) {
+            issue(`${at}.condition`, UNTAGGED_CONDITION);
+        }
+        validatePeersDeclaration(entry, at, issue, context);
         if (condition) {
             for (const refusal of conditionRefusals(condition))
                 issue(`${at}.condition`, refusal);
@@ -72,6 +76,40 @@ export function validateReferrerRuleDeclarations(manifest) {
     });
     return issues;
 }
+/** The strict half of `peers:` — the binding that lets a rule reach a referrer's
+ *  OTHER entries, which is also the one that fails invisibly: a pointer naming a
+ *  collection nothing in resolves would leave the rule seeing no declaration at
+ *  all, and a check that never sees its subject reads as passing. */
+function validatePeersDeclaration(entry, at, issue, context) {
+    const { peers } = entry;
+    if (peers === undefined)
+        return;
+    if (typeof peers !== "string") {
+        issue(`${at}.peers`, "'peers' is a JSON Pointer naming a collection OF THE REFERRER (e.g. /tables), whose " +
+            "other entries bind as 'peers' and whose own entry binds as 'entry'.");
+        return;
+    }
+    if (pointerSegments(peers) === undefined || peers === "" || peers === "/") {
+        issue(`${at}.peers`, `'peers' must be a JSON Pointer to a collection, e.g. /tables — '${peers}' is not one.`);
+        return;
+    }
+    if (typeof entry.referrer !== "string" || entry.referrer.length === 0) {
+        issue(`${at}.peers`, "'peers' names a collection of the REFERRER, so the rule must also declare 'referrer:' — " +
+            "without a kind there is nothing to check the pointer against, and a pointer that " +
+            "resolves to nothing disables the rule in silence.");
+        return;
+    }
+    const target = context.peersTarget?.(entry.referrer, peers);
+    if (target === "absent") {
+        issue(`${at}.peers`, `'${entry.referrer}' declares no collection at '${peers}'. A pointer that resolves to ` +
+            "nothing binds no peers, so the rule would never see a sibling declaration.");
+    }
+    else if (target === "plain") {
+        issue(`${at}.peers`, `'${peers}' on '${entry.referrer}' holds plain data — nothing in it is a reference, so ` +
+            "no entry resolves to a declaration and the rule would run against values it cannot " +
+            "compare. Name a collection whose items are, or contain, a reference.");
+    }
+}
 /**
  * Run a kind's referrer rules against every resource that references one of its
  * resources.
@@ -81,19 +119,25 @@ export function validateReferrerRuleDeclarations(manifest) {
  * manifest identity, since a name alone is module-scoped — because the condition
  * reads the two manifests and nothing about the site, so a second site could only
  * produce the identical verdict at a different path.
+ *
+ * **A rule declaring `peers:` is the exception, and evaluates once per ENTRY.**
+ * That is a deliberate departure from judge-once rather than an inconsistency: a
+ * rule that binds `entry` is about the entry, so a resource listed twice has two
+ * entries to answer for, and the two sites can genuinely disagree.
  */
 export function evaluateReferrerRules(manifest, definitionSchema, referrers, 
 /** Whether a referrer of `kind` satisfies a rule's `referrer:` filter —
  *  Liskov-substitutable, so a child of the named kind matches. Supplied by the
  *  caller, which holds the definition registry. */
-kindMatches) {
+kindMatches, context = {}) {
     const rules = readReferrerRules(definitionSchema);
     if (rules.length === 0)
         return [];
     const self = manifest;
     const findings = [];
     for (const rule of rules) {
-        const compiled = compileRuleCondition(rule.condition, ["self", "referrer"]);
+        const perEntry = rule.peers !== undefined;
+        const compiled = compileRuleCondition(rule.condition, perEntry ? ["self", "referrer", "entry", "peers"] : ["self", "referrer"]);
         if ("reason" in compiled) {
             findings.push({ kind: "failed", rule, reason: compiled.reason });
             continue;
@@ -108,29 +152,46 @@ kindMatches) {
         for (const referrer of referrers) {
             if (rule.referrer !== undefined && !kindMatches(rule.referrer, referrer.kind))
                 continue;
-            if (seen.has(referrer.manifest))
-                continue;
-            seen.add(referrer.manifest);
+            if (!perEntry) {
+                if (seen.has(referrer.manifest))
+                    continue;
+                seen.add(referrer.manifest);
+            }
+            const scope = {
+                self,
+                referrer: referrer.manifest,
+            };
+            if (perEntry) {
+                const bound = context.peerBinder
+                    ? context.peerBinder.bind(referrer.manifest, referrer.kind, rule.peers, referrer.path)
+                    : {
+                        ok: false,
+                        failure: { reason: "unknown-shape", at: pointerToPath(rule.peers) },
+                    };
+                if (!bound.ok) {
+                    findings.push({ kind: "unbound", rule, referrer, failure: bound.failure });
+                    continue;
+                }
+                scope.peers = bound.binding.peers;
+                scope.entry = bound.binding.entry;
+            }
             // Only the nodes this condition READS decide whether it can run — the
             // resource-rule reasoning, and it bites harder here: the referrer is a
             // whole manifest, so scanning all of it would disable the rule for any
             // server carrying one unrelated expression.
-            let dynamicAt;
-            for (const node of readNodes(chains, {
-                self,
-                referrer: referrer.manifest,
-            })) {
-                dynamicAt = findDynamicLeaf(node);
-                if (dynamicAt !== undefined)
+            let dynamic;
+            for (const node of readNodes(chains, scope)) {
+                dynamic = findDynamicLeaf(node);
+                if (dynamic !== undefined)
                     break;
             }
-            if (dynamicAt !== undefined) {
-                findings.push({ kind: "skipped", rule, referrer, dynamicAt });
+            if (dynamic !== undefined) {
+                findings.push({ kind: "skipped", rule, referrer, dynamic });
                 continue;
             }
             let held;
             try {
-                held = parsed({ self, referrer: referrer.manifest });
+                held = parsed(scope);
             }
             catch (err) {
                 findings.push({
@@ -156,11 +217,38 @@ kindMatches) {
 /** Whether a rule found any referrer to judge — the input to the never-exercised
  *  report, which is how a mistyped `referrer:` filter would otherwise disable a
  *  check in silence. */
-export function referrerRuleExercised(rule, referrers, kindMatches) {
-    if (rule.referrer === undefined)
-        return referrers.length > 0;
-    const filter = rule.referrer;
-    return referrers.some((referrer) => kindMatches(filter, referrer.kind));
+export function referrerRuleExercised(rule, referrers, kindMatches, context = {}) {
+    const matching = rule.referrer === undefined
+        ? referrers
+        : referrers.filter((referrer) => kindMatches(rule.referrer, referrer.kind));
+    if (matching.length === 0)
+        return false;
+    if (rule.peers === undefined)
+        return true;
+    // A peer rule that ran against an EMPTY peer set proved nothing — and an empty
+    // set everywhere is exactly what a typo in `peers:` looks like from outside,
+    // which is silence that reads as passing. Asked through the binder, so it
+    // shares the resolution the evaluation already paid for.
+    const binder = context.peerBinder;
+    if (!binder)
+        return false;
+    return matching.some((referrer) => binder.hasPeers(referrer.manifest, referrer.kind, rule.peers, referrer.path));
+}
+/** Why a peer binding could not be produced, as the sentence a reader acts on. */
+function peerBindingReason(failure) {
+    switch (failure.reason) {
+        case "no-collection":
+            return `'${failure.at}' holds no collection to bind 'peers' from.`;
+        case "unresolved":
+            return (`a reference at '${failure.at}' names a declaration this analysis does not hold, ` +
+                "so a peer would bind to nothing.");
+        case "dynamic":
+            return (`a value at '${failure.at}' holds ${failure.what ?? "a value"}, which is not known ` +
+                "until the resource is created, so the comparison would run against a placeholder.");
+        case "unknown-shape":
+            return (`which paths under '${failure.at}' hold references is not known here, so nothing ` +
+                "could be resolved into a declaration.");
+    }
 }
 const nameOf = (manifest) => manifest.metadata?.name ?? "<unnamed>";
 /**
@@ -196,8 +284,8 @@ declarationIsOurs) {
                 severity: "information",
                 message: `${finding.referrer.kind}/${nameOf(finding.referrer.manifest)}: rule ` +
                     `'${finding.rule.code}' from ${declaringKind} did not run at ` +
-                    `'${finding.referrer.path}' — the value holds a CEL expression at ` +
-                    `'${finding.dynamicAt}', which is not known until the resource is created. ` +
+                    `'${finding.referrer.path}' — the value holds ${finding.dynamic.what} at ` +
+                    `'${finding.dynamic.path}', which is not known until the resource is created. ` +
                     "Reported rather than dropped: a check whose coverage varies invisibly reads as passing.",
                 manifest: finding.referrer.manifest,
                 path: finding.referrer.path,
@@ -205,6 +293,20 @@ declarationIsOurs) {
             });
             continue;
         }
+        if (finding.kind === "unbound") {
+            out.push({
+                code: "REFERRER_RULE_SKIPPED",
+                severity: "information",
+                message: `${finding.referrer.kind}/${nameOf(finding.referrer.manifest)}: rule ` +
+                    `'${finding.rule.code}' from ${declaringKind} did not run at ` +
+                    `'${finding.referrer.path}' — ${peerBindingReason(finding.failure)}` +
+                    " Reported rather than dropped: a check whose coverage varies invisibly reads as passing.",
+                manifest: finding.referrer.manifest,
+                path: finding.referrer.path,
+                rule: finding.rule.code,
+            });
+            continue;
+        }
         const because = finding.kind === "failed"
             ? `failed to evaluate: ${finding.reason}. Guard an optional field with 'in' or '.?'.`
             : `exceeded its evaluation budget (${finding.elapsedMs}ms) and was stopped, so ` +
@@ -242,12 +344,18 @@ export function reportUnexercisedReferrerRule(definition, rule) {
     return {
         code: "REFERRER_RULE_UNEXERCISED",
         severity: "information",
-        message: `Referrer rule '${rule.code}' never ran: nothing` +
-            (rule.referrer === undefined ? "" : ` of kind '${rule.referrer}'`) +
-            " references a resource of this kind, so nothing has proven the condition." +
-            (rule.referrer === undefined
-                ? ""
-                : " A 'referrer' naming a kind no manifest uses disables the rule in silence."),
+        message: rule.peers !== undefined
+            ? `Referrer rule '${rule.code}' never ran with peers to compare: nothing` +
+                (rule.referrer === undefined ? "" : ` of kind '${rule.referrer}'`) +
+                ` references a resource of this kind while '${rule.peers}' held another ` +
+                "declaration, so nothing has proven the condition. An empty peer set " +
+                "everywhere is what a typo in 'peers:' looks like from outside."
+            : `Referrer rule '${rule.code}' never ran: nothing` +
+                (rule.referrer === undefined ? "" : ` of kind '${rule.referrer}'`) +
+                " references a resource of this kind, so nothing has proven the condition." +
+                (rule.referrer === undefined
+                    ? ""
+                    : " A 'referrer' naming a kind no manifest uses disables the rule in silence."),
         manifest: definition,
         path: `schema.${REFERRER_RULES_ANNOTATION}[${rule.index}]`,
         rule: rule.code,

package/dist/validate-resource-inputs.d.ts

@@ -0,0 +1,35 @@
+import type { ResourceManifest } from "@telorun/sdk";
+import type { AliasResolver } from "./alias-resolver.js";
+import type { DefinitionRegistry } from "./definition-registry.js";
+import { type AnalysisDiagnostic } from "./types.js";
+/**
+ * The strict half of {@link readResourceInputs} — the `validate-ref-slots.ts`
+ * split applied to the resource-input boundary, and not optional for the same
+ * reason: the two sides fail in OPPOSITE directions. An unreadable DECLARATION
+ * leaves the library referencing a name nothing stands behind; an unchecked
+ * INJECTION hands a library an instance of a kind it never asked for, which
+ * surfaces as a method-missing failure inside someone else's module.
+ *
+ * Two surfaces, scoped the same way every other declaration check is — to the
+ * entry's own modules, since a published dependency's block is not the
+ * consumer's to fix:
+ *
+ *  - **The library's own declaration.** Each entry's alias-qualified `kind:` must
+ *    resolve in the DECLARING module's scope (`RESOURCE_INPUT_KIND_UNRESOLVED`).
+ *    A constraint that resolves to nothing accepts anything, which is the same
+ *    hole `X_TELO_REF_UNRESOLVED` exists to close one level down.
+ *  - **The injection site.** Every declared entry must be supplied
+ *    (`RESOURCE_INPUT_MISSING` — the same failure as a missing required
+ *    variable), nothing beyond them may be (`RESOURCE_INPUT_UNKNOWN`), the value
+ *    must name a resource that exists (`RESOURCE_INPUT_UNRESOLVED`), and its
+ *    kind must satisfy the declared constraint transitively
+ *    (`RESOURCE_INPUT_KIND_MISMATCH`).
+ *
+ * Browser-safe.
+ */
+export declare function validateResourceInputs(manifests: ResourceManifest[], registry: DefinitionRegistry, aliases: AliasResolver, rootModules: Set<string>, 
+/** Kind acceptance, transitively — the `checkKind` rule `validate-references`
+ *  applies at an ordinary ref slot, passed in rather than re-derived so the
+ *  two cannot disagree about what satisfies a constraint. */
+acceptsKind: (suppliedKind: string, requiredKind: string) => boolean): AnalysisDiagnostic[];
+//# sourceMappingURL=validate-resource-inputs.d.ts.map

package/dist/validate-resource-inputs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-resource-inputs.d.ts","sourceRoot":"","sources":["../src/validate-resource-inputs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAGnE,OAAO,EAAE,KAAK,kBAAkB,EAAsB,MAAM,YAAY,CAAC;AASzE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,EACtB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC;AACxB;;6DAE6D;AAC7D,WAAW,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,GACnE,kBAAkB,EAAE,CA6LtB"}

package/dist/validate-resource-inputs.js

@@ -0,0 +1,319 @@
+import { isRefSentinel } from "@telorun/templating";
+import { findDynamicLeaf } from "./resource-rule.js";
+import { readResourceInputs, readSuppliedResources } from "./resource-input.js";
+import { DiagnosticSeverity } from "./types.js";
+const SOURCE = "telo-analyzer";
+/**
+ * The strict half of {@link readResourceInputs} — the `validate-ref-slots.ts`
+ * split applied to the resource-input boundary, and not optional for the same
+ * reason: the two sides fail in OPPOSITE directions. An unreadable DECLARATION
+ * leaves the library referencing a name nothing stands behind; an unchecked
+ * INJECTION hands a library an instance of a kind it never asked for, which
+ * surfaces as a method-missing failure inside someone else's module.
+ *
+ * Two surfaces, scoped the same way every other declaration check is — to the
+ * entry's own modules, since a published dependency's block is not the
+ * consumer's to fix:
+ *
+ *  - **The library's own declaration.** Each entry's alias-qualified `kind:` must
+ *    resolve in the DECLARING module's scope (`RESOURCE_INPUT_KIND_UNRESOLVED`).
+ *    A constraint that resolves to nothing accepts anything, which is the same
+ *    hole `X_TELO_REF_UNRESOLVED` exists to close one level down.
+ *  - **The injection site.** Every declared entry must be supplied
+ *    (`RESOURCE_INPUT_MISSING` — the same failure as a missing required
+ *    variable), nothing beyond them may be (`RESOURCE_INPUT_UNKNOWN`), the value
+ *    must name a resource that exists (`RESOURCE_INPUT_UNRESOLVED`), and its
+ *    kind must satisfy the declared constraint transitively
+ *    (`RESOURCE_INPUT_KIND_MISMATCH`).
+ *
+ * Browser-safe.
+ */
+export function validateResourceInputs(manifests, registry, aliases, rootModules, 
+/** Kind acceptance, transitively — the `checkKind` rule `validate-references`
+ *  applies at an ordinary ref slot, passed in rather than re-derived so the
+ *  two cannot disagree about what satisfies a constraint. */
+acceptsKind) {
+    const out = [];
+    const isOwn = (module) => !module || rootModules.has(module);
+    // --- the library's own declaration -------------------------------------
+    for (const m of manifests) {
+        if (m.kind !== "Telo.Library")
+            continue;
+        const moduleName = m.metadata?.name;
+        // Only the entry's own modules, so the declaring scope is always the root
+        // alias table — a library analyzed here IS a root module.
+        if (!isOwn(moduleName))
+            continue;
+        const scope = aliases;
+        const exported = new Set((m.exports?.resources ?? []).filter((e) => typeof e === "string"));
+        for (const input of readResourceInputs(m)) {
+            // An input is the IMPORTER's instance, borrowed. Exporting it back out
+            // would forward a kind-only stand-in into the consumer's flattened set as
+            // a resource this library declares — a phantom the consumer can `!ref`
+            // and whose kind constraint is all there is behind it. Handing an
+            // instance straight back to whoever supplied it is also a relation
+            // nothing needs; if it ever does, it should be a decision rather than a
+            // name collision nobody noticed.
+            if (exported.has(input.name)) {
+                out.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: "RESOURCE_INPUT_EXPORTED",
+                    source: SOURCE,
+                    message: `Resource input '${input.name}' is also listed in 'exports.resources'. An input is ` +
+                        `an instance the importer supplies, not one this library declares, so there is ` +
+                        `nothing to export — remove it from 'exports.resources', or rename the input.`,
+                    data: {
+                        resource: { kind: m.kind, name: moduleName },
+                        filePath: m.metadata?.source,
+                        path: `resources.${input.name}`,
+                    },
+                });
+            }
+            if (registry.resolve(input.kind) ?? registry.resolve(scope.resolveKind(input.kind) ?? "")) {
+                continue;
+            }
+            out.push({
+                severity: DiagnosticSeverity.Error,
+                code: "RESOURCE_INPUT_KIND_UNRESOLVED",
+                source: SOURCE,
+                message: `Resource input '${input.name}' is constrained to kind '${input.kind}', which does not ` +
+                    `resolve in this library's scope. Write it alias-qualified — '<Alias>.<Kind>' for an ` +
+                    `import declared in this file, 'Self.<Kind>' for a kind this library owns, or ` +
+                    `'Telo.<Kind>' for a built-in. An unresolvable constraint accepts anything.`,
+                data: {
+                    resource: { kind: m.kind, name: moduleName },
+                    filePath: m.metadata?.source,
+                    path: `resources.${input.name}.kind`,
+                },
+            });
+        }
+    }
+    // --- the injection site --------------------------------------------------
+    for (const m of manifests) {
+        if (m.kind !== "Telo.Import")
+            continue;
+        const meta = m.metadata;
+        const alias = meta?.name;
+        if (!alias || !isOwn(meta?.module))
+            continue;
+        // An import whose target identity was never established registers nothing —
+        // reporting a missing input against it would blame the author for a
+        // dependency the loader has already said it could not obtain.
+        if (!meta?.resolvedModuleName)
+            continue;
+        // A singleton has no room for a per-import override: `logging:` scopes a
+        // subtree that is no longer this import's subtree, and `runtime:` selects a
+        // controller backend for a library that is instantiated once. Whichever
+        // import happened to be created first would decide, so the field is
+        // rejected rather than silently applied to everyone or silently dropped.
+        if (meta.sharedLibrary === true) {
+            for (const field of ["logging", "runtime"]) {
+                if (m[field] === undefined)
+                    continue;
+                out.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: "SHARED_LIBRARY_OVERRIDE",
+                    source: SOURCE,
+                    message: `Import '${alias}' declares '${field}:', but module ` +
+                        `'${meta.resolvedModuleName}' is 'lifecycle: shared' — one instantiation for the ` +
+                        `whole application, so a per-import override cannot apply to it. Remove it, or ` +
+                        `make the library 'lifecycle: isolated'.`,
+                    data: {
+                        resource: { kind: m.kind, name: alias },
+                        filePath: meta.source,
+                        path: field,
+                    },
+                });
+            }
+        }
+        const required = Object.entries(meta.requiredResources ?? {});
+        const supplied = readSuppliedResources(m);
+        const declared = new Map(required);
+        const resource = { kind: m.kind, name: alias };
+        const filePath = meta.source;
+        for (const [entryName, entryKind] of required) {
+            if (entryName in supplied)
+                continue;
+            out.push({
+                severity: DiagnosticSeverity.Error,
+                code: "RESOURCE_INPUT_MISSING",
+                source: SOURCE,
+                message: `Import '${alias}' does not supply the resource input '${entryName}', which module ` +
+                    `'${meta.resolvedModuleName}' requires (kind '${entryKind}'). Add ` +
+                    `\`resources: { ${entryName}: !ref <name> }\` to the import.`,
+                data: { resource, filePath, path: "resources" },
+            });
+        }
+        for (const [name, value] of Object.entries(supplied)) {
+            const path = `resources.${name}`;
+            const entry = declared.get(name);
+            if (!entry) {
+                const known = required.map(([n]) => n).join(", ") || "(none)";
+                out.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: "RESOURCE_INPUT_UNKNOWN",
+                    source: SOURCE,
+                    message: `Import '${alias}' supplies a resource input '${name}', which module ` +
+                        `'${meta.resolvedModuleName}' does not declare. Declared inputs: ${known}.`,
+                    data: { resource, filePath, path },
+                });
+                continue;
+            }
+            // Phase 2.5 rewrote a resolvable `!ref` to `{kind, name}`; a sentinel that
+            // survived names nothing the importer can reach.
+            if (isRefSentinel(value)) {
+                out.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: "RESOURCE_INPUT_UNRESOLVED",
+                    source: SOURCE,
+                    message: `Import '${alias}': resource input '${name}' → resource '${value.source}' not found`,
+                    data: { resource, filePath, path },
+                });
+                continue;
+            }
+            if (!value || typeof value !== "object" || Array.isArray(value)) {
+                out.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: "RESOURCE_INPUT_UNRESOLVED",
+                    source: SOURCE,
+                    message: `Import '${alias}': resource input '${name}' must be a '!ref' to a resource this ` +
+                        `module declares.`,
+                    data: { resource, filePath, path },
+                });
+                continue;
+            }
+            const suppliedKind = value.kind;
+            if (typeof suppliedKind !== "string")
+                continue;
+            const canonical = aliases.resolveKind(suppliedKind) ?? suppliedKind;
+            if (acceptsKind(canonical, entry))
+                continue;
+            out.push({
+                severity: DiagnosticSeverity.Error,
+                code: "RESOURCE_INPUT_KIND_MISMATCH",
+                source: SOURCE,
+                message: `Import '${alias}': resource input '${name}' is '${suppliedKind}' (resolved: ` +
+                    `'${canonical}'), which does not satisfy the declared constraint '${entry}'.`,
+                data: { resource, filePath, path },
+            });
+        }
+    }
+    out.push(...sharedLibraryConflicts(manifests, isOwn));
+    return out;
+}
+const SUPPLIED_BLOCKS = ["variables", "secrets", "resources"];
+/**
+ * Two imports of ONE `lifecycle: shared` library supplying different values.
+ *
+ * The runtime half (`ERR_SHARED_LIBRARY_CONFLICT`) is authoritative — it holds
+ * resolved values and live instances, and a library reached through a
+ * programmatic load never passed `telo check`. But the overwhelmingly common
+ * shape is two literal scalars in one flattened manifest set, which is decidable
+ * here, and a conflict is a hard BOOT failure: finding it at `telo check` is the
+ * difference between a squiggle and a deployment that will not start.
+ *
+ * Only what is DECIDABLE is compared, and the two ways it is not are skipped
+ * rather than guessed:
+ *
+ *  - A value holding a `!cel` (at any depth) is known only at load. Two
+ *    different expressions may evaluate equal, and identical text in two
+ *    different modules may not.
+ *  - A `resources:` entry names a resource by name, which means the same
+ *    instance only when both imports were DECLARED in the same module — so a
+ *    cross-module pair is left to the runtime.
+ *
+ * Grouped by the target's RESOLVED SOURCE, the identity the kernel keys its
+ * singleton registry on; `resolvedModuleName` would collapse two versions of one
+ * module, which are two libraries.
+ */
+function sharedLibraryConflicts(manifests, isOwn) {
+    const out = [];
+    const byTarget = new Map();
+    for (const m of manifests) {
+        if (m.kind !== "Telo.Import")
+            continue;
+        const meta = m.metadata;
+        if (meta?.sharedLibrary !== true || !meta.name || !meta.resolvedSource)
+            continue;
+        const blocks = new Map();
+        for (const block of SUPPLIED_BLOCKS) {
+            const value = m[block];
+            blocks.set(block, value && typeof value === "object" && !Array.isArray(value)
+                ? value
+                : {});
+        }
+        const bucket = byTarget.get(meta.resolvedSource);
+        const entry = {
+            alias: meta.name,
+            module: meta.module,
+            filePath: meta.source,
+            blocks,
+        };
+        if (bucket)
+            bucket.push(entry);
+        else
+            byTarget.set(meta.resolvedSource, [entry]);
+    }
+    for (const group of byTarget.values()) {
+        if (group.length < 2)
+            continue;
+        const [first, ...rest] = group;
+        for (const later of rest) {
+            for (const block of SUPPLIED_BLOCKS) {
+                // A reference means the same instance only within one module's scope.
+                if (block === "resources" && first.module !== later.module)
+                    continue;
+                const a = first.blocks.get(block);
+                const b = later.blocks.get(block);
+                for (const key of new Set([...Object.keys(a), ...Object.keys(b)])) {
+                    if (findDynamicLeaf(a[key]) || findDynamicLeaf(b[key]))
+                        continue;
+                    if (sameSuppliedValue(a[key], b[key]))
+                        continue;
+                    out.push({
+                        severity: DiagnosticSeverity.Error,
+                        code: "SHARED_LIBRARY_CONFLICT",
+                        source: SOURCE,
+                        message: `Import '${later.alias}' and import '${first.alias}' both reach a ` +
+                            `'lifecycle: shared' library — one instantiation for the whole application — but ` +
+                            `they supply different values for ${block}.${key}. Make the two imports agree, or ` +
+                            `make the library 'lifecycle: isolated'.`,
+                        data: isOwn(later.module)
+                            ? {
+                                resource: { kind: "Telo.Import", name: later.alias },
+                                filePath: later.filePath,
+                                path: `${block}.${key}`,
+                            }
+                            : {
+                                resource: { kind: "Telo.Import", name: first.alias },
+                                filePath: first.filePath,
+                                path: `${block}.${key}`,
+                            },
+                    });
+                }
+            }
+        }
+    }
+    return out;
+}
+/** Structural equality, key-order insensitive — the analyzer's half of the rule
+ *  the kernel applies to resolved values. A secret's VALUE is compared but never
+ *  printed: the key is what the author has to look at. */
+function sameSuppliedValue(a, b) {
+    if (a === b)
+        return true;
+    if (a === undefined || b === undefined || a === null || b === null)
+        return false;
+    if (Array.isArray(a) || Array.isArray(b)) {
+        if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length)
+            return false;
+        return a.every((item, i) => sameSuppliedValue(item, b[i]));
+    }
+    if (typeof a === "object" && typeof b === "object") {
+        const left = a;
+        const right = b;
+        const keys = new Set([...Object.keys(left), ...Object.keys(right)]);
+        return [...keys].every((key) => sameSuppliedValue(left[key], right[key]));
+    }
+    return false;
+}

package/dist/validate-resource-rules.d.ts

@@ -22,7 +22,7 @@
  * Browser-safe: no Node built-ins.
  */
 import type { ResourceManifest } from "@telorun/sdk";
-import { type ResourceRule } from "./resource-rule.js";
+import { type DynamicLeaf, type ResourceRule } from "./resource-rule.js";
 /** Published name for the shared budget — see `rule-condition.ts`. */
 export declare const RESOURCE_RULE_BUDGET_MS = 50;
 export interface ResourceRuleIssue {
@@ -42,7 +42,7 @@ export type ResourceRuleFinding = {
     kind: "skipped";
     rule: ResourceRule;
     path: string;
-    dynamicAt: string;
+    dynamic: DynamicLeaf;
 } | {
     kind: "failed";
     rule: ResourceRule;
@@ -54,6 +54,15 @@ export type ResourceRuleFinding = {
     path: string;
     elapsedMs: number;
 };
+/** Navigate a kind's own schema to the node describing what a pointer names, so
+ *  an `in:` naming a field the kind does not declare is caught at the kind.
+ *  Exported because the peer-rule strict half asks the same question of the
+ *  REFERRER's schema, and two navigators would eventually disagree about what a
+ *  pointer names. */
+export declare function schemaAtPointer(schema: unknown, pointer: string): unknown;
+/** True when a schema node describes something a rule can iterate. Unknown or
+ *  absent `type` passes: an open schema is not evidence of a defect. */
+export declare function isIterableSchema(node: unknown): boolean;
 /**
  * Report every way a kind's rule declarations are malformed. Runs on the
  * `Telo.Definition` / `Telo.Abstract` doc, so a defect lands on the line the

package/dist/validate-resource-rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-resource-rules.d.ts","sourceRoot":"","sources":["../src/validate-resource-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,EASL,KAAK,YAAY,EAClB,MAAM,oBAAoB,CAAC;AAE5B,sEAAsE;AACtE,eAAO,MAAM,uBAAuB,KAAiB,CAAC;AAEtD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,0CAA0C;AAC1C,MAAM,MAAM,mBAAmB,GAC3B;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,YAAY,CAAC;IACnB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB,GACD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACxE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAmCjF;;;;GAIG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,gBAAgB;AAC1B;;;;;;;;;GASG;AACH,eAAe,CAAC,EAAE,OAAO,GACxB,iBAAiB,EAAE,CA+FrB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,gBAAgB,EAC1B,gBAAgB,EAAE,OAAO,GACxB,mBAAmB,EAAE,CA4DvB;AAED;iFACiF;AACjF,wBAAgB,aAAa,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAIrF;AAED;;gFAEgF;AAChF,MAAM,WAAW,sBAAsB;IACrC,IAAI,EACA,wBAAwB,GACxB,uBAAuB,GACvB,uBAAuB,GACvB,2BAA2B,CAAC;IAChC,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,aAAa,CAAC;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB;+EAC2E;IAC3E,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,gBAAgB,EAC1B,UAAU,EAAE,gBAAgB,GAAG,SAAS,EACxC,QAAQ,EAAE,SAAS,mBAAmB,EAAE;AACxC,0EAA0E;AAC1E,iBAAiB,EAAE,OAAO,GACzB,sBAAsB,EAAE,CA2D1B;AAED;+CAC+C;AAC/C,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,gBAAgB,EAC5B,IAAI,EAAE,YAAY,GACjB,sBAAsB,CAYxB"}
+{"version":3,"file":"validate-resource-rules.d.ts","sourceRoot":"","sources":["../src/validate-resource-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAOrD,OAAO,EAIL,KAAK,WAAW,EAOhB,KAAK,YAAY,EAClB,MAAM,oBAAoB,CAAC;AAE5B,sEAAsE;AACtE,eAAO,MAAM,uBAAuB,KAAiB,CAAC;AAEtD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,0CAA0C;AAC1C,MAAM,MAAM,mBAAmB,GAC3B;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,YAAY,CAAC;IACnB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB,GACD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GAC3E;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAMjF;;;;qBAIqB;AACrB,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAezE;AAED;wEACwE;AACxE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAMvD;AAED;;;;GAIG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,gBAAgB;AAC1B;;;;;;;;;GASG;AACH,eAAe,CAAC,EAAE,OAAO,GACxB,iBAAiB,EAAE,CAmGrB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,gBAAgB,EAC1B,gBAAgB,EAAE,OAAO,GACxB,mBAAmB,EAAE,CA4DvB;AAED;iFACiF;AACjF,wBAAgB,aAAa,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAIrF;AAED;;gFAEgF;AAChF,MAAM,WAAW,sBAAsB;IACrC,IAAI,EACA,wBAAwB,GACxB,uBAAuB,GACvB,uBAAuB,GACvB,2BAA2B,CAAC;IAChC,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,aAAa,CAAC;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB;+EAC2E;IAC3E,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,gBAAgB,EAC1B,UAAU,EAAE,gBAAgB,GAAG,SAAS,EACxC,QAAQ,EAAE,SAAS,mBAAmB,EAAE;AACxC,0EAA0E;AAC1E,iBAAiB,EAAE,OAAO,GACzB,sBAAsB,EAAE,CA2D1B;AAED;+CAC+C;AAC/C,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,gBAAgB,EAC5B,IAAI,EAAE,YAAY,GACjB,sBAAsB,CAYxB"}