@telorun/analyzer 0.67.0 → 0.69.0

package/dist/analysis-registry.d.ts

@@ -1,4 +1,5 @@
 import type { ResourceDefinition, ResourceManifest } from "@telorun/sdk";
+import type { BuildModuleGraphOptions, ModuleGraphDeps } from "./module-graph.js";
 import { ManifestAnalysis } from "./manifest-analysis.js";
 import { type ManifestVisitor } from "./manifest-visitor.js";
 import type { AnalysisContext } from "./types.js";
@@ -138,6 +139,17 @@ export declare class AnalysisRegistry {
      * function of the whole manifest set.
      */
     analysisOf(manifests: ResourceManifest[]): ManifestAnalysis;
+    /**
+     * What the projection needs that only this registry knows: how a kind
+     * resolves, what its reference slots are, which capabilities they target, and
+     * what a resource can raise.
+     *
+     * The GRAPH itself is built by `ManifestAnalysis.moduleGraph`, which is the
+     * pairing of a registry with a manifest set — a fifth
+     * `registry.x(manifests, …)` factory is the accretion naming that class
+     * stopped. This is the half the registry owns.
+     */
+    moduleGraphDeps(manifests: ResourceManifest[], options?: BuildModuleGraphOptions): ModuleGraphDeps;
     /**
      * Returns the built-in kernel definitions. The underlying DefinitionRegistry already
      * seeds these on construction; this method exposes them so callers (e.g. the kernel's

package/dist/analysis-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analysis-registry.d.ts","sourceRoot":"","sources":["../src/analysis-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D,OAAO,EAAqC,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAKhG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;wDAEwD;AACxD,MAAM,WAAW,YAAY;IAC3B;0CACsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,sFAAsF;IACtF,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;;8EAG0E;IAC1E,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;GAIG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IAEpE,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI;IAIjD,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAIpE;;+EAE2E;IAC3E,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IAI9E,wFAAwF;IACxF,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAIzD,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI7C;;;;;;;;;;uBAUmB;IACnB,qBAAqB,CAAC,SAAS,EAAE,gBAAgB,EAAE,GAAG,IAAI;IAI1D;;;;;;;OAOG;IACH,mBAAmB,CACjB,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,EAClC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GACnC,IAAI;IAkBP;;;;;;OAMG;IACH,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,YAAY,EAAE;IAoBhE;;;;;;wBAMoB;IACpB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAQtD;;;;;;mEAM+D;IAC/D,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAInE;;;oBAGgB;IAChB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAIpE,OAAO,CAAC,eAAe;IAkBvB;;;;sBAIkB;IAClB,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,mBAAmB;IAU3B;;;;;;+DAM2D;IAC3D,OAAO,CAAC,sBAAsB;IAU9B;;;;;;OAMG;IACH,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,EACxB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAAE,GACzF,IAAI;IAQP;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS;IAO7F;;;;;;;;;OASG;IACH,UAAU,CAAC,SAAS,EAAE,gBAAgB,EAAE,GAAG,gBAAgB;IAQ3D;;;;OAIG;IACH,kBAAkB,IAAI,kBAAkB,EAAE;IAI1C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAM/D;;;;gCAI4B;IAC5B,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAMlF;;;;;;;;yCAQqC;IACrC,qBAAqB,CAAC,GAAG,EAAE;QACzB,QAAQ,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAChC,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,kBAAkB,GAAG,SAAS;IASpD;;qFAEiF;IACjF,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE;IAUzC,QAAQ,IAAI,MAAM,EAAE;IAIpB;mEAC+D;IAC/D,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE;IAIxC;;;gCAG4B;IAC5B,oBAAoB,IAAI,MAAM,EAAE;IAIhC;wEACoE;IACpE,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIhD;;;;;;;;iDAQ6C;IAC7C,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS;IAqB9D;;;;;gEAK4D;IAC5D,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;IAiB7D,qFAAqF;IACrF,QAAQ,IAAI,eAAe;CAG5B"}
+{"version":3,"file":"analysis-registry.d.ts","sourceRoot":"","sources":["../src/analysis-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGzE,OAAO,KAAK,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D,OAAO,EAAqC,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAMhG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;wDAEwD;AACxD,MAAM,WAAW,YAAY;IAC3B;0CACsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,sFAAsF;IACtF,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;;8EAG0E;IAC1E,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;GAIG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IAEpE,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI;IAIjD,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAIpE;;+EAE2E;IAC3E,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IAI9E,wFAAwF;IACxF,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAIzD,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI7C;;;;;;;;;;uBAUmB;IACnB,qBAAqB,CAAC,SAAS,EAAE,gBAAgB,EAAE,GAAG,IAAI;IAI1D;;;;;;;OAOG;IACH,mBAAmB,CACjB,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,EAClC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GACnC,IAAI;IAkBP;;;;;;OAMG;IACH,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,YAAY,EAAE;IAoBhE;;;;;;wBAMoB;IACpB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAQtD;;;;;;mEAM+D;IAC/D,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAInE;;;oBAGgB;IAChB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAIpE,OAAO,CAAC,eAAe;IAkBvB;;;;sBAIkB;IAClB,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,mBAAmB;IAU3B;;;;;;+DAM2D;IAC3D,OAAO,CAAC,sBAAsB;IAU9B;;;;;;OAMG;IACH,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,EACxB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAAE,GACzF,IAAI;IAQP;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS;IAO7F;;;;;;;;;OASG;IACH,UAAU,CAAC,SAAS,EAAE,gBAAgB,EAAE,GAAG,gBAAgB;IAQ3D;;;;;;;;;OASG;IACH,eAAe,CACb,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,GAAE,uBAA4B,GACpC,eAAe;IAsBlB;;;;OAIG;IACH,kBAAkB,IAAI,kBAAkB,EAAE;IAI1C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAM/D;;;;gCAI4B;IAC5B,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAMlF;;;;;;;;yCAQqC;IACrC,qBAAqB,CAAC,GAAG,EAAE;QACzB,QAAQ,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAChC,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,kBAAkB,GAAG,SAAS;IASpD;;qFAEiF;IACjF,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE;IAUzC,QAAQ,IAAI,MAAM,EAAE;IAIpB;mEAC+D;IAC/D,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE;IAIxC;;;gCAG4B;IAC5B,oBAAoB,IAAI,MAAM,EAAE;IAIhC;wEACoE;IACpE,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIhD;;;;;;;;iDAQ6C;IAC7C,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS;IAqB9D;;;;;gEAK4D;IAC5D,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;IAiB7D,qFAAqF;IACrF,QAAQ,IAAI,eAAe;CAG5B"}

package/dist/analysis-registry.js

@@ -5,6 +5,7 @@ import { DefinitionRegistry } from "./definition-registry.js";
 import { computeSuggestKind, computeValidUserFacingKinds } from "./kind-suggest.js";
 import { visitManifest as runVisitManifest } from "./manifest-visitor.js";
 import { resolveContract } from "./invocation-contract.js";
+import { createResolveCtx, resolveThrowsUnion } from "./resolve-throws-union.js";
 import { isRefEntry, isScopeEntry } from "./reference-field-map.js";
 import { resolveSchemaTypeRefs as resolveSchemaTypeRefsIn } from "./resolve-schema-type-refs.js";
 /**
@@ -226,6 +227,31 @@ export class AnalysisRegistry {
             aliasesByModule: this.aliasesByModule,
         });
     }
+    /**
+     * What the projection needs that only this registry knows: how a kind
+     * resolves, what its reference slots are, which capabilities they target, and
+     * what a resource can raise.
+     *
+     * The GRAPH itself is built by `ManifestAnalysis.moduleGraph`, which is the
+     * pairing of a registry with a manifest set — a fifth
+     * `registry.x(manifests, …)` factory is the accretion naming that class
+     * stopped. This is the half the registry owns.
+     */
+    moduleGraphDeps(manifests, options = {}) {
+        // The error contract is resolved through the SAME resolver `telo check`
+        // uses, memoized across the whole graph — so what a box says it can raise
+        // is what a route's `catches:` is validated against.
+        const throwsCtx = createResolveCtx(manifests, this.defs, this.aliases, this.aliasesByModule, new Set(options.entryModule ? [options.entryModule] : []));
+        return {
+            refFields: (resource) => this.refFieldsForResource(resource),
+            definition: (kind, module) => this.resolveDefinitionIn(kind, module),
+            aliasesForModule: (module) => this.aliases.aliasesFor(module),
+            throwsOf: (resource) => {
+                const union = resolveThrowsUnion(resource, throwsCtx);
+                return { codes: [...union.codes.keys()], unbounded: union.unbounded };
+            },
+        };
+    }
     /**
      * Returns the built-in kernel definitions. The underlying DefinitionRegistry already
      * seeds these on construction; this method exposes them so callers (e.g. the kernel's

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAiBzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AA8B9B,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAWvF,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAwDjE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAkG/F;0CAC0C;AAC1C,eAAO,MAAM,eAAe,GAAI,OAAO;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OACT,CAAC;AAErD;8EAC8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhD;AAqUD,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACtC;AA6DD,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAkFD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IA+6DvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAyBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAiBzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AA8B9B,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAWvF,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AA4DjE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAkG/F;0CAC0C;AAC1C,eAAO,MAAM,eAAe,GAAI,OAAO;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OACT,CAAC;AAErD;8EAC8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhD;AAqUD,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACtC;AA6DD,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAkFD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAq8DvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAyBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -37,6 +37,7 @@ import { analyzerPeerBinder, analyzerPeersTarget } from "./peer-binding.js";
 import { describeProjectionFailure, manifestListScope, resolveSchemaProjections, } from "./schema-projection.js";
 import { validateDynamicSelectors, validateRefSlotDeclarations, } from "./validate-ref-slots.js";
 import { validateValueTypeSlots, } from "./validate-value-type-slots.js";
+import { validateSensitiveSlots, } from "./validate-sensitive-slots.js";
 import { resolveSchemaTypeRefs } from "./resolve-schema-type-refs.js";
 import { validateSchemaTypeRefs } from "./validate-schema-type-refs.js";
 import { rewriteSyntheticOrigins } from "./rewrite-synthetic-origins.js";
@@ -800,10 +801,16 @@ export class StaticAnalyzer {
         // definition's `schema:` does. Same scoping as every other schema issue —
         // the entry's own modules, since a dependency is not the consumer's to fix.
         const valueTypeSlotIssues = [];
+        // `x-telo-sensitive` rides the same walk and the same scoping. It is read by
+        // ONE consumer — the kernel, off a bound contract — so an occurrence outside
+        // `inputType` / `outputType` is inert; for a security control, inert-and-
+        // silent is the failure worth reporting.
+        const sensitiveSlotIssues = [];
         for (const m of manifests) {
             const declaringModule = m.metadata?.module;
             if (!declaringModule || rootModules.has(declaringModule)) {
                 valueTypeSlotIssues.push(...validateValueTypeSlots(m));
+                sensitiveSlotIssues.push(...validateSensitiveSlots(m));
             }
         }
         for (const m of manifests) {
@@ -1020,6 +1027,22 @@ export class StaticAnalyzer {
                     },
                 });
             }
+            for (const issue of sensitiveSlotIssues) {
+                diagnostics.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: issue.code,
+                    source: SOURCE,
+                    message: issue.message,
+                    data: {
+                        resource: {
+                            kind: issue.manifest.kind,
+                            name: issue.manifest.metadata?.name,
+                        },
+                        filePath: issue.manifest.metadata?.source,
+                        path: issue.path,
+                    },
+                });
+            }
             // Same split for the two zone annotations. Unreadable ones fail in
             // OPPOSITE directions — a dropped requirement is silently unenforced, a
             // dropped provision invents failures — so neither can be left to

package/dist/call-graph.d.ts

@@ -74,6 +74,47 @@ export interface StepGraphNode {
     index: number;
     /** The step value as written. */
     step: Record<string, unknown>;
+    /**
+     * Which branch of the step grammar this step IS — the branch's own title
+     * (`invoke`, `if/then/else`, `while/do`, `switch/cases/default`,
+     * `try/catch/finally`, `throw`, `value`).
+     *
+     * Matched on the branch's REQUIRED keys, and IS those keys — sorted and
+     * joined (`if+then`, `invoke`, `do+while`). A machine identity, so a consumer
+     * may branch on it; it was the branch's `title`, which is prose an author may
+     * reword at any time, and a view was splitting it on `/` to recover a keyword.
+     * Absent for a step matching no branch — one just added, and still empty.
+     */
+    variant?: string;
+    /** The branch's `title` as its author wrote it, for a view to render verbatim.
+     *  Never parsed: it is a label, and the moment anything reads its SHAPE it
+     *  becomes a vocabulary the author cannot change. */
+    variantLabel?: string;
+    /**
+     * The expression that decides whether or how this step runs, as written: an
+     * `if:`, a `while:`, a `switch:`, or the `when:` guard on a dispatch.
+     *
+     * Found through `x-telo-topology-role`, never by keyword, so a third-party
+     * composer annotating its own predicate is read the same way.
+     */
+    predicate?: string;
+    /**
+     * Every reference slot this step's grammar declares — filled, empty, or
+     * holding a declaration written at the site.
+     *
+     * Recorded here because this is the one place a step's item schema and its
+     * value are both in hand: a step array's items sit behind a local `$ref`, so
+     * the reference field map deliberately never reaches them, and a consumer
+     * asking "what may this step dispatch to, and where is that written" has
+     * nowhere else to look. An EMPTY slot is listed for exactly that reason — it
+     * is a site an editor can offer to fill, and an edge says nothing about one.
+     */
+    refSlots?: {
+        key: string;
+        path: string;
+        kinds: string[];
+        inline?: boolean;
+    }[];
 }
 export type CallGraphNode = ResourceGraphNode | StepGraphNode;
 export interface CallGraphEdge {
@@ -133,7 +174,15 @@ export interface CallGraph {
     /** Edges arriving at a resource node. */
     edgesTo(id: string): CallGraphEdge[];
     resource(kind: string, name: string): ResourceGraphNode | undefined;
-    resourceByName(name: string): ResourceGraphNode | undefined;
+    /**
+     * The resource a bare name addresses, read from `fromModule`'s scope.
+     *
+     * A name is module-scoped, so the module is how two declarations of one name
+     * are told apart — see {@link resolveScopedName}. Omitting it answers for a
+     * name declared once and, where several modules declare it, declines rather
+     * than taking whichever came first.
+     */
+    resourceByName(name: string, fromModule?: string): ResourceGraphNode | undefined;
     /** Step nodes declared by a resource, in lexical order. */
     steps(resourceId: string): StepGraphNode[];
     /** Every edge whose `use` includes at least one control transfer, plus every
@@ -141,6 +190,36 @@ export interface CallGraph {
     controlEdges(): CallGraphEdge[];
 }
 export declare const resourceId: (kind: string, name: string) => string;
+/**
+ * The id a manifest's node is keyed by.
+ *
+ * **A resource name is MODULE-SCOPED**, so `(kind, name)` is unique inside one
+ * module and not across a flattened set: two libraries each exporting an
+ * `Http.Api` named `routes` are two declarations, and keying both as
+ * `http.Api\0routes` silently made them one — the second overwrote the first,
+ * taking its edges and its steps with it. The module is part of the identity
+ * wherever the loader stamped one; a manifest with no stamp keeps the bare form,
+ * so nothing that never crossed a module boundary moves.
+ */
+export declare function nodeIdFor(manifest: ResourceManifest): string;
+/**
+ * A bare `<name>` read from a resource declared in `fromModule`.
+ *
+ * **Same module first**, because that is what a bare name MEANS: it is resolved
+ * in the scope it was written in, and a cross-module reference is written with
+ * an alias. A name declared in exactly one module resolves to it whatever the
+ * reader's scope — which is what keeps an unstamped manifest set (every
+ * fixture, every single-module load) behaving as it did. A name declared in
+ * SEVERAL other modules and none of the reader's resolves to NOTHING: guessing
+ * between them attributes a reference to a resource the author never named, and
+ * some other pass reports the dangling name honestly.
+ *
+ * Exported because more than one pass resolves a bare name — the call graph's
+ * own sites, and the projection's inline declarations and CEL state reads. Two
+ * spellings of this rule is how a fix in one leaves a first-wins lookup in the
+ * other, which is exactly the collision it exists to prevent.
+ */
+export declare function resolveScopedName<T>(candidates: readonly T[] | undefined, moduleOf: (item: T) => string | undefined, fromModule: string | undefined): T | undefined;
 export interface BuildCallGraphOptions {
     aliases?: AliasResolver;
     aliasesByModule?: Map<string, AliasResolver>;

package/dist/call-graph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"call-graph.d.ts","sourceRoot":"","sources":["../src/call-graph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAOnE,OAAO,EAIL,KAAK,MAAM,EACX,KAAK,WAAW,EACjB,MAAM,eAAe,CAAC;AAKvB,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,UAAU,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,gBAAgB,CAAC;IAC3B;;yEAEqE;IACrE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,MAAM,aAAa,GAAG,iBAAiB,GAAG,aAAa,CAAC;AAE9D,MAAM,WAAW,aAAa;IAC5B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb;;;+CAG2C;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf;;;iCAG6B;IAC7B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,GAAG,EAAE,MAAM,EAAE,CAAC;IACd;0EACsE;IACtE,UAAU,CAAC,EAAE,WAAW,CAAC;IACzB;;mEAE+D;IAC/D,gBAAgB,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC;IACtD,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;+BAM2B;IAC3B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;wEACoE;IACpE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;gBAGY;IACZ,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC1C,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;IAChC,kDAAkD;IAClD,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,aAAa,EAAE,CAAC;IACvC,yCAAyC;IACzC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,aAAa,EAAE,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAAC;IACpE,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAAC;IAC5D,2DAA2D;IAC3D,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,aAAa,EAAE,CAAC;IAC3C;yFACqF;IACrF,YAAY,IAAI,aAAa,EAAE,CAAC;CACjC;AAED,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,EAAE,MAAM,MAAM,KAAG,MAA4B,CAAC;AAuTrF,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CAC9C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,GAAE,qBAA0B,GAClC,SAAS,CA4QX;AAYD,MAAM,WAAW,qBAAqB;IACpC,yEAAyE;IACzE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IACrC;0EACsE;IACtE,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,SAAS,EAChB,OAAO,GAAE,qBAA0B,GAClC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAmB1B"}
+{"version":3,"file":"call-graph.d.ts","sourceRoot":"","sources":["../src/call-graph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAOnE,OAAO,EAIL,KAAK,MAAM,EACX,KAAK,WAAW,EACjB,MAAM,eAAe,CAAC;AAUvB,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,UAAU,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,gBAAgB,CAAC;IAC3B;;yEAEqE;IACrE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;yDAEqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;CAC/E;AAED,MAAM,MAAM,aAAa,GAAG,iBAAiB,GAAG,aAAa,CAAC;AAE9D,MAAM,WAAW,aAAa;IAC5B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb;;;+CAG2C;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf;;;iCAG6B;IAC7B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,GAAG,EAAE,MAAM,EAAE,CAAC;IACd;0EACsE;IACtE,UAAU,CAAC,EAAE,WAAW,CAAC;IACzB;;mEAE+D;IAC/D,gBAAgB,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC;IACtD,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;+BAM2B;IAC3B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;wEACoE;IACpE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;gBAGY;IACZ,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC1C,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;IAChC,kDAAkD;IAClD,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,aAAa,EAAE,CAAC;IACvC,yCAAyC;IACzC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,aAAa,EAAE,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAAC;IACpE;;;;;;;OAOG;IACH,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAAC;IACjF,2DAA2D;IAC3D,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,aAAa,EAAE,CAAC;IAC3C;yFACqF;IACrF,YAAY,IAAI,aAAa,EAAE,CAAC;CACjC;AAED,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,EAAE,MAAM,MAAM,KAAG,MAA4B,CAAC;AAErF;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,CAK5D;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EACjC,UAAU,EAAE,SAAS,CAAC,EAAE,GAAG,SAAS,EACpC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,MAAM,GAAG,SAAS,EACzC,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,CAAC,GAAG,SAAS,CAIf;AAoYD,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CAC9C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,GAAE,qBAA0B,GAClC,SAAS,CA8RX;AAYD,MAAM,WAAW,qBAAqB;IACpC,yEAAyE;IACzE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IACrC;0EACsE;IACtE,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,SAAS,EAChB,OAAO,GAAE,qBAA0B,GAClC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAmB1B"}

package/dist/call-graph.js

@@ -3,9 +3,52 @@ import { enclosingOf, propertySchemas, resolveLocalRef, } from "./manifest-navig
 import { visitManifest } from "./manifest-visitor.js";
 import { possibleUses, readRefSlot, transfersControl, } from "./ref-slot.js";
 import { isStepSlot } from "./step-slot.js";
-import { isRefEntry, resolveFieldEntries } from "./reference-field-map.js";
+import { isInlineResource, isRefEntry, resolveFieldEntries, } from "./reference-field-map.js";
 import { DEPENDENCY_GRAPH_SKIP_KINDS as SYSTEM_KINDS } from "./system-kinds.js";
 export const resourceId = (kind, name) => `${kind}\0${name}`;
+/**
+ * The id a manifest's node is keyed by.
+ *
+ * **A resource name is MODULE-SCOPED**, so `(kind, name)` is unique inside one
+ * module and not across a flattened set: two libraries each exporting an
+ * `Http.Api` named `routes` are two declarations, and keying both as
+ * `http.Api\0routes` silently made them one — the second overwrote the first,
+ * taking its edges and its steps with it. The module is part of the identity
+ * wherever the loader stamped one; a manifest with no stamp keeps the bare form,
+ * so nothing that never crossed a module boundary moves.
+ */
+export function nodeIdFor(manifest) {
+    const kind = manifest.kind;
+    const name = manifest.metadata?.name;
+    const module = manifest.metadata?.module;
+    return module ? `${module}\0${resourceId(kind, name)}` : resourceId(kind, name);
+}
+/** The module a manifest was declared in, when the loader stamped one. */
+const declaringModule = (manifest) => manifest.metadata?.module;
+/**
+ * A bare `<name>` read from a resource declared in `fromModule`.
+ *
+ * **Same module first**, because that is what a bare name MEANS: it is resolved
+ * in the scope it was written in, and a cross-module reference is written with
+ * an alias. A name declared in exactly one module resolves to it whatever the
+ * reader's scope — which is what keeps an unstamped manifest set (every
+ * fixture, every single-module load) behaving as it did. A name declared in
+ * SEVERAL other modules and none of the reader's resolves to NOTHING: guessing
+ * between them attributes a reference to a resource the author never named, and
+ * some other pass reports the dangling name honestly.
+ *
+ * Exported because more than one pass resolves a bare name — the call graph's
+ * own sites, and the projection's inline declarations and CEL state reads. Two
+ * spellings of this rule is how a fix in one leaves a first-wins lookup in the
+ * other, which is exactly the collision it exists to prevent.
+ */
+export function resolveScopedName(candidates, moduleOf, fromModule) {
+    if (!candidates || candidates.length === 0)
+        return undefined;
+    if (candidates.length === 1)
+        return candidates[0];
+    return candidates.find((candidate) => moduleOf(candidate) === fromModule);
+}
 /**
  * Does control reach this edge's target?
  *
@@ -141,6 +184,64 @@ function isPlainRefValue(value) {
         return false;
     return Object.keys(value).every((k) => k === "kind" || k === "name" || k === "alias" || k === "__ref");
 }
+/**
+ * What a step IS, and what decides whether it runs.
+ *
+ * Both come off the schema rather than off a keyword list: the variant is the
+ * `oneOf` branch whose REQUIRED keys the step carries, and the predicate is the
+ * field annotated as one. A composer that declares a step body of its own is
+ * therefore described in its own words, and nothing here knows that `while`
+ * exists.
+ *
+ * A step matching several branches takes the FIRST — the grammar is a `oneOf`,
+ * so more than one match is a manifest the checker rejects, and guessing among
+ * them would be a second opinion on a question the checker already answers.
+ */
+function classifyStep(step, itemSchema, rootSchema) {
+    if (!itemSchema)
+        return {};
+    const branches = Array.isArray(itemSchema.oneOf) ? itemSchema.oneOf : [];
+    let variant;
+    let variantLabel;
+    for (const raw of branches) {
+        const branch = resolveLocalRef(raw, rootSchema);
+        const required = Array.isArray(branch?.required) ? branch.required : [];
+        if (required.length === 0 || !required.every((key) => step[key] !== undefined))
+            continue;
+        // The keys are what the branch IS; the title is what it is called.
+        variant = [...required].sort().join("+");
+        if (typeof branch?.title === "string")
+            variantLabel = branch.title;
+        break;
+    }
+    let predicate;
+    for (const [key, propSchema] of propertySchemas(itemSchema)) {
+        const role = propSchema?.["x-telo-topology-role"];
+        if (role !== "predicate" && role !== "discriminator")
+            continue;
+        const written = expressionSource(step[key]);
+        if (written !== undefined) {
+            predicate = written;
+            break;
+        }
+    }
+    return {
+        ...(variant ? { variant } : {}),
+        ...(variantLabel ? { variantLabel } : {}),
+        ...(predicate ? { predicate } : {}),
+    };
+}
+/** A predicate as the author wrote it. A CEL value reaches here as a tagged
+ *  sentinel or as an already-compiled node, and the SOURCE is the only part of
+ *  either worth showing. */
+function expressionSource(value) {
+    if (typeof value === "string")
+        return value;
+    if (value === null || typeof value !== "object")
+        return undefined;
+    const record = value;
+    return typeof record.source === "string" ? record.source : undefined;
+}
 /**
  * Emit the edges a single step's own ref slots declare.
  *
@@ -158,7 +259,20 @@ function emitStepEdges(node, ctx) {
         const slot = readRefSlot(propSchema);
         if (!slot || slot.kinds.length === 0)
             continue;
-        const targetName = refTargetName(node.step[key]);
+        const written = node.step[key];
+        const inline = written !== null &&
+            typeof written === "object" &&
+            !Array.isArray(written) &&
+            isInlineResource(written);
+        // Every declared slot is recorded, whatever is in it: an empty one is a
+        // site an editor can fill, and a declaration written at the site is a real
+        // dispatch that emits no edge — which is what made an inline step read
+        // exactly like one that dispatches nothing.
+        node.refSlots = [
+            ...(node.refSlots ?? []),
+            { key, path: `${node.path}.${key}`, kinds: slot.kinds, ...(inline ? { inline: true } : {}) },
+        ];
+        const targetName = refTargetName(written);
         if (targetName === undefined)
             continue;
         const entry = {
@@ -252,6 +366,13 @@ function walkSteps(steps, arrayPath, parent, ctx) {
         };
         if (typeof value.name === "string")
             node.name = value.name;
+        const { variant, variantLabel, predicate } = classifyStep(value, ctx.itemSchema, ctx.rootSchema);
+        if (variant)
+            node.variant = variant;
+        if (variantLabel)
+            node.variantLabel = variantLabel;
+        if (predicate)
+            node.predicate = predicate;
         if (parent)
             node.parent = parent;
         ctx.nodes.set(id, node);
@@ -296,6 +417,8 @@ function ownerStepOf(steps, concretePath) {
 export function buildCallGraph(resources, registry, options = {}) {
     const nodes = new Map();
     const edges = [];
+    /** Every declaration of a bare name, in declaration order — a name may be
+     *  declared once per module, so this is a list rather than one node. */
     const byName = new Map();
     const stepsByOwner = new Map();
     const stepEdgesByPath = new Map();
@@ -325,14 +448,17 @@ export function buildCallGraph(resources, registry, options = {}) {
             continue;
         const node = {
             type: "resource",
-            id: resourceId(manifest.kind, name),
+            id: nodeIdFor(manifest),
             kind: manifest.kind,
             name: name,
             manifest,
         };
+        if (nodes.has(node.id))
+            continue;
         nodes.set(node.id, node);
-        byName.set(node.name, node);
+        byName.set(node.name, [...(byName.get(node.name) ?? []), node]);
     }
+    const resolveByName = (name, fromModule) => resolveScopedName(byName.get(name), (node) => declaringModule(node.manifest), fromModule);
     // --- step nodes ---
     const collectStepsFor = (node, resolveName) => {
         const definition = definitionFor(node.manifest);
@@ -362,7 +488,7 @@ export function buildCallGraph(resources, registry, options = {}) {
             stepsByOwner.set(node.id, collected);
     };
     for (const node of [...nodes.values()]) {
-        collectStepsFor(node, (name) => byName.get(name));
+        collectStepsFor(node, (name) => resolveByName(name, declaringModule(node.manifest)));
     }
     // --- edges ---
     // Scope-local nodes of the CURRENT resource. The visitor fires `onScope`
@@ -386,7 +512,7 @@ export function buildCallGraph(resources, registry, options = {}) {
             const ownerName = event.source.metadata?.name;
             if (!ownerName || !event.source.kind)
                 return;
-            const ownerId = resourceId(event.source.kind, ownerName);
+            const ownerId = nodeIdFor(event.source);
             // Inline declarations inside `x-telo-scope` arrays become nodes of
             // their own, keyed by their scope site — the declaration-site identity
             // the zones plan correlates on. They are excluded from init ordering
@@ -413,7 +539,8 @@ export function buildCallGraph(resources, registry, options = {}) {
             }
             if (scopeLocal.size === 0)
                 return;
-            const resolveScoped = (name) => scopeLocal.get(name) ?? byName.get(name);
+            const ownerModule = declaringModule(event.source);
+            const resolveScoped = (name) => scopeLocal.get(name) ?? resolveByName(name, ownerModule);
             // The owner's own step edges were emitted before this scope was seen
             // (step collection precedes the visit), so their names resolved
             // module-level. Re-resolve them now that the scope exists: scope-local
@@ -474,7 +601,7 @@ export function buildCallGraph(resources, registry, options = {}) {
             const sourceName = event.source.metadata?.name;
             if (!sourceName || !event.source.kind)
                 return;
-            const sourceId = resourceId(event.source.kind, sourceName);
+            const sourceId = nodeIdFor(event.source);
             if (!nodes.has(sourceId))
                 return;
             // A site inside a step was already emitted by the step walk, which
@@ -507,9 +634,10 @@ export function buildCallGraph(resources, registry, options = {}) {
                 path: event.concretePath,
                 use,
             };
+            const sourceModule = declaringModule(event.source);
             const target = scopedNames.has(targetName)
-                ? (scopeLocal.get(targetName) ?? byName.get(targetName))
-                : byName.get(targetName);
+                ? (scopeLocal.get(targetName) ?? resolveByName(targetName, sourceModule))
+                : resolveByName(targetName, sourceModule);
             if (target)
                 edge.to = target.id;
             if (unresolved)
@@ -552,8 +680,13 @@ export function buildCallGraph(resources, registry, options = {}) {
         edges,
         edgesFrom: (id) => fromIndex.get(id) ?? [],
         edgesTo: (id) => toIndex.get(id) ?? [],
-        resource: (kind, name) => nodes.get(resourceId(kind, name)),
-        resourceByName: (name) => byName.get(name),
+        // Both accessors take a name with no module, so both answer for the one
+        // declaration that name has — and, where a flattened set has several, the
+        // first in declaration order. A caller that must tell two apart holds a
+        // node id, which carries the module.
+        resource: (kind, name) => nodes.get(resourceId(kind, name)) ??
+            byName.get(name)?.find((n) => n.kind === kind),
+        resourceByName: (name, fromModule) => resolveScopedName(byName.get(name), (node) => declaringModule(node.manifest), fromModule),
         steps: (ownerId) => stepsByOwner.get(ownerId) ?? [],
         controlEdges: () => edges.filter(reachesTarget),
     };

package/dist/extends-resolution.d.ts

@@ -36,6 +36,26 @@ export declare function inheritedCapability(def: ResourceDefinition | undefined,
  *    `mergeTypeSchemas` that `Type.JsonSchema.extends` uses.
  *  - no `extends` → the own schema unchanged. */
 export declare function effectiveAuthorSchema(def: ResourceDefinition | undefined, resolve: DefResolver): Record<string, any>;
+/**
+ * The fields a merge-form inheriting child publishes over its parent's reading.
+ *
+ * A child that inherits its controller by delegation and declares no `base:` IS
+ * the parent instance, so `resources.<child>` is the parent's `snapshot()` — and
+ * a field the parent has never heard of would be readable from nowhere. These
+ * are exactly those fields: the ones the effective (merged) schema declares that
+ * the controller-bearing ancestor's does not.
+ *
+ * A REDECLARED name is deliberately excluded. Narrowing an inherited field (a
+ * description, a pattern, a widget hint) is ordinary in an additive extension and
+ * says nothing about publication, while the parent's `snapshot()` is the sole
+ * authority on what a parent instance publishes — its normalizations, its
+ * deliberate omissions, and its redactions. Republishing such a field from raw
+ * config would silently undo a provider's decision to keep it out.
+ *
+ * Empty for the `base:` form, whose fields are construction inputs consumed by
+ * the mapping, and for a child with its own controller, which publishes itself.
+ */
+export declare function publishedOwnFields(def: ResourceDefinition | undefined, resolve: DefResolver): string[];
 /** The two directions of a kind's invocation contract. `inputType` is what a
  *  caller sends to `invoke()`; `outputType` is what `invoke()` / `provide()`
  *  returns. */

package/dist/extends-resolution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extends-resolution.d.ts","sourceRoot":"","sources":["../src/extends-resolution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAGvD;;;;;;;2DAO2D;AAC3D,MAAM,MAAM,WAAW,GAAG,CACxB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,kBAAkB,KACtB,kBAAkB,GAAG,SAAS,CAAC;AA0BpC;sDACsD;AACtD,wBAAgB,aAAa,CAC3B,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,kBAAkB,GAAG,SAAS,CAIhC;AAED;6EAC6E;AAC7E,wBAAgB,aAAa,CAC3B,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,kBAAkB,EAAE,CAUtB;AAED;iFACiF;AACjF,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,kBAAkB,GAAG,SAAS,GAAG,OAAO,CAUvF;AAED;;mFAEmF;AACnF,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,kBAAkB,GAAG,SAAS,CAMhC;AAED;;sCAEsC;AACtC,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,OAAO,CAGT;AAED;2EAC2E;AAC3E,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,MAAM,GAAG,SAAS,CAMpB;AAED;;;;;;iDAMiD;AACjD,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAOrB;AAED;;eAEe;AACf,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,YAAY,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,iBAAiB,GAC3B,OAAO,CAQT;AAED;;;6BAG6B;AAC7B,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,iBAAiB,GAC3B,kBAAkB,GAAG,SAAS,CAShC;AAED;;;;;8CAK8C;AAC9C,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,iBAAiB,GAC3B,OAAO,CAKT;AAED;;8EAE8E;AAC9E,wBAAgB,eAAe,CAAC,SAAS,EAAE,iBAAiB,GAAG,QAAQ,GAAG,QAAQ,CAEjF;AAED;;;;;;;;;gDASgD;AAChD,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CASjC"}
+{"version":3,"file":"extends-resolution.d.ts","sourceRoot":"","sources":["../src/extends-resolution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAGvD;;;;;;;2DAO2D;AAC3D,MAAM,MAAM,WAAW,GAAG,CACxB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,kBAAkB,KACtB,kBAAkB,GAAG,SAAS,CAAC;AA0BpC;sDACsD;AACtD,wBAAgB,aAAa,CAC3B,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,kBAAkB,GAAG,SAAS,CAIhC;AAED;6EAC6E;AAC7E,wBAAgB,aAAa,CAC3B,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,kBAAkB,EAAE,CAUtB;AAED;iFACiF;AACjF,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,kBAAkB,GAAG,SAAS,GAAG,OAAO,CAUvF;AAED;;mFAEmF;AACnF,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,kBAAkB,GAAG,SAAS,CAMhC;AAED;;sCAEsC;AACtC,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,OAAO,CAGT;AAED;2EAC2E;AAC3E,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,MAAM,GAAG,SAAS,CAMpB;AAED;;;;;;iDAMiD;AACjD,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAOrB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,MAAM,EAAE,CASV;AAED;;eAEe;AACf,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,YAAY,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,iBAAiB,GAC3B,OAAO,CAQT;AAED;;;6BAG6B;AAC7B,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,iBAAiB,GAC3B,kBAAkB,GAAG,SAAS,CAShC;AAED;;;;;8CAK8C;AAC9C,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,iBAAiB,GAC3B,OAAO,CAKT;AAED;;8EAE8E;AAC9E,wBAAgB,eAAe,CAAC,SAAS,EAAE,iBAAiB,GAAG,QAAQ,GAAG,QAAQ,CAEjF;AAED;;;;;;;;;gDASgD;AAChD,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CASjC"}

package/dist/extends-resolution.js

@@ -80,6 +80,35 @@ export function effectiveAuthorSchema(def, resolve) {
     const parentSchema = effectiveAuthorSchema(parent, resolve);
     return mergeTypeSchemas([parentSchema, own]);
 }
+/**
+ * The fields a merge-form inheriting child publishes over its parent's reading.
+ *
+ * A child that inherits its controller by delegation and declares no `base:` IS
+ * the parent instance, so `resources.<child>` is the parent's `snapshot()` — and
+ * a field the parent has never heard of would be readable from nowhere. These
+ * are exactly those fields: the ones the effective (merged) schema declares that
+ * the controller-bearing ancestor's does not.
+ *
+ * A REDECLARED name is deliberately excluded. Narrowing an inherited field (a
+ * description, a pattern, a widget hint) is ordinary in an additive extension and
+ * says nothing about publication, while the parent's `snapshot()` is the sole
+ * authority on what a parent instance publishes — its normalizations, its
+ * deliberate omissions, and its redactions. Republishing such a field from raw
+ * config would silently undo a provider's decision to keep it out.
+ *
+ * Empty for the `base:` form, whose fields are construction inputs consumed by
+ * the mapping, and for a child with its own controller, which publishes itself.
+ */
+export function publishedOwnFields(def, resolve) {
+    if (body(def).base || !isInheritedDelegation(def, resolve))
+        return [];
+    const ancestor = controllerBearingAncestor(def, resolve);
+    if (!ancestor)
+        return [];
+    const inherited = new Set(Object.keys((effectiveAuthorSchema(ancestor, resolve).properties ?? {})));
+    const own = (effectiveAuthorSchema(def, resolve).properties ?? {});
+    return Object.keys(own).filter((name) => !inherited.has(name));
+}
 /**
  * The **nearest declaration** of an invocation contract along the `extends`
  * chain, self first — the raw type-field value, still to be resolved to a schema

package/dist/import-resolution-diagnostics.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"import-resolution-diagnostics.d.ts","sourceRoot":"","sources":["../src/import-resolution-diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAkB,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIrE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAyCzE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,WAAW,GAAG,kBAAkB,EAAE,CAepF"}
+{"version":3,"file":"import-resolution-diagnostics.d.ts","sourceRoot":"","sources":["../src/import-resolution-diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAkB,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AA2DzE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,WAAW,GAAG,kBAAkB,EAAE,CAepF"}

package/dist/import-resolution-diagnostics.js

@@ -1,15 +1,13 @@
 import { isLocalPathSource } from "./sources/local-path-ref.js";
-import { isRegistryRef } from "./sources/module-ref.js";
 import { isOciRef } from "./sources/oci-ref.js";
 import { DiagnosticSeverity } from "./types.js";
 const SOURCE = "telo-analyzer";
-/** True when `source` is a shape some transport claims — a registry ref, an OCI
- *  ref, an HTTP(S) URL, or a relative/absolute path. A source matching none of
- *  these is malformed (no transport can ever resolve it), which we report
- *  differently from a well-formed ref that simply failed to fetch. */
+/** True when `source` is a shape some transport claims — an OCI ref, an HTTP(S)
+ *  URL, or a relative/absolute path. A source matching none of these is
+ *  malformed (no transport can ever resolve it), which we report differently
+ *  from a well-formed ref that simply failed to fetch. */
 function isRecognizedSourceShape(source) {
-    return (isRegistryRef(source) ||
-        isOciRef(source) ||
+    return (isOciRef(source) ||
         source.startsWith("http://") ||
         source.startsWith("https://") ||
         isLocalPathSource(source));
@@ -21,12 +19,28 @@ function classify(e) {
         return "INVALID_IMPORT_TARGET";
     return isRecognizedSourceShape(e.source ?? e.url) ? "IMPORT_UNRESOLVED" : "INVALID_IMPORT_SOURCE";
 }
+/** The removed bare `<namespace>/<name>@<version>` ref: no scheme, not a path,
+ *  carrying both a `/` and an `@`. Recognised only to explain itself — no
+ *  migration can rewrite it, because the OCI host it moved to is not derivable
+ *  from the ref, and the failing line is frequently inside a dependency the
+ *  consumer cannot edit. The message is the whole remedy available to them. */
+function isRemovedBareRef(source) {
+    return (!source.includes("://") &&
+        !source.startsWith("/") &&
+        !source.startsWith(".") &&
+        source.includes("@") &&
+        source.includes("/"));
+}
 function messageFor(e, code) {
     const authored = e.source ?? e.url;
     const via = e.alias ? `import '${e.alias}' → '${authored}'` : `'${authored}'`;
     if (code === "INVALID_IMPORT_SOURCE") {
+        const removedForm = isRemovedBareRef(authored)
+            ? ` The bare '<namespace>/<name>@<version>' form was removed — rewrite it to the ` +
+                `module's 'oci://' ref (\`telo search <name>\` reports it).`
+            : "";
         return (`Cannot resolve ${via}: not a recognized module reference. Expected ` +
-            `'namespace/name@version', 'oci://host/repo@tag', 'https://…', or a relative path.`);
+            `'oci://host/repo@tag', 'https://…', or a relative path.${removedForm}`);
     }
     // The target WAS obtained, so "cannot resolve" would name the wrong problem —
     // and the wrong person to fix it. The loader's message already says what was