@telorun/analyzer 0.67.0 → 0.69.0

package/dist/reconcile-module-versions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reconcile-module-versions.d.ts","sourceRoot":"","sources":["../src/reconcile-module-versions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAOlE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;0CAI0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,gEAAgE;IAChE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;2EACuE;IACvE,WAAW,EAAE,kBAAkB,EAAE,CAAC;CACnC;AAgJD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,EAClC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,GAChD,qBAAqB,CAsEvB"}
+{"version":3,"file":"reconcile-module-versions.d.ts","sourceRoot":"","sources":["../src/reconcile-module-versions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAOlE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;0CAI0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,gEAAgE;IAChE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;2EACuE;IACvE,WAAW,EAAE,kBAAkB,EAAE,CAAC;CACnC;AA+ID;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,EAClC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,GAChD,qBAAqB,CAsEvB"}

package/dist/reconcile-module-versions.js

@@ -19,15 +19,14 @@ const SOURCE = "telo-analyzer";
  *  **What this key cannot relate.** It compares ref *spellings*, so it groups by
  *  origin exactly and nothing else. Two consequences, both accepted:
  *
- *  - A module imported once by a registry ref and once by a relative path is two
- *    groups, so a version skew between them is not hoisted. Keying on what the
- *    module declares about itself would catch that case, but only by trusting a
- *    self-declared identity — which is what this change removes, and which
- *    cannot tell two same-named modules from different origins apart.
- *  - A bare `std/kv-store@0.4.0` and the equivalent direct
- *    `https://<registry>/std/kv-store/0.4.0/telo.yaml` are two groups. Relating
- *    them needs the configured registry base, which this pure, browser-safe
- *    function does not have. */
+ *  - A module imported once by an `oci://` ref and once by a relative path is
+ *    two groups, so a version skew between them is not hoisted. Keying on what
+ *    the module declares about itself would catch that case, but only by
+ *    trusting a self-declared identity — which is what this change removes, and
+ *    which cannot tell two same-named modules from different origins apart.
+ *  - An `oci://` ref and a direct `https://…/telo.yaml` URL serving the same
+ *    module are two groups. Relating them needs knowledge of the origin's
+ *    layout, which this pure, browser-safe function does not have. */
 function refIdentity(ref) {
     const base = ref.split("#")[0];
     if (!base || base.startsWith(".") || base.startsWith("/") || base.startsWith("file:")) {
@@ -137,8 +136,8 @@ export function reconcileModuleVersions(modules, importEdges) {
     // source normally maps to exactly one identity; the entry module has no
     // inbound edge and needs none (it is never reconciled against itself).
     //
-    // One source CAN be reached by two spellings of the same location (a bare
-    // registry ref and the direct URL it resolves to). Both name the same module
+    // One source CAN be reached by two spellings of the same location (a ref and
+    // the direct URL it resolves to). Both name the same module
     // at the same version, so either identity groups it correctly — but the choice
     // must not depend on edge iteration order, or the same graph could reconcile
     // differently across runs. First edge wins.

package/dist/release/release-plan.d.ts

@@ -51,7 +51,7 @@ export interface ModuleEvidence {
     readonly inlines: ReadonlyMap<ModuleKey, readonly string[]>;
     /**
      * Modules reached by an in-repo **relative** `imports:` source. A pinned
-     * registry ref is deliberately not an edge: pinning is the statement "I am not
+     * remote ref is deliberately not an edge: pinning is the statement "I am not
      * affected until I choose to be", and moving it is `telo upgrade`'s job.
      */
     readonly imports: readonly ModuleKey[];

package/dist/resolve-zone-containment.d.ts

@@ -81,8 +81,15 @@ export interface ZoneRegion {
  *  DECLARED it — the same resolver the projection takes, passed in rather than
  *  rebuilt so both walks agree about what a kind means. */
 export type DefinitionLookup = (kind: string, module?: string) => ResourceDefinition | undefined;
+/** A region as the WALK finds it, before any attribute is asked for: the slot
+ *  that opens it and everything it reaches. Every attribute query is a filter
+ *  over these, so a consumer wanting regions regardless of what they declare —
+ *  an editor drawing the enclosure, where a zone declaring no attribute is
+ *  still a zone — reads them directly instead of enumerating the vocabulary and
+ *  silently missing whatever is not in it. */
+export type ZoneProvider = Omit<ZoneRegion, "attribute" | "reason">;
 /**
- * Every region in the graph opened by a slot declaring `attribute`.
+ * Every region in the graph, keyed by the slot that opens it.
  *
  * The provider itself is NOT in `contents` — a zone constrains what runs inside
  * its body, not the resource that establishes it. A transaction's own
@@ -90,6 +97,7 @@ export type DefinitionLookup = (kind: string, module?: string) => ResourceDefini
  * treated the provider as contained would report the provider against its own
  * constraint.
  */
+export declare function findZoneProviders(graph: CallGraph, resolveDef: DefinitionLookup): ZoneProvider[];
 export declare function findZoneRegions(graph: CallGraph, resolveDef: DefinitionLookup, attribute: string): ZoneRegion[];
 /** Convenience for a consumer that only wants membership: every node id inside
  *  any region opened by `attribute`, mapped to the region that contains it. */

package/dist/resolve-zone-containment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-zone-containment.d.ts","sourceRoot":"","sources":["../src/resolve-zone-containment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAKlG,+DAA+D;AAC/D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,aAAa,CAAC;IACpB;wDACoD;IACpD,GAAG,EAAE,MAAM,EAAE,CAAC;CACf;AAED;;;;;gFAKgF;AAChF,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,aAAa,CAAC;IACpB,mDAAmD;IACnD,IAAI,EAAE,iBAAiB,CAAC;IACxB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB;uEACmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb;4EACwE;IACxE,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7C;8EAC0E;IAC1E,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC7C,0EAA0E;IAC1E,UAAU,EAAE,SAAS,cAAc,EAAE,CAAC;CACvC;AAED;;2DAE2D;AAC3D,MAAM,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,kBAAkB,GAAG,SAAS,CAAC;AA4GjG;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,SAAS,EAChB,UAAU,EAAE,gBAAgB,EAC5B,SAAS,EAAE,MAAM,GAChB,UAAU,EAAE,CA6Dd;AAoCD;+EAC+E;AAC/E,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,SAAS,UAAU,EAAE,GAC7B,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAQjC;AAED,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,gBAAgB,EAAE,CAMtE"}
+{"version":3,"file":"resolve-zone-containment.d.ts","sourceRoot":"","sources":["../src/resolve-zone-containment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAKlG,+DAA+D;AAC/D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,aAAa,CAAC;IACpB;wDACoD;IACpD,GAAG,EAAE,MAAM,EAAE,CAAC;CACf;AAED;;;;;gFAKgF;AAChF,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,aAAa,CAAC;IACpB,mDAAmD;IACnD,IAAI,EAAE,iBAAiB,CAAC;IACxB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB;uEACmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb;4EACwE;IACxE,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7C;8EAC0E;IAC1E,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC7C,0EAA0E;IAC1E,UAAU,EAAE,SAAS,cAAc,EAAE,CAAC;CACvC;AAED;;2DAE2D;AAC3D,MAAM,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,kBAAkB,GAAG,SAAS,CAAC;AA4GjG;;;;;8CAK8C;AAC9C,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,EAAE,WAAW,GAAG,QAAQ,CAAC,CAAC;AAEpE;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,SAAS,EAChB,UAAU,EAAE,gBAAgB,GAC3B,YAAY,EAAE,CA0DhB;AAmBD,wBAAgB,eAAe,CAC7B,KAAK,EAAE,SAAS,EAChB,UAAU,EAAE,gBAAgB,EAC5B,SAAS,EAAE,MAAM,GAChB,UAAU,EAAE,CAad;AAoCD;+EAC+E;AAC/E,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,SAAS,UAAU,EAAE,GAC7B,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAQjC;AAED,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,gBAAgB,EAAE,CAMtE"}

package/dist/resolve-zone-containment.js

@@ -91,7 +91,7 @@ function collect(graph, entries, contents, boundaries) {
     }
 }
 /**
- * Every region in the graph opened by a slot declaring `attribute`.
+ * Every region in the graph, keyed by the slot that opens it.
  *
  * The provider itself is NOT in `contents` — a zone constrains what runs inside
  * its body, not the resource that establishes it. A transaction's own
@@ -99,7 +99,7 @@ function collect(graph, entries, contents, boundaries) {
  * treated the provider as contained would report the provider against its own
  * constraint.
  */
-export function findZoneRegions(graph, resolveDef, attribute) {
+export function findZoneProviders(graph, resolveDef) {
     const regions = [];
     for (const node of graph.nodes.values()) {
         if (node.type !== "resource")
@@ -112,8 +112,7 @@ export function findZoneRegions(graph, resolveDef, attribute) {
         // properties rather than by knowing any kind's field names.
         for (const [slot, slotSchema] of providingSlots(rootSchema)) {
             const provides = readProvidesZone(slotSchema);
-            const reason = provides?.attributes[attribute];
-            if (!provides || typeof reason !== "string")
+            if (!provides)
                 continue;
             const contents = new Map();
             const boundaries = [];
@@ -147,8 +146,6 @@ export function findZoneRegions(graph, resolveDef, attribute) {
                 collect(graph, entries, contents, boundaries);
             }
             regions.push({
-                attribute,
-                reason,
                 provider: node,
                 slot,
                 attributes: provides.attributes,
@@ -159,6 +156,37 @@ export function findZoneRegions(graph, resolveDef, attribute) {
     }
     return regions;
 }
+/**
+ * Every region opened by a slot declaring `attribute`.
+ *
+ * A filter over {@link findZoneProviders}, so the walk is stated once: what an
+ * attribute query adds is which regions are in scope and the author's `reason`,
+ * which is the attribute's own value.
+ *
+ * **The provider list is memoized per graph**, because the filter made the walk
+ * unconditional: it used to skip the containment BFS for any provider not
+ * declaring the queried attribute, and six queries per analysis (four zone
+ * attributes plus two durable ones) became six full walks over every provider
+ * in the module. The cache is keyed on the CallGraph object, which is itself
+ * built once per analysis — so it lives exactly as long as the answer stays
+ * true, and a rebuilt graph gets a fresh one.
+ */
+const providersByGraph = new WeakMap();
+export function findZoneRegions(graph, resolveDef, attribute) {
+    let providers = providersByGraph.get(graph);
+    if (!providers) {
+        providers = findZoneProviders(graph, resolveDef);
+        providersByGraph.set(graph, providers);
+    }
+    const out = [];
+    for (const region of providers) {
+        const reason = region.attributes[attribute];
+        if (typeof reason !== "string")
+            continue;
+        out.push({ ...region, attribute, reason });
+    }
+    return out;
+}
 /** Field-map paths of every slot in a kind's schema carrying a provides-zone
  *  annotation, with the schema node at each. Walks properties, array items and
  *  `additionalProperties`, resolving local `$ref`s — the paths the call graph's

package/dist/resolve-zone-requirements.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-zone-requirements.d.ts","sourceRoot":"","sources":["../src/resolve-zone-requirements.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAEL,KAAK,SAAS,EAEd,KAAK,iBAAiB,EACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAMnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;uCAEuC;AACvC,MAAM,WAAW,mBAAmB;IAClC,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb;;wBAEoB;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;sDACkD;IAClD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;gCAG4B;IAC5B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,GAAG,EAAE,MAAM,EAAE,CAAC;CACf;AAED,6EAA6E;AAC7E,MAAM,MAAM,sBAAsB,GAAG,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAExE,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,sBAAsB,CAAC;CACjC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;AAkBhE,UAAU,cAAc;IACtB,KAAK,EAAE,SAAS,CAAC;IACjB,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC5C;qEACiE;IACjE,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC;0EACsE;IACtE,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC3C;2CACuC;IACvC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,iBAAiB,KAAK,MAAM,GAAG,SAAS,CAAC;CAC5D;AAED,UAAU,gBAAgB;IACxB,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAClC,WAAW,EAAE,sBAAsB,CAAC;CACrC;AAwKD,yCAAyC;AACzC,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,cAAc,GAAG,gBAAgB,CA+Y9E;AAED;;;;iEAIiE;AACjE,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,SAAS,gBAAgB,EAAE,GAAG,MAAM,CAUrF;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,mBAAmB,EACzB,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAC3C,KAAK,CAAC,EAAE,eAAe,GACtB,sBAAsB,CAkBxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,KAAK,EAAE,SAAS,CAAC;IACjB,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC5C,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,eAAe,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACjD,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,gBAAgB,GAAG,kBAAkB,EAAE,CAwF5E"}
+{"version":3,"file":"resolve-zone-requirements.d.ts","sourceRoot":"","sources":["../src/resolve-zone-requirements.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAEL,KAAK,SAAS,EAEd,KAAK,iBAAiB,EACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAMnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;uCAEuC;AACvC,MAAM,WAAW,mBAAmB;IAClC,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb;;wBAEoB;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;sDACkD;IAClD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;gCAG4B;IAC5B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,GAAG,EAAE,MAAM,EAAE,CAAC;CACf;AAED,6EAA6E;AAC7E,MAAM,MAAM,sBAAsB,GAAG,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAExE,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,sBAAsB,CAAC;CACjC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;AAkBhE,UAAU,cAAc;IACtB,KAAK,EAAE,SAAS,CAAC;IACjB,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC5C;qEACiE;IACjE,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC;0EACsE;IACtE,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC3C;2CACuC;IACvC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,iBAAiB,KAAK,MAAM,GAAG,SAAS,CAAC;CAC5D;AAED,UAAU,gBAAgB;IACxB,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAClC,WAAW,EAAE,sBAAsB,CAAC;CACrC;AAwKD,yCAAyC;AACzC,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,cAAc,GAAG,gBAAgB,CAoZ9E;AAED;;;;iEAIiE;AACjE,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,SAAS,gBAAgB,EAAE,GAAG,MAAM,CAUrF;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,mBAAmB,EACzB,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAC3C,KAAK,CAAC,EAAE,eAAe,GACtB,sBAAsB,CAkBxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,KAAK,EAAE,SAAS,CAAC;IACjB,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC5C,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,eAAe,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACjD,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,gBAAgB,GAAG,kBAAkB,EAAE,CAwF5E"}

package/dist/resolve-zone-requirements.js

@@ -175,7 +175,9 @@ export function projectZoneRequirements(args) {
             if (local)
                 return local;
         }
-        return graph.resourceByName(name);
+        // In the scope that WROTE the name: a bare reference means the reader's own
+        // module, and two libraries may each declare one.
+        return graph.resourceByName(name, from.manifest.metadata?.module);
     };
     const acceptedFor = (zone) => {
         const out = new Set([zone]);
@@ -550,7 +552,7 @@ export function runZoneAnalysis(args) {
         for (const [exportName, specs] of openExports) {
             if (!lib.exportedNames.has(exportName))
                 continue;
-            const node = graph.resourceByName(exportName);
+            const node = graph.resourceByName(exportName, lib.module);
             if (!node || node.manifest.metadata?.module !== lib.module) {
                 continue;
             }

package/dist/schema-keywords.d.ts

@@ -26,6 +26,8 @@
  * Browser-safe: no Node built-ins.
  */
 import { X_TELO_TYPE } from "@telorun/sdk";
+/** The one annotation read from a DATA schema rather than a kind schema. */
+declare const X_TELO_SENSITIVE: "x-telo-sensitive";
 import { ANNOTATION_KEYWORDS } from "./value-type-keyword.js";
 /** A keyword entry: the JSON Schema its VALUE must satisfy, carrying the title
  *  and description completion and hover show. */
@@ -64,5 +66,18 @@ export declare function jsonSchemaKeywords(self: string): SchemaKeywords;
  * neither validation nor completion. Closing it needs the walkers to distinguish
  * a schema describing an annotation from an annotation, which nothing does yet.
  */
-export declare const TELO_SCHEMA_ANNOTATIONS: Record<(typeof ANNOTATION_KEYWORDS)[number] | typeof X_TELO_TYPE, Record<string, unknown>>;
+export declare const TELO_SCHEMA_ANNOTATIONS: Record<Exclude<(typeof ANNOTATION_KEYWORDS)[number], typeof X_TELO_SENSITIVE> | typeof X_TELO_TYPE, Record<string, unknown>>;
+/**
+ * Annotations that belong on a DATA schema — an `inputType` / `outputType`
+ * contract — rather than on a kind's own `schema:`.
+ *
+ * Split out because {@link TELO_SCHEMA_ANNOTATIONS} is offered only where the
+ * fragment is `KindSchema`, which is a kind's CONFIGURATION. `x-telo-sensitive`
+ * is read from the opposite place: the kernel resolves it off a bound contract,
+ * which stamps `JsonSchema7`. Offering it from the kind vocabulary alone put it
+ * on the one schema where nothing reads it and withheld it from the two where it
+ * is the whole mechanism.
+ */
+export declare const TELO_DATA_SCHEMA_ANNOTATIONS: Record<typeof X_TELO_SENSITIVE, Record<string, unknown>>;
+export {};
 //# sourceMappingURL=schema-keywords.d.ts.map

package/dist/schema-keywords.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-keywords.d.ts","sourceRoot":"","sources":["../src/schema-keywords.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D;iDACiD;AACjD,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AASrE;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAuJ/D;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAC1C,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,GAAG,OAAO,WAAW,EACzD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAwJxB,CAAC"}
+{"version":3,"file":"schema-keywords.d.ts","sourceRoot":"","sources":["../src/schema-keywords.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,4EAA4E;AAC5E,QAAA,MAAM,gBAAgB,EAAG,kBAA2B,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D;iDACiD;AACjD,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AASrE;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAuJ/D;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAMxC,OAAO,CAAC,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,gBAAgB,CAAC,GACtE,OAAO,WAAW,EACpB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAwJxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,EAAE,MAAM,CAC/C,OAAO,gBAAgB,EACvB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQxB,CAAC"}

package/dist/schema-keywords.js

@@ -25,6 +25,8 @@
  *
  * Browser-safe: no Node built-ins.
  */
+/** The one annotation read from a DATA schema rather than a kind schema. */
+const X_TELO_SENSITIVE = "x-telo-sensitive";
 /** A JSON type name, as `type:` accepts it — one, or a list (`[string, "null"]`,
  *  the spelling `CEL_NULLABLE_ACCESS` guards). */
 const TYPE_NAME = {
@@ -342,3 +344,21 @@ export const TELO_SCHEMA_ANNOTATIONS = {
         type: "string",
     },
 };
+/**
+ * Annotations that belong on a DATA schema — an `inputType` / `outputType`
+ * contract — rather than on a kind's own `schema:`.
+ *
+ * Split out because {@link TELO_SCHEMA_ANNOTATIONS} is offered only where the
+ * fragment is `KindSchema`, which is a kind's CONFIGURATION. `x-telo-sensitive`
+ * is read from the opposite place: the kernel resolves it off a bound contract,
+ * which stamps `JsonSchema7`. Offering it from the kind vocabulary alone put it
+ * on the one schema where nothing reads it and withheld it from the two where it
+ * is the whole mechanism.
+ */
+export const TELO_DATA_SCHEMA_ANNOTATIONS = {
+    [X_TELO_SENSITIVE]: {
+        title: "Sensitive",
+        description: "This value is auth material or equivalent: carry it as `[redacted]` in trace payloads and on the debug wire rather than verbatim. Read only from a resource's declared `inputType` / `outputType`.",
+        type: "boolean",
+    },
+};

package/dist/sources/default-sources.d.ts

@@ -1,8 +1,8 @@
 import type { ManifestSource } from "../types.js";
-/** The browser-safe built-in sources, in resolution order: HTTP fetch then
- *  registry. Node-specific sources (local filesystem) are supplied by the
- *  consuming package and passed alongside these into the `Loader` constructor.
- *  Callers that only want a subset (e.g. the editor, which brings its own
- *  registry adapters) construct the individual sources directly. */
-export declare function defaultSources(registryUrl?: string): ManifestSource[];
+/** The browser-safe built-in sources. Node-specific sources (local filesystem)
+ *  are supplied by the consuming package and passed alongside these into the
+ *  `Loader` constructor. Callers that only want a subset (e.g. the editor, which
+ *  brings its own manifest-cache adapter) construct the individual sources
+ *  directly. */
+export declare function defaultSources(): ManifestSource[];
 //# sourceMappingURL=default-sources.d.ts.map

package/dist/sources/default-sources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default-sources.d.ts","sourceRoot":"","sources":["../../src/sources/default-sources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAIlD;;;;oEAIoE;AACpE,wBAAgB,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,cAAc,EAAE,CAErE"}
+{"version":3,"file":"default-sources.d.ts","sourceRoot":"","sources":["../../src/sources/default-sources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAGlD;;;;gBAIgB;AAChB,wBAAgB,cAAc,IAAI,cAAc,EAAE,CAEjD"}

package/dist/sources/default-sources.js

@@ -1,10 +1,9 @@
 import { HttpSource } from "./http-source.js";
-import { RegistrySource } from "./registry-source.js";
-/** The browser-safe built-in sources, in resolution order: HTTP fetch then
- *  registry. Node-specific sources (local filesystem) are supplied by the
- *  consuming package and passed alongside these into the `Loader` constructor.
- *  Callers that only want a subset (e.g. the editor, which brings its own
- *  registry adapters) construct the individual sources directly. */
-export function defaultSources(registryUrl) {
-    return [new HttpSource(), new RegistrySource(registryUrl)];
+/** The browser-safe built-in sources. Node-specific sources (local filesystem)
+ *  are supplied by the consuming package and passed alongside these into the
+ *  `Loader` constructor. Callers that only want a subset (e.g. the editor, which
+ *  brings its own manifest-cache adapter) construct the individual sources
+ *  directly. */
+export function defaultSources() {
+    return [new HttpSource()];
 }

package/dist/sources/integrity.d.ts

@@ -43,8 +43,9 @@ export declare function verifyIntegrity(bytes: Uint8Array, integrity: string, de
 /** The single verified network read for remote manifests: fetch `fetchUrl`,
  *  verify the raw bytes against `integrity` (when pinned), and return both the
  *  bytes and the decoded text. The one choke point every network `ManifestSource`
- *  routes through, so verification cannot drift between them. `describe` names
- *  the artifact in error messages. */
+ *  routes through, so verification cannot drift between them — which is also why
+ *  the object-storage non-manifest check lives here rather than in each source.
+ *  `describe` names the artifact in error messages. */
 export declare function verifiedFetch(fetchUrl: string, integrity: string | undefined, describe: string): Promise<{
     bytes: Uint8Array;
     text: string;

package/dist/sources/integrity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integrity.d.ts","sourceRoot":"","sources":["../../src/sources/integrity.ts"],"names":[],"mappings":"AAAA;;;;;;6EAM6E;AAc7E;;;qDAGqD;AACrD,qBAAa,cAAe,SAAQ,KAAK;gBAC3B,OAAO,EAAE,MAAM;CAI5B;AAED;;2EAE2E;AAC3E,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAIhF;AAED;;;kFAGkF;AAClF,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,CAIxE;AAED;;;;;;;;8DAQ8D;AAC9D,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEpE;AAcD,iFAAiF;AACjF,wBAAsB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAOxE;AAED;;gFAEgF;AAChF,wBAAsB,eAAe,CACnC,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAkBf;AAED;;;;sCAIsC;AACtC,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAU9C"}
+{"version":3,"file":"integrity.d.ts","sourceRoot":"","sources":["../../src/sources/integrity.ts"],"names":[],"mappings":"AAAA;;;;;;6EAM6E;AAc7E;;;qDAGqD;AACrD,qBAAa,cAAe,SAAQ,KAAK;gBAC3B,OAAO,EAAE,MAAM;CAI5B;AAED;;2EAE2E;AAC3E,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAIhF;AAED;;;kFAGkF;AAClF,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,CAIxE;AAED;;;;;;;;8DAQ8D;AAC9D,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEpE;AAcD,iFAAiF;AACjF,wBAAsB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAOxE;AAED;;gFAEgF;AAChF,wBAAsB,eAAe,CACnC,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAkBf;AAgBD;;;;;uDAKuD;AACvD,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAoB9C"}

package/dist/sources/integrity.js

@@ -93,18 +93,41 @@ export async function verifyIntegrity(bytes, integrity, describe) {
             `the module may have been tampered with or republished.`);
     }
 }
+/** Object-storage backends (Cloudflare R2, S3) surface auth and permission
+ *  failures as a **200 with an XML error body**. Caught here rather than left to
+ *  the loader, which would parse the XML as YAML and report a downstream
+ *  `UNDEFINED_KIND` — naming the manifest's contents as the problem instead of
+ *  the origin that refused to serve it. Returns the failure detail, or `null`
+ *  when the body is not an XML error document. */
+function objectStorageError(text) {
+    const head = text.trimStart();
+    if (!head.startsWith("<?xml") && !head.startsWith("<Error"))
+        return null;
+    const code = text.match(/<Code>([^<]+)<\/Code>/);
+    const message = text.match(/<Message>([^<]+)<\/Message>/);
+    return code && message ? `${code[1]}: ${message[1]}` : text.slice(0, 200);
+}
 /** The single verified network read for remote manifests: fetch `fetchUrl`,
  *  verify the raw bytes against `integrity` (when pinned), and return both the
  *  bytes and the decoded text. The one choke point every network `ManifestSource`
- *  routes through, so verification cannot drift between them. `describe` names
- *  the artifact in error messages. */
+ *  routes through, so verification cannot drift between them — which is also why
+ *  the object-storage non-manifest check lives here rather than in each source.
+ *  `describe` names the artifact in error messages. */
 export async function verifiedFetch(fetchUrl, integrity, describe) {
     const response = await fetch(fetchUrl);
     if (!response.ok) {
         throw new Error(`Failed to fetch manifest ${describe}: ${response.status} ${response.statusText} (${fetchUrl})`);
     }
     const bytes = new Uint8Array(await response.arrayBuffer());
+    const text = new TextDecoder().decode(bytes);
+    // Before the integrity check: a bucket's error page hashes to something, and
+    // reporting a pin mismatch would name the wrong cause just as the loader does.
+    const storageError = objectStorageError(text);
+    if (storageError) {
+        throw new Error(`The origin returned a non-manifest response for ${describe} ` +
+            `(URL: ${fetchUrl}): ${storageError}`);
+    }
     if (integrity)
         await verifyIntegrity(bytes, integrity, describe);
-    return { bytes, text: new TextDecoder().decode(bytes) };
+    return { bytes, text };
 }

package/dist/sources/versioned-ref.d.ts

@@ -2,11 +2,11 @@
  *  ref, the version segment it currently names, and any inline pin. */
 export interface ParsedVersionedRef {
     /** The ref with its `@version` segment and integrity fragment removed —
-     *  `std/run`, `oci://ghcr.io/telorun/timer`. This is the identity a version
-     *  list is keyed by (the hub registers modules under exactly this form). */
+     *  `oci://ghcr.io/telorun/timer`. This is the identity a version list is keyed
+     *  by (the hub registers modules under exactly this form). */
     baseRef: string;
-    /** The version segment, raw — a registry `@version`, an OCI tag, or an OCI
-     *  digest reference (`sha256:…`). The caller applies its own SemVer check. */
+    /** The version segment, raw — an OCI tag or an OCI digest reference
+     *  (`sha256:…`). The caller applies its own SemVer check. */
     version: string;
     /** Telo's inline `sha256-<base64url>` pin, when the ref carried one. */
     integrity?: string;
@@ -15,12 +15,17 @@ export interface ParsedVersionedRef {
  *  upgradeable version — a local path, a bare `https://` URL, or an OCI ref
  *  with no explicit reference (an implicit `latest` is not a pin).
  *
- *  Browser-safe and transport-neutral: this is the *grammar* half of an
- *  upgrade, shared by the kernel transports (whose `refVersion` / `withVersion`
- *  delegate here) and the editor, which cannot use a transport at all — the
- *  *network* half (enumerating versions) is scheme-specific and stays behind
- *  `Transport.listVersions` on Node and the hub's `/module/versions` in the
- *  browser. */
+ *  Browser-safe: this is the *grammar* half of an upgrade, shared by the kernel
+ *  transports (whose `refVersion` / `withVersion` delegate here) and the editor,
+ *  which cannot use a transport at all — the *network* half (enumerating
+ *  versions) is scheme-specific and stays behind `Transport.listVersions` on
+ *  Node and the hub's `/module/versions` in the browser.
+ *
+ *  It is NOT transport-neutral: `oci://` is the only versionable grammar, named
+ *  literally below. That was equally true when the registry ref was the second
+ *  branch, and a third scheme still means editing this file — the versionable
+ *  set would have to become data the transports contribute before that claim
+ *  could be made honestly. */
 export declare function parseVersionedRef(ref: string): ParsedVersionedRef | null;
 /** `ref` rewritten to name `version`, dropping any integrity fragment (the
  *  caller re-pins the result). Appends the version when the ref carries none —
@@ -28,7 +33,7 @@ export declare function parseVersionedRef(ref: string): ParsedVersionedRef | nul
  *
  *  Throws when the ref's grammar has no version segment at all — a relative
  *  path, a bare `https://` URL. Producing `../lib@0.4.0` for those would write
- *  a ref nothing can resolve, so this fails where the transport-specific
- *  parsers it replaced (`parseOciRef` / `parseModuleRef`) also failed. */
+ *  a ref nothing can resolve, so this fails where the transport-specific parser
+ *  it replaced (`parseOciRef`) also failed. */
 export declare function withRefVersion(ref: string, version: string): string;
 //# sourceMappingURL=versioned-ref.d.ts.map

package/dist/sources/versioned-ref.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"versioned-ref.d.ts","sourceRoot":"","sources":["../../src/sources/versioned-ref.ts"],"names":[],"mappings":"AAIA;uEACuE;AACvE,MAAM,WAAW,kBAAkB;IACjC;;gFAE4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB;kFAC8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;eASe;AACf,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAOxE;AAED;;;;;;;0EAO0E;AAC1E,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAUnE"}
+{"version":3,"file":"versioned-ref.d.ts","sourceRoot":"","sources":["../../src/sources/versioned-ref.ts"],"names":[],"mappings":"AAGA;uEACuE;AACvE,MAAM,WAAW,kBAAkB;IACjC;;kEAE8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB;iEAC6D;IAC7D,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;8BAc8B;AAC9B,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAOxE;AAED;;;;;;;+CAO+C;AAC/C,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CASnE"}

package/dist/sources/versioned-ref.js

@@ -1,16 +1,20 @@
 import { splitIntegrity } from "./integrity.js";
-import { isRegistryRef } from "./module-ref.js";
 import { OCI_SCHEME } from "./oci-ref.js";
 /** Split a versioned module ref. Returns `null` when the ref names no
  *  upgradeable version — a local path, a bare `https://` URL, or an OCI ref
  *  with no explicit reference (an implicit `latest` is not a pin).
  *
- *  Browser-safe and transport-neutral: this is the *grammar* half of an
- *  upgrade, shared by the kernel transports (whose `refVersion` / `withVersion`
- *  delegate here) and the editor, which cannot use a transport at all — the
- *  *network* half (enumerating versions) is scheme-specific and stays behind
- *  `Transport.listVersions` on Node and the hub's `/module/versions` in the
- *  browser. */
+ *  Browser-safe: this is the *grammar* half of an upgrade, shared by the kernel
+ *  transports (whose `refVersion` / `withVersion` delegate here) and the editor,
+ *  which cannot use a transport at all — the *network* half (enumerating
+ *  versions) is scheme-specific and stays behind `Transport.listVersions` on
+ *  Node and the hub's `/module/versions` in the browser.
+ *
+ *  It is NOT transport-neutral: `oci://` is the only versionable grammar, named
+ *  literally below. That was equally true when the registry ref was the second
+ *  branch, and a third scheme still means editing this file — the versionable
+ *  set would have to become data the transports contribute before that claim
+ *  could be made honestly. */
 export function parseVersionedRef(ref) {
     const { base, integrity } = splitIntegrity(ref);
     const at = versionSeparator(base);
@@ -27,34 +31,28 @@ export function parseVersionedRef(ref) {
  *
  *  Throws when the ref's grammar has no version segment at all — a relative
  *  path, a bare `https://` URL. Producing `../lib@0.4.0` for those would write
- *  a ref nothing can resolve, so this fails where the transport-specific
- *  parsers it replaced (`parseOciRef` / `parseModuleRef`) also failed. */
+ *  a ref nothing can resolve, so this fails where the transport-specific parser
+ *  it replaced (`parseOciRef`) also failed. */
 export function withRefVersion(ref, version) {
     const { base } = splitIntegrity(ref);
-    if (refGrammar(base) === null) {
-        throw new Error(`Cannot set a version on '${ref}' — only registry (namespace/name@version) ` +
-            `and oci:// refs carry a version segment.`);
+    if (!isVersionableRef(base)) {
+        throw new Error(`Cannot set a version on '${ref}' — only oci:// refs carry a version segment.`);
     }
     const at = versionSeparator(base);
     return `${at === null ? base : base.slice(0, at)}@${version}`;
 }
-/** Which versionable ref grammar `base` is written in, or `null` when it is
- *  neither — a relative/absolute path, a `file:`/`https://` URL. */
-function refGrammar(base) {
-    if (base.startsWith(OCI_SCHEME)) {
-        // A host alone is not addressable; the repo path is what carries a version.
-        return base.indexOf("/", OCI_SCHEME.length) > OCI_SCHEME.length ? "oci" : null;
-    }
-    // `isRegistryRef` requires the `@`, so a version-less `std/console` is not a
-    // registry ref by this test — matching `parseModuleRef`, which throws on it.
-    return isRegistryRef(base) ? "registry" : null;
+/** True when `base` is written in a grammar that carries a version segment — a
+ *  relative/absolute path and a `file:`/`https://` URL are not. */
+function isVersionableRef(base) {
+    // A host alone is not addressable; the repo path is what carries a version.
+    return base.startsWith(OCI_SCHEME) && base.indexOf("/", OCI_SCHEME.length) > OCI_SCHEME.length;
 }
 /** Index of the `@` that separates the version, or `null` when the ref names
  *  none. Split on the LAST `@` so a digest reference (`repo@sha256:…`) keeps
  *  everything before it as the ref. */
 function versionSeparator(base) {
-    if (refGrammar(base) === null)
+    if (!isVersionableRef(base))
         return null;
     const at = base.lastIndexOf("@");
-    return at > (base.startsWith(OCI_SCHEME) ? OCI_SCHEME.length : 0) ? at : null;
+    return at > OCI_SCHEME.length ? at : null;
 }

package/dist/telo-version.d.ts

@@ -1,3 +1,3 @@
 /** The surface generation this analyzer implements. */
-export declare const TELO_SURFACE_VERSION = "0.83.0";
+export declare const TELO_SURFACE_VERSION = "0.85.0";
 //# sourceMappingURL=telo-version.d.ts.map

package/dist/telo-version.js

@@ -5,4 +5,4 @@
 // its release identity, this is the scale a module's `requires.telo` range is
 // written against, and every kernel in every language reports the same scale.
 /** The surface generation this analyzer implements. */
-export const TELO_SURFACE_VERSION = "0.83.0";
+export const TELO_SURFACE_VERSION = "0.85.0";

package/dist/validate-extends.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-extends.d.ts","sourceRoot":"","sources":["../src/validate-extends.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AA8BzE,wBAAgB,eAAe,CAC7B,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,GACrB,kBAAkB,EAAE,CA4JtB"}
+{"version":3,"file":"validate-extends.d.ts","sourceRoot":"","sources":["../src/validate-extends.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAQnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAiCzE,wBAAgB,eAAe,CAC7B,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,GACrB,kBAAkB,EAAE,CAqMtB"}

package/dist/validate-extends.js

@@ -1,4 +1,4 @@
-import { inheritedCapability } from "./extends-resolution.js";
+import { controllerBearingAncestor, effectiveAuthorSchema, inheritedCapability, isInheritedDelegation, } from "./extends-resolution.js";
 import { DiagnosticSeverity } from "./types.js";
 const SOURCE = "telo-analyzer";
 /** Alias-form pattern for `extends`: "<Alias>.<AbstractName>", two PascalCase segments. */
@@ -19,6 +19,9 @@ const EXTENDS_ALIAS_RE = /^[A-Z][A-Za-z0-9_]*\.[A-Z][A-Za-z0-9_]*$/;
  *  - EXTENDS_UNKNOWN_TARGET: alias resolves to a module, but that module has no
  *    registered definition with the target name.
  *  - EXTENDS_NON_ABSTRACT: target resolves to a Telo.Definition, not a Telo.Abstract.
+ *  - EXTENDS_CLOSED_PARENT_ADDS_FIELD: a child with no `base:` declares a property its
+ *    controller-bearing ancestor's closed schema rejects — the runtime counterpart is a
+ *    create-time failure phrased against the ancestor kind.
  *  - CAPABILITY_SHADOWS_EXTENDS (warning): `capability` names a user-declared abstract
  *    (metadata.module !== "Telo"). Builtin lifecycle capabilities (Telo.Invocable, etc.)
  *    never trigger this — they're lifecycle roles by design.
@@ -140,6 +143,44 @@ export function validateExtends(manifests, registry, aliases) {
                                     data: { resource, filePath, path: "capability" },
                                 });
                             }
+                            // A merge-form child (no `base:`) forwards its WHOLE config to the
+                            // inherited controller as the parent's config, so a field the
+                            // parent's schema closes out is rejected at the parent's own
+                            // create-time validation — phrased against the parent kind, at the
+                            // instance's line, about a resource the author never wrote.
+                            // Reported here instead, at the property that has to change.
+                            if (m.base == null &&
+                                isInheritedDelegation(m, resolveDef)) {
+                                const ancestor = controllerBearingAncestor(m, resolveDef);
+                                const ancestorSchema = ancestor
+                                    ? effectiveAuthorSchema(ancestor, resolveDef)
+                                    : undefined;
+                                if (ancestorSchema?.additionalProperties === false) {
+                                    const inherited = new Set(Object.keys(ancestorSchema.properties ?? {}));
+                                    const ownProps = (m
+                                        .schema?.properties ?? {});
+                                    const ancestorKind = `${ancestor?.metadata.module}.${ancestor?.metadata.name}`;
+                                    for (const prop of Object.keys(ownProps)) {
+                                        if (inherited.has(prop))
+                                            continue;
+                                        diagnostics.push({
+                                            severity: DiagnosticSeverity.Error,
+                                            code: "EXTENDS_CLOSED_PARENT_ADDS_FIELD",
+                                            source: SOURCE,
+                                            message: `${label}: declares '${prop}', but '${ancestorKind}' closes its schema ` +
+                                                `(additionalProperties: false) and a child without 'base:' forwards its whole ` +
+                                                `config as that kind's config — so '${prop}' is rejected when the resource is ` +
+                                                `created. Add a 'base:' mapping, which makes this kind's fields construction ` +
+                                                `inputs and builds the parent's config explicitly.`,
+                                            data: {
+                                                resource,
+                                                filePath,
+                                                path: `schema.properties.${prop}`,
+                                            },
+                                        });
+                                    }
+                                }
+                            }
                         }
                     }
                 }

package/dist/validate-sensitive-slots.d.ts

@@ -0,0 +1,28 @@
+import type { ResourceManifest } from "@telorun/sdk";
+/**
+ * `x-telo-sensitive` where nothing reads it.
+ *
+ * The annotation has exactly one consumer: the kernel resolves it from a
+ * resource's bound CONTRACT — `inputType` / `outputType` — and carries the
+ * marked value as `[redacted]` in trace payloads. Written anywhere else it is an
+ * unknown keyword in an open schema, which is to say it validates, ships, and
+ * does nothing.
+ *
+ * For a security control that is the worst available failure: an author marks a
+ * token, sees no error, and puts it on the debug wire anyway. So a misplacement
+ * is reported rather than ignored — the same posture `X_TELO_REF_UNRESOLVED`
+ * takes toward a reference constraint that resolves to nothing, and for the same
+ * reason: silence reads as protection.
+ *
+ * Scoped by the caller to the entry's own modules, since a dependency's schema
+ * is not the consumer's to fix.
+ */
+export interface SensitiveSlotIssue {
+    code: "SENSITIVE_ANNOTATION_MISPLACED" | "SENSITIVE_ANNOTATION_INVALID";
+    manifest: ResourceManifest;
+    /** Dotted path to the annotated schema node. */
+    path: string;
+    message: string;
+}
+export declare function validateSensitiveSlots(manifest: ResourceManifest): SensitiveSlotIssue[];
+//# sourceMappingURL=validate-sensitive-slots.d.ts.map