@telorun/analyzer 0.69.0 → 0.70.0

package/dist/canonical-json.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Canonical JSON: a rendering under which two structurally equal values produce
+ * the same string — object keys sorted, `undefined`-valued entries dropped.
+ *
+ * Shared rather than duplicated because both readers compare the RESULT for
+ * equality: `contentKey` anchors a module-graph row's identity to its content so
+ * an inserted sibling does not move it, and `declarationSignature` decides
+ * whether a resource has to be rebuilt. Two implementations would eventually
+ * disagree about key order or about `undefined`, and the disagreement surfaces
+ * as a row that silently changes identity, or as a resource that silently fails
+ * to restart.
+ *
+ * Browser-safe: no hashing, no `node:crypto`. Callers that only need equality
+ * compare the strings, which cannot collide; a caller that needs a short key
+ * hashes it itself.
+ */
+export declare function canonicalJson(value: unknown): string;
+//# sourceMappingURL=canonical-json.d.ts.map

package/dist/canonical-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-json.d.ts","sourceRoot":"","sources":["../src/canonical-json.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAOpD"}

package/dist/canonical-json.js

@@ -0,0 +1,26 @@
+/**
+ * Canonical JSON: a rendering under which two structurally equal values produce
+ * the same string — object keys sorted, `undefined`-valued entries dropped.
+ *
+ * Shared rather than duplicated because both readers compare the RESULT for
+ * equality: `contentKey` anchors a module-graph row's identity to its content so
+ * an inserted sibling does not move it, and `declarationSignature` decides
+ * whether a resource has to be rebuilt. Two implementations would eventually
+ * disagree about key order or about `undefined`, and the disagreement surfaces
+ * as a row that silently changes identity, or as a resource that silently fails
+ * to restart.
+ *
+ * Browser-safe: no hashing, no `node:crypto`. Callers that only need equality
+ * compare the strings, which cannot collide; a caller that needs a short key
+ * hashes it itself.
+ */
+export function canonicalJson(value) {
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value) ?? "null";
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(",")}]`;
+    const entries = Object.entries(value)
+        .filter(([, v]) => v !== undefined)
+        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(",")}}`;
+}

package/dist/cel-access-chains.d.ts

@@ -0,0 +1,14 @@
+import type { ResourceManifest } from "@telorun/sdk";
+/** Access chains an expression reads, or none when it does not parse — a syntax
+ *  error is the engine pass's to report, not this one's. */
+export declare function accessChains(source: string): string[][];
+/**
+ * The bare resource names a manifest's expressions read through
+ * `resources.<name>`, deduplicated.
+ *
+ * Read from the DECLARATION: a compile-eval field is expanded before a
+ * controller sees it, so by then `resources.db.dsn` is a literal with nothing
+ * left to say where it came from.
+ */
+export declare function celResourceReads(manifest: ResourceManifest): string[];
+//# sourceMappingURL=cel-access-chains.d.ts.map

package/dist/cel-access-chains.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cel-access-chains.d.ts","sourceRoot":"","sources":["../src/cel-access-chains.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAMrD;4DAC4D;AAC5D,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,CAOvD;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAQrE"}

package/dist/cel-access-chains.js

@@ -0,0 +1,45 @@
+/**
+ * What a manifest's CEL READS, as opposed to what its slots reference.
+ *
+ * A dependency a manifest states without a slot: `!cel "resources.db.dsn"` makes
+ * the reader depend on `db` as surely as a `!ref` would, and no reference walk
+ * can see it. Two consumers ask for it — the module graph draws it as a `data`
+ * edge, and the kernel needs it to know who becomes invalid when a resource is
+ * rebuilt — so the extraction is here rather than in either of them.
+ *
+ * The expensive half is the CEL environment used to parse, which is built once
+ * per process and evaluates nothing.
+ */
+import { extractAccessChains } from "@telorun/templating";
+import { walkCelExpressions } from "@telorun/templating";
+import { buildCelEnvironment } from "./cel-environment.js";
+let parseEnv;
+/** Access chains an expression reads, or none when it does not parse — a syntax
+ *  error is the engine pass's to report, not this one's. */
+export function accessChains(source) {
+    try {
+        parseEnv ??= buildCelEnvironment();
+        return extractAccessChains(parseEnv.parse(source).ast);
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * The bare resource names a manifest's expressions read through
+ * `resources.<name>`, deduplicated.
+ *
+ * Read from the DECLARATION: a compile-eval field is expanded before a
+ * controller sees it, so by then `resources.db.dsn` is a literal with nothing
+ * left to say where it came from.
+ */
+export function celResourceReads(manifest) {
+    const names = new Set();
+    walkCelExpressions(manifest, "", (source) => {
+        for (const chain of accessChains(source)) {
+            if (chain[0] === "resources" && chain.length >= 2 && chain[1])
+                names.add(chain[1]);
+        }
+    });
+    return [...names];
+}

package/dist/index.d.ts

@@ -26,6 +26,9 @@ export { hasIntermediateWildcard, parseRedactionPath, RedactionPathError, } from
 export type { RedactionSegment } from "./redaction-path.js";
 export { buildCallGraph, nodeIdFor, projectToPairs, resolveScopedName, resourceId, } from "./call-graph.js";
 export type { BuildCallGraphOptions, CallGraph, CallGraphEdge, CallGraphNode, ResourceGraphNode, StepGraphNode, } from "./call-graph.js";
+export { celResourceReads } from "./cel-access-chains.js";
+export { declarationSignature, diffManifests } from "./manifest-diff.js";
+export type { DiffEntry, ManifestDiff, ManifestDiffOptions, ResourceChangeKind, } from "./manifest-diff.js";
 export { AMBIENT_CAPABILITIES, buildModuleGraph, contentKey, edgeClassOf, isAmbientCapability, isAmbientHold, isOrderedRow, isUnwired, } from "./module-graph.js";
 export type { BuildModuleGraphOptions, EdgeClass, GraphEdge, GraphKind, GraphNode, GraphPort, GraphRegion, GraphRow, ModuleGraph, ModuleGraphDeps, NodeOwnership, PortSlot, RowKind, } from "./module-graph.js";
 export { buildReferenceFieldMap, isRefEntry, isScopeEntry, satisfiesValueBranch, } from "./reference-field-map.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACjF,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,0BAA0B,EAC1B,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,cAAc,EACd,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,SAAS,GACV,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,iCAAiC,EACjC,wBAAwB,EACxB,iBAAiB,EACjB,iCAAiC,EACjC,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACxF,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACtF,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,YAAY,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EACL,cAAc,EACd,SAAS,EACT,cAAc,EACd,iBAAiB,EACjB,UAAU,GACX,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,qBAAqB,EACrB,SAAS,EACT,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,mBAAmB,EACnB,aAAa,EACb,YAAY,EACZ,SAAS,GACV,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,uBAAuB,EACvB,SAAS,EACT,SAAS,EACT,SAAS,EACT,SAAS,EACT,SAAS,EACT,WAAW,EACX,QAAQ,EACR,WAAW,EACX,eAAe,EACf,aAAa,EACb,QAAQ,EACR,OAAO,GACR,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,sBAAsB,EACtB,UAAU,EACV,YAAY,EACZ,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,iBAAiB,EACjB,aAAa,EACb,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,cAAc,EACd,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACzE,YAAY,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,cAAc,EACd,WAAW,EACX,YAAY,EACZ,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACtF,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,aAAa,EACb,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,YAAY,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EACL,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,YAAY,EACZ,UAAU,GACX,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,EACvB,eAAe,EACf,sBAAsB,GACvB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,WAAW,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,gCAAgC,EAChC,qBAAqB,EACrB,aAAa,EACb,uBAAuB,EACvB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,GACzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,gCAAgC,EAChC,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,6BAA6B,EAC7B,KAAK,QAAQ,EACb,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,8BAA8B,GACpC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,UAAU,EACV,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,WAAW,GACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EACL,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,wBAAwB,EACxB,yBAAyB,EACzB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wBAAwB,EAAE,KAAK,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACvG,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,UAAU,GAChB,MAAM,+BAA+B,CAAC;AACvC,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAChG,YAAY,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,YAAY,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,EACL,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EACL,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACnB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC/E,YAAY,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,WAAW,EACX,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,SAAS,EACT,YAAY,EACZ,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,YAAY,EACV,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,eAAe,EACf,YAAY,EACZ,eAAe,EACf,eAAe,EACf,cAAc,GACf,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAIvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC3E,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAKxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,YAAY,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAGzF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC1F,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC;AACpB,cAAc,uBAAuB,CAAC;AAGtC,cAAc,sBAAsB,CAAC;AAIrC,OAAO,EACL,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AACpC,cAAc,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACjF,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,0BAA0B,EAC1B,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,cAAc,EACd,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,SAAS,GACV,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,iCAAiC,EACjC,wBAAwB,EACxB,iBAAiB,EACjB,iCAAiC,EACjC,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACxF,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACtF,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,YAAY,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EACL,cAAc,EACd,SAAS,EACT,cAAc,EACd,iBAAiB,EACjB,UAAU,GACX,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,qBAAqB,EACrB,SAAS,EACT,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACzE,YAAY,EACV,SAAS,EACT,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,mBAAmB,EACnB,aAAa,EACb,YAAY,EACZ,SAAS,GACV,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,uBAAuB,EACvB,SAAS,EACT,SAAS,EACT,SAAS,EACT,SAAS,EACT,SAAS,EACT,WAAW,EACX,QAAQ,EACR,WAAW,EACX,eAAe,EACf,aAAa,EACb,QAAQ,EACR,OAAO,GACR,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,sBAAsB,EACtB,UAAU,EACV,YAAY,EACZ,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,iBAAiB,EACjB,aAAa,EACb,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,cAAc,EACd,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACzE,YAAY,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,cAAc,EACd,WAAW,EACX,YAAY,EACZ,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACtF,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,aAAa,EACb,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,YAAY,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EACL,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,YAAY,EACZ,UAAU,GACX,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,EACvB,eAAe,EACf,sBAAsB,GACvB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,WAAW,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,gCAAgC,EAChC,qBAAqB,EACrB,aAAa,EACb,uBAAuB,EACvB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,GACzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,gCAAgC,EAChC,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,6BAA6B,EAC7B,KAAK,QAAQ,EACb,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,8BAA8B,GACpC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,UAAU,EACV,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,WAAW,GACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EACL,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,wBAAwB,EACxB,yBAAyB,EACzB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wBAAwB,EAAE,KAAK,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACvG,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,UAAU,GAChB,MAAM,+BAA+B,CAAC;AACvC,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAChG,YAAY,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,YAAY,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,EACL,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EACL,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACnB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC/E,YAAY,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,WAAW,EACX,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,SAAS,EACT,YAAY,EACZ,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,YAAY,EACV,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,eAAe,EACf,YAAY,EACZ,eAAe,EACf,eAAe,EACf,cAAc,GACf,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAIvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC3E,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAKxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,YAAY,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAGzF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC1F,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC;AACpB,cAAc,uBAAuB,CAAC;AAGtC,cAAc,sBAAsB,CAAC;AAIrC,OAAO,EACL,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AACpC,cAAc,oBAAoB,CAAC"}

package/dist/index.js

@@ -13,6 +13,8 @@ export { validateSensitiveSlots } from "./validate-sensitive-slots.js";
 export { defaultBearingPaths, declaredScalarPaths, PERMISSIVE_CONTRACT, resolveContract, resolveContractSchema, sensitivePaths, withLiveValuesSkipped, } from "./invocation-contract.js";
 export { hasIntermediateWildcard, parseRedactionPath, RedactionPathError, } from "./redaction-path.js";
 export { buildCallGraph, nodeIdFor, projectToPairs, resolveScopedName, resourceId, } from "./call-graph.js";
+export { celResourceReads } from "./cel-access-chains.js";
+export { declarationSignature, diffManifests } from "./manifest-diff.js";
 export { AMBIENT_CAPABILITIES, buildModuleGraph, contentKey, edgeClassOf, isAmbientCapability, isAmbientHold, isOrderedRow, isUnwired, } from "./module-graph.js";
 export { buildReferenceFieldMap, isRefEntry, isScopeEntry, satisfiesValueBranch, } from "./reference-field-map.js";
 export { hasDeclaredUse, isRefSlot, isRefUse, possibleUses, readRefSlot, REF_USES, refSlotAnnotation, rewriteRefSlotKinds, transfersControl, } from "./ref-slot.js";

package/dist/manifest-diff.d.ts

@@ -0,0 +1,111 @@
+/**
+ * What changed between two loads of one manifest set.
+ *
+ * The question a reconciling host asks before it touches anything: which
+ * resources survive an edit untouched, which have to be rebuilt, which are new,
+ * and which are gone. It is here rather than in the kernel because it is pure
+ * data in and data out and the editor wants the same answer — to show which
+ * resources a save would restart, in a browser, where no kernel runs.
+ *
+ * **This is the DECLARATION half of the question and only that half.** A field
+ * written `!cel "variables.port"` has the same declaration whatever the
+ * environment says, so a host that resolves configuration outside the manifest
+ * has to supply what moved there (`modulesWithChangedConfig`). Keeping the two
+ * apart is what lets this run in a browser at all.
+ */
+import type { ResourceManifest } from "@telorun/sdk";
+/** How one resource differs between the two sets. `unchanged` is reported as a
+ *  bare id rather than an entry, since there is nothing to say about it. */
+export type ResourceChangeKind = "added" | "removed" | "changed";
+export interface DiffEntry {
+    /** {@link nodeIdFor} — module-scoped, so two libraries each declaring a
+     *  resource named `store` are two entries rather than one. */
+    readonly id: string;
+    readonly change: ResourceChangeKind;
+    /** The declaration as it stood. Absent for an addition. */
+    readonly previous?: ResourceManifest;
+    /** The declaration as it now stands. Absent for a removal. */
+    readonly next?: ResourceManifest;
+}
+export interface ManifestDiff {
+    /** Additions, removals and changes. Order follows the next set, then the
+     *  previous set for removals, so a caller rendering this reads it in
+     *  declaration order rather than in hash order. */
+    readonly entries: readonly DiffEntry[];
+    /** Ids present in both sets with an identical declaration. */
+    readonly unchanged: readonly string[];
+    /** Ids whose current instance is no longer valid: every removal and every
+     *  change. What a reconciling host unwinds, once it has closed this set under
+     *  the resources that HOLD them — which is the call graph's answer, not this
+     *  one's. */
+    readonly stale: readonly string[];
+    /** Declarations that have to be created: every addition and every change.
+     *  Named for the kernel's own `pendingResources`, which is where they go. */
+    readonly pending: readonly ResourceManifest[];
+}
+export interface ManifestDiffOptions {
+    /**
+     * Modules whose resolved configuration moved between the two loads, by
+     * `metadata.module`.
+     *
+     * Every resource of such a module is reported `changed` even where its
+     * declaration is identical, because a declaration is not the whole of what a
+     * resource is built from: `!cel "variables.port"` reads the same and means
+     * something else once the environment behind it moves. Only the host that
+     * resolved that environment can know, so it is an input rather than something
+     * derived here.
+     */
+    readonly modulesWithChangedConfig?: ReadonlySet<string>;
+    /**
+     * Signatures of the previous set, by node id, taken while those manifests
+     * were still declarations.
+     *
+     * A host that INSTALLS manifests does not keep declarations: the kernel
+     * registers the very objects it loaded, and resolving references writes live
+     * instances into them — a boot target's `!ref`, or a slot nested past the
+     * create-time shallow copy. Signing such an object afterwards renders those
+     * slots opaque and reports a change that never happened, which on a module
+     * document means escalating every reconciliation there is.
+     *
+     * An id absent from the map is signed from its manifest, so a caller that
+     * really is holding declarations passes nothing.
+     */
+    readonly previousSignatures?: ReadonlyMap<string, string>;
+}
+/**
+ * A resource's declaration, rendered so that two equal declarations render
+ * identically.
+ *
+ * Three things are normalized away, and each would otherwise report a change
+ * that is not one:
+ *
+ *  - **Loader stamps** (`DERIVED_METADATA_FIELDS`). `metadata.sourceLine` is the
+ *    load-bearing one: inserting a line anywhere in a file shifts it for every
+ *    resource below, so leaving it in would mark a whole file changed on any
+ *    edit and defeat the mechanism entirely.
+ *  - **A compiled expression** renders as its source text. What the author wrote
+ *    is the declaration; what it evaluates to depends on configuration, which
+ *    `modulesWithChangedConfig` carries instead.
+ *  - **Anything that is not plain data** renders as a constant. A host that has
+ *    injected live instances over its reference slots has manifests that are no
+ *    longer declarations, and walking one reaches a controller's object graph,
+ *    which is cyclic. Both sides must be declarations as loaded.
+ *
+ * The result is compared as a string rather than hashed: there is no collision
+ * to reason about, and a missed change here is a resource that silently keeps
+ * running against a declaration it no longer matches.
+ */
+export declare function declarationSignature(manifest: ResourceManifest): string;
+/**
+ * Classify every resource of two loads against each other.
+ *
+ * **Identity is `nodeIdFor`**, which is module-scoped, so a name is compared
+ * only against the same name in the same module. One consequence is worth
+ * stating because it is visible: an INLINE resource's name is synthesized from
+ * its position (`api_routes_0_handler`), so inserting a route above one renames
+ * every inline below it and this reports those as a removal plus an addition.
+ * That costs a restart it did not have to cost; it never misses a change, which
+ * is the direction that matters.
+ */
+export declare function diffManifests(previous: readonly ResourceManifest[], next: readonly ResourceManifest[], options?: ManifestDiffOptions): ManifestDiff;
+//# sourceMappingURL=manifest-diff.d.ts.map

package/dist/manifest-diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-diff.d.ts","sourceRoot":"","sources":["../src/manifest-diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAMrD;4EAC4E;AAC5E,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;AAEjE,MAAM,WAAW,SAAS;IACxB;kEAC8D;IAC9D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IACrC,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC;CAClC;AAED,MAAM,WAAW,YAAY;IAC3B;;uDAEmD;IACnD,QAAQ,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,CAAC;IACvC,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC;;;iBAGa;IACb,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC;iFAC6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,CAAC;CAC/C;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAExD;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3D;AAcD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,CAqCvE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,SAAS,gBAAgB,EAAE,EACrC,IAAI,EAAE,SAAS,gBAAgB,EAAE,EACjC,OAAO,GAAE,mBAAwB,GAChC,YAAY,CA6Cd"}

package/dist/manifest-diff.js

@@ -0,0 +1,130 @@
+import { isCompiledValue } from "@telorun/sdk";
+import { nodeIdFor } from "./call-graph.js";
+import { canonicalJson } from "./canonical-json.js";
+import { DERIVED_METADATA_FIELDS } from "./module-metadata-scope.js";
+/** A value that is not part of the declaration and must not be walked into:
+ *  a live instance a host injected over a reference slot, a function, a class
+ *  instance of any kind. Rendering one as a constant keeps the walk finite and
+ *  acyclic; comparing two sets across the injection boundary is not supported
+ *  and is what {@link declarationSignature} documents against. */
+const OPAQUE = '"\\u0000opaque"';
+const isPlainObject = (value) => {
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+};
+/**
+ * A resource's declaration, rendered so that two equal declarations render
+ * identically.
+ *
+ * Three things are normalized away, and each would otherwise report a change
+ * that is not one:
+ *
+ *  - **Loader stamps** (`DERIVED_METADATA_FIELDS`). `metadata.sourceLine` is the
+ *    load-bearing one: inserting a line anywhere in a file shifts it for every
+ *    resource below, so leaving it in would mark a whole file changed on any
+ *    edit and defeat the mechanism entirely.
+ *  - **A compiled expression** renders as its source text. What the author wrote
+ *    is the declaration; what it evaluates to depends on configuration, which
+ *    `modulesWithChangedConfig` carries instead.
+ *  - **Anything that is not plain data** renders as a constant. A host that has
+ *    injected live instances over its reference slots has manifests that are no
+ *    longer declarations, and walking one reaches a controller's object graph,
+ *    which is cyclic. Both sides must be declarations as loaded.
+ *
+ * The result is compared as a string rather than hashed: there is no collision
+ * to reason about, and a missed change here is a resource that silently keeps
+ * running against a declaration it no longer matches.
+ */
+export function declarationSignature(manifest) {
+    const seen = new WeakSet();
+    const render = (value) => {
+        if (isCompiledValue(value)) {
+            const source = value.source;
+            return { "\u0000cel": typeof source === "string" ? source : null };
+        }
+        if (!value || typeof value !== "object")
+            return value;
+        if (seen.has(value))
+            return "\u0000cycle";
+        if (Array.isArray(value)) {
+            seen.add(value);
+            return value.map(render);
+        }
+        if (!isPlainObject(value))
+            return OPAQUE;
+        seen.add(value);
+        const out = {};
+        for (const [key, entry] of Object.entries(value)) {
+            out[key] = render(entry);
+        }
+        return out;
+    };
+    const authoredMetadata = {};
+    const metadata = manifest.metadata;
+    for (const [key, value] of Object.entries(metadata ?? {})) {
+        if (DERIVED_METADATA_FIELDS.has(key))
+            continue;
+        authoredMetadata[key] = render(value);
+    }
+    const body = {};
+    for (const [key, value] of Object.entries(manifest)) {
+        if (key === "metadata")
+            continue;
+        body[key] = render(value);
+    }
+    return canonicalJson({ ...body, metadata: authoredMetadata });
+}
+/**
+ * Classify every resource of two loads against each other.
+ *
+ * **Identity is `nodeIdFor`**, which is module-scoped, so a name is compared
+ * only against the same name in the same module. One consequence is worth
+ * stating because it is visible: an INLINE resource's name is synthesized from
+ * its position (`api_routes_0_handler`), so inserting a route above one renames
+ * every inline below it and this reports those as a removal plus an addition.
+ * That costs a restart it did not have to cost; it never misses a change, which
+ * is the direction that matters.
+ */
+export function diffManifests(previous, next, options = {}) {
+    const before = new Map();
+    for (const manifest of previous)
+        before.set(nodeIdFor(manifest), manifest);
+    const changedConfig = options.modulesWithChangedConfig;
+    const configMoved = (manifest) => {
+        if (!changedConfig || changedConfig.size === 0)
+            return false;
+        const module = manifest.metadata?.module;
+        return module !== undefined && changedConfig.has(module);
+    };
+    const entries = [];
+    const unchanged = [];
+    const stale = [];
+    const pending = [];
+    const survived = new Set();
+    for (const manifest of next) {
+        const id = nodeIdFor(manifest);
+        const prior = before.get(id);
+        if (!prior) {
+            entries.push({ id, change: "added", next: manifest });
+            pending.push(manifest);
+            continue;
+        }
+        survived.add(id);
+        const priorSignature = options.previousSignatures?.get(id) ?? declarationSignature(prior);
+        const same = !configMoved(manifest) && priorSignature === declarationSignature(manifest);
+        if (same) {
+            unchanged.push(id);
+            continue;
+        }
+        entries.push({ id, change: "changed", previous: prior, next: manifest });
+        stale.push(id);
+        pending.push(manifest);
+    }
+    for (const [id, manifest] of before) {
+        if (survived.has(id))
+            continue;
+        entries.push({ id, change: "removed", previous: manifest });
+        stale.push(id);
+    }
+    return { entries, unchanged, stale, pending };
+}

package/dist/module-graph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module-graph.d.ts","sourceRoot":"","sources":["../src/module-graph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAOzE,OAAO,EAIL,KAAK,SAAS,EAIf,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EAA6B,KAAK,MAAM,EAAE,MAAM,eAAe,CAAC;AAEvE;;qDAEqD;AACrD,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,CAAC;AAE7F;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,CAAC;AAE5D;;;;;;;;;;GAUG;AACH,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;AAE3E;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAEnD;AAED,yEAAyE;AACzE,MAAM,WAAW,QAAQ;IACvB,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;kCAC8B;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,yDAAyD;AACzD,MAAM,WAAW,SAAS;IACxB,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,iEAAiE;IACjE,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,uEAAuE;IACvE,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;qDAEiD;IACjD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,sCAAsC;AACtC,MAAM,WAAW,QAAQ;IACvB,oEAAoE;IACpE,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,OAAO,CAAC;IACd;;mFAE+E;IAC/E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;yDACqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC;IACd,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;yCAEqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;mDAC+C;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;iFAE6E;IAC7E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE;QACT,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,EAAE,CAAC;QACf;;;gFAGwE;QACxE,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB;;;;;;;;;;;;;;;;WAgBG;QACH,YAAY,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,EAAE,CAAC;KACnD,CAAC;IACF;;2EAEuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,qEAAqE;AACrE,MAAM,WAAW,SAAS;IACxB;wDACoD;IACpD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;gEAE4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;;OAaG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iDAAiD;IACjD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,EAAE,aAAa,CAAC;IACzB,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;6CACyC;IACzC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;kDAE8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,IAAI,EAAE,QAAQ,EAAE,CAAC;IACjB;;;;;;;OAOG;IACH,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IAC9C;;4EAEwE;IACxE,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;IACjD,yEAAyE;IACzE,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,iCAAiC;AACjC,MAAM,WAAW,SAAS;IACxB,sDAAsD;IACtD,EAAE,EAAE,MAAM,CAAC;IACX;+EAC2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;kFAE8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,SAAS,CAAC;IACjB,iDAAiD;IACjD,GAAG,EAAE,MAAM,EAAE,CAAC;IACd;2CACuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;8BAC0B;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,4DAA4D;IAC5D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;+EAC2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;IAClC,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;mEAE+D;IAC/D,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9C;;2DAEuD;IACvD,UAAU,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;CACrE;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB,gEAAgE;IAChE,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;+BAE2B;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;sBACkB;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB;iEAC6D;IAC7D,QAAQ,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,GAAG,EAAE,OAAO,CAAC;IACb;;kCAE8B;IAC9B,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,8CAA8C;IAC9C,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,wDAAwD;IACxD,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;IAC5C,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,EAAE,CAAC;IACnC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,EAAE,CAAC;CAClC;AAED;;;;;;;;;GASG;AACH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAItE;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAI1E;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAGnD,CAAC;AAEH,sEAAsE;AACtE,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAE3E;AAUD;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAK7D;AAED;;wCAEwC;AACxC,MAAM,WAAW,eAAe;IAC9B,sEAAsE;IACtE,SAAS,CAAC,QAAQ,EAAE,gBAAgB,GAAG;QACrC,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,OAAO,CAAC;QACjB,IAAI,EAAE,MAAM,EAAE,CAAC;QACf,YAAY,EAAE,MAAM,EAAE,CAAC;KACxB,EAAE,CAAC;IACJ,2EAA2E;IAC3E,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAC;IAC1E;8EAC0E;IAC1E,QAAQ,CAAC,CAAC,QAAQ,EAAE,gBAAgB,GAAG;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,GAAG,SAAS,CAAC;IAC3F;;;mFAG+E;IAC/E,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC5C;AAED,MAAM,WAAW,uBAAuB;IACtC;4DACwD;IACxD,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB;uEACmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AA+CD;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAQjD;AAkJD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,gBAAgB,EAAE,EAC7B,SAAS,EAAE,SAAS,EACpB,IAAI,EAAE,eAAe,EACrB,OAAO,GAAE,uBAA4B,GACpC,WAAW,CAgbb"}
+{"version":3,"file":"module-graph.d.ts","sourceRoot":"","sources":["../src/module-graph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAOzE,OAAO,EAIL,KAAK,SAAS,EAIf,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EAA6B,KAAK,MAAM,EAAE,MAAM,eAAe,CAAC;AAIvE;;qDAEqD;AACrD,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,CAAC;AAE7F;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,CAAC;AAE5D;;;;;;;;;;GAUG;AACH,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;AAE3E;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAEnD;AAED,yEAAyE;AACzE,MAAM,WAAW,QAAQ;IACvB,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;kCAC8B;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,yDAAyD;AACzD,MAAM,WAAW,SAAS;IACxB,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,iEAAiE;IACjE,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,uEAAuE;IACvE,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;qDAEiD;IACjD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,sCAAsC;AACtC,MAAM,WAAW,QAAQ;IACvB,oEAAoE;IACpE,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,OAAO,CAAC;IACd;;mFAE+E;IAC/E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;yDACqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC;IACd,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;yCAEqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;mDAC+C;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;iFAE6E;IAC7E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE;QACT,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,EAAE,CAAC;QACf;;;gFAGwE;QACxE,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB;;;;;;;;;;;;;;;;WAgBG;QACH,YAAY,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,EAAE,CAAC;KACnD,CAAC;IACF;;2EAEuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,qEAAqE;AACrE,MAAM,WAAW,SAAS;IACxB;wDACoD;IACpD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;gEAE4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;;OAaG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iDAAiD;IACjD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,EAAE,aAAa,CAAC;IACzB,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;6CACyC;IACzC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;kDAE8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,IAAI,EAAE,QAAQ,EAAE,CAAC;IACjB;;;;;;;OAOG;IACH,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IAC9C;;4EAEwE;IACxE,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;IACjD,yEAAyE;IACzE,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,iCAAiC;AACjC,MAAM,WAAW,SAAS;IACxB,sDAAsD;IACtD,EAAE,EAAE,MAAM,CAAC;IACX;+EAC2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;kFAE8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,SAAS,CAAC;IACjB,iDAAiD;IACjD,GAAG,EAAE,MAAM,EAAE,CAAC;IACd;2CACuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;8BAC0B;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,4DAA4D;IAC5D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;+EAC2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;IAClC,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;mEAE+D;IAC/D,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9C;;2DAEuD;IACvD,UAAU,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;CACrE;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB,gEAAgE;IAChE,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;+BAE2B;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;sBACkB;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB;iEAC6D;IAC7D,QAAQ,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,GAAG,EAAE,OAAO,CAAC;IACb;;kCAE8B;IAC9B,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,8CAA8C;IAC9C,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,wDAAwD;IACxD,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;IAC5C,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,EAAE,CAAC;IACnC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,EAAE,CAAC;CAClC;AAED;;;;;;;;;GASG;AACH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAItE;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAI1E;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAGnD,CAAC;AAEH,sEAAsE;AACtE,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAE3E;AAUD;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAK7D;AAED;;wCAEwC;AACxC,MAAM,WAAW,eAAe;IAC9B,sEAAsE;IACtE,SAAS,CAAC,QAAQ,EAAE,gBAAgB,GAAG;QACrC,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,OAAO,CAAC;QACjB,IAAI,EAAE,MAAM,EAAE,CAAC;QACf,YAAY,EAAE,MAAM,EAAE,CAAC;KACxB,EAAE,CAAC;IACJ,2EAA2E;IAC3E,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAC;IAC1E;8EAC0E;IAC1E,QAAQ,CAAC,CAAC,QAAQ,EAAE,gBAAgB,GAAG;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,GAAG,SAAS,CAAC;IAC3F;;;mFAG+E;IAC/E,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC5C;AAED,MAAM,WAAW,uBAAuB;IACtC;4DACwD;IACxD,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB;uEACmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AA+CD;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAQjD;AAyID;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,gBAAgB,EAAE,EAC7B,SAAS,EAAE,SAAS,EACpB,IAAI,EAAE,eAAe,EACrB,OAAO,GAAE,uBAA4B,GACpC,WAAW,CAgbb"}

package/dist/module-graph.js

@@ -1,10 +1,12 @@
-import { buildCelEnvironment, extractAccessChains, isRefSentinel, walkCelExpressions, } from "@telorun/templating";
+import { isRefSentinel, walkCelExpressions, } from "@telorun/templating";
 import { nodeIdFor, resolveScopedName, resourceId, } from "./call-graph.js";
 import { propertySchemas, resolveLocalRef } from "./manifest-navigation.js";
 import { isStepSlot } from "./step-slot.js";
 import { isInlineResource, resolveFieldEntries } from "./reference-field-map.js";
 import { findZoneProviders } from "./resolve-zone-containment.js";
 import { possibleUses, readRefSlot } from "./ref-slot.js";
+import { canonicalJson } from "./canonical-json.js";
+import { accessChains } from "./cel-access-chains.js";
 /**
  * Rows that are ordered entries of their array.
  *
@@ -144,16 +146,6 @@ export function contentKey(value) {
     }
     return hash.toString(36);
 }
-function canonicalJson(value) {
-    if (value === null || typeof value !== "object")
-        return JSON.stringify(value) ?? "null";
-    if (Array.isArray(value))
-        return `[${value.map(canonicalJson).join(",")}]`;
-    const entries = Object.entries(value)
-        .filter(([, v]) => v !== undefined)
-        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
-    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(",")}}`;
-}
 /** Mints ids that are unique without being positional: the name where one
  *  exists, a content key where none does, and a `~n` suffix only when two
  *  siblings are genuinely indistinguishable. */
@@ -1350,20 +1342,6 @@ function buildKindPlane(resources, nodes, deps, options) {
     }
     return out;
 }
-/** The CEL environment used to PARSE a chain out of an expression. One per
- *  process: building it is the expensive half, and nothing here evaluates. */
-let parseEnv;
-/** Access chains an expression reads, or none when it does not parse — a syntax
- *  error is the engine pass's to report, not this one's. */
-function accessChains(source) {
-    try {
-        parseEnv ??= buildCelEnvironment();
-        return extractAccessChains(parseEnv.parse(source).ast);
-    }
-    catch {
-        return [];
-    }
-}
 /**
  * Every `resources.<name>…` read in one resource's CEL, as an edge.
  *

package/dist/telo-version.d.ts

@@ -1,3 +1,3 @@
 /** The surface generation this analyzer implements. */
-export declare const TELO_SURFACE_VERSION = "0.85.0";
+export declare const TELO_SURFACE_VERSION = "0.86.0";
 //# sourceMappingURL=telo-version.d.ts.map

package/dist/telo-version.js

@@ -5,4 +5,4 @@
 // its release identity, this is the scale a module's `requires.telo` range is
 // written against, and every kernel in every language reports the same scale.
 /** The surface generation this analyzer implements. */
-export const TELO_SURFACE_VERSION = "0.85.0";
+export const TELO_SURFACE_VERSION = "0.86.0";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.69.0",
+  "version": "0.70.0",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",
@@ -49,7 +49,7 @@
     "@types/node": "^20.0.0",
     "typescript": "^5.0.0",
     "vitest": "^2.1.8",
-    "@telorun/sdk": "0.83.0"
+    "@telorun/sdk": "0.86.0"
   },
   "peerDependencies": {
     "@telorun/sdk": "*"

package/src/canonical-json.ts

@@ -0,0 +1,24 @@
+/**
+ * Canonical JSON: a rendering under which two structurally equal values produce
+ * the same string — object keys sorted, `undefined`-valued entries dropped.
+ *
+ * Shared rather than duplicated because both readers compare the RESULT for
+ * equality: `contentKey` anchors a module-graph row's identity to its content so
+ * an inserted sibling does not move it, and `declarationSignature` decides
+ * whether a resource has to be rebuilt. Two implementations would eventually
+ * disagree about key order or about `undefined`, and the disagreement surfaces
+ * as a row that silently changes identity, or as a resource that silently fails
+ * to restart.
+ *
+ * Browser-safe: no hashing, no `node:crypto`. Callers that only need equality
+ * compare the strings, which cannot collide; a caller that needs a short key
+ * hashes it itself.
+ */
+export function canonicalJson(value: unknown): string {
+  if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  const entries = Object.entries(value as Record<string, unknown>)
+    .filter(([, v]) => v !== undefined)
+    .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+  return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(",")}}`;
+}

package/src/cel-access-chains.ts

@@ -0,0 +1,47 @@
+/**
+ * What a manifest's CEL READS, as opposed to what its slots reference.
+ *
+ * A dependency a manifest states without a slot: `!cel "resources.db.dsn"` makes
+ * the reader depend on `db` as surely as a `!ref` would, and no reference walk
+ * can see it. Two consumers ask for it — the module graph draws it as a `data`
+ * edge, and the kernel needs it to know who becomes invalid when a resource is
+ * rebuilt — so the extraction is here rather than in either of them.
+ *
+ * The expensive half is the CEL environment used to parse, which is built once
+ * per process and evaluates nothing.
+ */
+import { extractAccessChains } from "@telorun/templating";
+import type { ResourceManifest } from "@telorun/sdk";
+import { walkCelExpressions } from "@telorun/templating";
+import { buildCelEnvironment } from "./cel-environment.js";
+
+let parseEnv: ReturnType<typeof buildCelEnvironment> | undefined;
+
+/** Access chains an expression reads, or none when it does not parse — a syntax
+ *  error is the engine pass's to report, not this one's. */
+export function accessChains(source: string): string[][] {
+  try {
+    parseEnv ??= buildCelEnvironment();
+    return extractAccessChains(parseEnv.parse(source).ast);
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * The bare resource names a manifest's expressions read through
+ * `resources.<name>`, deduplicated.
+ *
+ * Read from the DECLARATION: a compile-eval field is expanded before a
+ * controller sees it, so by then `resources.db.dsn` is a literal with nothing
+ * left to say where it came from.
+ */
+export function celResourceReads(manifest: ResourceManifest): string[] {
+  const names = new Set<string>();
+  walkCelExpressions(manifest as Record<string, unknown>, "", (source: string) => {
+    for (const chain of accessChains(source)) {
+      if (chain[0] === "resources" && chain.length >= 2 && chain[1]) names.add(chain[1]);
+    }
+  });
+  return [...names];
+}

package/src/index.ts

@@ -127,6 +127,14 @@ export type {
   ResourceGraphNode,
   StepGraphNode,
 } from "./call-graph.js";
+export { celResourceReads } from "./cel-access-chains.js";
+export { declarationSignature, diffManifests } from "./manifest-diff.js";
+export type {
+  DiffEntry,
+  ManifestDiff,
+  ManifestDiffOptions,
+  ResourceChangeKind,
+} from "./manifest-diff.js";
 export {
   AMBIENT_CAPABILITIES,
   buildModuleGraph,

package/src/manifest-diff.ts

@@ -0,0 +1,219 @@
+/**
+ * What changed between two loads of one manifest set.
+ *
+ * The question a reconciling host asks before it touches anything: which
+ * resources survive an edit untouched, which have to be rebuilt, which are new,
+ * and which are gone. It is here rather than in the kernel because it is pure
+ * data in and data out and the editor wants the same answer — to show which
+ * resources a save would restart, in a browser, where no kernel runs.
+ *
+ * **This is the DECLARATION half of the question and only that half.** A field
+ * written `!cel "variables.port"` has the same declaration whatever the
+ * environment says, so a host that resolves configuration outside the manifest
+ * has to supply what moved there (`modulesWithChangedConfig`). Keeping the two
+ * apart is what lets this run in a browser at all.
+ */
+import type { ResourceManifest } from "@telorun/sdk";
+import { isCompiledValue } from "@telorun/sdk";
+import { nodeIdFor } from "./call-graph.js";
+import { canonicalJson } from "./canonical-json.js";
+import { DERIVED_METADATA_FIELDS } from "./module-metadata-scope.js";
+
+/** How one resource differs between the two sets. `unchanged` is reported as a
+ *  bare id rather than an entry, since there is nothing to say about it. */
+export type ResourceChangeKind = "added" | "removed" | "changed";
+
+export interface DiffEntry {
+  /** {@link nodeIdFor} — module-scoped, so two libraries each declaring a
+   *  resource named `store` are two entries rather than one. */
+  readonly id: string;
+  readonly change: ResourceChangeKind;
+  /** The declaration as it stood. Absent for an addition. */
+  readonly previous?: ResourceManifest;
+  /** The declaration as it now stands. Absent for a removal. */
+  readonly next?: ResourceManifest;
+}
+
+export interface ManifestDiff {
+  /** Additions, removals and changes. Order follows the next set, then the
+   *  previous set for removals, so a caller rendering this reads it in
+   *  declaration order rather than in hash order. */
+  readonly entries: readonly DiffEntry[];
+  /** Ids present in both sets with an identical declaration. */
+  readonly unchanged: readonly string[];
+  /** Ids whose current instance is no longer valid: every removal and every
+   *  change. What a reconciling host unwinds, once it has closed this set under
+   *  the resources that HOLD them — which is the call graph's answer, not this
+   *  one's. */
+  readonly stale: readonly string[];
+  /** Declarations that have to be created: every addition and every change.
+   *  Named for the kernel's own `pendingResources`, which is where they go. */
+  readonly pending: readonly ResourceManifest[];
+}
+
+export interface ManifestDiffOptions {
+  /**
+   * Modules whose resolved configuration moved between the two loads, by
+   * `metadata.module`.
+   *
+   * Every resource of such a module is reported `changed` even where its
+   * declaration is identical, because a declaration is not the whole of what a
+   * resource is built from: `!cel "variables.port"` reads the same and means
+   * something else once the environment behind it moves. Only the host that
+   * resolved that environment can know, so it is an input rather than something
+   * derived here.
+   */
+  readonly modulesWithChangedConfig?: ReadonlySet<string>;
+
+  /**
+   * Signatures of the previous set, by node id, taken while those manifests
+   * were still declarations.
+   *
+   * A host that INSTALLS manifests does not keep declarations: the kernel
+   * registers the very objects it loaded, and resolving references writes live
+   * instances into them — a boot target's `!ref`, or a slot nested past the
+   * create-time shallow copy. Signing such an object afterwards renders those
+   * slots opaque and reports a change that never happened, which on a module
+   * document means escalating every reconciliation there is.
+   *
+   * An id absent from the map is signed from its manifest, so a caller that
+   * really is holding declarations passes nothing.
+   */
+  readonly previousSignatures?: ReadonlyMap<string, string>;
+}
+
+/** A value that is not part of the declaration and must not be walked into:
+ *  a live instance a host injected over a reference slot, a function, a class
+ *  instance of any kind. Rendering one as a constant keeps the walk finite and
+ *  acyclic; comparing two sets across the injection boundary is not supported
+ *  and is what {@link declarationSignature} documents against. */
+const OPAQUE = '"\\u0000opaque"';
+
+const isPlainObject = (value: object): boolean => {
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+};
+
+/**
+ * A resource's declaration, rendered so that two equal declarations render
+ * identically.
+ *
+ * Three things are normalized away, and each would otherwise report a change
+ * that is not one:
+ *
+ *  - **Loader stamps** (`DERIVED_METADATA_FIELDS`). `metadata.sourceLine` is the
+ *    load-bearing one: inserting a line anywhere in a file shifts it for every
+ *    resource below, so leaving it in would mark a whole file changed on any
+ *    edit and defeat the mechanism entirely.
+ *  - **A compiled expression** renders as its source text. What the author wrote
+ *    is the declaration; what it evaluates to depends on configuration, which
+ *    `modulesWithChangedConfig` carries instead.
+ *  - **Anything that is not plain data** renders as a constant. A host that has
+ *    injected live instances over its reference slots has manifests that are no
+ *    longer declarations, and walking one reaches a controller's object graph,
+ *    which is cyclic. Both sides must be declarations as loaded.
+ *
+ * The result is compared as a string rather than hashed: there is no collision
+ * to reason about, and a missed change here is a resource that silently keeps
+ * running against a declaration it no longer matches.
+ */
+export function declarationSignature(manifest: ResourceManifest): string {
+  const seen = new WeakSet<object>();
+
+  const render = (value: unknown): unknown => {
+    if (isCompiledValue(value)) {
+      const source = (value as { source?: unknown }).source;
+      return { "\u0000cel": typeof source === "string" ? source : null };
+    }
+    if (!value || typeof value !== "object") return value;
+    if (seen.has(value)) return "\u0000cycle";
+    if (Array.isArray(value)) {
+      seen.add(value);
+      return value.map(render);
+    }
+    if (!isPlainObject(value)) return OPAQUE;
+    seen.add(value);
+    const out: Record<string, unknown> = {};
+    for (const [key, entry] of Object.entries(value as Record<string, unknown>)) {
+      out[key] = render(entry);
+    }
+    return out;
+  };
+
+  const authoredMetadata: Record<string, unknown> = {};
+  const metadata = manifest.metadata as Record<string, unknown> | undefined;
+  for (const [key, value] of Object.entries(metadata ?? {})) {
+    if (DERIVED_METADATA_FIELDS.has(key)) continue;
+    authoredMetadata[key] = render(value);
+  }
+
+  const body: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(manifest as Record<string, unknown>)) {
+    if (key === "metadata") continue;
+    body[key] = render(value);
+  }
+
+  return canonicalJson({ ...body, metadata: authoredMetadata });
+}
+
+/**
+ * Classify every resource of two loads against each other.
+ *
+ * **Identity is `nodeIdFor`**, which is module-scoped, so a name is compared
+ * only against the same name in the same module. One consequence is worth
+ * stating because it is visible: an INLINE resource's name is synthesized from
+ * its position (`api_routes_0_handler`), so inserting a route above one renames
+ * every inline below it and this reports those as a removal plus an addition.
+ * That costs a restart it did not have to cost; it never misses a change, which
+ * is the direction that matters.
+ */
+export function diffManifests(
+  previous: readonly ResourceManifest[],
+  next: readonly ResourceManifest[],
+  options: ManifestDiffOptions = {},
+): ManifestDiff {
+  const before = new Map<string, ResourceManifest>();
+  for (const manifest of previous) before.set(nodeIdFor(manifest), manifest);
+
+  const changedConfig = options.modulesWithChangedConfig;
+  const configMoved = (manifest: ResourceManifest): boolean => {
+    if (!changedConfig || changedConfig.size === 0) return false;
+    const module = (manifest.metadata as { module?: string } | undefined)?.module;
+    return module !== undefined && changedConfig.has(module);
+  };
+
+  const entries: DiffEntry[] = [];
+  const unchanged: string[] = [];
+  const stale: string[] = [];
+  const pending: ResourceManifest[] = [];
+  const survived = new Set<string>();
+
+  for (const manifest of next) {
+    const id = nodeIdFor(manifest);
+    const prior = before.get(id);
+    if (!prior) {
+      entries.push({ id, change: "added", next: manifest });
+      pending.push(manifest);
+      continue;
+    }
+    survived.add(id);
+    const priorSignature =
+      options.previousSignatures?.get(id) ?? declarationSignature(prior);
+    const same = !configMoved(manifest) && priorSignature === declarationSignature(manifest);
+    if (same) {
+      unchanged.push(id);
+      continue;
+    }
+    entries.push({ id, change: "changed", previous: prior, next: manifest });
+    stale.push(id);
+    pending.push(manifest);
+  }
+
+  for (const [id, manifest] of before) {
+    if (survived.has(id)) continue;
+    entries.push({ id, change: "removed", previous: manifest });
+    stale.push(id);
+  }
+
+  return { entries, unchanged, stale, pending };
+}

package/src/module-graph.ts

@@ -65,6 +65,8 @@ import { isStepSlot } from "./step-slot.js";
 import { isInlineResource, resolveFieldEntries } from "./reference-field-map.js";
 import { findZoneProviders } from "./resolve-zone-containment.js";
 import { possibleUses, readRefSlot, type RefUse } from "./ref-slot.js";
+import { canonicalJson } from "./canonical-json.js";
+import { accessChains } from "./cel-access-chains.js";
 
 /** How a node's declaration reached the module, which is what decides where a
  *  view may draw it — an inline child exists nowhere but its parent's YAML, so
@@ -591,15 +593,6 @@ export function contentKey(value: unknown): string {
   return hash.toString(36);
 }
 
-function canonicalJson(value: unknown): string {
-  if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
-  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
-  const entries = Object.entries(value as Record<string, unknown>)
-    .filter(([, v]) => v !== undefined)
-    .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
-  return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(",")}}`;
-}
-
 /** Mints ids that are unique without being positional: the name where one
  *  exists, a content key where none does, and a `~n` suffix only when two
  *  siblings are genuinely indistinguishable. */
@@ -1940,21 +1933,6 @@ function buildKindPlane(
   return out;
 }
 
-/** The CEL environment used to PARSE a chain out of an expression. One per
- *  process: building it is the expensive half, and nothing here evaluates. */
-let parseEnv: ReturnType<typeof buildCelEnvironment> | undefined;
-
-/** Access chains an expression reads, or none when it does not parse — a syntax
- *  error is the engine pass's to report, not this one's. */
-function accessChains(source: string): string[][] {
-  try {
-    parseEnv ??= buildCelEnvironment();
-    return extractAccessChains(parseEnv.parse(source).ast);
-  } catch {
-    return [];
-  }
-}
-
 /**
  * Every `resources.<name>…` read in one resource's CEL, as an edge.
  *

package/src/telo-version.ts

@@ -6,4 +6,4 @@
 // written against, and every kernel in every language reports the same scale.
 
 /** The surface generation this analyzer implements. */
-export const TELO_SURFACE_VERSION = "0.85.0";
+export const TELO_SURFACE_VERSION = "0.86.0";