@telorun/analyzer 0.70.0 → 0.72.0

package/dist/validate-references.js

@@ -5,6 +5,8 @@ import { navigateJsonPointer, substituteCelFields } from "./schema-compat.js";
 import { REF_VALIDATION_SKIP_KINDS as SYSTEM_KINDS } from "./system-kinds.js";
 import { resolveTypeFieldToSchema } from "./validate-cel-context.js";
 import { DiagnosticSeverity } from "./types.js";
+import { moduleAliasScope } from "./module-alias-scope.js";
+import { isInjectedDeclaration } from "./resource-input.js";
 const SOURCE = "telo-analyzer";
 /**
  * Liskov substitutability at a kind constraint: is `resolved` (a canonical
@@ -16,17 +18,28 @@ const SOURCE = "telo-analyzer";
  *
  * A value satisfies the slot when it transitively extends the target kind, or —
  * for a CONCRETE target — IS that kind; `getByExtends` is the same transitive
- * subtype index for both, and an abstract is satisfied only by an implementer,
- * never by the abstract itself (which is non-instantiable). Accepts a constraint
- * that resolves to nothing, and an abstract with no loaded implementations:
- * partial context, where a rejection would be a guess.
+ * subtype index for both. Accepts a constraint that resolves to nothing, and an
+ * abstract with no loaded implementations: partial context, where a rejection
+ * would be a guess.
+ *
+ * An abstract is satisfied only by an implementer, never by the abstract itself,
+ * because a resource declared `kind: <some abstract>` is refused at `create()`
+ * and reported as `ABSTRACT_KIND_INSTANTIATED` at its declaration — so accepting
+ * it here would leave the reference sites silent about a manifest that cannot
+ * run. `isDeclaration` is the ONE exception and it is not an instance: a
+ * library's `resources:` entry is constrained by kind alone, so its kind-only
+ * stand-in routinely IS an abstract (`connection: {kind: Sql.Connection}`), and
+ * every use of that name inside the library is a reference to it.
  */
-export function kindSatisfies(resolved, targetKind, registry) {
+export function kindSatisfies(resolved, targetKind, registry, 
+/** The referent is a kind-only stand-in for a `resources:` entry rather than a
+ *  resource anything instantiates, so identity satisfies an abstract slot. */
+isDeclaration = false) {
     const canonical = registry.resolveRef(targetKind) ?? targetKind;
     const targetDef = registry.resolve(canonical);
     if (!targetDef)
         return true;
-    if (targetDef.kind !== "Telo.Abstract" && resolved === canonical)
+    if ((targetDef.kind !== "Telo.Abstract" || isDeclaration) && resolved === canonical)
         return true;
     const subtypes = registry.getByExtends(canonical);
     if (subtypes.some((d) => `${d.metadata.module}.${d.metadata.name}` === resolved))
@@ -53,7 +66,9 @@ export function kindSatisfies(resolved, targetKind, registry) {
 /** {@link kindSatisfies} at every kind a slot accepts, rendered as messages.
  *  The acceptance rule is not restated here — only what to say when it fails,
  *  which needs the slot's alternatives and the target's flavour. */
-function checkKind(kind, entry, registry, aliases) {
+function checkKind(kind, entry, registry, aliases, 
+/** See {@link kindSatisfies}: the referent is a `resources:` stand-in. */
+isDeclaration = false) {
     const resolved = aliases.resolveKind(kind) ?? kind;
     // A qualified kind whose prefix names no import in this scope is a bad NAME
     // rather than a bad type — `{kind: NotAnAlias.Script}` where only `Lib` is
@@ -76,7 +91,7 @@ function checkKind(kind, entry, registry, aliases) {
         const targetDef = registry.resolve(targetKind);
         if (!targetDef)
             return [];
-        if (!unknownAlias && kindSatisfies(resolved, targetKind, registry))
+        if (!unknownAlias && kindSatisfies(resolved, targetKind, registry, isDeclaration))
             return [];
         const subtypes = registry.getByExtends(targetKind);
         const subtypeKinds = new Set(subtypes.map((d) => `${d.metadata.module}.${d.metadata.name}`));
@@ -311,7 +326,7 @@ export function validateReferences(resources, context) {
                     });
                     return;
                 }
-                const kindErrors = checkKind(target.kind, entry, registry, aliases);
+                const kindErrors = checkKind(target.kind, entry, registry, aliases, isInjectedDeclaration(target));
                 if (kindErrors.length > 0) {
                     diagnostics.push({
                         severity: DiagnosticSeverity.Error,
@@ -359,7 +374,11 @@ export function validateReferences(resources, context) {
                 return;
             }
             // 2. Kind check
-            const kindErrors = checkKind(refVal.kind, entry, registry, aliases);
+            const objectTarget = typeof refVal.name === "string"
+                ? (visibleScopeManifests.find((m) => m.metadata?.name === refVal.name) ??
+                    byName.get(refVal.name))
+                : undefined;
+            const kindErrors = checkKind(refVal.kind, entry, registry, aliases, isInjectedDeclaration(objectTarget));
             if (kindErrors.length > 0) {
                 diagnostics.push({
                     severity: DiagnosticSeverity.Error,
@@ -448,8 +467,7 @@ export function validateReferences(resources, context) {
             if (!isAbsolute && anchorName.includes(".")) {
                 const resolvedResourceKind = aliases.resolveKind(r.kind) ?? r.kind;
                 const resourceDef = registry.resolve(r.kind) ?? registry.resolve(resolvedResourceKind);
-                const owningModule = resourceDef?.metadata?.module;
-                const ownerScope = (owningModule ? aliasesByModule?.get(owningModule) : undefined) ?? aliases;
+                const ownerScope = moduleAliasScope(resourceDef?.metadata, aliases, aliasesByModule);
                 const targetKind = ownerScope.resolveKind(anchorName);
                 if (!targetKind) {
                     // Names the ALIAS, not the whole kind path: the alias is what an
@@ -491,14 +509,38 @@ export function validateReferences(resources, context) {
                 for (const { value: fieldValue, path: concretePath } of resolveFieldEntries(r, fieldPath)) {
                     if (fieldValue == null)
                         continue;
-                    const issues = registry.validateWithRefs(fieldValue, subSchema);
+                    // CEL leaves become schema-shaped placeholders first, exactly as the
+                    // sibling-ref branch below does and for the same reason: a slot
+                    // anchored at a shared value-shape is overwhelmingly written as
+                    // expressions, so validating it raw reports every one of them as a
+                    // type error and the check fires only on the literal case nobody
+                    // writes. Omitting it here made one annotation mean two different
+                    // things depending on which branch resolved it — a `when:` typed
+                    // `boolean` accepted a `!cel` at a route's inline slot and rejected
+                    // the identical expression at a slot anchored on the carrier that
+                    // declares that very shape.
+                    const substituted = substituteCelFields(fieldValue, subSchema);
+                    // Anchored at the offending node INSIDE the value, not at the slot:
+                    // a `returns:` list is an array of entries, and reporting every one
+                    // of its issues on the `returns:` line puts three diagnostics on one
+                    // line and none on the entry that is wrong.
+                    const issues = registry.validateResourceConfig(substituted, subSchema);
                     for (const issue of issues) {
                         diagnostics.push({
                             severity: DiagnosticSeverity.Error,
                             code: "DEPENDENT_SCHEMA_MISMATCH",
                             source: SOURCE,
-                            message: `${resourceLabel}: '${concretePath}' does not match schema from '${anchorName}${jsonPointer}': ${issue}`,
-                            data: { resource: resourceData, filePath, path: concretePath },
+                            message: `${resourceLabel}: '${concretePath}' does not match schema from '${anchorName}${jsonPointer}': ${issue.message}`,
+                            data: {
+                                resource: resourceData,
+                                filePath,
+                                // An index-first sub-path (`[0].content`) joins with no dot.
+                                path: !issue.path
+                                    ? concretePath
+                                    : issue.path.startsWith("[")
+                                        ? `${concretePath}${issue.path}`
+                                        : `${concretePath}.${issue.path}`,
+                            },
                         });
                     }
                 }

package/dist/validate-resource-inputs.d.ts

@@ -2,34 +2,9 @@ import type { ResourceManifest } from "@telorun/sdk";
 import type { AliasResolver } from "./alias-resolver.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
 import { type AnalysisDiagnostic } from "./types.js";
-/**
- * The strict half of {@link readResourceInputs} — the `validate-ref-slots.ts`
- * split applied to the resource-input boundary, and not optional for the same
- * reason: the two sides fail in OPPOSITE directions. An unreadable DECLARATION
- * leaves the library referencing a name nothing stands behind; an unchecked
- * INJECTION hands a library an instance of a kind it never asked for, which
- * surfaces as a method-missing failure inside someone else's module.
- *
- * Two surfaces, scoped the same way every other declaration check is — to the
- * entry's own modules, since a published dependency's block is not the
- * consumer's to fix:
- *
- *  - **The library's own declaration.** Each entry's alias-qualified `kind:` must
- *    resolve in the DECLARING module's scope (`RESOURCE_INPUT_KIND_UNRESOLVED`).
- *    A constraint that resolves to nothing accepts anything, which is the same
- *    hole `X_TELO_REF_UNRESOLVED` exists to close one level down.
- *  - **The injection site.** Every declared entry must be supplied
- *    (`RESOURCE_INPUT_MISSING` — the same failure as a missing required
- *    variable), nothing beyond them may be (`RESOURCE_INPUT_UNKNOWN`), the value
- *    must name a resource that exists (`RESOURCE_INPUT_UNRESOLVED`), and its
- *    kind must satisfy the declared constraint transitively
- *    (`RESOURCE_INPUT_KIND_MISMATCH`).
- *
- * Browser-safe.
- */
 export declare function validateResourceInputs(manifests: ResourceManifest[], registry: DefinitionRegistry, aliases: AliasResolver, rootModules: Set<string>, 
 /** Kind acceptance, transitively — the `checkKind` rule `validate-references`
  *  applies at an ordinary ref slot, passed in rather than re-derived so the
  *  two cannot disagree about what satisfies a constraint. */
-acceptsKind: (suppliedKind: string, requiredKind: string) => boolean): AnalysisDiagnostic[];
+acceptsKind: (suppliedKind: string, requiredKind: string, suppliedIsDeclaration: boolean) => boolean): AnalysisDiagnostic[];
 //# sourceMappingURL=validate-resource-inputs.d.ts.map

package/dist/validate-resource-inputs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-resource-inputs.d.ts","sourceRoot":"","sources":["../src/validate-resource-inputs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAGnE,OAAO,EAAE,KAAK,kBAAkB,EAAsB,MAAM,YAAY,CAAC;AASzE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,EACtB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC;AACxB;;6DAE6D;AAC7D,WAAW,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,GACnE,kBAAkB,EAAE,CA6LtB"}
+{"version":3,"file":"validate-resource-inputs.d.ts","sourceRoot":"","sources":["../src/validate-resource-inputs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAOnE,OAAO,EAAE,KAAK,kBAAkB,EAAsB,MAAM,YAAY,CAAC;AAqCzE,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,EACtB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC;AACxB;;6DAE6D;AAC7D,WAAW,EAAE,CACX,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,qBAAqB,EAAE,OAAO,KAC3B,OAAO,GACX,kBAAkB,EAAE,CAyMtB"}

package/dist/validate-resource-inputs.js

@@ -1,6 +1,6 @@
 import { isRefSentinel } from "@telorun/templating";
 import { findDynamicLeaf } from "./resource-rule.js";
-import { readResourceInputs, readSuppliedResources } from "./resource-input.js";
+import { isInjectedDeclaration, readResourceInputs, readSuppliedResources, } from "./resource-input.js";
 import { DiagnosticSeverity } from "./types.js";
 const SOURCE = "telo-analyzer";
 /**
@@ -28,6 +28,7 @@ const SOURCE = "telo-analyzer";
  *
  * Browser-safe.
  */
+const declaringModule = (m) => m.metadata?.module;
 export function validateResourceInputs(manifests, registry, aliases, rootModules, 
 /** Kind acceptance, transitively — the `checkKind` rule `validate-references`
  *  applies at an ordinary ref slot, passed in rather than re-derived so the
@@ -186,7 +187,16 @@ acceptsKind) {
             if (typeof suppliedKind !== "string")
                 continue;
             const canonical = aliases.resolveKind(suppliedKind) ?? suppliedKind;
-            if (acceptsKind(canonical, entry))
+            // A library forwarding an input it was itself handed supplies a kind-only
+            // stand-in, whose kind is routinely the abstract the target declares. That
+            // is identity against an abstract, which an ordinary reference is refused
+            // — the referent there would be a resource nothing can instantiate, while
+            // here it is another declaration.
+            const suppliedName = value.name;
+            const supplied = typeof suppliedName === "string"
+                ? manifests.find((c) => c.metadata?.name === suppliedName && isOwn(declaringModule(c)))
+                : undefined;
+            if (acceptsKind(canonical, entry, isInjectedDeclaration(supplied)))
                 continue;
             out.push({
                 severity: DiagnosticSeverity.Error,

package/dist/validate-schema-type-refs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-schema-type-refs.d.ts","sourceRoot":"","sources":["../src/validate-schema-type-refs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAKzE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAC3C,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,GACvB,kBAAkB,EAAE,CAuDtB"}
+{"version":3,"file":"validate-schema-type-refs.d.ts","sourceRoot":"","sources":["../src/validate-schema-type-refs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAMzE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAC3C,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,GACvB,kBAAkB,EAAE,CAuDtB"}

package/dist/validate-schema-type-refs.js

@@ -1,5 +1,6 @@
 import { canonicalTypeSchemaId, parseTeloTypeRef } from "@telorun/sdk";
 import { DiagnosticSeverity } from "./types.js";
+import { moduleAliasScope } from "./module-alias-scope.js";
 const SOURCE = "telo-analyzer";
 const SCHEMA_FIELDS = ["schema", "inputType", "outputType"];
 /**
@@ -28,7 +29,7 @@ export function validateSchemaTypeRefs(manifests, registry, aliases, aliasesByMo
         // validated against their own library when it's analyzed as a root.
         if (ownModule && !rootModules.has(ownModule))
             continue;
-        const resolver = (ownModule ? aliasesByModule.get(ownModule) : undefined) ?? aliases;
+        const resolver = moduleAliasScope(m.metadata, aliases, aliasesByModule);
         const filePath = m.metadata?.source;
         const label = `${m.kind}/${name}`;
         const walk = (value, path) => {

package/dist/validate-throws-coverage.d.ts

@@ -4,5 +4,9 @@ import { type AliasResolver } from "./alias-resolver.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
 import { type AnalysisDiagnostic } from "./types.js";
 /** Entry point — invoked once per analyze() run. */
-export declare function validateThrowsCoverage(manifests: ResourceManifest[], defs: DefinitionRegistry, aliases: AliasResolver, env: Environment, aliasesByModule?: Map<string, AliasResolver>, rootModules?: Set<string>): AnalysisDiagnostic[];
+export declare function validateThrowsCoverage(manifests: ResourceManifest[], defs: DefinitionRegistry, aliases: AliasResolver, env: Environment, aliasesByModule?: Map<string, AliasResolver>, rootModules?: Set<string>, 
+/** Each imported library's full document set, so the walk can follow an
+ *  exported entry point into the siblings it invokes — which a consumer's
+ *  flat set does not carry. */
+moduleManifests?: Map<string, ResourceManifest[]>): AnalysisDiagnostic[];
 //# sourceMappingURL=validate-throws-coverage.d.ts.map

package/dist/validate-throws-coverage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-throws-coverage.d.ts","sourceRoot":"","sources":["../src/validate-throws-coverage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEjE,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAA0B,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAOnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAsfzE,oDAAoD;AACpD,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,WAAW,EAChB,eAAe,GAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAa,EACvD,WAAW,GAAE,GAAG,CAAC,MAAM,CAAa,GACnC,kBAAkB,EAAE,CAkDtB"}
+{"version":3,"file":"validate-throws-coverage.d.ts","sourceRoot":"","sources":["../src/validate-throws-coverage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEjE,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAA0B,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAenE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AA4kBzE,oDAAoD;AACpD,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,WAAW,EAChB,eAAe,GAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAa,EACvD,WAAW,GAAE,GAAG,CAAC,MAAM,CAAa;AACpC;;+BAE+B;AAC/B,eAAe,GAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAa,GAC3D,kBAAkB,EAAE,CAsLtB"}