@telorun/analyzer 0.71.0 → 0.73.0

package/dist/resolve-throws-union.js

@@ -2,7 +2,9 @@ import { isTaggedSentinel } from "@telorun/templating";
 import { scopeResolverForModule } from "./alias-resolver.js";
 import { resolveScopedName } from "./call-graph.js";
 import { refSentinelTarget } from "./ref-sentinel-target.js";
+import { possibleUses, transfersControl } from "./ref-slot.js";
 import { readStepSlot } from "./step-slot.js";
+import { forEachDrivenSlot } from "./schema-walk.js";
 /** Code a non-`InvokeError` failure surfaces as inside a `catch` block. Mirrors
  *  `PLAIN_ERROR_CODE` in `@telorun/run`'s `toSequenceError`: any invoke can throw
  *  a plain error, which the catch sees as `error.code === "INTERNAL_ERROR"`. */
@@ -179,6 +181,16 @@ export function resolveThrowsUnion(manifest, ctx) {
             ctx.inProgress.delete(name);
     }
 }
+/**
+ * `throws.inherit: true` — the union a composer's own STEP BODIES reach.
+ *
+ * Deliberately steps only, and not every slot the resource drives: `inherit` is
+ * a DECLARATION that a kind's union is the union of what it dispatches, and a
+ * kind that does not make that claim must not have it inferred — a kind holding
+ * a `call` ref it catches internally would silently gain codes it never lets
+ * escape. What a CATCH SCOPE needs is a different question with a different
+ * answer, and it has its own resolver below.
+ */
 function resolveInherited(manifest, definition, ctx, ownerModule) {
     const result = { codes: new Map(), unbounded: false };
     const props = definition.schema?.properties;
@@ -195,6 +207,54 @@ function resolveInherited(manifest, definition, ctx, ownerModule) {
     }
     return result;
 }
+/**
+ * The union a SCOPE-LEVEL `catches:` list can be asked to render — everything
+ * the resource it is written on drives, transitively.
+ *
+ * `x-telo-catches-for: ""` is itself the claim that this is the denominator, so
+ * nothing is inferred from a kind that did not opt in, and no definition has to
+ * declare a `throws:` block to carry a catch scope (the kernel forbids one on a
+ * `Telo.Service` and a `Telo.Mount`, and rightly: what a router renders is not
+ * what a router THROWS).
+ *
+ * Three edges, three answers. A **step body** contributes its own traversal,
+ * subtraction included. A **control-transferring ref** contributes the target's
+ * own declared union — a route handler is a leaf here, and asking what IT drives
+ * would credit this scope with codes the handler catches internally. A
+ * **`throwsThrough` ref** recurses, because the target is another scope on the
+ * same ladder: a server renders what its mounts' routes throw, not what the
+ * mounts themselves declare.
+ */
+export function resolveScopeUnion(manifest, definition, ctx, seen = new Set()) {
+    const result = { codes: new Map(), unbounded: false };
+    if (seen.has(manifest))
+        return result;
+    seen.add(manifest);
+    const ownerModule = manifest.metadata?.module;
+    forEachDrivenSlot(definition.schema, manifest, (driven) => {
+        if (driven.kind === "step") {
+            unionInto(result, collectStepArrayThrows(driven.data, driven.slot.invoke, undefined, ctx, ownerModule));
+            return;
+        }
+        if (driven.slot.throwsThrough) {
+            const target = resolveRefManifest(driven.data, ctx, ownerModule);
+            const targetDef = target
+                ? definitionFor(target.kind, ctx.defs, ctx.aliases, scopeResolverFor(ctx, target.metadata?.module))
+                : undefined;
+            if (target && targetDef)
+                unionInto(result, resolveScopeUnion(target, targetDef, ctx, seen));
+            // A target that cannot be resolved says nothing about what it throws, so
+            // the scope's union is no longer enumerable.
+            else
+                result.unbounded = true;
+            return;
+        }
+        if (!possibleUses(driven.slot).some(transfersControl))
+            return;
+        unionInto(result, resolveRefTargetThrows(driven.data, ctx, ownerModule));
+    });
+    return result;
+}
 function collectStepArrayThrows(steps, invokeField, enclosingTryCodes, ctx, ownerModule) {
     const result = emptyUnion();
     for (const step of steps) {
@@ -289,10 +349,25 @@ function cloneUnion(u) {
     return out;
 }
 function resolveStepInvokeThrows(step, invokeField, enclosingTryCodes, ctx, ownerModule) {
-    const invokeRef = step[invokeField];
-    if (!invokeRef || typeof invokeRef !== "object")
+    return resolveRefTargetThrows(step[invokeField], ctx, ownerModule, () => resolvePassthroughAtCallSite(step, enclosingTryCodes));
+}
+/**
+ * The effective throw union behind a resolved reference value.
+ *
+ * Shared by both ways a resource drives another: a step's `invoke:` and a
+ * reference slot that carries throws. The two used to differ only in where the
+ * ref value was read from, and keeping one copy is what stops a router's
+ * denominator and a sequence's from disagreeing about what a name resolves to.
+ *
+ * `onPassthrough` is the one genuine difference: a passthrough kind's union is a
+ * property of the CALL SITE (`inputs.code`), which only a step has. A reference
+ * slot has no such site, so the union is unbounded there rather than guessed.
+ */
+function resolveRefTargetThrows(refValue, ctx, ownerModule, onPassthrough) {
+    if (!refValue || typeof refValue !== "object" || Array.isArray(refValue))
         return emptyUnion();
-    const invokedKind = invokeRef.kind;
+    const ref = refValue;
+    const invokedKind = ref.kind;
     // A reference that still carries its parse-time sentinel — a library-internal
     // `!ref` inside a manifest forwarded into a consumer's flat set, where Phase
     // 2.5 had nothing to resolve it against. The target is in the declaring
@@ -302,7 +377,7 @@ function resolveStepInvokeThrows(step, invokeField, enclosingTryCodes, ctx, owne
     // its consumer and get the consumer's `catches:` rejected for the code the
     // entry point documents.
     if (!invokedKind) {
-        const sentinel = refSentinelTarget(invokeRef);
+        const sentinel = refSentinelTarget(ref);
         if (!sentinel)
             return emptyUnion();
         const target = findSentinelTarget(ctx, sentinel, ownerModule);
@@ -311,26 +386,19 @@ function resolveStepInvokeThrows(step, invokeField, enclosingTryCodes, ctx, owne
         return { codes: new Map(), unbounded: true };
     }
     // The invoked kind's alias resolves in the OWNER manifest's lexical scope (the
-    // composer that declares the step), so a library's step referencing its own
+    // resource that declares the slot), so a library's step referencing its own
     // import resolves against that library, not the consumer.
     const scopeResolver = scopeResolverFor(ctx, ownerModule);
     const definition = definitionFor(invokedKind, ctx.defs, ctx.aliases, scopeResolver);
     if (!definition)
         return { codes: new Map(), unbounded: true };
     if (definition.throws?.passthrough) {
-        return resolvePassthroughAtCallSite(step, enclosingTryCodes);
+        return onPassthrough ? onPassthrough() : { codes: new Map(), unbounded: true };
     }
     // Named manifest: resolve the full chain (covers transitive inherit).
-    const invokeName = invokeRef.name;
-    if (invokeName) {
-        const scopedInvokedKind = scopeResolver?.resolveKind(invokedKind);
-        const target = findTarget(ctx, invokeName, ownerModule, (m) => m.kind === invokedKind ||
-            ctx.aliases.resolveKind(m.kind) === invokedKind ||
-            m.kind === ctx.aliases.resolveKind(invokedKind) ||
-            (scopedInvokedKind !== undefined && m.kind === scopedInvokedKind));
-        if (target)
-            return resolveThrowsUnion(target, ctx);
-    }
+    const target = resolveRefManifest(ref, ctx, ownerModule);
+    if (target)
+        return resolveThrowsUnion(target, ctx);
     // Fall back to the definition's own explicit codes. Mark unbounded when the
     // definition depends on call-site or transitive resolution we couldn't
     // perform (no specific target manifest to recurse into).
@@ -338,6 +406,33 @@ function resolveStepInvokeThrows(step, invokeField, enclosingTryCodes, ctx, owne
     const unbounded = definition.throws?.inherit === true || definition.throws?.passthrough === true;
     return { codes, unbounded };
 }
+/**
+ * The manifest a resolved reference value names, in either shape it arrives in —
+ * a `{kind, name}` pair, or a `!ref` still carrying its parse-time sentinel.
+ *
+ * Exported because the catch-scope enclosure walk asks the same question about
+ * the same values; resolving a name twice by two rules is how two passes end up
+ * disagreeing about which resource a slot points at.
+ */
+export function resolveRefManifest(refValue, ctx, ownerModule) {
+    if (!refValue || typeof refValue !== "object" || Array.isArray(refValue))
+        return undefined;
+    const ref = refValue;
+    const kind = ref.kind;
+    if (!kind) {
+        const sentinel = refSentinelTarget(ref);
+        return sentinel ? findSentinelTarget(ctx, sentinel, ownerModule) : undefined;
+    }
+    const name = ref.name;
+    if (!name)
+        return undefined;
+    const scopeResolver = scopeResolverFor(ctx, ownerModule);
+    const scopedKind = scopeResolver?.resolveKind(kind);
+    return findTarget(ctx, name, ownerModule, (m) => m.kind === kind ||
+        ctx.aliases.resolveKind(m.kind) === kind ||
+        m.kind === ctx.aliases.resolveKind(kind) ||
+        (scopedKind !== undefined && m.kind === scopedKind));
+}
 /** Resolve a passthrough-style invocable at a specific call site. Recognised forms
  *  (see "passthrough: true" in the plan):
  *  - constant literal (no template) → `{ <literal> }`

package/dist/schema-compat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-compat.d.ts","sourceRoot":"","sources":["../src/schema-compat.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAgB,KAAK,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAG1E,QAAA,MAAM,GAAG,KAA0C,CAAC;AAEpD;;;;;;;mCAOmC;AACnC,wBAAgB,SAAS,IAAI,YAAY,CAAC,OAAO,GAAG,CAAC,CAYpD;AAKD,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAYD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAC5D,mBAAmB,CAIrB;AAuKD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC9E,YAAY,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAa5D,0GAA0G;AAC1G,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,WAAW,EAAE,CAmB/F;AAED;qFACqF;AACrF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAQ7E;AAED;;;;6DAI6D;AAC7D,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,EAAE,MAAM,GACX,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAsBjC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAqB,CAAC;AAE1E;;iEAEiE;AACjE,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAGzF;AAED,8DAA8D;AAC9D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,CA6BnF;AAED,wFAAwF;AACxF,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAkDhG;AAkED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CA+D/E;AAqBD;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,QAAQ,CAAC,EAAE,sBAAsB,GAChC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAErB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,QAAQ,CAAC,EAAE,sBAAsB,GAChC;IAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAS5D;AAED,iDAAiD;AACjD,MAAM,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;AAEtF,gGAAgG;AAChG;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,EAAE,OAAO,EACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,QAAQ,CAAC,EAAE,sBAAsB,GAChC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAgCrB;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAwBlF;AAED;iGACiG;AACjG;;;;;sDAKsD;AACtD,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;iEAQ6D;IAC7D,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,qEAAqE;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;iEAG6D;IAC7D,QAAQ,CAAC,EAAE,sBAAsB,CAAC;CACnC;AAED,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAChC,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAuET"}
+{"version":3,"file":"schema-compat.d.ts","sourceRoot":"","sources":["../src/schema-compat.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAgB,KAAK,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAG1E,QAAA,MAAM,GAAG,KAA0C,CAAC;AAEpD;;;;;;;mCAOmC;AACnC,wBAAgB,SAAS,IAAI,YAAY,CAAC,OAAO,GAAG,CAAC,CAYpD;AAKD,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAYD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAC5D,mBAAmB,CAIrB;AAuKD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC9E,YAAY,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAa5D,0GAA0G;AAC1G,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,WAAW,EAAE,CAmB/F;AAED;qFACqF;AACrF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAQ7E;AAED;;;;6DAI6D;AAC7D,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,EAAE,MAAM,GACX,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAsBjC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAqB,CAAC;AAE1E;;iEAEiE;AACjE,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAGzF;AAED,8DAA8D;AAC9D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,CA6BnF;AAED,wFAAwF;AACxF,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAkDhG;AAkED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CA+D/E;AAqBD;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,QAAQ,CAAC,EAAE,sBAAsB,GAChC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAErB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,QAAQ,CAAC,EAAE,sBAAsB,GAChC;IAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAS5D;AAED,iDAAiD;AACjD,MAAM,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;AAEtF,gGAAgG;AAChG;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,EAAE,OAAO,EACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,QAAQ,CAAC,EAAE,sBAAsB,GAChC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAgCrB;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAwBlF;AAED;iGACiG;AACjG;;;;;sDAKsD;AACtD,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;iEAQ6D;IAC7D,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,qEAAqE;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;iEAG6D;IAC7D,QAAQ,CAAC,EAAE,sBAAsB,CAAC;CACnC;AAED,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAChC,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAmFT"}

package/dist/schema-compat.js

@@ -1,7 +1,7 @@
 import AjvModule from "ajv";
 import addFormats from "ajv-formats";
 import { isRefSentinel, isTaggedSentinel, producedTypeOf, } from "@telorun/templating";
-import { celBaseOfValueType, celTypeOfValueType, readValueTypeSlot, valueBrandBases, valueTypeOf, valueTypePlaceholder, } from "@telorun/sdk";
+import { celBaseOfValueType, celTypeOfValueType, isCompiledValue, readValueTypeSlot, valueBrandBases, valueTypeOf, valueTypePlaceholder, } from "@telorun/sdk";
 import { ManifestRootSchema } from "./manifest-schemas.js";
 import { schemaIssues } from "./schema-error-report.js";
 import { registerTeloKeywords } from "./value-type-keyword.js";
@@ -709,6 +709,18 @@ export function substituteCelFields(data, schema, rootSchema, options = {}) {
         mark();
         return celPlaceholderForSchema(resolved);
     }
+    // The same fact in its third spelling. An expression reaches this walk as a
+    // `${{ … }}` string or a `!cel` sentinel BEFORE `precompileDoc`, and as a
+    // CompiledValue after — so a caller running under `compile: true` (every
+    // `telo run`, unlike `telo check`) handed one to AJV as a plain object, and a
+    // slot typed `boolean` rejected a `when:` the author wrote correctly. The
+    // kernel's `stripCompiledValues` has always substituted here; missing it on
+    // this side made one manifest mean two things depending on which command read
+    // it.
+    if (isCompiledValue(data)) {
+        mark();
+        return celPlaceholderForSchema(resolved);
+    }
     if (Array.isArray(data)) {
         const item = resolveRefIn((resolved.items ?? {}), root, external);
         return data.map((element, i) => substituteCelFields(element, item.schema, item.root, {

package/dist/schema-error-report.d.ts

@@ -42,6 +42,13 @@ export interface SchemaIssue {
     message: string;
     /** Dotted path to the field (e.g. "config.handler"). Empty string means root. */
     path: string;
+    /** The AJV keyword that produced it, so a consumer can key on WHAT failed
+     *  rather than on how the sentence reads. Prose is the renderer's to change;
+     *  a caller matching on it breaks silently when it does, and mis-fires on any
+     *  other issue whose text happens to quote the same name. */
+    keyword?: string;
+    /** For `required`, the property that is missing. */
+    missingProperty?: string;
 }
 export declare function formatSingleError(err: AjvErrorLike): string;
 /**

package/dist/schema-error-report.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-error-report.d.ts","sourceRoot":"","sources":["../src/schema-error-report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;gDACgD;AAChD,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;CACd;AAWD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,YAAY,GAAG,MAAM,CAe3D;AAkGD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,YAAY,EAAE,CAsF5F;AAqHD;;sFAEsF;AACtF,wBAAgB,cAAc,CAAC,GAAG,EAAE,YAAY,GAAG,MAAM,CAaxD;AAED,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,WAAW,EAAE,CAKrF;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAIjF"}
+{"version":3,"file":"schema-error-report.d.ts","sourceRoot":"","sources":["../src/schema-error-report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;gDACgD;AAChD,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb;;;iEAG6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAuCD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,YAAY,GAAG,MAAM,CA6B3D;AAoGD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,YAAY,EAAE,CAsF5F;AAqHD;;sFAEsF;AACtF,wBAAgB,cAAc,CAAC,GAAG,EAAE,YAAY,GAAG,MAAM,CAaxD;AAED,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,WAAW,EAAE,CAUrF;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAIjF"}

package/dist/schema-error-report.js

@@ -32,9 +32,38 @@ const UNION_KEYWORDS = new Set(["anyOf", "oneOf"]);
  *  not of that branch's shape at all — as opposed to being that shape and wrong
  *  further in. These are what make a branch implausible. */
 const SHAPE_KEYWORDS = new Set(["required", "type", "additionalProperties", "enum", "const"]);
+/** Keywords that exist to DISCRIMINATE, so a mismatch is positive evidence that
+ *  the value is not this branch — at any depth, not only at the union node.
+ *
+ *  Depth is otherwise the tiebreak, and it inverts exactly here: a branch that
+ *  agreed on the discriminator and failed one constraint reported at the union
+ *  node loses to every branch that disagreed about the discriminator one level
+ *  in. That is how a `capability: Telo.Service` document declaring a forbidden
+ *  key was reported as `/capability must be equal to constant` — naming neither
+ *  the key at fault nor a branch the value could ever have been. */
+const DISCRIMINATOR_KEYWORDS = new Set(["const", "enum"]);
+/** RFC 6901 escapes: `~1` is a literal `/` in the key, `~0` a literal `~`.
+ *  Decoded wherever a segment is shown or matched, because encoded it is not the
+ *  key the manifest holds — a content map (`application/json`) anchors nowhere
+ *  and reads wrong in the sentence. `~0` is expanded LAST, or `~01` would decode
+ *  to `/` instead of the literal `~1` it encodes. */
+function unescapeSegment(part) {
+    return part.replace(/~1/g, "/").replace(/~0/g, "~");
+}
+/** The whole pointer, segment by segment, for prose that quotes it verbatim. */
+function unescapePointer(pointer) {
+    return pointer
+        .split("/")
+        .map((segment, i) => (i === 0 ? segment : unescapeSegment(segment)))
+        .join("/");
+}
 /* ------------------------------------------------------------------ prose */
 export function formatSingleError(err) {
-    const p = err.instancePath || "/";
+    // Unescaped for the same reason the path is: a reader acting on this sentence
+    // needs the key the manifest holds (`application/json`), not its RFC 6901
+    // encoding. Reporting one form in `path` and the other in `message` made one
+    // diagnostic disagree with itself.
+    const p = unescapePointer(err.instancePath || "") || "/";
     const params = err.params ?? {};
     switch (err.keyword) {
         case "additionalProperties":
@@ -45,6 +74,16 @@ export function formatSingleError(err) {
             return `${p} ${err.message ?? "is invalid"} (${params.allowedValues?.join(" | ")})`;
         case "type":
             return `${p} must be ${params.type}${describeActual(err)}`;
+        // A `false` schema at a property is how a branch forbids a key it otherwise
+        // declares. AJV's own text ("boolean schema is false") describes the schema
+        // rather than the value, and the path is the only part a reader can act on.
+        case "false schema":
+            return `${p} is not allowed here`;
+        // `not:` says a forbidden shape matched, and AJV reports nothing about the
+        // inner schema — so the honest message says where, and no more. A branch
+        // that wants to name the key writes `properties: { <key>: false }` instead.
+        case "not":
+            return `${p} matches a shape that is not allowed here`;
         default:
             return `${p} ${err.message ?? "is invalid"}`;
     }
@@ -109,9 +148,14 @@ function describeAlternatives(errors, unionInstancePath) {
     return phrases.length > 0 ? phrases : ["another shape"];
 }
 /** Is this branch a plausible reading of the value — does it accept the value's
- *  shape at the union node itself, and only disagree further in? */
+ *  shape at the union node itself, and agree with every discriminator it pins? */
 function isPlausible(errors, unionInstancePath) {
-    return !errors.some((e) => (e.instancePath || "") === unionInstancePath && SHAPE_KEYWORDS.has(e.keyword ?? ""));
+    return !errors.some((e) => {
+        const keyword = e.keyword ?? "";
+        if (DISCRIMINATOR_KEYWORDS.has(keyword))
+            return true;
+        return (e.instancePath || "") === unionInstancePath && SHAPE_KEYWORDS.has(keyword);
+    });
 }
 function isUnder(child, parent) {
     return parent === "" ? child !== "" : child.startsWith(parent + "/");
@@ -332,7 +376,7 @@ export function ajvErrorToPath(err) {
         if (/^\d+$/.test(part))
             result += `[${part}]`;
         else
-            result += result ? `.${part}` : part;
+            result += result ? `.${unescapeSegment(part)}` : unescapeSegment(part);
     }
     if (err.keyword === "required" && err.params?.missingProperty) {
         const missing = err.params.missingProperty;
@@ -342,10 +386,15 @@ export function ajvErrorToPath(err) {
 }
 /** Reduced, path-anchored issues — what a diagnostic list is built from. */
 export function schemaIssues(errors) {
-    return reduceSchemaErrors(errors).map((err) => ({
-        message: formatSingleError(err),
-        path: ajvErrorToPath(err),
-    }));
+    return reduceSchemaErrors(errors).map((err) => {
+        const missing = (err.params ?? {}).missingProperty;
+        return {
+            message: formatSingleError(err),
+            path: ajvErrorToPath(err),
+            ...(err.keyword ? { keyword: err.keyword } : {}),
+            ...(typeof missing === "string" ? { missingProperty: missing } : {}),
+        };
+    });
 }
 /** Reduced, rendered as one sentence — what a thrown runtime error carries. */
 export function formatAjvErrors(errors) {

package/dist/schema-keywords.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-keywords.d.ts","sourceRoot":"","sources":["../src/schema-keywords.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,4EAA4E;AAC5E,QAAA,MAAM,gBAAgB,EAAG,kBAA2B,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D;iDACiD;AACjD,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AASrE;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAuJ/D;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAMxC,OAAO,CAAC,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,gBAAgB,CAAC,GACtE,OAAO,WAAW,EACpB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAwJxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,EAAE,MAAM,CAC/C,OAAO,gBAAgB,EACvB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQxB,CAAC"}
+{"version":3,"file":"schema-keywords.d.ts","sourceRoot":"","sources":["../src/schema-keywords.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,4EAA4E;AAC5E,QAAA,MAAM,gBAAgB,EAAG,kBAA2B,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D;iDACiD;AACjD,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AASrE;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAuJ/D;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAMxC,OAAO,CAAC,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,gBAAgB,CAAC,GACtE,OAAO,WAAW,EACpB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA2JxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,EAAE,MAAM,CAC/C,OAAO,gBAAgB,EACvB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQxB,CAAC"}

package/dist/schema-keywords.js

@@ -340,7 +340,9 @@ export const TELO_SCHEMA_ANNOTATIONS = {
     },
     "x-telo-catches-for": {
         title: "Catches for",
-        description: "Names the field whose failures this branch list handles.",
+        description: "Whose failures this catch list renders: a sibling field naming the handler, " +
+            "or the EMPTY string for everything this resource drives — a scope-level list, " +
+            "which owes coverage of nothing itself and answers for every site it encloses.",
         type: "string",
     },
 };

package/dist/schema-walk.d.ts

@@ -1,3 +1,5 @@
+import { type RefSlot } from "./ref-slot.js";
+import { type StepSlot } from "./step-slot.js";
 /** Resolve a local `$ref` (only `#/$defs/<name>` form) against the root schema.
  *  Non-refs and unresolved refs pass through unchanged. */
 export declare function resolveLocalRef(schema: Record<string, any> | undefined, root: Record<string, any>): Record<string, any> | undefined;
@@ -22,4 +24,29 @@ export declare function gatherPropertySchemas(schema: Record<string, any>, root?
  * hardcoded; recursion is driven entirely by the schema annotations.
  */
 export declare function walkStepArray(steps: unknown[], stepItemSchema: Record<string, any> | undefined, rootSchema: Record<string, any>, basePath: string, visit: (step: Record<string, any>, stepPath: string) => void): void;
+/** A slot through which a resource drives another. */
+export type DrivenSlot = {
+    kind: "step";
+    slot: StepSlot;
+    data: unknown[];
+    path: string;
+} | {
+    kind: "ref";
+    slot: RefSlot;
+    data: unknown;
+    path: string;
+};
+/**
+ * Every slot of one resource through which it drives another, schema and data in
+ * tandem.
+ *
+ * One traversal with two consumers — the inherited union here, and the catch
+ * scope enclosure in `validate-throws-coverage.ts` — because both ask the same
+ * structural question and two copies would eventually disagree about where the
+ * walk stops. It terminates on the manifest's own depth, and it stops AT a step
+ * slot (that traversal owns everything below it, `try`/`catch` subtraction
+ * included) and AT a reference slot (a resolved ref is a leaf, `{kind, name}`,
+ * with nothing beneath it to visit).
+ */
+export declare function forEachDrivenSlot(schema: unknown, data: unknown, visit: (slot: DrivenSlot) => void, path?: string): void;
 //# sourceMappingURL=schema-walk.d.ts.map

package/dist/schema-walk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-walk.d.ts","sourceRoot":"","sources":["../src/schema-walk.ts"],"names":[],"mappings":"AAYA;2DAC2D;AAC3D,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACvC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAqBjC;AAID;;;;;;;;iDAQiD;AACjD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACzB,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAsBtC;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,OAAO,EAAE,EAChB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EAC/C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,GAC3D,IAAI,CAiDN"}
+{"version":3,"file":"schema-walk.d.ts","sourceRoot":"","sources":["../src/schema-walk.ts"],"names":[],"mappings":"AAWA,OAAO,EAAe,KAAK,OAAO,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE7D;2DAC2D;AAC3D,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACvC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAqBjC;AAID;;;;;;;;iDAQiD;AACjD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACzB,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAsBtC;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,OAAO,EAAE,EAChB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EAC/C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,GAC3D,IAAI,CAiDN;AACD,sDAAsD;AACtD,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,OAAO,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhE;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,OAAO,EACb,KAAK,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,EACjC,IAAI,SAAK,GACR,IAAI,CA8BN"}

package/dist/schema-walk.js

@@ -9,6 +9,8 @@
  * scope rule is consumed by the IDE, which must not pull the pass in behind it.
  */
 import { MANIFEST_SCHEMA_URI, ManifestRootSchema } from "./manifest-schemas.js";
+import { readRefSlot } from "./ref-slot.js";
+import { readStepSlot } from "./step-slot.js";
 /** Resolve a local `$ref` (only `#/$defs/<name>` form) against the root schema.
  *  Non-refs and unresolved refs pass through unchanged. */
 export function resolveLocalRef(schema, root) {
@@ -124,3 +126,45 @@ export function walkStepArray(steps, stepItemSchema, rootSchema, basePath, visit
         }
     });
 }
+/**
+ * Every slot of one resource through which it drives another, schema and data in
+ * tandem.
+ *
+ * One traversal with two consumers — the inherited union here, and the catch
+ * scope enclosure in `validate-throws-coverage.ts` — because both ask the same
+ * structural question and two copies would eventually disagree about where the
+ * walk stops. It terminates on the manifest's own depth, and it stops AT a step
+ * slot (that traversal owns everything below it, `try`/`catch` subtraction
+ * included) and AT a reference slot (a resolved ref is a leaf, `{kind, name}`,
+ * with nothing beneath it to visit).
+ */
+export function forEachDrivenSlot(schema, data, visit, path = "") {
+    if (!schema || typeof schema !== "object" || data === undefined || data === null)
+        return;
+    const node = schema;
+    const stepSlot = readStepSlot(node);
+    if (stepSlot) {
+        if (Array.isArray(data))
+            visit({ kind: "step", slot: stepSlot, data, path });
+        return;
+    }
+    const refSlot = readRefSlot(node);
+    if (refSlot) {
+        visit({ kind: "ref", slot: refSlot, data, path });
+        return;
+    }
+    const props = node.properties;
+    if (props && typeof data === "object" && !Array.isArray(data)) {
+        const obj = data;
+        for (const [key, propSchema] of Object.entries(props)) {
+            if (obj[key] === undefined)
+                continue;
+            forEachDrivenSlot(propSchema, obj[key], visit, path ? `${path}.${key}` : key);
+        }
+    }
+    if (node.items && Array.isArray(data)) {
+        for (const [i, item] of data.entries()) {
+            forEachDrivenSlot(node.items, item, visit, `${path}[${i}]`);
+        }
+    }
+}

package/dist/telo-version.d.ts

@@ -1,3 +1,3 @@
 /** The surface generation this analyzer implements. */
-export declare const TELO_SURFACE_VERSION = "0.87.0";
+export declare const TELO_SURFACE_VERSION = "0.89.0";
 //# sourceMappingURL=telo-version.d.ts.map

package/dist/telo-version.js

@@ -5,4 +5,4 @@
 // its release identity, this is the scale a module's `requires.telo` range is
 // written against, and every kernel in every language reports the same scale.
 /** The surface generation this analyzer implements. */
-export const TELO_SURFACE_VERSION = "0.87.0";
+export const TELO_SURFACE_VERSION = "0.89.0";

package/dist/template-body.d.ts

@@ -33,6 +33,16 @@ export interface TemplateBody {
 /** The template bodies a manifest declares — empty for anything that is not a
  *  `Telo.Definition` with a `resources:` array. */
 export declare function templateBodies(m: ResourceManifest, registry: DefinitionRegistry, aliases: AliasResolver | undefined, scopes: ModuleScopes | undefined): TemplateBody[];
+/** What a definition's dispatch slot names: the `resources:` entry a `!ref` at
+ *  `slot` (`invoke` / `provide` / `run` / `mount`) resolves to, with its kind.
+ *  The entry is matched by its LITERAL `metadata.name`; a slot holding anything
+ *  but a `!ref`, or naming no entry, resolves to nothing — `validate-template-body`
+ *  is what reports either. `Self.<entry>` is the explicit self-qualifier. */
+export declare function dispatchTargetOf(definition: Record<string, any>, slot: string): {
+    entry: Record<string, any> | undefined;
+    kind: string;
+    name: string;
+} | undefined;
 /** True when a CEL path lies at or inside a body's own subtree. */
 export declare function pathInBody(path: string, prefix: string): boolean;
 /** The body a CEL path belongs to, or undefined for a path in the definition's

package/dist/template-body.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"template-body.d.ts","sourceRoot":"","sources":["../src/template-body.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,YAAY;IAC3B;qBACiB;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,UAAU,EAAE,kBAAkB,GAAG,SAAS,CAAC;CAC5C;AAED;mDACmD;AACnD,wBAAgB,cAAc,CAC5B,CAAC,EAAE,gBAAgB,EACnB,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,MAAM,EAAE,YAAY,GAAG,SAAS,GAC/B,YAAY,EAAE,CA0BhB;AAED,mEAAmE;AACnE,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAIhE;AAED;;+EAE+E;AAC/E,wBAAgB,WAAW,CAAC,CAAC,SAAS;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,EACtD,MAAM,EAAE,SAAS,CAAC,EAAE,EACpB,IAAI,EAAE,MAAM,GACX,CAAC,GAAG,SAAS,CAEf;AAED;;;;6CAI6C;AAC7C,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQxF"}
+{"version":3,"file":"template-body.d.ts","sourceRoot":"","sources":["../src/template-body.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,YAAY;IAC3B;qBACiB;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,UAAU,EAAE,kBAAkB,GAAG,SAAS,CAAC;CAC5C;AAED;mDACmD;AACnD,wBAAgB,cAAc,CAC5B,CAAC,EAAE,gBAAgB,EACnB,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,MAAM,EAAE,YAAY,GAAG,SAAS,GAC/B,YAAY,EAAE,CA0BhB;AAED;;;;6EAI6E;AAC7E,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,IAAI,EAAE,MAAM,GACX;IAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAcpF;AAED,mEAAmE;AACnE,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAIhE;AAED;;+EAE+E;AAC/E,wBAAgB,WAAW,CAAC,CAAC,SAAS;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,EACtD,MAAM,EAAE,SAAS,CAAC,EAAE,EACpB,IAAI,EAAE,MAAM,GACX,CAAC,GAAG,SAAS,CAEf;AAED;;;;6CAI6C;AAC7C,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQxF"}

package/dist/template-body.js

@@ -1,3 +1,4 @@
+import { isRefSentinel } from "@telorun/templating";
 import { moduleAliasScope } from "./module-alias-scope.js";
 /** The template bodies a manifest declares — empty for anything that is not a
  *  `Telo.Definition` with a `resources:` array. */
@@ -30,6 +31,30 @@ export function templateBodies(m, registry, aliases, scopes) {
     }
     return out;
 }
+/** What a definition's dispatch slot names: the `resources:` entry a `!ref` at
+ *  `slot` (`invoke` / `provide` / `run` / `mount`) resolves to, with its kind.
+ *  The entry is matched by its LITERAL `metadata.name`; a slot holding anything
+ *  but a `!ref`, or naming no entry, resolves to nothing — `validate-template-body`
+ *  is what reports either. `Self.<entry>` is the explicit self-qualifier. */
+export function dispatchTargetOf(definition, slot) {
+    const value = definition[slot];
+    if (!isRefSentinel(value))
+        return undefined;
+    const source = value.source;
+    const name = source.startsWith("Self.") ? source.slice("Self.".length) : source;
+    const bodies = definition.resources;
+    if (!Array.isArray(bodies))
+        return undefined;
+    for (const body of bodies) {
+        if (!body || typeof body !== "object")
+            continue;
+        const entry = body;
+        if (entry.metadata?.name !== name || typeof entry.kind !== "string")
+            continue;
+        return { entry, kind: entry.kind, name };
+    }
+    return undefined;
+}
 /** True when a CEL path lies at or inside a body's own subtree. */
 export function pathInBody(path, prefix) {
     return (path === prefix || path.startsWith(`${prefix}.`) || path.startsWith(`${prefix}[`));

package/dist/types.d.ts

@@ -9,6 +9,18 @@ export declare const DiagnosticSeverity: {
     readonly Hint: 4;
 };
 export type DiagnosticSeverity = (typeof DiagnosticSeverity)[keyof typeof DiagnosticSeverity];
+/** Matches LSP DiagnosticTag values exactly.
+ *  https://microsoft.github.io/language-server-protocol/specifications/lsp/3.17/specification/#diagnosticTag
+ *
+ *  Declared whole rather than trimmed to what Telo emits today, for the reason
+ *  the severity ladder above is: it is someone else's closed vocabulary, and a
+ *  partial copy of one is what drifts. `Unnecessary` (rendered faded) has an
+ *  obvious future consumer in the unused-declaration checks. */
+export declare const DiagnosticTag: {
+    readonly Unnecessary: 1;
+    readonly Deprecated: 2;
+};
+export type DiagnosticTag = (typeof DiagnosticTag)[keyof typeof DiagnosticTag];
 /** Default entry-point filename when a directory is given instead of a file. */
 export declare const DEFAULT_MANIFEST_FILENAME = "telo.yaml";
 export interface Position {
@@ -65,6 +77,11 @@ export interface AnalysisDiagnostic {
     /** e.g. "telo-analyzer" */
     source?: string;
     message: string;
+    /** What KIND of thing this is, orthogonal to how loudly it asks to be dealt
+     *  with. A deprecation is warning-grade *and* a deprecation; severity alone
+     *  can only say the first, which is why an editor renders a deprecated symbol
+     *  struck through rather than merely yellow. */
+    tags?: DiagnosticTag[];
     /** Telo-specific extras such as { resource: { kind, name }, path } */
     data?: unknown;
 }

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D;qHACqH;AACrH,eAAO,MAAM,kBAAkB;;;;;CAKrB,CAAC;AACX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAC;AAE9F,gFAAgF;AAChF,eAAO,MAAM,yBAAyB,cAAc,CAAC;AAErD,MAAM,WAAW,QAAQ;IACvB,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,KAAK;IACpB,KAAK,EAAE,QAAQ,CAAC;IAChB,GAAG,EAAE,QAAQ,CAAC;CACf;AAED;;oDAEoD;AACpD,MAAM,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAE/C;6EAC6E;AAC7E;;;;;;;;;;;;;;kEAckE;AAClE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;kEACkE;AAClE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,aAAa,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,2BAA2B;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;8BAC8B;AAC9B,wBAAgB,aAAa,CAAC,CAAC,EAAE,kBAAkB,GAAG,aAAa,GAAG,SAAS,CAG9E;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAExD;;qEAEiE;IACjE,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEjE;;qEAEiE;IACjE,cAAc,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,WAAW;IAC1B;;;+EAG2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;mEAO+D;IAC/D,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;;;;;;uCAWmC;IACnC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC;6FACyF;IACzF,WAAW,CAAC,EAAE,OAAO,sBAAsB,EAAE,WAAW,CAAC;IACzD;;kDAE8C;IAC9C,UAAU,CAAC,EAAE,SAAS,OAAO,uBAAuB,EAAE,cAAc,EAAE,CAAC;CACxE;AAED,MAAM,WAAW,eAAe;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;oCAKgC;IAChC,eAAe,CAAC,EAAE,eAAe,EAAE,CAAC;IACpC;;;;;;;;;;sDAUkD;IAClD,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;;;;;;;;;;;;;;;;2DAqBuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;+CAK2C;IAC3C,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;;;gEAKgE;AAChE,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,OAAO,qBAAqB,EAAE,aAAa,CAAC;IACtD,WAAW,CAAC,EAAE,OAAO,0BAA0B,EAAE,kBAAkB,CAAC;IACpE;;;;+EAI2E;IAC3E,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,qBAAqB,EAAE,aAAa,CAAC,CAAC;CAC5E"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D;qHACqH;AACrH,eAAO,MAAM,kBAAkB;;;;;CAKrB,CAAC;AACX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAC;AAE9F;;;;;;gEAMgE;AAChE,eAAO,MAAM,aAAa;;;CAGhB,CAAC;AACX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,OAAO,aAAa,CAAC,CAAC;AAE/E,gFAAgF;AAChF,eAAO,MAAM,yBAAyB,cAAc,CAAC;AAErD,MAAM,WAAW,QAAQ;IACvB,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,KAAK;IACpB,KAAK,EAAE,QAAQ,CAAC;IAChB,GAAG,EAAE,QAAQ,CAAC;CACf;AAED;;oDAEoD;AACpD,MAAM,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAE/C;6EAC6E;AAC7E;;;;;;;;;;;;;;kEAckE;AAClE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;kEACkE;AAClE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,aAAa,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,2BAA2B;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB;;;oDAGgD;IAChD,IAAI,CAAC,EAAE,aAAa,EAAE,CAAC;IACvB,sEAAsE;IACtE,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;8BAC8B;AAC9B,wBAAgB,aAAa,CAAC,CAAC,EAAE,kBAAkB,GAAG,aAAa,GAAG,SAAS,CAG9E;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAExD;;qEAEiE;IACjE,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEjE;;qEAEiE;IACjE,cAAc,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,WAAW;IAC1B;;;+EAG2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;mEAO+D;IAC/D,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;;;;;;uCAWmC;IACnC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC;6FACyF;IACzF,WAAW,CAAC,EAAE,OAAO,sBAAsB,EAAE,WAAW,CAAC;IACzD;;kDAE8C;IAC9C,UAAU,CAAC,EAAE,SAAS,OAAO,uBAAuB,EAAE,cAAc,EAAE,CAAC;CACxE;AAED,MAAM,WAAW,eAAe;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;oCAKgC;IAChC,eAAe,CAAC,EAAE,eAAe,EAAE,CAAC;IACpC;;;;;;;;;;sDAUkD;IAClD,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;;;;;;;;;;;;;;;;2DAqBuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;+CAK2C;IAC3C,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;;;gEAKgE;AAChE,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,OAAO,qBAAqB,EAAE,aAAa,CAAC;IACtD,WAAW,CAAC,EAAE,OAAO,0BAA0B,EAAE,kBAAkB,CAAC;IACpE;;;;+EAI2E;IAC3E,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,qBAAqB,EAAE,aAAa,CAAC,CAAC;CAC5E"}

package/dist/types.js

@@ -6,6 +6,17 @@ export const DiagnosticSeverity = {
     Information: 3,
     Hint: 4,
 };
+/** Matches LSP DiagnosticTag values exactly.
+ *  https://microsoft.github.io/language-server-protocol/specifications/lsp/3.17/specification/#diagnosticTag
+ *
+ *  Declared whole rather than trimmed to what Telo emits today, for the reason
+ *  the severity ladder above is: it is someone else's closed vocabulary, and a
+ *  partial copy of one is what drifts. `Unnecessary` (rendered faded) has an
+ *  obvious future consumer in the unused-declaration checks. */
+export const DiagnosticTag = {
+    Unnecessary: 1,
+    Deprecated: 2,
+};
 /** Default entry-point filename when a directory is given instead of a file. */
 export const DEFAULT_MANIFEST_FILENAME = "telo.yaml";
 /** Single reader for a diagnostic's fix, so no consumer re-derives the shape