@telorun/analyzer 0.72.0 → 0.74.0

package/dist/source-entries.js

@@ -0,0 +1,349 @@
+/**
+ * A module's **sources** — the `sources:` block on a `Telo.Library` or
+ * `Telo.Application` doc, saying where every staged file comes from: a pinned
+ * upstream archive, fetched by `telo release stage`.
+ *
+ * ```yaml
+ * sources:
+ *   better-sqlite3:
+ *     version: 12.8.0
+ *     url: https://github.com/WiseLibs/better-sqlite3/releases/download/v{version}/better-sqlite3-v{version}-{upstream}.tar.gz
+ *     archive: tar.gz
+ *     notices: [./notices/better-sqlite3.LICENSE]
+ *     entries:
+ *       ./native/linux-amd64-gnu-node-137/better_sqlite3.node:
+ *         upstream: node-v137-linux-x64
+ *         member: build/Release/better_sqlite3.node
+ *         sha256: 4c9e…
+ *         executable: false
+ *       ./native/linux-amd64-gnu/libvips.so:
+ *         target: libvips.so.42
+ * ```
+ *
+ * Keyed by the module-relative path an entry produces, because the manifest
+ * already names every staged file — a `native:` entry's path or a
+ * platform-qualified controller candidate's `path=`.
+ *
+ * The single reader: every rule decidable from the block alone is a problem
+ * here, so `telo check` (`validate-source-entries.ts`), the stager and the
+ * kernels refuse the same blocks. Browser-safe: string work only.
+ */
+import { normalizeNativePath } from "./native-entries.js";
+const SOURCE_NAME_TOKEN = /^[a-z0-9][a-z0-9_.-]*$/;
+const SHA256_HEX = /^[0-9a-f]{64}$/;
+const INPUTS_DIGEST = /^sha256-[A-Za-z0-9_-]{43}$/;
+const SOURCE_KEYS = ["version", "url", "archive", "notices", "entries", "build"];
+const BUILD_KEYS = ["cargo", "inputs"];
+const URL_PLACEHOLDERS = new Set(["version", "upstream"]);
+const FILE_KEYS = ["upstream", "member", "sha256", "executable"];
+const URL_ORIGIN = /^([a-z][a-z0-9+.-]*):\/\/([^/?#]*)/i;
+const LOOPBACK_HOST = /^(localhost|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|\[::1\])$/i;
+/** The archive formats an upstream may be. */
+export const SOURCE_ARCHIVE_FORMATS = ["tar.gz"];
+const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** The URL an entry is fetched from: substitution only. */
+export function resolveSourceUrl(source, upstream) {
+    return source.url.replaceAll("{version}", source.version).replaceAll("{upstream}", upstream);
+}
+/** Resolve a link target against the link's own directory, confined to the module. */
+function resolveLinkTarget(linkPath, target) {
+    const dir = linkPath.includes("/") ? linkPath.slice(0, linkPath.lastIndexOf("/")) : "";
+    if (target.startsWith("/") || target.startsWith("\\"))
+        return undefined;
+    const verdict = normalizeNativePath(dir === "" ? target : `${dir}/${target}`);
+    return "path" in verdict ? verdict.path : undefined;
+}
+/** Why a url — a template, or the URL a fetch ended at after redirects — may not
+ *  be fetched from, or undefined when it may: https, or plain http to a loopback
+ *  host. */
+export function sourceUrlProblem(url) {
+    const origin = URL_ORIGIN.exec(url);
+    if (!origin) {
+        return {
+            code: "SOURCE_INVALID",
+            detail: `url '${url}' is not an absolute URL. Write an https:// URL template.`,
+        };
+    }
+    const scheme = origin[1].toLowerCase();
+    if (scheme === "https")
+        return undefined;
+    const authority = origin[2];
+    const hostPort = authority.slice(authority.lastIndexOf("@") + 1);
+    const host = hostPort.startsWith("[")
+        ? hostPort.slice(0, hostPort.indexOf("]") + 1)
+        : hostPort.split(":")[0];
+    if (scheme === "http" && LOOPBACK_HOST.test(host))
+        return undefined;
+    return {
+        code: "SOURCE_URL_INSECURE",
+        detail: `url '${url}' is fetched over ${scheme}, where the archive could be altered on the way. ` +
+            `Use https; plain http is accepted only for a loopback host (localhost, 127.0.0.0/8, [::1]).`,
+    };
+}
+/** Whether one normalized module-relative path is a directory the other runs through. */
+function runsThrough(path, parent) {
+    return path.startsWith(`${parent}/`);
+}
+/**
+ * Read the `sources:` block off an owner document's JSON projection.
+ *
+ * A source or entry with any problem is left out, never read partially: a
+ * half-read entry would stage a file the author did not declare.
+ *
+ * `ignorePins` reads a file entry's `sha256` / `executable` and a build's
+ * `inputs` as absent — for the one writer of pins, which replaces them whatever
+ * they held.
+ */
+export function readModuleSources(ownerJson, options = {}) {
+    const ignorePins = options.ignorePins === true;
+    const declared = ownerJson?.sources;
+    const sources = [];
+    const problems = [];
+    if (declared === undefined)
+        return { sources, problems };
+    const problem = (code, path, message) => problems.push({ code, path, message });
+    if (!isObject(declared)) {
+        problem("SHAPE", "sources", "sources: expected a map of source name to source.");
+        return { sources, problems };
+    }
+    const producers = new Map();
+    for (const [name, raw] of Object.entries(declared)) {
+        const at = `sources.${name}`;
+        const label = `source '${name}'`;
+        if (!isObject(raw)) {
+            problem("SHAPE", at, `${label}: expected an object.`);
+            continue;
+        }
+        const build = raw.build;
+        if (typeof raw.version !== "string" ||
+            typeof raw.url !== "string" ||
+            !SOURCE_ARCHIVE_FORMATS.includes(raw.archive) ||
+            !Array.isArray(raw.notices) ||
+            raw.notices.length === 0 ||
+            raw.notices.some((notice) => typeof notice !== "string") ||
+            !isObject(raw.entries) ||
+            (build !== undefined &&
+                (!isObject(build) ||
+                    typeof build.cargo !== "string" ||
+                    (!ignorePins && "inputs" in build && typeof build.inputs !== "string") ||
+                    Object.keys(build).some((key) => !BUILD_KEYS.includes(key)))) ||
+            Object.keys(raw).some((key) => !SOURCE_KEYS.includes(key))) {
+            problem("SHAPE", at, `${label}: a source is { version, url, archive (${SOURCE_ARCHIVE_FORMATS.join(" | ")}), ` +
+                `notices (non-empty list), entries, build? { cargo, inputs? } } and nothing else.`);
+            continue;
+        }
+        let valid = true;
+        if (!SOURCE_NAME_TOKEN.test(name)) {
+            problem("SOURCE_INVALID", `${at}`, `${label}: the name is not a canonical token. Use lowercase letters, digits, '.', '-' or ` +
+                `'_', starting with a letter or digit.`);
+            valid = false;
+        }
+        for (const key of ["version", "url"]) {
+            if (raw[key].trim() === "") {
+                problem("SOURCE_INVALID", `${at}.${key}`, `${label}: '${key}' must not be empty.`);
+                valid = false;
+            }
+        }
+        const url = raw.url;
+        for (const match of url.matchAll(/\{([^{}]*)\}/g)) {
+            if (URL_PLACEHOLDERS.has(match[1]))
+                continue;
+            problem("SOURCE_URL_PLACEHOLDER_UNKNOWN", `${at}.url`, `${label}: the url placeholder '{${match[1]}}' is not recognized. A url template may use ` +
+                `only {version} (the source's version) and {upstream} (each entry's upstream).`);
+            valid = false;
+        }
+        const insecure = url.trim() === "" ? undefined : sourceUrlProblem(url);
+        if (insecure) {
+            problem(insecure.code, `${at}.url`, `${label}: ${insecure.detail}`);
+            valid = false;
+        }
+        const notices = [];
+        raw.notices.forEach((notice, index) => {
+            const verdict = normalizeNativePath(notice.trim());
+            if ("path" in verdict) {
+                notices.push(verdict.path);
+                return;
+            }
+            problem("SOURCE_INVALID", `${at}.notices[${index}]`, `${label}: notice ${verdict.detail}`);
+            valid = false;
+        });
+        let readBuild;
+        if (isObject(build)) {
+            const written = build.cargo.trim();
+            const verdict = /^\.?\/?$/.test(written) ? { path: "" } : normalizeNativePath(written);
+            const inputs = ignorePins ? undefined : build.inputs;
+            if (!("path" in verdict)) {
+                problem("SOURCE_INVALID", `${at}.build.cargo`, verdict.kind === "escape"
+                    ? `${label}: build.cargo '${written}' is not a directory inside the module. Name the ` +
+                        `crate relative to the directory holding telo.yaml; code outside the module reaches ` +
+                        `its digest as a path dependency of that crate.`
+                    : `${label}: build.cargo '${written}' does not name one module-relative directory.`);
+                valid = false;
+            }
+            else if (inputs !== undefined && !INPUTS_DIGEST.test(inputs)) {
+                problem("SOURCE_INVALID", `${at}.build.inputs`, `${label}: build.inputs must be a digest of the form sha256-<43 base64url characters> — ` +
+                    `run \`telo release stage --pin\` to write it.`);
+                valid = false;
+            }
+            else {
+                readBuild = { cargo: verdict.path, ...(inputs !== undefined ? { inputs } : {}) };
+            }
+        }
+        const entries = [];
+        const rawEntries = raw.entries;
+        const entryPaths = new Map();
+        const links = [];
+        // Paths first, from every key, so a link to an entry with an unrelated
+        // problem is not also reported as unresolved.
+        const pathOfKey = new Map();
+        for (const key of Object.keys(rawEntries)) {
+            const entryAt = `${at}.entries.${key}`;
+            const verdict = normalizeNativePath(key.trim());
+            if (!("path" in verdict)) {
+                problem("SOURCE_ENTRY_INVALID", entryAt, `${label} entry '${key}': ${verdict.detail}`);
+                valid = false;
+                continue;
+            }
+            if (entryPaths.has(verdict.path)) {
+                problem("SOURCE_ENTRY_DUPLICATE", entryAt, `${label} entry '${key}': path '${verdict.path}' is also produced by entry ` +
+                    `'${entryPaths.get(verdict.path)}'.`);
+                valid = false;
+                continue;
+            }
+            entryPaths.set(verdict.path, key);
+            pathOfKey.set(key, verdict.path);
+        }
+        for (const [key, value] of Object.entries(rawEntries)) {
+            const entryAt = `${at}.entries.${key}`;
+            const entryLabel = `${label} entry '${key}'`;
+            const path = pathOfKey.get(key);
+            if (path === undefined)
+                continue;
+            if (!isObject(value)) {
+                problem("SHAPE", entryAt, `${entryLabel}: expected an object.`);
+                valid = false;
+                continue;
+            }
+            const fileKeys = FILE_KEYS.filter((k) => k in value);
+            const isLink = "target" in value;
+            if (isLink && fileKeys.length > 0) {
+                problem("SOURCE_ENTRY_INVALID", entryAt, `${entryLabel}: an entry is either a link (target) or a file (upstream, member, ` +
+                    `sha256, executable) — remove ${fileKeys.map((k) => `'${k}'`).join(", ")} or 'target'.`);
+                valid = false;
+                continue;
+            }
+            const strings = isLink ? ["target"] : ["upstream", "member"];
+            if (strings.some((k) => typeof value[k] !== "string") ||
+                (!ignorePins && "sha256" in value && typeof value.sha256 !== "string") ||
+                (!ignorePins && "executable" in value && typeof value.executable !== "boolean")) {
+                problem("SHAPE", entryAt, `${entryLabel}: expected a file or a link entry.`);
+                valid = false;
+                continue;
+            }
+            const blank = strings.filter((k) => value[k].trim() === "");
+            if (blank.length > 0) {
+                for (const k of blank) {
+                    problem("SOURCE_ENTRY_INVALID", `${entryAt}.${k}`, `${entryLabel}: '${k}' must not be empty.`);
+                }
+                valid = false;
+                continue;
+            }
+            if (isLink) {
+                links.push({ key, path, target: value.target });
+                continue;
+            }
+            const sha256 = ignorePins ? undefined : value.sha256;
+            const executable = ignorePins ? undefined : value.executable;
+            if (sha256 !== undefined && !SHA256_HEX.test(sha256)) {
+                problem("SOURCE_ENTRY_INVALID", `${entryAt}.sha256`, `${entryLabel}: sha256 must be 64 lowercase hex characters — run ` +
+                    `\`telo release stage --pin\` to write it.`);
+                valid = false;
+                continue;
+            }
+            if ((sha256 === undefined) !== (executable === undefined)) {
+                problem("SOURCE_ENTRY_INVALID", entryAt, `${entryLabel}: a pin is sha256 and executable together — run ` +
+                    `\`telo release stage --pin\` to write both.`);
+                valid = false;
+                continue;
+            }
+            entries.push({
+                kind: "file",
+                key,
+                path,
+                upstream: value.upstream,
+                member: value.member,
+                ...(sha256 !== undefined ? { pin: { sha256, executable: executable } } : {}),
+            });
+        }
+        const linkTargets = new Map();
+        for (const link of links) {
+            const resolved = resolveLinkTarget(link.path, link.target);
+            const targetAt = `${at}.entries.${link.key}.target`;
+            if (resolved === link.path) {
+                problem("SOURCE_LINK_CYCLE", targetAt, `${label} entry '${link.key}': link target '${link.target}' resolves to the link itself.`);
+                valid = false;
+                continue;
+            }
+            if (resolved === undefined || !entryPaths.has(resolved)) {
+                problem("SOURCE_LINK_TARGET_UNRESOLVED", targetAt, `${label} entry '${link.key}': link target '${link.target}' resolves, relative to the ` +
+                    `link's directory, to ${resolved === undefined ? "a path outside the module" : `'${resolved}'`}, ` +
+                    `which is not another entry of this source.`);
+                valid = false;
+                continue;
+            }
+            linkTargets.set(link.path, resolved);
+            entries.push({ kind: "link", key: link.key, path: link.path, target: link.target, resolved });
+        }
+        for (const link of links) {
+            if (!linkTargets.has(link.path))
+                continue;
+            const chain = [link.path];
+            for (let next = linkTargets.get(link.path); next !== undefined; next = linkTargets.get(next)) {
+                if (!chain.includes(next)) {
+                    chain.push(next);
+                    continue;
+                }
+                problem("SOURCE_LINK_CYCLE", `${at}.entries.${link.key}.target`, `${label} entry '${link.key}': the link never reaches a file — it cycles through ` +
+                    `${chain.map((p) => `'${p}'`).join(" → ")} → '${next}'. A link chain must end at a file entry.`);
+                valid = false;
+                break;
+            }
+        }
+        for (const entry of entries) {
+            const other = producers.get(entry.path);
+            if (other !== undefined) {
+                problem("SOURCE_ENTRY_DUPLICATE", `${at}.entries.${entry.key}`, `${label} entry '${entry.key}': path '${entry.path}' is also produced by source ` +
+                    `'${other.source}'. Each staged file has exactly one source.`);
+                valid = false;
+                continue;
+            }
+            for (const [path, producer] of producers) {
+                const relation = runsThrough(entry.path, path)
+                    ? `runs through '${path}' as a directory`
+                    : runsThrough(path, entry.path)
+                        ? `is a directory that '${path}' runs through`
+                        : undefined;
+                if (relation === undefined)
+                    continue;
+                problem("SOURCE_ENTRY_NESTED", `${at}.entries.${entry.key}`, `${label} entry '${entry.key}': path '${entry.path}' ${relation}, and source ` +
+                    `'${producer.source}' entry '${producer.key}' produces '${path}'. A staged path cannot ` +
+                    `be both a file and a directory — give each entry its own path.`);
+                valid = false;
+                break;
+            }
+            producers.set(entry.path, { source: name, key: entry.key });
+        }
+        if (!valid)
+            continue;
+        sources.push({
+            name,
+            version: raw.version,
+            url,
+            archive: raw.archive,
+            notices,
+            entries,
+            ...(readBuild !== undefined ? { build: readBuild } : {}),
+        });
+    }
+    return { sources, problems };
+}

package/dist/step-bodies.d.ts

@@ -0,0 +1,24 @@
+/**
+ * A declaration's step bodies, found through its kind's step-body slots — the
+ * ONLY way a value is read as a step, never its shape. Shared by inline
+ * extraction and the scope-reach check, which must agree about where a step's
+ * dispatch target is.
+ *
+ * Browser-safe.
+ */
+/** One step body of one declaration. */
+export interface StepBody {
+    /** The field holding it (`steps`). */
+    field: string;
+    /** The field on each step naming what it dispatches (`invoke`). */
+    invokeField: string;
+    steps: unknown[];
+    /** The step item schema, local `$ref` resolved, which says how steps nest. */
+    itemSchema: Record<string, any> | undefined;
+}
+/** Every step body `declaration` holds, per its kind's author-facing `schema`. */
+export declare function stepBodiesOf(declaration: Record<string, unknown>, schema: Record<string, any>): StepBody[];
+/** Visit every step of a body at every nesting depth, with its concrete path
+ *  (`steps[1].then[0]`). */
+export declare function forEachStep(body: StepBody, schema: Record<string, any>, visit: (step: Record<string, any>, stepPath: string) => void): void;
+//# sourceMappingURL=step-bodies.d.ts.map

package/dist/step-bodies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-bodies.d.ts","sourceRoot":"","sources":["../src/step-bodies.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AAEH,wCAAwC;AACxC,MAAM,WAAW,QAAQ;IACvB,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;CAC7C;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAC1B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC1B,QAAQ,EAAE,CAiBZ;AAED;4BAC4B;AAC5B,wBAAgB,WAAW,CACzB,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,GAC3D,IAAI,CAEN"}

package/dist/step-bodies.js

@@ -0,0 +1,28 @@
+import { gatherPropertySchemas, resolveLocalRef, walkStepArray } from "./schema-walk.js";
+import { readStepSlot } from "./step-slot.js";
+/** Every step body `declaration` holds, per its kind's author-facing `schema`. */
+export function stepBodiesOf(declaration, schema) {
+    const out = [];
+    const seen = new Set();
+    for (const [field, fieldSchema] of gatherPropertySchemas(schema)) {
+        const slot = readStepSlot(fieldSchema);
+        if (!slot || seen.has(field))
+            continue;
+        const steps = declaration[field];
+        if (!Array.isArray(steps))
+            continue;
+        seen.add(field);
+        out.push({
+            field,
+            invokeField: slot.invoke,
+            steps,
+            itemSchema: resolveLocalRef(fieldSchema.items, schema),
+        });
+    }
+    return out;
+}
+/** Visit every step of a body at every nesting depth, with its concrete path
+ *  (`steps[1].then[0]`). */
+export function forEachStep(body, schema, visit) {
+    walkStepArray(body.steps, body.itemSchema, schema, body.field, visit);
+}

package/dist/telo-version.d.ts

@@ -1,3 +1,3 @@
 /** The surface generation this analyzer implements. */
-export declare const TELO_SURFACE_VERSION = "0.88.0";
+export declare const TELO_SURFACE_VERSION = "0.90.0";
 //# sourceMappingURL=telo-version.d.ts.map

package/dist/telo-version.js

@@ -5,4 +5,4 @@
 // its release identity, this is the scale a module's `requires.telo` range is
 // written against, and every kernel in every language reports the same scale.
 /** The surface generation this analyzer implements. */
-export const TELO_SURFACE_VERSION = "0.88.0";
+export const TELO_SURFACE_VERSION = "0.90.0";

package/dist/template-body.d.ts

@@ -33,6 +33,16 @@ export interface TemplateBody {
 /** The template bodies a manifest declares — empty for anything that is not a
  *  `Telo.Definition` with a `resources:` array. */
 export declare function templateBodies(m: ResourceManifest, registry: DefinitionRegistry, aliases: AliasResolver | undefined, scopes: ModuleScopes | undefined): TemplateBody[];
+/** What a definition's dispatch slot names: the `resources:` entry a `!ref` at
+ *  `slot` (`invoke` / `provide` / `run` / `mount`) resolves to, with its kind.
+ *  The entry is matched by its LITERAL `metadata.name`; a slot holding anything
+ *  but a `!ref`, or naming no entry, resolves to nothing — `validate-template-body`
+ *  is what reports either. `Self.<entry>` is the explicit self-qualifier. */
+export declare function dispatchTargetOf(definition: Record<string, any>, slot: string): {
+    entry: Record<string, any> | undefined;
+    kind: string;
+    name: string;
+} | undefined;
 /** True when a CEL path lies at or inside a body's own subtree. */
 export declare function pathInBody(path: string, prefix: string): boolean;
 /** The body a CEL path belongs to, or undefined for a path in the definition's

package/dist/template-body.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"template-body.d.ts","sourceRoot":"","sources":["../src/template-body.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,YAAY;IAC3B;qBACiB;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,UAAU,EAAE,kBAAkB,GAAG,SAAS,CAAC;CAC5C;AAED;mDACmD;AACnD,wBAAgB,cAAc,CAC5B,CAAC,EAAE,gBAAgB,EACnB,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,MAAM,EAAE,YAAY,GAAG,SAAS,GAC/B,YAAY,EAAE,CA0BhB;AAED,mEAAmE;AACnE,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAIhE;AAED;;+EAE+E;AAC/E,wBAAgB,WAAW,CAAC,CAAC,SAAS;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,EACtD,MAAM,EAAE,SAAS,CAAC,EAAE,EACpB,IAAI,EAAE,MAAM,GACX,CAAC,GAAG,SAAS,CAEf;AAED;;;;6CAI6C;AAC7C,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQxF"}
+{"version":3,"file":"template-body.d.ts","sourceRoot":"","sources":["../src/template-body.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,YAAY;IAC3B;qBACiB;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,UAAU,EAAE,kBAAkB,GAAG,SAAS,CAAC;CAC5C;AAED;mDACmD;AACnD,wBAAgB,cAAc,CAC5B,CAAC,EAAE,gBAAgB,EACnB,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,MAAM,EAAE,YAAY,GAAG,SAAS,GAC/B,YAAY,EAAE,CA0BhB;AAED;;;;6EAI6E;AAC7E,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,IAAI,EAAE,MAAM,GACX;IAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAcpF;AAED,mEAAmE;AACnE,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAIhE;AAED;;+EAE+E;AAC/E,wBAAgB,WAAW,CAAC,CAAC,SAAS;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,EACtD,MAAM,EAAE,SAAS,CAAC,EAAE,EACpB,IAAI,EAAE,MAAM,GACX,CAAC,GAAG,SAAS,CAEf;AAED;;;;6CAI6C;AAC7C,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQxF"}

package/dist/template-body.js

@@ -1,3 +1,4 @@
+import { isRefSentinel } from "@telorun/templating";
 import { moduleAliasScope } from "./module-alias-scope.js";
 /** The template bodies a manifest declares — empty for anything that is not a
  *  `Telo.Definition` with a `resources:` array. */
@@ -30,6 +31,30 @@ export function templateBodies(m, registry, aliases, scopes) {
     }
     return out;
 }
+/** What a definition's dispatch slot names: the `resources:` entry a `!ref` at
+ *  `slot` (`invoke` / `provide` / `run` / `mount`) resolves to, with its kind.
+ *  The entry is matched by its LITERAL `metadata.name`; a slot holding anything
+ *  but a `!ref`, or naming no entry, resolves to nothing — `validate-template-body`
+ *  is what reports either. `Self.<entry>` is the explicit self-qualifier. */
+export function dispatchTargetOf(definition, slot) {
+    const value = definition[slot];
+    if (!isRefSentinel(value))
+        return undefined;
+    const source = value.source;
+    const name = source.startsWith("Self.") ? source.slice("Self.".length) : source;
+    const bodies = definition.resources;
+    if (!Array.isArray(bodies))
+        return undefined;
+    for (const body of bodies) {
+        if (!body || typeof body !== "object")
+            continue;
+        const entry = body;
+        if (entry.metadata?.name !== name || typeof entry.kind !== "string")
+            continue;
+        return { entry, kind: entry.kind, name };
+    }
+    return undefined;
+}
 /** True when a CEL path lies at or inside a body's own subtree. */
 export function pathInBody(path, prefix) {
     return (path === prefix || path.startsWith(`${prefix}.`) || path.startsWith(`${prefix}[`));

package/dist/validate-cel-context.d.ts

@@ -13,6 +13,11 @@ export interface ContextResolveOpts {
     aliases?: {
         resolveKind(kind: string): string | undefined;
     };
+    /** Per-declaring-module alias tables, so a kind read off a forwarded
+     *  definition resolves in the module that wrote it. */
+    aliasesByModule?: ReadonlyMap<string, {
+        resolveKind(kind: string): string | undefined;
+    }>;
     allManifests?: Record<string, any>[];
 }
 export declare function resolveTypeFieldToSchema(value: unknown, allManifests: Record<string, any>[], ancestry?: ReadonlySet<string>): Record<string, any> | undefined;
@@ -39,18 +44,20 @@ export declare function resolveTypeFieldToSchema(value: unknown, allManifests: R
  *   Example: `properties.self.x-telo-context-from-root: "schema"` reads
  *   `manifestRoot.schema` and uses it as the schema of the `self` CEL variable.
  *
- * - `x-telo-context-from-ref-kind`: reads a kind name from `manifestRoot.<refPath>`,
- *   resolves it via the definition registry, and returns that kind's `<field>` schema
- *   (e.g. `outputType`/`inputType`). Used to type `result` against the dispatch
- *   target's declared output shape.
+ * - `x-telo-context-from-ref-kind`: reads a KIND from `manifestRoot.<refPath>` —
+ *   a field holding a kind name, or a definition's dispatch slot holding a
+ *   `!ref` to a `resources:` entry (whose kind it is) — and returns the
+ *   `<field>` schema (e.g. `outputType`/`inputType`) the entry itself declares,
+ *   else the one the kind's definition declares. Used to type `result` against
+ *   the dispatch target's declared output shape.
  *
  *   Syntax: `<refPath>#<field>` — slashes traverse the manifest tree.
  *
- *   Example: `x-telo-context-from-ref-kind: "provide/kind#outputType"` reads
- *   `manifestRoot.provide.kind` as a kind name, looks up the kind's Telo.Definition,
- *   and returns the `outputType` schema.
+ *   Example: `x-telo-context-from-ref-kind: "provide#outputType"` resolves
+ *   `manifestRoot.provide` (`!ref source`) to the entry named `source`, and
+ *   returns its `outputType` schema, or its kind's.
  *
- *   Accepts either a single string or an array of strings. With an array, paths
+ *   Accepts either a single string or an array of strings. With an array, slots
  *   are tried in order and the first one that resolves to a usable schema wins —
  *   used by `result:` to find its dispatch target under whichever entry-point
  *   field (`provide:` or `invoke:`) the definition declares.
@@ -70,6 +77,14 @@ export declare function resolveContextAnnotations(schema: Record<string, any>, m
  * e.g. exprPath="routes[0].inputs.q", scope="$.routes[*].inputs" → manifest.routes[0]
  */
 export declare function getManifestItem(exprPath: string, scope: string, manifest: Record<string, any>): Record<string, any>;
+/** The kind an `x-telo-context-from-ref-kind` path names: a field holding a
+ *  kind NAME (`targetKind`), or a definition's dispatch slot holding a `!ref`
+ *  to a `resources:` entry, which carries the kind — and, where it narrows
+ *  one, the contract field itself. */
+export declare function kindAtPath(manifestRoot: Record<string, any>, refPath: string): {
+    kind: string;
+    entry?: Record<string, any>;
+} | undefined;
 /**
  * Walk a JSON Schema tree and collect all `x-telo-context` annotations,
  * returning them as `{ scope, schema }` pairs using JSONPath-style scopes —

package/dist/validate-cel-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAatF,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AA2B3E,MAAM,WAAW,kBAAkB;IACjC;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC;;kDAE8C;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;KACxD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AA4CD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CA0EjC;AAyID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAChD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAoLrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAuBrB;AAqBD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,SAAM,GACT,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAC,CAGvD"}
+{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAetF,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AA2B3E,MAAM,WAAW,kBAAkB;IACjC;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC;;kDAE8C;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;KACxD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF;2DACuD;IACvD,eAAe,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE;QAAE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC,CAAC;IACzF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AA4CD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CA0EjC;AAyID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAChD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAiMrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAuBrB;AAqBD;;;sCAGsC;AACtC,wBAAgB,UAAU,CACxB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,OAAO,EAAE,MAAM,GACd;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,GAAG,SAAS,CAa3D;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,SAAM,GACT,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAC,CAGvD"}