@telorun/analyzer 0.21.0 → 0.23.0

package/dist/flatten-for-analyzer.js

@@ -1,4 +1,13 @@
 import { isModuleKind } from "./module-kinds.js";
+/** Parse a single dotted export entry: `Alias.Name` → `{name: "Name", alias: "Alias"}`,
+ *  bare `Name` → `{name: "Name"}`. The single grammar for `exports.resources` and
+ *  `exports.kinds`, shared by the kernel's import controller and the analyzer/editor so
+ *  the dotted-name split can't drift. A leading dot (`.Name`) has no alias by design —
+ *  the empty prefix isn't a valid alias. */
+export function parseExportEntry(entry) {
+    const dot = entry.indexOf(".");
+    return dot > 0 ? { name: entry.slice(dot + 1), alias: entry.slice(0, dot) } : { name: entry };
+}
 /** The import-boundary forwarding rule, shared by `flattenForAnalyzer` (the
  *  CLI / kernel loader path) and the telo-editor's workspace projection so the
  *  two cannot drift. Given one module's stamped manifests and whether that
@@ -23,7 +32,15 @@ export function selectModuleManifestsForAnalysis(moduleManifests, isRoot) {
     if (isRoot)
         return moduleManifests;
     const libDoc = moduleManifests.find((m) => isModuleKind(m.kind));
-    const exportedResources = new Set(libDoc?.exports?.resources ?? []);
+    // An `exports.resources` entry is a bare name or a dotted `Alias.Name` (re-export). Only the
+    // export NAME matches a local instance below; re-exports are forwarded by `forwardReExports`.
+    const exportedResources = new Set();
+    for (const entry of libDoc?.exports
+        ?.resources ?? []) {
+        if (typeof entry !== "string")
+            continue;
+        exportedResources.add(parseExportEntry(entry).name);
+    }
     const out = [];
     for (const m of moduleManifests) {
         if (m.kind === "Telo.Definition" || m.kind === "Telo.Abstract" || m.kind === "Telo.Import") {
@@ -81,6 +98,7 @@ export function flattenForAnalyzer(graph) {
             result.push(...selectModuleManifestsForAnalysis(collectModuleManifests(targetModule), false));
         }
     }
+    forwardReExports(graph, result);
     // Stamp resolved import identity on every Telo.Import in the result by
     // reading the edge's pre-resolved name/namespace — no re-derivation from
     // manifest metadata. The edge is keyed by (owner-file, alias) which is
@@ -105,6 +123,179 @@ export function flattenForAnalyzer(graph) {
     }
     return result;
 }
+/** Extract re-export specs from a library doc's `exports.resources` — the dotted `Alias.Name`
+ *  entries (bare-name locals are forwarded by the BFS instead). Shared by the CLI graph path
+ *  and the editor's workspace projection so the two cannot drift. */
+export function reExportSpecsFromExports(moduleName, exportsResources) {
+    const specs = [];
+    for (const entry of exportsResources ?? []) {
+        if (typeof entry !== "string")
+            continue;
+        const { name, alias } = parseExportEntry(entry);
+        if (!alias || alias === "Self")
+            continue;
+        specs.push({ module: moduleName, alias, name });
+    }
+    return specs;
+}
+/** Forward re-exported instances (`exports.resources: [!ref Alias.name]`) transitively so a
+ *  consumer's `!ref Consumer.name` resolves in `resolveRefSentinels` (keyed by the RE-EXPORTING
+ *  module). The owning instance is already forwarded under its own module; here we emit an
+ *  additional copy stamped under each re-exporting module, with an already-canonical kind. A
+ *  fixpoint loop forwards chains of arbitrary depth (`app → api → domain → …`): each pass can
+ *  resolve a re-export whose source was emitted in a prior pass. Graph-agnostic: `aliasToModule`
+ *  maps `(module, alias)` to the imported module's name. Mutates `result` in place. */
+export function forwardReExportManifests(result, specs, aliasToModule) {
+    // Index forwarded instances by `module\0name` (only re-export TARGETS are forwarded).
+    const forwarded = new Map();
+    for (const m of result) {
+        const meta = m.metadata;
+        if (meta?.forwardedExport && meta.module && meta.name) {
+            forwarded.set(`${meta.module}\0${meta.name}`, m);
+        }
+    }
+    // Canonicalize an authored/forwarded kind to a scope-independent `<module>.<Kind>` using the
+    // owning module's own import aliases. Idempotent: an already-canonical kind whose prefix isn't
+    // an alias of `ownerModule` is returned unchanged, so re-exports of re-exports stay stable.
+    const canonicalKind = (kind, ownerModule) => {
+        if (kind.startsWith("Self."))
+            return `${ownerModule}.${kind.slice("Self.".length)}`;
+        const dot = kind.indexOf(".");
+        if (dot <= 0)
+            return kind;
+        const target = aliasToModule(ownerModule, kind.slice(0, dot));
+        return target ? `${target}.${kind.slice(dot + 1)}` : kind;
+    };
+    // Fixpoint — bounded by the number of specs (each can be satisfied at most once).
+    for (let pass = 0; pass <= specs.length; pass++) {
+        let added = false;
+        for (const spec of specs) {
+            const key = `${spec.module}\0${spec.name}`;
+            if (forwarded.has(key))
+                continue;
+            const sourceModule = aliasToModule(spec.module, spec.alias);
+            if (!sourceModule)
+                continue;
+            const src = forwarded.get(`${sourceModule}\0${spec.name}`);
+            if (!src)
+                continue; // source not forwarded yet — a later pass may satisfy it
+            const kind = canonicalKind(src.kind, sourceModule);
+            const manifest = {
+                ...src,
+                kind,
+                metadata: {
+                    ...src.metadata,
+                    name: spec.name,
+                    module: spec.module,
+                    forwardedExport: true,
+                },
+            };
+            result.push(manifest);
+            forwarded.set(key, manifest);
+            added = true;
+        }
+        if (!added)
+            break;
+    }
+}
+/** Resolve every library's `exports.kinds` to a per-module map `suffix → canonical
+ *  <owningModule>.<Kind>`, following re-exports (`Alias.Kind`) transitively via a fixpoint.
+ *  `modules` lists each library's name + its raw `exports.kinds`; `aliasToModule(module, alias)`
+ *  maps one of that module's import aliases to the imported module's name. Graph-agnostic —
+ *  shared by the CLI graph path and the editor's workspace projection. */
+export function resolveExportedKinds(modules, aliasToModule) {
+    const out = new Map();
+    const tableFor = (m) => {
+        let t = out.get(m);
+        if (!t)
+            out.set(m, (t = new Map()));
+        return t;
+    };
+    for (let pass = 0; pass <= modules.length; pass++) {
+        let changed = false;
+        for (const { module, exportsKinds } of modules) {
+            const table = tableFor(module);
+            for (const entry of exportsKinds) {
+                const { name: suffix, alias } = parseExportEntry(entry);
+                if (table.has(suffix))
+                    continue;
+                if (!alias) {
+                    table.set(suffix, `${module}.${suffix}`);
+                    changed = true;
+                    continue;
+                }
+                const source = aliasToModule(module, alias);
+                const canonical = source ? out.get(source)?.get(suffix) : undefined;
+                if (canonical) {
+                    table.set(suffix, canonical);
+                    changed = true;
+                }
+            }
+        }
+        if (!changed)
+            break;
+    }
+    return out;
+}
+/** Stamp `metadata.reExportedKinds` (suffix → canonical kind) onto every `Telo.Import` whose
+ *  target re-exports kinds, so the analyzer can register the re-export mappings. Only entries
+ *  that point at a module OTHER than the import's own target are stamped (genuine re-exports;
+ *  a locally-defined kind resolves through the normal alias path). Stamped on `metadata` (which
+ *  permits additional properties, like `resolvedModuleName`) since the `Telo.Import` schema
+ *  forbids extra top-level fields. Shared by both paths. */
+export function stampReExportedKinds(imports, exportedKinds) {
+    for (const { manifest, targetModule } of imports) {
+        const table = exportedKinds.get(targetModule);
+        if (!table)
+            continue;
+        const reExported = {};
+        for (const [suffix, canonical] of table) {
+            if (canonical !== `${targetModule}.${suffix}`)
+                reExported[suffix] = canonical;
+        }
+        if (Object.keys(reExported).length === 0)
+            continue;
+        manifest.metadata.reExportedKinds = reExported;
+    }
+}
+/** CLI/kernel adapter: collect re-export specs + alias map from a LoadedGraph. */
+function forwardReExports(graph, result) {
+    const ownerSourceOf = new Map();
+    const specs = [];
+    const kindModules = [];
+    for (const [source, mod] of graph.modules) {
+        if (source === graph.rootSource)
+            continue; // root is an Application — no exports
+        const libDoc = mod.owner.manifests.find((m) => m && isModuleKind(m.kind));
+        const moduleName = libDoc?.metadata?.name;
+        if (!libDoc || !moduleName)
+            continue;
+        ownerSourceOf.set(moduleName, mod.owner.source);
+        specs.push(...reExportSpecsFromExports(moduleName, libDoc.exports?.resources));
+        kindModules.push({ module: moduleName, exportsKinds: libDoc.exports?.kinds ?? [] });
+    }
+    const aliasToModule = (module, alias) => {
+        const ownerSource = ownerSourceOf.get(module);
+        return ownerSource
+            ? (graph.importEdges.get(ownerSource)?.get(alias)?.targetModuleName ?? undefined)
+            : undefined;
+    };
+    forwardReExportManifests(result, specs, aliasToModule);
+    // Resolve every library's re-exported kinds and stamp them onto the consumer-facing
+    // Telo.Import manifests so the analyzer can register the re-export mappings.
+    const exportedKinds = resolveExportedKinds(kindModules, aliasToModule);
+    const imports = [];
+    for (const m of result) {
+        if (m.kind !== "Telo.Import")
+            continue;
+        const owner = m.metadata?.source;
+        const alias = m.metadata?.name;
+        const target = owner && alias ? graph.importEdges.get(owner)?.get(alias)?.targetModuleName : undefined;
+        if (target)
+            imports.push({ manifest: m, targetModule: target });
+    }
+    stampReExportedKinds(imports, exportedKinds);
+}
 /** Project a LoadedModule (owner + partials) to a flat ResourceManifest[]
  *  with `metadata.module` stamped on non-module docs. The kernel's runtime
  *  entry load uses this to convert a `Loader.loadModule` result into the

package/dist/index.d.ts

@@ -2,7 +2,7 @@ export { AnalysisRegistry } from "./analysis-registry.js";
 export type { RefFieldInfo } from "./analysis-registry.js";
 export { StaticAnalyzer } from "./analyzer.js";
 export type { GraphLoadError, ImportEdge, LoadedFile, LoadedGraph, LoadedModule, ParseError, } from "./loaded-types.js";
-export { flattenForAnalyzer, flattenLoadedModule, selectModuleManifestsForAnalysis, } from "./flatten-for-analyzer.js";
+export { flattenForAnalyzer, flattenLoadedModule, forwardReExportManifests, parseExportEntry, reExportSpecsFromExports, resolveExportedKinds, selectModuleManifestsForAnalysis, stampReExportedKinds, type ParsedExportEntry, type ReExportSpec, } from "./flatten-for-analyzer.js";
 export { visitManifest } from "./manifest-visitor.js";
 export type { CelSiteEvent, ManifestVisitor, RefSiteEvent, ResourceEnterEvent, ResourceExitEvent, ScopeBoundaryEvent, SchemaFromSiteEvent, VisitOptions, } from "./manifest-visitor.js";
 export { Loader } from "./manifest-loader.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,gCAAgC,GACnC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,6 +1,6 @@
 export { AnalysisRegistry } from "./analysis-registry.js";
 export { StaticAnalyzer } from "./analyzer.js";
-export { flattenForAnalyzer, flattenLoadedModule, selectModuleManifestsForAnalysis, } from "./flatten-for-analyzer.js";
+export { flattenForAnalyzer, flattenLoadedModule, forwardReExportManifests, parseExportEntry, reExportSpecsFromExports, resolveExportedKinds, selectModuleManifestsForAnalysis, stampReExportedKinds, } from "./flatten-for-analyzer.js";
 export { visitManifest } from "./manifest-visitor.js";
 export { Loader } from "./manifest-loader.js";
 export { isModuleKind, MODULE_KINDS } from "./module-kinds.js";

package/dist/resolve-ref-sentinels.d.ts

@@ -1,10 +1,23 @@
 import type { ResourceManifest } from "@telorun/sdk";
 import type { AliasResolver } from "./alias-resolver.js";
-import type { DefinitionRegistry } from "./definition-registry.js";
 /**
- * Walks every `x-telo-ref` slot in every non-system resource and rewrites
- * `!ref <name>` sentinels in-place to `{kind, name}` (local) or
- * `{kind, name, alias}` (cross-module).
+ * Rewrites every `!ref <name>` sentinel in each non-system resource's value tree
+ * to `{kind, name}` (local) or `{kind, name, alias}` (cross-module), in place.
+ *
+ * The walk is value-tree-driven, not field-map-driven: a `!ref` tag is an
+ * *explicit* reference marker, so any sentinel found anywhere is unambiguously a
+ * reference and is resolved. This reaches sites the field map intentionally does
+ * not descend — notably `Run.Sequence` step `invoke`s (behind a local `$ref`)
+ * and references nested inside inline definitions — so every downstream consumer
+ * (Phase-5 injection, the runtime controllers, the analyzer's step-context and
+ * dependency passes) sees the uniform `{kind, name}` shape regardless of where
+ * the reference was written.
+ *
+ * Resolving a sentinel here does NOT cause Phase-5 injection: that pass is
+ * driven by the field map, which still excludes step `invoke`s, so a resolved
+ * step invoke stays `{kind, name}` and is dispatched through
+ * `executeInvokeStep` (preserving `<Kind>.<Name>.Invoked` events) rather than
+ * being replaced with a live instance.
  *
  * Reference grammar — the tag's source string is split on the FIRST dot:
  *   - `!ref writeLine`          → local resource `writeLine`
@@ -14,12 +27,14 @@ import type { DefinitionRegistry } from "./definition-registry.js";
  *
  * Aliases are PascalCase identifiers without dots and resource names carry no dots
  * (enforced as a hard diagnostic), so the first-dot split is unambiguous. When the
- * name doesn't resolve, the sentinel is left in place so `validateReferences` emits the
- * `UNRESOLVED_REFERENCE` diagnostic with full context.
+ * name doesn't resolve (e.g. a scope-local target, or a cross-module reference in
+ * partial single-file analysis), the sentinel is left in place — the runtime
+ * resolves scope-local names on demand, and `validateReferences` emits the
+ * `UNRESOLVED_REFERENCE` diagnostic for genuine misses.
  *
  * Forwarded foreign resources (an imported library's exported instances, carrying a
  * `metadata.module` that isn't a root module) are resolution TARGETS only — they are not
  * re-walked as sources here, since their own ref slots belong to their own module scope.
  */
-export declare function resolveRefSentinels(resources: ResourceManifest[], registry: DefinitionRegistry, aliases?: AliasResolver, aliasesByModule?: Map<string, AliasResolver>, crossModuleTargets?: ResourceManifest[]): void;
+export declare function resolveRefSentinels(resources: ResourceManifest[], aliases?: AliasResolver, aliasesByModule?: Map<string, AliasResolver>, crossModuleTargets?: ResourceManifest[]): void;
 //# sourceMappingURL=resolve-ref-sentinels.d.ts.map

package/dist/resolve-ref-sentinels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-ref-sentinels.d.ts","sourceRoot":"","sources":["../src/resolve-ref-sentinels.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAQnE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE,aAAa,EACvB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAK5C,kBAAkB,GAAE,gBAAgB,EAAO,GAC1C,IAAI,CAmFN"}
+{"version":3,"file":"resolve-ref-sentinels.d.ts","sourceRoot":"","sources":["../src/resolve-ref-sentinels.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAOzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,aAAa,EACvB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAK5C,kBAAkB,GAAE,gBAAgB,EAAO,GAC1C,IAAI,CAgFN"}

package/dist/resolve-ref-sentinels.js

@@ -1,10 +1,23 @@
-import { isRefSentinel } from "@telorun/templating";
-import { isRefEntry, isScopeEntry } from "./reference-field-map.js";
+import { isRefSentinel, isTaggedSentinel } from "@telorun/templating";
 import { REF_RESOLUTION_SKIP_KINDS as SYSTEM_KINDS } from "./system-kinds.js";
 /**
- * Walks every `x-telo-ref` slot in every non-system resource and rewrites
- * `!ref <name>` sentinels in-place to `{kind, name}` (local) or
- * `{kind, name, alias}` (cross-module).
+ * Rewrites every `!ref <name>` sentinel in each non-system resource's value tree
+ * to `{kind, name}` (local) or `{kind, name, alias}` (cross-module), in place.
+ *
+ * The walk is value-tree-driven, not field-map-driven: a `!ref` tag is an
+ * *explicit* reference marker, so any sentinel found anywhere is unambiguously a
+ * reference and is resolved. This reaches sites the field map intentionally does
+ * not descend — notably `Run.Sequence` step `invoke`s (behind a local `$ref`)
+ * and references nested inside inline definitions — so every downstream consumer
+ * (Phase-5 injection, the runtime controllers, the analyzer's step-context and
+ * dependency passes) sees the uniform `{kind, name}` shape regardless of where
+ * the reference was written.
+ *
+ * Resolving a sentinel here does NOT cause Phase-5 injection: that pass is
+ * driven by the field map, which still excludes step `invoke`s, so a resolved
+ * step invoke stays `{kind, name}` and is dispatched through
+ * `executeInvokeStep` (preserving `<Kind>.<Name>.Invoked` events) rather than
+ * being replaced with a live instance.
  *
  * Reference grammar — the tag's source string is split on the FIRST dot:
  *   - `!ref writeLine`          → local resource `writeLine`
@@ -14,14 +27,16 @@ import { REF_RESOLUTION_SKIP_KINDS as SYSTEM_KINDS } from "./system-kinds.js";
  *
  * Aliases are PascalCase identifiers without dots and resource names carry no dots
  * (enforced as a hard diagnostic), so the first-dot split is unambiguous. When the
- * name doesn't resolve, the sentinel is left in place so `validateReferences` emits the
- * `UNRESOLVED_REFERENCE` diagnostic with full context.
+ * name doesn't resolve (e.g. a scope-local target, or a cross-module reference in
+ * partial single-file analysis), the sentinel is left in place — the runtime
+ * resolves scope-local names on demand, and `validateReferences` emits the
+ * `UNRESOLVED_REFERENCE` diagnostic for genuine misses.
  *
  * Forwarded foreign resources (an imported library's exported instances, carrying a
  * `metadata.module` that isn't a root module) are resolution TARGETS only — they are not
  * re-walked as sources here, since their own ref slots belong to their own module scope.
  */
-export function resolveRefSentinels(resources, registry, aliases, aliasesByModule, 
+export function resolveRefSentinels(resources, aliases, aliasesByModule, 
 // Extra foreign resources used only as cross-module resolution TARGETS (not mutated, not
 // walked as sources). The kernel passes the analyzer-flattened set here so the runtime
 // pass — which loads the entry module only — can still resolve `!ref Alias.name` against
@@ -81,138 +96,33 @@ crossModuleTargets = []) {
         }
         return undefined;
     };
-    const processResource = (r) => {
-        if (!r.metadata?.name || !r.kind || SYSTEM_KINDS.has(r.kind))
-            return;
-        const fieldMap = aliases && aliasesByModule
-            ? registry.expandedFieldMapForResource(r, aliases, aliasesByModule)
-            : registry.getFieldMapForKind(r.kind, aliases);
-        if (!fieldMap)
-            return;
-        for (const [fieldPath, entry] of fieldMap) {
-            const parts = fieldPath.split(".");
-            if (isRefEntry(entry)) {
-                descend(r, parts, resolveTarget);
-            }
-            else if (isScopeEntry(entry)) {
-                // x-telo-scope resources (e.g. a Run.Sequence `with` server) carry their own ref
-                // slots. The top-level walk skips scope contents, so recurse so a scoped resource's
-                // `!ref` (e.g. an Http.Server mount) is canonicalized to {kind, name} like any other.
-                forEachScopeResource(r, parts, processResource);
-            }
+    // Resolve every `!ref` sentinel in the tree; leave opaque tagged / precompiled
+    // nodes (e.g. `!cel`) untouched and don't descend into them.
+    const walk = (value) => {
+        if (isRefSentinel(value)) {
+            return resolveTarget(value.source) ?? value;
         }
+        if (value === null || typeof value !== "object")
+            return value;
+        if (isTaggedSentinel(value))
+            return value;
+        if (value.__compiled)
+            return value;
+        if (Array.isArray(value)) {
+            for (let i = 0; i < value.length; i++)
+                value[i] = walk(value[i]);
+            return value;
+        }
+        const obj = value;
+        for (const key of Object.keys(obj))
+            obj[key] = walk(obj[key]);
+        return value;
     };
     for (const r of resources) {
         if (isForeign(r))
             continue;
-        processResource(r);
-    }
-}
-/**
- * Navigates `obj` along the scope field path (dot notation, `[]` = array items) and
- * invokes `cb` on every resource-like object found — any value carrying a `kind` string.
- *
- * Two-phase design:
- *
- *  Phase 1 — path-walk: steps through each `parts` segment. `[]`-suffixed parts spread
- *  the array into individual elements so `current` always ends up holding scalars or
- *  plain objects, never intermediate arrays. Non-`[]` parts push the value as-is.
- *
- *  Phase 2 — terminal visit: after the walk, `current` contains the values at the end
- *  of the path. These are always scalars or plain objects because of the `[]` spreading
- *  above, EXCEPT when a scope field is typed as an array in the schema but the path
- *  was authored WITHOUT a `[]` suffix. The `visit` function handles that case by
- *  recursing one level into arrays so `cb` is always called on resource objects, not
- *  on their container.
- */
-function forEachScopeResource(obj, parts, cb) {
-    let current = [obj];
-    for (const part of parts) {
-        const isArr = part.endsWith("[]");
-        const key = isArr ? part.slice(0, -2) : part;
-        const next = [];
-        for (const node of current) {
-            if (!node || typeof node !== "object")
-                continue;
-            const val = node[key];
-            if (val == null)
-                continue;
-            if (isArr && Array.isArray(val))
-                next.push(...val);
-            else if (!isArr)
-                next.push(val);
-        }
-        current = next;
-    }
-    const visit = (node) => {
-        if (Array.isArray(node)) {
-            for (const elem of node)
-                visit(elem);
-        }
-        else if (node && typeof node === "object" && typeof node.kind === "string") {
-            cb(node);
-        }
-    };
-    for (const node of current)
-        visit(node);
-}
-/** Walks `obj` along `fieldPath` parts (dot notation with `[]` for arrays and `{}` for
- *  additionalProperties-typed maps) and replaces any `!ref` sentinel at the terminal slot
- *  with its resolved `{kind, name, alias?}`. Mutates the parent container in place. */
-function descend(obj, parts, resolve) {
-    if (obj == null || typeof obj !== "object" || parts.length === 0)
-        return;
-    const [head, ...rest] = parts;
-    if (head === "{}") {
-        const container = obj;
-        for (const key of Object.keys(container)) {
-            const child = container[key];
-            if (rest.length === 0) {
-                if (isRefSentinel(child)) {
-                    const target = resolve(child.source);
-                    if (target)
-                        container[key] = target;
-                }
-            }
-            else {
-                descend(child, rest, resolve);
-            }
-        }
-        return;
-    }
-    const isArr = head.endsWith("[]");
-    const key = isArr ? head.slice(0, -2) : head;
-    const container = obj;
-    const val = container[key];
-    if (val == null)
-        return;
-    if (isArr) {
-        if (!Array.isArray(val))
-            return;
-        for (let i = 0; i < val.length; i++) {
-            if (rest.length === 0) {
-                const elem = val[i];
-                if (isRefSentinel(elem)) {
-                    const target = resolve(elem.source);
-                    if (target)
-                        val[i] = target;
-                }
-            }
-            else {
-                descend(val[i], rest, resolve);
-            }
-        }
-    }
-    else {
-        if (rest.length === 0) {
-            if (isRefSentinel(val)) {
-                const target = resolve(val.source);
-                if (target)
-                    container[key] = target;
-            }
-        }
-        else {
-            descend(val, rest, resolve);
-        }
+        if (!r.metadata?.name || !r.kind || SYSTEM_KINDS.has(r.kind))
+            continue;
+        walk(r);
     }
 }

package/dist/schema-compat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-compat.d.ts","sourceRoot":"","sources":["../src/schema-compat.ts"],"names":[],"mappings":"AAIA,QAAA,MAAM,GAAG,KAA0C,CAAC;AAEpD;;;;;;;mCAOmC;AACnC,wBAAgB,SAAS,IAAI,YAAY,CAAC,OAAO,GAAG,CAAC,CAOpD;AAKD,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;oEAEoE;AACpE,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC1B,mBAAmB,CAIrB;AAiDD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAelD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAGxE;AAuBD,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;CACd;AAED,0GAA0G;AAC1G,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,WAAW,EAAE,CAmB/F;AAED;qFACqF;AACrF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAQ7E;AAED;;;;6DAI6D;AAC7D,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,EAAE,MAAM,GACX,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAsBjC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGnD,CAAC;AAEF,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAGzF;AAED,8DAA8D;AAC9D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,CAyBnF;AAED,wFAAwF;AACxF,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAiChG;AAED,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAiB5E;AAID,0EAA0E;AAC1E,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAOtG;AAED,gGAAgG;AAChG,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAUlF;AAED;iGACiG;AACjG,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC/B,OAAO,CAqCT"}
+{"version":3,"file":"schema-compat.d.ts","sourceRoot":"","sources":["../src/schema-compat.ts"],"names":[],"mappings":"AAIA,QAAA,MAAM,GAAG,KAA0C,CAAC;AAEpD;;;;;;;mCAOmC;AACnC,wBAAgB,SAAS,IAAI,YAAY,CAAC,OAAO,GAAG,CAAC,CAOpD;AAKD,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;oEAEoE;AACpE,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC1B,mBAAmB,CAIrB;AAiDD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAelD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAGxE;AAuBD,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;CACd;AAaD,0GAA0G;AAC1G,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,WAAW,EAAE,CA2B/F;AAED;qFACqF;AACrF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAQ7E;AAED;;;;6DAI6D;AAC7D,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,EAAE,MAAM,GACX,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAsBjC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGnD,CAAC;AAEF,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAGzF;AAED,8DAA8D;AAC9D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,CAyBnF;AAED,wFAAwF;AACxF,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAiChG;AAED,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAiB5E;AAID,0EAA0E;AAC1E,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAOtG;AAED,gGAAgG;AAChG,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAUlF;AAED;iGACiG;AACjG,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC/B,OAAO,CAqCT"}

package/dist/schema-compat.js

@@ -1,6 +1,6 @@
 import AjvModule from "ajv";
 import addFormats from "ajv-formats";
-import { isRefSentinel, isTaggedSentinel, ManifestRootSchema } from "@telorun/templating";
+import { isRefSentinel, isTaggedSentinel, ManifestRootSchema, normalizeRefSlots } from "@telorun/templating";
 const Ajv = AjvModule.default ?? AjvModule;
 /** Creates a configured AJV instance (allErrors, strict: false, with formats).
  *  Also registers the kernel manifest root schema under `telo://manifest` so
@@ -100,21 +100,41 @@ function ajvErrorToPath(err) {
     }
     return result;
 }
+/** Does `schema` compile as-authored? Used to tell a malformed module schema
+ *  (the author's problem) apart from a fault we introduced while normalizing it. */
+function schemaCompiles(schema) {
+    try {
+        ajv.compile(schema);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 /** Validate actual data against a JSON Schema. Returns issues with path info, or empty array if valid. */
 export function validateAgainstSchema(data, schema) {
     let validate = compiledSchemaValidators.get(schema);
     if (!validate) {
+        // Normalize outside the try: a fault in our own ref-slot normalization must
+        // surface, never be mistaken for the module author's schema being malformed.
+        // Drop the legacy scalar `type` an older published module may still pin on
+        // its `x-telo-ref` slots so a resolved reference object validates.
+        const normalized = normalizeRefSlots(schema);
         try {
-            validate = ajv.compile(schema);
-            compiledSchemaValidators.set(schema, validate);
+            validate = ajv.compile(normalized);
         }
-        catch {
-            // A schema that won't compile is reported loudly (once, on the owning
-            // definition) by the analyzer's definition-schema compile check
-            // (`DefinitionRegistry.schemaCompileError`), so returning `[]` here does
-            // not silently accept resources of that kind.
+        catch (err) {
+            // The normalized schema didn't compile. If the original schema is itself
+            // malformed, that is the module author's error — already surfaced once,
+            // anchored on the definition, by the analyzer's `SCHEMA_COMPILE_ERROR`
+            // pre-check (`DefinitionRegistry.schemaCompileError`); re-reporting it per
+            // resource would be noise, so skip. If the original compiles and only the
+            // normalized form fails, the fault is ours — let it throw.
+            if (schemaCompiles(schema))
+                throw err;
             return [];
         }
+        compiledSchemaValidators.set(schema, validate);
     }
     if (validate(data))
         return [];

package/dist/validate-cel-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAEtF,MAAM,WAAW,kBAAkB;IACjC;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC;;kDAE8C;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;KACxD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CA6BjC;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAChD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAqGrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB;AAWD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,SAAM,GACT,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAC,CAGvD"}
+{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAEtF,MAAM,WAAW,kBAAkB;IACjC;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC;;kDAE8C;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;KACxD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAkCjC;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAChD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAqGrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB;AAWD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,SAAM,GACT,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAC,CAGvD"}

package/dist/validate-cel-context.js

@@ -27,6 +27,11 @@ export function resolveTypeFieldToSchema(value, allManifests) {
         if (obj.type || obj.properties) {
             return obj;
         }
+        // Named type reference resolved from a `!ref` → { kind, name } — resolve the
+        // named Telo.Type the same way as the bare-string form.
+        if (typeof obj.name === "string") {
+            return resolveTypeFieldToSchema(obj.name, allManifests);
+        }
     }
     return undefined;
 }

package/dist/validate-reference-forms.d.ts

@@ -0,0 +1,28 @@
+import type { ResourceManifest } from "@telorun/sdk";
+import type { AliasResolver } from "./alias-resolver.js";
+import type { DefinitionRegistry } from "./definition-registry.js";
+import { type AnalysisDiagnostic } from "./types.js";
+/**
+ * Reference-form validation — the single enforcement point for "a reference is
+ * written `!ref <name>` (or `!ref <Alias>.<name>`), nothing else".
+ *
+ * Runs on the RAW manifest set, BEFORE inline-resource extraction and `!ref`
+ * sentinel resolution. That ordering is load-bearing: only at this point is an
+ * author-written value still distinguishable from the resolver's own
+ * substitution. After normalization both an author's `{kind, name}` and a
+ * resolved `!ref` are the same `{kind, name}` object, so no later pass — and no
+ * JSON Schema — can tell them apart.
+ *
+ * At every `x-telo-ref` slot the only accepted value is:
+ *   - a `!ref` sentinel (or any tagged sentinel — e.g. a `${{ }}` ref passed
+ *     through a template), or
+ *   - an inline definition: a plain object with a `kind` and NO `name` (the
+ *     extractor assigns the name), or
+ *   - a `${{ }}` CEL expression string (a reference flowed through CEL).
+ *
+ * Rejected, each with an actionable diagnostic pointing at `!ref`:
+ *   - the object form `{ kind, name }` (the old reference object), and
+ *   - a bare string (the old name / dotted-FQN reference).
+ */
+export declare function validateReferenceForms(resources: ResourceManifest[], registry: DefinitionRegistry, aliases?: AliasResolver, aliasesByModule?: Map<string, AliasResolver>): AnalysisDiagnostic[];
+//# sourceMappingURL=validate-reference-forms.d.ts.map

package/dist/validate-reference-forms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-reference-forms.d.ts","sourceRoot":"","sources":["../src/validate-reference-forms.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAGnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE,aAAa,EACvB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC3C,kBAAkB,EAAE,CA+DtB"}