@telorun/analyzer 0.24.0 → 0.25.0

package/README.md

@@ -55,8 +55,8 @@ metadata:
     A complete feedback collection REST API — no code, pure YAML.
     Persists entries to SQLite and serves them over HTTP.
 imports:
-  Http: std/http-server@0.11.0
-  Sql: std/sql@0.9.0
+  Http: std/http-server@0.12.0
+  Sql: std/sql@0.9.2
 targets:
   - !ref Migrations
   - !ref Server

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAiB9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA4hB/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAstBvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAerB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAmB9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA4hB/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAgvBvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAmBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -1,3 +1,4 @@
+import { canonicalTypeSchemaId } from "@telorun/sdk";
 import { defaultRegistry, isTaggedSentinel } from "@telorun/templating";
 import { AliasResolver, scopeResolverForModule } from "./alias-resolver.js";
 import { buildCelEnvironment, buildImportInputCelEnvironment, buildTypedCelEnvironment, } from "./cel-environment.js";
@@ -10,6 +11,8 @@ import { isModuleKind } from "./module-kinds.js";
 import { normalizeInlineResources } from "./normalize-inline-resources.js";
 import { REF_VALIDATION_SKIP_KINDS } from "./system-kinds.js";
 import { resolveRefSentinels } from "./resolve-ref-sentinels.js";
+import { resolveSchemaTypeRefs } from "./resolve-schema-type-refs.js";
+import { validateSchemaTypeRefs } from "./validate-schema-type-refs.js";
 import { rewriteSyntheticOrigins } from "./rewrite-synthetic-origins.js";
 import { celTypeSatisfiesJsonSchema, substituteCelFields, validateAgainstSchema, } from "./schema-compat.js";
 import { DiagnosticSeverity } from "./types.js";
@@ -663,6 +666,26 @@ export class StaticAnalyzer {
         // kernel controllers) see a uniform shape. Runs after normalize so both
         // original and inline-extracted manifests have their sentinels resolved.
         resolveRefSentinels(allManifests, aliases, aliasesByModule);
+        // Phase 2.6: register each named `Telo.Type` resource's schema under its
+        // canonical module-scoped id (`telo://<module>/<name>`), validate
+        // `telo://Self|Alias/Type` schema refs resolve to one, then rewrite those
+        // refs to the canonical id so AJV resolves them at compile time. Register
+        // and validate BEFORE the rewrite, while the authored authority is intact.
+        for (const m of allManifests) {
+            const ownModule = m.metadata?.module;
+            if (!ownModule || !m.metadata?.name || typeof m.schema !== "object" || m.schema === null) {
+                continue;
+            }
+            const scopeResolver = rootModules.has(ownModule) ? aliases : (aliasesByModule.get(ownModule) ?? new AliasResolver());
+            const canonicalKind = scopeResolver.resolveKind(m.kind) ?? m.kind;
+            if (defs.resolve(canonicalKind)?.capability !== "Telo.Type")
+                continue;
+            defs.registerNamedTypeSchema(canonicalTypeSchemaId(ownModule, m.metadata.name), m.schema);
+        }
+        if (!options?.skipValidation) {
+            diagnostics.push(...validateSchemaTypeRefs(allManifests, defs, aliases, aliasesByModule, rootModules));
+        }
+        resolveSchemaTypeRefs(allManifests, aliases, aliasesByModule);
         // Trusted-input fast path: when the caller has already attested that
         // this exact manifest set passes analysis (e.g. via the kernel's
         // hash-stamped `.validated.json` cache), skip the validation walk.
@@ -1109,6 +1132,10 @@ export class StaticAnalyzer {
         // inline-extracted manifests get their refs canonicalized to
         // {kind, name} for the kernel that consumes this output.
         resolveRefSentinels(normalized, ctx.aliases, ctx.aliasesByModule, crossModuleTargets ?? []);
+        // Canonicalize import-scoped schema `$ref`s (`telo://Self|Alias/Type`) so the
+        // kernel that executes this output compiles inputs/outputs against the same
+        // ids the type controllers register their schemas under.
+        resolveSchemaTypeRefs(normalized, ctx.aliases, ctx.aliasesByModule);
         return normalized;
     }
     prepare(manifests, registry) {

package/dist/definition-registry.d.ts

@@ -27,6 +27,15 @@ export declare class DefinitionRegistry {
      *  @param namespace  The module's metadata.namespace (e.g. "std"), or null for telo built-ins.
      *  @param moduleName The module's metadata.name (e.g. "pipeline", "http-server"). */
     registerModuleIdentity(namespace: string | null, moduleName: string): void;
+    /** Registers a named `Telo.Type` resource's schema under its canonical
+     *  module-scoped URI `$id` (`telo://<module>/<name>`), so a sibling schema's
+     *  `$ref: "telo://Self/<name>"` (rewritten to the canonical form by
+     *  `resolveSchemaTypeRefs`) resolves during AJV compilation. Mirrors the
+     *  kernel type controller's `registerSchema(canonicalTypeSchemaId(...))`. */
+    registerNamedTypeSchema(id: string, schema: Record<string, any>): void;
+    /** True when a schema is registered under `id` (a canonical `telo://` type id
+     *  or a definition `$id`). Used to flag schema `$ref`s that resolve to nothing. */
+    hasSchemaId(id: string): boolean;
     /** Computes the $id for a definition schema: "<identity>/<TypeName>".
      *  Returns undefined when the module identity is not yet registered. */
     computeId(moduleName: string, typeName: string): string | undefined;

package/dist/definition-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"definition-registry.d.ts","sourceRoot":"","sources":["../src/definition-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAGlC,+EAA+E;AAC/E,qBAAa,kBAAkB;;IAK7B;;sFAEkF;IAClF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IAEzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyC;IAC9D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D;6DACyD;IACzD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD;;0EAEsE;IACtE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA6B;IAEhE,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI;IAiC9C,OAAO,CAAC,aAAa;IASrB;;;yFAGqF;IACrF,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IA+B1E;4EACwE;IACxE,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAMnE;;;;oFAIgF;IAChF,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE;IAWtE;;;;;;iCAM6B;IAC7B,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,GAAG,SAAS;IASnE,OAAO,CAAC,iBAAiB;IAczB;;;;;;;;4FAQwF;IACxF,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAUhD,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAIrD,+FAA+F;IAC/F,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAIxD,gGAAgG;IAChG,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,GACvD,iBAAiB,GAAG,SAAS;IAOhC;;;;;;;;qFAQiF;IACjF,2BAA2B,CACzB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC1C,iBAAiB,GAAG,SAAS;IAuBhC,OAAO,CAAC,uBAAuB;IA+B/B;;qEAEiE;IACjE,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAgBxD,KAAK,IAAI,MAAM,EAAE;CAGlB"}
+{"version":3,"file":"definition-registry.d.ts","sourceRoot":"","sources":["../src/definition-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAGlC,+EAA+E;AAC/E,qBAAa,kBAAkB;;IAK7B;;sFAEkF;IAClF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IAEzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyC;IAC9D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D;6DACyD;IACzD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD;;0EAEsE;IACtE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA6B;IAEhE,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI;IAiC9C,OAAO,CAAC,aAAa;IASrB;;;yFAGqF;IACrF,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IA+B1E;;;;iFAI6E;IAC7E,uBAAuB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI;IAMtE;uFACmF;IACnF,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAIhC;4EACwE;IACxE,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAMnE;;;;oFAIgF;IAChF,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE;IAWtE;;;;;;iCAM6B;IAC7B,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,GAAG,SAAS;IASnE,OAAO,CAAC,iBAAiB;IAczB;;;;;;;;4FAQwF;IACxF,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAUhD,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAIrD,+FAA+F;IAC/F,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAIxD,gGAAgG;IAChG,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,GACvD,iBAAiB,GAAG,SAAS;IAOhC;;;;;;;;qFAQiF;IACjF,2BAA2B,CACzB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC1C,iBAAiB,GAAG,SAAS;IAuBhC,OAAO,CAAC,uBAAuB;IA+B/B;;qEAEiE;IACjE,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAgBxD,KAAK,IAAI,MAAM,EAAE;CAGlB"}

package/dist/definition-registry.js

@@ -96,6 +96,22 @@ export class DefinitionRegistry {
             }
         }
     }
+    /** Registers a named `Telo.Type` resource's schema under its canonical
+     *  module-scoped URI `$id` (`telo://<module>/<name>`), so a sibling schema's
+     *  `$ref: "telo://Self/<name>"` (rewritten to the canonical form by
+     *  `resolveSchemaTypeRefs`) resolves during AJV compilation. Mirrors the
+     *  kernel type controller's `registerSchema(canonicalTypeSchemaId(...))`. */
+    registerNamedTypeSchema(id, schema) {
+        if (this.registeredSchemaIds.has(id) || this.ajv.getSchema(id))
+            return;
+        this.ajv.addSchema(schema, id);
+        this.registeredSchemaIds.add(id);
+    }
+    /** True when a schema is registered under `id` (a canonical `telo://` type id
+     *  or a definition `$id`). Used to flag schema `$ref`s that resolve to nothing. */
+    hasSchemaId(id) {
+        return this.registeredSchemaIds.has(id) || this.ajv.getSchema(id) !== undefined;
+    }
     /** Computes the $id for a definition schema: "<identity>/<TypeName>".
      *  Returns undefined when the module identity is not yet registered. */
     computeId(moduleName, typeName) {

package/dist/resolve-ref-sentinels.d.ts

@@ -16,7 +16,7 @@ import type { AliasResolver } from "./alias-resolver.js";
  * Resolving a sentinel here does NOT cause Phase-5 injection: that pass is
  * driven by the field map, which still excludes step `invoke`s, so a resolved
  * step invoke stays `{kind, name}` and is dispatched through
- * `executeInvokeStep` (preserving `<Kind>.<Name>.Invoked` events) rather than
+ * `executeInvokeStep` (preserving `<name>.Invoked` events) rather than
  * being replaced with a live instance.
  *
  * Reference grammar — the tag's source string is split on the FIRST dot:

package/dist/resolve-ref-sentinels.js

@@ -16,7 +16,7 @@ import { REF_RESOLUTION_SKIP_KINDS as SYSTEM_KINDS } from "./system-kinds.js";
  * Resolving a sentinel here does NOT cause Phase-5 injection: that pass is
  * driven by the field map, which still excludes step `invoke`s, so a resolved
  * step invoke stays `{kind, name}` and is dispatched through
- * `executeInvokeStep` (preserving `<Kind>.<Name>.Invoked` events) rather than
+ * `executeInvokeStep` (preserving `<name>.Invoked` events) rather than
  * being replaced with a live instance.
  *
  * Reference grammar — the tag's source string is split on the FIRST dot:

package/dist/resolve-schema-type-refs.d.ts

@@ -0,0 +1,20 @@
+import type { ResourceManifest } from "@telorun/sdk";
+import type { AliasResolver } from "./alias-resolver.js";
+/**
+ * Rewrites import-scoped schema references in place. A `$ref` of the form
+ * `telo://<authority>/<typeName>` names a `Type.JsonSchema` (or any `Telo.Type`)
+ * reached through an import: `telo://Self/<type>` for the declaring module's own
+ * type, `telo://<Alias>/<type>` for an imported module's. Each authority is
+ * resolved to the owning module's name and the ref is rewritten to the canonical
+ * `telo://<module>/<type>` the type registered its schema under.
+ *
+ * The version lives on the `imports:` entry, never the URI — only the pinned
+ * version is loaded, so the canonical id is version-free.
+ *
+ * Already-canonical refs (authority is a real module name, not an alias) and
+ * fragment-bearing built-ins (`telo://manifest#/$defs/ResourceRef`) are left
+ * untouched: the former because the authority resolves to nothing, the latter
+ * because they don't match the `authority/type` grammar.
+ */
+export declare function resolveSchemaTypeRefs(resources: ResourceManifest[], aliases?: AliasResolver, aliasesByModule?: Map<string, AliasResolver>): void;
+//# sourceMappingURL=resolve-schema-type-refs.d.ts.map

package/dist/resolve-schema-type-refs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-schema-type-refs.d.ts","sourceRoot":"","sources":["../src/resolve-schema-type-refs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAKzD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,aAAa,EACvB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC3C,IAAI,CAyBN"}

package/dist/resolve-schema-type-refs.js

@@ -0,0 +1,47 @@
+import { canonicalTypeSchemaId, parseTeloTypeRef } from "@telorun/sdk";
+/** Schema-bearing fields on a Telo.Definition / Telo.Type resource. */
+const SCHEMA_FIELDS = ["schema", "inputType", "outputType"];
+/**
+ * Rewrites import-scoped schema references in place. A `$ref` of the form
+ * `telo://<authority>/<typeName>` names a `Type.JsonSchema` (or any `Telo.Type`)
+ * reached through an import: `telo://Self/<type>` for the declaring module's own
+ * type, `telo://<Alias>/<type>` for an imported module's. Each authority is
+ * resolved to the owning module's name and the ref is rewritten to the canonical
+ * `telo://<module>/<type>` the type registered its schema under.
+ *
+ * The version lives on the `imports:` entry, never the URI — only the pinned
+ * version is loaded, so the canonical id is version-free.
+ *
+ * Already-canonical refs (authority is a real module name, not an alias) and
+ * fragment-bearing built-ins (`telo://manifest#/$defs/ResourceRef`) are left
+ * untouched: the former because the authority resolves to nothing, the latter
+ * because they don't match the `authority/type` grammar.
+ */
+export function resolveSchemaTypeRefs(resources, aliases, aliasesByModule) {
+    const walk = (value, resolveAuthority) => {
+        if (value === null || typeof value !== "object")
+            return;
+        if (Array.isArray(value)) {
+            for (const item of value)
+                walk(item, resolveAuthority);
+            return;
+        }
+        const obj = value;
+        const parsed = parseTeloTypeRef(obj.$ref);
+        if (parsed) {
+            const module = resolveAuthority(parsed.authority);
+            if (module)
+                obj.$ref = canonicalTypeSchemaId(module, parsed.typeName);
+        }
+        for (const key of Object.keys(obj))
+            walk(obj[key], resolveAuthority);
+    };
+    for (const r of resources) {
+        const ownModule = r.metadata?.module;
+        const resolver = (ownModule ? aliasesByModule?.get(ownModule) : undefined) ?? aliases;
+        const resolveAuthority = (authority) => authority === "Self" ? ownModule : resolver?.moduleForAlias(authority);
+        for (const field of SCHEMA_FIELDS) {
+            walk(r[field], resolveAuthority);
+        }
+    }
+}

package/dist/validate-schema-type-refs.d.ts

@@ -0,0 +1,21 @@
+import type { ResourceManifest } from "@telorun/sdk";
+import type { AliasResolver } from "./alias-resolver.js";
+import type { DefinitionRegistry } from "./definition-registry.js";
+import { type AnalysisDiagnostic } from "./types.js";
+/**
+ * Validates module-scoped schema `$ref`s of the form `telo://<authority>/<type>`.
+ * The authority is an import alias (or `Self`) declared in the resource's module;
+ * the type must be a registered `Telo.Type` resource in the module it resolves to.
+ *
+ * Diagnostics (both errors — a `$ref` that resolves to nothing is never validated
+ * by AJV, so without this it would silently pass):
+ *  - SCHEMA_TYPE_REF_UNKNOWN_ALIAS: the authority is neither `Self` nor a declared import.
+ *  - SCHEMA_TYPE_REF_UNRESOLVED: the authority resolves to a module, but that module
+ *    declares no `Telo.Type` named `<type>`.
+ *
+ * Forwarded/imported definitions are skipped — their own refs are validated when the
+ * owning library is analyzed as a root, and the consumer's scope can't see the
+ * library's internal aliases (mirrors `validateExtends`).
+ */
+export declare function validateSchemaTypeRefs(manifests: ResourceManifest[], registry: DefinitionRegistry, aliases: AliasResolver, aliasesByModule: Map<string, AliasResolver>, rootModules: Set<string>): AnalysisDiagnostic[];
+//# sourceMappingURL=validate-schema-type-refs.d.ts.map

package/dist/validate-schema-type-refs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-schema-type-refs.d.ts","sourceRoot":"","sources":["../src/validate-schema-type-refs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAKzE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAC3C,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,GACvB,kBAAkB,EAAE,CAuDtB"}

package/dist/validate-schema-type-refs.js

@@ -0,0 +1,74 @@
+import { canonicalTypeSchemaId, parseTeloTypeRef } from "@telorun/sdk";
+import { DiagnosticSeverity } from "./types.js";
+const SOURCE = "telo-analyzer";
+const SCHEMA_FIELDS = ["schema", "inputType", "outputType"];
+/**
+ * Validates module-scoped schema `$ref`s of the form `telo://<authority>/<type>`.
+ * The authority is an import alias (or `Self`) declared in the resource's module;
+ * the type must be a registered `Telo.Type` resource in the module it resolves to.
+ *
+ * Diagnostics (both errors — a `$ref` that resolves to nothing is never validated
+ * by AJV, so without this it would silently pass):
+ *  - SCHEMA_TYPE_REF_UNKNOWN_ALIAS: the authority is neither `Self` nor a declared import.
+ *  - SCHEMA_TYPE_REF_UNRESOLVED: the authority resolves to a module, but that module
+ *    declares no `Telo.Type` named `<type>`.
+ *
+ * Forwarded/imported definitions are skipped — their own refs are validated when the
+ * owning library is analyzed as a root, and the consumer's scope can't see the
+ * library's internal aliases (mirrors `validateExtends`).
+ */
+export function validateSchemaTypeRefs(manifests, registry, aliases, aliasesByModule, rootModules) {
+    const diagnostics = [];
+    for (const m of manifests) {
+        const ownModule = m.metadata?.module;
+        const name = m.metadata?.name;
+        if (!name)
+            continue;
+        // Only validate refs authored in a root module's scope; imported defs are
+        // validated against their own library when it's analyzed as a root.
+        if (ownModule && !rootModules.has(ownModule))
+            continue;
+        const resolver = (ownModule ? aliasesByModule.get(ownModule) : undefined) ?? aliases;
+        const filePath = m.metadata?.source;
+        const label = `${m.kind}/${name}`;
+        const walk = (value, path) => {
+            if (value === null || typeof value !== "object")
+                return;
+            if (Array.isArray(value)) {
+                value.forEach((item, i) => walk(item, `${path}[${i}]`));
+                return;
+            }
+            const obj = value;
+            const parsed = parseTeloTypeRef(obj.$ref);
+            if (parsed) {
+                const module = parsed.authority === "Self" ? ownModule : resolver.moduleForAlias(parsed.authority);
+                if (!module) {
+                    diagnostics.push({
+                        severity: DiagnosticSeverity.Error,
+                        code: "SCHEMA_TYPE_REF_UNKNOWN_ALIAS",
+                        source: SOURCE,
+                        message: `${label}: schema $ref '${obj.$ref}' — '${parsed.authority}' is not 'Self' or a ` +
+                            `Telo.Import in this module. Declare the import or correct the authority.`,
+                        data: { resource: { kind: m.kind, name }, filePath, path: `${path}/$ref` },
+                    });
+                }
+                else if (!registry.hasSchemaId(canonicalTypeSchemaId(module, parsed.typeName))) {
+                    diagnostics.push({
+                        severity: DiagnosticSeverity.Error,
+                        code: "SCHEMA_TYPE_REF_UNRESOLVED",
+                        source: SOURCE,
+                        message: `${label}: schema $ref '${obj.$ref}' resolves to module '${module}', which declares ` +
+                            `no Telo.Type named '${parsed.typeName}'.`,
+                        data: { resource: { kind: m.kind, name }, filePath, path: `${path}/$ref` },
+                    });
+                }
+            }
+            for (const key of Object.keys(obj))
+                walk(obj[key], `${path}/${key}`);
+        };
+        for (const field of SCHEMA_FIELDS) {
+            walk(m[field], field);
+        }
+    }
+    return diagnostics;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.24.0",
+  "version": "0.25.0",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",
@@ -42,13 +42,13 @@
     "ajv-formats": "^3.0.1",
     "jsonpath-plus": "^10.3.0",
     "yaml": "^2.8.3",
-    "@telorun/templating": "0.9.0"
+    "@telorun/templating": "0.10.0"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",
     "typescript": "^5.0.0",
     "vitest": "^2.1.8",
-    "@telorun/sdk": "0.26.0"
+    "@telorun/sdk": "0.34.0"
   },
   "peerDependencies": {
     "@telorun/sdk": "*"

package/src/analyzer.ts

@@ -1,4 +1,5 @@
 import type { ResourceDefinition, ResourceManifest } from "@telorun/sdk";
+import { canonicalTypeSchemaId } from "@telorun/sdk";
 import type { Environment } from "@marcbachmann/cel-js";
 import { defaultRegistry, isTaggedSentinel } from "@telorun/templating";
 import { AliasResolver, scopeResolverForModule } from "./alias-resolver.js";
@@ -18,6 +19,8 @@ import { isModuleKind } from "./module-kinds.js";
 import { normalizeInlineResources } from "./normalize-inline-resources.js";
 import { REF_VALIDATION_SKIP_KINDS } from "./system-kinds.js";
 import { resolveRefSentinels } from "./resolve-ref-sentinels.js";
+import { resolveSchemaTypeRefs } from "./resolve-schema-type-refs.js";
+import { validateSchemaTypeRefs } from "./validate-schema-type-refs.js";
 import { rewriteSyntheticOrigins } from "./rewrite-synthetic-origins.js";
 import {
   celTypeSatisfiesJsonSchema,
@@ -800,6 +803,32 @@ export class StaticAnalyzer {
     // original and inline-extracted manifests have their sentinels resolved.
     resolveRefSentinels(allManifests, aliases, aliasesByModule);
 
+    // Phase 2.6: register each named `Telo.Type` resource's schema under its
+    // canonical module-scoped id (`telo://<module>/<name>`), validate
+    // `telo://Self|Alias/Type` schema refs resolve to one, then rewrite those
+    // refs to the canonical id so AJV resolves them at compile time. Register
+    // and validate BEFORE the rewrite, while the authored authority is intact.
+    for (const m of allManifests) {
+      const ownModule = (m.metadata as { module?: string } | undefined)?.module;
+      if (!ownModule || !m.metadata?.name || typeof m.schema !== "object" || m.schema === null) {
+        continue;
+      }
+      const scopeResolver =
+        rootModules.has(ownModule) ? aliases : (aliasesByModule.get(ownModule) ?? new AliasResolver());
+      const canonicalKind = scopeResolver.resolveKind(m.kind as string) ?? (m.kind as string);
+      if (defs.resolve(canonicalKind)?.capability !== "Telo.Type") continue;
+      defs.registerNamedTypeSchema(
+        canonicalTypeSchemaId(ownModule, m.metadata.name as string),
+        m.schema as Record<string, any>,
+      );
+    }
+    if (!options?.skipValidation) {
+      diagnostics.push(
+        ...validateSchemaTypeRefs(allManifests, defs, aliases, aliasesByModule, rootModules),
+      );
+    }
+    resolveSchemaTypeRefs(allManifests, aliases, aliasesByModule);
+
     // Trusted-input fast path: when the caller has already attested that
     // this exact manifest set passes analysis (e.g. via the kernel's
     // hash-stamped `.validated.json` cache), skip the validation walk.
@@ -1350,6 +1379,10 @@ export class StaticAnalyzer {
     // inline-extracted manifests get their refs canonicalized to
     // {kind, name} for the kernel that consumes this output.
     resolveRefSentinels(normalized, ctx.aliases, ctx.aliasesByModule, crossModuleTargets ?? []);
+    // Canonicalize import-scoped schema `$ref`s (`telo://Self|Alias/Type`) so the
+    // kernel that executes this output compiles inputs/outputs against the same
+    // ids the type controllers register their schemas under.
+    resolveSchemaTypeRefs(normalized, ctx.aliases, ctx.aliasesByModule);
     return normalized;
   }
 

package/src/definition-registry.ts

@@ -110,6 +110,23 @@ export class DefinitionRegistry {
     }
   }
 
+  /** Registers a named `Telo.Type` resource's schema under its canonical
+   *  module-scoped URI `$id` (`telo://<module>/<name>`), so a sibling schema's
+   *  `$ref: "telo://Self/<name>"` (rewritten to the canonical form by
+   *  `resolveSchemaTypeRefs`) resolves during AJV compilation. Mirrors the
+   *  kernel type controller's `registerSchema(canonicalTypeSchemaId(...))`. */
+  registerNamedTypeSchema(id: string, schema: Record<string, any>): void {
+    if (this.registeredSchemaIds.has(id) || this.ajv.getSchema(id)) return;
+    this.ajv.addSchema(schema, id);
+    this.registeredSchemaIds.add(id);
+  }
+
+  /** True when a schema is registered under `id` (a canonical `telo://` type id
+   *  or a definition `$id`). Used to flag schema `$ref`s that resolve to nothing. */
+  hasSchemaId(id: string): boolean {
+    return this.registeredSchemaIds.has(id) || this.ajv.getSchema(id) !== undefined;
+  }
+
   /** Computes the $id for a definition schema: "<identity>/<TypeName>".
    *  Returns undefined when the module identity is not yet registered. */
   computeId(moduleName: string, typeName: string): string | undefined {

package/src/resolve-ref-sentinels.ts

@@ -23,7 +23,7 @@ type ResolvedRef = { kind: string; name: string; alias?: string };
  * Resolving a sentinel here does NOT cause Phase-5 injection: that pass is
  * driven by the field map, which still excludes step `invoke`s, so a resolved
  * step invoke stays `{kind, name}` and is dispatched through
- * `executeInvokeStep` (preserving `<Kind>.<Name>.Invoked` events) rather than
+ * `executeInvokeStep` (preserving `<name>.Invoked` events) rather than
  * being replaced with a live instance.
  *
  * Reference grammar — the tag's source string is split on the FIRST dot:

package/src/resolve-schema-type-refs.ts

@@ -0,0 +1,53 @@
+import type { ResourceManifest } from "@telorun/sdk";
+import { canonicalTypeSchemaId, parseTeloTypeRef } from "@telorun/sdk";
+import type { AliasResolver } from "./alias-resolver.js";
+
+/** Schema-bearing fields on a Telo.Definition / Telo.Type resource. */
+const SCHEMA_FIELDS = ["schema", "inputType", "outputType"];
+
+/**
+ * Rewrites import-scoped schema references in place. A `$ref` of the form
+ * `telo://<authority>/<typeName>` names a `Type.JsonSchema` (or any `Telo.Type`)
+ * reached through an import: `telo://Self/<type>` for the declaring module's own
+ * type, `telo://<Alias>/<type>` for an imported module's. Each authority is
+ * resolved to the owning module's name and the ref is rewritten to the canonical
+ * `telo://<module>/<type>` the type registered its schema under.
+ *
+ * The version lives on the `imports:` entry, never the URI — only the pinned
+ * version is loaded, so the canonical id is version-free.
+ *
+ * Already-canonical refs (authority is a real module name, not an alias) and
+ * fragment-bearing built-ins (`telo://manifest#/$defs/ResourceRef`) are left
+ * untouched: the former because the authority resolves to nothing, the latter
+ * because they don't match the `authority/type` grammar.
+ */
+export function resolveSchemaTypeRefs(
+  resources: ResourceManifest[],
+  aliases?: AliasResolver,
+  aliasesByModule?: Map<string, AliasResolver>,
+): void {
+  const walk = (value: unknown, resolveAuthority: (authority: string) => string | undefined): void => {
+    if (value === null || typeof value !== "object") return;
+    if (Array.isArray(value)) {
+      for (const item of value) walk(item, resolveAuthority);
+      return;
+    }
+    const obj = value as Record<string, unknown>;
+    const parsed = parseTeloTypeRef(obj.$ref);
+    if (parsed) {
+      const module = resolveAuthority(parsed.authority);
+      if (module) obj.$ref = canonicalTypeSchemaId(module, parsed.typeName);
+    }
+    for (const key of Object.keys(obj)) walk(obj[key], resolveAuthority);
+  };
+
+  for (const r of resources) {
+    const ownModule = (r.metadata as { module?: string } | undefined)?.module;
+    const resolver = (ownModule ? aliasesByModule?.get(ownModule) : undefined) ?? aliases;
+    const resolveAuthority = (authority: string): string | undefined =>
+      authority === "Self" ? ownModule : resolver?.moduleForAlias(authority);
+    for (const field of SCHEMA_FIELDS) {
+      walk((r as Record<string, unknown>)[field], resolveAuthority);
+    }
+  }
+}

package/src/validate-schema-type-refs.ts

@@ -0,0 +1,86 @@
+import type { ResourceManifest } from "@telorun/sdk";
+import { canonicalTypeSchemaId, parseTeloTypeRef } from "@telorun/sdk";
+import type { AliasResolver } from "./alias-resolver.js";
+import type { DefinitionRegistry } from "./definition-registry.js";
+import { DiagnosticSeverity, type AnalysisDiagnostic } from "./types.js";
+
+const SOURCE = "telo-analyzer";
+const SCHEMA_FIELDS = ["schema", "inputType", "outputType"] as const;
+
+/**
+ * Validates module-scoped schema `$ref`s of the form `telo://<authority>/<type>`.
+ * The authority is an import alias (or `Self`) declared in the resource's module;
+ * the type must be a registered `Telo.Type` resource in the module it resolves to.
+ *
+ * Diagnostics (both errors — a `$ref` that resolves to nothing is never validated
+ * by AJV, so without this it would silently pass):
+ *  - SCHEMA_TYPE_REF_UNKNOWN_ALIAS: the authority is neither `Self` nor a declared import.
+ *  - SCHEMA_TYPE_REF_UNRESOLVED: the authority resolves to a module, but that module
+ *    declares no `Telo.Type` named `<type>`.
+ *
+ * Forwarded/imported definitions are skipped — their own refs are validated when the
+ * owning library is analyzed as a root, and the consumer's scope can't see the
+ * library's internal aliases (mirrors `validateExtends`).
+ */
+export function validateSchemaTypeRefs(
+  manifests: ResourceManifest[],
+  registry: DefinitionRegistry,
+  aliases: AliasResolver,
+  aliasesByModule: Map<string, AliasResolver>,
+  rootModules: Set<string>,
+): AnalysisDiagnostic[] {
+  const diagnostics: AnalysisDiagnostic[] = [];
+
+  for (const m of manifests) {
+    const ownModule = (m.metadata as { module?: string } | undefined)?.module;
+    const name = m.metadata?.name as string | undefined;
+    if (!name) continue;
+    // Only validate refs authored in a root module's scope; imported defs are
+    // validated against their own library when it's analyzed as a root.
+    if (ownModule && !rootModules.has(ownModule)) continue;
+    const resolver = (ownModule ? aliasesByModule.get(ownModule) : undefined) ?? aliases;
+    const filePath = (m.metadata as { source?: string } | undefined)?.source;
+    const label = `${m.kind}/${name}`;
+
+    const walk = (value: unknown, path: string): void => {
+      if (value === null || typeof value !== "object") return;
+      if (Array.isArray(value)) {
+        value.forEach((item, i) => walk(item, `${path}[${i}]`));
+        return;
+      }
+      const obj = value as Record<string, unknown>;
+      const parsed = parseTeloTypeRef(obj.$ref);
+      if (parsed) {
+        const module = parsed.authority === "Self" ? ownModule : resolver.moduleForAlias(parsed.authority);
+        if (!module) {
+          diagnostics.push({
+            severity: DiagnosticSeverity.Error,
+            code: "SCHEMA_TYPE_REF_UNKNOWN_ALIAS",
+            source: SOURCE,
+            message:
+              `${label}: schema $ref '${obj.$ref}' — '${parsed.authority}' is not 'Self' or a ` +
+              `Telo.Import in this module. Declare the import or correct the authority.`,
+            data: { resource: { kind: m.kind, name }, filePath, path: `${path}/$ref` },
+          });
+        } else if (!registry.hasSchemaId(canonicalTypeSchemaId(module, parsed.typeName))) {
+          diagnostics.push({
+            severity: DiagnosticSeverity.Error,
+            code: "SCHEMA_TYPE_REF_UNRESOLVED",
+            source: SOURCE,
+            message:
+              `${label}: schema $ref '${obj.$ref}' resolves to module '${module}', which declares ` +
+              `no Telo.Type named '${parsed.typeName}'.`,
+            data: { resource: { kind: m.kind, name }, filePath, path: `${path}/$ref` },
+          });
+        }
+      }
+      for (const key of Object.keys(obj)) walk(obj[key], `${path}/${key}`);
+    };
+
+    for (const field of SCHEMA_FIELDS) {
+      walk((m as Record<string, unknown>)[field], field);
+    }
+  }
+
+  return diagnostics;
+}