@telorun/analyzer 0.32.0 → 0.34.0

package/dist/analysis-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analysis-registry.d.ts","sourceRoot":"","sources":["../src/analysis-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAAqC,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAEhG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGlD;;wDAEwD;AACxD,MAAM,WAAW,YAAY;IAC3B;0CACsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;;8EAG0E;IAC1E,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;GAIG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IAEpE,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI;IAIjD,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAIpE,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAIpE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI7C;;;;;;;OAOG;IACH,mBAAmB,CACjB,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,EAClC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GACnC,IAAI;IAkBP;;;;;;OAMG;IACH,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,YAAY,EAAE;IAoBhE;;;;;;wBAMoB;IACpB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAQtD;;;;;;sFAMkF;IAClF,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAenE;;;;;qDAKiD;IACjD,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAepE,OAAO,CAAC,mBAAmB;IAS3B;;;;;;OAMG;IACH,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,EACxB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAAE,GACzF,IAAI;IAQP;;;;OAIG;IACH,kBAAkB,IAAI,kBAAkB,EAAE;IAI1C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAM/D;;qFAEiF;IACjF,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE;IAUzC,QAAQ,IAAI,MAAM,EAAE;IAIpB;mEAC+D;IAC/D,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE;IAIxC;;;gCAG4B;IAC5B,oBAAoB,IAAI,MAAM,EAAE;IAIhC;wEACoE;IACpE,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIhD;;;;;;;;iDAQ6C;IAC7C,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS;IAoB9D;;;;;gEAK4D;IAC5D,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;IAiB7D,qFAAqF;IACrF,QAAQ,IAAI,eAAe;CAG5B"}
+{"version":3,"file":"analysis-registry.d.ts","sourceRoot":"","sources":["../src/analysis-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAAqC,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAEhG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGlD;;wDAEwD;AACxD,MAAM,WAAW,YAAY;IAC3B;0CACsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;;8EAG0E;IAC1E,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;GAIG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IAEpE,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI;IAIjD,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAIpE,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAIpE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI7C;;;;;;;OAOG;IACH,mBAAmB,CACjB,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,EAClC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GACnC,IAAI;IAkBP;;;;;;OAMG;IACH,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,YAAY,EAAE;IAoBhE;;;;;;wBAMoB;IACpB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAQtD;;;;;;sFAMkF;IAClF,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAenE;;;;;qDAKiD;IACjD,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAepE,OAAO,CAAC,mBAAmB;IAS3B;;;;;;OAMG;IACH,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,EACxB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAAE,GACzF,IAAI;IAQP;;;;OAIG;IACH,kBAAkB,IAAI,kBAAkB,EAAE;IAI1C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAM/D;;qFAEiF;IACjF,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE;IAUzC,QAAQ,IAAI,MAAM,EAAE;IAIpB;mEAC+D;IAC/D,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE;IAIxC;;;gCAG4B;IAC5B,oBAAoB,IAAI,MAAM,EAAE;IAIhC;wEACoE;IACpE,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIhD;;;;;;;;iDAQ6C;IAC7C,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS;IAqB9D;;;;;gEAK4D;IAC5D,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;IAiB7D,qFAAqF;IACrF,QAAQ,IAAI,eAAe;CAG5B"}

package/dist/analysis-registry.js

@@ -220,17 +220,18 @@ export class AnalysisRegistry {
         const targetDef = this.defs.resolve(targetKind);
         if (!targetDef)
             return undefined;
+        // General single inheritance: the accepted set is the target kind plus every
+        // kind that transitively extends it (subtypes are substitutable). A concrete
+        // target contributes itself and any specializations; an abstract contributes
+        // its implementations. Same transitive index for both.
         const out = new Set();
-        if (targetDef.kind === "Telo.Abstract") {
-            for (const def of this.defs.getByExtends(targetKind)) {
-                const module = def.metadata?.module;
-                if (module && def.metadata?.name) {
-                    out.add(`${module}.${def.metadata.name}`);
-                }
-            }
-        }
-        else {
+        if (targetDef.kind !== "Telo.Abstract")
             out.add(targetKind);
+        for (const def of this.defs.getByExtends(targetKind)) {
+            const module = def.metadata?.module;
+            if (module && def.metadata?.name) {
+                out.add(`${module}.${def.metadata.name}`);
+            }
         }
         return out;
     }

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAmB9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAwjB/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAkyBvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAmBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAoB9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAwxB/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAmzBvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAmBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -1,8 +1,9 @@
 import { canonicalTypeSchemaId } from "@telorun/sdk";
-import { defaultRegistry, isTaggedSentinel } from "@telorun/templating";
+import { defaultRegistry, isRefSentinel, isTaggedSentinel } from "@telorun/templating";
 import { AliasResolver, scopeResolverForModule } from "./alias-resolver.js";
 import { buildCelEnvironment, buildImportInputCelEnvironment, buildTypedCelEnvironment, } from "./cel-environment.js";
 import { DefinitionRegistry } from "./definition-registry.js";
+import { effectiveAuthorSchema } from "./extends-resolution.js";
 import { buildDependencyGraph, formatCycle } from "./dependency-graph.js";
 import { buildKernelGlobalsSchema, mergeKernelGlobalsIntoContext } from "./kernel-globals.js";
 import { computeSuggestKind } from "./kind-suggest.js";
@@ -19,7 +20,9 @@ import { DiagnosticSeverity } from "./types.js";
 import { extractCelRegionScopes, extractContextsFromSchema, getManifestItem, pathMatchesScope, resolveContextAnnotations, resolveTypeFieldToSchema, } from "./validate-cel-context.js";
 import { buildEvalPaths, evalPathsCover } from "./eval-paths.js";
 import { validateExtends } from "./validate-extends.js";
+import { validateBaseMapping } from "./validate-base-mapping.js";
 import { validateNestedInlineResources } from "./validate-nested-inline.js";
+import { validateKindDescriptions } from "./validate-kind-descriptions.js";
 import { validateProviderCoherence } from "./validate-provider-coherence.js";
 import { validateReferences } from "./validate-references.js";
 import { validateReferenceForms } from "./validate-reference-forms.js";
@@ -87,8 +90,12 @@ const SOURCE = "telo-analyzer";
  *  property the user declared in `schema:` plus synthetic `name` / `kind` and
  *  the metadata sub-object (kept open since metadata legitimately carries
  *  arbitrary user-added fields). */
-function buildSelfSchema(definition) {
-    const userSchema = (definition.schema ?? {});
+function buildSelfSchema(definition, defs, aliases) {
+    // The author-facing schema resolves inheritance: with `base:` the child's own
+    // schema (the parent's config is internal); without it, `merge(parent, own)`.
+    const userSchema = (defs
+        ? effectiveAuthorSchema(definition, (k) => defs.resolve(aliases?.resolveKind(k) ?? k) ?? defs.resolve(k))
+        : (definition.schema ?? {}));
     const userProps = (userSchema.properties ?? {});
     const userRequired = Array.isArray(userSchema.required) ? userSchema.required : [];
     return {
@@ -145,7 +152,7 @@ function manifestRootForResolver(m, defs, aliases, allManifests) {
     const inputs = lookupTemplateInputsSchema(m, defs, aliases, allManifests);
     return {
         ...m,
-        schema: buildSelfSchema(m),
+        schema: buildSelfSchema(m, defs, aliases),
         ...(inputs ? { inputType: inputs } : {}),
     };
 }
@@ -186,6 +193,59 @@ function gatherPropertySchemas(schema) {
     }
     return out;
 }
+/**
+ * Generic, role-driven walk over an `x-telo-step-context` step array. Calls
+ * `visit(step, stepPath)` for every step — top-level and nested through the
+ * `x-telo-topology-role` forms (`branch`, `branch-list`, `case-map`). This is
+ * the single definition of how steps nest, shared by `buildStepContextSchema`
+ * (which types `steps.<name>.result`) and `validateStepInvokeReferences` (which
+ * checks invoke refs), so the topology contract lives in one place — adding a
+ * role or nesting form updates both consumers at once. No resource kind is
+ * hardcoded; recursion is driven entirely by the schema annotations.
+ */
+function walkStepArray(steps, stepItemSchema, rootSchema, basePath, visit) {
+    const dispatchRole = (data, role, itemsSchema, path) => {
+        if (role === "branch" && Array.isArray(data)) {
+            walkStepArray(data, stepItemSchema, rootSchema, path, visit);
+        }
+        else if (role === "case-map" && data && typeof data === "object" && !Array.isArray(data)) {
+            for (const [caseKey, arr] of Object.entries(data)) {
+                if (Array.isArray(arr))
+                    walkStepArray(arr, stepItemSchema, rootSchema, `${path}.${caseKey}`, visit);
+            }
+        }
+        else if (role === "branch-list" && Array.isArray(data)) {
+            const entrySchema = resolveLocalRef(itemsSchema, rootSchema);
+            if (!entrySchema)
+                return;
+            data.forEach((entry, i) => {
+                if (!entry || typeof entry !== "object")
+                    return;
+                for (const [subKey, subSchema] of gatherPropertySchemas(entrySchema)) {
+                    const subRole = subSchema["x-telo-topology-role"];
+                    if (typeof subRole !== "string")
+                        continue;
+                    dispatchRole(entry[subKey], subRole, subSchema.items, `${path}[${i}].${subKey}`);
+                }
+            });
+        }
+    };
+    steps.forEach((step, i) => {
+        if (!step || typeof step !== "object")
+            return;
+        const s = step;
+        const stepPath = `${basePath}[${i}]`;
+        visit(s, stepPath);
+        if (!stepItemSchema)
+            return;
+        for (const [propKey, propSchema] of gatherPropertySchemas(stepItemSchema)) {
+            const role = propSchema["x-telo-topology-role"];
+            if (typeof role !== "string")
+                continue;
+            dispatchRole(s[propKey], role, propSchema.items, `${stepPath}.${propKey}`);
+        }
+    });
+}
 /**
  * Build a `steps` context schema from `x-telo-step-context` annotation.
  * Walks each step in the manifest array, resolves the invoked resource's outputType,
@@ -229,80 +289,40 @@ function buildStepContextSchema(manifest, defSchema, allManifests, defs, aliases
             continue;
         const stepItemSchema = resolveLocalRef(fieldSchema.items, defSchema);
         const stepProperties = {};
-        const dispatchRole = (data, role, itemsSchema) => {
-            if (role === "branch" && Array.isArray(data)) {
-                collectSteps(data);
-            }
-            else if (role === "case-map" && data && typeof data === "object" && !Array.isArray(data)) {
-                for (const arr of Object.values(data)) {
-                    if (Array.isArray(arr))
-                        collectSteps(arr);
+        walkStepArray(steps, stepItemSchema, defSchema, fieldName, (s) => {
+            const name = s.name;
+            const invoke = s[invokeField];
+            // Only invoke steps register a `steps.<name>.result` entry — control-flow
+            // wrappers (try/if/while/switch/throw) don't produce a result and must
+            // not shadow real entries with a permissive `additionalProperties: true`,
+            // or unknown step references slip through chain validation.
+            if (typeof name !== "string" || !invoke || typeof invoke !== "object")
+                return;
+            let outputSchema;
+            const invokedKind = invoke.kind;
+            const invokedName = invoke.name;
+            if (invokedName) {
+                const invokedManifest = allManifests.find((m) => m.metadata?.name === invokedName &&
+                    (!invokedKind || m.kind === invokedKind));
+                if (invokedManifest) {
+                    outputSchema = resolveTypeFieldToSchema(invokedManifest[outputTypeField], allManifests);
                 }
             }
-            else if (role === "branch-list" && Array.isArray(data)) {
-                const entrySchema = resolveLocalRef(itemsSchema, defSchema);
-                if (!entrySchema)
-                    return;
-                for (const entry of data) {
-                    if (!entry || typeof entry !== "object")
-                        continue;
-                    for (const [subKey, subSchema] of gatherPropertySchemas(entrySchema)) {
-                        const subRole = subSchema["x-telo-topology-role"];
-                        if (typeof subRole !== "string")
-                            continue;
-                        dispatchRole(entry[subKey], subRole, subSchema.items);
-                    }
-                }
+            else {
+                outputSchema = resolveTypeFieldToSchema(invoke[outputTypeField], allManifests);
             }
-        };
-        function collectSteps(items) {
-            for (const step of items) {
-                if (!step || typeof step !== "object")
-                    continue;
-                const s = step;
-                const name = s.name;
-                const invoke = s[invokeField];
-                // Only invoke steps register a `steps.<name>.result` entry — control-flow
-                // wrappers (try/if/while/switch/throw) don't produce a result and must
-                // not shadow real entries with a permissive `additionalProperties: true`,
-                // or unknown step references slip through chain validation.
-                if (typeof name === "string" && invoke && typeof invoke === "object") {
-                    let outputSchema;
-                    const invokedKind = invoke.kind;
-                    const invokedName = invoke.name;
-                    if (invokedName) {
-                        const invokedManifest = allManifests.find((m) => m.metadata?.name === invokedName &&
-                            (!invokedKind || m.kind === invokedKind));
-                        if (invokedManifest) {
-                            outputSchema = resolveTypeFieldToSchema(invokedManifest[outputTypeField], allManifests);
-                        }
-                    }
-                    else {
-                        outputSchema = resolveTypeFieldToSchema(invoke[outputTypeField], allManifests);
-                    }
-                    // Fallback: pull outputType from the kind's Telo.Definition. The
-                    // resource manifest typically doesn't carry outputType; the def does.
-                    if (!outputSchema && invokedKind) {
-                        outputSchema = lookupDefinitionTypeField(invokedKind, outputTypeField, defs, aliases, allManifests);
-                    }
-                    stepProperties[name] = {
-                        type: "object",
-                        properties: {
-                            result: outputSchema ?? { type: "object", additionalProperties: true },
-                        },
-                    };
-                }
-                if (stepItemSchema) {
-                    for (const [propKey, propSchema] of gatherPropertySchemas(stepItemSchema)) {
-                        const role = propSchema["x-telo-topology-role"];
-                        if (typeof role !== "string")
-                            continue;
-                        dispatchRole(s[propKey], role, propSchema.items);
-                    }
-                }
+            // Fallback: pull outputType from the kind's Telo.Definition. The
+            // resource manifest typically doesn't carry outputType; the def does.
+            if (!outputSchema && invokedKind) {
+                outputSchema = lookupDefinitionTypeField(invokedKind, outputTypeField, defs, aliases, allManifests);
             }
-        }
-        collectSteps(steps);
+            stepProperties[name] = {
+                type: "object",
+                properties: {
+                    result: outputSchema ?? { type: "object", additionalProperties: true },
+                },
+            };
+        });
         if (Object.keys(stepProperties).length > 0) {
             return {
                 type: "object",
@@ -312,6 +332,178 @@ function buildStepContextSchema(manifest, defSchema, allManifests, defs, aliases
     }
     return undefined;
 }
+/**
+ * Capabilities whose instances structurally expose no `invoke`/`run` method, so
+ * a step `invoke` of one always fails at runtime with ERR_RESOURCE_NOT_INVOKABLE
+ * (kernel dispatch checks method presence, not capability — evaluation-context.ts).
+ * `Telo.Service` is intentionally absent: some services are invocable (a function
+ * handler dispatched directly, e.g. `Lambda.Function`), so it can't be rejected
+ * statically without false positives. This is the sound subset of the runtime rule.
+ */
+const NON_INVOKABLE_CAPABILITIES = new Set([
+    "Telo.Provider",
+    "Telo.Mount",
+    "Telo.Type",
+    "Telo.Template",
+]);
+/**
+ * Validate `x-telo-step-context` step `invoke` references (e.g. `Run.Sequence`
+ * steps).
+ *
+ * The reference field map deliberately does NOT descend into step `invoke`
+ * slots — they sit behind a local `$ref` to the shared step definition, and
+ * turning the descent on would make Phase 5 inject live instances there,
+ * breaking the invoke dispatch path (see `reference-field-map.ts`). A
+ * consequence is that `validateReferences` never sees these slots, so a bad
+ * step invoke passes `telo check` and only fails at runtime. This pass covers
+ * exactly those slots, in two dimensions:
+ *   - Existence: an `invoke: !ref <name>` that names a missing instance — or a
+ *     *kind* instead of an exported instance (`!ref Stream.Of`) — is a still-a-
+ *     sentinel after Phase 2.5 resolution → `UNRESOLVED_REFERENCE` (runtime
+ *     `ERR_RESOURCE_NOT_FOUND`).
+ *   - Invokability: a resolved instance whose capability structurally has no
+ *     invoke/run method (`NON_INVOKABLE_CAPABILITIES`) → `REFERENCE_KIND_MISMATCH`
+ *     (runtime `ERR_RESOURCE_NOT_INVOKABLE`).
+ *
+ * Generic and topology-driven — it walks steps via the same `x-telo-step-context`
+ * / `x-telo-topology-role` annotations `buildStepContextSchema` uses (through the
+ * shared `walkStepArray`), so nested branches (then/else/do/catch/cases) are
+ * covered and no `Run.Sequence` field name is hardcoded. The cross-module
+ * partial-analysis guard mirrors `validateReferences`, so a reference into an
+ * unloaded import is skipped rather than false-flagged.
+ */
+function validateStepInvokeReferences(allManifests, defs, aliases) {
+    const diagnostics = [];
+    // Local instance names + loaded-module set — same construction as
+    // validateReferences, so the cross-module guard behaves identically.
+    const localNames = new Set();
+    const loadedModules = new Set();
+    // Also collect names of resources nested inside a manifest tree — notably
+    // `with:`-scoped resources (an `x-telo-scope` region the field map does not
+    // extract to a top-level manifest). A step can invoke one by bare name, so
+    // omitting them would false-flag a valid `!ref`. Conservative: any nested
+    // object carrying both a `kind` and a `metadata.name` is a resource
+    // definition; scope visibility is left to the runtime.
+    const collectNestedNames = (value) => {
+        if (!value || typeof value !== "object" || isTaggedSentinel(value))
+            return;
+        if (Array.isArray(value)) {
+            for (const item of value)
+                collectNestedNames(item);
+            return;
+        }
+        const obj = value;
+        const name = obj.metadata?.name;
+        if (typeof obj.kind === "string" && typeof name === "string")
+            localNames.add(name);
+        for (const v of Object.values(obj))
+            collectNestedNames(v);
+    };
+    for (const r of allManifests) {
+        if (r.kind === "Telo.Import") {
+            const m = r.metadata?.resolvedModuleName;
+            if (typeof m === "string")
+                loadedModules.add(m);
+            continue;
+        }
+        const meta = r.metadata;
+        if (typeof meta?.name !== "string" || REF_VALIDATION_SKIP_KINDS.has(r.kind))
+            continue;
+        if (meta.forwardedExport === true) {
+            if (typeof meta.module === "string")
+                loadedModules.add(meta.module);
+            continue;
+        }
+        localNames.add(meta.name);
+        collectNestedNames(r);
+    }
+    const validateInvoke = (value, resource, filePath, path) => {
+        if (isRefSentinel(value)) {
+            // An unresolved `!ref` is a miss: a real instance would have resolved to
+            // `{kind, name}` in Phase 2.5.
+            const refName = value.source;
+            const dot = refName.indexOf(".");
+            const aliasPrefix = dot > 0 ? refName.slice(0, dot) : undefined;
+            if (aliasPrefix && aliasPrefix !== "Self" && aliases.hasAlias(aliasPrefix)) {
+                const module = aliases.moduleForAlias(aliasPrefix);
+                // Partial single-file analysis (import not loaded) — skip to avoid a false miss.
+                if (module && !loadedModules.has(module))
+                    return;
+                diagnostics.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: "UNRESOLVED_REFERENCE",
+                    source: SOURCE,
+                    message: `${resource.kind}/${resource.name}: step invoke at '${path}' → '${refName}' is not an exported instance of module '${module ?? aliasPrefix}' (reference a declared instance, not a kind)`,
+                    data: { resource, filePath, path },
+                });
+                return;
+            }
+            const localName = aliasPrefix === "Self" ? refName.slice(dot + 1) : refName;
+            if (localNames.has(localName))
+                return;
+            diagnostics.push({
+                severity: DiagnosticSeverity.Error,
+                code: "UNRESOLVED_REFERENCE",
+                source: SOURCE,
+                message: `${resource.kind}/${resource.name}: step invoke at '${path}' → resource '${localName}' not found`,
+                data: { resource, filePath, path },
+            });
+            return;
+        }
+        // Resolved `{kind, name}` (or an inline `{kind, …}` definition) — the
+        // instance exists. Mirror the kernel's ERR_RESOURCE_NOT_INVOKABLE, which
+        // fires when the instance has neither an `invoke` nor a `run` method
+        // (evaluation-context.ts). That is a per-instance property, not a pure
+        // capability, so only capabilities that STRUCTURALLY expose no such method
+        // are rejected statically — Service is intentionally excluded, since some
+        // services are invocable (e.g. a function handler dispatched directly).
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            return;
+        const kind = value.kind;
+        if (typeof kind !== "string")
+            return;
+        const capability = defs.resolve(aliases.resolveKind(kind) ?? kind)?.capability;
+        if (typeof capability === "string" && NON_INVOKABLE_CAPABILITIES.has(capability)) {
+            diagnostics.push({
+                severity: DiagnosticSeverity.Error,
+                code: "REFERENCE_KIND_MISMATCH",
+                source: SOURCE,
+                message: `${resource.kind}/${resource.name}: step invoke at '${path}' → '${kind}' is a ${capability} and cannot be invoked in a step — it has no invoke or run method (runtime ERR_RESOURCE_NOT_INVOKABLE)`,
+                data: { resource, filePath, path },
+            });
+        }
+    };
+    for (const m of allManifests) {
+        const meta = m.metadata;
+        if (typeof meta?.name !== "string" ||
+            REF_VALIDATION_SKIP_KINDS.has(m.kind) ||
+            meta.forwardedExport === true)
+            continue;
+        const def = defs.resolve(aliases.resolveKind(m.kind) ?? m.kind);
+        const defSchema = def?.schema;
+        if (!defSchema?.properties)
+            continue;
+        const resource = { kind: m.kind, name: meta.name };
+        const filePath = typeof meta.source === "string" ? meta.source : undefined;
+        for (const [fieldName, fieldSchema] of Object.entries(defSchema.properties)) {
+            const stepCtx = fieldSchema["x-telo-step-context"];
+            const invokeField = stepCtx?.invoke;
+            if (!invokeField)
+                continue;
+            const steps = m[fieldName];
+            if (!Array.isArray(steps))
+                continue;
+            const stepItemSchema = resolveLocalRef(fieldSchema.items, defSchema);
+            walkStepArray(steps, stepItemSchema, defSchema, fieldName, (s, stepPath) => {
+                const invoke = s[invokeField];
+                if (invoke === undefined || invoke === null)
+                    return;
+                validateInvoke(invoke, resource, filePath, `${stepPath}.${invokeField}`);
+            });
+        }
+    }
+    return diagnostics;
+}
 /**
  * Collect every field annotated with `x-telo-error-context` anywhere in a
  * definition schema (resolving local `$ref`s into `$defs`, cycle-safe), mapping
@@ -865,20 +1057,25 @@ export class StaticAnalyzer {
                 });
                 continue;
             }
-            // Validate resource config against definition schema.
+            // Validate resource config against the definition's AUTHOR-FACING schema —
+            // inheritance-resolved: with `base:` the child's own schema (parent config
+            // is internal), else `merge(parent, own)` so a `base:`-less `extends` child
+            // is validated against the inherited fields it may set. For a definition
+            // that neither extends nor uses `base:` this is exactly its own schema.
             // `kind` and `metadata` are implicit on every resource — inject them so module
             // authors don't have to repeat them when using additionalProperties: false.
-            if (definition.schema) {
-                const schema = definition.schema.additionalProperties === false
+            const authorSchema = effectiveAuthorSchema(definition, (k) => defs.resolve(aliases.resolveKind(k) ?? k) ?? defs.resolve(k));
+            if (authorSchema && Object.keys(authorSchema).length > 0) {
+                const schema = authorSchema.additionalProperties === false
                     ? {
-                        ...definition.schema,
+                        ...authorSchema,
                         properties: {
                             kind: { type: "string" },
                             metadata: { type: "object" },
-                            ...definition.schema.properties,
+                            ...authorSchema.properties,
                         },
                     }
-                    : definition.schema;
+                    : authorSchema;
                 // Phase 1: CEL type checking — walk data+schema together, check env.check() return types.
                 // A Telo.Import's variables/secrets are a config-only contract evaluated against the
                 // IMPORTING module's scope, so type them from the owning module doc (matched by
@@ -1177,10 +1374,17 @@ export class StaticAnalyzer {
         }, { aliases });
         // Validate resource references (Phase 3)
         diagnostics.push(...validateReferences(allManifests, { aliases, definitions: defs, aliasesByModule }));
+        // Validate step `invoke` references — the slots the reference field map
+        // deliberately skips (behind the step `$ref`), so a missing instance or a
+        // kind-instead-of-instance ref there is caught statically, not at runtime.
+        diagnostics.push(...validateStepInvokeReferences(allManifests, defs, aliases));
         // Validate `extends` fields and flag legacy `capability: <UserAbstract>` overload.
         diagnostics.push(...validateExtends(allManifests, defs, aliases));
+        diagnostics.push(...validateBaseMapping(allManifests, defs, aliases));
         // Validate provider coherence rules for `provide:` template-target definitions.
         diagnostics.push(...validateProviderCoherence(allManifests, defs, aliases));
+        // Warn about exported kinds lacking a metadata.description (semantic-search input).
+        diagnostics.push(...validateKindDescriptions(allManifests));
         // Validate throws: declarations and catches: coverage (rules 1, 2, 4, 7)
         diagnostics.push(...validateThrowsCoverage(allManifests, defs, aliases, this.celEnv, aliasesByModule, rootModules));
         // Warn about declared variables / secrets / ports that no CEL references.

package/dist/builtins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EAwiB/C,CAAC"}
+{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EAujB/C,CAAC"}

package/dist/builtins.js

@@ -207,6 +207,21 @@ export const KERNEL_BUILTINS = [
                         },
                     },
                 },
+                // `base:` ("super(...)") — construction mapping for an inherited
+                // (concrete-`extends`) definition. Its CEL is evaluated once against
+                // `self` (typed from this definition's `schema:`) to build the parent
+                // kind's config. Same `self`-only scope as a resource body.
+                base: {
+                    type: "object",
+                    additionalProperties: true,
+                    "x-telo-context": {
+                        type: "object",
+                        additionalProperties: false,
+                        properties: {
+                            self: { "x-telo-context-from-root": "schema" },
+                        },
+                    },
+                },
             },
         },
     },

package/dist/definition-registry.d.ts

@@ -65,7 +65,10 @@ export declare class DefinitionRegistry {
      *  Returns undefined when the string is malformed or the identity is not registered. */
     resolveRef(xTeloRef: string): string | undefined;
     resolve(kind: string): ResourceDefinition | undefined;
-    /** Returns the cached reference field map for the given kind, built once during register(). */
+    /** Returns the reference field map for the given kind, computed lazily from the
+     *  kind's AUTHOR-FACING (inheritance-resolved) schema and memoized. Lazy so a
+     *  child registered before its parent still sees the parent's inherited ref
+     *  slots once both are present. */
     getFieldMap(kind: string): ReferenceFieldMap | undefined;
     /** Returns the field map for `kind`, falling back to the alias-resolved kind when not found. */
     getFieldMapForKind(kind: string, aliases?: {

package/dist/definition-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"definition-registry.d.ts","sourceRoot":"","sources":["../src/definition-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAGlC,+EAA+E;AAC/E,qBAAa,kBAAkB;;IAK7B;;sFAEkF;IAClF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IAEzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyC;IAC9D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D;6DACyD;IACzD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD;;0EAEsE;IACtE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA6B;IAEhE,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI;IAiC9C,OAAO,CAAC,aAAa;IASrB;;;yFAGqF;IACrF,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IA+B1E;;;;iFAI6E;IAC7E,uBAAuB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI;IAMtE;uFACmF;IACnF,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAIhC;4EACwE;IACxE,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAMnE;;;;oFAIgF;IAChF,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE;IAWtE;;;;;;iCAM6B;IAC7B,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,GAAG,SAAS;IASnE,OAAO,CAAC,iBAAiB;IAczB;;;;;;;;4FAQwF;IACxF,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAUhD,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAIrD,+FAA+F;IAC/F,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAIxD,gGAAgG;IAChG,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,GACvD,iBAAiB,GAAG,SAAS;IAOhC;;;;;;;;qFAQiF;IACjF,2BAA2B,CACzB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC1C,iBAAiB,GAAG,SAAS;IAkChC,OAAO,CAAC,uBAAuB;IA+B/B;;qEAEiE;IACjE,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAgBxD,KAAK,IAAI,MAAM,EAAE;CAGlB"}
+{"version":3,"file":"definition-registry.d.ts","sourceRoot":"","sources":["../src/definition-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAIlC,+EAA+E;AAC/E,qBAAa,kBAAkB;;IAK7B;;sFAEkF;IAClF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IAEzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyC;IAC9D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D;6DACyD;IACzD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD;;0EAEsE;IACtE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA6B;IAEhE,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI;IAqC9C,OAAO,CAAC,aAAa;IASrB;;;yFAGqF;IACrF,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IA+B1E;;;;iFAI6E;IAC7E,uBAAuB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI;IAMtE;uFACmF;IACnF,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAIhC;4EACwE;IACxE,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAMnE;;;;oFAIgF;IAChF,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE;IAWtE;;;;;;iCAM6B;IAC7B,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,GAAG,SAAS;IASnE,OAAO,CAAC,iBAAiB;IAczB;;;;;;;;4FAQwF;IACxF,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAUhD,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAIrD;;;uCAGmC;IACnC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAWxD,gGAAgG;IAChG,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,GACvD,iBAAiB,GAAG,SAAS;IAOhC;;;;;;;;qFAQiF;IACjF,2BAA2B,CACzB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC1C,iBAAiB,GAAG,SAAS;IAkChC,OAAO,CAAC,uBAAuB;IA+B/B;;qEAEiE;IACjE,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAgBxD,KAAK,IAAI,MAAM,EAAE;CAGlB"}

package/dist/definition-registry.js

@@ -1,6 +1,7 @@
 import { KERNEL_BUILTINS } from "./builtins.js";
 import { buildFieldMapAtPath, buildReferenceFieldMap, isSchemaFromEntry, } from "./reference-field-map.js";
 import { createAjv, formatSingleError, navigateJsonPointer } from "./schema-compat.js";
+import { effectiveAuthorSchema } from "./extends-resolution.js";
 /** Pure kind → ResourceDefinition map. No controller loading, no lifecycle. */
 export class DefinitionRegistry {
     constructor() {
@@ -27,7 +28,11 @@ export class DefinitionRegistry {
         const { name, module: mod } = definition.metadata;
         const key = mod ? `${mod}.${name}` : name;
         this.defs.set(key, definition);
-        this.fieldMaps.set(key, buildReferenceFieldMap(definition.schema ?? {}));
+        // Field maps derive from the AUTHOR-FACING (inheritance-resolved) schema, which
+        // depends on the parent — possibly registered after this child. Clear the cache
+        // so any already-computed map recomputes against the now-larger def set; the
+        // maps rebuild lazily on first `getFieldMap` (after all defs are registered).
+        this.fieldMaps.clear();
         // `capability` populates extendedBy for backward-compat with the legacy pattern where
         // a concrete definition overloaded `capability: <AbstractKind>` to mean "implements
         // this abstract." The canonical pattern is `extends` (below). Both populate the index,
@@ -186,9 +191,21 @@ export class DefinitionRegistry {
     resolve(kind) {
         return this.defs.get(kind);
     }
-    /** Returns the cached reference field map for the given kind, built once during register(). */
+    /** Returns the reference field map for the given kind, computed lazily from the
+     *  kind's AUTHOR-FACING (inheritance-resolved) schema and memoized. Lazy so a
+     *  child registered before its parent still sees the parent's inherited ref
+     *  slots once both are present. */
     getFieldMap(kind) {
-        return this.fieldMaps.get(kind);
+        const cached = this.fieldMaps.get(kind);
+        if (cached)
+            return cached;
+        const def = this.defs.get(kind);
+        if (!def)
+            return undefined;
+        const schema = effectiveAuthorSchema(def, (k) => this.resolve(k));
+        const map = buildReferenceFieldMap(schema ?? {});
+        this.fieldMaps.set(kind, map);
+        return map;
     }
     /** Returns the field map for `kind`, falling back to the alias-resolved kind when not found. */
     getFieldMapForKind(kind, aliases) {

package/dist/extends-resolution.d.ts

@@ -0,0 +1,33 @@
+import type { ResourceDefinition } from "@telorun/sdk";
+/** Resolves a kind string (canonical or alias form, depending on the caller's
+ *  registry) to its `Telo.Definition` / `Telo.Abstract`, or undefined. */
+export type DefResolver = (kind: string) => ResourceDefinition | undefined;
+/** The definition a given definition directly `extends`, or undefined when it
+ *  extends nothing / the target can't be resolved. */
+export declare function resolveParent(def: ResourceDefinition | undefined, resolve: DefResolver): ResourceDefinition | undefined;
+/** The `extends` ancestor chain, nearest-first, excluding `def` itself.
+ *  Cycle-guarded so a malformed self/mutual `extends` can't loop forever. */
+export declare function ancestorChain(def: ResourceDefinition | undefined, resolve: DefResolver): ResourceDefinition[];
+/** True when a definition carries its own controller (`controllers:`) or a
+ *  template body (`invoke:` / `run:` / `provide:` / `mount:` / `resources:`). */
+export declare function hasOwnControllerOrTemplate(def: ResourceDefinition | undefined): boolean;
+/** The nearest concrete ancestor that provides a controller (own `controllers:`
+ *  or a template body) — the definition whose controller an inherited child
+ *  delegates to. Undefined when no controller-bearing concrete ancestor exists. */
+export declare function controllerBearingAncestor(def: ResourceDefinition | undefined, resolve: DefResolver): ResourceDefinition | undefined;
+/** True when this definition inherits its controller by delegation: it declares
+ *  `extends`, has no own controller/template body, and its nearest concrete
+ *  ancestor is controller-bearing. */
+export declare function isInheritedDelegation(def: ResourceDefinition | undefined, resolve: DefResolver): boolean;
+/** The effective (possibly inherited) capability: the nearest self-or-ancestor
+ *  that declares a `capability`. Undefined when none in the chain does. */
+export declare function inheritedCapability(def: ResourceDefinition | undefined, resolve: DefResolver): string | undefined;
+/** The author-facing schema for a definition:
+ *  - with `base:` present → the definition's **own** schema (the parent's config
+ *    fields are internal, set solely through `base:`).
+ *  - without `base:` but with `extends` → `merge(parent-effective, own)` (a pure
+ *    additive extension; child overrides on key conflicts), reusing the same
+ *    `mergeTypeSchemas` that `Type.JsonSchema.extends` uses.
+ *  - no `extends` → the own schema unchanged. */
+export declare function effectiveAuthorSchema(def: ResourceDefinition | undefined, resolve: DefResolver): Record<string, any>;
+//# sourceMappingURL=extends-resolution.d.ts.map

package/dist/extends-resolution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extends-resolution.d.ts","sourceRoot":"","sources":["../src/extends-resolution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAGvD;0EAC0E;AAC1E,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,kBAAkB,GAAG,SAAS,CAAC;AAqB3E;sDACsD;AACtD,wBAAgB,aAAa,CAC3B,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,kBAAkB,GAAG,SAAS,CAIhC;AAED;6EAC6E;AAC7E,wBAAgB,aAAa,CAC3B,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,kBAAkB,EAAE,CAUtB;AAED;iFACiF;AACjF,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,kBAAkB,GAAG,SAAS,GAAG,OAAO,CAUvF;AAED;;mFAEmF;AACnF,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,kBAAkB,GAAG,SAAS,CAMhC;AAED;;sCAEsC;AACtC,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,OAAO,CAGT;AAED;2EAC2E;AAC3E,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,MAAM,GAAG,SAAS,CAMpB;AAED;;;;;;iDAMiD;AACjD,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAOrB"}