@telorun/analyzer 0.42.0 → 0.44.0

package/dist/manifest-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest-loader.d.ts","sourceRoot":"","sources":["../src/manifest-loader.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAGV,UAAU,EACV,WAAW,EACX,YAAY,EACb,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAIL,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACpB,MAAM,YAAY,CAAC;AAwCpB,qBAAa,MAAM;IACjB;;;yEAGqE;IACrE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiC;IAE3D;;;;;8BAK0B;IAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IAEzD,SAAS,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IAErC;;;;mBAIe;gBACH,OAAO,GAAE,cAAc,EAAO,EAAE,OAAO,GAAE,iBAAsB;IAK3E,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;IAKtC,OAAO,CAAC,IAAI;IAMN,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUrD;;;;2CAIuC;IACvC,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAM7C;;;+BAG2B;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAyCvE;;;;gEAI4D;IAC5D,OAAO,CAAC,oBAAoB;IAa5B;gFAC4E;IAC5E,OAAO,CAAC,cAAc;IAQtB;;wEAEoE;IAC9D,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;IAsB3E;;;qCAGiC;IAC3B,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAgI9E;;;;;;;;sBAQkB;IAClB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAOlE,OAAO,CAAC,6BAA6B;IAarC,OAAO,CAAC,mCAAmC;IAc3C,OAAO,CAAC,2BAA2B;YAkCrB,eAAe;IAmB7B;;;0CAGsC;IAChC,gBAAgB,CACpB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC;QAAE,KAAK,EAAE,WAAW,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CA0B5D"}
+{"version":3,"file":"manifest-loader.d.ts","sourceRoot":"","sources":["../src/manifest-loader.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAGV,UAAU,EACV,WAAW,EACX,YAAY,EACb,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAIL,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACpB,MAAM,YAAY,CAAC;AAwCpB,qBAAa,MAAM;IACjB;;;yEAGqE;IACrE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiC;IAE3D;;;;;8BAK0B;IAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IAEzD,SAAS,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IAErC;;;;mBAIe;gBACH,OAAO,GAAE,cAAc,EAAO,EAAE,OAAO,GAAE,iBAAsB;IAK3E,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;IAKtC,OAAO,CAAC,IAAI;IAMN,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUrD;;;;2CAIuC;IACvC,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAM7C;;;+BAG2B;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAyCvE;;;;gEAI4D;IAC5D,OAAO,CAAC,oBAAoB;IAa5B;gFAC4E;IAC5E,OAAO,CAAC,cAAc;IAQtB;;wEAEoE;IAC9D,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;IAsB3E;;;qCAGiC;IAC3B,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAiI9E;;;;;;;;sBAQkB;IAClB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAOlE,OAAO,CAAC,6BAA6B;IAarC,OAAO,CAAC,mCAAmC;IAc3C,OAAO,CAAC,2BAA2B;YAkCrB,eAAe;IAmB7B;;;0CAGsC;IAChC,gBAAgB,CACpB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC;QAAE,KAAK,EAAE,WAAW,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CA0B5D"}

package/dist/manifest-loader.js

@@ -274,6 +274,7 @@ export class Loader {
                     }
                     aliases.set(alias, {
                         targetSource: targetCanonical,
+                        targetRef: importSource,
                         targetModuleName,
                         targetNamespace,
                     });

package/dist/reconcile-module-versions.d.ts

@@ -13,8 +13,8 @@ export interface VersionReconciliation {
     diagnostics: AnalysisDiagnostic[];
 }
 /**
- * Reconcile a loaded import graph so each module identity (`namespace/name`)
- * resolves to a single version. Within a shared major the highest version wins
+ * Reconcile a loaded import graph so each module location (an import ref minus
+ * its version) resolves to a single version. Within a shared major the highest version wins
  * (a non-lossy hoist, given Telo's additive-only pre-1.0 policy); a major
  * mismatch is a hard conflict. Mutates `importEdges` in place — every edge that
  * pointed at a losing source is repointed at the winner — so `flattenForAnalyzer`

package/dist/reconcile-module-versions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reconcile-module-versions.d.ts","sourceRoot":"","sources":["../src/reconcile-module-versions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAElE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;0CAI0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,gEAAgE;IAChE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;2EACuE;IACvE,WAAW,EAAE,kBAAkB,EAAE,CAAC;CACnC;AAwKD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,EAClC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,GAChD,qBAAqB,CAiDvB"}
+{"version":3,"file":"reconcile-module-versions.d.ts","sourceRoot":"","sources":["../src/reconcile-module-versions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAElE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;0CAI0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,gEAAgE;IAChE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;2EACuE;IACvE,WAAW,EAAE,kBAAkB,EAAE,CAAC;CACnC;AAuMD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,EAClC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,GAChD,qBAAqB,CAsEvB"}

package/dist/reconcile-module-versions.js

@@ -64,27 +64,56 @@ function compareVersions(a, b) {
     }
     return 0;
 }
-/** Read a loaded module's `namespace/name` identity, version, and raw owner
- *  text. Returns `null` for modules without a namespace: only a registry
- *  identity (`<namespace>/<name>`) is a stable cross-import key. Two namespace-
- *  less local libraries that merely share a `metadata.name` are distinct modules
- *  reached via distinct source URLs — reconciling them would drop one and break
- *  its kinds; the same local file reached via two paths is already collapsed by
- *  canonical-source dedup, so there is nothing left to reconcile here. */
-function moduleIdentityOf(mod) {
+/** The location identity of an import ref: the ref with its version stripped.
+ *  Two refs share an identity when they address the same module at different
+ *  versions, whatever transport owns them:
+ *
+ *    "std/kv-store@0.3.0"             → "std/kv-store"
+ *    "oci://ghcr.io/acme/s3@1.2.0"    → "oci://ghcr.io/acme/s3"
+ *    "https://x.com/lib/telo.yaml"    → itself (a URL carries no version)
+ *
+ *  Returns `null` for a relative path, which addresses one file on the
+ *  publisher's disk and is therefore not a cross-import key: two local libraries
+ *  that merely agree on `metadata.name` are distinct modules, and reconciling
+ *  them would drop one and break its kinds. The same local file reached via two
+ *  paths is already collapsed by canonical-source dedup.
+ *
+ *  **What this key cannot relate.** It compares ref *spellings*, so it groups by
+ *  origin exactly and nothing else. Two consequences, both accepted:
+ *
+ *  - A module imported once by a registry ref and once by a relative path is two
+ *    groups, so a version skew between them is not hoisted. Keying on what the
+ *    module declares about itself would catch that case, but only by trusting a
+ *    self-declared identity — which is what this change removes, and which
+ *    cannot tell two same-named modules from different origins apart.
+ *  - A bare `std/kv-store@0.4.0` and the equivalent direct
+ *    `https://<registry>/std/kv-store/0.4.0/telo.yaml` are two groups. Relating
+ *    them needs the configured registry base, which this pure, browser-safe
+ *    function does not have. */
+function refIdentity(ref) {
+    const base = ref.split("#")[0];
+    if (!base || base.startsWith(".") || base.startsWith("/") || base.startsWith("file:")) {
+        return null;
+    }
+    const lastSlash = base.lastIndexOf("/");
+    const at = base.lastIndexOf("@");
+    return at > lastSlash && at > 0 ? base.slice(0, at) : base;
+}
+/** Read a loaded module's version and raw owner text under the location
+ *  identity the import edge reached it by. The identity comes from the ref, not
+ *  from anything the module declares about itself — a module's own metadata
+ *  cannot distinguish two same-named modules published to different origins. */
+function moduleIdentityOf(mod, identity) {
     const doc = mod.owner.manifests.find((m) => m && isModuleKind(m.kind));
     if (!doc)
         return null;
     const meta = doc.metadata;
-    const name = meta?.name;
-    if (typeof name !== "string" || name.length === 0)
-        return null;
-    if (typeof meta.namespace !== "string" || meta.namespace.length === 0)
+    if (typeof meta?.name !== "string" || meta.name.length === 0)
         return null;
     const version = typeof meta.version === "string" ? meta.version : "";
     return {
         source: mod.owner.source,
-        identity: `${meta.namespace}/${name}`,
+        identity,
         version,
         parsed: parseVersion(version),
         text: mod.owner.text,
@@ -154,8 +183,8 @@ function hoistDiagnostic(identity, importerSource, alias, loser, winner, conflic
     return null;
 }
 /**
- * Reconcile a loaded import graph so each module identity (`namespace/name`)
- * resolves to a single version. Within a shared major the highest version wins
+ * Reconcile a loaded import graph so each module location (an import ref minus
+ * its version) resolves to a single version. Within a shared major the highest version wins
  * (a non-lossy hoist, given Telo's additive-only pre-1.0 policy); a major
  * mismatch is a hard conflict. Mutates `importEdges` in place — every edge that
  * pointed at a losing source is repointed at the winner — so `flattenForAnalyzer`
@@ -165,10 +194,33 @@ function hoistDiagnostic(identity, importerSource, alias, loser, winner, conflic
 export function reconcileModuleVersions(modules, importEdges) {
     const overrides = new Map();
     const diagnostics = [];
+    // Location identity per resolved module, taken from the ref that reached it.
+    // Two refs at different versions resolve to different canonical sources, so a
+    // source normally maps to exactly one identity; the entry module has no
+    // inbound edge and needs none (it is never reconciled against itself).
+    //
+    // One source CAN be reached by two spellings of the same location (a bare
+    // registry ref and the direct URL it resolves to). Both name the same module
+    // at the same version, so either identity groups it correctly — but the choice
+    // must not depend on edge iteration order, or the same graph could reconcile
+    // differently across runs. First edge wins.
+    const identityBySource = new Map();
+    for (const aliasMap of importEdges.values()) {
+        for (const edge of aliasMap.values()) {
+            if (identityBySource.has(edge.targetSource))
+                continue;
+            const identity = refIdentity(edge.targetRef);
+            if (identity)
+                identityBySource.set(edge.targetSource, identity);
+        }
+    }
     const groups = new Map();
     const infoBySource = new Map();
-    for (const mod of modules.values()) {
-        const info = moduleIdentityOf(mod);
+    for (const [source, mod] of modules) {
+        const identity = identityBySource.get(source);
+        if (!identity)
+            continue;
+        const info = moduleIdentityOf(mod, identity);
         if (!info)
             continue;
         infoBySource.set(info.source, info);

package/dist/reference-field-map.d.ts

@@ -1,6 +1,7 @@
 /** An entry for a field that carries one or more x-telo-ref constraints. */
 export interface RefFieldEntry {
-    /** One or more canonical ref strings ("namespace/module#TypeName" or "telo#TypeName").
+    /** One or more canonical kind keys ("<module>.<Kind>"), or the deprecated
+     *  identity form ("<namespace>/<module>#<Kind>") for a legacy published module.
      *  Multiple entries arise from anyOf branches. */
     refs: string[];
     /** True when the field path traversed through at least one array (path contains "[]"). */

package/dist/reference-field-map.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reference-field-map.d.ts","sourceRoot":"","sources":["../src/reference-field-map.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,MAAM,WAAW,aAAa;IAC5B;sDACkD;IAClD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,0FAA0F;IAC1F,OAAO,EAAE,OAAO,CAAC;IACjB;8DAC0D;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9B;;;;;;;;;;kCAU8B;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAC9B;2CACuC;IACvC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC1B;AAED;8CAC8C;AAC9C,MAAM,WAAW,oBAAoB;IACnC;;qFAEiF;IACjF,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,eAAe,GAAG,oBAAoB,CAAC;AAEnF;0FAC0F;AAC1F,MAAM,MAAM,iBAAiB,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAE3D,wBAAgB,UAAU,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,IAAI,aAAa,CAEvE;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,IAAI,eAAe,CAE3E;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,IAAI,oBAAoB,CAErF;AAED,oGAAoG;AACpG,eAAO,MAAM,cAAc,aAAwC,CAAC;AAEpE;;;;;;;;;2EAS2E;AAC3E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAItE;AAED;;;;sEAIsE;AACtE,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;wDAUwD;AACxD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAoCpF;AAED;+DAC+D;AAC/D,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,EAAE,CAExE;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,iBAAiB,CAQrF;AASD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE,CAa/D;AAED;;;8CAG8C;AAC9C,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,EAAE,MAAM,GACjB,iBAAiB,CAInB"}
+{"version":3,"file":"reference-field-map.d.ts","sourceRoot":"","sources":["../src/reference-field-map.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,MAAM,WAAW,aAAa;IAC5B;;sDAEkD;IAClD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,0FAA0F;IAC1F,OAAO,EAAE,OAAO,CAAC;IACjB;8DAC0D;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9B;;;;;;;;;;kCAU8B;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAC9B;2CACuC;IACvC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC1B;AAED;8CAC8C;AAC9C,MAAM,WAAW,oBAAoB;IACnC;;qFAEiF;IACjF,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,eAAe,GAAG,oBAAoB,CAAC;AAEnF;0FAC0F;AAC1F,MAAM,MAAM,iBAAiB,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAE3D,wBAAgB,UAAU,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,IAAI,aAAa,CAEvE;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,IAAI,eAAe,CAE3E;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,IAAI,oBAAoB,CAErF;AAED,oGAAoG;AACpG,eAAO,MAAM,cAAc,aAAwC,CAAC;AAEpE;;;;;;;;;2EAS2E;AAC3E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAItE;AAED;;;;sEAIsE;AACtE,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;wDAUwD;AACxD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAoCpF;AAED;+DAC+D;AAC/D,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,EAAE,CAExE;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,iBAAiB,CAQrF;AASD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE,CAa/D;AAED;;;8CAG8C;AAC9C,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,EAAE,MAAM,GACjB,iBAAiB,CAInB"}

package/dist/reference-field-map.js

@@ -142,7 +142,7 @@ function traverseNode(node, path, map, root, visitedRefs = new Set()) {
     // the kernel's `runInvoke` emit-Invoked path. The walker fix and the
     // dispatcher fix need to land together — see the follow-up in
     // [kernel/nodejs/plans/reference-syntax-unification.md] and the
-    // stopgap in `resource-context.ts:resolveChildren`. `visitedRefs`
+    // stopgap in `resource-context.ts:ensureKindRef`. `visitedRefs`
     // stays as a parameter so the recursive calls below thread the right
     // signature; turning the descent back on is a single-branch change.
     if (typeof node?.$ref === "string")

package/dist/resolve-schema-ref-kinds.d.ts

@@ -0,0 +1,62 @@
+import type { ResourceManifest } from "@telorun/sdk";
+import type { AliasResolver } from "./alias-resolver.js";
+/** Why an `x-telo-ref` constraint did not canonicalize.
+ *
+ *  - `legacy`  — the deprecated `<namespace>/<module>#<Kind>` identity form,
+ *                still resolved through the identity table.
+ *  - `unknown` — the prefix is not an alias in the declaring module's scope: a
+ *                typo, a missing `imports:` entry — or a value that was already
+ *                canonical, which the caller separates by asking the registry.
+ *  - `gated`   — the alias is known and the target owns the kind, but its
+ *                `exports.kinds` does not list it. */
+export type RefConstraintReason = "legacy" | "unknown" | "gated";
+/** An `x-telo-ref` constraint that did not canonicalize. */
+export interface RefConstraintIssue {
+    /** The constraint string exactly as authored. */
+    ref: string;
+    /** Dotted path to the annotated schema node within the doc, e.g.
+     *  `schema.properties.store`. Points the author at the slot, not just the doc. */
+    path: string;
+    /** The `Telo.Definition` / `Telo.Abstract` doc that declares the slot. */
+    manifest: ResourceManifest;
+    reason: RefConstraintReason;
+    /** For `gated`: the target module and the kinds it does export. */
+    gate?: {
+        module: string;
+        exported: string[];
+    };
+    /** Aliases the declaring scope does know — the "did you mean" material for
+     *  an `unknown` prefix. */
+    knownAliases?: string[];
+}
+/** True for the legacy identity form, which is split on `#` by the identity table. */
+export declare function isLegacyRefIdentity(ref: string): boolean;
+/**
+ * Rewrites the `x-telo-ref` constraints on one definition doc from the alias
+ * form (`KvStore.Store`, `Self.Store`, `Telo.Invocable`) to the canonical
+ * `<module>.<Kind>` key the definition registry is keyed by.
+ *
+ * `resolver` must be the scope of the module that DECLARES the definition, not
+ * the consumer's: an imported library names its dependencies by its own aliases.
+ * This mirrors how `extends:` and `capability:` are pre-resolved before
+ * registration, so the registry never needs module context to answer a ref query.
+ *
+ * Every constraint that does not canonicalize is returned, tagged with why. That
+ * matters more than it looks: an unresolved constraint leaves a string naming no
+ * registered kind, and the reference check treats an unknown target as partial
+ * context and skips it — so an unreported one would silently let the slot accept
+ * anything. The authored value is left in place either way, so a diagnostic
+ * quotes what the author actually wrote.
+ *
+ * An `unknown` result also covers an already-canonical value (`kv-store.Store`
+ * names a module, not an alias), which is what keeps the rewrite idempotent —
+ * the caller drops those by checking the definition registry once every kind is
+ * registered.
+ *
+ * The walk covers the whole doc rather than a fixed field list: a constraint can
+ * sit in `schema`, `inputType`, `outputType`, or a `$defs` entry nested in any of
+ * them, and rewriting one that appears in a template body's inline schema is
+ * correct too.
+ */
+export declare function resolveSchemaRefKinds(definition: ResourceManifest, resolver: Pick<AliasResolver, "resolveKindResult" | "knownAliases">): RefConstraintIssue[];
+//# sourceMappingURL=resolve-schema-ref-kinds.d.ts.map

package/dist/resolve-schema-ref-kinds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-schema-ref-kinds.d.ts","sourceRoot":"","sources":["../src/resolve-schema-ref-kinds.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAIzD;;;;;;;;sDAQsD;AACtD,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;AAEjE,4DAA4D;AAC5D,MAAM,WAAW,kBAAkB;IACjC,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ;sFACkF;IAClF,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,MAAM,EAAE,mBAAmB,CAAC;IAC5B,mEAAmE;IACnE,IAAI,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC9C;+BAC2B;IAC3B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,sFAAsF;AACtF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,gBAAgB,EAC5B,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,mBAAmB,GAAG,cAAc,CAAC,GAClE,kBAAkB,EAAE,CAiDtB"}

package/dist/resolve-schema-ref-kinds.js

@@ -0,0 +1,81 @@
+const REF_ANNOTATION = "x-telo-ref";
+/** True for the legacy identity form, which is split on `#` by the identity table. */
+export function isLegacyRefIdentity(ref) {
+    return ref.includes("#");
+}
+/**
+ * Rewrites the `x-telo-ref` constraints on one definition doc from the alias
+ * form (`KvStore.Store`, `Self.Store`, `Telo.Invocable`) to the canonical
+ * `<module>.<Kind>` key the definition registry is keyed by.
+ *
+ * `resolver` must be the scope of the module that DECLARES the definition, not
+ * the consumer's: an imported library names its dependencies by its own aliases.
+ * This mirrors how `extends:` and `capability:` are pre-resolved before
+ * registration, so the registry never needs module context to answer a ref query.
+ *
+ * Every constraint that does not canonicalize is returned, tagged with why. That
+ * matters more than it looks: an unresolved constraint leaves a string naming no
+ * registered kind, and the reference check treats an unknown target as partial
+ * context and skips it — so an unreported one would silently let the slot accept
+ * anything. The authored value is left in place either way, so a diagnostic
+ * quotes what the author actually wrote.
+ *
+ * An `unknown` result also covers an already-canonical value (`kv-store.Store`
+ * names a module, not an alias), which is what keeps the rewrite idempotent —
+ * the caller drops those by checking the definition registry once every kind is
+ * registered.
+ *
+ * The walk covers the whole doc rather than a fixed field list: a constraint can
+ * sit in `schema`, `inputType`, `outputType`, or a `$defs` entry nested in any of
+ * them, and rewriting one that appears in a template body's inline schema is
+ * correct too.
+ */
+export function resolveSchemaRefKinds(definition, resolver) {
+    const issues = [];
+    const record = (ref, path) => {
+        if (isLegacyRefIdentity(ref)) {
+            issues.push({ ref, path, manifest: definition, reason: "legacy" });
+            return;
+        }
+        const result = resolver.resolveKindResult(ref);
+        if (result.status === "ok")
+            return;
+        issues.push(result.status === "gated"
+            ? {
+                ref,
+                path,
+                manifest: definition,
+                reason: "gated",
+                gate: { module: result.module, exported: result.exported },
+            }
+            : {
+                ref,
+                path,
+                manifest: definition,
+                reason: "unknown",
+                knownAliases: resolver.knownAliases(),
+            });
+    };
+    const walk = (value, path) => {
+        if (value === null || typeof value !== "object")
+            return;
+        if (Array.isArray(value)) {
+            value.forEach((item, i) => walk(item, `${path}[${i}]`));
+            return;
+        }
+        const obj = value;
+        const ref = obj[REF_ANNOTATION];
+        if (typeof ref === "string" && ref) {
+            const result = isLegacyRefIdentity(ref) ? null : resolver.resolveKindResult(ref);
+            if (result?.status === "ok")
+                obj[REF_ANNOTATION] = result.kind;
+            else
+                record(ref, path);
+        }
+        for (const key of Object.keys(obj)) {
+            walk(obj[key], path ? `${path}.${key}` : key);
+        }
+    };
+    walk(definition, "");
+    return issues;
+}

package/dist/sources/manifest-cache.d.ts

@@ -7,16 +7,26 @@ export declare const MANIFEST_CACHE_BASE_URL = "https://manifests.telo.sh";
  *  stores per version — `{ transport, host, path, version }` — so the tracker's
  *  write key and the editor's read key come from the same function and never
  *  drift. `path` is the slash-separated repo/module path (multi-segment OCI
- *  repos nest as prefixes). */
+ *  repos nest as prefixes), empty for a module addressed at a host's root. */
 export interface ManifestCacheCoords {
     transport: string;
     host: string;
     path: string;
-    version: string;
+    /** Omit only when the ref carries no version to key by — a direct `https://`
+     *  URL addresses exactly one file, so its path alone is already unambiguous.
+     *  Every ref whose grammar has a version segment must supply it, or two
+     *  versions of one module would collide on a single key. */
+    version?: string;
+    /** File within the version directory. Defaults to the module manifest, which
+     *  is the only file the hub's bucket stores; the local install cache also
+     *  holds each `include:` partial, which is named here. */
+    file?: string;
 }
 /** Deterministic cache key for one module version:
- *  `<transport>/<host>/<path…>/<version>/telo.yaml`. Returns `null` when any
- *  coordinate is empty or would traverse out of the key space. */
+ *  `<transport>/<host>/<path…>/<version>/<file>`, where `version` is omitted
+ *  when the coordinates carry none and `file` defaults to the module manifest.
+ *  Returns `null` when any coordinate is empty or would traverse out of the key
+ *  space. */
 export declare function manifestCacheKey(coords: ManifestCacheCoords): string | null;
 /** Cache coordinates for an `oci://host/repo@tag` ref. Returns `null` when the
  *  ref carries no explicit tag (a defaulted `latest` or a `sha256:` digest is

package/dist/sources/manifest-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest-cache.d.ts","sourceRoot":"","sources":["../../src/sources/manifest-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAKlD;;iFAEiF;AACjF,eAAO,MAAM,uBAAuB,8BAA8B,CAAC;AAEnE;;;;+BAI+B;AAC/B,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAOD;;kEAEkE;AAClE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI,CAO3E;AAED;;;6EAG6E;AAC7E,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAY9E;AAID;;2DAE2D;AAC3D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;;;;;oEASoE;AACpE,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAuB/F;AAED,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,GAAG,mBAAmB,EACzC,OAAO,GAAE,MAAgC,GACxC,MAAM,GAAG,IAAI,CAKf;AAED;;;;;+DAK+D;AAC/D,qBAAa,mBAAoB,YAAW,cAAc;IAC5C,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,GAAE,MAAgC;IAEtE,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAQxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAalE;;;iEAG6D;IAC7D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;CAOxD"}
+{"version":3,"file":"manifest-cache.d.ts","sourceRoot":"","sources":["../../src/sources/manifest-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAKlD;;iFAEiF;AACjF,eAAO,MAAM,uBAAuB,8BAA8B,CAAC;AAEnE;;;;8EAI8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;gEAG4D;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;8DAE0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAOD;;;;aAIa;AACb,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI,CAe3E;AAED;;;6EAG6E;AAC7E,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAY9E;AAID;;2DAE2D;AAC3D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;;;;;oEASoE;AACpE,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAuB/F;AAED,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,GAAG,mBAAmB,EACzC,OAAO,GAAE,MAAgC,GACxC,MAAM,GAAG,IAAI,CAKf;AAED;;;;;+DAK+D;AAC/D,qBAAa,mBAAoB,YAAW,cAAc;IAC5C,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,GAAE,MAAgC;IAEtE,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAQxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAalE;;;iEAG6D;IAC7D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;CAOxD"}

package/dist/sources/manifest-cache.js

@@ -10,15 +10,24 @@ function invalidSegment(segment) {
     return segment === "" || segment === "." || segment === ".." || segment.includes("\\");
 }
 /** Deterministic cache key for one module version:
- *  `<transport>/<host>/<path…>/<version>/telo.yaml`. Returns `null` when any
- *  coordinate is empty or would traverse out of the key space. */
+ *  `<transport>/<host>/<path…>/<version>/<file>`, where `version` is omitted
+ *  when the coordinates carry none and `file` defaults to the module manifest.
+ *  Returns `null` when any coordinate is empty or would traverse out of the key
+ *  space. */
 export function manifestCacheKey(coords) {
-    const { transport, host, path, version } = coords;
-    const segments = [transport, host, ...path.split("/"), version];
-    if (segments.some(invalidSegment) || transport.includes("/") || host.includes("/") || version.includes("/")) {
+    const { transport, host, path, version, file } = coords;
+    const segments = [transport, host, ...(path ? path.split("/") : [])];
+    if (version !== undefined)
+        segments.push(version);
+    segments.push(file ?? DEFAULT_MANIFEST_FILENAME);
+    if (segments.some(invalidSegment) ||
+        transport.includes("/") ||
+        host.includes("/") ||
+        (version !== undefined && version.includes("/")) ||
+        (file !== undefined && file.includes("/"))) {
         return null;
     }
-    return `${segments.join("/")}/${DEFAULT_MANIFEST_FILENAME}`;
+    return segments.join("/");
 }
 /** Cache coordinates for an `oci://host/repo@tag` ref. Returns `null` when the
  *  ref carries no explicit tag (a defaulted `latest` or a `sha256:` digest is

package/dist/validate-nested-inline.d.ts

@@ -26,5 +26,7 @@ export interface InlineDefinitionLookup {
  * `rewriteSyntheticOrigins` reroutes those on inline-extracted (synthetic)
  * manifests back to the root doc.
  */
-export declare function validateNestedInlineResources(manifest: ResourceManifest, rootSchema: Record<string, any>, lookupDefinition: InlineDefinitionLookup): AnalysisDiagnostic[];
+export declare function validateNestedInlineResources(manifest: ResourceManifest, rootSchema: Record<string, any>, lookupDefinition: InlineDefinitionLookup, 
+/** Needed to resolve a `telo#Type` field a value slot is validated against. */
+allManifests?: Record<string, any>[]): AnalysisDiagnostic[];
 //# sourceMappingURL=validate-nested-inline.d.ts.map

package/dist/validate-nested-inline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-nested-inline.d.ts","sourceRoot":"","sources":["../src/validate-nested-inline.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAQrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE,mFAAmF;AACnF,MAAM,WAAW,sBAAsB;IACrC,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;KAAE,GAAG,SAAS,CAAC;CAC9D;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,gBAAgB,EAC1B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,gBAAgB,EAAE,sBAAsB,GACvC,kBAAkB,EAAE,CAoHtB"}
+{"version":3,"file":"validate-nested-inline.d.ts","sourceRoot":"","sources":["../src/validate-nested-inline.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAQrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAKzE,mFAAmF;AACnF,MAAM,WAAW,sBAAsB;IACrC,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;KAAE,GAAG,SAAS,CAAC;CAC9D;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,gBAAgB,EAC1B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,gBAAgB,EAAE,sBAAsB;AACxC,+EAA+E;AAC/E,YAAY,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAO,GACvC,kBAAkB,EAAE,CA6HtB"}

package/dist/validate-nested-inline.js

@@ -1,6 +1,7 @@
 import { collectRefs, isInlineResource } from "./reference-field-map.js";
 import { collectProperties, resolveRef, substituteCelFields, validateAgainstSchema, } from "./schema-compat.js";
 import { DiagnosticSeverity } from "./types.js";
+import { collectValueSchemaIssues } from "./validate-value-schema.js";
 const SOURCE = "telo-analyzer";
 /**
  * Validates inline resources nested inside a resource body against their kind's
@@ -22,7 +23,9 @@ const SOURCE = "telo-analyzer";
  * `rewriteSyntheticOrigins` reroutes those on inline-extracted (synthetic)
  * manifests back to the root doc.
  */
-export function validateNestedInlineResources(manifest, rootSchema, lookupDefinition) {
+export function validateNestedInlineResources(manifest, rootSchema, lookupDefinition, 
+/** Needed to resolve a `telo#Type` field a value slot is validated against. */
+allManifests = []) {
     const diagnostics = [];
     const resource = { kind: manifest.kind, name: manifest.metadata?.name };
     const filePath = manifest.metadata?.source;
@@ -68,7 +71,16 @@ export function validateNestedInlineResources(manifest, rootSchema, lookupDefini
             : {};
         const data = { ...inline, metadata: { name: "__inline__", ...existingMeta } };
         const substituted = substituteCelFields(data, effectiveSchema, effectiveSchema);
-        for (const issue of validateAgainstSchema(substituted, effectiveSchema)) {
+        // The same two passes the top-level resource loop runs, so a kind's
+        // guarantees don't depend on whether the author wrote it standalone or
+        // inline (under a step's `invoke:`, or in a `with:` scope). `data` carries
+        // the synthesized metadata; `x-telo-value-schema-from` reads sibling fields
+        // off the resource, which are present either way.
+        const inlineIssues = [
+            ...validateAgainstSchema(substituted, effectiveSchema),
+            ...collectValueSchemaIssues(data, schema, allManifests),
+        ];
+        for (const issue of inlineIssues) {
             diagnostics.push({
                 severity: DiagnosticSeverity.Error,
                 code: "SCHEMA_VIOLATION",

package/dist/validate-value-schema.d.ts

@@ -0,0 +1,13 @@
+import { type SchemaIssue } from "./schema-compat.js";
+/**
+ * Validate every `x-telo-value-schema-from` slot in one resource.
+ *
+ * CEL leaves are replaced with schema-shaped placeholders before AJV runs
+ * (`substituteCelFields`), so an expression is accepted wherever its slot's
+ * declared type would be — a static pass cannot know what it evaluates to. What
+ * this DOES catch is structural disagreement that no runtime value can fix: a
+ * missing required property, an unknown property under
+ * `additionalProperties: false`, or a literal of the wrong type.
+ */
+export declare function collectValueSchemaIssues(manifest: Record<string, any>, defSchema: Record<string, any> | undefined, allManifests: Record<string, any>[]): SchemaIssue[];
+//# sourceMappingURL=validate-value-schema.d.ts.map

package/dist/validate-value-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-value-schema.d.ts","sourceRoot":"","sources":["../src/validate-value-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8C,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AA2FlG;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC7B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EAC1C,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,WAAW,EAAE,CAoBf"}

package/dist/validate-value-schema.js

@@ -0,0 +1,114 @@
+import { substituteCelFields, validateAgainstSchema } from "./schema-compat.js";
+import { resolveTypeFieldToSchema } from "./validate-cel-context.js";
+/**
+ * `x-telo-value-schema-from: "<field>"` — the value written at the annotated
+ * node must satisfy the type declared at the resource's `<field>`.
+ *
+ * The motivating shape is a kind with ONE declared output contract and SEVERAL
+ * places that must each produce it — a decision table's rows, a switch's arms.
+ * Only the branch that wins at runtime gets checked there, so a mistyped branch
+ * ships and fails on the one input that selects it. This annotation checks every
+ * branch statically instead.
+ *
+ * Generic and topology-driven: the analyzer hardcodes no kind. Any definition
+ * with a `telo#Type` field and value-producing slots opts in by annotating those
+ * slots. `<field>` is resolved with the same `telo#Type` semantics as
+ * `inputType` / `outputType` everywhere else, so an inline
+ * `{ kind: Type.JsonSchema, schema: … }` and a named type reference both work.
+ *
+ * A field that resolves to no schema — the common case of an optional
+ * `outputType` left undeclared — is skipped, not reported: declaring the
+ * contract is what opts into the check.
+ */
+const ANNOTATION = "x-telo-value-schema-from";
+/** Walk a definition schema collecting every `x-telo-value-schema-from`, in the
+ *  same scope form the CEL-context walker produces. */
+function collectAnnotations(schema, path) {
+    if (!schema || typeof schema !== "object")
+        return [];
+    const out = [];
+    const from = schema[ANNOTATION];
+    if (typeof from === "string" && from.length > 0)
+        out.push({ scope: path, from });
+    if (schema.properties) {
+        for (const [key, value] of Object.entries(schema.properties)) {
+            out.push(...collectAnnotations(value, `${path}.${key}`));
+        }
+    }
+    if (schema.items && typeof schema.items === "object") {
+        out.push(...collectAnnotations(schema.items, `${path}[*]`));
+    }
+    for (const key of ["oneOf", "anyOf", "allOf"]) {
+        if (Array.isArray(schema[key])) {
+            for (const sub of schema[key])
+                out.push(...collectAnnotations(sub, path));
+        }
+    }
+    return out;
+}
+/** Expand a scope into the concrete values present in this manifest, carrying
+ *  each one's real path so a diagnostic points at the row the author wrote. */
+function resolveScopeValues(manifest, scope) {
+    const stripped = scope.startsWith("$.") ? scope.slice(2) : scope;
+    if (!stripped)
+        return [];
+    let frontier = [{ path: "", value: manifest }];
+    // Segments look like `choices[*]` or `default` — a name plus optional wildcard.
+    for (const segment of stripped.split(".")) {
+        const wildcard = segment.endsWith("[*]");
+        const name = wildcard ? segment.slice(0, -3) : segment;
+        const next = [];
+        for (const entry of frontier) {
+            const container = entry.value;
+            if (!container || typeof container !== "object")
+                continue;
+            const child = container[name];
+            if (child === undefined)
+                continue;
+            const childPath = entry.path ? `${entry.path}.${name}` : name;
+            if (!wildcard) {
+                next.push({ path: childPath, value: child });
+                continue;
+            }
+            if (!Array.isArray(child))
+                continue;
+            child.forEach((item, i) => next.push({ path: `${childPath}[${i}]`, value: item }));
+        }
+        frontier = next;
+        if (frontier.length === 0)
+            break;
+    }
+    return frontier;
+}
+/**
+ * Validate every `x-telo-value-schema-from` slot in one resource.
+ *
+ * CEL leaves are replaced with schema-shaped placeholders before AJV runs
+ * (`substituteCelFields`), so an expression is accepted wherever its slot's
+ * declared type would be — a static pass cannot know what it evaluates to. What
+ * this DOES catch is structural disagreement that no runtime value can fix: a
+ * missing required property, an unknown property under
+ * `additionalProperties: false`, or a literal of the wrong type.
+ */
+export function collectValueSchemaIssues(manifest, defSchema, allManifests) {
+    if (!defSchema)
+        return [];
+    const annotations = collectAnnotations(defSchema, "$");
+    if (annotations.length === 0)
+        return [];
+    const issues = [];
+    for (const { scope, from } of annotations) {
+        const target = resolveTypeFieldToSchema(manifest[from], allManifests);
+        if (!target || typeof target !== "object")
+            continue;
+        for (const { path, value } of resolveScopeValues(manifest, scope)) {
+            for (const issue of validateAgainstSchema(substituteCelFields(value, target), target)) {
+                issues.push({
+                    message: `\`${path}\` does not satisfy the type declared at \`${from}\`: ${issue.message}`,
+                    path: issue.path ? `${path}.${issue.path}` : path,
+                });
+            }
+        }
+    }
+    return issues;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.42.0",
+  "version": "0.44.0",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",
@@ -48,7 +48,7 @@
     "@types/node": "^20.0.0",
     "typescript": "^5.0.0",
     "vitest": "^2.1.8",
-    "@telorun/sdk": "0.50.0"
+    "@telorun/sdk": "0.56.0"
   },
   "peerDependencies": {
     "@telorun/sdk": "*"