@telorun/analyzer 0.46.0 → 0.47.0

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AA6B9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAyyB/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IA4hCvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAmBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AA6B9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAyyB/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IA4hCvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAyBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -973,7 +973,7 @@ export class StaticAnalyzer {
         // {kind, name} objects so downstream phases (validation, dependency graph,
         // kernel controllers) see a uniform shape. Runs after normalize so both
         // original and inline-extracted manifests have their sentinels resolved.
-        resolveRefSentinels(allManifests, aliases, aliasesByModule);
+        resolveRefSentinels(allManifests, aliases, aliasesByModule, [], defs);
         // Phase 2.6: register each named `Telo.Type` resource's schema under its
         // canonical module-scoped id (`telo://<module>/<name>`), validate
         // `telo://Self|Alias/Type` schema refs resolve to one, then rewrite those
@@ -1642,7 +1642,7 @@ export class StaticAnalyzer {
         // Resolve !ref sentinels after normalize so both the original and
         // inline-extracted manifests get their refs canonicalized to
         // {kind, name} for the kernel that consumes this output.
-        resolveRefSentinels(normalized, ctx.aliases, ctx.aliasesByModule, crossModuleTargets ?? []);
+        resolveRefSentinels(normalized, ctx.aliases, ctx.aliasesByModule, crossModuleTargets ?? [], ctx.definitions);
         // Canonicalize import-scoped schema `$ref`s (`telo://Self|Alias/Type`) so the
         // kernel that executes this output compiles inputs/outputs against the same
         // ids the type controllers register their schemas under.

package/dist/resolve-ref-sentinels.d.ts

@@ -1,5 +1,13 @@
 import type { ResourceManifest } from "@telorun/sdk";
 import type { AliasResolver } from "./alias-resolver.js";
+import { type ReferenceFieldMap } from "./reference-field-map.js";
+/** The slice of the definition registry this pass needs: a kind's field map, from
+ *  which the `x-telo-scope` slots are read. */
+export interface ScopeFieldMapSource {
+    getFieldMapForKind(kind: string, aliases?: {
+        resolveKind(k: string): string | undefined;
+    }): ReferenceFieldMap | undefined;
+}
 /**
  * Rewrites every `!ref <name>` sentinel in each non-system resource's value tree
  * to `{kind, name}` (local) or `{kind, name, alias}` (cross-module), in place.
@@ -36,5 +44,9 @@ import type { AliasResolver } from "./alias-resolver.js";
  * `metadata.module` that isn't a root module) are resolution TARGETS only — they are not
  * re-walked as sources here, since their own ref slots belong to their own module scope.
  */
-export declare function resolveRefSentinels(resources: ResourceManifest[], aliases?: AliasResolver, aliasesByModule?: Map<string, AliasResolver>, crossModuleTargets?: ResourceManifest[]): void;
+export declare function resolveRefSentinels(resources: ResourceManifest[], aliases?: AliasResolver, aliasesByModule?: Map<string, AliasResolver>, crossModuleTargets?: ResourceManifest[], 
+/** Supplies each kind's `x-telo-scope` slots. Without it a scoped name cannot be
+ *  told from a module-level one, and a shadowed `!ref` resolves to the resource
+ *  it shadows — so both call sites pass it. */
+defs?: ScopeFieldMapSource): void;
 //# sourceMappingURL=resolve-ref-sentinels.d.ts.map

package/dist/resolve-ref-sentinels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-ref-sentinels.d.ts","sourceRoot":"","sources":["../src/resolve-ref-sentinels.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAOzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,aAAa,EACvB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAK5C,kBAAkB,GAAE,gBAAgB,EAAO,GAC1C,IAAI,CAgFN"}
+{"version":3,"file":"resolve-ref-sentinels.d.ts","sourceRoot":"","sources":["../src/resolve-ref-sentinels.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAGlC;+CAC+C;AAC/C,MAAM,WAAW,mBAAmB;IAClC,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,GACvD,iBAAiB,GAAG,SAAS,CAAC;CAClC;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,aAAa,EACvB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAK5C,kBAAkB,GAAE,gBAAgB,EAAO;AAC3C;;+CAE+C;AAC/C,IAAI,CAAC,EAAE,mBAAmB,GACzB,IAAI,CA8HN"}

package/dist/resolve-ref-sentinels.js

@@ -1,4 +1,5 @@
 import { isRefSentinel, isTaggedSentinel } from "@telorun/templating";
+import { isScopeEntry, resolveFieldEntries, } from "./reference-field-map.js";
 import { REF_RESOLUTION_SKIP_KINDS as SYSTEM_KINDS } from "./system-kinds.js";
 /**
  * Rewrites every `!ref <name>` sentinel in each non-system resource's value tree
@@ -41,7 +42,11 @@ export function resolveRefSentinels(resources, aliases, aliasesByModule,
 // walked as sources). The kernel passes the analyzer-flattened set here so the runtime
 // pass — which loads the entry module only — can still resolve `!ref Alias.name` against
 // imported libraries' exported instances.
-crossModuleTargets = []) {
+crossModuleTargets = [], 
+/** Supplies each kind's `x-telo-scope` slots. Without it a scoped name cannot be
+ *  told from a module-level one, and a shadowed `!ref` resolves to the resource
+ *  it shadows — so both call sites pass it. */
+defs) {
     const moduleOf = (r) => r.metadata?.module;
     // Forwarded exports are flagged by flattenForAnalyzer (`metadata.forwardedExport`); they're
     // cross-module resolution targets only — never walked as local ref sources here.
@@ -96,11 +101,50 @@ crossModuleTargets = []) {
         }
         return undefined;
     };
+    /** Names a resource declares in its own execution scopes, read from the kind's
+     *  `x-telo-scope` slots — the analyzer's single definition of "scope", shared
+     *  with `manifest-visitor`. Inferring it structurally instead (any array of
+     *  named inline manifests) would give scope-local shadowing to the first kind
+     *  that happens to carry such an array without asking for it, and this pass is
+     *  shared with the kernel, so the guess would be baked into the runtime tree
+     *  rather than merely reported. */
+    const declaredInScopes = (resource) => {
+        const fieldMap = defs?.getFieldMapForKind(resource.kind, aliases);
+        if (!fieldMap)
+            return undefined;
+        let declared;
+        for (const [fieldPath, entry] of fieldMap) {
+            if (!isScopeEntry(entry))
+                continue;
+            for (const { value } of resolveFieldEntries(resource, fieldPath)) {
+                for (const element of Array.isArray(value) ? value : [value]) {
+                    if (!element || typeof element !== "object" || Array.isArray(element))
+                        continue;
+                    const manifest = element;
+                    const name = manifest.metadata?.name;
+                    if (typeof manifest.kind === "string" && typeof name === "string") {
+                        (declared ??= new Map()).set(name, manifest);
+                    }
+                }
+            }
+        }
+        return declared;
+    };
     // Resolve every `!ref` sentinel in the tree; leave opaque tagged / precompiled
     // nodes (e.g. `!cel`) untouched and don't descend into them.
-    const walk = (value) => {
+    //
+    // `scoped` carries the names the enclosing resource declares in its `x-telo-scope`
+    // slots, and they SHADOW the module-level ones — the order the runtime resolves
+    // in. Baking the module-level kind into a shadowed reference would label traces
+    // and `getRefIdentity` with a resource that never runs.
+    const walk = (value, scoped) => {
         if (isRefSentinel(value)) {
-            return resolveTarget(value.source) ?? value;
+            const source = value.source;
+            const bare = source.indexOf(".") === -1;
+            const shadow = bare ? scoped?.get(source) : undefined;
+            if (shadow)
+                return { kind: shadow.kind, name: source };
+            return resolveTarget(source) ?? value;
         }
         if (value === null || typeof value !== "object")
             return value;
@@ -110,12 +154,19 @@ crossModuleTargets = []) {
             return value;
         if (Array.isArray(value)) {
             for (let i = 0; i < value.length; i++)
-                value[i] = walk(value[i]);
+                value[i] = walk(value[i], scoped);
             return value;
         }
         const obj = value;
+        // A nested inline resource may declare scopes of its own (a `Run.Sequence`
+        // inside another sequence's `with:`). Collected before descending, so the
+        // declarations are visible to every region of the resource that declares
+        // them — a sequence's `with:` names resolve in its `targets:` and `steps:`
+        // alike, not only inside `with:` itself.
+        const declared = typeof obj.kind === "string" ? declaredInScopes(obj) : undefined;
+        const inner = declared ? new Map([...(scoped ?? new Map()), ...declared]) : scoped;
         for (const key of Object.keys(obj))
-            obj[key] = walk(obj[key]);
+            obj[key] = walk(obj[key], inner);
         return value;
     };
     for (const r of resources) {

package/dist/validate-cel-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAGtF,MAAM,WAAW,kBAAkB;IACjC;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC;;kDAE8C;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;KACxD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CA0CjC;AAuFD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAChD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAgHrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB;AAWD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,SAAM,GACT,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAC,CAGvD;AAUD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,SAAM,GAAG,MAAM,EAAE,CAqBxF"}
+{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAGtF,MAAM,WAAW,kBAAkB;IACjC;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC;;kDAE8C;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;KACxD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CA0CjC;AAuFD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAChD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAmIrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB;AAWD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,SAAM,GACT,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAC,CAGvD;AAUD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,SAAM,GAAG,MAAM,EAAE,CAqBxF"}

package/dist/validate-cel-context.js

@@ -276,13 +276,29 @@ export function resolveContextAnnotations(schema, manifestItem, opts) {
             typeof ref.kind === "string" &&
             typeof ref.name === "string" &&
             subpath) {
+            const segments = subpath.split("/");
             const refManifest = allManifests.find((m) => m.kind === ref.kind && m.metadata?.name === ref.name);
             if (refManifest) {
-                const resolved = resolveTypeFieldToSchema(navigatePath(refManifest, subpath.split("/")), allManifests);
+                const resolved = resolveTypeFieldToSchema(navigatePath(refManifest, segments), allManifests);
                 if (resolved && typeof resolved === "object") {
                     return resolved;
                 }
             }
+            // The instance declares nothing, so fall back to its KIND's declaration —
+            // the same layering `buildStepContextSchema` applies to `steps.<name>.result`,
+            // so a kind with one fixed output shape (declared once on its Telo.Definition)
+            // types the context, while a kind that exposes the field for per-instance
+            // narrowing keeps winning above.
+            if (defs) {
+                const canonical = aliases?.resolveKind(ref.kind) ?? ref.kind;
+                const def = defs.resolve(canonical);
+                if (def) {
+                    const resolved = resolveTypeFieldToSchema(navigatePath(def, segments), allManifests);
+                    if (resolved && typeof resolved === "object") {
+                        return resolved;
+                    }
+                }
+            }
         }
         // Fallback: open schema (no false errors when outputType is not declared)
         return { ...schema, additionalProperties: true };

package/dist/validate-references.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-references.d.ts","sourceRoot":"","sources":["../src/validate-references.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAMrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAgD/F;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,GACvB,kBAAkB,EAAE,CA6dtB"}
+{"version":3,"file":"validate-references.d.ts","sourceRoot":"","sources":["../src/validate-references.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAMrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAgD/F;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,GACvB,kBAAkB,EAAE,CAmetB"}

package/dist/validate-references.js

@@ -254,8 +254,14 @@ export function validateReferences(resources, context) {
                 }
                 // Local reference (bare name or explicit `Self.`-qualified).
                 const localName = aliasPrefix === "Self" ? refName.slice(dot + 1) : refName;
-                const target = byName.get(localName) ??
-                    visibleScopeManifests.find((m) => m.metadata?.name === localName);
+                // Scope-local FIRST, enclosing module as the fallback — the order the
+                // runtime uses at every name-resolution site (`ScopeContext.getInstance`,
+                // `ResourceContext.resolveRef`, and the CEL `resources` layering). Module-first
+                // here would validate a shadowed name against the resource the kernel will
+                // never bind: a false pass when the outer kind fits and the scoped one does
+                // not, a false REFERENCE_KIND_MISMATCH when it is the other way round.
+                const target = visibleScopeManifests.find((m) => m.metadata?.name === localName) ??
+                    byName.get(localName);
                 if (!target) {
                     diagnostics.push({
                         severity: DiagnosticSeverity.Error,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.46.0",
+  "version": "0.47.0",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",
@@ -48,7 +48,7 @@
     "@types/node": "^20.0.0",
     "typescript": "^5.0.0",
     "vitest": "^2.1.8",
-    "@telorun/sdk": "0.58.0"
+    "@telorun/sdk": "0.59.0"
   },
   "peerDependencies": {
     "@telorun/sdk": "*"

package/src/analyzer.ts

@@ -1153,7 +1153,7 @@ export class StaticAnalyzer {
     // {kind, name} objects so downstream phases (validation, dependency graph,
     // kernel controllers) see a uniform shape. Runs after normalize so both
     // original and inline-extracted manifests have their sentinels resolved.
-    resolveRefSentinels(allManifests, aliases, aliasesByModule);
+    resolveRefSentinels(allManifests, aliases, aliasesByModule, [], defs);
 
     // Phase 2.6: register each named `Telo.Type` resource's schema under its
     // canonical module-scoped id (`telo://<module>/<name>`), validate
@@ -1957,7 +1957,13 @@ export class StaticAnalyzer {
     // Resolve !ref sentinels after normalize so both the original and
     // inline-extracted manifests get their refs canonicalized to
     // {kind, name} for the kernel that consumes this output.
-    resolveRefSentinels(normalized, ctx.aliases, ctx.aliasesByModule, crossModuleTargets ?? []);
+    resolveRefSentinels(
+      normalized,
+      ctx.aliases,
+      ctx.aliasesByModule,
+      crossModuleTargets ?? [],
+      ctx.definitions!,
+    );
     // Canonicalize import-scoped schema `$ref`s (`telo://Self|Alias/Type`) so the
     // kernel that executes this output compiles inputs/outputs against the same
     // ids the type controllers register their schemas under.

package/src/resolve-ref-sentinels.ts

@@ -1,8 +1,22 @@
 import type { ResourceManifest } from "@telorun/sdk";
 import { isRefSentinel, isTaggedSentinel } from "@telorun/templating";
 import type { AliasResolver } from "./alias-resolver.js";
+import {
+  isScopeEntry,
+  resolveFieldEntries,
+  type ReferenceFieldMap,
+} from "./reference-field-map.js";
 import { REF_RESOLUTION_SKIP_KINDS as SYSTEM_KINDS } from "./system-kinds.js";
 
+/** The slice of the definition registry this pass needs: a kind's field map, from
+ *  which the `x-telo-scope` slots are read. */
+export interface ScopeFieldMapSource {
+  getFieldMapForKind(
+    kind: string,
+    aliases?: { resolveKind(k: string): string | undefined },
+  ): ReferenceFieldMap | undefined;
+}
+
 /** Resolved ref shape written in place of a `!ref` sentinel. `alias` is set only for
  *  cross-module references (resolved into an imported library's exported instance). */
 type ResolvedRef = { kind: string; name: string; alias?: string };
@@ -52,6 +66,10 @@ export function resolveRefSentinels(
   // pass — which loads the entry module only — can still resolve `!ref Alias.name` against
   // imported libraries' exported instances.
   crossModuleTargets: ResourceManifest[] = [],
+  /** Supplies each kind's `x-telo-scope` slots. Without it a scoped name cannot be
+   *  told from a module-level one, and a shadowed `!ref` resolves to the resource
+   *  it shadows — so both call sites pass it. */
+  defs?: ScopeFieldMapSource,
 ): void {
   const moduleOf = (r: ResourceManifest): string | undefined =>
     (r.metadata as { module?: string } | undefined)?.module;
@@ -109,21 +127,67 @@ export function resolveRefSentinels(
     return undefined;
   };
 
+  /** Names a resource declares in its own execution scopes, read from the kind's
+   *  `x-telo-scope` slots — the analyzer's single definition of "scope", shared
+   *  with `manifest-visitor`. Inferring it structurally instead (any array of
+   *  named inline manifests) would give scope-local shadowing to the first kind
+   *  that happens to carry such an array without asking for it, and this pass is
+   *  shared with the kernel, so the guess would be baked into the runtime tree
+   *  rather than merely reported. */
+  const declaredInScopes = (
+    resource: ResourceManifest,
+  ): Map<string, ResourceManifest> | undefined => {
+    const fieldMap = defs?.getFieldMapForKind(resource.kind, aliases);
+    if (!fieldMap) return undefined;
+    let declared: Map<string, ResourceManifest> | undefined;
+    for (const [fieldPath, entry] of fieldMap) {
+      if (!isScopeEntry(entry)) continue;
+      for (const { value } of resolveFieldEntries(resource, fieldPath)) {
+        for (const element of Array.isArray(value) ? value : [value]) {
+          if (!element || typeof element !== "object" || Array.isArray(element)) continue;
+          const manifest = element as ResourceManifest;
+          const name = (manifest.metadata as { name?: string } | undefined)?.name;
+          if (typeof manifest.kind === "string" && typeof name === "string") {
+            (declared ??= new Map()).set(name, manifest);
+          }
+        }
+      }
+    }
+    return declared;
+  };
+
   // Resolve every `!ref` sentinel in the tree; leave opaque tagged / precompiled
   // nodes (e.g. `!cel`) untouched and don't descend into them.
-  const walk = (value: unknown): unknown => {
+  //
+  // `scoped` carries the names the enclosing resource declares in its `x-telo-scope`
+  // slots, and they SHADOW the module-level ones — the order the runtime resolves
+  // in. Baking the module-level kind into a shadowed reference would label traces
+  // and `getRefIdentity` with a resource that never runs.
+  const walk = (value: unknown, scoped?: Map<string, ResourceManifest>): unknown => {
     if (isRefSentinel(value)) {
-      return resolveTarget(value.source) ?? value;
+      const source = value.source;
+      const bare = source.indexOf(".") === -1;
+      const shadow = bare ? scoped?.get(source) : undefined;
+      if (shadow) return { kind: shadow.kind as string, name: source };
+      return resolveTarget(source) ?? value;
     }
     if (value === null || typeof value !== "object") return value;
     if (isTaggedSentinel(value)) return value;
     if ((value as { __compiled?: unknown }).__compiled) return value;
     if (Array.isArray(value)) {
-      for (let i = 0; i < value.length; i++) value[i] = walk(value[i]);
+      for (let i = 0; i < value.length; i++) value[i] = walk(value[i], scoped);
       return value;
     }
     const obj = value as Record<string, unknown>;
-    for (const key of Object.keys(obj)) obj[key] = walk(obj[key]);
+    // A nested inline resource may declare scopes of its own (a `Run.Sequence`
+    // inside another sequence's `with:`). Collected before descending, so the
+    // declarations are visible to every region of the resource that declares
+    // them — a sequence's `with:` names resolve in its `targets:` and `steps:`
+    // alike, not only inside `with:` itself.
+    const declared =
+      typeof obj.kind === "string" ? declaredInScopes(obj as ResourceManifest) : undefined;
+    const inner = declared ? new Map([...(scoped ?? new Map()), ...declared]) : scoped;
+    for (const key of Object.keys(obj)) obj[key] = walk(obj[key], inner);
     return value;
   };
 

package/src/validate-cel-context.ts

@@ -323,18 +323,37 @@ export function resolveContextAnnotations(
       typeof ref.name === "string" &&
       subpath
     ) {
+      const segments = subpath.split("/");
       const refManifest = allManifests.find(
         (m) => m.kind === ref.kind && (m.metadata as any)?.name === ref.name,
       ) as Record<string, any> | undefined;
       if (refManifest) {
         const resolved = resolveTypeFieldToSchema(
-          navigatePath(refManifest, subpath.split("/")) as unknown,
+          navigatePath(refManifest, segments) as unknown,
           allManifests,
         );
         if (resolved && typeof resolved === "object") {
           return resolved;
         }
       }
+      // The instance declares nothing, so fall back to its KIND's declaration —
+      // the same layering `buildStepContextSchema` applies to `steps.<name>.result`,
+      // so a kind with one fixed output shape (declared once on its Telo.Definition)
+      // types the context, while a kind that exposes the field for per-instance
+      // narrowing keeps winning above.
+      if (defs) {
+        const canonical = aliases?.resolveKind(ref.kind) ?? ref.kind;
+        const def = defs.resolve(canonical) as Record<string, unknown> | undefined;
+        if (def) {
+          const resolved = resolveTypeFieldToSchema(
+            navigatePath(def, segments) as unknown,
+            allManifests,
+          );
+          if (resolved && typeof resolved === "object") {
+            return resolved;
+          }
+        }
+      }
     }
     // Fallback: open schema (no false errors when outputType is not declared)
     return { ...schema, additionalProperties: true };

package/src/validate-references.ts

@@ -267,9 +267,15 @@ export function validateReferences(
 
           // Local reference (bare name or explicit `Self.`-qualified).
           const localName = aliasPrefix === "Self" ? refName.slice(dot + 1) : refName;
+          // Scope-local FIRST, enclosing module as the fallback — the order the
+          // runtime uses at every name-resolution site (`ScopeContext.getInstance`,
+          // `ResourceContext.resolveRef`, and the CEL `resources` layering). Module-first
+          // here would validate a shadowed name against the resource the kernel will
+          // never bind: a false pass when the outer kind fits and the scoped one does
+          // not, a false REFERENCE_KIND_MISMATCH when it is the other way round.
           const target =
-            byName.get(localName) ??
-            visibleScopeManifests.find((m) => m.metadata?.name === localName);
+            visibleScopeManifests.find((m) => m.metadata?.name === localName) ??
+            byName.get(localName);
           if (!target) {
             diagnostics.push({
               severity: DiagnosticSeverity.Error,