@telorun/analyzer 0.63.0 → 0.64.0

package/dist/analyzer.js

@@ -1,13 +1,13 @@
 import { canonicalTypeSchemaId, OBSERVED_STATE_KEY } from "@telorun/sdk";
 import { defaultRegistry, isRefSentinel, isTaggedSentinel, plainChainOf, } from "@telorun/templating";
-import { AliasResolver, moduleScopedDefResolver, scopeResolverForModule, } from "./alias-resolver.js";
-import { buildCelEnvironment, buildImportInputCelEnvironment, buildTypedCelEnvironment, } from "./cel-environment.js";
+import { AliasResolver, scopeResolverForModule, } from "./alias-resolver.js";
+import { buildCelEnvironment, } from "./cel-environment.js";
 import { DefinitionRegistry } from "./definition-registry.js";
 import { effectiveAuthorSchema } from "./extends-resolution.js";
-import { PERMISSIVE_CONTRACT, resolveContract, } from "./invocation-contract.js";
+import { analyzerContractScope, resolveContract, } from "./invocation-contract.js";
 import { buildCallGraph } from "./call-graph.js";
 import { buildDependencyGraph, formatCycle } from "./dependency-graph.js";
-import { buildKernelGlobalsIndex, KERNEL_GLOBAL_NAMES, mergeKernelGlobalsIntoContext, } from "./kernel-globals.js";
+import { buildKernelGlobalsIndex, KERNEL_GLOBAL_NAMES, } from "./kernel-globals.js";
 import { buildObservedStateIndex, buildObservedStateResourcesSchema, collectRunReachableNames, observedStateRead, validateObservedStateDeclarations, } from "./validate-observed-state.js";
 import { computeSuggestKind } from "./kind-suggest.js";
 import { visitManifest } from "./manifest-visitor.js";
@@ -19,7 +19,14 @@ import { resolveSchemaRefKinds } from "./resolve-schema-ref-kinds.js";
 import { runZoneAnalysis } from "./resolve-zone-requirements.js";
 import { validateDurableRegions } from "./validate-durable-regions.js";
 import { validateZoneViolations } from "./validate-zone-violations.js";
-import { MANIFEST_SCHEMA_URI, ManifestRootSchema } from "./manifest-schemas.js";
+import { resolveLocalRef, walkStepArray } from "./schema-walk.js";
+import { CelScopeResolver } from "./cel-scope.js";
+// The structural walks and the CEL scope rule moved out of this file — the
+// first so both halves can reach them, the second so the IDE can ask what a
+// cursor sees without pulling the analysis pass in behind it. Re-exported here
+// because they were part of this module's surface before the split.
+export { gatherPropertySchemas, resolveLocalRef, walkStepArray } from "./schema-walk.js";
+export { analyzerContractScope } from "./invocation-contract.js";
 import { validateZoneSlotDeclarations } from "./validate-zone-slots.js";
 import { validateSchemaProjection, } from "./validate-schema-projection.js";
 import { evaluateResourceRules, reportResourceRules, reportUnexercisedRule, ruleExercised, validateResourceRuleDeclarations, } from "./validate-resource-rules.js";
@@ -35,9 +42,9 @@ import { rewriteSyntheticOrigins } from "./rewrite-synthetic-origins.js";
 import { celTypeSatisfiesJsonSchema, checkSchemaCompatibility, navigateSchemaToExprPath, substituteCelFields, validateAgainstSchema, } from "./schema-compat.js";
 import { collectValueSchemaIssues } from "./validate-value-schema.js";
 import { DiagnosticSeverity } from "./types.js";
-import { extractAccessChains, extractCelRegionScopes, getManifestItem, pathMatchesScope, resolveContextAnnotations, resolveTypeFieldToSchema, } from "./validate-cel-context.js";
+import { extractAccessChains, extractCelRegionScopes, pathMatchesScope, } from "./validate-cel-context.js";
 import { buildEvalPaths, evalPathsCover } from "./eval-paths.js";
-import { BINDINGS_ANNOTATION, bindingContextProperties, bindingPathChain, findBindingSites, resolveBindingOrder, schemaAtChain, } from "./cel-bindings.js";
+import { BINDINGS_ANNOTATION, findBindingSites, resolveBindingOrder, } from "./cel-bindings.js";
 import { CEL_RESERVED_WORDS, checkName } from "./identifier-name.js";
 import { validateIdentifierNames } from "./validate-identifier-names.js";
 import { validateExtends } from "./validate-extends.js";
@@ -48,7 +55,7 @@ import { validateModuleMetadata } from "./validate-module-metadata.js";
 import { validateRequires } from "./validate-requires.js";
 import { validateBaseMapping } from "./validate-base-mapping.js";
 import { validateInvocationContract } from "./validate-invocation-contract.js";
-import { collectStepInputIssues } from "./validate-step-inputs.js";
+import { collectRefInputIssues, collectStepInputIssues } from "./validate-step-inputs.js";
 import { validateNestedInlineResources } from "./validate-nested-inline.js";
 import { validateProviderCoherence } from "./validate-provider-coherence.js";
 import { validateReferences } from "./validate-references.js";
@@ -99,83 +106,7 @@ function resolveSelfOrAlias(value, ownModule, scopeResolver) {
     }
     return scopeResolver.resolveKind(value);
 }
-/** The {@link ContractScope} the analyzer resolves invocation contracts in: kinds
- *  resolve in the module that declared the definition they were read off (so an
- *  `extends` chain crossing module boundaries re-scopes at every hop), and named
- *  `telo#Type` references resolve against the flattened manifest list. `resolveIn`
- *  is the top-level entry point, where the kind was written by the READING
- *  module and there is no declaring definition yet. */
-export function analyzerContractScope(defs, aliases, scopes, allManifests) {
-    const resolve = moduleScopedDefResolver(defs, aliases, scopes);
-    return {
-        resolveDefinition: resolve,
-        resolveIn: resolve.in,
-        typeManifestsFor: () => allManifests,
-    };
-}
 const SOURCE = "telo-analyzer";
-/** Build a closed JSON Schema for the `self` CEL variable available inside a
- *  `Telo.Definition` template body. Mirrors the runtime template controller's
- *  `const self = { ...resource, name: resource.metadata.name };` — every
- *  property the user declared in `schema:` plus synthetic `name` / `kind` and
- *  the metadata sub-object (kept open since metadata legitimately carries
- *  arbitrary user-added fields). */
-function buildSelfSchema(definition, defs, aliases) {
-    // The author-facing schema resolves inheritance: with `base:` the child's own
-    // schema (the parent's config is internal); without it, `merge(parent, own)`.
-    const userSchema = (defs
-        ? effectiveAuthorSchema(definition, (k) => defs.resolve(aliases?.resolveKind(k) ?? k) ?? defs.resolve(k))
-        : (definition.schema ?? {}));
-    const userProps = (userSchema.properties ?? {});
-    const userRequired = Array.isArray(userSchema.required) ? userSchema.required : [];
-    return {
-        type: "object",
-        additionalProperties: false,
-        properties: {
-            ...userProps,
-            name: { type: "string" },
-            kind: { type: "string" },
-            metadata: {
-                type: "object",
-                additionalProperties: true,
-                properties: { name: { type: "string" } },
-            },
-        },
-        required: [...userRequired, "name", "kind"],
-    };
-}
-/** Build the JSON Schema for the `inputs` CEL variable available inside an
- *  invocable template body — the shared contract resolver applied to the
- *  definition itself, so a body is typed against the exact signature callers are
- *  checked against and dispatch enforces. Walks the whole `extends` chain rather
- *  than one hop, so a definition two levels below the declaration still gets
- *  typed inputs. Undefined when nothing in the chain declares a contract —
- *  the caller signals opaque `map<string, dyn>` upstream. */
-function lookupTemplateInputsSchema(definition, defs, aliases, allManifests, scopes) {
-    return resolveContract("inputType", undefined, definition, analyzerContractScope(defs, aliases, scopes, allManifests))?.schema;
-}
-/** Returns a "resolver-facing" view of the manifest where the fields used as
- *  navigation roots by Telo.Definition's `x-telo-context-from-root` annotations
- *  have been pre-augmented:
- *    - `schema`     → augmented `self` schema (synthetic `name`/`kind`/metadata).
- *    - `inputType`  → resolved through the shared contract resolver, so
- *                     `x-telo-context-from-root: inputType` substitutes the
- *                     real signature. Without it the annotation would replace
- *                     the node verbatim with the inline `{kind, schema}` wrapper
- *                     the standard library writes everywhere, typing `inputs` as
- *                     `{kind, schema}` instead of the declared properties.
- *
- *  For non-definition manifests the original object is returned. */
-function manifestRootForResolver(m, defs, aliases, allManifests, scopes) {
-    if (m.kind !== "Telo.Definition")
-        return m;
-    const inputs = lookupTemplateInputsSchema(m, defs, aliases, allManifests, scopes);
-    return {
-        ...m,
-        schema: buildSelfSchema(m, defs, aliases),
-        ...(inputs ? { inputType: inputs } : {}),
-    };
-}
 /** True when an issue reports a property that is absent — its path points at a
  *  node the manifest does not contain. */
 export const missingRequired = (issue) => /is missing required property/.test(issue.message);
@@ -202,228 +133,6 @@ function contractOwnerLabel(definition, contract) {
     }
     return canonical;
 }
-/** Resolve a local `$ref` (only `#/$defs/<name>` form) against the root schema.
- *  Non-refs and unresolved refs pass through unchanged. */
-export function resolveLocalRef(schema, root) {
-    if (!schema)
-        return undefined;
-    const ref = schema.$ref;
-    if (typeof ref === "string" && ref.startsWith("#/$defs/")) {
-        const defName = ref.slice("#/$defs/".length);
-        const resolved = root.$defs?.[defName];
-        if (resolved && typeof resolved === "object")
-            return resolved;
-    }
-    // A kernel-owned structural fragment (`telo://manifest#/$defs/InvokeStep`).
-    // Resolved HERE rather than by each walker: this is the one chokepoint every
-    // structural walk already goes through — the step-array walks, the call graph,
-    // the zone projection, the eval-path collector — so a composer that points at a
-    // shared shape stays legible to all of them at once. Nothing is inlined into
-    // the stored schema, which keeps validator-cache identity stable and matches
-    // what `resolveSchemaTypeRefs` does for a named user type.
-    if (typeof ref === "string" && ref.startsWith(BUILTIN_FRAGMENT_PREFIX)) {
-        const defName = ref.slice(BUILTIN_FRAGMENT_PREFIX.length);
-        const resolved = ManifestRootSchema.$defs[defName];
-        if (resolved && typeof resolved === "object")
-            return resolved;
-    }
-    return schema;
-}
-const BUILTIN_FRAGMENT_PREFIX = `${MANIFEST_SCHEMA_URI}#/$defs/`;
-/** Gather property schemas from a (possibly variant-bearing) object schema:
- *  top-level `properties` plus every `oneOf` / `anyOf` / `allOf` branch.
- *
- *  Each branch is resolved through {@link resolveLocalRef} first, so a branch
- *  that points at a shared shape — a `oneOf` arm that IS the kernel's dispatch
- *  site — contributes its properties like an inline one. Without that, pointing a
- *  composer at a shared shape would silently empty every role-driven lookup that
- *  reads this (the inputs slot, the retry policy, the eval paths), which is a
- *  failure with no diagnostic attached to it. */
-export function gatherPropertySchemas(schema, root) {
-    const out = [];
-    const base = resolveLocalRef(schema, root ?? schema) ?? schema;
-    if (base.properties && typeof base.properties === "object") {
-        for (const [k, v] of Object.entries(base.properties)) {
-            out.push([k, v]);
-        }
-    }
-    for (const variantKey of ["oneOf", "anyOf", "allOf"]) {
-        const arr = base[variantKey];
-        if (!Array.isArray(arr))
-            continue;
-        for (const raw of arr) {
-            if (!raw || typeof raw !== "object")
-                continue;
-            const variant = resolveLocalRef(raw, root ?? schema) ?? raw;
-            if (variant.properties) {
-                for (const [k, v] of Object.entries(variant.properties)) {
-                    out.push([k, v]);
-                }
-            }
-        }
-    }
-    return out;
-}
-/**
- * Generic, role-driven walk over a step array. Calls
- * `visit(step, stepPath)` for every step — top-level and nested through the
- * `x-telo-topology-role` forms (`branch`, `branch-list`, `case-map`). This is
- * the single definition of how steps nest, shared by `buildStepContextSchema`
- * (which types `steps.<name>.result`) and `validateStepInvokeReferences` (which
- * checks invoke refs), so the topology contract lives in one place — adding a
- * role or nesting form updates both consumers at once. No resource kind is
- * hardcoded; recursion is driven entirely by the schema annotations.
- */
-export function walkStepArray(steps, stepItemSchema, rootSchema, basePath, visit) {
-    const dispatchRole = (data, role, itemsSchema, path) => {
-        if (role === "branch" && Array.isArray(data)) {
-            walkStepArray(data, stepItemSchema, rootSchema, path, visit);
-        }
-        else if (role === "case-map" && data && typeof data === "object" && !Array.isArray(data)) {
-            for (const [caseKey, arr] of Object.entries(data)) {
-                if (Array.isArray(arr))
-                    walkStepArray(arr, stepItemSchema, rootSchema, `${path}.${caseKey}`, visit);
-            }
-        }
-        else if (role === "branch-list" && Array.isArray(data)) {
-            const entrySchema = resolveLocalRef(itemsSchema, rootSchema);
-            if (!entrySchema)
-                return;
-            data.forEach((entry, i) => {
-                if (!entry || typeof entry !== "object")
-                    return;
-                for (const [subKey, subSchema] of gatherPropertySchemas(entrySchema)) {
-                    const subRole = subSchema["x-telo-topology-role"];
-                    if (typeof subRole !== "string")
-                        continue;
-                    dispatchRole(entry[subKey], subRole, subSchema.items, `${path}[${i}].${subKey}`);
-                }
-            });
-        }
-    };
-    steps.forEach((step, i) => {
-        if (!step || typeof step !== "object")
-            return;
-        const s = step;
-        const stepPath = `${basePath}[${i}]`;
-        visit(s, stepPath);
-        if (!stepItemSchema)
-            return;
-        for (const [propKey, propSchema] of gatherPropertySchemas(stepItemSchema)) {
-            const role = propSchema["x-telo-topology-role"];
-            if (typeof role !== "string")
-                continue;
-            dispatchRole(s[propKey], role, propSchema.items, `${stepPath}.${propKey}`);
-        }
-    });
-}
-/**
- * Build a `steps` context schema for a kind's step body.
- * Walks each step in the manifest array, resolves the invoked resource's output
- * contract, and builds `steps.<name>.result` context entries.
- *
- * Resolution is the shared {@link resolveContract} — the invoked resource
- * manifest's own declaration, then the kind's, resolved to the nearest
- * declaration along `extends`, then permissive. Sharing it with the kernel is
- * what stops `telo check` from typing `steps.X.result` against one contract
- * while dispatch validates against another.
- *
- * The kind layer is what makes `x-telo-stream` properties on definitions
- * actually govern step-result chain validation — without it, the validator falls
- * back to permissive and the stream-opacity rule never fires.
- *
- * Recursion into nested step arrays is annotation-driven via
- * `x-telo-topology-role`. The analyzer recognises three role values:
- *   - `branch`     — value is an array of steps (e.g. then / else / do / catch).
- *   - `branch-list`— value is an array of objects each carrying further roled
- *                    sub-properties (e.g. elseif: [{ if, then }]).
- *   - `case-map`   — value is an object whose values are step arrays (e.g. cases).
- * No specific Run.Sequence field name is hardcoded; any kind that uses
- * a step body and tags its branch fields with these roles works.
- */
-function buildStepContextSchema(manifest, defSchema, allManifests, defs, aliases, scopes) {
-    const props = defSchema.properties;
-    if (!props)
-        return undefined;
-    const contractScope = analyzerContractScope(defs, aliases, scopes, allManifests);
-    const readingModule = manifest.metadata?.module;
-    for (const [fieldName, fieldSchema] of Object.entries(props)) {
-        const stepCtx = readStepSlot(fieldSchema);
-        if (!stepCtx)
-            continue;
-        const invokeField = stepCtx.invoke;
-        const outputTypeField = stepCtx.outputType;
-        // Optional: the field a step uses to produce a result without dispatching.
-        // Only a kind that declares one has pure steps at all.
-        const valueField = stepCtx.value;
-        if (!invokeField || !outputTypeField)
-            continue;
-        const steps = manifest[fieldName];
-        if (!Array.isArray(steps))
-            continue;
-        const stepItemSchema = resolveLocalRef(fieldSchema.items, defSchema);
-        // The instance's own input contract, for typing a pure step that just
-        // forwards one of its values.
-        const ownInputs = resolveTypeFieldToSchema(manifest.inputType, allManifests);
-        const stepProperties = {};
-        walkStepArray(steps, stepItemSchema, defSchema, fieldName, (s) => {
-            const name = s.name;
-            const invoke = s[invokeField];
-            // Only invoke steps register a `steps.<name>.result` entry — control-flow
-            // wrappers (try/if/while/switch/throw) don't produce a result and must
-            // not shadow real entries with a permissive `additionalProperties: true`,
-            // or unknown step references slip through chain validation.
-            if (typeof name !== "string")
-                return;
-            if (!invoke || typeof invoke !== "object") {
-                // A pure step dispatches nothing, so there is no contract to resolve.
-                // Where its expression is a plain chain into something already typed —
-                // an earlier step's result, or the kind's own inputs — that type carries
-                // through; anything else (arithmetic, a call, a comprehension) stays
-                // permissive rather than guessed. Same rule as a named binding's.
-                if (valueField && valueField in s) {
-                    const scopeRoot = {
-                        properties: {
-                            steps: { type: "object", properties: { ...stepProperties } },
-                            ...(ownInputs ? { inputs: ownInputs } : {}),
-                        },
-                    };
-                    const chained = schemaAtChain(bindingPathChain(s[valueField]), scopeRoot);
-                    stepProperties[name] = {
-                        type: "object",
-                        properties: { result: chained ?? PERMISSIVE_CONTRACT },
-                    };
-                }
-                return;
-            }
-            const invokedKind = invoke.kind;
-            const invokedName = invoke.name;
-            // A named `!ref` carries the target's own manifest (which may narrow the
-            // contract for this one instance); an inline `{ kind, ... }` step IS the
-            // manifest. Either way the kind layer resolves through `extends`.
-            const invokedManifest = invokedName
-                ? allManifests.find((m) => m.metadata?.name === invokedName && (!invokedKind || m.kind === invokedKind))
-                : invoke;
-            const invokedDef = invokedKind
-                ? contractScope.resolveIn(invokedKind, readingModule)
-                : undefined;
-            const outputSchema = resolveContract(outputTypeField, invokedManifest, invokedDef, contractScope)?.schema;
-            stepProperties[name] = {
-                type: "object",
-                properties: {
-                    result: outputSchema ?? PERMISSIVE_CONTRACT,
-                },
-            };
-        });
-        if (Object.keys(stepProperties).length > 0) {
-            return {
-                type: "object",
-                properties: stepProperties,
-            };
-        }
-    }
-    return undefined;
-}
 /** The built-in namespace: globally resolvable, crossing no import boundary. */
 const TELO_BUILTIN_MODULE = "Telo";
 /** One mapping from a ref-slot issue to a diagnostic — the shape is identical
@@ -684,84 +393,6 @@ function pathCrossesNestedResource(root, path) {
     }
     return false;
 }
-function collectErrorContextScopes(defSchema) {
-    const out = new Map();
-    if (!defSchema || typeof defSchema !== "object")
-        return out;
-    const seen = new Set();
-    const walk = (schema) => {
-        if (!schema || typeof schema !== "object" || seen.has(schema))
-            return;
-        seen.add(schema);
-        const props = schema.properties;
-        if (props) {
-            for (const [fieldName, fieldSchema] of Object.entries(props)) {
-                if (fieldSchema && typeof fieldSchema === "object") {
-                    const errCtx = fieldSchema["x-telo-error-context"];
-                    if (errCtx && typeof errCtx === "object" && !out.has(fieldName)) {
-                        out.set(fieldName, errCtx);
-                    }
-                }
-                walk(resolveLocalRef(fieldSchema, defSchema));
-            }
-        }
-        if (schema.items)
-            walk(resolveLocalRef(schema.items, defSchema));
-        for (const key of ["oneOf", "anyOf", "allOf"]) {
-            const arr = schema[key];
-            if (Array.isArray(arr))
-                for (const sub of arr)
-                    walk(resolveLocalRef(sub, defSchema));
-        }
-        if (schema.$defs && typeof schema.$defs === "object") {
-            for (const sub of Object.values(schema.$defs)) {
-                walk(sub);
-            }
-        }
-    };
-    walk(defSchema);
-    return out;
-}
-/**
- * Return the error-context schema for a CEL `path` when the path lies within
- * (any depth under) one of the error-bearing fields, else undefined. A path is
- * "within" field `f` when it contains a segment `f[<index>]`. When multiple
- * error-bearing fields match (e.g. a `finally` nested inside a `catch`), the
- * deepest — the one whose segment appears latest in the path — wins, so the
- * innermost branch's schema governs.
- */
-function errorContextForPath(path, scopes) {
-    let best;
-    for (const [fieldName, schema] of scopes) {
-        const escaped = fieldName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-        for (const match of path.matchAll(new RegExp(`(^|\\.)${escaped}\\[\\d+\\]`, "g"))) {
-            if (best === undefined || match.index > best.index) {
-                best = { index: match.index, schema };
-            }
-        }
-    }
-    return best?.schema;
-}
-/** Add a kind's named bindings to a resolved context, when the context declares
- *  a bindings region. They go UNDER the context's own properties: a scope
- *  variable wins over a same-named binding at runtime, so static typing has to
- *  agree (the collision itself is `BINDING_NAME_RESERVED`). */
-function withBindingNames(contextSchema, resource) {
-    const field = contextSchema[BINDINGS_ANNOTATION];
-    if (typeof field !== "string")
-        return contextSchema;
-    const bindings = resource[field];
-    if (bindings === null || typeof bindings !== "object" || Array.isArray(bindings)) {
-        return contextSchema;
-    }
-    return {
-        ...contextSchema,
-        properties: {
-            ...bindingContextProperties(bindings, contextSchema),
-            ...(contextSchema.properties ?? {}),
-        },
-    };
-}
 /** Member-access chains in a CEL expression, or none when it doesn't parse.
  *  Best-effort: a syntax error is reported by the engine pass, not here. */
 function celAccessChains(env, expr) {
@@ -1764,9 +1395,20 @@ export class StaticAnalyzer {
         // fit the slot at all", the schema answers "do their type arguments agree",
         // which cel-js cannot express because it types by constructor identity.
         const celSourceSchemaByPath = new Map();
-        // Context-free typed environments, one per manifest. Reused across every
-        // expression in it — see the build site for why a matched context opts out.
-        const typedEnvByManifest = new Map();
+        // What every CEL expression in this set is typed against. The rule lives in
+        // `cel-scope.ts` so the IDE asks the same question the pass does — a
+        // completion list is a claim that the name it offers will pass this check,
+        // and two implementations of it could not be held in agreement.
+        const celScope = new CelScopeResolver({
+            celEnv: this.celEnv,
+            defs,
+            aliases,
+            scopes: { aliasesByModule, rootModules },
+            allManifests,
+            kernelGlobals,
+            moduleManifest,
+            observedStateContext,
+        });
         // Validate each non-definition, non-system resource
         for (const m of allManifests) {
             const filePath = m.metadata?.source;
@@ -2106,10 +1748,10 @@ export class StaticAnalyzer {
         // state (definitions, aliases, the typed CEL env).
         // Per-resource state computed at enter and read by that resource's CEL
         // sites. The manifest / resource / filePath come straight off each CelSite's
-        // `source` (no need to capture them); only the derived step / invocation
-        // context — which require analyzer state to build — are stashed here.
+        // `source` (no need to capture them); the derived step / invocation / error
+        // context is the scope resolver's, read back from it where a CHECK needs the
+        // same schema an expression is typed against.
         let celStepContextSchema;
-        let celInvocationContext;
         let celErrorScopes = new Map();
         // Region coverage for the "CEL in a non-eval field" check: the union of
         // `x-telo-eval` paths (own + capability) and `x-telo-context` /
@@ -2127,14 +1769,24 @@ export class StaticAnalyzer {
         visitManifest(allManifests, defs, {
             onResourceEnter: (e) => {
                 const m = e.source;
-                celInvocationContext = m.metadata?.xTeloInvocationContext;
-                celStepContextSchema = e.definition?.schema
-                    ? buildStepContextSchema(m, e.definition.schema, allManifests, defs, aliases, { aliasesByModule, rootModules })
-                    : undefined;
+                celScope.enterResource(m, e.definition);
+                // Read back rather than recomputed: the step-inputs check has to see
+                // the same `steps` schema this resource's expressions are typed
+                // against, and a second computation is how the two come to disagree.
+                celStepContextSchema = celScope.stepContextSchema;
+                celErrorScopes = celScope.errorContextScopes;
                 if (e.definition?.schema) {
                     const stepName = m.metadata?.name;
                     const stepFile = m.metadata?.source;
-                    for (const issue of collectStepInputIssues(m, e.definition.schema, allManifests, defs, aliases, { aliasesByModule, rootModules }, celStepContextSchema)) {
+                    // Both drivers of the SAME check: a step's `inputs:` found through
+                    // the step grammar, and a reference slot's found through the
+                    // `x-telo-ref` `inputs:` pointer. A call site the editor can
+                    // complete is a call site `telo check` validates.
+                    const inputIssues = [
+                        ...collectRefInputIssues(m, defs.expandedFieldMapForResource(m, aliases, aliasesByModule), allManifests, defs, aliases, { aliasesByModule, rootModules }),
+                        ...collectStepInputIssues(m, e.definition.schema, allManifests, defs, aliases, { aliasesByModule, rootModules }, celStepContextSchema),
+                    ];
+                    for (const issue of inputIssues) {
                         diagnostics.push({
                             severity: DiagnosticSeverity.Error,
                             code: issue.code ?? "CONTRACT_INPUTS_MISMATCH",
@@ -2152,7 +1804,6 @@ export class StaticAnalyzer {
                         });
                     }
                 }
-                celErrorScopes = collectErrorContextScopes(e.definition?.schema);
                 celBindingSites = findBindingSites(e.definition?.schema);
                 if (celBindingSites) {
                     const declared = m[celBindingSites.field];
@@ -2276,7 +1927,7 @@ export class StaticAnalyzer {
                 // (resource-wide invocation context) carry CEL the kernel evaluates.
                 if (celRuleApplies &&
                     engineName === "cel" &&
-                    celInvocationContext === undefined &&
+                    celScope.invocationContextSchema === undefined &&
                     !evalPathsCover(celEvalPaths, path) &&
                     !celRegionScopes.some((scope) => pathMatchesScope(path, scope)) &&
                     !pathCrossesNestedResource(m, path)) {
@@ -2323,55 +1974,6 @@ export class StaticAnalyzer {
                         }
                     }
                 }
-                let matchedContext = e.contextSchema ?? celInvocationContext;
-                if (celStepContextSchema) {
-                    const base = matchedContext ?? { type: "object", properties: {}, additionalProperties: true };
-                    matchedContext = {
-                        ...base,
-                        properties: {
-                            ...(base.properties ?? {}),
-                            steps: celStepContextSchema,
-                        },
-                    };
-                }
-                // `error` is only in scope inside an error-bearing branch (e.g. a
-                // `catch:` / `finally:`), so it's merged per-path, not resource-wide.
-                const errorSchema = celErrorScopes.size > 0 ? errorContextForPath(path, celErrorScopes) : undefined;
-                if (errorSchema) {
-                    const base = matchedContext ?? { type: "object", properties: {}, additionalProperties: true };
-                    matchedContext = {
-                        ...base,
-                        properties: {
-                            ...(base.properties ?? {}),
-                            error: errorSchema,
-                        },
-                    };
-                }
-                let effectiveContext = null;
-                if (matchedContext) {
-                    const manifestItem = matchedScope
-                        ? getManifestItem(path, matchedScope, m)
-                        : m;
-                    const rootForResolver = manifestRootForResolver(m, defs, aliases, allManifests, { aliasesByModule, rootModules });
-                    const resolvedContext = resolveContextAnnotations(matchedContext, manifestItem, {
-                        manifestRoot: rootForResolver,
-                        defs,
-                        aliases,
-                        allManifests: allManifests,
-                    });
-                    effectiveContext = mergeKernelGlobalsIntoContext(withBindingNames(resolvedContext, m), 
-                    // Typed in the module that DECLARED this resource — for a manifest
-                    // forwarded from an imported library, that is its `moduleGlobals`
-                    // stamp, not the consuming application's block.
-                    kernelGlobals.forResource(m));
-                }
-                else if (observedStateContext) {
-                    // No `x-telo-context` matched, so nothing was chain-validated here
-                    // before. Validate the observed-state segment alone rather than
-                    // merging the kernel globals, whose closed `variables` / `ports`
-                    // nodes would newly reject reads that pass today.
-                    effectiveContext = observedStateContext;
-                }
                 const engine = defaultRegistry().get(engineName);
                 if (!engine) {
                     // No registered engine owns this tag — the expression would go
@@ -2386,27 +1988,15 @@ export class StaticAnalyzer {
                     return;
                 }
                 // The engine type-checks, so it gets the environment typed for THIS
-                // path — not the bare base one. A `Telo.Import`'s variables/secrets
-                // are a config-only contract evaluated in the IMPORTING module's
-                // scope, so they type from the owning module doc and drop
-                // `resources`/`env`, making a reference to either an error.
-                //
-                // Cached per manifest when no `x-telo-context` applied, which is most
-                // expressions: the environment then depends only on the manifest, so
-                // rebuilding it per expression is pure waste — a clone plus a
-                // re-registration of every variable, on every keystroke in the IDE.
-                // A matched context makes the environment path-specific (its schema is
-                // resolved against the enclosing array item), so those still build
-                // fresh rather than risk one item's types leaking into another's.
-                const cached = effectiveContext === null ? typedEnvByManifest.get(m) : undefined;
-                const typedEnv = cached ??
-                    (m.kind === "Telo.Import"
-                        ? buildImportInputCelEnvironment(this.celEnv, allManifests.find((mm) => (mm.kind === "Telo.Application" || mm.kind === "Telo.Library") &&
-                            mm.metadata?.name ===
-                                m.metadata?.module))
-                        : buildTypedCelEnvironment(this.celEnv, m, effectiveContext ?? undefined, moduleManifest));
-                if (effectiveContext === null && !cached)
-                    typedEnvByManifest.set(m, typedEnv);
+                // path — not the bare base one. Both halves come from the one scope
+                // rule, which is what makes the IDE's answer and this check the same
+                // answer rather than two that agree today.
+                const { env: typedEnv, contextSchema: effectiveContext } = celScope.scopeFor({
+                    source: m,
+                    path,
+                    contextSchema: e.contextSchema,
+                    matchedScope,
+                });
                 const result = engine.analyze(expr, { celEnv: typedEnv, contextSchema: effectiveContext });
                 if (result.type !== undefined) {
                     let byPath = celTypeByPath.get(m);