@telorun/analyzer 0.65.0 → 0.67.0

package/dist/call-graph.js

@@ -119,7 +119,13 @@ function resolveUseAtSite(entry, root, concretePath, schemaDefault) {
         if (resolved)
             return { use: resolved };
     }
-    const slot = { kinds: entry.refs, uses: entry.uses, useCases: entry.useCases, inline: false };
+    const slot = {
+        kinds: entry.refs,
+        uses: entry.uses,
+        useCases: entry.useCases,
+        inline: false,
+        valueBranches: [],
+    };
     const unresolvedReason = isTaggedSentinel(selector)
         ? "dynamic"
         : selector === undefined

package/dist/cel-environment.d.ts

@@ -13,6 +13,18 @@ export type { CelHandlers } from "@telorun/templating";
  *  NOTE: The set of kernel globals registered here must match `KERNEL_GLOBAL_NAMES`
  *  in kernel-globals.ts, which is used for chain-access validation. */
 export declare function buildTypedCelEnvironment(baseEnv: Environment, manifest: ResourceManifest, extraContextSchema?: Record<string, any> | null, rootModuleManifest?: ResourceManifest): Environment;
+/**
+ * A kind document — whose CEL is written for whoever instantiates the kind, not
+ * evaluated in the declaring module's own scope.
+ *
+ * Its `examples:` show a consumer's route reading `request` and `result`, its
+ * `description`s show `${{ secrets.API_KEY }}`, and a rule condition reads the
+ * `self` / `referrer` its own evaluator binds. None of those names are in scope
+ * where they are WRITTEN, and all of them are correct where they are READ — so
+ * every check that asks "is this name in scope here" has to stand down on these
+ * documents, or it reports errors nobody can fix without deleting the example.
+ */
+export declare function isKindDocument(manifest: ResourceManifest): boolean;
 /** CEL environment for the `variables:`/`secrets:` expressions on a `Telo.Import`.
  *
  *  Import inputs are a config-only contract: their expressions are evaluated

package/dist/cel-environment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cel-environment.d.ts","sourceRoot":"","sources":["../src/cel-environment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAcrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;;;uEASuE;AACvE,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,gBAAgB,EAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,EAI/C,kBAAkB,CAAC,EAAE,gBAAgB,GACpC,WAAW,CAgGb;AAuBD;;;;;;8DAM8D;AAC9D,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,WAAW,EACpB,cAAc,EAAE,gBAAgB,GAAG,SAAS,GAC3C,WAAW,CAkCb"}
+{"version":3,"file":"cel-environment.d.ts","sourceRoot":"","sources":["../src/cel-environment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAcrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;;;uEASuE;AACvE,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,gBAAgB,EAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,EAI/C,kBAAkB,CAAC,EAAE,gBAAgB,GACpC,WAAW,CA8Gb;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAElE;AAuBD;;;;;;8DAM8D;AAC9D,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,WAAW,EACpB,cAAc,EAAE,gBAAgB,GAAG,SAAS,GAC3C,WAAW,CAkCb"}

package/dist/cel-environment.js

@@ -35,24 +35,26 @@ rootModuleManifest) {
         for (const brand of Object.keys(VALUE_BRAND_BASE)) {
             env.registerType(brand, { fields: {} });
         }
-        // Build typed ObjectSchema from manifest.variables if it looks like a schema map
-        const vars = manifest.variables;
-        if (vars !== null && typeof vars === "object" && !Array.isArray(vars)) {
-            const entries = Object.entries(vars).filter(([, v]) => v !== null && typeof v === "object" && !Array.isArray(v));
-            if (entries.length > 0) {
-                const schema = {};
-                for (const [k, v] of entries) {
-                    schema[k] = jsonSchemaToCelType(v);
-                }
-                env.registerVariable({ name: "variables", schema });
-            }
-            else {
-                env.registerVariable("variables", "map");
-            }
-        }
-        else {
-            env.registerVariable("variables", "map");
-        }
+        // `variables` / `secrets`: the DECLARING module's blocks, which is the
+        // contract the resource's CEL is evaluated against at runtime. Read the
+        // same three ways `ports` and `module` are, and for the same reason — a
+        // resource doc does not carry them, so typing from `manifest` alone left
+        // every ordinary resource with an open `variables` and no check at all,
+        // while `ports.<typo>` one line away was an error.
+        //
+        // Order matters: a module-identity doc analyzing itself carries its own
+        // block; a resource forwarded from an imported library carries its
+        // library's as `metadata.moduleGlobals`, which must win over the consuming
+        // application's; everything else is the entry module's own doc.
+        const moduleGlobals = manifest.metadata?.moduleGlobals;
+        // A KIND document is the exception, and it is not a detail: the CEL inside
+        // a `Telo.Definition`'s `schema:` — an `examples:` entry, a `description`
+        // showing `${{ secrets.API_KEY }}` — illustrates what a CONSUMER writes, in
+        // the consumer's scope. Closing those over the declaring module's blocks
+        // reported an error against a name the module never meant to declare, and
+        // one nobody could fix without deleting the example.
+        const root = (isKindDocument(manifest) ? undefined : rootModuleManifest);
+        registerConfigNamespace(env, manifest.variables ?? moduleGlobals?.variables ?? root?.variables, "variables");
         // `ports` namespace: each entry types as the brand its `protocol` selects
         // (tcp → TcpPort, udp → UdpPort), so `${{ ports.http }}` carries a nominal
         // type that consuming fields can check against.
@@ -73,7 +75,7 @@ rootModuleManifest) {
         else {
             env.registerVariable("ports", "map");
         }
-        env.registerVariable("secrets", "map");
+        registerConfigNamespace(env, manifest.secrets ?? moduleGlobals?.secrets ?? root?.secrets, "secrets");
         env.registerVariable("resources", "map");
         // `module` — the declaring module's own `metadata`, so a manifest reads its
         // version instead of restating it. A resource forwarded from an imported
@@ -110,6 +112,20 @@ rootModuleManifest) {
         return baseEnv.clone();
     }
 }
+/**
+ * A kind document — whose CEL is written for whoever instantiates the kind, not
+ * evaluated in the declaring module's own scope.
+ *
+ * Its `examples:` show a consumer's route reading `request` and `result`, its
+ * `description`s show `${{ secrets.API_KEY }}`, and a rule condition reads the
+ * `self` / `referrer` its own evaluator binds. None of those names are in scope
+ * where they are WRITTEN, and all of them are correct where they are READ — so
+ * every check that asks "is this name in scope here" has to stand down on these
+ * documents, or it reports errors nobody can fix without deleting the example.
+ */
+export function isKindDocument(manifest) {
+    return manifest.kind === "Telo.Definition" || manifest.kind === "Telo.Abstract";
+}
 /** Register a `variables`/`secrets` namespace typed from a module doc's schema map
  *  (`{ name: <schema>, … }`), falling back to dyn `map` when absent or untyped. */
 function registerConfigNamespace(env, block, name) {

package/dist/cel-scope.d.ts

@@ -132,6 +132,14 @@ export declare class CelScopeResolver {
     private stepContext;
     private invocationContext;
     private errorScopes;
+    /** The same two facts per `resources:` entry of a `Telo.Definition` — a
+     *  template body is a declaration of ANOTHER kind, so its step body and its
+     *  error branches are that kind's, not the enclosing definition's. */
+    private bodyScopes;
+    /** The enclosing definition's `self` schema, resolved once per resource. A
+     *  template body's contexts resolve against the BODY, so `self` — the one
+     *  binding anchored on the definition — is substituted before they do. */
+    private selfSchema;
     constructor(inputs: CelScopeInputs);
     /** The `steps` context schema for the current resource, or undefined when its
      *  kind declares no step body. Exposed because the step-inputs check needs the

package/dist/cel-scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cel-scope.d.ts","sourceRoot":"","sources":["../src/cel-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAQvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAO9D,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,qBAAqB,CAAC;AAsE7B;;;;;;;;;;;oEAWoE;AACpE,wBAAgB,uBAAuB,CACrC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACtB,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,MAAM,EAAE,YAAY,GACnB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC7B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC9B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY,GACnB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAqGjC;AAED,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GACzC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAmClC;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,GACvC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAWjC;AAED;;;+DAG+D;AAC/D,wBAAgB,gBAAgB,CAC9B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAClC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAcrB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,QAAQ;IACvB,wDAAwD;IACxD,GAAG,EAAE,WAAW,CAAC;IACjB;+EAC2E;IAC3E,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;CAC3C;AAED;+CAC+C;AAC/C,MAAM,WAAW,cAAc;IAC7B,0CAA0C;IAC1C,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,YAAY,CAAC;IACrB,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,aAAa,EAAE,kBAAkB,CAAC;IAClC,sEAAsE;IACtE,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC,+EAA+E;IAC/E,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;CAClD;AAED;;;6BAG6B;AAC7B,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,gBAAgB,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,qBAAa,gBAAgB;IAQf,OAAO,CAAC,QAAQ,CAAC,MAAM;IAPnC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA4C;IAE/E,4DAA4D;IAC5D,OAAO,CAAC,WAAW,CAAkC;IACrD,OAAO,CAAC,iBAAiB,CAAkC;IAC3D,OAAO,CAAC,WAAW,CAA+C;gBAErC,MAAM,EAAE,cAAc;IAEnD;;;uDAGmD;IACnD,IAAI,iBAAiB,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAEvD;IAED,sEAAsE;IACtE,IAAI,kBAAkB,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAEjE;IAED;;;+CAG2C;IAC3C,IAAI,uBAAuB,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAE7D;IAED,oDAAoD;IACpD,aAAa,CAAC,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,kBAAkB,GAAG,SAAS,GAAG,IAAI;IAoBpF;;;;;;;;;OASG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ;IAoCpC;;sEAEkE;IAClE,OAAO,CAAC,iBAAiB;CA0D1B"}
+{"version":3,"file":"cel-scope.d.ts","sourceRoot":"","sources":["../src/cel-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAQvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAO9D,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,qBAAqB,CAAC;AAuE7B;;;;;;;;;;;oEAWoE;AACpE,wBAAgB,uBAAuB,CACrC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACtB,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,MAAM,EAAE,YAAY,GACnB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC7B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC9B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY,GACnB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAqGjC;AAED,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GACzC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAmClC;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,GACvC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAWjC;AAED;;;+DAG+D;AAC/D,wBAAgB,gBAAgB,CAC9B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAClC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAcrB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,QAAQ;IACvB,wDAAwD;IACxD,GAAG,EAAE,WAAW,CAAC;IACjB;+EAC2E;IAC3E,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;CAC3C;AAED;+CAC+C;AAC/C,MAAM,WAAW,cAAc;IAC7B,0CAA0C;IAC1C,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,YAAY,CAAC;IACrB,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,aAAa,EAAE,kBAAkB,CAAC;IAClC,sEAAsE;IACtE,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC,+EAA+E;IAC/E,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;CAClD;AAED;;;6BAG6B;AAC7B,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,gBAAgB,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,qBAAa,gBAAgB;IAsBf,OAAO,CAAC,QAAQ,CAAC,MAAM;IArBnC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA4C;IAE/E,4DAA4D;IAC5D,OAAO,CAAC,WAAW,CAAkC;IACrD,OAAO,CAAC,iBAAiB,CAAkC;IAC3D,OAAO,CAAC,WAAW,CAA+C;IAClE;;0EAEsE;IACtE,OAAO,CAAC,UAAU,CAMV;IACR;;8EAE0E;IAC1E,OAAO,CAAC,UAAU,CAAkC;gBAEvB,MAAM,EAAE,cAAc;IAEnD;;;uDAGmD;IACnD,IAAI,iBAAiB,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAEvD;IAED,sEAAsE;IACtE,IAAI,kBAAkB,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAEjE;IAED;;;+CAG2C;IAC3C,IAAI,uBAAuB,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAE7D;IAED,oDAAoD;IACpD,aAAa,CAAC,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,kBAAkB,GAAG,SAAS,GAAG,IAAI;IA6CpF;;;;;;;;;OASG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ;IAoCpC;;sEAEkE;IAClE,OAAO,CAAC,iBAAiB;CAgH1B"}

package/dist/cel-scope.js

@@ -5,6 +5,7 @@ import { analyzerContractScope, PERMISSIVE_CONTRACT, resolveContract, } from "./
 import { mergeKernelGlobalsIntoContext, } from "./kernel-globals.js";
 import { resolveLocalRef, walkStepArray } from "./schema-walk.js";
 import { readStepSlot } from "./step-slot.js";
+import { bodyForPath, templateBodies } from "./template-body.js";
 import { getManifestItem, resolveContextAnnotations, resolveTypeFieldToSchema, } from "./validate-cel-context.js";
 /** Build a closed JSON Schema for the `self` CEL variable available inside a
  *  `Telo.Definition` template body. Mirrors the runtime template controller's
@@ -268,6 +269,14 @@ export class CelScopeResolver {
     stepContext;
     invocationContext;
     errorScopes = new Map();
+    /** The same two facts per `resources:` entry of a `Telo.Definition` — a
+     *  template body is a declaration of ANOTHER kind, so its step body and its
+     *  error branches are that kind's, not the enclosing definition's. */
+    bodyScopes = [];
+    /** The enclosing definition's `self` schema, resolved once per resource. A
+     *  template body's contexts resolve against the BODY, so `self` — the one
+     *  binding anchored on the definition — is substituted before they do. */
+    selfSchema;
     constructor(inputs) {
         this.inputs = inputs;
     }
@@ -293,10 +302,30 @@ export class CelScopeResolver {
     enterResource(m, definition) {
         const { allManifests, defs, aliases, scopes } = this.inputs;
         this.invocationContext = m.metadata?.xTeloInvocationContext;
-        this.stepContext = definition?.schema
-            ? buildStepContextSchema(m, definition.schema, allManifests, defs, aliases, scopes)
+        // The INHERITANCE-RESOLVED schema at both sites, for the reason the CEL
+        // context regions use it: an `extends` child is authored against
+        // merge(parent, own), so a step body or a `catch:` region the parent
+        // declares is in force on the child. All three consumers share one memo so
+        // they cannot come to disagree about which schema a kind means.
+        const authorSchema = defs.effectiveSchemaOf(definition);
+        this.stepContext = authorSchema
+            ? buildStepContextSchema(m, authorSchema, allManifests, defs, aliases, scopes)
             : undefined;
-        this.errorScopes = collectErrorContextScopes(definition?.schema);
+        this.errorScopes = collectErrorContextScopes(authorSchema);
+        this.selfSchema =
+            m.kind === "Telo.Definition" ? buildSelfSchema(m, defs, aliases) : undefined;
+        this.bodyScopes = templateBodies(m, defs, aliases, scopes).map((body) => {
+            const bodySchema = defs.effectiveSchemaOf(body.definition);
+            return {
+                prefix: body.prefix,
+                scopePrefix: body.scopePrefix,
+                manifest: body.manifest,
+                stepContext: bodySchema
+                    ? buildStepContextSchema(body.manifest, bodySchema, allManifests, defs, aliases, scopes)
+                    : undefined,
+                errorScopes: collectErrorContextScopes(bodySchema),
+            };
+        });
     }
     /**
      * What the expression at `site` is typed against.
@@ -333,16 +362,36 @@ export class CelScopeResolver {
         const { path } = site;
         const m = site.source;
         let matched = site.contextSchema ?? this.invocationContext;
-        if (this.stepContext) {
+        // Inside a template body the step and error regions are the NESTED kind's.
+        // Its `steps` accumulator and its `catch:` branches are declared there, and
+        // the enclosing definition's (there are none) would say nothing about them.
+        const inBody = this.bodyScopes.length > 0 ? bodyForPath(this.bodyScopes, path) : undefined;
+        const stepContext = inBody ? inBody.stepContext : this.stepContext;
+        const errorScopes = inBody ? inBody.errorScopes : this.errorScopes;
+        if (stepContext) {
             const base = matched ?? { type: "object", properties: {}, additionalProperties: true };
             matched = {
                 ...base,
-                properties: { ...(base.properties ?? {}), steps: this.stepContext },
+                properties: {
+                    // `inputs` is in scope beside `steps` wherever a step body runs — the
+                    // step engine evaluates a step against the enclosing kind's own
+                    // arguments, which is what `steps[0].inputs.x` reads. Modelled here
+                    // because it was modelled NOWHERE: the step context is open, so a
+                    // chain through it was never checked and the name's absence went
+                    // unnoticed until something asked whether the root existed.
+                    //
+                    // OPEN, not typed from the kind's `inputType`: closing it would newly
+                    // reject every read of an argument the contract does not spell out,
+                    // which is a separate decision from knowing the name is legal.
+                    inputs: { type: "object", additionalProperties: true },
+                    ...(base.properties ?? {}),
+                    steps: stepContext,
+                },
             };
         }
         // `error` is only in scope inside an error-bearing branch (e.g. a
         // `catch:` / `finally:`), so it's merged per-path, not resource-wide.
-        const errorSchema = this.errorScopes.size > 0 ? errorContextForPath(path, this.errorScopes) : undefined;
+        const errorSchema = errorScopes.size > 0 ? errorContextForPath(path, errorScopes) : undefined;
         if (errorSchema) {
             const base = matched ?? { type: "object", properties: {}, additionalProperties: true };
             matched = {
@@ -358,17 +407,46 @@ export class CelScopeResolver {
             return this.inputs.observedStateContext;
         }
         const { defs, aliases, scopes, allManifests, kernelGlobals } = this.inputs;
-        const manifestItem = site.matchedScope
-            ? getManifestItem(path, site.matchedScope, m)
-            : m;
-        const rootForResolver = manifestRootForResolver(m, defs, aliases, allManifests, scopes);
+        // A template body's context annotations are the NESTED kind's, and every one
+        // that anchors at a root — `x-telo-context-element-from`,
+        // `-collection-from`, `-from-root`, `x-telo-bindings-from` — means the root
+        // of the DECLARATION they were written for. Resolving them against the
+        // enclosing `Telo.Definition` looked `collection:` up on a document that has
+        // no such field, so `item` typed open and a typo below it went unreported —
+        // the one place a nested declaration did not answer as the same declaration
+        // written at the top level.
+        //
+        // So the path and the scope are rebased into the body and the body becomes
+        // the resolution root. `self` is the single binding that genuinely belongs to
+        // the enclosing definition, and it is substituted below rather than left as
+        // an annotation the rebased root would misread.
+        const body = inBody;
+        const localPath = body ? path.slice(body.prefix.length + 1) : path;
+        const localScope = body && site.matchedScope?.startsWith(`${body.scopePrefix}.`)
+            ? `$.${site.matchedScope.slice(body.scopePrefix.length + 1)}`
+            : body
+                ? undefined
+                : site.matchedScope;
+        const rootManifest = body ? body.manifest : m;
+        if (body && this.selfSchema && matched.properties?.self) {
+            matched = {
+                ...matched,
+                properties: { ...matched.properties, self: this.selfSchema },
+            };
+        }
+        const manifestItem = localScope
+            ? getManifestItem(localPath, localScope, rootManifest)
+            : rootManifest;
+        const rootForResolver = body
+            ? rootManifest
+            : manifestRootForResolver(m, defs, aliases, allManifests, scopes);
         const resolved = resolveContextAnnotations(matched, manifestItem, {
             manifestRoot: rootForResolver,
             defs,
             aliases,
             allManifests: allManifests,
         });
-        return mergeKernelGlobalsIntoContext(withBindingNames(resolved, m), 
+        return mergeKernelGlobalsIntoContext(withBindingNames(resolved, rootManifest), 
         // Typed in the module that DECLARED this resource — for a manifest
         // forwarded from an imported library, that is its `moduleGlobals` stamp,
         // not the consuming application's block.

package/dist/definition-registry.d.ts

@@ -18,6 +18,9 @@ export declare class DefinitionRegistry {
     private readonly fieldMaps;
     /** Reverse inheritance index: parent kind → direct child kinds. */
     private readonly extendedBy;
+    /** Memoized inheritance-resolved schemas. `null` records "resolved to
+     *  nothing", so a kind with no schema is not re-walked on every resource. */
+    private readonly effectiveSchemas;
     /** DEPRECATED module identity table: identity string → canonical module name
      *  ("std/pipeline" → "pipeline"). Serves only the legacy
      *  `<namespace>/<module>#<Kind>` form of `x-telo-ref`, kept resolvable for
@@ -131,6 +134,27 @@ export declare class DefinitionRegistry {
      *  never registered. */
     resolveRef(xTeloRef: string): string | undefined;
     resolve(kind: string): ResourceDefinition | undefined;
+    /**
+     * The kind's AUTHOR-FACING schema — its own merged with everything it
+     * inherits along `extends` — memoized per kind.
+     *
+     * This is what every consumer reading a kind's schema to interpret an
+     * INSTANCE must use, because that is the schema the instance was authored
+     * against and the one the kernel stamps at definition registration. Reading
+     * `resolve(kind).schema` instead sees only what the leaf declared, so an
+     * annotation on a parent — a CEL context region, a step body, an error
+     * context — is invisible on every child, silently and per consumer. Sharing
+     * one memo is what keeps those consumers from drifting apart.
+     *
+     * Lazy for the same reason `getFieldMap` is: a child registered before its
+     * parent still sees the inherited half once both are present.
+     */
+    effectiveSchema(kind: string): Record<string, unknown> | undefined;
+    /** The effective schema for a definition, by the kind it is registered under.
+     *  Falls back to the definition's own schema when it is not in this registry
+     *  (a synthesized or not-yet-registered kind), which is the pre-inheritance
+     *  behaviour and the safe direction: it types less, never wrongly. */
+    effectiveSchemaOf(definition: ResourceDefinition | undefined): Record<string, unknown> | undefined;
     /** Returns the reference field map for the given kind, computed lazily from the
      *  kind's AUTHOR-FACING (inheritance-resolved) schema and memoized. Lazy so a
      *  child registered before its parent still sees the parent's inherited ref
@@ -166,6 +190,23 @@ export declare class DefinitionRegistry {
      */
     resolveSchemaFromNode(schemaFrom: string, ownerScope: AliasResolver): Record<string, any> | undefined;
     private resolveSchemaFromSubMap;
+    /** The kinds a definition descends from DIRECTLY — the same two edges
+     *  `register` feeds into `extendedBy`, read the other way.
+     *
+     *  Both spellings, because either can carry the edge that satisfies a slot:
+     *  `capability:` is the legacy implements-this form, `extends:` the canonical
+     *  one. A consumer walking these by hand would be a second reading of what an
+     *  inheritance edge IS, and the downward index and the upward walk have to
+     *  agree about that forever. */
+    parentsOf(kind: string): string[];
+    /** Whether every kind this one descends from is registered.
+     *
+     *  When it is, what the kind implements is FULLY KNOWN: a target it does not
+     *  reach is one it genuinely does not implement, so a mismatch is a verdict.
+     *  When a hop is missing — an unimported abstract, an alias the declaring file
+     *  could not resolve — a mismatch cannot be told from a missing dependency,
+     *  which is the partial context every reference check stays lenient in. */
+    ancestryResolved(kind: string): boolean;
     /** Returns all definitions that transitively extend the given abstract kind.
      *  Follows the capability chain to any depth (equivalent to instanceof in OOP).
      *  Definitions are included regardless of registration order. */

package/dist/definition-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"definition-registry.d.ts","sourceRoot":"","sources":["../src/definition-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,0BAA0B,CAAC;AAOlC,qBAAa,kBAAkB;;IAK7B;;sFAEkF;IAClF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IACzD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAyD;IAC5F;;mFAE+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IAEzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyC;IAC9D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D;;;;wEAIoE;IACpE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IAEzD,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI;IAoC9C,OAAO,CAAC,aAAa;IASrB;;;;;;;;;;;;;2FAauF;IACvF,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAK1E;;;;;;;;;;gFAU4E;IAC5E,uBAAuB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO;IAQzE;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,YAAY;IASpB;uFACmF;IACnF,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAIhC;;;gEAG4D;IAC5D,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS;IAMxD;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE;IAMtE,yEAAyE;IACzE,sBAAsB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,WAAW,EAAE;IAMjF;;;sEAGkE;IAClE,OAAO,CAAC,WAAW;IAYnB;;;;;;iCAM6B;IAC7B,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,GAAG,SAAS;IASnE;;;;4EAIwE;IACxE,OAAO,CAAC,iBAAiB;IAqBzB;;;;;;;;;;;;;;4BAcwB;IACxB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAShD,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAIrD;;;uCAGmC;IACnC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAWxD,gGAAgG;IAChG,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,GACvD,iBAAiB,GAAG,SAAS;IAOhC;;;;;;;;qFAQiF;IACjF,2BAA2B,CACzB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC1C,iBAAiB,GAAG,SAAS;IAkChC;;;;;;;;;;;;;OAaG;IACH,qBAAqB,CACnB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,aAAa,GACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS;IAsBlC,OAAO,CAAC,uBAAuB;IAU/B;;qEAEiE;IACjE,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAgBxD,KAAK,IAAI,MAAM,EAAE;CAGlB"}
+{"version":3,"file":"definition-registry.d.ts","sourceRoot":"","sources":["../src/definition-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,0BAA0B,CAAC;AAOlC,qBAAa,kBAAkB;;IAK7B;;sFAEkF;IAClF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IACzD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAyD;IAC5F;;mFAE+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IAEzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyC;IAC9D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D;iFAC6E;IAC7E,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqD;IACtF;;;;wEAIoE;IACpE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IAEzD,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI;IAqC9C,OAAO,CAAC,aAAa;IASrB;;;;;;;;;;;;;2FAauF;IACvF,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAK1E;;;;;;;;;;gFAU4E;IAC5E,uBAAuB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO;IAQzE;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,YAAY;IASpB;uFACmF;IACnF,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAIhC;;;gEAG4D;IAC5D,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS;IAMxD;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE;IAMtE,yEAAyE;IACzE,sBAAsB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,WAAW,EAAE;IAMjF;;;sEAGkE;IAClE,OAAO,CAAC,WAAW;IAYnB;;;;;;iCAM6B;IAC7B,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,GAAG,SAAS;IASnE;;;;4EAIwE;IACxE,OAAO,CAAC,iBAAiB;IAqBzB;;;;;;;;;;;;;;4BAcwB;IACxB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAShD,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAIrD;;;;;;;;;;;;;;OAcG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAYlE;;;0EAGsE;IACtE,iBAAiB,CAAC,UAAU,EAAE,kBAAkB,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAOlG;;;uCAGmC;IACnC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAWxD,gGAAgG;IAChG,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,GACvD,iBAAiB,GAAG,SAAS;IAOhC;;;;;;;;qFAQiF;IACjF,2BAA2B,CACzB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC1C,iBAAiB,GAAG,SAAS;IAkChC;;;;;;;;;;;;;OAaG;IACH,qBAAqB,CACnB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,aAAa,GACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS;IAsBlC,OAAO,CAAC,uBAAuB;IAU/B;;;;;;;oCAOgC;IAChC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE;IAQjC;;;;;;+EAM2E;IAC3E,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAavC;;qEAEiE;IACjE,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAgBxD,KAAK,IAAI,MAAM,EAAE;CAGlB"}

package/dist/definition-registry.js

@@ -23,6 +23,9 @@ export class DefinitionRegistry {
     fieldMaps = new Map();
     /** Reverse inheritance index: parent kind → direct child kinds. */
     extendedBy = new Map();
+    /** Memoized inheritance-resolved schemas. `null` records "resolved to
+     *  nothing", so a kind with no schema is not re-walked on every resource. */
+    effectiveSchemas = new Map();
     /** DEPRECATED module identity table: identity string → canonical module name
      *  ("std/pipeline" → "pipeline"). Serves only the legacy
      *  `<namespace>/<module>#<Kind>` form of `x-telo-ref`, kept resolvable for
@@ -38,6 +41,7 @@ export class DefinitionRegistry {
         // so any already-computed map recomputes against the now-larger def set; the
         // maps rebuild lazily on first `getFieldMap` (after all defs are registered).
         this.fieldMaps.clear();
+        this.effectiveSchemas.clear();
         // `capability` populates extendedBy for backward-compat with the legacy pattern where
         // a concrete definition overloaded `capability: <AbstractKind>` to mean "implements
         // this abstract." The canonical pattern is `extends` (below). Both populate the index,
@@ -263,6 +267,43 @@ export class DefinitionRegistry {
     resolve(kind) {
         return this.defs.get(kind);
     }
+    /**
+     * The kind's AUTHOR-FACING schema — its own merged with everything it
+     * inherits along `extends` — memoized per kind.
+     *
+     * This is what every consumer reading a kind's schema to interpret an
+     * INSTANCE must use, because that is the schema the instance was authored
+     * against and the one the kernel stamps at definition registration. Reading
+     * `resolve(kind).schema` instead sees only what the leaf declared, so an
+     * annotation on a parent — a CEL context region, a step body, an error
+     * context — is invisible on every child, silently and per consumer. Sharing
+     * one memo is what keeps those consumers from drifting apart.
+     *
+     * Lazy for the same reason `getFieldMap` is: a child registered before its
+     * parent still sees the inherited half once both are present.
+     */
+    effectiveSchema(kind) {
+        const cached = this.effectiveSchemas.get(kind);
+        if (cached !== undefined)
+            return cached ?? undefined;
+        const def = this.defs.get(kind);
+        if (!def)
+            return undefined;
+        const schema = effectiveAuthorSchema(def, (k) => this.resolve(k));
+        this.effectiveSchemas.set(kind, schema ?? null);
+        return schema;
+    }
+    /** The effective schema for a definition, by the kind it is registered under.
+     *  Falls back to the definition's own schema when it is not in this registry
+     *  (a synthesized or not-yet-registered kind), which is the pre-inheritance
+     *  behaviour and the safe direction: it types less, never wrongly. */
+    effectiveSchemaOf(definition) {
+        if (!definition)
+            return undefined;
+        const { name, module: mod } = definition.metadata;
+        const resolved = this.effectiveSchema(mod ? `${mod}.${name}` : name);
+        return resolved ?? definition.schema;
+    }
     /** Returns the reference field map for the given kind, computed lazily from the
      *  kind's AUTHOR-FACING (inheritance-resolved) schema and memoized. Lazy so a
      *  child registered before its parent still sees the parent's inherited ref
@@ -368,6 +409,41 @@ export class DefinitionRegistry {
             return null;
         return buildFieldMapAtPath(subSchema, fieldPath);
     }
+    /** The kinds a definition descends from DIRECTLY — the same two edges
+     *  `register` feeds into `extendedBy`, read the other way.
+     *
+     *  Both spellings, because either can carry the edge that satisfies a slot:
+     *  `capability:` is the legacy implements-this form, `extends:` the canonical
+     *  one. A consumer walking these by hand would be a second reading of what an
+     *  inheritance edge IS, and the downward index and the upward walk have to
+     *  agree about that forever. */
+    parentsOf(kind) {
+        const def = this.defs.get(kind);
+        if (!def)
+            return [];
+        return [def.capability, def.extends].filter((parent) => typeof parent === "string" && parent.length > 0);
+    }
+    /** Whether every kind this one descends from is registered.
+     *
+     *  When it is, what the kind implements is FULLY KNOWN: a target it does not
+     *  reach is one it genuinely does not implement, so a mismatch is a verdict.
+     *  When a hop is missing — an unimported abstract, an alias the declaring file
+     *  could not resolve — a mismatch cannot be told from a missing dependency,
+     *  which is the partial context every reference check stays lenient in. */
+    ancestryResolved(kind) {
+        const queue = [kind];
+        const seen = new Set();
+        while (queue.length > 0) {
+            const current = queue.shift();
+            if (seen.has(current))
+                continue;
+            seen.add(current);
+            if (!this.defs.has(current))
+                return false;
+            queue.push(...this.parentsOf(current));
+        }
+        return true;
+    }
     /** Returns all definitions that transitively extend the given abstract kind.
      *  Follows the capability chain to any depth (equivalent to instanceof in OOP).
      *  Definitions are included regardless of registration order. */

package/dist/dependency-graph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dependency-graph.d.ts","sourceRoot":"","sources":["../src/dependency-graph.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B;kDAC8C;IAC9C,KAAK,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;IACpC;oFACgF;IAChF,KAAK,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;CACrC;AAID;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE,aAAa,EACvB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC3C,eAAe,CAyDjB;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,aAAa,CAAC,YAAY,CAAC,GAAG,MAAM,CAOtE"}
+{"version":3,"file":"dependency-graph.d.ts","sourceRoot":"","sources":["../src/dependency-graph.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAGnE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B;kDAC8C;IAC9C,KAAK,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;IACpC;oFACgF;IAChF,KAAK,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;CACrC;AAID;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE,aAAa,EACvB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC3C,eAAe,CA2DjB;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,aAAa,CAAC,YAAY,CAAC,GAAG,MAAM,CAOtE"}

package/dist/dependency-graph.js

@@ -1,4 +1,5 @@
 import { buildCallGraph, projectToPairs } from "./call-graph.js";
+import { readSuppliedResources } from "./resource-input.js";
 const nodeKey = (kind, name) => `${kind}\0${name}`;
 /**
  * Builds a directed acyclic graph (DAG) of boot-time resource dependencies and
@@ -45,6 +46,7 @@ export function buildDependencyGraph(resources, registry, aliases, aliasesByModu
     for (const key of nodes.keys())
         if (!deps.has(key))
             deps.set(key, new Set());
+    addResourceInputEdges(resources, nodes, deps);
     // --- Kahn's topological sort ---
     // in-degree[X] = number of X's dependencies (size of deps[X])
     // reverse[dep] = set of nodes that depend on dep (for degree decrement)
@@ -130,3 +132,66 @@ function findCycle(nodes, deps) {
     }
     return [];
 }
+/**
+ * Boot-order edges for the one thing a `Telo.Import` does hold: the instances it
+ * hands DOWN to its target library's declared `resources:` inputs.
+ *
+ * An import is otherwise module wiring rather than a runtime node — it is in
+ * `DEPENDENCY_GRAPH_SKIP_KINDS` and the call graph gives it no node at all — but
+ * a borrowed instance must exist before the import initializes, and a cycle
+ * through one is a cycle like any other. The edges are added here rather than
+ * read off the reference field map because the accepted KIND at this slot is
+ * declared by the TARGET library, not by the `Telo.Import` schema, so there is
+ * no `x-telo-ref` for the map to read; the constraint itself is checked by
+ * `validate-resource-inputs`.
+ */
+function addResourceInputEdges(resources, nodes, deps) {
+    // Every import that supplies inputs becomes a node FIRST, so a cross-module
+    // reference below can resolve to the import that exports its target.
+    const imports = [];
+    for (const m of resources) {
+        if (m.kind !== "Telo.Import")
+            continue;
+        const alias = m.metadata?.name;
+        const supplied = readSuppliedResources(m);
+        if (!alias || Object.keys(supplied).length === 0)
+            continue;
+        const key = nodeKey(m.kind, alias);
+        nodes.set(key, { kind: m.kind, name: alias });
+        if (!deps.has(key))
+            deps.set(key, new Set());
+        imports.push({ key, supplied });
+    }
+    if (imports.length === 0)
+        return;
+    const byName = new Map();
+    for (const [key, node] of nodes)
+        byName.set(node.name, key);
+    // An import is keyed by its alias, and that is also how a cross-module
+    // reference names it — index those so one resolves.
+    for (const m of resources) {
+        if (m.kind !== "Telo.Import")
+            continue;
+        const alias = m.metadata?.name;
+        const key = alias ? nodeKey(m.kind, alias) : undefined;
+        if (alias && key && nodes.has(key))
+            byName.set(alias, key);
+    }
+    for (const { key, supplied } of imports) {
+        const set = deps.get(key);
+        for (const value of Object.values(supplied)) {
+            const ref = value;
+            // A CROSS-MODULE reference (`!ref Other.db`) names an instance exported by
+            // another import, never a local resource. Looking it up in the local name
+            // map would find an unrelated resource of the same name — a wrong edge,
+            // and possibly a phantom cycle — or nothing at all. What it depends on is
+            // the IMPORT that exports it, which is the projection
+            // `localDependencyNames` already makes at runtime.
+            const alias = typeof ref?.alias === "string" ? ref.alias : undefined;
+            const targetName = alias && alias !== "Self" ? alias : typeof ref?.name === "string" ? ref.name : undefined;
+            const target = targetName ? byName.get(targetName) : undefined;
+            if (target && target !== key)
+                set.add(target);
+        }
+    }
+}