@telorun/analyzer 0.66.0 → 0.67.0

package/dist/system-kinds.js

@@ -25,8 +25,13 @@ export const DEPENDENCY_GRAPH_SKIP_KINDS = new Set([
 /** Skipped by `!ref` sentinel resolution: kinds whose bodies are
  *  blueprints or import-time metadata, not resource instances with
  *  user-referenced ref slots. Mirrors `REF_VALIDATION_SKIP_KINDS` but
- *  also drops Telo.Import (its `source` isn't a ref slot, and walking
- *  the field map on it is pointless since there's no registered kind). */
+ *  also lists Telo.Import, because walking its field map is pointless —
+ *  there is no registered kind behind it.
+ *
+ *  `resolveRefSentinels` reaches Telo.Import's `resources:` block AHEAD of this
+ *  set, deliberately: those are the references an importer supplies for a
+ *  library's declared inputs, and they resolve exactly like any other. Nothing
+ *  else on the document is a reference slot, so only that subtree is walked. */
 export const REF_RESOLUTION_SKIP_KINDS = new Set([
     "Telo.Definition",
     "Telo.Abstract",

package/dist/telo-version.d.ts

@@ -1,3 +1,3 @@
 /** The surface generation this analyzer implements. */
-export declare const TELO_SURFACE_VERSION = "0.82.1";
+export declare const TELO_SURFACE_VERSION = "0.83.0";
 //# sourceMappingURL=telo-version.d.ts.map

package/dist/telo-version.js

@@ -5,4 +5,4 @@
 // its release identity, this is the scale a module's `requires.telo` range is
 // written against, and every kernel in every language reports the same scale.
 /** The surface generation this analyzer implements. */
-export const TELO_SURFACE_VERSION = "0.82.1";
+export const TELO_SURFACE_VERSION = "0.83.0";

package/dist/template-body.d.ts

@@ -0,0 +1,50 @@
+import type { ResourceDefinition, ResourceManifest } from "@telorun/sdk";
+import type { AliasResolver } from "./alias-resolver.js";
+import type { DefinitionRegistry } from "./definition-registry.js";
+import type { ModuleScopes } from "./alias-resolver.js";
+/**
+ * A `Telo.Definition`'s `resources:` entries — the bodies a kind writes for
+ * ANOTHER kind — read as what they are: declarations of that other kind.
+ *
+ * The consequence is the whole point. CEL inside such a body used to be typed in
+ * the ENCLOSING definition's scope, against one fixed permissive context
+ * (`self`, plus open `request` / `result` / `steps` / `error`). So `inputs` and
+ * `item` were undefined wherever the nested kind declares them, while `error`
+ * was offered everywhere regardless of whether a `catch:` was in scope — a body
+ * of more than one dispatch was unwritable, which is why no standard-library
+ * template has one.
+ *
+ * Resolving through the nested kind's OWN annotations — its `x-telo-context`
+ * regions, its step body, its error branches — makes a nested declaration answer
+ * exactly as the same declaration written at the top level does, with `self`
+ * merged in from the enclosing definition's `schema:`.
+ *
+ * Browser-safe.
+ */
+export interface TemplateBody {
+    /** Concrete path prefix of this entry (`resources[0]`), as CEL sites are
+     *  addressed. */
+    prefix: string;
+    /** JSONPath prefix for context scopes (`$.resources[0]`). */
+    scopePrefix: string;
+    manifest: ResourceManifest;
+    definition: ResourceDefinition | undefined;
+}
+/** The template bodies a manifest declares — empty for anything that is not a
+ *  `Telo.Definition` with a `resources:` array. */
+export declare function templateBodies(m: ResourceManifest, registry: DefinitionRegistry, aliases: AliasResolver | undefined, scopes: ModuleScopes | undefined): TemplateBody[];
+/** True when a CEL path lies at or inside a body's own subtree. */
+export declare function pathInBody(path: string, prefix: string): boolean;
+/** The body a CEL path belongs to, or undefined for a path in the definition's
+ *  own fields. Generic over what the caller keyed to each body — the resolver
+ *  carries a step context and an error map, the visitor carries the schema. */
+export declare function bodyForPath<T extends {
+    prefix: string;
+}>(bodies: readonly T[], path: string): T | undefined;
+/** `self` is in scope throughout a template body — it is how the body reaches
+ *  the configuration its enclosing kind was given — so it is merged into every
+ *  context the nested kind declares, which knows nothing about it. Merged UNDER
+ *  the nested kind's own properties: a name the nested kind declares wins, since
+ *  that is what its controller will bind. */
+export declare function withTemplateSelf(contextSchema: Record<string, any>): Record<string, any>;
+//# sourceMappingURL=template-body.d.ts.map

package/dist/template-body.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"template-body.d.ts","sourceRoot":"","sources":["../src/template-body.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,YAAY;IAC3B;qBACiB;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,UAAU,EAAE,kBAAkB,GAAG,SAAS,CAAC;CAC5C;AAED;mDACmD;AACnD,wBAAgB,cAAc,CAC5B,CAAC,EAAE,gBAAgB,EACnB,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,MAAM,EAAE,YAAY,GAAG,SAAS,GAC/B,YAAY,EAAE,CA8BhB;AAED,mEAAmE;AACnE,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAIhE;AAED;;+EAE+E;AAC/E,wBAAgB,WAAW,CAAC,CAAC,SAAS;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,EACtD,MAAM,EAAE,SAAS,CAAC,EAAE,EACpB,IAAI,EAAE,MAAM,GACX,CAAC,GAAG,SAAS,CAEf;AAED;;;;6CAI6C;AAC7C,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQxF"}

package/dist/template-body.js

@@ -0,0 +1,58 @@
+/** The template bodies a manifest declares — empty for anything that is not a
+ *  `Telo.Definition` with a `resources:` array. */
+export function templateBodies(m, registry, aliases, scopes) {
+    if (m.kind !== "Telo.Definition")
+        return [];
+    const bodies = m.resources;
+    if (!Array.isArray(bodies))
+        return [];
+    // A nested kind is written through the alias scope of the module that DECLARED
+    // the definition, never the consumer's — the same rule every other kind
+    // resolution in a forwarded manifest follows.
+    const ownModule = m.metadata?.module;
+    const scope = (ownModule && scopes && !scopes.rootModules.has(ownModule)
+        ? scopes.aliasesByModule.get(ownModule)
+        : undefined) ?? aliases;
+    const out = [];
+    for (let i = 0; i < bodies.length; i++) {
+        const body = bodies[i];
+        if (!body || typeof body !== "object" || Array.isArray(body))
+            continue;
+        const kind = body.kind;
+        if (typeof kind !== "string")
+            continue;
+        const canonical = scope?.resolveKind(kind);
+        const definition = registry.resolve(kind) ?? (canonical ? registry.resolve(canonical) : undefined);
+        out.push({
+            prefix: `resources[${i}]`,
+            scopePrefix: `$.resources[${i}]`,
+            manifest: body,
+            definition,
+        });
+    }
+    return out;
+}
+/** True when a CEL path lies at or inside a body's own subtree. */
+export function pathInBody(path, prefix) {
+    return (path === prefix || path.startsWith(`${prefix}.`) || path.startsWith(`${prefix}[`));
+}
+/** The body a CEL path belongs to, or undefined for a path in the definition's
+ *  own fields. Generic over what the caller keyed to each body — the resolver
+ *  carries a step context and an error map, the visitor carries the schema. */
+export function bodyForPath(bodies, path) {
+    return bodies.find((b) => pathInBody(path, b.prefix));
+}
+/** `self` is in scope throughout a template body — it is how the body reaches
+ *  the configuration its enclosing kind was given — so it is merged into every
+ *  context the nested kind declares, which knows nothing about it. Merged UNDER
+ *  the nested kind's own properties: a name the nested kind declares wins, since
+ *  that is what its controller will bind. */
+export function withTemplateSelf(contextSchema) {
+    return {
+        ...contextSchema,
+        properties: {
+            self: { "x-telo-context-from-root": "schema" },
+            ...(contextSchema.properties ?? {}),
+        },
+    };
+}

package/dist/validate-cel-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAatF,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAG3E,MAAM,WAAW,kBAAkB;IACjC;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC;;kDAE8C;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;KACxD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AA4CD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CA0EjC;AAyID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAChD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAyKrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB;AAWD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,SAAM,GACT,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAC,CAGvD"}
+{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAatF,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AA2B3E,MAAM,WAAW,kBAAkB;IACjC;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC;;kDAE8C;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;KACxD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AA4CD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CA0EjC;AAyID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAChD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAoLrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAuBrB;AAqBD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,SAAM,GACT,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAC,CAGvD"}

package/dist/validate-cel-context.js

@@ -7,6 +7,29 @@ import { withRefSlotsAsReadings } from "./ref-slot-reading.js";
 // question in one place. Re-exported: this module is where every existing
 // consumer imports them from.
 export { extractCelRegionScopes, pathMatchesScope } from "./eval-paths.js";
+/** True when a node's value is decided at load or dispatch rather than written
+ *  — a tagged sentinel (`!cel`, `!sql`, an embed) or an already-compiled value.
+ *  A schema position holding one declares a shape nothing static can read. */
+function isDynamicNode(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const node = value;
+    return node.__tagged === true || node.__compiled !== undefined;
+}
+/** Replace every dynamically-valued property with an OPEN schema, so the name is
+ *  in scope with its members unconstrained. */
+function openDynamicProperties(props) {
+    if (!props || typeof props !== "object")
+        return props;
+    let out;
+    for (const [key, value] of Object.entries(props)) {
+        if (!isDynamicNode(value))
+            continue;
+        out ??= { ...props };
+        out[key] = {};
+    }
+    return out ?? props;
+}
 /**
  * Resolve a type field value (string name, inline type, or raw schema) to a JSON Schema.
  * - String: look up the named type in allManifests (Type.JsonSchema resources)
@@ -298,8 +321,19 @@ export function resolveContextAnnotations(schema, manifestItem, opts) {
         // to be resolved first: the standard library writes it as the inline
         // `{ kind: Type.JsonSchema, schema: … }` wrapper, so merging it verbatim
         // would type the variable as `{ kind, schema }` instead of its properties.
+        // The navigated node — or one of the properties in it — may itself be an
+        // expression: a route whose `request.schema.body` is `!cel "self.model.schema"`
+        // declares a body whose SHAPE is only known once the template is
+        // instantiated. Such a name types as OPEN rather than as nothing, and a
+        // wholly dynamic map leaves the whole node open. Resolving it to nothing
+        // reports `request.body` as undefined, which blames the reader for the
+        // writer's dynamism — the same posture a rule takes when a value it reads
+        // is dynamic: skip the judgement, never invert it.
+        if (isDynamicNode(navigated)) {
+            return { ...schema, properties: { ...(schema.properties ?? {}) }, additionalProperties: true };
+        }
         const asType = resolveTypeFieldToSchema(navigated, allManifests ?? []);
-        const resolved = asType?.properties ?? navigated;
+        const resolved = openDynamicProperties(asType?.properties ?? navigated);
         const required = Array.isArray(asType?.required) ? asType.required : undefined;
         return {
             ...schema,
@@ -438,14 +472,40 @@ export function resolveContextAnnotations(schema, manifestItem, opts) {
  */
 export function getManifestItem(exprPath, scope, manifest) {
     const stripped = scope.startsWith("$.") ? scope.slice(2) : scope;
-    const wildcardIdx = stripped.indexOf("[*]");
-    if (wildcardIdx === -1)
-        return manifest;
-    const arrayProp = stripped.slice(0, wildcardIdx); // e.g. "routes"
-    const m = exprPath.match(new RegExp(`^${arrayProp}\\[(\\d+)\\]`));
-    if (!m)
+    const parts = stripped.split("[*]");
+    if (parts.length === 1)
         return manifest;
-    return manifest[arrayProp]?.[Number(m[1])] ?? manifest;
+    // Resolve each `[*]` against the concrete index the expression path carries at
+    // the same position, accumulating up to the LAST wildcard: that node is the
+    // per-scope item (`routes[2]`), which is what `x-telo-context-from` navigates
+    // from. Built by walking the pattern rather than by a regex over the scope —
+    // a scope is a path, not a pattern, and its own `[4]` segments are regex
+    // character classes, which is what silently made every nested scope resolve
+    // to the whole document instead of the item.
+    let remaining = exprPath;
+    let concrete = "";
+    for (let i = 0; i < parts.length - 1; i++) {
+        const part = parts[i];
+        if (!remaining.startsWith(part))
+            return manifest;
+        remaining = remaining.slice(part.length);
+        const index = remaining.match(/^\[(\d+)\]/);
+        if (!index)
+            return manifest;
+        remaining = remaining.slice(index[0].length);
+        concrete += `${part}${index[0]}`;
+    }
+    return navigateConcretePath(manifest, concrete) ?? manifest;
+}
+/** Walk a concrete dotted path with `[N]` indices (`resources[4].routes[2]`). */
+function navigateConcretePath(root, path) {
+    let cur = root;
+    for (const segment of path.match(/[^.[\]]+/g) ?? []) {
+        if (cur === null || typeof cur !== "object")
+            return undefined;
+        cur = cur[segment];
+    }
+    return cur;
 }
 function navigatePath(obj, segments) {
     let cur = obj;

package/dist/validate-identifier-names.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-identifier-names.d.ts","sourceRoot":"","sources":["../src/validate-identifier-names.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAOnE,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIrD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,EACtB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EACxB,KAAK,EAAE,SAAS,GACf,kBAAkB,EAAE,CAgEtB"}
+{"version":3,"file":"validate-identifier-names.d.ts","sourceRoot":"","sources":["../src/validate-identifier-names.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAQnE,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIrD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,EACtB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EACxB,KAAK,EAAE,SAAS,GACf,kBAAkB,EAAE,CAwEtB"}

package/dist/validate-identifier-names.js

@@ -1,4 +1,5 @@
 import { TYPE_LEVEL_DOC_KINDS, checkName, } from "./identifier-name.js";
+import { isInjectedDeclaration } from "./resource-input.js";
 const SOURCE = "telo-analyzer";
 /**
  * Every author-written name in one pass — resource instances, kinds, modules,
@@ -36,6 +37,11 @@ export function validateIdentifierNames(manifests, registry, aliases, rootModule
         // would blame them for a spelling this pass's own pipeline chose.
         if (metadata?.xTeloOrigin)
             continue;
+        // A kind-only stand-in for a `resources:` entry carries the name the author
+        // wrote in that block, and the block's own keys are checked below — on the
+        // module doc, where the name is written and a squiggle can land.
+        if (isInjectedDeclaration(manifest))
+            continue;
         const ownModule = metadata?.module;
         if (ownModule && !rootModules.has(ownModule))
             continue;
@@ -53,7 +59,10 @@ export function validateIdentifierNames(manifests, registry, aliases, rootModule
         // keys are the imported library's declarations, so a violation there is
         // the library author's, reported when their module is analyzed as a root.
         if (manifest.kind === "Telo.Application" || manifest.kind === "Telo.Library") {
-            for (const field of ["variables", "secrets", "ports"]) {
+            // `resources:` joins them: a library's resource inputs are named in the
+            // same identifier space (`!ref connection`, `resources.connection`) and
+            // break the same way.
+            for (const field of ["variables", "secrets", "ports", "resources"]) {
                 const block = manifest[field];
                 if (!block || typeof block !== "object" || Array.isArray(block))
                     continue;
@@ -125,7 +134,13 @@ function surfaceFor(kind) {
     }
 }
 function singular(field) {
-    return field === "variables" ? "variable" : field === "secrets" ? "secret" : "port";
+    return field === "variables"
+        ? "variable"
+        : field === "secrets"
+            ? "secret"
+            : field === "ports"
+                ? "port"
+                : "resource input";
 }
 function push(out, violation, at) {
     if (!violation)

package/dist/validate-references.d.ts

@@ -1,5 +1,22 @@
 import type { ResourceManifest } from "@telorun/sdk";
 import { type AnalysisDiagnostic, type AnalysisContext } from "./types.js";
+import type { DefinitionRegistry } from "./definition-registry.js";
+/**
+ * Liskov substitutability at a kind constraint: is `resolved` (a canonical
+ * `<module>.<Kind>`) accepted where `targetKind` is required?
+ *
+ * THE one implementation — `checkKind` below builds a MESSAGE from it and adds
+ * nothing to the rule, so a resource input's injection site and an ordinary ref
+ * slot cannot come to disagree about what satisfies a constraint.
+ *
+ * A value satisfies the slot when it transitively extends the target kind, or —
+ * for a CONCRETE target — IS that kind; `getByExtends` is the same transitive
+ * subtype index for both, and an abstract is satisfied only by an implementer,
+ * never by the abstract itself (which is non-instantiable). Accepts a constraint
+ * that resolves to nothing, and an abstract with no loaded implementations:
+ * partial context, where a rejection would be a guess.
+ */
+export declare function kindSatisfies(resolved: string, targetKind: string, registry: DefinitionRegistry): boolean;
 /**
  * Phase 3 — Reference validation.
  *

package/dist/validate-references.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-references.d.ts","sourceRoot":"","sources":["../src/validate-references.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAarD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAuD/F;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,GACvB,kBAAkB,EAAE,CA2gBtB"}
+{"version":3,"file":"validate-references.d.ts","sourceRoot":"","sources":["../src/validate-references.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAarD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAE/F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAInE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,kBAAkB,GAC3B,OAAO,CAwBT;AA8DD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,GACvB,kBAAkB,EAAE,CA2gBtB"}

package/dist/validate-references.js

@@ -7,13 +7,67 @@ import { resolveTypeFieldToSchema } from "./validate-cel-context.js";
 import { DiagnosticSeverity } from "./types.js";
 const SOURCE = "telo-analyzer";
 /**
- * Checks whether `kind` satisfies the ref constraint in `entry`.
- * Returns an empty array when valid, or mismatch error strings when not.
- * Returns an empty array immediately when the ref identity is not registered
- * (partial context — skip check rather than false-positive).
+ * Liskov substitutability at a kind constraint: is `resolved` (a canonical
+ * `<module>.<Kind>`) accepted where `targetKind` is required?
+ *
+ * THE one implementation — `checkKind` below builds a MESSAGE from it and adds
+ * nothing to the rule, so a resource input's injection site and an ordinary ref
+ * slot cannot come to disagree about what satisfies a constraint.
+ *
+ * A value satisfies the slot when it transitively extends the target kind, or —
+ * for a CONCRETE target — IS that kind; `getByExtends` is the same transitive
+ * subtype index for both, and an abstract is satisfied only by an implementer,
+ * never by the abstract itself (which is non-instantiable). Accepts a constraint
+ * that resolves to nothing, and an abstract with no loaded implementations:
+ * partial context, where a rejection would be a guess.
  */
+export function kindSatisfies(resolved, targetKind, registry) {
+    const canonical = registry.resolveRef(targetKind) ?? targetKind;
+    const targetDef = registry.resolve(canonical);
+    if (!targetDef)
+        return true;
+    if (targetDef.kind !== "Telo.Abstract" && resolved === canonical)
+        return true;
+    const subtypes = registry.getByExtends(canonical);
+    if (subtypes.some((d) => `${d.metadata.module}.${d.metadata.name}` === resolved))
+        return true;
+    // Leniency is about the CANDIDATE, not about the population, and it is the
+    // same question for an abstract target and a concrete one. Accepting whenever
+    // no subtype happened to be loaded silenced the check exactly where it was
+    // needed: an app whose imports declare no `Telo.Runnable` is an app whose boot
+    // targets are all wrong, and every one of them passed.
+    //
+    // An UNREGISTERED candidate is not partial context, and the distinction is
+    // load-bearing: a kind nobody declared is an unknown kind or an unimported
+    // alias prefix (`NotAnAlias.Script`), which is precisely what this check
+    // exists to report. Only a kind that IS declared, whose ancestry reaches
+    // something this analysis never saw, is undecidable — there the missing hop is
+    // where the target it appears not to reach could have been declared.
+    // A candidate the registry never saw cannot be judged on what it implements —
+    // the analysis simply does not hold it. Whether its NAME is resolvable is a
+    // different question, asked of the alias scope by the caller.
+    if (!registry.resolve(resolved))
+        return true;
+    return !registry.ancestryResolved(resolved);
+}
+/** {@link kindSatisfies} at every kind a slot accepts, rendered as messages.
+ *  The acceptance rule is not restated here — only what to say when it fails,
+ *  which needs the slot's alternatives and the target's flavour. */
 function checkKind(kind, entry, registry, aliases) {
     const resolved = aliases.resolveKind(kind) ?? kind;
+    // A qualified kind whose prefix names no import in this scope is a bad NAME
+    // rather than a bad type — `{kind: NotAnAlias.Script}` where only `Lib` is
+    // imported — and this check is the only place it surfaces, so it is never
+    // waved through as partial context. Asked of the resolver, which reports
+    // `unknown` for exactly that case: a kind reached through a DECLARED alias
+    // resolves (`ok`) even when the target's definitions are not loaded, and a
+    // gated one says so separately.
+    const unknownAlias = kind.includes(".") &&
+        aliases.resolveKindResult(kind).status === "unknown" &&
+        // …and the registry does not hold it under the name as written either. A
+        // manifest may carry a canonical `<module>.<Kind>`, which no alias resolves
+        // and which is nonetheless perfectly identified.
+        registry.resolve(resolved) === undefined;
     const errors = [];
     for (const refStr of entry.refs) {
         const targetKind = registry.resolveRef(refStr);
@@ -22,20 +76,11 @@ function checkKind(kind, entry, registry, aliases) {
         const targetDef = registry.resolve(targetKind);
         if (!targetDef)
             return [];
-        // Liskov substitutability: a value satisfies the slot when it transitively
-        // extends the target kind, or — for a CONCRETE target — IS that kind.
-        // `getByExtends` is the same transitive subtype index for abstract and
-        // concrete targets alike; an abstract is satisfied only by an implementer,
-        // never by the abstract kind itself (which is non-instantiable).
-        if (targetDef.kind !== "Telo.Abstract" && resolved === targetKind)
+        if (!unknownAlias && kindSatisfies(resolved, targetKind, registry))
             return [];
         const subtypes = registry.getByExtends(targetKind);
         const subtypeKinds = new Set(subtypes.map((d) => `${d.metadata.module}.${d.metadata.name}`));
-        if (subtypeKinds.has(resolved))
-            return [];
         if (targetDef.kind === "Telo.Abstract") {
-            if (subtypes.length === 0)
-                return []; // partial context — no implementations loaded yet
             // Suggest only what an author can actually wire: with abstract-extends-
             // abstract real (Telo.Executable over Invocable/Runnable), the transitive
             // subtype list contains abstracts, which are non-instantiable and would
@@ -43,8 +88,15 @@ function checkKind(kind, entry, registry, aliases) {
             const concrete = subtypes
                 .filter((d) => d.kind !== "Telo.Abstract")
                 .map((d) => `${d.metadata.module}.${d.metadata.name}`);
-            const options = (concrete.length > 0 ? concrete : [...subtypeKinds]).join(", ");
-            errors.push(`'${kind}' does not implement '${targetKind}' (known implementations: ${options})`);
+            const options = concrete.length > 0 ? concrete : [...subtypeKinds];
+            // With nothing loaded that implements the target there is no list to
+            // offer, so the message says what this kind IS instead — which is the
+            // half the author can act on ("it declares 'Telo.Invocable'" points
+            // straight at a boot target that should have been an invoke step).
+            const declared = registry.resolve(resolved)?.capability;
+            errors.push(options.length > 0
+                ? `'${kind}' does not implement '${targetKind}' (known implementations: ${options.join(", ")})`
+                : `'${kind}' does not implement '${targetKind}'${declared ? ` — it declares '${declared}'` : ""}`);
         }
         else {
             const options = subtypeKinds.size > 0 ? ` or a subtype (${[...subtypeKinds].join(", ")})` : "";

package/dist/validate-resource-inputs.d.ts

@@ -0,0 +1,35 @@
+import type { ResourceManifest } from "@telorun/sdk";
+import type { AliasResolver } from "./alias-resolver.js";
+import type { DefinitionRegistry } from "./definition-registry.js";
+import { type AnalysisDiagnostic } from "./types.js";
+/**
+ * The strict half of {@link readResourceInputs} — the `validate-ref-slots.ts`
+ * split applied to the resource-input boundary, and not optional for the same
+ * reason: the two sides fail in OPPOSITE directions. An unreadable DECLARATION
+ * leaves the library referencing a name nothing stands behind; an unchecked
+ * INJECTION hands a library an instance of a kind it never asked for, which
+ * surfaces as a method-missing failure inside someone else's module.
+ *
+ * Two surfaces, scoped the same way every other declaration check is — to the
+ * entry's own modules, since a published dependency's block is not the
+ * consumer's to fix:
+ *
+ *  - **The library's own declaration.** Each entry's alias-qualified `kind:` must
+ *    resolve in the DECLARING module's scope (`RESOURCE_INPUT_KIND_UNRESOLVED`).
+ *    A constraint that resolves to nothing accepts anything, which is the same
+ *    hole `X_TELO_REF_UNRESOLVED` exists to close one level down.
+ *  - **The injection site.** Every declared entry must be supplied
+ *    (`RESOURCE_INPUT_MISSING` — the same failure as a missing required
+ *    variable), nothing beyond them may be (`RESOURCE_INPUT_UNKNOWN`), the value
+ *    must name a resource that exists (`RESOURCE_INPUT_UNRESOLVED`), and its
+ *    kind must satisfy the declared constraint transitively
+ *    (`RESOURCE_INPUT_KIND_MISMATCH`).
+ *
+ * Browser-safe.
+ */
+export declare function validateResourceInputs(manifests: ResourceManifest[], registry: DefinitionRegistry, aliases: AliasResolver, rootModules: Set<string>, 
+/** Kind acceptance, transitively — the `checkKind` rule `validate-references`
+ *  applies at an ordinary ref slot, passed in rather than re-derived so the
+ *  two cannot disagree about what satisfies a constraint. */
+acceptsKind: (suppliedKind: string, requiredKind: string) => boolean): AnalysisDiagnostic[];
+//# sourceMappingURL=validate-resource-inputs.d.ts.map

package/dist/validate-resource-inputs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-resource-inputs.d.ts","sourceRoot":"","sources":["../src/validate-resource-inputs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAGnE,OAAO,EAAE,KAAK,kBAAkB,EAAsB,MAAM,YAAY,CAAC;AASzE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,EACtB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC;AACxB;;6DAE6D;AAC7D,WAAW,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,GACnE,kBAAkB,EAAE,CA6LtB"}