@telorun/analyzer 0.66.0 → 0.67.0

package/dist/validate-resource-inputs.js

@@ -0,0 +1,319 @@
+import { isRefSentinel } from "@telorun/templating";
+import { findDynamicLeaf } from "./resource-rule.js";
+import { readResourceInputs, readSuppliedResources } from "./resource-input.js";
+import { DiagnosticSeverity } from "./types.js";
+const SOURCE = "telo-analyzer";
+/**
+ * The strict half of {@link readResourceInputs} — the `validate-ref-slots.ts`
+ * split applied to the resource-input boundary, and not optional for the same
+ * reason: the two sides fail in OPPOSITE directions. An unreadable DECLARATION
+ * leaves the library referencing a name nothing stands behind; an unchecked
+ * INJECTION hands a library an instance of a kind it never asked for, which
+ * surfaces as a method-missing failure inside someone else's module.
+ *
+ * Two surfaces, scoped the same way every other declaration check is — to the
+ * entry's own modules, since a published dependency's block is not the
+ * consumer's to fix:
+ *
+ *  - **The library's own declaration.** Each entry's alias-qualified `kind:` must
+ *    resolve in the DECLARING module's scope (`RESOURCE_INPUT_KIND_UNRESOLVED`).
+ *    A constraint that resolves to nothing accepts anything, which is the same
+ *    hole `X_TELO_REF_UNRESOLVED` exists to close one level down.
+ *  - **The injection site.** Every declared entry must be supplied
+ *    (`RESOURCE_INPUT_MISSING` — the same failure as a missing required
+ *    variable), nothing beyond them may be (`RESOURCE_INPUT_UNKNOWN`), the value
+ *    must name a resource that exists (`RESOURCE_INPUT_UNRESOLVED`), and its
+ *    kind must satisfy the declared constraint transitively
+ *    (`RESOURCE_INPUT_KIND_MISMATCH`).
+ *
+ * Browser-safe.
+ */
+export function validateResourceInputs(manifests, registry, aliases, rootModules, 
+/** Kind acceptance, transitively — the `checkKind` rule `validate-references`
+ *  applies at an ordinary ref slot, passed in rather than re-derived so the
+ *  two cannot disagree about what satisfies a constraint. */
+acceptsKind) {
+    const out = [];
+    const isOwn = (module) => !module || rootModules.has(module);
+    // --- the library's own declaration -------------------------------------
+    for (const m of manifests) {
+        if (m.kind !== "Telo.Library")
+            continue;
+        const moduleName = m.metadata?.name;
+        // Only the entry's own modules, so the declaring scope is always the root
+        // alias table — a library analyzed here IS a root module.
+        if (!isOwn(moduleName))
+            continue;
+        const scope = aliases;
+        const exported = new Set((m.exports?.resources ?? []).filter((e) => typeof e === "string"));
+        for (const input of readResourceInputs(m)) {
+            // An input is the IMPORTER's instance, borrowed. Exporting it back out
+            // would forward a kind-only stand-in into the consumer's flattened set as
+            // a resource this library declares — a phantom the consumer can `!ref`
+            // and whose kind constraint is all there is behind it. Handing an
+            // instance straight back to whoever supplied it is also a relation
+            // nothing needs; if it ever does, it should be a decision rather than a
+            // name collision nobody noticed.
+            if (exported.has(input.name)) {
+                out.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: "RESOURCE_INPUT_EXPORTED",
+                    source: SOURCE,
+                    message: `Resource input '${input.name}' is also listed in 'exports.resources'. An input is ` +
+                        `an instance the importer supplies, not one this library declares, so there is ` +
+                        `nothing to export — remove it from 'exports.resources', or rename the input.`,
+                    data: {
+                        resource: { kind: m.kind, name: moduleName },
+                        filePath: m.metadata?.source,
+                        path: `resources.${input.name}`,
+                    },
+                });
+            }
+            if (registry.resolve(input.kind) ?? registry.resolve(scope.resolveKind(input.kind) ?? "")) {
+                continue;
+            }
+            out.push({
+                severity: DiagnosticSeverity.Error,
+                code: "RESOURCE_INPUT_KIND_UNRESOLVED",
+                source: SOURCE,
+                message: `Resource input '${input.name}' is constrained to kind '${input.kind}', which does not ` +
+                    `resolve in this library's scope. Write it alias-qualified — '<Alias>.<Kind>' for an ` +
+                    `import declared in this file, 'Self.<Kind>' for a kind this library owns, or ` +
+                    `'Telo.<Kind>' for a built-in. An unresolvable constraint accepts anything.`,
+                data: {
+                    resource: { kind: m.kind, name: moduleName },
+                    filePath: m.metadata?.source,
+                    path: `resources.${input.name}.kind`,
+                },
+            });
+        }
+    }
+    // --- the injection site --------------------------------------------------
+    for (const m of manifests) {
+        if (m.kind !== "Telo.Import")
+            continue;
+        const meta = m.metadata;
+        const alias = meta?.name;
+        if (!alias || !isOwn(meta?.module))
+            continue;
+        // An import whose target identity was never established registers nothing —
+        // reporting a missing input against it would blame the author for a
+        // dependency the loader has already said it could not obtain.
+        if (!meta?.resolvedModuleName)
+            continue;
+        // A singleton has no room for a per-import override: `logging:` scopes a
+        // subtree that is no longer this import's subtree, and `runtime:` selects a
+        // controller backend for a library that is instantiated once. Whichever
+        // import happened to be created first would decide, so the field is
+        // rejected rather than silently applied to everyone or silently dropped.
+        if (meta.sharedLibrary === true) {
+            for (const field of ["logging", "runtime"]) {
+                if (m[field] === undefined)
+                    continue;
+                out.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: "SHARED_LIBRARY_OVERRIDE",
+                    source: SOURCE,
+                    message: `Import '${alias}' declares '${field}:', but module ` +
+                        `'${meta.resolvedModuleName}' is 'lifecycle: shared' — one instantiation for the ` +
+                        `whole application, so a per-import override cannot apply to it. Remove it, or ` +
+                        `make the library 'lifecycle: isolated'.`,
+                    data: {
+                        resource: { kind: m.kind, name: alias },
+                        filePath: meta.source,
+                        path: field,
+                    },
+                });
+            }
+        }
+        const required = Object.entries(meta.requiredResources ?? {});
+        const supplied = readSuppliedResources(m);
+        const declared = new Map(required);
+        const resource = { kind: m.kind, name: alias };
+        const filePath = meta.source;
+        for (const [entryName, entryKind] of required) {
+            if (entryName in supplied)
+                continue;
+            out.push({
+                severity: DiagnosticSeverity.Error,
+                code: "RESOURCE_INPUT_MISSING",
+                source: SOURCE,
+                message: `Import '${alias}' does not supply the resource input '${entryName}', which module ` +
+                    `'${meta.resolvedModuleName}' requires (kind '${entryKind}'). Add ` +
+                    `\`resources: { ${entryName}: !ref <name> }\` to the import.`,
+                data: { resource, filePath, path: "resources" },
+            });
+        }
+        for (const [name, value] of Object.entries(supplied)) {
+            const path = `resources.${name}`;
+            const entry = declared.get(name);
+            if (!entry) {
+                const known = required.map(([n]) => n).join(", ") || "(none)";
+                out.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: "RESOURCE_INPUT_UNKNOWN",
+                    source: SOURCE,
+                    message: `Import '${alias}' supplies a resource input '${name}', which module ` +
+                        `'${meta.resolvedModuleName}' does not declare. Declared inputs: ${known}.`,
+                    data: { resource, filePath, path },
+                });
+                continue;
+            }
+            // Phase 2.5 rewrote a resolvable `!ref` to `{kind, name}`; a sentinel that
+            // survived names nothing the importer can reach.
+            if (isRefSentinel(value)) {
+                out.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: "RESOURCE_INPUT_UNRESOLVED",
+                    source: SOURCE,
+                    message: `Import '${alias}': resource input '${name}' → resource '${value.source}' not found`,
+                    data: { resource, filePath, path },
+                });
+                continue;
+            }
+            if (!value || typeof value !== "object" || Array.isArray(value)) {
+                out.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: "RESOURCE_INPUT_UNRESOLVED",
+                    source: SOURCE,
+                    message: `Import '${alias}': resource input '${name}' must be a '!ref' to a resource this ` +
+                        `module declares.`,
+                    data: { resource, filePath, path },
+                });
+                continue;
+            }
+            const suppliedKind = value.kind;
+            if (typeof suppliedKind !== "string")
+                continue;
+            const canonical = aliases.resolveKind(suppliedKind) ?? suppliedKind;
+            if (acceptsKind(canonical, entry))
+                continue;
+            out.push({
+                severity: DiagnosticSeverity.Error,
+                code: "RESOURCE_INPUT_KIND_MISMATCH",
+                source: SOURCE,
+                message: `Import '${alias}': resource input '${name}' is '${suppliedKind}' (resolved: ` +
+                    `'${canonical}'), which does not satisfy the declared constraint '${entry}'.`,
+                data: { resource, filePath, path },
+            });
+        }
+    }
+    out.push(...sharedLibraryConflicts(manifests, isOwn));
+    return out;
+}
+const SUPPLIED_BLOCKS = ["variables", "secrets", "resources"];
+/**
+ * Two imports of ONE `lifecycle: shared` library supplying different values.
+ *
+ * The runtime half (`ERR_SHARED_LIBRARY_CONFLICT`) is authoritative — it holds
+ * resolved values and live instances, and a library reached through a
+ * programmatic load never passed `telo check`. But the overwhelmingly common
+ * shape is two literal scalars in one flattened manifest set, which is decidable
+ * here, and a conflict is a hard BOOT failure: finding it at `telo check` is the
+ * difference between a squiggle and a deployment that will not start.
+ *
+ * Only what is DECIDABLE is compared, and the two ways it is not are skipped
+ * rather than guessed:
+ *
+ *  - A value holding a `!cel` (at any depth) is known only at load. Two
+ *    different expressions may evaluate equal, and identical text in two
+ *    different modules may not.
+ *  - A `resources:` entry names a resource by name, which means the same
+ *    instance only when both imports were DECLARED in the same module — so a
+ *    cross-module pair is left to the runtime.
+ *
+ * Grouped by the target's RESOLVED SOURCE, the identity the kernel keys its
+ * singleton registry on; `resolvedModuleName` would collapse two versions of one
+ * module, which are two libraries.
+ */
+function sharedLibraryConflicts(manifests, isOwn) {
+    const out = [];
+    const byTarget = new Map();
+    for (const m of manifests) {
+        if (m.kind !== "Telo.Import")
+            continue;
+        const meta = m.metadata;
+        if (meta?.sharedLibrary !== true || !meta.name || !meta.resolvedSource)
+            continue;
+        const blocks = new Map();
+        for (const block of SUPPLIED_BLOCKS) {
+            const value = m[block];
+            blocks.set(block, value && typeof value === "object" && !Array.isArray(value)
+                ? value
+                : {});
+        }
+        const bucket = byTarget.get(meta.resolvedSource);
+        const entry = {
+            alias: meta.name,
+            module: meta.module,
+            filePath: meta.source,
+            blocks,
+        };
+        if (bucket)
+            bucket.push(entry);
+        else
+            byTarget.set(meta.resolvedSource, [entry]);
+    }
+    for (const group of byTarget.values()) {
+        if (group.length < 2)
+            continue;
+        const [first, ...rest] = group;
+        for (const later of rest) {
+            for (const block of SUPPLIED_BLOCKS) {
+                // A reference means the same instance only within one module's scope.
+                if (block === "resources" && first.module !== later.module)
+                    continue;
+                const a = first.blocks.get(block);
+                const b = later.blocks.get(block);
+                for (const key of new Set([...Object.keys(a), ...Object.keys(b)])) {
+                    if (findDynamicLeaf(a[key]) || findDynamicLeaf(b[key]))
+                        continue;
+                    if (sameSuppliedValue(a[key], b[key]))
+                        continue;
+                    out.push({
+                        severity: DiagnosticSeverity.Error,
+                        code: "SHARED_LIBRARY_CONFLICT",
+                        source: SOURCE,
+                        message: `Import '${later.alias}' and import '${first.alias}' both reach a ` +
+                            `'lifecycle: shared' library — one instantiation for the whole application — but ` +
+                            `they supply different values for ${block}.${key}. Make the two imports agree, or ` +
+                            `make the library 'lifecycle: isolated'.`,
+                        data: isOwn(later.module)
+                            ? {
+                                resource: { kind: "Telo.Import", name: later.alias },
+                                filePath: later.filePath,
+                                path: `${block}.${key}`,
+                            }
+                            : {
+                                resource: { kind: "Telo.Import", name: first.alias },
+                                filePath: first.filePath,
+                                path: `${block}.${key}`,
+                            },
+                    });
+                }
+            }
+        }
+    }
+    return out;
+}
+/** Structural equality, key-order insensitive — the analyzer's half of the rule
+ *  the kernel applies to resolved values. A secret's VALUE is compared but never
+ *  printed: the key is what the author has to look at. */
+function sameSuppliedValue(a, b) {
+    if (a === b)
+        return true;
+    if (a === undefined || b === undefined || a === null || b === null)
+        return false;
+    if (Array.isArray(a) || Array.isArray(b)) {
+        if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length)
+            return false;
+        return a.every((item, i) => sameSuppliedValue(item, b[i]));
+    }
+    if (typeof a === "object" && typeof b === "object") {
+        const left = a;
+        const right = b;
+        const keys = new Set([...Object.keys(left), ...Object.keys(right)]);
+        return [...keys].every((key) => sameSuppliedValue(left[key], right[key]));
+    }
+    return false;
+}

package/dist/validate-template-dispatch.d.ts

@@ -0,0 +1,27 @@
+import type { ResourceManifest } from "@telorun/sdk";
+import { type AnalysisDiagnostic } from "./types.js";
+/**
+ * A `!ref` at a definition's dispatch slot must name a sibling `resources:`
+ * entry.
+ *
+ * `!ref` is the one spelling an author — and the editor's rename, completion and
+ * go-to-definition — expects to be RESOLVED. But a `Telo.Definition` is in both
+ * `REF_VALIDATION_SKIP_KINDS` and `REF_RESOLUTION_SKIP_KINDS`, and the dispatch
+ * slots carry no `x-telo-ref` (the accepted targets are the definition's own
+ * template-internal entries, not resources of any module), so no reference pass
+ * reaches them. Introducing the tag at a slot nothing resolves would be worse
+ * than the string form it replaces: a typo that used to be an obvious runtime
+ * miss becomes a typo in a construct that advertises static resolution.
+ *
+ * Decidable only when every sibling name is LITERAL. A template routinely names
+ * its entries with CEL (`name: !cel "self.name + '-query'"`), and an expression
+ * could expand to the referenced name — so one dynamic sibling switches the
+ * check off for that definition rather than inventing a miss.
+ *
+ * Entry-module-scoped, like every other declaration check: a published
+ * dependency's template body is not the consumer's to fix.
+ *
+ * Browser-safe.
+ */
+export declare function validateTemplateDispatch(manifests: ResourceManifest[], rootModules: ReadonlySet<string>): AnalysisDiagnostic[];
+//# sourceMappingURL=validate-template-dispatch.d.ts.map

package/dist/validate-template-dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-template-dispatch.d.ts","sourceRoot":"","sources":["../src/validate-template-dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AASzE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,GAC/B,kBAAkB,EAAE,CAgDtB"}

package/dist/validate-template-dispatch.js

@@ -0,0 +1,95 @@
+import { isRefSentinel } from "@telorun/templating";
+import { distance } from "./levenshtein.js";
+import { DiagnosticSeverity } from "./types.js";
+const SOURCE = "telo-analyzer";
+/** The four slots a `Telo.Definition` names its dispatch target in. Each takes
+ *  the same grammar; which one is legal for a given capability is
+ *  `validate-provider-coherence`'s question, not this one's. */
+const DISPATCH_FIELDS = ["invoke", "run", "provide", "mount"];
+/**
+ * A `!ref` at a definition's dispatch slot must name a sibling `resources:`
+ * entry.
+ *
+ * `!ref` is the one spelling an author — and the editor's rename, completion and
+ * go-to-definition — expects to be RESOLVED. But a `Telo.Definition` is in both
+ * `REF_VALIDATION_SKIP_KINDS` and `REF_RESOLUTION_SKIP_KINDS`, and the dispatch
+ * slots carry no `x-telo-ref` (the accepted targets are the definition's own
+ * template-internal entries, not resources of any module), so no reference pass
+ * reaches them. Introducing the tag at a slot nothing resolves would be worse
+ * than the string form it replaces: a typo that used to be an obvious runtime
+ * miss becomes a typo in a construct that advertises static resolution.
+ *
+ * Decidable only when every sibling name is LITERAL. A template routinely names
+ * its entries with CEL (`name: !cel "self.name + '-query'"`), and an expression
+ * could expand to the referenced name — so one dynamic sibling switches the
+ * check off for that definition rather than inventing a miss.
+ *
+ * Entry-module-scoped, like every other declaration check: a published
+ * dependency's template body is not the consumer's to fix.
+ *
+ * Browser-safe.
+ */
+export function validateTemplateDispatch(manifests, rootModules) {
+    const out = [];
+    for (const m of manifests) {
+        if (m.kind !== "Telo.Definition")
+            continue;
+        const meta = m.metadata;
+        const name = meta?.name;
+        if (!name)
+            continue;
+        if (meta?.module && !rootModules.has(meta.module))
+            continue;
+        const bodies = m.resources;
+        if (!Array.isArray(bodies))
+            continue;
+        const siblings = [];
+        let anyDynamic = false;
+        for (const entry of bodies) {
+            const entryName = entry?.metadata?.name;
+            if (typeof entryName === "string" && !entryName.includes("${{"))
+                siblings.push(entryName);
+            else if (entryName !== undefined)
+                anyDynamic = true;
+        }
+        if (anyDynamic)
+            continue;
+        for (const field of DISPATCH_FIELDS) {
+            const value = m[field];
+            if (!isRefSentinel(value))
+                continue;
+            const source = value.source;
+            const target = source.startsWith("Self.") ? source.slice("Self.".length) : source;
+            if (siblings.includes(target))
+                continue;
+            const suggestion = nearest(target, siblings);
+            out.push({
+                severity: DiagnosticSeverity.Error,
+                code: "TEMPLATE_DISPATCH_UNKNOWN",
+                source: SOURCE,
+                message: `${m.kind}/${name}: '${field}: !ref ${source}' names no entry in 'resources:'. ` +
+                    `Available: ${siblings.join(", ") || "(none)"}.` +
+                    (suggestion ? ` Did you mean '${suggestion}'?` : ""),
+                data: {
+                    resource: { kind: m.kind, name },
+                    filePath: meta?.source,
+                    path: field,
+                    ...(suggestion ? { fix: { replacement: suggestion } } : {}),
+                },
+            });
+        }
+    }
+    return out;
+}
+/** The closest sibling name, when one is close enough to be a typo rather than a
+ *  different name. */
+function nearest(target, candidates) {
+    let best;
+    for (const candidate of candidates) {
+        const d = distance(target, candidate);
+        if (!best || d < best.d)
+            best = { name: candidate, d };
+    }
+    const limit = Math.max(1, Math.floor(target.length / 3));
+    return best && best.d <= limit ? best.name : undefined;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.66.0",
+  "version": "0.67.0",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",
@@ -43,13 +43,13 @@
     "jsonpath-plus": "^10.3.0",
     "packageurl-js": "^2.0.1",
     "yaml": "^2.8.3",
-    "@telorun/templating": "0.17.0"
+    "@telorun/templating": "0.18.0"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",
     "typescript": "^5.0.0",
     "vitest": "^2.1.8",
-    "@telorun/sdk": "0.82.1"
+    "@telorun/sdk": "0.83.0"
   },
   "peerDependencies": {
     "@telorun/sdk": "*"

package/src/analyzer.ts

@@ -157,8 +157,11 @@ import { validateInvocationContract } from "./validate-invocation-contract.js";
 import { collectRefInputIssues, collectStepInputIssues } from "./validate-step-inputs.js";
 import { validateNestedInlineResources } from "./validate-nested-inline.js";
 import { validateProviderCoherence } from "./validate-provider-coherence.js";
-import { validateReferences } from "./validate-references.js";
+import { kindSatisfies, validateReferences } from "./validate-references.js";
 import { validateReferenceForms } from "./validate-reference-forms.js";
+import { isInjectedDeclaration } from "./resource-input.js";
+import { validateResourceInputs } from "./validate-resource-inputs.js";
+import { validateTemplateDispatch } from "./validate-template-dispatch.js";
 import { validateUnusedDeclarations } from "./validate-unused-declarations.js";
 import { validateThrowsCoverage } from "./validate-throws-coverage.js";
 import { readStepSlot } from "./step-slot.js";
@@ -1627,6 +1630,16 @@ export class StaticAnalyzer {
     const runReachable = reportsObservedState
       ? collectRunReachableNames(getCallGraph())
       : new Set<string>();
+    // "Nothing starts this" is DECLARATION-derived, and a library does not
+    // declare its injected inputs — whether the application starts the instance
+    // it hands down is answerable only where that instance is declared. Inside
+    // the library the question has no answer, so the name is treated as
+    // reachable rather than reported on a `targets:` list the author cannot
+    // write. The check still runs at the injection site, against the real
+    // declaration.
+    for (const m of allManifests) {
+      if (isInjectedDeclaration(m)) runReachable.add(m.metadata?.name as string);
+    }
 
     // Build typed kernel globals schema so x-telo-context chain validation
     // recognises variables, secrets, resources, env automatically
@@ -1762,6 +1775,15 @@ export class StaticAnalyzer {
         continue;
       }
 
+      // A kind-only stand-in for a `resources:` entry is a DECLARATION, not an
+      // instantiation: its kind is routinely an abstract and its configuration
+      // is the importer's to supply, so validating it here would report a
+      // non-instantiable kind and a page of missing required fields against a
+      // block that is correct. Its kind is checked where it was written, by
+      // `validate-resource-inputs`; it participates here only as a resolution
+      // target and as a CEL type.
+      if (isInjectedDeclaration(m)) continue;
+
       const resource = { kind: m.kind, name: m.metadata?.name as string };
 
       // Resolve kind through alias if needed; direct lookup takes priority so that
@@ -1861,6 +1883,11 @@ export class StaticAnalyzer {
         ) as Record<string, any>;
         if (!ownModule || rootModules.has(ownModule)) {
           for (const failure of projectionFailures) {
+            // A projection through a library's own resource INPUT is
+            // unanswerable here — the entries belong to the declaration the
+            // importer supplies — so it is not a defect in the block that named
+            // it. The check runs at the injection site instead.
+            if (failure.reason === "injected") continue;
             diagnostics.push({
               severity: DiagnosticSeverity.Error,
               code: "SCHEMA_PROJECTION_FROM_UNRESOLVED",
@@ -2556,7 +2583,7 @@ export class StaticAnalyzer {
           }
         },
       },
-      { aliases },
+      { aliases, aliasesByModule, rootModules },
     );
 
     // The two halves of "does this expression fit the slot it flows into" meet
@@ -2645,6 +2672,22 @@ export class StaticAnalyzer {
     // Warn about declared variables / secrets / ports that no CEL references.
     diagnostics.push(...validateUnusedDeclarations(allManifests, this.celEnv));
 
+    // A `!ref` at a definition's dispatch slot must name a sibling `resources:`
+    // entry — the slot no reference pass reaches, so the tag would otherwise
+    // advertise a resolution nothing performs.
+    diagnostics.push(...validateTemplateDispatch(allManifests, rootModules));
+
+    // A library's declared resource inputs, and every import that supplies them.
+    diagnostics.push(
+      ...validateResourceInputs(
+        allManifests,
+        defs,
+        aliases,
+        rootModules,
+        (supplied, required) => kindSatisfies(supplied, required, defs),
+      ),
+    );
+
     // Reroute diagnostics on synthetic (inline-extracted) resources back to
     // the chain root so position-index lookups land on the parent doc.
     return rewriteSyntheticOrigins(