@telorun/analyzer 0.66.0 → 0.68.0

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAiBzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AA8B9B,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAWvF,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAwDjE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA+F/F;0CAC0C;AAC1C,eAAO,MAAM,eAAe,GAAI,OAAO;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OACT,CAAC;AAErD;8EAC8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhD;AAqUD,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACtC;AA6DD,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAkFD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAu4DvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAyBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAiBzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AA8B9B,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAWvF,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AA4DjE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAkG/F;0CAC0C;AAC1C,eAAO,MAAM,eAAe,GAAI,OAAO;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OACT,CAAC;AAErD;8EAC8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhD;AAqUD,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACtC;AA6DD,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAkFD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAq8DvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAyBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -37,6 +37,7 @@ import { analyzerPeerBinder, analyzerPeersTarget } from "./peer-binding.js";
 import { describeProjectionFailure, manifestListScope, resolveSchemaProjections, } from "./schema-projection.js";
 import { validateDynamicSelectors, validateRefSlotDeclarations, } from "./validate-ref-slots.js";
 import { validateValueTypeSlots, } from "./validate-value-type-slots.js";
+import { validateSensitiveSlots, } from "./validate-sensitive-slots.js";
 import { resolveSchemaTypeRefs } from "./resolve-schema-type-refs.js";
 import { validateSchemaTypeRefs } from "./validate-schema-type-refs.js";
 import { rewriteSyntheticOrigins } from "./rewrite-synthetic-origins.js";
@@ -59,8 +60,11 @@ import { validateInvocationContract } from "./validate-invocation-contract.js";
 import { collectRefInputIssues, collectStepInputIssues } from "./validate-step-inputs.js";
 import { validateNestedInlineResources } from "./validate-nested-inline.js";
 import { validateProviderCoherence } from "./validate-provider-coherence.js";
-import { validateReferences } from "./validate-references.js";
+import { kindSatisfies, validateReferences } from "./validate-references.js";
 import { validateReferenceForms } from "./validate-reference-forms.js";
+import { isInjectedDeclaration } from "./resource-input.js";
+import { validateResourceInputs } from "./validate-resource-inputs.js";
+import { validateTemplateDispatch } from "./validate-template-dispatch.js";
 import { validateUnusedDeclarations } from "./validate-unused-declarations.js";
 import { validateThrowsCoverage } from "./validate-throws-coverage.js";
 import { readStepSlot } from "./step-slot.js";
@@ -797,10 +801,16 @@ export class StaticAnalyzer {
         // definition's `schema:` does. Same scoping as every other schema issue —
         // the entry's own modules, since a dependency is not the consumer's to fix.
         const valueTypeSlotIssues = [];
+        // `x-telo-sensitive` rides the same walk and the same scoping. It is read by
+        // ONE consumer — the kernel, off a bound contract — so an occurrence outside
+        // `inputType` / `outputType` is inert; for a security control, inert-and-
+        // silent is the failure worth reporting.
+        const sensitiveSlotIssues = [];
         for (const m of manifests) {
             const declaringModule = m.metadata?.module;
             if (!declaringModule || rootModules.has(declaringModule)) {
                 valueTypeSlotIssues.push(...validateValueTypeSlots(m));
+                sensitiveSlotIssues.push(...validateSensitiveSlots(m));
             }
         }
         for (const m of manifests) {
@@ -1017,6 +1027,22 @@ export class StaticAnalyzer {
                     },
                 });
             }
+            for (const issue of sensitiveSlotIssues) {
+                diagnostics.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: issue.code,
+                    source: SOURCE,
+                    message: issue.message,
+                    data: {
+                        resource: {
+                            kind: issue.manifest.kind,
+                            name: issue.manifest.metadata?.name,
+                        },
+                        filePath: issue.manifest.metadata?.source,
+                        path: issue.path,
+                    },
+                });
+            }
             // Same split for the two zone annotations. Unreadable ones fail in
             // OPPOSITE directions — a dropped requirement is silently unenforced, a
             // dropped provision invents failures — so neither can be left to
@@ -1399,6 +1425,17 @@ export class StaticAnalyzer {
         const runReachable = reportsObservedState
             ? collectRunReachableNames(getCallGraph())
             : new Set();
+        // "Nothing starts this" is DECLARATION-derived, and a library does not
+        // declare its injected inputs — whether the application starts the instance
+        // it hands down is answerable only where that instance is declared. Inside
+        // the library the question has no answer, so the name is treated as
+        // reachable rather than reported on a `targets:` list the author cannot
+        // write. The check still runs at the injection site, against the real
+        // declaration.
+        for (const m of allManifests) {
+            if (isInjectedDeclaration(m))
+                runReachable.add(m.metadata?.name);
+        }
         // Build typed kernel globals schema so x-telo-context chain validation
         // recognises variables, secrets, resources, env automatically
         const kernelGlobals = buildKernelGlobalsIndex(allManifests, observedState);
@@ -1511,6 +1548,15 @@ export class StaticAnalyzer {
             if (m.metadata?.forwardedExport === true) {
                 continue;
             }
+            // A kind-only stand-in for a `resources:` entry is a DECLARATION, not an
+            // instantiation: its kind is routinely an abstract and its configuration
+            // is the importer's to supply, so validating it here would report a
+            // non-instantiable kind and a page of missing required fields against a
+            // block that is correct. Its kind is checked where it was written, by
+            // `validate-resource-inputs`; it participates here only as a resolution
+            // target and as a CEL type.
+            if (isInjectedDeclaration(m))
+                continue;
             const resource = { kind: m.kind, name: m.metadata?.name };
             // Resolve kind through alias if needed; direct lookup takes priority so that
             // aliases whose name matches the module name (the common case) work without
@@ -1599,6 +1645,12 @@ export class StaticAnalyzer {
                 const projected = resolveSchemaProjections(schema, m, resourceProjectionScope, projectionFailures);
                 if (!ownModule || rootModules.has(ownModule)) {
                     for (const failure of projectionFailures) {
+                        // A projection through a library's own resource INPUT is
+                        // unanswerable here — the entries belong to the declaration the
+                        // importer supplies — so it is not a defect in the block that named
+                        // it. The check runs at the injection site instead.
+                        if (failure.reason === "injected")
+                            continue;
                         diagnostics.push({
                             severity: DiagnosticSeverity.Error,
                             code: "SCHEMA_PROJECTION_FROM_UNRESOLVED",
@@ -2199,7 +2251,7 @@ export class StaticAnalyzer {
                     }
                 }
             },
-        }, { aliases });
+        }, { aliases, aliasesByModule, rootModules });
         // The two halves of "does this expression fit the slot it flows into" meet
         // here: the engine resolved the expression's type during the walk above,
         // and the schema walk recorded the slot. An expression that failed to check
@@ -2269,6 +2321,12 @@ export class StaticAnalyzer {
         diagnostics.push(...validateThrowsCoverage(allManifests, defs, aliases, this.celEnv, aliasesByModule, rootModules));
         // Warn about declared variables / secrets / ports that no CEL references.
         diagnostics.push(...validateUnusedDeclarations(allManifests, this.celEnv));
+        // A `!ref` at a definition's dispatch slot must name a sibling `resources:`
+        // entry — the slot no reference pass reaches, so the tag would otherwise
+        // advertise a resolution nothing performs.
+        diagnostics.push(...validateTemplateDispatch(allManifests, rootModules));
+        // A library's declared resource inputs, and every import that supplies them.
+        diagnostics.push(...validateResourceInputs(allManifests, defs, aliases, rootModules, (supplied, required) => kindSatisfies(supplied, required, defs)));
         // Reroute diagnostics on synthetic (inline-extracted) resources back to
         // the chain root so position-index lookups land on the parent doc.
         return rewriteSyntheticOrigins(suppressUnreadableModuleDiagnostics(diagnostics, unreadableFiles), allManifests);

package/dist/builtins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAiNvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EAusB/C,CAAC"}
+{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AA8OvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EA+tB/C,CAAC"}

package/dist/builtins.js

@@ -215,6 +215,33 @@ const ROOT_LOGGING_SCHEMA = {
     },
     additionalProperties: false,
 };
+/** A `Telo.Library`'s declared resource inputs — the instances it requires from
+ *  whoever imports it, the inward half of the symmetry `exports.resources`
+ *  already had outward. Each entry is constrained by KIND ONLY, through the same
+ *  alias-qualified grammar `extends:` and `x-telo-ref` use; there is no `use:`,
+ *  because the boundary is a dependency edge for init order whatever the library
+ *  does with the instance. See `analyzer/nodejs/src/resource-input.ts`. */
+const LIBRARY_RESOURCE_INPUTS_SCHEMA = {
+    type: "object",
+    additionalProperties: {
+        type: "object",
+        required: ["kind"],
+        properties: {
+            kind: { type: "string" },
+            description: { type: "string" },
+        },
+        additionalProperties: false,
+    },
+};
+/** The importer's side of the same block: entry name → `!ref` to the instance
+ *  supplied for it. Left open because the accepted KIND is declared by the
+ *  target library, not by this schema — the constraint is checked by
+ *  `validate-resource-inputs.ts`, which reads the target's declared block off
+ *  the `metadata.requiredResources` stamp. */
+const IMPORT_RESOURCE_INPUTS_SCHEMA = {
+    type: "object",
+    additionalProperties: {},
+};
 export const KERNEL_BUILTINS = [
     { kind: "Telo.Abstract", metadata: { name: "Template", module: "Telo" } },
     // "Control can be transferred to this" — the parent of Invocable and Runnable,
@@ -408,28 +435,26 @@ export const KERNEL_BUILTINS = [
                     items: {
                         type: "object",
                         additionalProperties: true,
-                        // Resource bodies are `self`-only for config: per-call `inputs` is
-                        // NOT in scope here. Each entry is a persistent child created once at
-                        // init() and reused, so its config cannot depend on call-time data —
-                        // that flows through the top-level `inputs:` sibling into the dispatch
-                        // target's invoke().
+                        // A `resources:` entry is a DECLARATION of another kind, so the
+                        // CEL inside it belongs to THAT kind: its `x-telo-context` regions
+                        // are rebased under this entry's path and take precedence (they are
+                        // deeper), which is what puts `inputs`, `item`, `request`, `steps`
+                        // and a `catch:`'s `error` in scope exactly where the nested kind
+                        // declares them — see `analyzer/nodejs/src/template-body.ts`.
                         //
-                        // The exception is CEL the child's OWN controller evaluates later
-                        // against a runtime context it owns (e.g. an Http.Api evaluating route
-                        // CEL per request). Those `request` / `result` / `steps` / `error`
-                        // variables are deferred — the template controller preserves them
-                        // untouched (see resource-template-controller.ts) — so they are
-                        // exposed here permissively. Their deep shape is the child kind's
-                        // concern, not the template's, so they type as open values.
+                        // What stays here is `self` alone, in force throughout the entry:
+                        // it is how a body reaches the configuration its enclosing template
+                        // was given, and no nested kind knows about it. The four names that
+                        // used to sit beside it (`request` / `result` / `steps` / `error`)
+                        // were a fixed permissive stand-in for the nested kind's own
+                        // regions — which is why `error` was offered outside every `catch:`
+                        // while `inputs` and `item` were undefined wherever a body actually
+                        // reads them.
                         "x-telo-context": {
                             type: "object",
                             additionalProperties: false,
                             properties: {
                                 self: { "x-telo-context-from-root": "schema" },
-                                request: {},
-                                result: {},
-                                steps: {},
-                                error: {},
                             },
                         },
                     },
@@ -592,6 +617,7 @@ export const KERNEL_BUILTINS = [
                 integrity: { type: "string" },
                 variables: { type: "object" },
                 secrets: { type: "object" },
+                resources: IMPORT_RESOURCE_INPUTS_SCHEMA,
                 runtime: {
                     oneOf: [
                         { type: "string" },
@@ -738,6 +764,7 @@ export const KERNEL_BUILTINS = [
                                     integrity: { type: "string" },
                                     variables: { type: "object" },
                                     secrets: { type: "object" },
+                                    resources: IMPORT_RESOURCE_INPUTS_SCHEMA,
                                     runtime: {
                                         oneOf: [
                                             { type: "string" },
@@ -853,6 +880,29 @@ export const KERNEL_BUILTINS = [
                 },
                 variables: { type: "object" },
                 secrets: { type: "object" },
+                // How many times this library is instantiated in one application.
+                //
+                // `isolated` (the default) is what every published module was written
+                // against: each import declaration builds its own child scope with its
+                // own instances, so two libraries importing a third get two of
+                // everything in it. `shared` makes the library a SINGLETON — every
+                // import of it resolves to one instantiation, owned by the root and
+                // torn down after everything that borrowed it.
+                //
+                // Default `isolated` rather than `shared` — the opposite of the
+                // Application field's — because flipping it would silently collapse
+                // every existing app's resource graph and turn per-import `variables:`
+                // into a conflict. The `exports.kinds` precedent: private-by-default is
+                // the better end state and still needs the ecosystem republished first.
+                lifecycle: {
+                    type: "string",
+                    enum: ["shared", "isolated"],
+                    default: "isolated",
+                },
+                // The inward half of `exports.resources`: instances this library
+                // requires from whoever imports it. Library-only — an Application is a
+                // root with no importer, so it owns its instances outright.
+                resources: LIBRARY_RESOURCE_INPUTS_SCHEMA,
                 include: {
                     type: "array",
                     items: { type: "string" },
@@ -883,6 +933,7 @@ export const KERNEL_BUILTINS = [
                                     integrity: { type: "string" },
                                     variables: { type: "object" },
                                     secrets: { type: "object" },
+                                    resources: IMPORT_RESOURCE_INPUTS_SCHEMA,
                                     runtime: {
                                         oneOf: [
                                             { type: "string" },

package/dist/cel-scope.d.ts

@@ -132,6 +132,14 @@ export declare class CelScopeResolver {
     private stepContext;
     private invocationContext;
     private errorScopes;
+    /** The same two facts per `resources:` entry of a `Telo.Definition` — a
+     *  template body is a declaration of ANOTHER kind, so its step body and its
+     *  error branches are that kind's, not the enclosing definition's. */
+    private bodyScopes;
+    /** The enclosing definition's `self` schema, resolved once per resource. A
+     *  template body's contexts resolve against the BODY, so `self` — the one
+     *  binding anchored on the definition — is substituted before they do. */
+    private selfSchema;
     constructor(inputs: CelScopeInputs);
     /** The `steps` context schema for the current resource, or undefined when its
      *  kind declares no step body. Exposed because the step-inputs check needs the

package/dist/cel-scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cel-scope.d.ts","sourceRoot":"","sources":["../src/cel-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAQvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAO9D,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,qBAAqB,CAAC;AAsE7B;;;;;;;;;;;oEAWoE;AACpE,wBAAgB,uBAAuB,CACrC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACtB,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,MAAM,EAAE,YAAY,GACnB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC7B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC9B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY,GACnB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAqGjC;AAED,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GACzC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAmClC;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,GACvC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAWjC;AAED;;;+DAG+D;AAC/D,wBAAgB,gBAAgB,CAC9B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAClC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAcrB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,QAAQ;IACvB,wDAAwD;IACxD,GAAG,EAAE,WAAW,CAAC;IACjB;+EAC2E;IAC3E,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;CAC3C;AAED;+CAC+C;AAC/C,MAAM,WAAW,cAAc;IAC7B,0CAA0C;IAC1C,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,YAAY,CAAC;IACrB,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,aAAa,EAAE,kBAAkB,CAAC;IAClC,sEAAsE;IACtE,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC,+EAA+E;IAC/E,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;CAClD;AAED;;;6BAG6B;AAC7B,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,gBAAgB,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,qBAAa,gBAAgB;IAQf,OAAO,CAAC,QAAQ,CAAC,MAAM;IAPnC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA4C;IAE/E,4DAA4D;IAC5D,OAAO,CAAC,WAAW,CAAkC;IACrD,OAAO,CAAC,iBAAiB,CAAkC;IAC3D,OAAO,CAAC,WAAW,CAA+C;gBAErC,MAAM,EAAE,cAAc;IAEnD;;;uDAGmD;IACnD,IAAI,iBAAiB,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAEvD;IAED,sEAAsE;IACtE,IAAI,kBAAkB,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAEjE;IAED;;;+CAG2C;IAC3C,IAAI,uBAAuB,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAE7D;IAED,oDAAoD;IACpD,aAAa,CAAC,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,kBAAkB,GAAG,SAAS,GAAG,IAAI;IAwBpF;;;;;;;;;OASG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ;IAoCpC;;sEAEkE;IAClE,OAAO,CAAC,iBAAiB;CAwE1B"}
+{"version":3,"file":"cel-scope.d.ts","sourceRoot":"","sources":["../src/cel-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAQvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAO9D,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,qBAAqB,CAAC;AAuE7B;;;;;;;;;;;oEAWoE;AACpE,wBAAgB,uBAAuB,CACrC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACtB,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,MAAM,EAAE,YAAY,GACnB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC7B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC9B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY,GACnB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAqGjC;AAED,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GACzC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAmClC;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,GACvC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAWjC;AAED;;;+DAG+D;AAC/D,wBAAgB,gBAAgB,CAC9B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAClC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAcrB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,QAAQ;IACvB,wDAAwD;IACxD,GAAG,EAAE,WAAW,CAAC;IACjB;+EAC2E;IAC3E,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;CAC3C;AAED;+CAC+C;AAC/C,MAAM,WAAW,cAAc;IAC7B,0CAA0C;IAC1C,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,YAAY,CAAC;IACrB,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,aAAa,EAAE,kBAAkB,CAAC;IAClC,sEAAsE;IACtE,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC,+EAA+E;IAC/E,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;CAClD;AAED;;;6BAG6B;AAC7B,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,gBAAgB,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,qBAAa,gBAAgB;IAsBf,OAAO,CAAC,QAAQ,CAAC,MAAM;IArBnC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA4C;IAE/E,4DAA4D;IAC5D,OAAO,CAAC,WAAW,CAAkC;IACrD,OAAO,CAAC,iBAAiB,CAAkC;IAC3D,OAAO,CAAC,WAAW,CAA+C;IAClE;;0EAEsE;IACtE,OAAO,CAAC,UAAU,CAMV;IACR;;8EAE0E;IAC1E,OAAO,CAAC,UAAU,CAAkC;gBAEvB,MAAM,EAAE,cAAc;IAEnD;;;uDAGmD;IACnD,IAAI,iBAAiB,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAEvD;IAED,sEAAsE;IACtE,IAAI,kBAAkB,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAEjE;IAED;;;+CAG2C;IAC3C,IAAI,uBAAuB,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAE7D;IAED,oDAAoD;IACpD,aAAa,CAAC,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,kBAAkB,GAAG,SAAS,GAAG,IAAI;IA6CpF;;;;;;;;;OASG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ;IAoCpC;;sEAEkE;IAClE,OAAO,CAAC,iBAAiB;CAgH1B"}

package/dist/cel-scope.js

@@ -5,6 +5,7 @@ import { analyzerContractScope, PERMISSIVE_CONTRACT, resolveContract, } from "./
 import { mergeKernelGlobalsIntoContext, } from "./kernel-globals.js";
 import { resolveLocalRef, walkStepArray } from "./schema-walk.js";
 import { readStepSlot } from "./step-slot.js";
+import { bodyForPath, templateBodies } from "./template-body.js";
 import { getManifestItem, resolveContextAnnotations, resolveTypeFieldToSchema, } from "./validate-cel-context.js";
 /** Build a closed JSON Schema for the `self` CEL variable available inside a
  *  `Telo.Definition` template body. Mirrors the runtime template controller's
@@ -268,6 +269,14 @@ export class CelScopeResolver {
     stepContext;
     invocationContext;
     errorScopes = new Map();
+    /** The same two facts per `resources:` entry of a `Telo.Definition` — a
+     *  template body is a declaration of ANOTHER kind, so its step body and its
+     *  error branches are that kind's, not the enclosing definition's. */
+    bodyScopes = [];
+    /** The enclosing definition's `self` schema, resolved once per resource. A
+     *  template body's contexts resolve against the BODY, so `self` — the one
+     *  binding anchored on the definition — is substituted before they do. */
+    selfSchema;
     constructor(inputs) {
         this.inputs = inputs;
     }
@@ -303,6 +312,20 @@ export class CelScopeResolver {
             ? buildStepContextSchema(m, authorSchema, allManifests, defs, aliases, scopes)
             : undefined;
         this.errorScopes = collectErrorContextScopes(authorSchema);
+        this.selfSchema =
+            m.kind === "Telo.Definition" ? buildSelfSchema(m, defs, aliases) : undefined;
+        this.bodyScopes = templateBodies(m, defs, aliases, scopes).map((body) => {
+            const bodySchema = defs.effectiveSchemaOf(body.definition);
+            return {
+                prefix: body.prefix,
+                scopePrefix: body.scopePrefix,
+                manifest: body.manifest,
+                stepContext: bodySchema
+                    ? buildStepContextSchema(body.manifest, bodySchema, allManifests, defs, aliases, scopes)
+                    : undefined,
+                errorScopes: collectErrorContextScopes(bodySchema),
+            };
+        });
     }
     /**
      * What the expression at `site` is typed against.
@@ -339,7 +362,13 @@ export class CelScopeResolver {
         const { path } = site;
         const m = site.source;
         let matched = site.contextSchema ?? this.invocationContext;
-        if (this.stepContext) {
+        // Inside a template body the step and error regions are the NESTED kind's.
+        // Its `steps` accumulator and its `catch:` branches are declared there, and
+        // the enclosing definition's (there are none) would say nothing about them.
+        const inBody = this.bodyScopes.length > 0 ? bodyForPath(this.bodyScopes, path) : undefined;
+        const stepContext = inBody ? inBody.stepContext : this.stepContext;
+        const errorScopes = inBody ? inBody.errorScopes : this.errorScopes;
+        if (stepContext) {
             const base = matched ?? { type: "object", properties: {}, additionalProperties: true };
             matched = {
                 ...base,
@@ -356,13 +385,13 @@ export class CelScopeResolver {
                     // which is a separate decision from knowing the name is legal.
                     inputs: { type: "object", additionalProperties: true },
                     ...(base.properties ?? {}),
-                    steps: this.stepContext,
+                    steps: stepContext,
                 },
             };
         }
         // `error` is only in scope inside an error-bearing branch (e.g. a
         // `catch:` / `finally:`), so it's merged per-path, not resource-wide.
-        const errorSchema = this.errorScopes.size > 0 ? errorContextForPath(path, this.errorScopes) : undefined;
+        const errorSchema = errorScopes.size > 0 ? errorContextForPath(path, errorScopes) : undefined;
         if (errorSchema) {
             const base = matched ?? { type: "object", properties: {}, additionalProperties: true };
             matched = {
@@ -378,17 +407,46 @@ export class CelScopeResolver {
             return this.inputs.observedStateContext;
         }
         const { defs, aliases, scopes, allManifests, kernelGlobals } = this.inputs;
-        const manifestItem = site.matchedScope
-            ? getManifestItem(path, site.matchedScope, m)
-            : m;
-        const rootForResolver = manifestRootForResolver(m, defs, aliases, allManifests, scopes);
+        // A template body's context annotations are the NESTED kind's, and every one
+        // that anchors at a root — `x-telo-context-element-from`,
+        // `-collection-from`, `-from-root`, `x-telo-bindings-from` — means the root
+        // of the DECLARATION they were written for. Resolving them against the
+        // enclosing `Telo.Definition` looked `collection:` up on a document that has
+        // no such field, so `item` typed open and a typo below it went unreported —
+        // the one place a nested declaration did not answer as the same declaration
+        // written at the top level.
+        //
+        // So the path and the scope are rebased into the body and the body becomes
+        // the resolution root. `self` is the single binding that genuinely belongs to
+        // the enclosing definition, and it is substituted below rather than left as
+        // an annotation the rebased root would misread.
+        const body = inBody;
+        const localPath = body ? path.slice(body.prefix.length + 1) : path;
+        const localScope = body && site.matchedScope?.startsWith(`${body.scopePrefix}.`)
+            ? `$.${site.matchedScope.slice(body.scopePrefix.length + 1)}`
+            : body
+                ? undefined
+                : site.matchedScope;
+        const rootManifest = body ? body.manifest : m;
+        if (body && this.selfSchema && matched.properties?.self) {
+            matched = {
+                ...matched,
+                properties: { ...matched.properties, self: this.selfSchema },
+            };
+        }
+        const manifestItem = localScope
+            ? getManifestItem(localPath, localScope, rootManifest)
+            : rootManifest;
+        const rootForResolver = body
+            ? rootManifest
+            : manifestRootForResolver(m, defs, aliases, allManifests, scopes);
         const resolved = resolveContextAnnotations(matched, manifestItem, {
             manifestRoot: rootForResolver,
             defs,
             aliases,
             allManifests: allManifests,
         });
-        return mergeKernelGlobalsIntoContext(withBindingNames(resolved, m), 
+        return mergeKernelGlobalsIntoContext(withBindingNames(resolved, rootManifest), 
         // Typed in the module that DECLARED this resource — for a manifest
         // forwarded from an imported library, that is its `moduleGlobals` stamp,
         // not the consuming application's block.

package/dist/definition-registry.d.ts

@@ -190,6 +190,23 @@ export declare class DefinitionRegistry {
      */
     resolveSchemaFromNode(schemaFrom: string, ownerScope: AliasResolver): Record<string, any> | undefined;
     private resolveSchemaFromSubMap;
+    /** The kinds a definition descends from DIRECTLY — the same two edges
+     *  `register` feeds into `extendedBy`, read the other way.
+     *
+     *  Both spellings, because either can carry the edge that satisfies a slot:
+     *  `capability:` is the legacy implements-this form, `extends:` the canonical
+     *  one. A consumer walking these by hand would be a second reading of what an
+     *  inheritance edge IS, and the downward index and the upward walk have to
+     *  agree about that forever. */
+    parentsOf(kind: string): string[];
+    /** Whether every kind this one descends from is registered.
+     *
+     *  When it is, what the kind implements is FULLY KNOWN: a target it does not
+     *  reach is one it genuinely does not implement, so a mismatch is a verdict.
+     *  When a hop is missing — an unimported abstract, an alias the declaring file
+     *  could not resolve — a mismatch cannot be told from a missing dependency,
+     *  which is the partial context every reference check stays lenient in. */
+    ancestryResolved(kind: string): boolean;
     /** Returns all definitions that transitively extend the given abstract kind.
      *  Follows the capability chain to any depth (equivalent to instanceof in OOP).
      *  Definitions are included regardless of registration order. */

package/dist/definition-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"definition-registry.d.ts","sourceRoot":"","sources":["../src/definition-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,0BAA0B,CAAC;AAOlC,qBAAa,kBAAkB;;IAK7B;;sFAEkF;IAClF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IACzD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAyD;IAC5F;;mFAE+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IAEzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyC;IAC9D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D;iFAC6E;IAC7E,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqD;IACtF;;;;wEAIoE;IACpE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IAEzD,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI;IAqC9C,OAAO,CAAC,aAAa;IASrB;;;;;;;;;;;;;2FAauF;IACvF,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAK1E;;;;;;;;;;gFAU4E;IAC5E,uBAAuB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO;IAQzE;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,YAAY;IASpB;uFACmF;IACnF,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAIhC;;;gEAG4D;IAC5D,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS;IAMxD;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE;IAMtE,yEAAyE;IACzE,sBAAsB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,WAAW,EAAE;IAMjF;;;sEAGkE;IAClE,OAAO,CAAC,WAAW;IAYnB;;;;;;iCAM6B;IAC7B,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,GAAG,SAAS;IASnE;;;;4EAIwE;IACxE,OAAO,CAAC,iBAAiB;IAqBzB;;;;;;;;;;;;;;4BAcwB;IACxB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAShD,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAIrD;;;;;;;;;;;;;;OAcG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAYlE;;;0EAGsE;IACtE,iBAAiB,CAAC,UAAU,EAAE,kBAAkB,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAOlG;;;uCAGmC;IACnC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAWxD,gGAAgG;IAChG,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,GACvD,iBAAiB,GAAG,SAAS;IAOhC;;;;;;;;qFAQiF;IACjF,2BAA2B,CACzB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC1C,iBAAiB,GAAG,SAAS;IAkChC;;;;;;;;;;;;;OAaG;IACH,qBAAqB,CACnB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,aAAa,GACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS;IAsBlC,OAAO,CAAC,uBAAuB;IAU/B;;qEAEiE;IACjE,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAgBxD,KAAK,IAAI,MAAM,EAAE;CAGlB"}
+{"version":3,"file":"definition-registry.d.ts","sourceRoot":"","sources":["../src/definition-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,0BAA0B,CAAC;AAOlC,qBAAa,kBAAkB;;IAK7B;;sFAEkF;IAClF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IACzD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAyD;IAC5F;;mFAE+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IAEzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyC;IAC9D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D;iFAC6E;IAC7E,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqD;IACtF;;;;wEAIoE;IACpE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IAEzD,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI;IAqC9C,OAAO,CAAC,aAAa;IASrB;;;;;;;;;;;;;2FAauF;IACvF,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAK1E;;;;;;;;;;gFAU4E;IAC5E,uBAAuB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO;IAQzE;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,YAAY;IASpB;uFACmF;IACnF,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAIhC;;;gEAG4D;IAC5D,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS;IAMxD;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE;IAMtE,yEAAyE;IACzE,sBAAsB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,WAAW,EAAE;IAMjF;;;sEAGkE;IAClE,OAAO,CAAC,WAAW;IAYnB;;;;;;iCAM6B;IAC7B,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,GAAG,SAAS;IASnE;;;;4EAIwE;IACxE,OAAO,CAAC,iBAAiB;IAqBzB;;;;;;;;;;;;;;4BAcwB;IACxB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAShD,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAIrD;;;;;;;;;;;;;;OAcG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAYlE;;;0EAGsE;IACtE,iBAAiB,CAAC,UAAU,EAAE,kBAAkB,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAOlG;;;uCAGmC;IACnC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAWxD,gGAAgG;IAChG,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,GACvD,iBAAiB,GAAG,SAAS;IAOhC;;;;;;;;qFAQiF;IACjF,2BAA2B,CACzB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC1C,iBAAiB,GAAG,SAAS;IAkChC;;;;;;;;;;;;;OAaG;IACH,qBAAqB,CACnB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,aAAa,GACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS;IAsBlC,OAAO,CAAC,uBAAuB;IAU/B;;;;;;;oCAOgC;IAChC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE;IAQjC;;;;;;+EAM2E;IAC3E,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAavC;;qEAEiE;IACjE,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAgBxD,KAAK,IAAI,MAAM,EAAE;CAGlB"}

package/dist/definition-registry.js

@@ -409,6 +409,41 @@ export class DefinitionRegistry {
             return null;
         return buildFieldMapAtPath(subSchema, fieldPath);
     }
+    /** The kinds a definition descends from DIRECTLY — the same two edges
+     *  `register` feeds into `extendedBy`, read the other way.
+     *
+     *  Both spellings, because either can carry the edge that satisfies a slot:
+     *  `capability:` is the legacy implements-this form, `extends:` the canonical
+     *  one. A consumer walking these by hand would be a second reading of what an
+     *  inheritance edge IS, and the downward index and the upward walk have to
+     *  agree about that forever. */
+    parentsOf(kind) {
+        const def = this.defs.get(kind);
+        if (!def)
+            return [];
+        return [def.capability, def.extends].filter((parent) => typeof parent === "string" && parent.length > 0);
+    }
+    /** Whether every kind this one descends from is registered.
+     *
+     *  When it is, what the kind implements is FULLY KNOWN: a target it does not
+     *  reach is one it genuinely does not implement, so a mismatch is a verdict.
+     *  When a hop is missing — an unimported abstract, an alias the declaring file
+     *  could not resolve — a mismatch cannot be told from a missing dependency,
+     *  which is the partial context every reference check stays lenient in. */
+    ancestryResolved(kind) {
+        const queue = [kind];
+        const seen = new Set();
+        while (queue.length > 0) {
+            const current = queue.shift();
+            if (seen.has(current))
+                continue;
+            seen.add(current);
+            if (!this.defs.has(current))
+                return false;
+            queue.push(...this.parentsOf(current));
+        }
+        return true;
+    }
     /** Returns all definitions that transitively extend the given abstract kind.
      *  Follows the capability chain to any depth (equivalent to instanceof in OOP).
      *  Definitions are included regardless of registration order. */

package/dist/dependency-graph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dependency-graph.d.ts","sourceRoot":"","sources":["../src/dependency-graph.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B;kDAC8C;IAC9C,KAAK,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;IACpC;oFACgF;IAChF,KAAK,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;CACrC;AAID;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE,aAAa,EACvB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC3C,eAAe,CAyDjB;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,aAAa,CAAC,YAAY,CAAC,GAAG,MAAM,CAOtE"}
+{"version":3,"file":"dependency-graph.d.ts","sourceRoot":"","sources":["../src/dependency-graph.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAGnE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B;kDAC8C;IAC9C,KAAK,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;IACpC;oFACgF;IAChF,KAAK,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;CACrC;AAID;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE,aAAa,EACvB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC3C,eAAe,CA2DjB;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,aAAa,CAAC,YAAY,CAAC,GAAG,MAAM,CAOtE"}

package/dist/dependency-graph.js

@@ -1,4 +1,5 @@
 import { buildCallGraph, projectToPairs } from "./call-graph.js";
+import { readSuppliedResources } from "./resource-input.js";
 const nodeKey = (kind, name) => `${kind}\0${name}`;
 /**
  * Builds a directed acyclic graph (DAG) of boot-time resource dependencies and
@@ -45,6 +46,7 @@ export function buildDependencyGraph(resources, registry, aliases, aliasesByModu
     for (const key of nodes.keys())
         if (!deps.has(key))
             deps.set(key, new Set());
+    addResourceInputEdges(resources, nodes, deps);
     // --- Kahn's topological sort ---
     // in-degree[X] = number of X's dependencies (size of deps[X])
     // reverse[dep] = set of nodes that depend on dep (for degree decrement)
@@ -130,3 +132,66 @@ function findCycle(nodes, deps) {
     }
     return [];
 }
+/**
+ * Boot-order edges for the one thing a `Telo.Import` does hold: the instances it
+ * hands DOWN to its target library's declared `resources:` inputs.
+ *
+ * An import is otherwise module wiring rather than a runtime node — it is in
+ * `DEPENDENCY_GRAPH_SKIP_KINDS` and the call graph gives it no node at all — but
+ * a borrowed instance must exist before the import initializes, and a cycle
+ * through one is a cycle like any other. The edges are added here rather than
+ * read off the reference field map because the accepted KIND at this slot is
+ * declared by the TARGET library, not by the `Telo.Import` schema, so there is
+ * no `x-telo-ref` for the map to read; the constraint itself is checked by
+ * `validate-resource-inputs`.
+ */
+function addResourceInputEdges(resources, nodes, deps) {
+    // Every import that supplies inputs becomes a node FIRST, so a cross-module
+    // reference below can resolve to the import that exports its target.
+    const imports = [];
+    for (const m of resources) {
+        if (m.kind !== "Telo.Import")
+            continue;
+        const alias = m.metadata?.name;
+        const supplied = readSuppliedResources(m);
+        if (!alias || Object.keys(supplied).length === 0)
+            continue;
+        const key = nodeKey(m.kind, alias);
+        nodes.set(key, { kind: m.kind, name: alias });
+        if (!deps.has(key))
+            deps.set(key, new Set());
+        imports.push({ key, supplied });
+    }
+    if (imports.length === 0)
+        return;
+    const byName = new Map();
+    for (const [key, node] of nodes)
+        byName.set(node.name, key);
+    // An import is keyed by its alias, and that is also how a cross-module
+    // reference names it — index those so one resolves.
+    for (const m of resources) {
+        if (m.kind !== "Telo.Import")
+            continue;
+        const alias = m.metadata?.name;
+        const key = alias ? nodeKey(m.kind, alias) : undefined;
+        if (alias && key && nodes.has(key))
+            byName.set(alias, key);
+    }
+    for (const { key, supplied } of imports) {
+        const set = deps.get(key);
+        for (const value of Object.values(supplied)) {
+            const ref = value;
+            // A CROSS-MODULE reference (`!ref Other.db`) names an instance exported by
+            // another import, never a local resource. Looking it up in the local name
+            // map would find an unrelated resource of the same name — a wrong edge,
+            // and possibly a phantom cycle — or nothing at all. What it depends on is
+            // the IMPORT that exports it, which is the projection
+            // `localDependencyNames` already makes at runtime.
+            const alias = typeof ref?.alias === "string" ? ref.alias : undefined;
+            const targetName = alias && alias !== "Self" ? alias : typeof ref?.name === "string" ? ref.name : undefined;
+            const target = targetName ? byName.get(targetName) : undefined;
+            if (target && target !== key)
+                set.add(target);
+        }
+    }
+}

package/dist/extends-resolution.d.ts

@@ -36,6 +36,26 @@ export declare function inheritedCapability(def: ResourceDefinition | undefined,
  *    `mergeTypeSchemas` that `Type.JsonSchema.extends` uses.
  *  - no `extends` → the own schema unchanged. */
 export declare function effectiveAuthorSchema(def: ResourceDefinition | undefined, resolve: DefResolver): Record<string, any>;
+/**
+ * The fields a merge-form inheriting child publishes over its parent's reading.
+ *
+ * A child that inherits its controller by delegation and declares no `base:` IS
+ * the parent instance, so `resources.<child>` is the parent's `snapshot()` — and
+ * a field the parent has never heard of would be readable from nowhere. These
+ * are exactly those fields: the ones the effective (merged) schema declares that
+ * the controller-bearing ancestor's does not.
+ *
+ * A REDECLARED name is deliberately excluded. Narrowing an inherited field (a
+ * description, a pattern, a widget hint) is ordinary in an additive extension and
+ * says nothing about publication, while the parent's `snapshot()` is the sole
+ * authority on what a parent instance publishes — its normalizations, its
+ * deliberate omissions, and its redactions. Republishing such a field from raw
+ * config would silently undo a provider's decision to keep it out.
+ *
+ * Empty for the `base:` form, whose fields are construction inputs consumed by
+ * the mapping, and for a child with its own controller, which publishes itself.
+ */
+export declare function publishedOwnFields(def: ResourceDefinition | undefined, resolve: DefResolver): string[];
 /** The two directions of a kind's invocation contract. `inputType` is what a
  *  caller sends to `invoke()`; `outputType` is what `invoke()` / `provide()`
  *  returns. */