@telorun/analyzer 0.66.0 → 0.68.0

package/src/manifest-visitor.ts

@@ -16,6 +16,8 @@ import {
   type RefFieldEntry,
   type SchemaFromFieldEntry,
 } from "./reference-field-map.js";
+import type { ModuleScopes } from "./alias-resolver.js";
+import { templateBodies, withTemplateSelf } from "./template-body.js";
 import { extractContextsFromSchema, pathMatchesScope } from "./validate-cel-context.js";
 
 /**
@@ -150,6 +152,10 @@ export interface VisitOptions {
    *  Opt-in: the validators / dependency graph must NOT enable it (those refs
    *  are runtime-resolved, not boot dependencies). */
   discoverNestedRefs?: boolean;
+  /** Root (consumer-owned) module names, paired with `aliasesByModule` so a
+   *  nested kind inside an imported library's definition resolves through THAT
+   *  library's aliases. */
+  rootModules?: ReadonlySet<string>;
 }
 
 /** Synthetic entry for a value-tree-discovered ref — these carry no declared
@@ -204,6 +210,15 @@ const pathUnderPrefix = (fieldPath: string, prefix: string): boolean =>
   fieldPath.startsWith(prefix + ".") ||
   fieldPath.startsWith(prefix + "[");
 
+/** The per-declaring-module alias tables, when the caller threaded them. A
+ *  nested kind inside an imported library's definition is written through THAT
+ *  library's aliases. */
+function moduleScopes(options: VisitOptions): ModuleScopes | undefined {
+  return options.aliasesByModule && options.rootModules
+    ? { aliasesByModule: options.aliasesByModule, rootModules: options.rootModules }
+    : undefined;
+}
+
 export function visitManifest(
   resources: ResourceManifest[],
   registry: DefinitionRegistry,
@@ -367,6 +382,24 @@ export function visitManifest(
       // check simply stops existing.
       const authorSchema = registry.effectiveSchemaOf(definition);
       const contexts = authorSchema ? extractContextsFromSchema(authorSchema) : [];
+      // A `Telo.Definition`'s `resources:` entries are DECLARATIONS of another
+      // kind, so the CEL inside one belongs to THAT kind — its own
+      // `x-telo-context` regions, rebased under the entry's path. `self` is
+      // merged into each, since the nested kind knows nothing about the
+      // configuration its enclosing template was given. Without this a nested
+      // body saw one fixed permissive context: `inputs` and `item` undefined
+      // wherever the nested kind declares them, `error` offered everywhere.
+      for (const body of templateBodies(r, registry, aliases, moduleScopes(options))) {
+        const bodySchema = registry.effectiveSchemaOf(body.definition);
+        if (!bodySchema) continue;
+        for (const ctx of extractContextsFromSchema(bodySchema, body.scopePrefix)) {
+          contexts.push({ scope: ctx.scope, schema: withTemplateSelf(ctx.schema) });
+        }
+      }
+      // Longest scope wins, as `extractContextsFromSchema` already orders its
+      // own: a nested kind's region is deeper than the enclosing definition's
+      // blanket `$.resources[*]`, so it takes precedence.
+      contexts.sort((a, b) => b.scope.length - a.scope.length);
       walkCelExpressions(r, "", (expr, path, engineName, surface) => {
         let contextSchema: Record<string, any> | undefined;
         let matchedScope: string | undefined;

package/src/precompile.ts

@@ -40,6 +40,14 @@ export function precompileDoc(doc: unknown, env: Environment): unknown {
         __compiled: true,
         engine: doc.engine,
         source: doc.source,
+        // The AST-derived root identifiers the engine computed, carried through
+        // rather than dropped. This rebuild is where EVERY tagged sentinel's
+        // compiled value is produced, so losing `refs` here lost them for every
+        // `!cel` in every manifest — leaving a consumer that asks what an
+        // expression READS (a template body deciding which nodes survive its
+        // `init()`) with nothing but the source text to scan, which cannot tell
+        // an identifier from a word inside a string literal.
+        ...(compiled.refs ? { refs: compiled.refs } : {}),
         call: compiled.call.bind(compiled),
       };
     }

package/src/resolve-ref-sentinels.ts

@@ -193,7 +193,18 @@ export function resolveRefSentinels(
 
   for (const r of resources) {
     if (isForeign(r)) continue;
-    if (!r.metadata?.name || !r.kind || SYSTEM_KINDS.has(r.kind)) continue;
+    if (!r.metadata?.name || !r.kind) continue;
+    // A `Telo.Import` is import-time metadata, not a resource instance — except
+    // for its `resources:` block, which supplies the instances the target
+    // library declared it needs. Those are `!ref`s to the importer's OWN
+    // resources and resolve exactly like any other reference; nothing else on
+    // the document is a reference slot, so only that subtree is walked.
+    if (r.kind === "Telo.Import") {
+      const supplied = (r as Record<string, unknown>).resources;
+      if (supplied) (r as Record<string, unknown>).resources = walk(supplied);
+      continue;
+    }
+    if (SYSTEM_KINDS.has(r.kind)) continue;
     walk(r as Record<string, unknown>);
   }
 }

package/src/resource-input.ts

@@ -0,0 +1,132 @@
+import type { ResourceManifest } from "@telorun/sdk";
+
+/**
+ * The `resources:` block on a `Telo.Library` — the instances a library requires
+ * from whoever imports it, beside the scalar `variables:` / `secrets:` blocks.
+ * Instances used to flow up only (`exports.resources`); this is the inward half.
+ *
+ * THE SINGLE READER of the block, in both halves (the analyzer's passes and the
+ * kernel's import controller), on the `ref-slot.ts` precedent: a boundary whose
+ * shape two runtimes must agree about is read in one place, so the next shape
+ * change is a one-file edit rather than four surfaces recognising a block by
+ * pattern-matching it.
+ *
+ * Browser-safe — no I/O, no Node built-ins.
+ */
+
+/** One declared input. */
+export interface ResourceInput {
+  /** The entry key. Inside the library the instance is named exactly as a
+   *  locally declared resource: `!ref <name>` at a ref slot, `resources.<name>`
+   *  in CEL. */
+  name: string;
+  /** The alias-qualified kind constraint, as written in the DECLARING library's
+   *  own scope (`Sql.Connection`, `Self.Store`, `Telo.LogSink`). There is no
+   *  `use:` here: the boundary is a dependency edge for init order whatever the
+   *  library does with the instance, and the flattened application analysis
+   *  drops the library doc, so an app-level claim about internal call sites is
+   *  one nothing could check. */
+  kind: string;
+  description?: string;
+}
+
+/** Marker stamped on a synthesized kind-only declaration (see
+ *  {@link injectedDeclarations}). Read through {@link isInjectedDeclaration} —
+ *  never by testing the field. */
+const INJECTED = "xTeloInjected";
+
+/** Read a module document's `resources:` block. Returns `[]` for an
+ *  `Telo.Application` (which has no such block), for a library that declares
+ *  none, and for a malformed entry — the document's own schema validation
+ *  reports the shape against the precise `resources.<name>` path. */
+export function readResourceInputs(moduleDoc: unknown): ResourceInput[] {
+  const raw = (moduleDoc as { resources?: unknown } | undefined)?.resources;
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return [];
+  const out: ResourceInput[] = [];
+  for (const [name, value] of Object.entries(raw as Record<string, unknown>)) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) continue;
+    const kind = (value as { kind?: unknown }).kind;
+    if (typeof kind !== "string" || kind.length === 0) continue;
+    const description = (value as { description?: unknown }).description;
+    out.push({
+      name,
+      kind,
+      ...(typeof description === "string" ? { description } : {}),
+    });
+  }
+  return out;
+}
+
+/** The values an import supplies for a target library's declared inputs, keyed
+ *  by entry name. Read off a `Telo.Import` (authored or desugared from an
+ *  `imports:` entry). Values are `!ref` sentinels before Phase 2.5 and
+ *  `{kind, name}` after it — this reader does not interpret them. */
+export function readSuppliedResources(importDoc: unknown): Record<string, unknown> {
+  const raw = (importDoc as { resources?: unknown } | undefined)?.resources;
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return {};
+  return raw as Record<string, unknown>;
+}
+
+/** True when `manifest` is a synthesized kind-only declaration standing in for a
+ *  library's `resources:` entry rather than a resource the author declared. */
+export function isInjectedDeclaration(manifest: ResourceManifest | undefined): boolean {
+  return (manifest?.metadata as Record<string, unknown> | undefined)?.[INJECTED] === true;
+}
+
+/**
+ * Synthesize a kind-only declaration per `resources:` entry, in the declaring
+ * library's own scope.
+ *
+ * That model has to exist because a library's internals are validated in the
+ * library's own pass — the flattened application analysis drops the library doc
+ * — so with nothing behind `connection`, `!ref connection` would have nothing to
+ * resolve against.
+ *
+ * Kind-only is enough because it is already what a ref slot gets: a reading
+ * types its `status:` half from the kind, closed so a typo below it is
+ * `CEL_UNKNOWN_FIELD`, and leaves the flat half open, since no manifest declares
+ * what `snapshot()` returned. So `!ref connection` at a ref slot and
+ * `resources.connection.<field>` in CEL answer exactly as they do for a locally
+ * declared resource.
+ *
+ * The declaration is a stand-in, never an instantiation: the per-resource
+ * validation loop skips it (its kind is routinely an abstract, and its config is
+ * the importer's to supply), and the kernel's import controller filters it out
+ * of the manifests it registers, binding the borrowed instance under the name
+ * instead.
+ */
+export function injectedDeclarations(
+  moduleDoc: ResourceManifest,
+  ownModule: string | undefined,
+): ResourceManifest[] {
+  const inputs = readResourceInputs(moduleDoc);
+  if (inputs.length === 0) return [];
+  const meta = moduleDoc.metadata as
+    | { source?: string; sourceLine?: number }
+    | undefined;
+  return inputs.map((input) => ({
+    kind: input.kind,
+    metadata: {
+      name: input.name,
+      ...(ownModule ? { module: ownModule } : {}),
+      source: meta?.source ?? "",
+      sourceLine: meta?.sourceLine ?? 0,
+      [INJECTED]: true,
+    },
+  })) as unknown as ResourceManifest[];
+}
+
+/** How many times a library is instantiated in one application. `isolated` —
+ *  the default, and what every published module was written against — gives
+ *  each import declaration its own child scope with its own instances;
+ *  `shared` makes the library a singleton every import resolves to. */
+export type LibraryLifecycle = "isolated" | "shared";
+
+/** Read a module document's `lifecycle:`. `Telo.Application` has a field of the
+ *  same name with a different default and no reader; this is the LIBRARY
+ *  question only, so it answers `isolated` for anything else. */
+export function readLibraryLifecycle(moduleDoc: unknown): LibraryLifecycle {
+  const doc = moduleDoc as { kind?: unknown; lifecycle?: unknown } | undefined;
+  if (doc?.kind !== "Telo.Library") return "isolated";
+  return doc.lifecycle === "shared" ? "shared" : "isolated";
+}

package/src/schema-keywords.ts

@@ -27,6 +27,9 @@
  */
 
 import { X_TELO_TYPE } from "@telorun/sdk";
+
+/** The one annotation read from a DATA schema rather than a kind schema. */
+const X_TELO_SENSITIVE = "x-telo-sensitive" as const;
 import { ANNOTATION_KEYWORDS } from "./value-type-keyword.js";
 
 /** A keyword entry: the JSON Schema its VALUE must satisfy, carrying the title
@@ -227,7 +230,13 @@ export function jsonSchemaKeywords(self: string): SchemaKeywords {
  * a schema describing an annotation from an annotation, which nothing does yet.
  */
 export const TELO_SCHEMA_ANNOTATIONS: Record<
-  (typeof ANNOTATION_KEYWORDS)[number] | typeof X_TELO_TYPE,
+  // Exhaustive over the kind vocabulary, so adding a keyword without an entry is
+  // a compile error. `x-telo-sensitive` is excluded because it belongs to the
+  // DATA vocabulary below — it is read from a contract, not from a kind's own
+  // `schema:` — and offering it here would put it on the one schema where
+  // nothing reads it.
+  | Exclude<(typeof ANNOTATION_KEYWORDS)[number], typeof X_TELO_SENSITIVE>
+  | typeof X_TELO_TYPE,
   Record<string, unknown>
 > = {
   "x-telo-eval": {
@@ -381,3 +390,26 @@ export const TELO_SCHEMA_ANNOTATIONS: Record<
     type: "string",
   },
 };
+
+/**
+ * Annotations that belong on a DATA schema — an `inputType` / `outputType`
+ * contract — rather than on a kind's own `schema:`.
+ *
+ * Split out because {@link TELO_SCHEMA_ANNOTATIONS} is offered only where the
+ * fragment is `KindSchema`, which is a kind's CONFIGURATION. `x-telo-sensitive`
+ * is read from the opposite place: the kernel resolves it off a bound contract,
+ * which stamps `JsonSchema7`. Offering it from the kind vocabulary alone put it
+ * on the one schema where nothing reads it and withheld it from the two where it
+ * is the whole mechanism.
+ */
+export const TELO_DATA_SCHEMA_ANNOTATIONS: Record<
+  typeof X_TELO_SENSITIVE,
+  Record<string, unknown>
+> = {
+  [X_TELO_SENSITIVE]: {
+    title: "Sensitive",
+    description:
+      "This value is auth material or equivalent: carry it as `[redacted]` in trace payloads and on the debug wire rather than verbatim. Read only from a resource's declared `inputType` / `outputType`.",
+    type: "boolean",
+  },
+};

package/src/schema-projection.ts

@@ -35,7 +35,9 @@
  * derivation can reach.
  */
 
+import type { ResourceManifest } from "@telorun/sdk";
 import { isRefSentinel } from "@telorun/templating";
+import { isInjectedDeclaration } from "./resource-input.js";
 
 /** How a kind's entry collection projects to an object schema. */
 export interface SchemaProjection {
@@ -499,6 +501,15 @@ export type ProjectionFailure =
       readonly kind: string;
       readonly entries: string;
     }
+  /** The slot names a resource the module does not DECLARE — a library's
+   *  `resources:` input, standing in for an instance its importer supplies. A
+   *  projection is DECLARATION-derived, so it cannot be answered here at all;
+   *  the stand-in has no entries, and reporting that would tell the library
+   *  author their block is wrong when it is correct. Resolution moves to the
+   *  injection site, where the real declaration is. Carried as its own reason
+   *  rather than as `no-entries` so a consumer can tell "unanswerable here"
+   *  from "answered, and empty". */
+  | { readonly reason: "injected"; readonly pointer: string; readonly name: string }
   /** An ENTRY of the projected declaration references a shape that could not be
    *  read. Reported rather than dropped: the entry would silently vanish from
    *  the projected row, so a consumer naming it would be told the property does
@@ -523,6 +534,9 @@ function refTarget(
   if (!found) return { reason: "unresolved", pointer, name };
   if ("ambiguous" in found) return { reason: "ambiguous", pointer, name };
   const manifest = found.manifest;
+  if (isInjectedDeclaration(manifest as ResourceManifest)) {
+    return { reason: "injected", pointer, name };
+  }
   if (typeof manifest.kind !== "string") return { reason: "unresolved", pointer, name };
   const definition = scope.resolveDefinition(manifest.kind);
   if (!definition) return { reason: "no-projection", pointer, kind: manifest.kind };
@@ -550,6 +564,11 @@ export function describeProjectionFailure(failure: ProjectionFailure): string {
         : `'${failure.pointer}' does not hold a reference, so there is no declaration to project.`;
     case "unresolved":
       return `'${failure.pointer}' references '${failure.name}', which resolves to no resource.`;
+    case "injected":
+      return (
+        `'${failure.pointer}' references '${failure.name}', a resource input this module does ` +
+        `not declare — its entries belong to whoever supplies it.`
+      );
     case "ambiguous":
       return (
         `'${failure.pointer}' references '${failure.name}', which matches more than one resource ` +

package/src/system-kinds.ts

@@ -28,8 +28,13 @@ export const DEPENDENCY_GRAPH_SKIP_KINDS: ReadonlySet<string> = new Set([
 /** Skipped by `!ref` sentinel resolution: kinds whose bodies are
  *  blueprints or import-time metadata, not resource instances with
  *  user-referenced ref slots. Mirrors `REF_VALIDATION_SKIP_KINDS` but
- *  also drops Telo.Import (its `source` isn't a ref slot, and walking
- *  the field map on it is pointless since there's no registered kind). */
+ *  also lists Telo.Import, because walking its field map is pointless —
+ *  there is no registered kind behind it.
+ *
+ *  `resolveRefSentinels` reaches Telo.Import's `resources:` block AHEAD of this
+ *  set, deliberately: those are the references an importer supplies for a
+ *  library's declared inputs, and they resolve exactly like any other. Nothing
+ *  else on the document is a reference slot, so only that subtree is walked. */
 export const REF_RESOLUTION_SKIP_KINDS: ReadonlySet<string> = new Set([
   "Telo.Definition",
   "Telo.Abstract",

package/src/telo-version.ts

@@ -6,4 +6,4 @@
 // written against, and every kernel in every language reports the same scale.
 
 /** The surface generation this analyzer implements. */
-export const TELO_SURFACE_VERSION = "0.82.1";
+export const TELO_SURFACE_VERSION = "0.84.0";

package/src/template-body.ts

@@ -0,0 +1,104 @@
+import type { ResourceDefinition, ResourceManifest } from "@telorun/sdk";
+import type { AliasResolver } from "./alias-resolver.js";
+import type { DefinitionRegistry } from "./definition-registry.js";
+import type { ModuleScopes } from "./alias-resolver.js";
+
+/**
+ * A `Telo.Definition`'s `resources:` entries — the bodies a kind writes for
+ * ANOTHER kind — read as what they are: declarations of that other kind.
+ *
+ * The consequence is the whole point. CEL inside such a body used to be typed in
+ * the ENCLOSING definition's scope, against one fixed permissive context
+ * (`self`, plus open `request` / `result` / `steps` / `error`). So `inputs` and
+ * `item` were undefined wherever the nested kind declares them, while `error`
+ * was offered everywhere regardless of whether a `catch:` was in scope — a body
+ * of more than one dispatch was unwritable, which is why no standard-library
+ * template has one.
+ *
+ * Resolving through the nested kind's OWN annotations — its `x-telo-context`
+ * regions, its step body, its error branches — makes a nested declaration answer
+ * exactly as the same declaration written at the top level does, with `self`
+ * merged in from the enclosing definition's `schema:`.
+ *
+ * Browser-safe.
+ */
+export interface TemplateBody {
+  /** Concrete path prefix of this entry (`resources[0]`), as CEL sites are
+   *  addressed. */
+  prefix: string;
+  /** JSONPath prefix for context scopes (`$.resources[0]`). */
+  scopePrefix: string;
+  manifest: ResourceManifest;
+  definition: ResourceDefinition | undefined;
+}
+
+/** The template bodies a manifest declares — empty for anything that is not a
+ *  `Telo.Definition` with a `resources:` array. */
+export function templateBodies(
+  m: ResourceManifest,
+  registry: DefinitionRegistry,
+  aliases: AliasResolver | undefined,
+  scopes: ModuleScopes | undefined,
+): TemplateBody[] {
+  if (m.kind !== "Telo.Definition") return [];
+  const bodies = (m as Record<string, unknown>).resources;
+  if (!Array.isArray(bodies)) return [];
+
+  // A nested kind is written through the alias scope of the module that DECLARED
+  // the definition, never the consumer's — the same rule every other kind
+  // resolution in a forwarded manifest follows.
+  const ownModule = (m.metadata as { module?: string } | undefined)?.module;
+  const scope =
+    (ownModule && scopes && !scopes.rootModules.has(ownModule)
+      ? scopes.aliasesByModule.get(ownModule)
+      : undefined) ?? aliases;
+
+  const out: TemplateBody[] = [];
+  for (let i = 0; i < bodies.length; i++) {
+    const body = bodies[i];
+    if (!body || typeof body !== "object" || Array.isArray(body)) continue;
+    const kind = (body as { kind?: unknown }).kind;
+    if (typeof kind !== "string") continue;
+    const canonical = scope?.resolveKind(kind);
+    const definition = registry.resolve(kind) ?? (canonical ? registry.resolve(canonical) : undefined);
+    out.push({
+      prefix: `resources[${i}]`,
+      scopePrefix: `$.resources[${i}]`,
+      manifest: body as ResourceManifest,
+      definition,
+    });
+  }
+  return out;
+}
+
+/** True when a CEL path lies at or inside a body's own subtree. */
+export function pathInBody(path: string, prefix: string): boolean {
+  return (
+    path === prefix || path.startsWith(`${prefix}.`) || path.startsWith(`${prefix}[`)
+  );
+}
+
+/** The body a CEL path belongs to, or undefined for a path in the definition's
+ *  own fields. Generic over what the caller keyed to each body — the resolver
+ *  carries a step context and an error map, the visitor carries the schema. */
+export function bodyForPath<T extends { prefix: string }>(
+  bodies: readonly T[],
+  path: string,
+): T | undefined {
+  return bodies.find((b) => pathInBody(path, b.prefix));
+}
+
+/** `self` is in scope throughout a template body — it is how the body reaches
+ *  the configuration its enclosing kind was given — so it is merged into every
+ *  context the nested kind declares, which knows nothing about it. Merged UNDER
+ *  the nested kind's own properties: a name the nested kind declares wins, since
+ *  that is what its controller will bind. */
+export function withTemplateSelf(contextSchema: Record<string, any>): Record<string, any> {
+  return {
+    ...contextSchema,
+    properties: {
+      self: { "x-telo-context-from-root": "schema" },
+      ...(contextSchema.properties ?? {}),
+    },
+  };
+}

package/src/validate-cel-context.ts

@@ -14,6 +14,30 @@ import { withRefSlotsAsReadings } from "./ref-slot-reading.js";
 export { extractCelRegionScopes, pathMatchesScope } from "./eval-paths.js";
 import { pathMatchesScope } from "./eval-paths.js";
 
+/** True when a node's value is decided at load or dispatch rather than written
+ *  — a tagged sentinel (`!cel`, `!sql`, an embed) or an already-compiled value.
+ *  A schema position holding one declares a shape nothing static can read. */
+function isDynamicNode(value: unknown): boolean {
+  if (!value || typeof value !== "object") return false;
+  const node = value as Record<string, unknown>;
+  return node.__tagged === true || node.__compiled !== undefined;
+}
+
+/** Replace every dynamically-valued property with an OPEN schema, so the name is
+ *  in scope with its members unconstrained. */
+function openDynamicProperties(
+  props: Record<string, any> | undefined,
+): Record<string, any> | undefined {
+  if (!props || typeof props !== "object") return props;
+  let out: Record<string, any> | undefined;
+  for (const [key, value] of Object.entries(props)) {
+    if (!isDynamicNode(value)) continue;
+    out ??= { ...props };
+    out[key] = {};
+  }
+  return out ?? props;
+}
+
 export interface ContextResolveOpts {
   /** When provided, used to resolve `x-telo-context-from-root` annotations against the
    *  root manifest. When omitted, defaults to `manifestItem`. */
@@ -357,8 +381,19 @@ export function resolveContextAnnotations(
     // to be resolved first: the standard library writes it as the inline
     // `{ kind: Type.JsonSchema, schema: … }` wrapper, so merging it verbatim
     // would type the variable as `{ kind, schema }` instead of its properties.
+    // The navigated node — or one of the properties in it — may itself be an
+    // expression: a route whose `request.schema.body` is `!cel "self.model.schema"`
+    // declares a body whose SHAPE is only known once the template is
+    // instantiated. Such a name types as OPEN rather than as nothing, and a
+    // wholly dynamic map leaves the whole node open. Resolving it to nothing
+    // reports `request.body` as undefined, which blames the reader for the
+    // writer's dynamism — the same posture a rule takes when a value it reads
+    // is dynamic: skip the judgement, never invert it.
+    if (isDynamicNode(navigated)) {
+      return { ...schema, properties: { ...(schema.properties ?? {}) }, additionalProperties: true };
+    }
     const asType = resolveTypeFieldToSchema(navigated, allManifests ?? []);
-    const resolved = asType?.properties ?? navigated;
+    const resolved = openDynamicProperties(asType?.properties ?? navigated);
     const required = Array.isArray(asType?.required) ? asType.required : undefined;
     return {
       ...schema,
@@ -520,12 +555,37 @@ export function getManifestItem(
   manifest: Record<string, any>,
 ): Record<string, any> {
   const stripped = scope.startsWith("$.") ? scope.slice(2) : scope;
-  const wildcardIdx = stripped.indexOf("[*]");
-  if (wildcardIdx === -1) return manifest;
-  const arrayProp = stripped.slice(0, wildcardIdx); // e.g. "routes"
-  const m = exprPath.match(new RegExp(`^${arrayProp}\\[(\\d+)\\]`));
-  if (!m) return manifest;
-  return (manifest as any)[arrayProp]?.[Number(m[1])] ?? manifest;
+  const parts = stripped.split("[*]");
+  if (parts.length === 1) return manifest;
+  // Resolve each `[*]` against the concrete index the expression path carries at
+  // the same position, accumulating up to the LAST wildcard: that node is the
+  // per-scope item (`routes[2]`), which is what `x-telo-context-from` navigates
+  // from. Built by walking the pattern rather than by a regex over the scope —
+  // a scope is a path, not a pattern, and its own `[4]` segments are regex
+  // character classes, which is what silently made every nested scope resolve
+  // to the whole document instead of the item.
+  let remaining = exprPath;
+  let concrete = "";
+  for (let i = 0; i < parts.length - 1; i++) {
+    const part = parts[i]!;
+    if (!remaining.startsWith(part)) return manifest;
+    remaining = remaining.slice(part.length);
+    const index = remaining.match(/^\[(\d+)\]/);
+    if (!index) return manifest;
+    remaining = remaining.slice(index[0].length);
+    concrete += `${part}${index[0]}`;
+  }
+  return (navigateConcretePath(manifest, concrete) as Record<string, any> | undefined) ?? manifest;
+}
+
+/** Walk a concrete dotted path with `[N]` indices (`resources[4].routes[2]`). */
+function navigateConcretePath(root: unknown, path: string): unknown {
+  let cur: unknown = root;
+  for (const segment of path.match(/[^.[\]]+/g) ?? []) {
+    if (cur === null || typeof cur !== "object") return undefined;
+    cur = (cur as Record<string, unknown>)[segment];
+  }
+  return cur;
 }
 
 function navigatePath(obj: unknown, segments: string[]): unknown {

package/src/validate-extends.ts

@@ -1,7 +1,13 @@
 import type { ResourceDefinition, ResourceManifest } from "@telorun/sdk";
 import type { AliasResolver } from "./alias-resolver.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
-import { inheritedCapability, type DefResolver } from "./extends-resolution.js";
+import {
+  controllerBearingAncestor,
+  effectiveAuthorSchema,
+  inheritedCapability,
+  isInheritedDelegation,
+  type DefResolver,
+} from "./extends-resolution.js";
 import { DiagnosticSeverity, type AnalysisDiagnostic } from "./types.js";
 
 const SOURCE = "telo-analyzer";
@@ -25,6 +31,9 @@ const EXTENDS_ALIAS_RE = /^[A-Z][A-Za-z0-9_]*\.[A-Z][A-Za-z0-9_]*$/;
  *  - EXTENDS_UNKNOWN_TARGET: alias resolves to a module, but that module has no
  *    registered definition with the target name.
  *  - EXTENDS_NON_ABSTRACT: target resolves to a Telo.Definition, not a Telo.Abstract.
+ *  - EXTENDS_CLOSED_PARENT_ADDS_FIELD: a child with no `base:` declares a property its
+ *    controller-bearing ancestor's closed schema rejects — the runtime counterpart is a
+ *    create-time failure phrased against the ancestor kind.
  *  - CAPABILITY_SHADOWS_EXTENDS (warning): `capability` names a user-declared abstract
  *    (metadata.module !== "Telo"). Builtin lifecycle capabilities (Telo.Invocable, etc.)
  *    never trigger this — they're lifecycle roles by design.
@@ -149,6 +158,47 @@ export function validateExtends(
                   data: { resource, filePath, path: "capability" },
                 });
               }
+
+              // A merge-form child (no `base:`) forwards its WHOLE config to the
+              // inherited controller as the parent's config, so a field the
+              // parent's schema closes out is rejected at the parent's own
+              // create-time validation — phrased against the parent kind, at the
+              // instance's line, about a resource the author never wrote.
+              // Reported here instead, at the property that has to change.
+              if (
+                (m as { base?: unknown }).base == null &&
+                isInheritedDelegation(m as ResourceDefinition, resolveDef)
+              ) {
+                const ancestor = controllerBearingAncestor(m as ResourceDefinition, resolveDef);
+                const ancestorSchema = ancestor
+                  ? effectiveAuthorSchema(ancestor, resolveDef)
+                  : undefined;
+                if (ancestorSchema?.additionalProperties === false) {
+                  const inherited = new Set(Object.keys(ancestorSchema.properties ?? {}));
+                  const ownProps = ((m as { schema?: { properties?: Record<string, unknown> } })
+                    .schema?.properties ?? {}) as Record<string, unknown>;
+                  const ancestorKind = `${ancestor?.metadata.module}.${ancestor?.metadata.name}`;
+                  for (const prop of Object.keys(ownProps)) {
+                    if (inherited.has(prop)) continue;
+                    diagnostics.push({
+                      severity: DiagnosticSeverity.Error,
+                      code: "EXTENDS_CLOSED_PARENT_ADDS_FIELD",
+                      source: SOURCE,
+                      message:
+                        `${label}: declares '${prop}', but '${ancestorKind}' closes its schema ` +
+                        `(additionalProperties: false) and a child without 'base:' forwards its whole ` +
+                        `config as that kind's config — so '${prop}' is rejected when the resource is ` +
+                        `created. Add a 'base:' mapping, which makes this kind's fields construction ` +
+                        `inputs and builds the parent's config explicitly.`,
+                      data: {
+                        resource,
+                        filePath,
+                        path: `schema.properties.${prop}`,
+                      },
+                    });
+                  }
+                }
+              }
             }
           }
         }