@telorun/analyzer 0.69.0 → 0.71.0

package/dist/validate-references.js

@@ -5,6 +5,8 @@ import { navigateJsonPointer, substituteCelFields } from "./schema-compat.js";
 import { REF_VALIDATION_SKIP_KINDS as SYSTEM_KINDS } from "./system-kinds.js";
 import { resolveTypeFieldToSchema } from "./validate-cel-context.js";
 import { DiagnosticSeverity } from "./types.js";
+import { moduleAliasScope } from "./module-alias-scope.js";
+import { isInjectedDeclaration } from "./resource-input.js";
 const SOURCE = "telo-analyzer";
 /**
  * Liskov substitutability at a kind constraint: is `resolved` (a canonical
@@ -16,17 +18,28 @@ const SOURCE = "telo-analyzer";
  *
  * A value satisfies the slot when it transitively extends the target kind, or —
  * for a CONCRETE target — IS that kind; `getByExtends` is the same transitive
- * subtype index for both, and an abstract is satisfied only by an implementer,
- * never by the abstract itself (which is non-instantiable). Accepts a constraint
- * that resolves to nothing, and an abstract with no loaded implementations:
- * partial context, where a rejection would be a guess.
+ * subtype index for both. Accepts a constraint that resolves to nothing, and an
+ * abstract with no loaded implementations: partial context, where a rejection
+ * would be a guess.
+ *
+ * An abstract is satisfied only by an implementer, never by the abstract itself,
+ * because a resource declared `kind: <some abstract>` is refused at `create()`
+ * and reported as `ABSTRACT_KIND_INSTANTIATED` at its declaration — so accepting
+ * it here would leave the reference sites silent about a manifest that cannot
+ * run. `isDeclaration` is the ONE exception and it is not an instance: a
+ * library's `resources:` entry is constrained by kind alone, so its kind-only
+ * stand-in routinely IS an abstract (`connection: {kind: Sql.Connection}`), and
+ * every use of that name inside the library is a reference to it.
  */
-export function kindSatisfies(resolved, targetKind, registry) {
+export function kindSatisfies(resolved, targetKind, registry, 
+/** The referent is a kind-only stand-in for a `resources:` entry rather than a
+ *  resource anything instantiates, so identity satisfies an abstract slot. */
+isDeclaration = false) {
     const canonical = registry.resolveRef(targetKind) ?? targetKind;
     const targetDef = registry.resolve(canonical);
     if (!targetDef)
         return true;
-    if (targetDef.kind !== "Telo.Abstract" && resolved === canonical)
+    if ((targetDef.kind !== "Telo.Abstract" || isDeclaration) && resolved === canonical)
         return true;
     const subtypes = registry.getByExtends(canonical);
     if (subtypes.some((d) => `${d.metadata.module}.${d.metadata.name}` === resolved))
@@ -53,7 +66,9 @@ export function kindSatisfies(resolved, targetKind, registry) {
 /** {@link kindSatisfies} at every kind a slot accepts, rendered as messages.
  *  The acceptance rule is not restated here — only what to say when it fails,
  *  which needs the slot's alternatives and the target's flavour. */
-function checkKind(kind, entry, registry, aliases) {
+function checkKind(kind, entry, registry, aliases, 
+/** See {@link kindSatisfies}: the referent is a `resources:` stand-in. */
+isDeclaration = false) {
     const resolved = aliases.resolveKind(kind) ?? kind;
     // A qualified kind whose prefix names no import in this scope is a bad NAME
     // rather than a bad type — `{kind: NotAnAlias.Script}` where only `Lib` is
@@ -76,7 +91,7 @@ function checkKind(kind, entry, registry, aliases) {
         const targetDef = registry.resolve(targetKind);
         if (!targetDef)
             return [];
-        if (!unknownAlias && kindSatisfies(resolved, targetKind, registry))
+        if (!unknownAlias && kindSatisfies(resolved, targetKind, registry, isDeclaration))
             return [];
         const subtypes = registry.getByExtends(targetKind);
         const subtypeKinds = new Set(subtypes.map((d) => `${d.metadata.module}.${d.metadata.name}`));
@@ -311,7 +326,7 @@ export function validateReferences(resources, context) {
                     });
                     return;
                 }
-                const kindErrors = checkKind(target.kind, entry, registry, aliases);
+                const kindErrors = checkKind(target.kind, entry, registry, aliases, isInjectedDeclaration(target));
                 if (kindErrors.length > 0) {
                     diagnostics.push({
                         severity: DiagnosticSeverity.Error,
@@ -359,7 +374,11 @@ export function validateReferences(resources, context) {
                 return;
             }
             // 2. Kind check
-            const kindErrors = checkKind(refVal.kind, entry, registry, aliases);
+            const objectTarget = typeof refVal.name === "string"
+                ? (visibleScopeManifests.find((m) => m.metadata?.name === refVal.name) ??
+                    byName.get(refVal.name))
+                : undefined;
+            const kindErrors = checkKind(refVal.kind, entry, registry, aliases, isInjectedDeclaration(objectTarget));
             if (kindErrors.length > 0) {
                 diagnostics.push({
                     severity: DiagnosticSeverity.Error,
@@ -448,8 +467,7 @@ export function validateReferences(resources, context) {
             if (!isAbsolute && anchorName.includes(".")) {
                 const resolvedResourceKind = aliases.resolveKind(r.kind) ?? r.kind;
                 const resourceDef = registry.resolve(r.kind) ?? registry.resolve(resolvedResourceKind);
-                const owningModule = resourceDef?.metadata?.module;
-                const ownerScope = (owningModule ? aliasesByModule?.get(owningModule) : undefined) ?? aliases;
+                const ownerScope = moduleAliasScope(resourceDef?.metadata, aliases, aliasesByModule);
                 const targetKind = ownerScope.resolveKind(anchorName);
                 if (!targetKind) {
                     // Names the ALIAS, not the whole kind path: the alias is what an

package/dist/validate-resource-inputs.d.ts

@@ -2,34 +2,9 @@ import type { ResourceManifest } from "@telorun/sdk";
 import type { AliasResolver } from "./alias-resolver.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
 import { type AnalysisDiagnostic } from "./types.js";
-/**
- * The strict half of {@link readResourceInputs} — the `validate-ref-slots.ts`
- * split applied to the resource-input boundary, and not optional for the same
- * reason: the two sides fail in OPPOSITE directions. An unreadable DECLARATION
- * leaves the library referencing a name nothing stands behind; an unchecked
- * INJECTION hands a library an instance of a kind it never asked for, which
- * surfaces as a method-missing failure inside someone else's module.
- *
- * Two surfaces, scoped the same way every other declaration check is — to the
- * entry's own modules, since a published dependency's block is not the
- * consumer's to fix:
- *
- *  - **The library's own declaration.** Each entry's alias-qualified `kind:` must
- *    resolve in the DECLARING module's scope (`RESOURCE_INPUT_KIND_UNRESOLVED`).
- *    A constraint that resolves to nothing accepts anything, which is the same
- *    hole `X_TELO_REF_UNRESOLVED` exists to close one level down.
- *  - **The injection site.** Every declared entry must be supplied
- *    (`RESOURCE_INPUT_MISSING` — the same failure as a missing required
- *    variable), nothing beyond them may be (`RESOURCE_INPUT_UNKNOWN`), the value
- *    must name a resource that exists (`RESOURCE_INPUT_UNRESOLVED`), and its
- *    kind must satisfy the declared constraint transitively
- *    (`RESOURCE_INPUT_KIND_MISMATCH`).
- *
- * Browser-safe.
- */
 export declare function validateResourceInputs(manifests: ResourceManifest[], registry: DefinitionRegistry, aliases: AliasResolver, rootModules: Set<string>, 
 /** Kind acceptance, transitively — the `checkKind` rule `validate-references`
  *  applies at an ordinary ref slot, passed in rather than re-derived so the
  *  two cannot disagree about what satisfies a constraint. */
-acceptsKind: (suppliedKind: string, requiredKind: string) => boolean): AnalysisDiagnostic[];
+acceptsKind: (suppliedKind: string, requiredKind: string, suppliedIsDeclaration: boolean) => boolean): AnalysisDiagnostic[];
 //# sourceMappingURL=validate-resource-inputs.d.ts.map

package/dist/validate-resource-inputs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-resource-inputs.d.ts","sourceRoot":"","sources":["../src/validate-resource-inputs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAGnE,OAAO,EAAE,KAAK,kBAAkB,EAAsB,MAAM,YAAY,CAAC;AASzE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,EACtB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC;AACxB;;6DAE6D;AAC7D,WAAW,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,GACnE,kBAAkB,EAAE,CA6LtB"}
+{"version":3,"file":"validate-resource-inputs.d.ts","sourceRoot":"","sources":["../src/validate-resource-inputs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAOnE,OAAO,EAAE,KAAK,kBAAkB,EAAsB,MAAM,YAAY,CAAC;AAqCzE,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,EACtB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC;AACxB;;6DAE6D;AAC7D,WAAW,EAAE,CACX,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,qBAAqB,EAAE,OAAO,KAC3B,OAAO,GACX,kBAAkB,EAAE,CAyMtB"}

package/dist/validate-resource-inputs.js

@@ -1,6 +1,6 @@
 import { isRefSentinel } from "@telorun/templating";
 import { findDynamicLeaf } from "./resource-rule.js";
-import { readResourceInputs, readSuppliedResources } from "./resource-input.js";
+import { isInjectedDeclaration, readResourceInputs, readSuppliedResources, } from "./resource-input.js";
 import { DiagnosticSeverity } from "./types.js";
 const SOURCE = "telo-analyzer";
 /**
@@ -28,6 +28,7 @@ const SOURCE = "telo-analyzer";
  *
  * Browser-safe.
  */
+const declaringModule = (m) => m.metadata?.module;
 export function validateResourceInputs(manifests, registry, aliases, rootModules, 
 /** Kind acceptance, transitively — the `checkKind` rule `validate-references`
  *  applies at an ordinary ref slot, passed in rather than re-derived so the
@@ -186,7 +187,16 @@ acceptsKind) {
             if (typeof suppliedKind !== "string")
                 continue;
             const canonical = aliases.resolveKind(suppliedKind) ?? suppliedKind;
-            if (acceptsKind(canonical, entry))
+            // A library forwarding an input it was itself handed supplies a kind-only
+            // stand-in, whose kind is routinely the abstract the target declares. That
+            // is identity against an abstract, which an ordinary reference is refused
+            // — the referent there would be a resource nothing can instantiate, while
+            // here it is another declaration.
+            const suppliedName = value.name;
+            const supplied = typeof suppliedName === "string"
+                ? manifests.find((c) => c.metadata?.name === suppliedName && isOwn(declaringModule(c)))
+                : undefined;
+            if (acceptsKind(canonical, entry, isInjectedDeclaration(supplied)))
                 continue;
             out.push({
                 severity: DiagnosticSeverity.Error,

package/dist/validate-schema-type-refs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-schema-type-refs.d.ts","sourceRoot":"","sources":["../src/validate-schema-type-refs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAKzE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAC3C,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,GACvB,kBAAkB,EAAE,CAuDtB"}
+{"version":3,"file":"validate-schema-type-refs.d.ts","sourceRoot":"","sources":["../src/validate-schema-type-refs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAMzE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAC3C,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,GACvB,kBAAkB,EAAE,CAuDtB"}

package/dist/validate-schema-type-refs.js

@@ -1,5 +1,6 @@
 import { canonicalTypeSchemaId, parseTeloTypeRef } from "@telorun/sdk";
 import { DiagnosticSeverity } from "./types.js";
+import { moduleAliasScope } from "./module-alias-scope.js";
 const SOURCE = "telo-analyzer";
 const SCHEMA_FIELDS = ["schema", "inputType", "outputType"];
 /**
@@ -28,7 +29,7 @@ export function validateSchemaTypeRefs(manifests, registry, aliases, aliasesByMo
         // validated against their own library when it's analyzed as a root.
         if (ownModule && !rootModules.has(ownModule))
             continue;
-        const resolver = (ownModule ? aliasesByModule.get(ownModule) : undefined) ?? aliases;
+        const resolver = moduleAliasScope(m.metadata, aliases, aliasesByModule);
         const filePath = m.metadata?.source;
         const label = `${m.kind}/${name}`;
         const walk = (value, path) => {

package/dist/validate-throws-coverage.d.ts

@@ -4,5 +4,9 @@ import { type AliasResolver } from "./alias-resolver.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
 import { type AnalysisDiagnostic } from "./types.js";
 /** Entry point — invoked once per analyze() run. */
-export declare function validateThrowsCoverage(manifests: ResourceManifest[], defs: DefinitionRegistry, aliases: AliasResolver, env: Environment, aliasesByModule?: Map<string, AliasResolver>, rootModules?: Set<string>): AnalysisDiagnostic[];
+export declare function validateThrowsCoverage(manifests: ResourceManifest[], defs: DefinitionRegistry, aliases: AliasResolver, env: Environment, aliasesByModule?: Map<string, AliasResolver>, rootModules?: Set<string>, 
+/** Each imported library's full document set, so the walk can follow an
+ *  exported entry point into the siblings it invokes — which a consumer's
+ *  flat set does not carry. */
+moduleManifests?: Map<string, ResourceManifest[]>): AnalysisDiagnostic[];
 //# sourceMappingURL=validate-throws-coverage.d.ts.map

package/dist/validate-throws-coverage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-throws-coverage.d.ts","sourceRoot":"","sources":["../src/validate-throws-coverage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEjE,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAA0B,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAOnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAsfzE,oDAAoD;AACpD,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,WAAW,EAChB,eAAe,GAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAa,EACvD,WAAW,GAAE,GAAG,CAAC,MAAM,CAAa,GACnC,kBAAkB,EAAE,CAkDtB"}
+{"version":3,"file":"validate-throws-coverage.d.ts","sourceRoot":"","sources":["../src/validate-throws-coverage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEjE,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAA0B,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAOnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAsfzE,oDAAoD;AACpD,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,WAAW,EAChB,eAAe,GAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAa,EACvD,WAAW,GAAE,GAAG,CAAC,MAAM,CAAa;AACpC;;+BAE+B;AAC/B,eAAe,GAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAa,GAC3D,kBAAkB,EAAE,CAyDtB"}

package/dist/validate-throws-coverage.js

@@ -431,10 +431,14 @@ function schemaHasStepContext(schema) {
     return false;
 }
 /** Entry point — invoked once per analyze() run. */
-export function validateThrowsCoverage(manifests, defs, aliases, env, aliasesByModule = new Map(), rootModules = new Set()) {
+export function validateThrowsCoverage(manifests, defs, aliases, env, aliasesByModule = new Map(), rootModules = new Set(), 
+/** Each imported library's full document set, so the walk can follow an
+ *  exported entry point into the siblings it invokes — which a consumer's
+ *  flat set does not carry. */
+moduleManifests = new Map()) {
     const diagnostics = [];
     diagnostics.push(...validateThrowsDeclarations(manifests));
-    const resolveCtx = createResolveCtx(manifests, defs, aliases, aliasesByModule, rootModules);
+    const resolveCtx = createResolveCtx(manifests, defs, aliases, aliasesByModule, rootModules, moduleManifests);
     // The alias resolver for a manifest's own lexical scope — an imported library's
     // resolver when it owns the manifest, else undefined (fall back to root aliases).
     const scopeResolverFor = (m) => scopeResolverForModule(m.metadata?.module, rootModules, aliasesByModule);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.69.0",
+  "version": "0.71.0",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",
@@ -49,7 +49,7 @@
     "@types/node": "^20.0.0",
     "typescript": "^5.0.0",
     "vitest": "^2.1.8",
-    "@telorun/sdk": "0.83.0"
+    "@telorun/sdk": "0.87.0"
   },
   "peerDependencies": {
     "@telorun/sdk": "*"

package/src/analysis-registry.ts

@@ -9,6 +9,7 @@ import { visitManifest as runVisitManifest, type ManifestVisitor } from "./manif
 import type { ContractDirection, DefResolver } from "./extends-resolution.js";
 import { resolveContract } from "./invocation-contract.js";
 import { createResolveCtx, resolveThrowsUnion } from "./resolve-throws-union.js";
+import { moduleAliasScope } from "./module-alias-scope.js";
 import { isRefEntry, isScopeEntry } from "./reference-field-map.js";
 import { resolveSchemaTypeRefs as resolveSchemaTypeRefsIn } from "./resolve-schema-type-refs.js";
 import type { AnalysisContext } from "./types.js";
@@ -258,8 +259,7 @@ export class AnalysisRegistry {
    */
   resolveSchemaFrom(schemaFrom: string, declaringKind: string): Record<string, any> | undefined {
     const def = this.resolveDefinition(declaringKind);
-    const ownerModule = (def?.metadata as { module?: string } | undefined)?.module;
-    const scope = (ownerModule ? this.aliasesByModule.get(ownerModule) : undefined) ?? this.aliases;
+    const scope = moduleAliasScope(def?.metadata, this.aliases, this.aliasesByModule);
     return this.defs.resolveSchemaFromNode(schemaFrom, scope);
   }
 
@@ -337,7 +337,7 @@ export class AnalysisRegistry {
    *  the kind was read off. Falls back to the global table when the module is
    *  unknown or is a root. */
   resolveDefinitionIn(kind: string, module?: string): ResourceDefinition | undefined {
-    const scope = (module ? this.aliasesByModule.get(module) : undefined) ?? this.aliases;
+    const scope = moduleAliasScope({ module }, this.aliases, this.aliasesByModule);
     const canonical = scope.resolveKind(kind);
     return this.defs.resolve(kind) ?? (canonical ? this.defs.resolve(canonical) : undefined);
   }
@@ -354,8 +354,7 @@ export class AnalysisRegistry {
   resolverForDefinition(def: {
     metadata?: { module?: string };
   }): (kind: string) => ResourceDefinition | undefined {
-    const ownModule = def?.metadata?.module;
-    const scope = (ownModule ? this.aliasesByModule.get(ownModule) : undefined) ?? this.aliases;
+    const scope = moduleAliasScope(def?.metadata, this.aliases, this.aliasesByModule);
     return (kind) => {
       const canonical = scope.resolveKind(kind);
       return this.defs.resolve(kind) ?? (canonical ? this.defs.resolve(canonical) : undefined);

package/src/analyzer.ts

@@ -47,6 +47,7 @@ import {
 } from "./validate-observed-state.js";
 import { computeSuggestKind } from "./kind-suggest.js";
 import { visitManifest } from "./manifest-visitor.js";
+import { declaringModuleScope, moduleAliasScope } from "./module-alias-scope.js";
 import { isModuleKind } from "./module-kinds.js";
 import { normalizeInlineResources } from "./normalize-inline-resources.js";
 import { REF_VALIDATION_SKIP_KINDS } from "./system-kinds.js";
@@ -999,10 +1000,10 @@ export class StaticAnalyzer {
       if (m.kind !== "Telo.Definition" && m.kind !== "Telo.Abstract") continue;
       const def = m as unknown as ResourceDefinition;
       const ownModule = (def.metadata as { module?: string } | undefined)?.module;
-      const scopeResolver =
-        ownModule && !rootModules.has(ownModule)
-          ? (aliasesByModule.get(ownModule) ?? new AliasResolver())
-          : aliases;
+      const scopeResolver = declaringModuleScope(ownModule, aliases, {
+        aliasesByModule,
+        rootModules,
+      });
       // Canonicalize alias-form `x-telo-ref` constraints in the DECLARING module's
       // scope, before the schema reaches `register()` and the lazily-built field
       // maps. Same pre-resolution `capability` / `extends` get below.
@@ -1425,7 +1426,7 @@ export class StaticAnalyzer {
       // analyzer knowing it exists: going native costs a module, not a change
       // here.
       const resolveRegionDef = (kind: string, module?: string) => {
-        const scope = (module ? aliasesByModule.get(module) : undefined) ?? aliases;
+        const scope = moduleAliasScope({ module }, aliases, aliasesByModule);
         const canonical = scope.resolveKind(kind);
         return defs.resolve(kind) ?? (canonical ? defs.resolve(canonical) : undefined);
       };
@@ -1456,8 +1457,10 @@ export class StaticAnalyzer {
       if (!ownModule || !m.metadata?.name || typeof m.schema !== "object" || m.schema === null) {
         continue;
       }
-      const scopeResolver =
-        rootModules.has(ownModule) ? aliases : (aliasesByModule.get(ownModule) ?? new AliasResolver());
+      const scopeResolver = declaringModuleScope(ownModule, aliases, {
+        aliasesByModule,
+        rootModules,
+      });
       const canonicalKind = scopeResolver.resolveKind(m.kind as string) ?? (m.kind as string);
       if (defs.resolve(canonicalKind)?.capability !== "Telo.Type") continue;
       const typeName = m.metadata.name as string;
@@ -1877,6 +1880,37 @@ export class StaticAnalyzer {
         continue;
       }
 
+      // An abstract names a CONTRACT for reference slots, not something to
+      // instantiate — the kernel refuses it outright at `create()`. Reported
+      // here, at the declaration, because that is the line the author has to
+      // change and because a runtime-only refusal is exactly the shape static
+      // analysis exists to remove. The hint mirrors the kernel's: the concrete
+      // implementations this analysis holds, or the reason there are none.
+      //
+      // Injected declarations never reach this loop (skipped above), which is
+      // what keeps a `resources:` entry — kind-only and routinely abstract by
+      // design — out of it.
+      if (definition.kind === "Telo.Abstract") {
+        const canonical = resolvedKind ?? m.kind;
+        const impls = defs
+          .getByExtends(canonical)
+          .filter((d) => d.kind !== "Telo.Abstract")
+          .map((d) => `${d.metadata.module}.${d.metadata.name}`);
+        const kindInfo =
+          canonical !== m.kind ? `'${m.kind}' (resolved to '${canonical}')` : `'${m.kind}'`;
+        const hint = impls.length
+          ? `instantiate a concrete implementation: ${impls.join(", ")}`
+          : "no concrete implementations are registered — import a module that provides one";
+        diagnostics.push({
+          severity: DiagnosticSeverity.Error,
+          code: "ABSTRACT_KIND_INSTANTIATED",
+          source: SOURCE,
+          message: `Kind ${kindInfo} is abstract and cannot be instantiated directly; ${hint}.`,
+          data: { resource, filePath, path: "kind" },
+        });
+        continue;
+      }
+
       // Validate resource config against the definition's AUTHOR-FACING schema —
       // inheritance-resolved, with `kind` / `metadata` injected. See
       // `validationSchemaFor`, which is where both derivations and the reason
@@ -2690,9 +2724,25 @@ export class StaticAnalyzer {
     // Validate provider coherence rules for `provide:` template-target definitions.
     diagnostics.push(...validateProviderCoherence(allManifests, defs, aliases));
 
-    // Validate throws: declarations and catches: coverage (rules 1, 2, 4, 7)
+    // Validate throws: declarations and catches: coverage (rules 1, 2, 4, 7).
+    // The library document sets collected for the zone stage serve here too: a
+    // library's exported entry point is forwarded into the flat set while the
+    // siblings it invokes are not, so without them the walk stops at the
+    // boundary and reports an empty union for a body that plainly throws.
+    const libraryManifests = new Map<string, ResourceManifest[]>();
+    for (const doc of options?.moduleDocuments ?? []) {
+      libraryManifests.set(doc.module, doc.manifests);
+    }
     diagnostics.push(
-      ...validateThrowsCoverage(allManifests, defs, aliases, this.celEnv, aliasesByModule, rootModules),
+      ...validateThrowsCoverage(
+        allManifests,
+        defs,
+        aliases,
+        this.celEnv,
+        aliasesByModule,
+        rootModules,
+        libraryManifests,
+      ),
     );
 
     // Warn about declared variables / secrets / ports that no CEL references.
@@ -2710,7 +2760,8 @@ export class StaticAnalyzer {
         defs,
         aliases,
         rootModules,
-        (supplied, required) => kindSatisfies(supplied, required, defs),
+        (supplied, required, isDeclaration) =>
+          kindSatisfies(supplied, required, defs, isDeclaration),
       ),
     );
 

package/src/call-graph.ts

@@ -40,6 +40,7 @@
  */
 import type { ResourceDefinition, ResourceManifest } from "@telorun/sdk";
 import { isRefSentinel, isTaggedSentinel } from "@telorun/templating";
+import { refSentinelTarget } from "./ref-sentinel-target.js";
 import type { AliasResolver } from "./alias-resolver.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
 import {
@@ -63,6 +64,7 @@ import {
   type RefFieldEntry,
 } from "./reference-field-map.js";
 import { DEPENDENCY_GRAPH_SKIP_KINDS as SYSTEM_KINDS } from "./system-kinds.js";
+import { moduleAliasScope } from "./module-alias-scope.js";
 
 export interface ResourceGraphNode {
   type: "resource";
@@ -693,8 +695,7 @@ export function buildCallGraph(
   const definitionFor = (manifest: ResourceManifest): ResourceDefinition | undefined => {
     const direct = registry.resolve(manifest.kind as string);
     if (direct) return direct;
-    const module = (manifest.metadata as { module?: string } | undefined)?.module;
-    const scope = (module ? options.aliasesByModule?.get(module) : undefined) ?? options.aliases;
+    const scope = moduleAliasScope(manifest.metadata, options.aliases, options.aliasesByModule);
     const canonical = scope?.resolveKind(manifest.kind as string);
     return canonical ? registry.resolve(canonical) : undefined;
   };
@@ -962,7 +963,12 @@ export function buildCallGraph(
  *  here: an unresolved `!ref <name>` sentinel and the `{kind, name}` object
  *  `resolveRefSentinels` rewrites it into. */
 function refTargetName(value: unknown): string | undefined {
-  if (isRefSentinel(value)) return value.source;
+  // An edge's target is taken VERBATIM — `resolveScopedName` and the node index
+  // are what resolve it, and a cross-module `Alias.name` is a target this graph
+  // legitimately carries unresolved. That is this pass's reduction over the
+  // shared parse, not a second reading of the tag.
+  const sentinel = refSentinelTarget(value);
+  if (sentinel) return sentinel.source;
   if (!value || typeof value !== "object") return undefined;
   const name = (value as Record<string, unknown>).name;
   return typeof name === "string" ? name : undefined;

package/src/canonical-json.ts

@@ -0,0 +1,24 @@
+/**
+ * Canonical JSON: a rendering under which two structurally equal values produce
+ * the same string — object keys sorted, `undefined`-valued entries dropped.
+ *
+ * Shared rather than duplicated because both readers compare the RESULT for
+ * equality: `contentKey` anchors a module-graph row's identity to its content so
+ * an inserted sibling does not move it, and `declarationSignature` decides
+ * whether a resource has to be rebuilt. Two implementations would eventually
+ * disagree about key order or about `undefined`, and the disagreement surfaces
+ * as a row that silently changes identity, or as a resource that silently fails
+ * to restart.
+ *
+ * Browser-safe: no hashing, no `node:crypto`. Callers that only need equality
+ * compare the strings, which cannot collide; a caller that needs a short key
+ * hashes it itself.
+ */
+export function canonicalJson(value: unknown): string {
+  if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  const entries = Object.entries(value as Record<string, unknown>)
+    .filter(([, v]) => v !== undefined)
+    .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+  return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(",")}}`;
+}

package/src/cel-access-chains.ts

@@ -0,0 +1,47 @@
+/**
+ * What a manifest's CEL READS, as opposed to what its slots reference.
+ *
+ * A dependency a manifest states without a slot: `!cel "resources.db.dsn"` makes
+ * the reader depend on `db` as surely as a `!ref` would, and no reference walk
+ * can see it. Two consumers ask for it — the module graph draws it as a `data`
+ * edge, and the kernel needs it to know who becomes invalid when a resource is
+ * rebuilt — so the extraction is here rather than in either of them.
+ *
+ * The expensive half is the CEL environment used to parse, which is built once
+ * per process and evaluates nothing.
+ */
+import { extractAccessChains } from "@telorun/templating";
+import type { ResourceManifest } from "@telorun/sdk";
+import { walkCelExpressions } from "@telorun/templating";
+import { buildCelEnvironment } from "./cel-environment.js";
+
+let parseEnv: ReturnType<typeof buildCelEnvironment> | undefined;
+
+/** Access chains an expression reads, or none when it does not parse — a syntax
+ *  error is the engine pass's to report, not this one's. */
+export function accessChains(source: string): string[][] {
+  try {
+    parseEnv ??= buildCelEnvironment();
+    return extractAccessChains(parseEnv.parse(source).ast);
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * The bare resource names a manifest's expressions read through
+ * `resources.<name>`, deduplicated.
+ *
+ * Read from the DECLARATION: a compile-eval field is expanded before a
+ * controller sees it, so by then `resources.db.dsn` is a literal with nothing
+ * left to say where it came from.
+ */
+export function celResourceReads(manifest: ResourceManifest): string[] {
+  const names = new Set<string>();
+  walkCelExpressions(manifest as Record<string, unknown>, "", (source: string) => {
+    for (const chain of accessChains(source)) {
+      if (chain[0] === "resources" && chain.length >= 2 && chain[1]) names.add(chain[1]);
+    }
+  });
+  return [...names];
+}

package/src/cel-scope-query.ts

@@ -18,6 +18,7 @@ import { buildCelEnvironment } from "./cel-environment.js";
 import { CelScopeResolver, type CelScope } from "./cel-scope.js";
 import { DefinitionRegistry } from "./definition-registry.js";
 import { buildKernelGlobalsIndex } from "./kernel-globals.js";
+import { moduleAliasScope } from "./module-alias-scope.js";
 import { isModuleKind } from "./module-kinds.js";
 import { navigateConcretePath } from "./manifest-path.js";
 import { findManifest } from "./find-manifest.js";
@@ -41,6 +42,12 @@ export interface ContextDeclarationSite {
   kind: string;
   name: string;
   path: string;
+  /** The declaring module, when the manifest carries one. Part of the identity,
+   *  not decoration: a resource name is unique inside its module and not across a
+   *  flattened set, so `(kind, name)` alone lets a host locating this site land on
+   *  another library's same-named document — which for go-to-declaration means
+   *  jumping to the wrong file with nothing to indicate it. */
+  module?: string;
 }
 
 /** Join a concrete path segment, tolerating an empty base (the manifest root). */
@@ -210,9 +217,14 @@ export class CelScopeQuery {
       base = hit;
     }
 
-    const metadata = origin.manifest.metadata as { name?: string } | undefined;
+    const metadata = origin.manifest.metadata as { name?: string; module?: string } | undefined;
     if (!origin.manifest.kind || !metadata?.name) return undefined;
-    return { kind: origin.manifest.kind, name: metadata.name, path: base };
+    return {
+      kind: origin.manifest.kind,
+      name: metadata.name,
+      path: base,
+      ...(metadata.module === undefined ? {} : { module: metadata.module }),
+    };
   }
 
   /** The manifest and path an annotated context property is derived from, and
@@ -265,13 +277,29 @@ export class CelScopeQuery {
       if (hash <= 0) return undefined;
       const kindValue = navigateConcretePath(root, first.slice(0, hash).split("/").join("."));
       if (typeof kindValue !== "string") return undefined;
-      const canonical = this.ctx.aliases.resolveKind(kindValue) ?? kindValue;
-      const suffix = canonical.slice(canonical.indexOf(".") + 1);
-      const target = this.manifests.find(
+      // The kind was read off THIS resource, so it is spelled in the alias scope
+      // of the module that declared it — not the entry's.
+      const scope = moduleAliasScope(resource.metadata, this.ctx.aliases, this.ctx.aliasesByModule);
+      const canonical = scope.resolveKind(kindValue) ?? kindValue;
+      const dot = canonical.indexOf(".");
+      const owningModule = dot === -1 ? undefined : canonical.slice(0, dot);
+      const suffix = canonical.slice(dot + 1);
+      // Matched by MODULE AND NAME once the canonical form carries a module: a
+      // definition name is unique inside its module and not across a flattened
+      // set, so two libraries each declaring an `Api` would otherwise resolve to
+      // whichever came first — and the editor would type a context region off the
+      // wrong kind's annotations, silently. Falls back to name alone only when the
+      // kind did not resolve to a canonical form, where there is nothing to narrow
+      // by and a best-effort match is still better than none.
+      const named = this.manifests.filter(
         (m) =>
           (m.kind === "Telo.Definition" || m.kind === "Telo.Abstract") &&
           (m.metadata as { name?: string } | undefined)?.name === suffix,
-      ) as Record<string, any> | undefined;
+      ) as Record<string, any>[];
+      const target =
+        (owningModule
+          ? named.find((m) => (m.metadata as { module?: string } | undefined)?.module === owningModule)
+          : undefined) ?? (owningModule && named.length > 1 ? undefined : named[0]);
       if (!target) return undefined;
       return { manifest: target, path: first.slice(hash + 1), propertyMap: false };
     }
@@ -313,9 +341,18 @@ export class CelScopeQuery {
     return undefined;
   }
 
+  /** The kind's declaration, resolved in the scope of the module that DECLARED
+   *  this resource — the same rule the manifest visitor applies, and the reason
+   *  it has to be the same one: everything this query offers is read off the
+   *  definition, so resolving a forwarded library resource's `kind: Http.Api`
+   *  through the entry's aliases alone found nothing and the editor silently
+   *  offered no `request` / `result` at a site `telo check` accepts. A
+   *  completion list is a claim that the name it offers will pass the checker,
+   *  so the two must resolve a kind identically. */
   private definitionFor(resource: ResourceManifest): ResourceDefinition | undefined {
-    const { defs, aliases } = this.ctx;
-    const canonical = aliases.resolveKind(resource.kind);
+    const { defs, aliases, aliasesByModule } = this.ctx;
+    const scope = moduleAliasScope(resource.metadata, aliases, aliasesByModule);
+    const canonical = scope.resolveKind(resource.kind);
     return defs.resolve(resource.kind) ?? (canonical ? defs.resolve(canonical) : undefined);
   }