@telorun/analyzer 0.69.0 → 0.71.0

package/src/resolve-throws-union.ts

@@ -1,6 +1,8 @@
 import type { ResourceDefinition, ResourceManifest } from "@telorun/sdk";
 import { isTaggedSentinel } from "@telorun/templating";
 import { scopeResolverForModule, type AliasResolver } from "./alias-resolver.js";
+import { resolveScopedName } from "./call-graph.js";
+import { refSentinelTarget, type RefSentinelTarget } from "./ref-sentinel-target.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
 import { readStepSlot } from "./step-slot.js";
 
@@ -40,6 +42,23 @@ export interface ResolveCtx {
   aliasesByModule: Map<string, AliasResolver>;
   /** The consumer/root module names; resources owned by these resolve against `aliases`. */
   rootModules: Set<string>;
+  /**
+   * Every imported library's FULL manifest list, keyed by module name.
+   *
+   * A consumer's flat set holds a library's EXPORTED instances and nothing else,
+   * so the siblings an exported entry point invokes are not in it. Without this
+   * the walk stops at the first such hop, and the difference is not academic: a
+   * library whose entry point raises its own code through an internal guard
+   * presented an empty union to its consumer, which then had its `catches:`
+   * rejected for the very code the entry point documents.
+   *
+   * Consulted only as a FALLBACK, after the flat set — the flat set is what the
+   * consumer's own resources resolve against, and a library-internal name must
+   * never shadow one of them.
+   */
+  moduleManifests: Map<string, ResourceManifest[]>;
+  /** Keyed `<module>\0<name>`: resource names are module-scoped, so two
+   *  libraries each declaring a `query` are two different unions. */
   memo: Map<string, ThrowsUnion>;
   inProgress: Set<string>;
 }
@@ -50,6 +69,7 @@ export function createResolveCtx(
   aliases: AliasResolver,
   aliasesByModule: Map<string, AliasResolver> = new Map(),
   rootModules: Set<string> = new Set(),
+  moduleManifests: Map<string, ResourceManifest[]> = new Map(),
 ): ResolveCtx {
   return {
     allManifests,
@@ -57,11 +77,90 @@ export function createResolveCtx(
     aliases,
     aliasesByModule,
     rootModules,
+    moduleManifests,
     memo: new Map(),
     inProgress: new Set(),
   };
 }
 
+/**
+ * A dispatch target named by a resolved `{kind, name}` ref.
+ *
+ * The flat set is the scope such a ref was resolved in, so it is asked first;
+ * the owning library's own documents are the fallback for a name the flattened
+ * view dropped. `kindMatches` applies to BOTH — one function, one rule, or the
+ * next caller inherits whichever half it happened to hit.
+ */
+function findTarget(
+  ctx: ResolveCtx,
+  name: string,
+  ownerModule: string | undefined,
+  kindMatches: (m: ResourceManifest) => boolean,
+): ResourceManifest | undefined {
+  const flat = ctx.allManifests.find((m) => m.metadata?.name === name && kindMatches(m));
+  if (flat) return flat;
+  if (!ownerModule) return undefined;
+  return ctx.moduleManifests
+    .get(ownerModule)
+    ?.find((m) => m.metadata?.name === name && kindMatches(m));
+}
+
+/**
+ * The target of a `!ref` that still carries its sentinel — a library-internal
+ * reference inside a manifest forwarded into a consumer's flat set, where Phase
+ * 2.5 had nothing to resolve it against.
+ *
+ * **The declaring library is asked FIRST**, and that ordering is the whole rule:
+ * a bare name in a library manifest is unambiguously library-internal, so
+ * searching the consumer's flat set first let any consumer resource that
+ * happened to share the name supply another library's throw union — the same
+ * false `{∅}` this branch exists to remove, arrived at from the other side.
+ *
+ * An ALIAS-qualified source is the cross-module case and is resolved through the
+ * declaring module's own alias table, never by dropping the alias and matching
+ * the bare name anywhere.
+ *
+ * Ambiguity resolves to NOTHING rather than to a guess (`resolveScopedName`'s
+ * rule), and the caller reads that as unbounded — the safe direction here, since
+ * a union that cannot be enumerated must not read as empty.
+ */
+function findSentinelTarget(
+  ctx: ResolveCtx,
+  target: RefSentinelTarget,
+  ownerModule: string | undefined,
+): ResourceManifest | undefined {
+  const named = (pool: readonly ResourceManifest[] | undefined): ResourceManifest[] =>
+    (pool ?? []).filter((m) => m.metadata?.name === target.name);
+
+  if (target.alias !== undefined && target.alias !== "Self") {
+    // A forwarded export: its module is whatever the DECLARING module aliases
+    // that prefix to, and it keeps its export name in the flat set.
+    // A root-owned manifest resolves aliases against the global table, which is
+    // what `scopeResolverForModule` returns undefined for — so fall back to it
+    // rather than reading a root's own alias as unresolvable.
+    const resolver = scopeResolverFor(ctx, ownerModule) ?? ctx.aliases;
+    const module = resolver.moduleForAlias(target.alias);
+    if (!module) return undefined;
+    return named(ctx.allManifests).find((m) => declaringModuleOf(m) === module);
+  }
+
+  const own = named(ctx.moduleManifests.get(ownerModule ?? ""));
+  if (own.length === 1) return own[0];
+  if (own.length > 1) return undefined;
+  return resolveScopedName(named(ctx.allManifests), declaringModuleOf, ownerModule);
+}
+
+const declaringModuleOf = (m: ResourceManifest): string | undefined =>
+  (m.metadata as { module?: string } | undefined)?.module;
+
+/** Memo key. Module-scoped, because resource names are. */
+function memoKey(manifest: ResourceManifest): string | undefined {
+  const name = manifest.metadata?.name as string | undefined;
+  if (!name) return undefined;
+  const mod = (manifest.metadata as { module?: string } | undefined)?.module ?? "";
+  return `${mod}\0${name}`;
+}
+
 function emptyUnion(): ThrowsUnion {
   return { codes: new Map(), unbounded: false };
 }
@@ -114,7 +213,7 @@ export function resolveThrowsUnion(
   manifest: ResourceManifest,
   ctx: ResolveCtx,
 ): ThrowsUnion {
-  const name = manifest.metadata?.name as string | undefined;
+  const name = memoKey(manifest);
 
   if (name) {
     const cached = ctx.memo.get(name);
@@ -314,7 +413,21 @@ function resolveStepInvokeThrows(
   const invokeRef = step[invokeField];
   if (!invokeRef || typeof invokeRef !== "object") return emptyUnion();
   const invokedKind = invokeRef.kind as string | undefined;
-  if (!invokedKind) return emptyUnion();
+  // A reference that still carries its parse-time sentinel — a library-internal
+  // `!ref` inside a manifest forwarded into a consumer's flat set, where Phase
+  // 2.5 had nothing to resolve it against. The target is in the declaring
+  // library's own documents, so it is looked up there; only a name that is not
+  // there either is UNKNOWN, which is unbounded rather than empty. Reading it as
+  // empty is what made a library's exported entry point present a `{∅}` union to
+  // its consumer and get the consumer's `catches:` rejected for the code the
+  // entry point documents.
+  if (!invokedKind) {
+    const sentinel = refSentinelTarget(invokeRef);
+    if (!sentinel) return emptyUnion();
+    const target = findSentinelTarget(ctx, sentinel, ownerModule);
+    if (target) return resolveThrowsUnion(target, ctx);
+    return { codes: new Map(), unbounded: true };
+  }
 
   // The invoked kind's alias resolves in the OWNER manifest's lexical scope (the
   // composer that declares the step), so a library's step referencing its own
@@ -331,13 +444,15 @@ function resolveStepInvokeThrows(
   const invokeName = invokeRef.name as string | undefined;
   if (invokeName) {
     const scopedInvokedKind = scopeResolver?.resolveKind(invokedKind);
-    const target = ctx.allManifests.find(
+    const target = findTarget(
+      ctx,
+      invokeName,
+      ownerModule,
       (m) =>
-        m.metadata?.name === invokeName &&
-        (m.kind === invokedKind ||
-          ctx.aliases.resolveKind(m.kind) === invokedKind ||
-          m.kind === ctx.aliases.resolveKind(invokedKind) ||
-          (scopedInvokedKind !== undefined && m.kind === scopedInvokedKind)),
+        m.kind === invokedKind ||
+        ctx.aliases.resolveKind(m.kind) === invokedKind ||
+        m.kind === ctx.aliases.resolveKind(invokedKind) ||
+        (scopedInvokedKind !== undefined && m.kind === scopedInvokedKind),
     );
     if (target) return resolveThrowsUnion(target, ctx);
   }

package/src/resolve-zone-requirements.ts

@@ -14,7 +14,7 @@
  * Browser-safe: no Node built-ins.
  */
 import type { ResourceDefinition, ResourceManifest } from "@telorun/sdk";
-import { isRefSentinel } from "@telorun/templating";
+import { refSentinelTarget } from "./ref-sentinel-target.js";
 import type { AliasResolver } from "./alias-resolver.js";
 import {
   buildCallGraph,
@@ -28,9 +28,10 @@ import {
   propertySchemas,
   resolveLocalRef,
 } from "./manifest-navigation.js";
-import type { ZoneModuleDocuments } from "./zone-module-documents.js";
+import type { ModuleDocuments } from "./module-documents.js";
 import { readProvidesZone, readRequiresZone } from "./zone-slot.js";
 import { DiagnosticSeverity, type AnalysisDiagnostic } from "./types.js";
+import { moduleAliasScope } from "./module-alias-scope.js";
 
 const SOURCE = "telo-analyzer";
 
@@ -125,7 +126,7 @@ function definitionResolver(
   aliasesByModule: Map<string, AliasResolver>,
 ) {
   return (kind: string, module?: string): ResourceDefinition | undefined => {
-    const scope = (module ? aliasesByModule.get(module) : undefined) ?? aliases;
+    const scope = moduleAliasScope({ module }, aliases, aliasesByModule);
     const canonical = scope.resolveKind(kind);
     return defs.resolve(kind) ?? (canonical ? defs.resolve(canonical) : undefined);
   };
@@ -193,17 +194,16 @@ function schemaNodeAt(
  * under-approximating direction the whole pass leans on. `Self.` is a local
  * name written the long way and does resolve.
  *
- * This deliberately differs from `call-graph`'s `refTargetName`, which answers a
- * different question (what an EDGE points at, cross-module included, for a graph
- * whose consumers tolerate an unresolved target) — hence two functions rather
- * than one shared helper.
+ * This is this pass's REDUCTION over the shared `refSentinelTarget` parse, not a
+ * second reading of the tag: `call-graph`'s answers a different question (what
+ * an EDGE points at, cross-module included, for a graph whose consumers tolerate
+ * an unresolved target) and states its own reduction the same way.
  */
 function refName(value: unknown): string | undefined {
-  if (isRefSentinel(value)) {
-    const source = value.source;
-    const dot = source.indexOf(".");
-    if (dot <= 0) return source;
-    return source.slice(0, dot) === "Self" ? source.slice(dot + 1) : undefined;
+  const sentinel = refSentinelTarget(value);
+  if (sentinel) {
+    if (sentinel.alias === undefined) return sentinel.name;
+    return sentinel.alias === "Self" ? sentinel.name : undefined;
   }
   if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
   const v = value as Record<string, unknown>;
@@ -712,7 +712,7 @@ export function zoneDocumentsSignature(manifests: readonly ResourceManifest[]):
  * the projection derive-only, and keep what reaches an exported instance.
  */
 export function deriveLibraryExportRequirements(
-  docs: ZoneModuleDocuments,
+  docs: ModuleDocuments,
   defs: DefinitionRegistry,
   aliases: AliasResolver,
   aliasesByModule: Map<string, AliasResolver>,
@@ -745,7 +745,7 @@ export interface ZoneAnalysisArgs {
   aliases: AliasResolver;
   aliasesByModule: Map<string, AliasResolver>;
   rootModules: ReadonlySet<string>;
-  moduleDocuments?: readonly ZoneModuleDocuments[];
+  moduleDocuments?: readonly ModuleDocuments[];
   cache?: ZoneExportCache;
 }
 

package/src/telo-version.ts

@@ -6,4 +6,4 @@
 // written against, and every kernel in every language reports the same scale.
 
 /** The surface generation this analyzer implements. */
-export const TELO_SURFACE_VERSION = "0.85.0";
+export const TELO_SURFACE_VERSION = "0.87.0";

package/src/template-body.ts

@@ -2,6 +2,7 @@ import type { ResourceDefinition, ResourceManifest } from "@telorun/sdk";
 import type { AliasResolver } from "./alias-resolver.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
 import type { ModuleScopes } from "./alias-resolver.js";
+import { moduleAliasScope } from "./module-alias-scope.js";
 
 /**
  * A `Telo.Definition`'s `resources:` entries — the bodies a kind writes for
@@ -47,11 +48,7 @@ export function templateBodies(
   // A nested kind is written through the alias scope of the module that DECLARED
   // the definition, never the consumer's — the same rule every other kind
   // resolution in a forwarded manifest follows.
-  const ownModule = (m.metadata as { module?: string } | undefined)?.module;
-  const scope =
-    (ownModule && scopes && !scopes.rootModules.has(ownModule)
-      ? scopes.aliasesByModule.get(ownModule)
-      : undefined) ?? aliases;
+  const scope = moduleAliasScope(m.metadata, aliases, scopes?.aliasesByModule);
 
   const out: TemplateBody[] = [];
   for (let i = 0; i < bodies.length; i++) {

package/src/types.ts

@@ -1,6 +1,6 @@
 import type { HostVersions } from "./requires-block.js";
 
-import type { ZoneModuleDocuments } from "./zone-module-documents.js";
+import type { ModuleDocuments } from "./module-documents.js";
 /** Matches LSP DiagnosticSeverity values exactly.
  *  https://microsoft.github.io/language-server-protocol/specifications/lsp/3.17/specification/#diagnosticSeverity */
 export const DiagnosticSeverity = {
@@ -142,10 +142,10 @@ export interface AnalysisOptions {
   /** Imported libraries' FULL document sets, for the zone stage's per-library
    *  export derivation — the flattened analysis view forwards only each
    *  library's export surface, never its internal dispatch chain. Collected
-   *  from a LoadedGraph via `collectZoneModuleDocuments`. Omitting it skips
+   *  from a LoadedGraph via `collectModuleDocuments`. Omitting it skips
    *  the derivation (the under-approximating direction — the runtime check
    *  remains the enforcement). */
-  moduleDocuments?: ZoneModuleDocuments[];
+  moduleDocuments?: ModuleDocuments[];
   /** When true, `analyze()` runs the state-mutating setup (module identity /
    *  alias / definition registration plus `normalizeInlineResources`) but
    *  skips every diagnostic-producing pass — per-resource validation, the

package/src/validate-invocation-contract.ts

@@ -2,13 +2,17 @@ import type { ResourceDefinition, ResourceManifest } from "@telorun/sdk";
 import type { AliasResolver } from "./alias-resolver.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
 import {
+  ancestorChain,
   type ContractDirection,
   type DefResolver,
   effectiveContractField,
   mappingFieldFor,
   needsContractMapping,
 } from "./extends-resolution.js";
+import { resolveTypeFieldToSchema } from "./validate-cel-context.js";
+import { moduleAliasScope } from "./module-alias-scope.js";
 import { buildReferenceFieldMap, isRefEntry } from "./reference-field-map.js";
+import { checkSchemaCompatibility } from "./schema-compat.js";
 import { DiagnosticSeverity, type AnalysisDiagnostic } from "./types.js";
 
 const SOURCE = "telo-analyzer";
@@ -29,6 +33,11 @@ const SOURCE = "telo-analyzer";
  *    whose input contract is now `inputType:`.
  *  - CONTRACT_TYPE_NOT_FOUND: a contract names a type that is not declared in
  *    scope, so every call through it would fail at dispatch.
+ *  - CONTRACT_NOT_SUBSTITUTABLE: a definition replaces an ancestor's contract
+ *    with a shape that cannot stand in for it. The one check nothing else makes:
+ *    contracts resolve to the nearest declaration in BOTH halves, so a child that
+ *    declares its own is compared against its abstract by neither the analyzer
+ *    nor dispatch.
  *
  * Deliberately NOT diagnosed: an input that is neither `required:` nor
  * defaulted. It is indistinguishable from a genuinely optional one — `Ai.Text`
@@ -45,8 +54,7 @@ export function validateInvocationContract(
 ): AnalysisDiagnostic[] {
   const diagnostics: AnalysisDiagnostic[] = [];
   const resolveDef: DefResolver = (kind, from) => {
-    const module = (from?.metadata as { module?: string } | undefined)?.module;
-    const scope = (module ? aliasesByModule.get(module) : undefined) ?? aliases;
+    const scope = moduleAliasScope(from?.metadata, aliases, aliasesByModule);
     return registry.resolve(kind) ?? registry.resolve(scope.resolveKind(kind) ?? kind);
   };
 
@@ -73,6 +81,7 @@ export function validateInvocationContract(
     if (m.kind === "Telo.Definition" || m.kind === "Telo.Abstract") {
       checkMappingRequired(m, resource, filePath, resolveDef, diagnostics);
       checkContractResolves(m, md, manifests, resource, filePath, diagnostics);
+      checkAncestorSubstitutability(m, md, manifests, resource, filePath, resolveDef, diagnostics);
       continue;
     }
 
@@ -360,6 +369,123 @@ function namedTypeReference(value: unknown): string | undefined {
   return typeof ref.name === "string" ? ref.name : undefined;
 }
 
+/**
+ * A REPLACING CONTRACT MUST STILL STAND IN FOR THE ONE IT REPLACES.
+ *
+ * Contracts resolve to the NEAREST declaration and never merge, which is right —
+ * a call signature is not additive, and a backend narrowing `status` to the
+ * states it actually has could not express that through a merge. But the
+ * consequence is that an abstract's contract binds only the children that
+ * declare none of their own: a child that declares one is checked against
+ * nothing, statically or at dispatch, since `resolveBoundContract` stops at the
+ * same nearest declaration. So an abstract could state a floor every
+ * implementation must answer with (`Durable.Run`'s `runId` / `status`, the
+ * identity every later question about a run is asked by) and have that floor hold
+ * for exactly the implementations that declared nothing — while the real ones,
+ * which all declare their own, escaped it. A slot typed by the abstract would
+ * then be typed by a promise nothing kept.
+ *
+ * The rule is substitutability, and its direction differs per contract because
+ * one is produced and the other consumed:
+ *
+ *  - `outputType` is COVARIANT — a consumer written against the ancestor reads
+ *    the ancestor's shape, so the child's output must be acceptable where the
+ *    ancestor's is declared. Dropping a required property is what breaks it.
+ *  - `inputType` is CONTRAVARIANT — a caller written against the ancestor sends
+ *    the ancestor's shape, so the ancestor's input must be acceptable where the
+ *    child's is declared. Requiring an input the ancestor never mentions is what
+ *    breaks it: no such caller could satisfy it.
+ *
+ * **Only an ABSTRACT ancestor's contract is a contract**, and that narrowing is a
+ * decision rather than an oversight. Extending a CONCRETE kind is how a friendlier
+ * schema is put over an existing controller — `base:` reshapes its config and
+ * `inputs:` / `result:` translate its call signature — so a child there is
+ * SUPPOSED to present different inputs, and demanding substitutability would
+ * reject the pattern the standard library and every custom-kind example are built
+ * on. An abstract has no implementation to reshape: extending one is a claim to
+ * BE the thing, its contract is written for implementors, and a slot typed by it
+ * is polymorphic by construction — which is exactly where an unkept promise has
+ * nowhere to be caught.
+ *
+ * A direction the child BRIDGES (`inputs:` for inputs, `result:` for outputs) is
+ * skipped for the same reason one hop down: the mapping is the author saying the
+ * shapes differ deliberately and are translated.
+ *
+ * The comparison is {@link checkSchemaCompatibility}, which reports only DEFINITE
+ * mismatches — a union, an absent `type`, an undeclared argument all read as
+ * compatible — so narrowing a value's type, adding an optional property or
+ * restricting an enum stays legal, which is the whole point of letting a child
+ * replace the contract at all.
+ */
+function checkAncestorSubstitutability(
+  m: ResourceManifest,
+  md: Record<string, unknown>,
+  manifests: ResourceManifest[],
+  resource: { kind: string; name: string },
+  filePath: string | undefined,
+  resolveDef: DefResolver,
+  diagnostics: AnalysisDiagnostic[],
+): void {
+  const def = m as unknown as ResourceDefinition;
+
+  for (const direction of ["inputType", "outputType"] as ContractDirection[]) {
+    const own = md[direction];
+    if (own === undefined || own === null) continue;
+    // A declared bridge says the shapes differ on purpose and are translated.
+    if (md[mappingFieldFor(direction)] != null) continue;
+
+    // The nearest ANCESTOR that declares it — the contract this one replaces.
+    // Walking past self is the whole question: `contractDeclarer` would answer
+    // "this one", which is what nothing checks.
+    const ancestor = ancestorChain(def, resolveDef).find((a) => {
+      const inherited = (a as unknown as Record<string, unknown>)[direction];
+      return inherited !== undefined && inherited !== null;
+    });
+    if (!ancestor || ancestor.kind !== "Telo.Abstract") continue;
+    const inherited = (ancestor as unknown as Record<string, unknown>)[direction];
+
+    // The WHOLE manifest set, which is what `analyzerContractScope`'s
+    // `typeManifestsFor` hands `resolveContract` — so this resolves a named type
+    // exactly as the resolver the kernel binds with does. Filtering to the
+    // declaring module looked more careful and was strictly worse: a contract
+    // naming a shape from a shared module resolved to nothing, and an
+    // unresolvable side is skipped, so the check silently switched itself off for
+    // precisely the libraries that factor their shapes out. Nothing else caught
+    // it either — `CONTRACT_TYPE_NOT_FOUND` finds the type through its own global
+    // fallback, so such a kind passed `telo check` with no diagnostic at all.
+    const ownSchema = resolveTypeFieldToSchema(own, manifests);
+    const ancestorSchema = resolveTypeFieldToSchema(inherited, manifests);
+    // An unresolvable side says nothing about compatibility; CONTRACT_TYPE_NOT_FOUND
+    // is what reports a contract that names a type nothing declares.
+    if (!ownSchema || !ancestorSchema) continue;
+
+    const { compatible, issues } =
+      direction === "outputType"
+        ? checkSchemaCompatibility(ownSchema, ancestorSchema)
+        : checkSchemaCompatibility(ancestorSchema, ownSchema);
+    if (compatible) continue;
+
+    const ancestorName = `${(ancestor.metadata as { module?: string } | undefined)?.module ?? ""}.${
+      ancestor.metadata?.name ?? "?"
+    }`.replace(/^\./, "");
+    const why =
+      direction === "outputType"
+        ? `every caller that holds this through '${ancestorName}' reads the shape that kind declares`
+        : `a caller that holds this through '${ancestorName}' sends the shape that kind declares`;
+    diagnostics.push({
+      severity: DiagnosticSeverity.Error,
+      code: "CONTRACT_NOT_SUBSTITUTABLE",
+      source: SOURCE,
+      message:
+        `${m.kind}/${resource.name}: \`${direction}\` replaces the one declared by '${ancestorName}' ` +
+        `with a shape that cannot stand in for it — ${issues.join("; ")}. Contracts replace rather ` +
+        `than merge, so nothing re-checks this at dispatch: ${why}. Restate the fields ` +
+        `'${ancestorName}' declares, or drop \`${direction}\` to inherit the contract unchanged.`,
+      data: { resource, filePath, path: direction },
+    });
+  }
+}
+
 /** A child that inherits its controller and REPLACES a contract must bridge it:
  *  contracts resolve to the nearest declaration and never merge, so the
  *  inherited controller only understands its own shape. Without the mapping the

package/src/validate-logging.ts

@@ -3,6 +3,7 @@ import type { AliasResolver } from "./alias-resolver.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
 import { parseRedactionPath, RedactionPathError } from "./redaction-path.js";
 import { DiagnosticSeverity, type AnalysisDiagnostic } from "./types.js";
+import { moduleAliasScope } from "./module-alias-scope.js";
 
 const SOURCE = "telo-analyzer";
 
@@ -124,9 +125,7 @@ function isSinkKind(
 ): boolean {
   if (typeof manifest.kind !== "string") return false;
   if (manifest.kind === "Telo.ConsoleSink" || manifest.kind === "Telo.FileSink") return true;
-  const ownModule = (manifest.metadata as { module?: string } | undefined)?.module;
-  const resolver =
-    (ownModule ? aliasesByModule?.get(ownModule) : undefined) ?? aliases;
+  const resolver = moduleAliasScope(manifest.metadata, aliases, aliasesByModule);
   const canonical = resolver.resolveKind(manifest.kind) ?? manifest.kind;
   return registry.resolve(canonical)?.capability === "Telo.Sink";
 }

package/src/validate-references.ts

@@ -14,6 +14,8 @@ import { resolveTypeFieldToSchema } from "./validate-cel-context.js";
 import { DiagnosticSeverity, type AnalysisDiagnostic, type AnalysisContext } from "./types.js";
 import type { AliasResolver } from "./alias-resolver.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
+import { moduleAliasScope } from "./module-alias-scope.js";
+import { isInjectedDeclaration } from "./resource-input.js";
 
 const SOURCE = "telo-analyzer";
 
@@ -27,20 +29,31 @@ const SOURCE = "telo-analyzer";
  *
  * A value satisfies the slot when it transitively extends the target kind, or —
  * for a CONCRETE target — IS that kind; `getByExtends` is the same transitive
- * subtype index for both, and an abstract is satisfied only by an implementer,
- * never by the abstract itself (which is non-instantiable). Accepts a constraint
- * that resolves to nothing, and an abstract with no loaded implementations:
- * partial context, where a rejection would be a guess.
+ * subtype index for both. Accepts a constraint that resolves to nothing, and an
+ * abstract with no loaded implementations: partial context, where a rejection
+ * would be a guess.
+ *
+ * An abstract is satisfied only by an implementer, never by the abstract itself,
+ * because a resource declared `kind: <some abstract>` is refused at `create()`
+ * and reported as `ABSTRACT_KIND_INSTANTIATED` at its declaration — so accepting
+ * it here would leave the reference sites silent about a manifest that cannot
+ * run. `isDeclaration` is the ONE exception and it is not an instance: a
+ * library's `resources:` entry is constrained by kind alone, so its kind-only
+ * stand-in routinely IS an abstract (`connection: {kind: Sql.Connection}`), and
+ * every use of that name inside the library is a reference to it.
  */
 export function kindSatisfies(
   resolved: string,
   targetKind: string,
   registry: DefinitionRegistry,
+  /** The referent is a kind-only stand-in for a `resources:` entry rather than a
+   *  resource anything instantiates, so identity satisfies an abstract slot. */
+  isDeclaration = false,
 ): boolean {
   const canonical = registry.resolveRef(targetKind) ?? targetKind;
   const targetDef = registry.resolve(canonical);
   if (!targetDef) return true;
-  if (targetDef.kind !== "Telo.Abstract" && resolved === canonical) return true;
+  if ((targetDef.kind !== "Telo.Abstract" || isDeclaration) && resolved === canonical) return true;
   const subtypes = registry.getByExtends(canonical);
   if (subtypes.some((d) => `${d.metadata.module}.${d.metadata.name}` === resolved)) return true;
   // Leniency is about the CANDIDATE, not about the population, and it is the
@@ -70,6 +83,8 @@ function checkKind(
   entry: RefFieldEntry,
   registry: DefinitionRegistry,
   aliases: AliasResolver,
+  /** See {@link kindSatisfies}: the referent is a `resources:` stand-in. */
+  isDeclaration = false,
 ): string[] {
   const resolved = aliases.resolveKind(kind) ?? kind;
   // A qualified kind whose prefix names no import in this scope is a bad NAME
@@ -92,7 +107,7 @@ function checkKind(
     if (!targetKind) return [];
     const targetDef = registry.resolve(targetKind);
     if (!targetDef) return [];
-    if (!unknownAlias && kindSatisfies(resolved, targetKind, registry)) return [];
+    if (!unknownAlias && kindSatisfies(resolved, targetKind, registry, isDeclaration)) return [];
     const subtypes = registry.getByExtends(targetKind);
     const subtypeKinds = new Set(subtypes.map((d) => `${d.metadata.module}.${d.metadata.name}`));
     if (targetDef.kind === "Telo.Abstract") {
@@ -335,7 +350,13 @@ export function validateReferences(
             });
             return;
           }
-          const kindErrors = checkKind(target.kind as string, entry, registry, aliases);
+          const kindErrors = checkKind(
+            target.kind as string,
+            entry,
+            registry,
+            aliases,
+            isInjectedDeclaration(target),
+          );
           if (kindErrors.length > 0) {
             diagnostics.push({
               severity: DiagnosticSeverity.Error,
@@ -385,7 +406,18 @@ export function validateReferences(
         }
 
         // 2. Kind check
-        const kindErrors = checkKind(refVal.kind, entry, registry, aliases);
+        const objectTarget =
+          typeof refVal.name === "string"
+            ? (visibleScopeManifests.find((m) => m.metadata?.name === refVal.name) ??
+              byName.get(refVal.name))
+            : undefined;
+        const kindErrors = checkKind(
+          refVal.kind,
+          entry,
+          registry,
+          aliases,
+          isInjectedDeclaration(objectTarget),
+        );
         if (kindErrors.length > 0) {
           diagnostics.push({
             severity: DiagnosticSeverity.Error,
@@ -484,9 +516,7 @@ export function validateReferences(
           const resolvedResourceKind = aliases.resolveKind(r.kind) ?? r.kind;
           const resourceDef =
             registry.resolve(r.kind) ?? registry.resolve(resolvedResourceKind);
-          const owningModule = (resourceDef?.metadata as { module?: string } | undefined)?.module;
-          const ownerScope =
-            (owningModule ? aliasesByModule?.get(owningModule) : undefined) ?? aliases;
+          const ownerScope = moduleAliasScope(resourceDef?.metadata, aliases, aliasesByModule);
 
           const targetKind = ownerScope.resolveKind(anchorName);
           if (!targetKind) {

package/src/validate-resource-inputs.ts

@@ -3,7 +3,11 @@ import { isRefSentinel } from "@telorun/templating";
 import type { AliasResolver } from "./alias-resolver.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
 import { findDynamicLeaf } from "./resource-rule.js";
-import { readResourceInputs, readSuppliedResources } from "./resource-input.js";
+import {
+  isInjectedDeclaration,
+  readResourceInputs,
+  readSuppliedResources,
+} from "./resource-input.js";
 import { type AnalysisDiagnostic, DiagnosticSeverity } from "./types.js";
 
 const SOURCE = "telo-analyzer";
@@ -38,6 +42,9 @@ type RequiredResources = Record<string, string>;
  *
  * Browser-safe.
  */
+const declaringModule = (m: ResourceManifest): string | undefined =>
+  (m.metadata as { module?: string } | undefined)?.module;
+
 export function validateResourceInputs(
   manifests: ResourceManifest[],
   registry: DefinitionRegistry,
@@ -46,7 +53,11 @@ export function validateResourceInputs(
   /** Kind acceptance, transitively — the `checkKind` rule `validate-references`
    *  applies at an ordinary ref slot, passed in rather than re-derived so the
    *  two cannot disagree about what satisfies a constraint. */
-  acceptsKind: (suppliedKind: string, requiredKind: string) => boolean,
+  acceptsKind: (
+    suppliedKind: string,
+    requiredKind: string,
+    suppliedIsDeclaration: boolean,
+  ) => boolean,
 ): AnalysisDiagnostic[] {
   const out: AnalysisDiagnostic[] = [];
 
@@ -220,7 +231,19 @@ export function validateResourceInputs(
       const suppliedKind = (value as { kind?: unknown }).kind;
       if (typeof suppliedKind !== "string") continue;
       const canonical = aliases.resolveKind(suppliedKind) ?? suppliedKind;
-      if (acceptsKind(canonical, entry)) continue;
+      // A library forwarding an input it was itself handed supplies a kind-only
+      // stand-in, whose kind is routinely the abstract the target declares. That
+      // is identity against an abstract, which an ordinary reference is refused
+      // — the referent there would be a resource nothing can instantiate, while
+      // here it is another declaration.
+      const suppliedName = (value as { name?: unknown }).name;
+      const supplied =
+        typeof suppliedName === "string"
+          ? manifests.find(
+              (c) => c.metadata?.name === suppliedName && isOwn(declaringModule(c)),
+            )
+          : undefined;
+      if (acceptsKind(canonical, entry, isInjectedDeclaration(supplied))) continue;
       out.push({
         severity: DiagnosticSeverity.Error,
         code: "RESOURCE_INPUT_KIND_MISMATCH",