@telorun/analyzer 0.70.0 → 0.71.0

package/dist/validate-invocation-contract.js

@@ -1,5 +1,8 @@
-import { effectiveContractField, mappingFieldFor, needsContractMapping, } from "./extends-resolution.js";
+import { ancestorChain, effectiveContractField, mappingFieldFor, needsContractMapping, } from "./extends-resolution.js";
+import { resolveTypeFieldToSchema } from "./validate-cel-context.js";
+import { moduleAliasScope } from "./module-alias-scope.js";
 import { buildReferenceFieldMap, isRefEntry } from "./reference-field-map.js";
+import { checkSchemaCompatibility } from "./schema-compat.js";
 import { DiagnosticSeverity } from "./types.js";
 const SOURCE = "telo-analyzer";
 /**
@@ -18,6 +21,11 @@ const SOURCE = "telo-analyzer";
  *    whose input contract is now `inputType:`.
  *  - CONTRACT_TYPE_NOT_FOUND: a contract names a type that is not declared in
  *    scope, so every call through it would fail at dispatch.
+ *  - CONTRACT_NOT_SUBSTITUTABLE: a definition replaces an ancestor's contract
+ *    with a shape that cannot stand in for it. The one check nothing else makes:
+ *    contracts resolve to the nearest declaration in BOTH halves, so a child that
+ *    declares its own is compared against its abstract by neither the analyzer
+ *    nor dispatch.
  *
  * Deliberately NOT diagnosed: an input that is neither `required:` nor
  * defaulted. It is indistinguishable from a genuinely optional one — `Ai.Text`
@@ -29,8 +37,7 @@ const SOURCE = "telo-analyzer";
 export function validateInvocationContract(manifests, registry, aliases, aliasesByModule = new Map()) {
     const diagnostics = [];
     const resolveDef = (kind, from) => {
-        const module = from?.metadata?.module;
-        const scope = (module ? aliasesByModule.get(module) : undefined) ?? aliases;
+        const scope = moduleAliasScope(from?.metadata, aliases, aliasesByModule);
         return registry.resolve(kind) ?? registry.resolve(scope.resolveKind(kind) ?? kind);
     };
     // A published dependency's declarations are not the consumer's to fix.
@@ -58,6 +65,7 @@ export function validateInvocationContract(manifests, registry, aliases, aliases
         if (m.kind === "Telo.Definition" || m.kind === "Telo.Abstract") {
             checkMappingRequired(m, resource, filePath, resolveDef, diagnostics);
             checkContractResolves(m, md, manifests, resource, filePath, diagnostics);
+            checkAncestorSubstitutability(m, md, manifests, resource, filePath, resolveDef, diagnostics);
             continue;
         }
         // A RESOURCE (an instance of some kind) — a leftover `inputs:` map is only
@@ -318,6 +326,109 @@ function namedTypeReference(value) {
         return undefined;
     return typeof ref.name === "string" ? ref.name : undefined;
 }
+/**
+ * A REPLACING CONTRACT MUST STILL STAND IN FOR THE ONE IT REPLACES.
+ *
+ * Contracts resolve to the NEAREST declaration and never merge, which is right —
+ * a call signature is not additive, and a backend narrowing `status` to the
+ * states it actually has could not express that through a merge. But the
+ * consequence is that an abstract's contract binds only the children that
+ * declare none of their own: a child that declares one is checked against
+ * nothing, statically or at dispatch, since `resolveBoundContract` stops at the
+ * same nearest declaration. So an abstract could state a floor every
+ * implementation must answer with (`Durable.Run`'s `runId` / `status`, the
+ * identity every later question about a run is asked by) and have that floor hold
+ * for exactly the implementations that declared nothing — while the real ones,
+ * which all declare their own, escaped it. A slot typed by the abstract would
+ * then be typed by a promise nothing kept.
+ *
+ * The rule is substitutability, and its direction differs per contract because
+ * one is produced and the other consumed:
+ *
+ *  - `outputType` is COVARIANT — a consumer written against the ancestor reads
+ *    the ancestor's shape, so the child's output must be acceptable where the
+ *    ancestor's is declared. Dropping a required property is what breaks it.
+ *  - `inputType` is CONTRAVARIANT — a caller written against the ancestor sends
+ *    the ancestor's shape, so the ancestor's input must be acceptable where the
+ *    child's is declared. Requiring an input the ancestor never mentions is what
+ *    breaks it: no such caller could satisfy it.
+ *
+ * **Only an ABSTRACT ancestor's contract is a contract**, and that narrowing is a
+ * decision rather than an oversight. Extending a CONCRETE kind is how a friendlier
+ * schema is put over an existing controller — `base:` reshapes its config and
+ * `inputs:` / `result:` translate its call signature — so a child there is
+ * SUPPOSED to present different inputs, and demanding substitutability would
+ * reject the pattern the standard library and every custom-kind example are built
+ * on. An abstract has no implementation to reshape: extending one is a claim to
+ * BE the thing, its contract is written for implementors, and a slot typed by it
+ * is polymorphic by construction — which is exactly where an unkept promise has
+ * nowhere to be caught.
+ *
+ * A direction the child BRIDGES (`inputs:` for inputs, `result:` for outputs) is
+ * skipped for the same reason one hop down: the mapping is the author saying the
+ * shapes differ deliberately and are translated.
+ *
+ * The comparison is {@link checkSchemaCompatibility}, which reports only DEFINITE
+ * mismatches — a union, an absent `type`, an undeclared argument all read as
+ * compatible — so narrowing a value's type, adding an optional property or
+ * restricting an enum stays legal, which is the whole point of letting a child
+ * replace the contract at all.
+ */
+function checkAncestorSubstitutability(m, md, manifests, resource, filePath, resolveDef, diagnostics) {
+    const def = m;
+    for (const direction of ["inputType", "outputType"]) {
+        const own = md[direction];
+        if (own === undefined || own === null)
+            continue;
+        // A declared bridge says the shapes differ on purpose and are translated.
+        if (md[mappingFieldFor(direction)] != null)
+            continue;
+        // The nearest ANCESTOR that declares it — the contract this one replaces.
+        // Walking past self is the whole question: `contractDeclarer` would answer
+        // "this one", which is what nothing checks.
+        const ancestor = ancestorChain(def, resolveDef).find((a) => {
+            const inherited = a[direction];
+            return inherited !== undefined && inherited !== null;
+        });
+        if (!ancestor || ancestor.kind !== "Telo.Abstract")
+            continue;
+        const inherited = ancestor[direction];
+        // The WHOLE manifest set, which is what `analyzerContractScope`'s
+        // `typeManifestsFor` hands `resolveContract` — so this resolves a named type
+        // exactly as the resolver the kernel binds with does. Filtering to the
+        // declaring module looked more careful and was strictly worse: a contract
+        // naming a shape from a shared module resolved to nothing, and an
+        // unresolvable side is skipped, so the check silently switched itself off for
+        // precisely the libraries that factor their shapes out. Nothing else caught
+        // it either — `CONTRACT_TYPE_NOT_FOUND` finds the type through its own global
+        // fallback, so such a kind passed `telo check` with no diagnostic at all.
+        const ownSchema = resolveTypeFieldToSchema(own, manifests);
+        const ancestorSchema = resolveTypeFieldToSchema(inherited, manifests);
+        // An unresolvable side says nothing about compatibility; CONTRACT_TYPE_NOT_FOUND
+        // is what reports a contract that names a type nothing declares.
+        if (!ownSchema || !ancestorSchema)
+            continue;
+        const { compatible, issues } = direction === "outputType"
+            ? checkSchemaCompatibility(ownSchema, ancestorSchema)
+            : checkSchemaCompatibility(ancestorSchema, ownSchema);
+        if (compatible)
+            continue;
+        const ancestorName = `${ancestor.metadata?.module ?? ""}.${ancestor.metadata?.name ?? "?"}`.replace(/^\./, "");
+        const why = direction === "outputType"
+            ? `every caller that holds this through '${ancestorName}' reads the shape that kind declares`
+            : `a caller that holds this through '${ancestorName}' sends the shape that kind declares`;
+        diagnostics.push({
+            severity: DiagnosticSeverity.Error,
+            code: "CONTRACT_NOT_SUBSTITUTABLE",
+            source: SOURCE,
+            message: `${m.kind}/${resource.name}: \`${direction}\` replaces the one declared by '${ancestorName}' ` +
+                `with a shape that cannot stand in for it — ${issues.join("; ")}. Contracts replace rather ` +
+                `than merge, so nothing re-checks this at dispatch: ${why}. Restate the fields ` +
+                `'${ancestorName}' declares, or drop \`${direction}\` to inherit the contract unchanged.`,
+            data: { resource, filePath, path: direction },
+        });
+    }
+}
 /** A child that inherits its controller and REPLACES a contract must bridge it:
  *  contracts resolve to the nearest declaration and never merge, so the
  *  inherited controller only understands its own shape. Without the mapping the

package/dist/validate-logging.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-logging.d.ts","sourceRoot":"","sources":["../src/validate-logging.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,EACtB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC3C,kBAAkB,EAAE,CAqBtB"}
+{"version":3,"file":"validate-logging.d.ts","sourceRoot":"","sources":["../src/validate-logging.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAKzE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,EACtB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC3C,kBAAkB,EAAE,CAqBtB"}

package/dist/validate-logging.js

@@ -1,5 +1,6 @@
 import { parseRedactionPath, RedactionPathError } from "./redaction-path.js";
 import { DiagnosticSeverity } from "./types.js";
+import { moduleAliasScope } from "./module-alias-scope.js";
 const SOURCE = "telo-analyzer";
 /**
  * Static validation of the `logging:` block — `kernel/specs/logging.md` §14.1
@@ -106,8 +107,7 @@ function isSinkKind(manifest, registry, aliases, aliasesByModule) {
         return false;
     if (manifest.kind === "Telo.ConsoleSink" || manifest.kind === "Telo.FileSink")
         return true;
-    const ownModule = manifest.metadata?.module;
-    const resolver = (ownModule ? aliasesByModule?.get(ownModule) : undefined) ?? aliases;
+    const resolver = moduleAliasScope(manifest.metadata, aliases, aliasesByModule);
     const canonical = resolver.resolveKind(manifest.kind) ?? manifest.kind;
     return registry.resolve(canonical)?.capability === "Telo.Sink";
 }

package/dist/validate-references.d.ts

@@ -11,12 +11,23 @@ import type { DefinitionRegistry } from "./definition-registry.js";
  *
  * A value satisfies the slot when it transitively extends the target kind, or —
  * for a CONCRETE target — IS that kind; `getByExtends` is the same transitive
- * subtype index for both, and an abstract is satisfied only by an implementer,
- * never by the abstract itself (which is non-instantiable). Accepts a constraint
- * that resolves to nothing, and an abstract with no loaded implementations:
- * partial context, where a rejection would be a guess.
+ * subtype index for both. Accepts a constraint that resolves to nothing, and an
+ * abstract with no loaded implementations: partial context, where a rejection
+ * would be a guess.
+ *
+ * An abstract is satisfied only by an implementer, never by the abstract itself,
+ * because a resource declared `kind: <some abstract>` is refused at `create()`
+ * and reported as `ABSTRACT_KIND_INSTANTIATED` at its declaration — so accepting
+ * it here would leave the reference sites silent about a manifest that cannot
+ * run. `isDeclaration` is the ONE exception and it is not an instance: a
+ * library's `resources:` entry is constrained by kind alone, so its kind-only
+ * stand-in routinely IS an abstract (`connection: {kind: Sql.Connection}`), and
+ * every use of that name inside the library is a reference to it.
  */
-export declare function kindSatisfies(resolved: string, targetKind: string, registry: DefinitionRegistry): boolean;
+export declare function kindSatisfies(resolved: string, targetKind: string, registry: DefinitionRegistry, 
+/** The referent is a kind-only stand-in for a `resources:` entry rather than a
+ *  resource anything instantiates, so identity satisfies an abstract slot. */
+isDeclaration?: boolean): boolean;
 /**
  * Phase 3 — Reference validation.
  *

package/dist/validate-references.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-references.d.ts","sourceRoot":"","sources":["../src/validate-references.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAarD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAE/F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAInE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,kBAAkB,GAC3B,OAAO,CAwBT;AA8DD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,GACvB,kBAAkB,EAAE,CA2gBtB"}
+{"version":3,"file":"validate-references.d.ts","sourceRoot":"","sources":["../src/validate-references.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAarD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAE/F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAMnE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,kBAAkB;AAC5B;8EAC8E;AAC9E,aAAa,UAAQ,GACpB,OAAO,CAwBT;AAgED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,GACvB,kBAAkB,EAAE,CA0hBtB"}

package/dist/validate-references.js

@@ -5,6 +5,8 @@ import { navigateJsonPointer, substituteCelFields } from "./schema-compat.js";
 import { REF_VALIDATION_SKIP_KINDS as SYSTEM_KINDS } from "./system-kinds.js";
 import { resolveTypeFieldToSchema } from "./validate-cel-context.js";
 import { DiagnosticSeverity } from "./types.js";
+import { moduleAliasScope } from "./module-alias-scope.js";
+import { isInjectedDeclaration } from "./resource-input.js";
 const SOURCE = "telo-analyzer";
 /**
  * Liskov substitutability at a kind constraint: is `resolved` (a canonical
@@ -16,17 +18,28 @@ const SOURCE = "telo-analyzer";
  *
  * A value satisfies the slot when it transitively extends the target kind, or —
  * for a CONCRETE target — IS that kind; `getByExtends` is the same transitive
- * subtype index for both, and an abstract is satisfied only by an implementer,
- * never by the abstract itself (which is non-instantiable). Accepts a constraint
- * that resolves to nothing, and an abstract with no loaded implementations:
- * partial context, where a rejection would be a guess.
+ * subtype index for both. Accepts a constraint that resolves to nothing, and an
+ * abstract with no loaded implementations: partial context, where a rejection
+ * would be a guess.
+ *
+ * An abstract is satisfied only by an implementer, never by the abstract itself,
+ * because a resource declared `kind: <some abstract>` is refused at `create()`
+ * and reported as `ABSTRACT_KIND_INSTANTIATED` at its declaration — so accepting
+ * it here would leave the reference sites silent about a manifest that cannot
+ * run. `isDeclaration` is the ONE exception and it is not an instance: a
+ * library's `resources:` entry is constrained by kind alone, so its kind-only
+ * stand-in routinely IS an abstract (`connection: {kind: Sql.Connection}`), and
+ * every use of that name inside the library is a reference to it.
  */
-export function kindSatisfies(resolved, targetKind, registry) {
+export function kindSatisfies(resolved, targetKind, registry, 
+/** The referent is a kind-only stand-in for a `resources:` entry rather than a
+ *  resource anything instantiates, so identity satisfies an abstract slot. */
+isDeclaration = false) {
     const canonical = registry.resolveRef(targetKind) ?? targetKind;
     const targetDef = registry.resolve(canonical);
     if (!targetDef)
         return true;
-    if (targetDef.kind !== "Telo.Abstract" && resolved === canonical)
+    if ((targetDef.kind !== "Telo.Abstract" || isDeclaration) && resolved === canonical)
         return true;
     const subtypes = registry.getByExtends(canonical);
     if (subtypes.some((d) => `${d.metadata.module}.${d.metadata.name}` === resolved))
@@ -53,7 +66,9 @@ export function kindSatisfies(resolved, targetKind, registry) {
 /** {@link kindSatisfies} at every kind a slot accepts, rendered as messages.
  *  The acceptance rule is not restated here — only what to say when it fails,
  *  which needs the slot's alternatives and the target's flavour. */
-function checkKind(kind, entry, registry, aliases) {
+function checkKind(kind, entry, registry, aliases, 
+/** See {@link kindSatisfies}: the referent is a `resources:` stand-in. */
+isDeclaration = false) {
     const resolved = aliases.resolveKind(kind) ?? kind;
     // A qualified kind whose prefix names no import in this scope is a bad NAME
     // rather than a bad type — `{kind: NotAnAlias.Script}` where only `Lib` is
@@ -76,7 +91,7 @@ function checkKind(kind, entry, registry, aliases) {
         const targetDef = registry.resolve(targetKind);
         if (!targetDef)
             return [];
-        if (!unknownAlias && kindSatisfies(resolved, targetKind, registry))
+        if (!unknownAlias && kindSatisfies(resolved, targetKind, registry, isDeclaration))
             return [];
         const subtypes = registry.getByExtends(targetKind);
         const subtypeKinds = new Set(subtypes.map((d) => `${d.metadata.module}.${d.metadata.name}`));
@@ -311,7 +326,7 @@ export function validateReferences(resources, context) {
                     });
                     return;
                 }
-                const kindErrors = checkKind(target.kind, entry, registry, aliases);
+                const kindErrors = checkKind(target.kind, entry, registry, aliases, isInjectedDeclaration(target));
                 if (kindErrors.length > 0) {
                     diagnostics.push({
                         severity: DiagnosticSeverity.Error,
@@ -359,7 +374,11 @@ export function validateReferences(resources, context) {
                 return;
             }
             // 2. Kind check
-            const kindErrors = checkKind(refVal.kind, entry, registry, aliases);
+            const objectTarget = typeof refVal.name === "string"
+                ? (visibleScopeManifests.find((m) => m.metadata?.name === refVal.name) ??
+                    byName.get(refVal.name))
+                : undefined;
+            const kindErrors = checkKind(refVal.kind, entry, registry, aliases, isInjectedDeclaration(objectTarget));
             if (kindErrors.length > 0) {
                 diagnostics.push({
                     severity: DiagnosticSeverity.Error,
@@ -448,8 +467,7 @@ export function validateReferences(resources, context) {
             if (!isAbsolute && anchorName.includes(".")) {
                 const resolvedResourceKind = aliases.resolveKind(r.kind) ?? r.kind;
                 const resourceDef = registry.resolve(r.kind) ?? registry.resolve(resolvedResourceKind);
-                const owningModule = resourceDef?.metadata?.module;
-                const ownerScope = (owningModule ? aliasesByModule?.get(owningModule) : undefined) ?? aliases;
+                const ownerScope = moduleAliasScope(resourceDef?.metadata, aliases, aliasesByModule);
                 const targetKind = ownerScope.resolveKind(anchorName);
                 if (!targetKind) {
                     // Names the ALIAS, not the whole kind path: the alias is what an

package/dist/validate-resource-inputs.d.ts

@@ -2,34 +2,9 @@ import type { ResourceManifest } from "@telorun/sdk";
 import type { AliasResolver } from "./alias-resolver.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
 import { type AnalysisDiagnostic } from "./types.js";
-/**
- * The strict half of {@link readResourceInputs} — the `validate-ref-slots.ts`
- * split applied to the resource-input boundary, and not optional for the same
- * reason: the two sides fail in OPPOSITE directions. An unreadable DECLARATION
- * leaves the library referencing a name nothing stands behind; an unchecked
- * INJECTION hands a library an instance of a kind it never asked for, which
- * surfaces as a method-missing failure inside someone else's module.
- *
- * Two surfaces, scoped the same way every other declaration check is — to the
- * entry's own modules, since a published dependency's block is not the
- * consumer's to fix:
- *
- *  - **The library's own declaration.** Each entry's alias-qualified `kind:` must
- *    resolve in the DECLARING module's scope (`RESOURCE_INPUT_KIND_UNRESOLVED`).
- *    A constraint that resolves to nothing accepts anything, which is the same
- *    hole `X_TELO_REF_UNRESOLVED` exists to close one level down.
- *  - **The injection site.** Every declared entry must be supplied
- *    (`RESOURCE_INPUT_MISSING` — the same failure as a missing required
- *    variable), nothing beyond them may be (`RESOURCE_INPUT_UNKNOWN`), the value
- *    must name a resource that exists (`RESOURCE_INPUT_UNRESOLVED`), and its
- *    kind must satisfy the declared constraint transitively
- *    (`RESOURCE_INPUT_KIND_MISMATCH`).
- *
- * Browser-safe.
- */
 export declare function validateResourceInputs(manifests: ResourceManifest[], registry: DefinitionRegistry, aliases: AliasResolver, rootModules: Set<string>, 
 /** Kind acceptance, transitively — the `checkKind` rule `validate-references`
  *  applies at an ordinary ref slot, passed in rather than re-derived so the
  *  two cannot disagree about what satisfies a constraint. */
-acceptsKind: (suppliedKind: string, requiredKind: string) => boolean): AnalysisDiagnostic[];
+acceptsKind: (suppliedKind: string, requiredKind: string, suppliedIsDeclaration: boolean) => boolean): AnalysisDiagnostic[];
 //# sourceMappingURL=validate-resource-inputs.d.ts.map

package/dist/validate-resource-inputs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-resource-inputs.d.ts","sourceRoot":"","sources":["../src/validate-resource-inputs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAGnE,OAAO,EAAE,KAAK,kBAAkB,EAAsB,MAAM,YAAY,CAAC;AASzE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,EACtB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC;AACxB;;6DAE6D;AAC7D,WAAW,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,GACnE,kBAAkB,EAAE,CA6LtB"}
+{"version":3,"file":"validate-resource-inputs.d.ts","sourceRoot":"","sources":["../src/validate-resource-inputs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAOnE,OAAO,EAAE,KAAK,kBAAkB,EAAsB,MAAM,YAAY,CAAC;AAqCzE,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,EACtB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC;AACxB;;6DAE6D;AAC7D,WAAW,EAAE,CACX,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,qBAAqB,EAAE,OAAO,KAC3B,OAAO,GACX,kBAAkB,EAAE,CAyMtB"}

package/dist/validate-resource-inputs.js

@@ -1,6 +1,6 @@
 import { isRefSentinel } from "@telorun/templating";
 import { findDynamicLeaf } from "./resource-rule.js";
-import { readResourceInputs, readSuppliedResources } from "./resource-input.js";
+import { isInjectedDeclaration, readResourceInputs, readSuppliedResources, } from "./resource-input.js";
 import { DiagnosticSeverity } from "./types.js";
 const SOURCE = "telo-analyzer";
 /**
@@ -28,6 +28,7 @@ const SOURCE = "telo-analyzer";
  *
  * Browser-safe.
  */
+const declaringModule = (m) => m.metadata?.module;
 export function validateResourceInputs(manifests, registry, aliases, rootModules, 
 /** Kind acceptance, transitively — the `checkKind` rule `validate-references`
  *  applies at an ordinary ref slot, passed in rather than re-derived so the
@@ -186,7 +187,16 @@ acceptsKind) {
             if (typeof suppliedKind !== "string")
                 continue;
             const canonical = aliases.resolveKind(suppliedKind) ?? suppliedKind;
-            if (acceptsKind(canonical, entry))
+            // A library forwarding an input it was itself handed supplies a kind-only
+            // stand-in, whose kind is routinely the abstract the target declares. That
+            // is identity against an abstract, which an ordinary reference is refused
+            // — the referent there would be a resource nothing can instantiate, while
+            // here it is another declaration.
+            const suppliedName = value.name;
+            const supplied = typeof suppliedName === "string"
+                ? manifests.find((c) => c.metadata?.name === suppliedName && isOwn(declaringModule(c)))
+                : undefined;
+            if (acceptsKind(canonical, entry, isInjectedDeclaration(supplied)))
                 continue;
             out.push({
                 severity: DiagnosticSeverity.Error,

package/dist/validate-schema-type-refs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-schema-type-refs.d.ts","sourceRoot":"","sources":["../src/validate-schema-type-refs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAKzE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAC3C,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,GACvB,kBAAkB,EAAE,CAuDtB"}
+{"version":3,"file":"validate-schema-type-refs.d.ts","sourceRoot":"","sources":["../src/validate-schema-type-refs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAMzE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAC3C,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,GACvB,kBAAkB,EAAE,CAuDtB"}

package/dist/validate-schema-type-refs.js

@@ -1,5 +1,6 @@
 import { canonicalTypeSchemaId, parseTeloTypeRef } from "@telorun/sdk";
 import { DiagnosticSeverity } from "./types.js";
+import { moduleAliasScope } from "./module-alias-scope.js";
 const SOURCE = "telo-analyzer";
 const SCHEMA_FIELDS = ["schema", "inputType", "outputType"];
 /**
@@ -28,7 +29,7 @@ export function validateSchemaTypeRefs(manifests, registry, aliases, aliasesByMo
         // validated against their own library when it's analyzed as a root.
         if (ownModule && !rootModules.has(ownModule))
             continue;
-        const resolver = (ownModule ? aliasesByModule.get(ownModule) : undefined) ?? aliases;
+        const resolver = moduleAliasScope(m.metadata, aliases, aliasesByModule);
         const filePath = m.metadata?.source;
         const label = `${m.kind}/${name}`;
         const walk = (value, path) => {

package/dist/validate-throws-coverage.d.ts

@@ -4,5 +4,9 @@ import { type AliasResolver } from "./alias-resolver.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
 import { type AnalysisDiagnostic } from "./types.js";
 /** Entry point — invoked once per analyze() run. */
-export declare function validateThrowsCoverage(manifests: ResourceManifest[], defs: DefinitionRegistry, aliases: AliasResolver, env: Environment, aliasesByModule?: Map<string, AliasResolver>, rootModules?: Set<string>): AnalysisDiagnostic[];
+export declare function validateThrowsCoverage(manifests: ResourceManifest[], defs: DefinitionRegistry, aliases: AliasResolver, env: Environment, aliasesByModule?: Map<string, AliasResolver>, rootModules?: Set<string>, 
+/** Each imported library's full document set, so the walk can follow an
+ *  exported entry point into the siblings it invokes — which a consumer's
+ *  flat set does not carry. */
+moduleManifests?: Map<string, ResourceManifest[]>): AnalysisDiagnostic[];
 //# sourceMappingURL=validate-throws-coverage.d.ts.map

package/dist/validate-throws-coverage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-throws-coverage.d.ts","sourceRoot":"","sources":["../src/validate-throws-coverage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEjE,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAA0B,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAOnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAsfzE,oDAAoD;AACpD,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,WAAW,EAChB,eAAe,GAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAa,EACvD,WAAW,GAAE,GAAG,CAAC,MAAM,CAAa,GACnC,kBAAkB,EAAE,CAkDtB"}
+{"version":3,"file":"validate-throws-coverage.d.ts","sourceRoot":"","sources":["../src/validate-throws-coverage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEjE,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAA0B,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAOnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAsfzE,oDAAoD;AACpD,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,WAAW,EAChB,eAAe,GAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAa,EACvD,WAAW,GAAE,GAAG,CAAC,MAAM,CAAa;AACpC;;+BAE+B;AAC/B,eAAe,GAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAa,GAC3D,kBAAkB,EAAE,CAyDtB"}

package/dist/validate-throws-coverage.js

@@ -431,10 +431,14 @@ function schemaHasStepContext(schema) {
     return false;
 }
 /** Entry point — invoked once per analyze() run. */
-export function validateThrowsCoverage(manifests, defs, aliases, env, aliasesByModule = new Map(), rootModules = new Set()) {
+export function validateThrowsCoverage(manifests, defs, aliases, env, aliasesByModule = new Map(), rootModules = new Set(), 
+/** Each imported library's full document set, so the walk can follow an
+ *  exported entry point into the siblings it invokes — which a consumer's
+ *  flat set does not carry. */
+moduleManifests = new Map()) {
     const diagnostics = [];
     diagnostics.push(...validateThrowsDeclarations(manifests));
-    const resolveCtx = createResolveCtx(manifests, defs, aliases, aliasesByModule, rootModules);
+    const resolveCtx = createResolveCtx(manifests, defs, aliases, aliasesByModule, rootModules, moduleManifests);
     // The alias resolver for a manifest's own lexical scope — an imported library's
     // resolver when it owns the manifest, else undefined (fall back to root aliases).
     const scopeResolverFor = (m) => scopeResolverForModule(m.metadata?.module, rootModules, aliasesByModule);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.70.0",
+  "version": "0.71.0",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",
@@ -49,7 +49,7 @@
     "@types/node": "^20.0.0",
     "typescript": "^5.0.0",
     "vitest": "^2.1.8",
-    "@telorun/sdk": "0.86.0"
+    "@telorun/sdk": "0.87.0"
   },
   "peerDependencies": {
     "@telorun/sdk": "*"

package/src/analysis-registry.ts

@@ -9,6 +9,7 @@ import { visitManifest as runVisitManifest, type ManifestVisitor } from "./manif
 import type { ContractDirection, DefResolver } from "./extends-resolution.js";
 import { resolveContract } from "./invocation-contract.js";
 import { createResolveCtx, resolveThrowsUnion } from "./resolve-throws-union.js";
+import { moduleAliasScope } from "./module-alias-scope.js";
 import { isRefEntry, isScopeEntry } from "./reference-field-map.js";
 import { resolveSchemaTypeRefs as resolveSchemaTypeRefsIn } from "./resolve-schema-type-refs.js";
 import type { AnalysisContext } from "./types.js";
@@ -258,8 +259,7 @@ export class AnalysisRegistry {
    */
   resolveSchemaFrom(schemaFrom: string, declaringKind: string): Record<string, any> | undefined {
     const def = this.resolveDefinition(declaringKind);
-    const ownerModule = (def?.metadata as { module?: string } | undefined)?.module;
-    const scope = (ownerModule ? this.aliasesByModule.get(ownerModule) : undefined) ?? this.aliases;
+    const scope = moduleAliasScope(def?.metadata, this.aliases, this.aliasesByModule);
     return this.defs.resolveSchemaFromNode(schemaFrom, scope);
   }
 
@@ -337,7 +337,7 @@ export class AnalysisRegistry {
    *  the kind was read off. Falls back to the global table when the module is
    *  unknown or is a root. */
   resolveDefinitionIn(kind: string, module?: string): ResourceDefinition | undefined {
-    const scope = (module ? this.aliasesByModule.get(module) : undefined) ?? this.aliases;
+    const scope = moduleAliasScope({ module }, this.aliases, this.aliasesByModule);
     const canonical = scope.resolveKind(kind);
     return this.defs.resolve(kind) ?? (canonical ? this.defs.resolve(canonical) : undefined);
   }
@@ -354,8 +354,7 @@ export class AnalysisRegistry {
   resolverForDefinition(def: {
     metadata?: { module?: string };
   }): (kind: string) => ResourceDefinition | undefined {
-    const ownModule = def?.metadata?.module;
-    const scope = (ownModule ? this.aliasesByModule.get(ownModule) : undefined) ?? this.aliases;
+    const scope = moduleAliasScope(def?.metadata, this.aliases, this.aliasesByModule);
     return (kind) => {
       const canonical = scope.resolveKind(kind);
       return this.defs.resolve(kind) ?? (canonical ? this.defs.resolve(canonical) : undefined);

package/src/analyzer.ts

@@ -47,6 +47,7 @@ import {
 } from "./validate-observed-state.js";
 import { computeSuggestKind } from "./kind-suggest.js";
 import { visitManifest } from "./manifest-visitor.js";
+import { declaringModuleScope, moduleAliasScope } from "./module-alias-scope.js";
 import { isModuleKind } from "./module-kinds.js";
 import { normalizeInlineResources } from "./normalize-inline-resources.js";
 import { REF_VALIDATION_SKIP_KINDS } from "./system-kinds.js";
@@ -999,10 +1000,10 @@ export class StaticAnalyzer {
       if (m.kind !== "Telo.Definition" && m.kind !== "Telo.Abstract") continue;
       const def = m as unknown as ResourceDefinition;
       const ownModule = (def.metadata as { module?: string } | undefined)?.module;
-      const scopeResolver =
-        ownModule && !rootModules.has(ownModule)
-          ? (aliasesByModule.get(ownModule) ?? new AliasResolver())
-          : aliases;
+      const scopeResolver = declaringModuleScope(ownModule, aliases, {
+        aliasesByModule,
+        rootModules,
+      });
       // Canonicalize alias-form `x-telo-ref` constraints in the DECLARING module's
       // scope, before the schema reaches `register()` and the lazily-built field
       // maps. Same pre-resolution `capability` / `extends` get below.
@@ -1425,7 +1426,7 @@ export class StaticAnalyzer {
       // analyzer knowing it exists: going native costs a module, not a change
       // here.
       const resolveRegionDef = (kind: string, module?: string) => {
-        const scope = (module ? aliasesByModule.get(module) : undefined) ?? aliases;
+        const scope = moduleAliasScope({ module }, aliases, aliasesByModule);
         const canonical = scope.resolveKind(kind);
         return defs.resolve(kind) ?? (canonical ? defs.resolve(canonical) : undefined);
       };
@@ -1456,8 +1457,10 @@ export class StaticAnalyzer {
       if (!ownModule || !m.metadata?.name || typeof m.schema !== "object" || m.schema === null) {
         continue;
       }
-      const scopeResolver =
-        rootModules.has(ownModule) ? aliases : (aliasesByModule.get(ownModule) ?? new AliasResolver());
+      const scopeResolver = declaringModuleScope(ownModule, aliases, {
+        aliasesByModule,
+        rootModules,
+      });
       const canonicalKind = scopeResolver.resolveKind(m.kind as string) ?? (m.kind as string);
       if (defs.resolve(canonicalKind)?.capability !== "Telo.Type") continue;
       const typeName = m.metadata.name as string;
@@ -1877,6 +1880,37 @@ export class StaticAnalyzer {
         continue;
       }
 
+      // An abstract names a CONTRACT for reference slots, not something to
+      // instantiate — the kernel refuses it outright at `create()`. Reported
+      // here, at the declaration, because that is the line the author has to
+      // change and because a runtime-only refusal is exactly the shape static
+      // analysis exists to remove. The hint mirrors the kernel's: the concrete
+      // implementations this analysis holds, or the reason there are none.
+      //
+      // Injected declarations never reach this loop (skipped above), which is
+      // what keeps a `resources:` entry — kind-only and routinely abstract by
+      // design — out of it.
+      if (definition.kind === "Telo.Abstract") {
+        const canonical = resolvedKind ?? m.kind;
+        const impls = defs
+          .getByExtends(canonical)
+          .filter((d) => d.kind !== "Telo.Abstract")
+          .map((d) => `${d.metadata.module}.${d.metadata.name}`);
+        const kindInfo =
+          canonical !== m.kind ? `'${m.kind}' (resolved to '${canonical}')` : `'${m.kind}'`;
+        const hint = impls.length
+          ? `instantiate a concrete implementation: ${impls.join(", ")}`
+          : "no concrete implementations are registered — import a module that provides one";
+        diagnostics.push({
+          severity: DiagnosticSeverity.Error,
+          code: "ABSTRACT_KIND_INSTANTIATED",
+          source: SOURCE,
+          message: `Kind ${kindInfo} is abstract and cannot be instantiated directly; ${hint}.`,
+          data: { resource, filePath, path: "kind" },
+        });
+        continue;
+      }
+
       // Validate resource config against the definition's AUTHOR-FACING schema —
       // inheritance-resolved, with `kind` / `metadata` injected. See
       // `validationSchemaFor`, which is where both derivations and the reason
@@ -2690,9 +2724,25 @@ export class StaticAnalyzer {
     // Validate provider coherence rules for `provide:` template-target definitions.
     diagnostics.push(...validateProviderCoherence(allManifests, defs, aliases));
 
-    // Validate throws: declarations and catches: coverage (rules 1, 2, 4, 7)
+    // Validate throws: declarations and catches: coverage (rules 1, 2, 4, 7).
+    // The library document sets collected for the zone stage serve here too: a
+    // library's exported entry point is forwarded into the flat set while the
+    // siblings it invokes are not, so without them the walk stops at the
+    // boundary and reports an empty union for a body that plainly throws.
+    const libraryManifests = new Map<string, ResourceManifest[]>();
+    for (const doc of options?.moduleDocuments ?? []) {
+      libraryManifests.set(doc.module, doc.manifests);
+    }
     diagnostics.push(
-      ...validateThrowsCoverage(allManifests, defs, aliases, this.celEnv, aliasesByModule, rootModules),
+      ...validateThrowsCoverage(
+        allManifests,
+        defs,
+        aliases,
+        this.celEnv,
+        aliasesByModule,
+        rootModules,
+        libraryManifests,
+      ),
     );
 
     // Warn about declared variables / secrets / ports that no CEL references.
@@ -2710,7 +2760,8 @@ export class StaticAnalyzer {
         defs,
         aliases,
         rootModules,
-        (supplied, required) => kindSatisfies(supplied, required, defs),
+        (supplied, required, isDeclaration) =>
+          kindSatisfies(supplied, required, defs, isDeclaration),
       ),
     );