@telorun/analyzer 0.70.0 → 0.71.0

package/src/resolve-zone-requirements.ts

@@ -14,7 +14,7 @@
  * Browser-safe: no Node built-ins.
  */
 import type { ResourceDefinition, ResourceManifest } from "@telorun/sdk";
-import { isRefSentinel } from "@telorun/templating";
+import { refSentinelTarget } from "./ref-sentinel-target.js";
 import type { AliasResolver } from "./alias-resolver.js";
 import {
   buildCallGraph,
@@ -28,9 +28,10 @@ import {
   propertySchemas,
   resolveLocalRef,
 } from "./manifest-navigation.js";
-import type { ZoneModuleDocuments } from "./zone-module-documents.js";
+import type { ModuleDocuments } from "./module-documents.js";
 import { readProvidesZone, readRequiresZone } from "./zone-slot.js";
 import { DiagnosticSeverity, type AnalysisDiagnostic } from "./types.js";
+import { moduleAliasScope } from "./module-alias-scope.js";
 
 const SOURCE = "telo-analyzer";
 
@@ -125,7 +126,7 @@ function definitionResolver(
   aliasesByModule: Map<string, AliasResolver>,
 ) {
   return (kind: string, module?: string): ResourceDefinition | undefined => {
-    const scope = (module ? aliasesByModule.get(module) : undefined) ?? aliases;
+    const scope = moduleAliasScope({ module }, aliases, aliasesByModule);
     const canonical = scope.resolveKind(kind);
     return defs.resolve(kind) ?? (canonical ? defs.resolve(canonical) : undefined);
   };
@@ -193,17 +194,16 @@ function schemaNodeAt(
  * under-approximating direction the whole pass leans on. `Self.` is a local
  * name written the long way and does resolve.
  *
- * This deliberately differs from `call-graph`'s `refTargetName`, which answers a
- * different question (what an EDGE points at, cross-module included, for a graph
- * whose consumers tolerate an unresolved target) — hence two functions rather
- * than one shared helper.
+ * This is this pass's REDUCTION over the shared `refSentinelTarget` parse, not a
+ * second reading of the tag: `call-graph`'s answers a different question (what
+ * an EDGE points at, cross-module included, for a graph whose consumers tolerate
+ * an unresolved target) and states its own reduction the same way.
  */
 function refName(value: unknown): string | undefined {
-  if (isRefSentinel(value)) {
-    const source = value.source;
-    const dot = source.indexOf(".");
-    if (dot <= 0) return source;
-    return source.slice(0, dot) === "Self" ? source.slice(dot + 1) : undefined;
+  const sentinel = refSentinelTarget(value);
+  if (sentinel) {
+    if (sentinel.alias === undefined) return sentinel.name;
+    return sentinel.alias === "Self" ? sentinel.name : undefined;
   }
   if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
   const v = value as Record<string, unknown>;
@@ -712,7 +712,7 @@ export function zoneDocumentsSignature(manifests: readonly ResourceManifest[]):
  * the projection derive-only, and keep what reaches an exported instance.
  */
 export function deriveLibraryExportRequirements(
-  docs: ZoneModuleDocuments,
+  docs: ModuleDocuments,
   defs: DefinitionRegistry,
   aliases: AliasResolver,
   aliasesByModule: Map<string, AliasResolver>,
@@ -745,7 +745,7 @@ export interface ZoneAnalysisArgs {
   aliases: AliasResolver;
   aliasesByModule: Map<string, AliasResolver>;
   rootModules: ReadonlySet<string>;
-  moduleDocuments?: readonly ZoneModuleDocuments[];
+  moduleDocuments?: readonly ModuleDocuments[];
   cache?: ZoneExportCache;
 }
 

package/src/telo-version.ts

@@ -6,4 +6,4 @@
 // written against, and every kernel in every language reports the same scale.
 
 /** The surface generation this analyzer implements. */
-export const TELO_SURFACE_VERSION = "0.86.0";
+export const TELO_SURFACE_VERSION = "0.87.0";

package/src/template-body.ts

@@ -2,6 +2,7 @@ import type { ResourceDefinition, ResourceManifest } from "@telorun/sdk";
 import type { AliasResolver } from "./alias-resolver.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
 import type { ModuleScopes } from "./alias-resolver.js";
+import { moduleAliasScope } from "./module-alias-scope.js";
 
 /**
  * A `Telo.Definition`'s `resources:` entries — the bodies a kind writes for
@@ -47,11 +48,7 @@ export function templateBodies(
   // A nested kind is written through the alias scope of the module that DECLARED
   // the definition, never the consumer's — the same rule every other kind
   // resolution in a forwarded manifest follows.
-  const ownModule = (m.metadata as { module?: string } | undefined)?.module;
-  const scope =
-    (ownModule && scopes && !scopes.rootModules.has(ownModule)
-      ? scopes.aliasesByModule.get(ownModule)
-      : undefined) ?? aliases;
+  const scope = moduleAliasScope(m.metadata, aliases, scopes?.aliasesByModule);
 
   const out: TemplateBody[] = [];
   for (let i = 0; i < bodies.length; i++) {

package/src/types.ts

@@ -1,6 +1,6 @@
 import type { HostVersions } from "./requires-block.js";
 
-import type { ZoneModuleDocuments } from "./zone-module-documents.js";
+import type { ModuleDocuments } from "./module-documents.js";
 /** Matches LSP DiagnosticSeverity values exactly.
  *  https://microsoft.github.io/language-server-protocol/specifications/lsp/3.17/specification/#diagnosticSeverity */
 export const DiagnosticSeverity = {
@@ -142,10 +142,10 @@ export interface AnalysisOptions {
   /** Imported libraries' FULL document sets, for the zone stage's per-library
    *  export derivation — the flattened analysis view forwards only each
    *  library's export surface, never its internal dispatch chain. Collected
-   *  from a LoadedGraph via `collectZoneModuleDocuments`. Omitting it skips
+   *  from a LoadedGraph via `collectModuleDocuments`. Omitting it skips
    *  the derivation (the under-approximating direction — the runtime check
    *  remains the enforcement). */
-  moduleDocuments?: ZoneModuleDocuments[];
+  moduleDocuments?: ModuleDocuments[];
   /** When true, `analyze()` runs the state-mutating setup (module identity /
    *  alias / definition registration plus `normalizeInlineResources`) but
    *  skips every diagnostic-producing pass — per-resource validation, the

package/src/validate-invocation-contract.ts

@@ -2,13 +2,17 @@ import type { ResourceDefinition, ResourceManifest } from "@telorun/sdk";
 import type { AliasResolver } from "./alias-resolver.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
 import {
+  ancestorChain,
   type ContractDirection,
   type DefResolver,
   effectiveContractField,
   mappingFieldFor,
   needsContractMapping,
 } from "./extends-resolution.js";
+import { resolveTypeFieldToSchema } from "./validate-cel-context.js";
+import { moduleAliasScope } from "./module-alias-scope.js";
 import { buildReferenceFieldMap, isRefEntry } from "./reference-field-map.js";
+import { checkSchemaCompatibility } from "./schema-compat.js";
 import { DiagnosticSeverity, type AnalysisDiagnostic } from "./types.js";
 
 const SOURCE = "telo-analyzer";
@@ -29,6 +33,11 @@ const SOURCE = "telo-analyzer";
  *    whose input contract is now `inputType:`.
  *  - CONTRACT_TYPE_NOT_FOUND: a contract names a type that is not declared in
  *    scope, so every call through it would fail at dispatch.
+ *  - CONTRACT_NOT_SUBSTITUTABLE: a definition replaces an ancestor's contract
+ *    with a shape that cannot stand in for it. The one check nothing else makes:
+ *    contracts resolve to the nearest declaration in BOTH halves, so a child that
+ *    declares its own is compared against its abstract by neither the analyzer
+ *    nor dispatch.
  *
  * Deliberately NOT diagnosed: an input that is neither `required:` nor
  * defaulted. It is indistinguishable from a genuinely optional one — `Ai.Text`
@@ -45,8 +54,7 @@ export function validateInvocationContract(
 ): AnalysisDiagnostic[] {
   const diagnostics: AnalysisDiagnostic[] = [];
   const resolveDef: DefResolver = (kind, from) => {
-    const module = (from?.metadata as { module?: string } | undefined)?.module;
-    const scope = (module ? aliasesByModule.get(module) : undefined) ?? aliases;
+    const scope = moduleAliasScope(from?.metadata, aliases, aliasesByModule);
     return registry.resolve(kind) ?? registry.resolve(scope.resolveKind(kind) ?? kind);
   };
 
@@ -73,6 +81,7 @@ export function validateInvocationContract(
     if (m.kind === "Telo.Definition" || m.kind === "Telo.Abstract") {
       checkMappingRequired(m, resource, filePath, resolveDef, diagnostics);
       checkContractResolves(m, md, manifests, resource, filePath, diagnostics);
+      checkAncestorSubstitutability(m, md, manifests, resource, filePath, resolveDef, diagnostics);
       continue;
     }
 
@@ -360,6 +369,123 @@ function namedTypeReference(value: unknown): string | undefined {
   return typeof ref.name === "string" ? ref.name : undefined;
 }
 
+/**
+ * A REPLACING CONTRACT MUST STILL STAND IN FOR THE ONE IT REPLACES.
+ *
+ * Contracts resolve to the NEAREST declaration and never merge, which is right —
+ * a call signature is not additive, and a backend narrowing `status` to the
+ * states it actually has could not express that through a merge. But the
+ * consequence is that an abstract's contract binds only the children that
+ * declare none of their own: a child that declares one is checked against
+ * nothing, statically or at dispatch, since `resolveBoundContract` stops at the
+ * same nearest declaration. So an abstract could state a floor every
+ * implementation must answer with (`Durable.Run`'s `runId` / `status`, the
+ * identity every later question about a run is asked by) and have that floor hold
+ * for exactly the implementations that declared nothing — while the real ones,
+ * which all declare their own, escaped it. A slot typed by the abstract would
+ * then be typed by a promise nothing kept.
+ *
+ * The rule is substitutability, and its direction differs per contract because
+ * one is produced and the other consumed:
+ *
+ *  - `outputType` is COVARIANT — a consumer written against the ancestor reads
+ *    the ancestor's shape, so the child's output must be acceptable where the
+ *    ancestor's is declared. Dropping a required property is what breaks it.
+ *  - `inputType` is CONTRAVARIANT — a caller written against the ancestor sends
+ *    the ancestor's shape, so the ancestor's input must be acceptable where the
+ *    child's is declared. Requiring an input the ancestor never mentions is what
+ *    breaks it: no such caller could satisfy it.
+ *
+ * **Only an ABSTRACT ancestor's contract is a contract**, and that narrowing is a
+ * decision rather than an oversight. Extending a CONCRETE kind is how a friendlier
+ * schema is put over an existing controller — `base:` reshapes its config and
+ * `inputs:` / `result:` translate its call signature — so a child there is
+ * SUPPOSED to present different inputs, and demanding substitutability would
+ * reject the pattern the standard library and every custom-kind example are built
+ * on. An abstract has no implementation to reshape: extending one is a claim to
+ * BE the thing, its contract is written for implementors, and a slot typed by it
+ * is polymorphic by construction — which is exactly where an unkept promise has
+ * nowhere to be caught.
+ *
+ * A direction the child BRIDGES (`inputs:` for inputs, `result:` for outputs) is
+ * skipped for the same reason one hop down: the mapping is the author saying the
+ * shapes differ deliberately and are translated.
+ *
+ * The comparison is {@link checkSchemaCompatibility}, which reports only DEFINITE
+ * mismatches — a union, an absent `type`, an undeclared argument all read as
+ * compatible — so narrowing a value's type, adding an optional property or
+ * restricting an enum stays legal, which is the whole point of letting a child
+ * replace the contract at all.
+ */
+function checkAncestorSubstitutability(
+  m: ResourceManifest,
+  md: Record<string, unknown>,
+  manifests: ResourceManifest[],
+  resource: { kind: string; name: string },
+  filePath: string | undefined,
+  resolveDef: DefResolver,
+  diagnostics: AnalysisDiagnostic[],
+): void {
+  const def = m as unknown as ResourceDefinition;
+
+  for (const direction of ["inputType", "outputType"] as ContractDirection[]) {
+    const own = md[direction];
+    if (own === undefined || own === null) continue;
+    // A declared bridge says the shapes differ on purpose and are translated.
+    if (md[mappingFieldFor(direction)] != null) continue;
+
+    // The nearest ANCESTOR that declares it — the contract this one replaces.
+    // Walking past self is the whole question: `contractDeclarer` would answer
+    // "this one", which is what nothing checks.
+    const ancestor = ancestorChain(def, resolveDef).find((a) => {
+      const inherited = (a as unknown as Record<string, unknown>)[direction];
+      return inherited !== undefined && inherited !== null;
+    });
+    if (!ancestor || ancestor.kind !== "Telo.Abstract") continue;
+    const inherited = (ancestor as unknown as Record<string, unknown>)[direction];
+
+    // The WHOLE manifest set, which is what `analyzerContractScope`'s
+    // `typeManifestsFor` hands `resolveContract` — so this resolves a named type
+    // exactly as the resolver the kernel binds with does. Filtering to the
+    // declaring module looked more careful and was strictly worse: a contract
+    // naming a shape from a shared module resolved to nothing, and an
+    // unresolvable side is skipped, so the check silently switched itself off for
+    // precisely the libraries that factor their shapes out. Nothing else caught
+    // it either — `CONTRACT_TYPE_NOT_FOUND` finds the type through its own global
+    // fallback, so such a kind passed `telo check` with no diagnostic at all.
+    const ownSchema = resolveTypeFieldToSchema(own, manifests);
+    const ancestorSchema = resolveTypeFieldToSchema(inherited, manifests);
+    // An unresolvable side says nothing about compatibility; CONTRACT_TYPE_NOT_FOUND
+    // is what reports a contract that names a type nothing declares.
+    if (!ownSchema || !ancestorSchema) continue;
+
+    const { compatible, issues } =
+      direction === "outputType"
+        ? checkSchemaCompatibility(ownSchema, ancestorSchema)
+        : checkSchemaCompatibility(ancestorSchema, ownSchema);
+    if (compatible) continue;
+
+    const ancestorName = `${(ancestor.metadata as { module?: string } | undefined)?.module ?? ""}.${
+      ancestor.metadata?.name ?? "?"
+    }`.replace(/^\./, "");
+    const why =
+      direction === "outputType"
+        ? `every caller that holds this through '${ancestorName}' reads the shape that kind declares`
+        : `a caller that holds this through '${ancestorName}' sends the shape that kind declares`;
+    diagnostics.push({
+      severity: DiagnosticSeverity.Error,
+      code: "CONTRACT_NOT_SUBSTITUTABLE",
+      source: SOURCE,
+      message:
+        `${m.kind}/${resource.name}: \`${direction}\` replaces the one declared by '${ancestorName}' ` +
+        `with a shape that cannot stand in for it — ${issues.join("; ")}. Contracts replace rather ` +
+        `than merge, so nothing re-checks this at dispatch: ${why}. Restate the fields ` +
+        `'${ancestorName}' declares, or drop \`${direction}\` to inherit the contract unchanged.`,
+      data: { resource, filePath, path: direction },
+    });
+  }
+}
+
 /** A child that inherits its controller and REPLACES a contract must bridge it:
  *  contracts resolve to the nearest declaration and never merge, so the
  *  inherited controller only understands its own shape. Without the mapping the

package/src/validate-logging.ts

@@ -3,6 +3,7 @@ import type { AliasResolver } from "./alias-resolver.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
 import { parseRedactionPath, RedactionPathError } from "./redaction-path.js";
 import { DiagnosticSeverity, type AnalysisDiagnostic } from "./types.js";
+import { moduleAliasScope } from "./module-alias-scope.js";
 
 const SOURCE = "telo-analyzer";
 
@@ -124,9 +125,7 @@ function isSinkKind(
 ): boolean {
   if (typeof manifest.kind !== "string") return false;
   if (manifest.kind === "Telo.ConsoleSink" || manifest.kind === "Telo.FileSink") return true;
-  const ownModule = (manifest.metadata as { module?: string } | undefined)?.module;
-  const resolver =
-    (ownModule ? aliasesByModule?.get(ownModule) : undefined) ?? aliases;
+  const resolver = moduleAliasScope(manifest.metadata, aliases, aliasesByModule);
   const canonical = resolver.resolveKind(manifest.kind) ?? manifest.kind;
   return registry.resolve(canonical)?.capability === "Telo.Sink";
 }

package/src/validate-references.ts

@@ -14,6 +14,8 @@ import { resolveTypeFieldToSchema } from "./validate-cel-context.js";
 import { DiagnosticSeverity, type AnalysisDiagnostic, type AnalysisContext } from "./types.js";
 import type { AliasResolver } from "./alias-resolver.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
+import { moduleAliasScope } from "./module-alias-scope.js";
+import { isInjectedDeclaration } from "./resource-input.js";
 
 const SOURCE = "telo-analyzer";
 
@@ -27,20 +29,31 @@ const SOURCE = "telo-analyzer";
  *
  * A value satisfies the slot when it transitively extends the target kind, or —
  * for a CONCRETE target — IS that kind; `getByExtends` is the same transitive
- * subtype index for both, and an abstract is satisfied only by an implementer,
- * never by the abstract itself (which is non-instantiable). Accepts a constraint
- * that resolves to nothing, and an abstract with no loaded implementations:
- * partial context, where a rejection would be a guess.
+ * subtype index for both. Accepts a constraint that resolves to nothing, and an
+ * abstract with no loaded implementations: partial context, where a rejection
+ * would be a guess.
+ *
+ * An abstract is satisfied only by an implementer, never by the abstract itself,
+ * because a resource declared `kind: <some abstract>` is refused at `create()`
+ * and reported as `ABSTRACT_KIND_INSTANTIATED` at its declaration — so accepting
+ * it here would leave the reference sites silent about a manifest that cannot
+ * run. `isDeclaration` is the ONE exception and it is not an instance: a
+ * library's `resources:` entry is constrained by kind alone, so its kind-only
+ * stand-in routinely IS an abstract (`connection: {kind: Sql.Connection}`), and
+ * every use of that name inside the library is a reference to it.
  */
 export function kindSatisfies(
   resolved: string,
   targetKind: string,
   registry: DefinitionRegistry,
+  /** The referent is a kind-only stand-in for a `resources:` entry rather than a
+   *  resource anything instantiates, so identity satisfies an abstract slot. */
+  isDeclaration = false,
 ): boolean {
   const canonical = registry.resolveRef(targetKind) ?? targetKind;
   const targetDef = registry.resolve(canonical);
   if (!targetDef) return true;
-  if (targetDef.kind !== "Telo.Abstract" && resolved === canonical) return true;
+  if ((targetDef.kind !== "Telo.Abstract" || isDeclaration) && resolved === canonical) return true;
   const subtypes = registry.getByExtends(canonical);
   if (subtypes.some((d) => `${d.metadata.module}.${d.metadata.name}` === resolved)) return true;
   // Leniency is about the CANDIDATE, not about the population, and it is the
@@ -70,6 +83,8 @@ function checkKind(
   entry: RefFieldEntry,
   registry: DefinitionRegistry,
   aliases: AliasResolver,
+  /** See {@link kindSatisfies}: the referent is a `resources:` stand-in. */
+  isDeclaration = false,
 ): string[] {
   const resolved = aliases.resolveKind(kind) ?? kind;
   // A qualified kind whose prefix names no import in this scope is a bad NAME
@@ -92,7 +107,7 @@ function checkKind(
     if (!targetKind) return [];
     const targetDef = registry.resolve(targetKind);
     if (!targetDef) return [];
-    if (!unknownAlias && kindSatisfies(resolved, targetKind, registry)) return [];
+    if (!unknownAlias && kindSatisfies(resolved, targetKind, registry, isDeclaration)) return [];
     const subtypes = registry.getByExtends(targetKind);
     const subtypeKinds = new Set(subtypes.map((d) => `${d.metadata.module}.${d.metadata.name}`));
     if (targetDef.kind === "Telo.Abstract") {
@@ -335,7 +350,13 @@ export function validateReferences(
             });
             return;
           }
-          const kindErrors = checkKind(target.kind as string, entry, registry, aliases);
+          const kindErrors = checkKind(
+            target.kind as string,
+            entry,
+            registry,
+            aliases,
+            isInjectedDeclaration(target),
+          );
           if (kindErrors.length > 0) {
             diagnostics.push({
               severity: DiagnosticSeverity.Error,
@@ -385,7 +406,18 @@ export function validateReferences(
         }
 
         // 2. Kind check
-        const kindErrors = checkKind(refVal.kind, entry, registry, aliases);
+        const objectTarget =
+          typeof refVal.name === "string"
+            ? (visibleScopeManifests.find((m) => m.metadata?.name === refVal.name) ??
+              byName.get(refVal.name))
+            : undefined;
+        const kindErrors = checkKind(
+          refVal.kind,
+          entry,
+          registry,
+          aliases,
+          isInjectedDeclaration(objectTarget),
+        );
         if (kindErrors.length > 0) {
           diagnostics.push({
             severity: DiagnosticSeverity.Error,
@@ -484,9 +516,7 @@ export function validateReferences(
           const resolvedResourceKind = aliases.resolveKind(r.kind) ?? r.kind;
           const resourceDef =
             registry.resolve(r.kind) ?? registry.resolve(resolvedResourceKind);
-          const owningModule = (resourceDef?.metadata as { module?: string } | undefined)?.module;
-          const ownerScope =
-            (owningModule ? aliasesByModule?.get(owningModule) : undefined) ?? aliases;
+          const ownerScope = moduleAliasScope(resourceDef?.metadata, aliases, aliasesByModule);
 
           const targetKind = ownerScope.resolveKind(anchorName);
           if (!targetKind) {

package/src/validate-resource-inputs.ts

@@ -3,7 +3,11 @@ import { isRefSentinel } from "@telorun/templating";
 import type { AliasResolver } from "./alias-resolver.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
 import { findDynamicLeaf } from "./resource-rule.js";
-import { readResourceInputs, readSuppliedResources } from "./resource-input.js";
+import {
+  isInjectedDeclaration,
+  readResourceInputs,
+  readSuppliedResources,
+} from "./resource-input.js";
 import { type AnalysisDiagnostic, DiagnosticSeverity } from "./types.js";
 
 const SOURCE = "telo-analyzer";
@@ -38,6 +42,9 @@ type RequiredResources = Record<string, string>;
  *
  * Browser-safe.
  */
+const declaringModule = (m: ResourceManifest): string | undefined =>
+  (m.metadata as { module?: string } | undefined)?.module;
+
 export function validateResourceInputs(
   manifests: ResourceManifest[],
   registry: DefinitionRegistry,
@@ -46,7 +53,11 @@ export function validateResourceInputs(
   /** Kind acceptance, transitively — the `checkKind` rule `validate-references`
    *  applies at an ordinary ref slot, passed in rather than re-derived so the
    *  two cannot disagree about what satisfies a constraint. */
-  acceptsKind: (suppliedKind: string, requiredKind: string) => boolean,
+  acceptsKind: (
+    suppliedKind: string,
+    requiredKind: string,
+    suppliedIsDeclaration: boolean,
+  ) => boolean,
 ): AnalysisDiagnostic[] {
   const out: AnalysisDiagnostic[] = [];
 
@@ -220,7 +231,19 @@ export function validateResourceInputs(
       const suppliedKind = (value as { kind?: unknown }).kind;
       if (typeof suppliedKind !== "string") continue;
       const canonical = aliases.resolveKind(suppliedKind) ?? suppliedKind;
-      if (acceptsKind(canonical, entry)) continue;
+      // A library forwarding an input it was itself handed supplies a kind-only
+      // stand-in, whose kind is routinely the abstract the target declares. That
+      // is identity against an abstract, which an ordinary reference is refused
+      // — the referent there would be a resource nothing can instantiate, while
+      // here it is another declaration.
+      const suppliedName = (value as { name?: unknown }).name;
+      const supplied =
+        typeof suppliedName === "string"
+          ? manifests.find(
+              (c) => c.metadata?.name === suppliedName && isOwn(declaringModule(c)),
+            )
+          : undefined;
+      if (acceptsKind(canonical, entry, isInjectedDeclaration(supplied))) continue;
       out.push({
         severity: DiagnosticSeverity.Error,
         code: "RESOURCE_INPUT_KIND_MISMATCH",

package/src/validate-schema-type-refs.ts

@@ -3,6 +3,7 @@ import { canonicalTypeSchemaId, parseTeloTypeRef } from "@telorun/sdk";
 import type { AliasResolver } from "./alias-resolver.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
 import { DiagnosticSeverity, type AnalysisDiagnostic } from "./types.js";
+import { moduleAliasScope } from "./module-alias-scope.js";
 
 const SOURCE = "telo-analyzer";
 const SCHEMA_FIELDS = ["schema", "inputType", "outputType"] as const;
@@ -38,7 +39,7 @@ export function validateSchemaTypeRefs(
     // Only validate refs authored in a root module's scope; imported defs are
     // validated against their own library when it's analyzed as a root.
     if (ownModule && !rootModules.has(ownModule)) continue;
-    const resolver = (ownModule ? aliasesByModule.get(ownModule) : undefined) ?? aliases;
+    const resolver = moduleAliasScope(m.metadata, aliases, aliasesByModule);
     const filePath = (m.metadata as { source?: string } | undefined)?.source;
     const label = `${m.kind}/${name}`;
 

package/src/validate-throws-coverage.ts

@@ -523,11 +523,22 @@ export function validateThrowsCoverage(
   env: Environment,
   aliasesByModule: Map<string, AliasResolver> = new Map(),
   rootModules: Set<string> = new Set(),
+  /** Each imported library's full document set, so the walk can follow an
+   *  exported entry point into the siblings it invokes — which a consumer's
+   *  flat set does not carry. */
+  moduleManifests: Map<string, ResourceManifest[]> = new Map(),
 ): AnalysisDiagnostic[] {
   const diagnostics: AnalysisDiagnostic[] = [];
   diagnostics.push(...validateThrowsDeclarations(manifests));
 
-  const resolveCtx = createResolveCtx(manifests, defs, aliases, aliasesByModule, rootModules);
+  const resolveCtx = createResolveCtx(
+    manifests,
+    defs,
+    aliases,
+    aliasesByModule,
+    rootModules,
+    moduleManifests,
+  );
 
   // The alias resolver for a manifest's own lexical scope — an imported library's
   // resolver when it owns the manifest, else undefined (fall back to root aliases).

package/dist/zone-module-documents.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"zone-module-documents.d.ts","sourceRoot":"","sources":["../src/zone-module-documents.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,mBAAmB;IAClC,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC"}