@telorun/analyzer 0.71.0 → 0.73.0

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAiBzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AA+B9B,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAWvF,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AA4DjE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAkG/F;0CAC0C;AAC1C,eAAO,MAAM,eAAe,GAAI,OAAO;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OACT,CAAC;AAErD;8EAC8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhD;AAqUD,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACtC;AA6DD,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAkFD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAu/DvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAyBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAiBzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAsC9B,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAWvF,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AA4DjE,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACrB,MAAM,YAAY,CAAC;AAoGpB;0CAC0C;AAC1C,eAAO,MAAM,eAAe,GAAI,OAAO;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OACT,CAAC;AAErD;8EAC8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhD;AAqUD,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACtC;AA6DD,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAkFD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAmlEvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAyBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -3,7 +3,8 @@ import { defaultRegistry, isRefSentinel, isTaggedSentinel, plainChainOf, } from
 import { AliasResolver, scopeResolverForModule, } from "./alias-resolver.js";
 import { buildCelEnvironment, isKindDocument, } from "./cel-environment.js";
 import { DefinitionRegistry } from "./definition-registry.js";
-import { effectiveAuthorSchema } from "./extends-resolution.js";
+import { readDeprecation } from "./deprecation.js";
+import { effectiveAuthorSchema, inheritedCapability, inheritedRequiredFields, } from "./extends-resolution.js";
 import { analyzerContractScope, resolveContract, } from "./invocation-contract.js";
 import { buildCallGraph } from "./call-graph.js";
 import { buildDependencyGraph, formatCycle } from "./dependency-graph.js";
@@ -44,9 +45,9 @@ import { validateSchemaTypeRefs } from "./validate-schema-type-refs.js";
 import { rewriteSyntheticOrigins } from "./rewrite-synthetic-origins.js";
 import { celTypeSatisfiesJsonSchema, checkSchemaCompatibility, navigateSchemaToExprPath, substituteCelFields, validateAgainstSchema, } from "./schema-compat.js";
 import { collectValueSchemaIssues } from "./validate-value-schema.js";
-import { DiagnosticSeverity } from "./types.js";
+import { DiagnosticSeverity, DiagnosticTag, } from "./types.js";
 import { extractAccessChains, } from "./validate-cel-context.js";
-import { celEvalModeAt, celEvalSites, mergeCelEvalSites, NO_CEL_EVAL_SITES, } from "./eval-paths.js";
+import { celEvalModeAt, celEvalSites, implicitEvalSites, mergeCelEvalSites, NO_CEL_EVAL_SITES, } from "./eval-paths.js";
 import { BINDINGS_ANNOTATION, findBindingSites, resolveBindingOrder, } from "./cel-bindings.js";
 import { CEL_RESERVED_WORDS, checkName } from "./identifier-name.js";
 import { validateIdentifierNames } from "./validate-identifier-names.js";
@@ -65,7 +66,8 @@ import { kindSatisfies, validateReferences } from "./validate-references.js";
 import { validateReferenceForms } from "./validate-reference-forms.js";
 import { isInjectedDeclaration } from "./resource-input.js";
 import { validateResourceInputs } from "./validate-resource-inputs.js";
-import { validateTemplateDispatch } from "./validate-template-dispatch.js";
+import { validateExports } from "./validate-exports.js";
+import { validateTemplateBody } from "./validate-template-body.js";
 import { validateUnusedDeclarations } from "./validate-unused-declarations.js";
 import { validateThrowsCoverage } from "./validate-throws-coverage.js";
 import { readStepSlot } from "./step-slot.js";
@@ -1308,7 +1310,7 @@ export class StaticAnalyzer {
             // unchecked where it is declared and its consequences land at whichever
             // CEL site reads it — for a hyphen, sometimes as silent arithmetic. Takes
             // the call graph for step names rather than re-walking the step arrays.
-            diagnostics.push(...validateIdentifierNames(allManifests, defs, aliases, rootModules, getCallGraph()));
+            diagnostics.push(...validateIdentifierNames(allManifests, defs, aliases, rootModules, getCallGraph(), { aliasesByModule, rootModules }));
             // A file embed resolves at resource creation, so one written on a doc that
             // is never instantiated is read by nothing and would ship silently.
             diagnostics.push(...validateIncludePlacement(allManifests));
@@ -1652,6 +1654,45 @@ export class StaticAnalyzer {
                 });
                 continue;
             }
+            // A kind its own author marked `metadata.deprecated` still works exactly as
+            // it did — the manifest is valid and keeps running — so this is a WARNING,
+            // reported at the declaration because `kind:` is the line that has to
+            // change. Emitted here rather than in a pass of its own so it reads the
+            // kind THIS walk resolved: the resolution is alias- and gate-aware and
+            // scope-dependent, and a second implementation of it would eventually
+            // disagree about which definition a name means.
+            //
+            // Entry-module-scoped, like every other "not the consumer's to fix" check:
+            // a library's internal use of a kind its own author deprecated is that
+            // author's concern, and reporting it floods a consumer with lines they
+            // cannot act on.
+            //
+            // No `DiagnosticFix`. `replacedBy` names a kind through the DECLARING
+            // module's aliases; writing it into the consumer's file would produce a
+            // prefix that resolves to nothing there — and a kind swap is not a
+            // whole-value replacement anyway, since the successor needs its own import
+            // and usually a different configuration.
+            const deprecation = readDeprecation(definition.metadata);
+            if (deprecation && (!ownModule || rootModules.has(ownModule))) {
+                // Quoted CANONICALLY, not verbatim: `Self.Thing` is how the declaring
+                // library names its own kind and means nothing where the warning lands.
+                const declaringScope = scopeResolverForModule(definition.metadata?.module, rootModules, aliasesByModule) ?? aliases;
+                const replacement = deprecation.replacedBy
+                    ? (declaringScope.resolveKind(deprecation.replacedBy) ?? deprecation.replacedBy)
+                    : undefined;
+                diagnostics.push({
+                    severity: DiagnosticSeverity.Warning,
+                    code: "DEPRECATED_KIND",
+                    source: SOURCE,
+                    // Warning-grade AND a deprecation: the severity says it must
+                    // eventually be dealt with, the tag says what it is, and an editor
+                    // strikes the kind through on the strength of the second.
+                    tags: [DiagnosticTag.Deprecated],
+                    message: `Kind '${m.kind}' is deprecated: ${deprecation.reason}` +
+                        (replacement ? ` Use '${replacement}' instead.` : ""),
+                    data: { resource, filePath, path: "kind" },
+                });
+            }
             // Validate resource config against the definition's AUTHOR-FACING schema —
             // inheritance-resolved, with `kind` / `metadata` injected. See
             // `validationSchemaFor`, which is where both derivations and the reason
@@ -1706,12 +1747,37 @@ export class StaticAnalyzer {
                 // is caught here rather than on the one input that selects it.
                 const valueSchemaIssues = collectValueSchemaIssues(m, schema, allManifests);
                 const issues = [...ajvIssues, ...valueSchemaIssues];
+                // WHY A FIELD THIS KIND EXISTS TO SUPPLY IS STILL REQUIRED OF ITS
+                // CONSUMER. A child that `extends` and declares no `base:` is authored
+                // against merge(parent, own), so the parent's `required` stays on the
+                // CHILD's surface — and a kind written to wire that field internally
+                // then demands it from the consumer anyway. The `base:` mapping is what
+                // narrows (with it the surface is the child's own schema alone), and
+                // nothing in "is missing required property" points there, which is what
+                // turns one mistake into a three-step dead end.
+                //
+                // Matched against names DERIVED from the parent, never by parsing the
+                // message: which fields are inherited is a fact about the definition,
+                // and a check that reads a validator's prose breaks when the prose does.
+                const inheritedRequired = inheritedRequiredFields(definition, (k) => defs.resolve(aliases.resolveKind(k) ?? k) ?? defs.resolve(k));
+                const parentKind = definition?.extends;
                 for (const issue of issues) {
+                    // Keyed on the STRUCTURED failure, never on the sentence: the field
+                    // names are derived from the parent, and matching them against the
+                    // validator's prose would break when the prose changes and mis-fire on
+                    // any other issue quoting the same name (an `additionalProperties`
+                    // rejection, an `enum` listing).
+                    const inherited = issue.keyword === "required" && issue.missingProperty !== undefined
+                        ? inheritedRequired.filter((f) => f === issue.missingProperty)
+                        : [];
+                    const hint = inherited.length > 0 && parentKind
+                        ? ` — ${inherited.map((f) => `'${f}'`).join(", ")} ${inherited.length > 1 ? "come" : "comes"} from '${parentKind}', which this kind extends without a 'base:' mapping, so the parent's required fields stay on this kind's author surface. Add 'base:' to set them internally; that also narrows the surface to this kind's own schema.`
+                        : "";
                     diagnostics.push({
                         severity: DiagnosticSeverity.Error,
                         code: "SCHEMA_VIOLATION",
                         source: SOURCE,
-                        message: `${m.kind}/${resource.name}: ${issue.message}`,
+                        message: `${m.kind}/${resource.name}: ${issue.message}${hint}`,
                         data: { resource, filePath, path: issue.path },
                     });
                 }
@@ -2076,8 +2142,14 @@ export class StaticAnalyzer {
                 }
                 // The non-eval-field check only applies to runtime resource instances:
                 // structural / templating kinds (capability `Telo.Template`, or no
-                // definition) carry CEL the kernel evaluates by other rules.
-                const capability = e.definition?.capability;
+                // definition) carry CEL the kernel evaluates by other rules. The
+                // capability is INHERITED along `extends` — an inheritance kind
+                // writes none of its own — and reading the declared one left the
+                // rule off for every such kind, and its expressions untyped.
+                const resolveDef = (k) => defs.resolve(aliases.resolveKind(k) ?? k) ?? defs.resolve(k);
+                const capability = e.definition
+                    ? inheritedCapability(e.definition, resolveDef)
+                    : undefined;
                 celRuleApplies =
                     !!e.definition?.schema && capability !== undefined && capability !== "Telo.Template";
                 if (celRuleApplies) {
@@ -2089,12 +2161,14 @@ export class StaticAnalyzer {
                     // the own schema here reported `CEL_IN_NON_EVAL_FIELD` for an
                     // expression the runtime evaluates correctly, which is the two halves
                     // disagreeing about what the manifest means.
-                    const ownSchema = effectiveAuthorSchema(e.definition, (k) => defs.resolve(aliases.resolveKind(k) ?? k) ?? defs.resolve(k));
+                    const ownSchema = effectiveAuthorSchema(e.definition, resolveDef);
                     const capabilityDef = capability ? defs.resolve(capability) : undefined;
                     // A `Telo.Provider`'s fields are implicitly compile-eval — the
                     // capability abstract carries the root annotation — so its reads are
-                    // covered here without the provider restating anything.
-                    celSites = mergeCelEvalSites(celEvalSites(ownSchema), celEvalSites(capabilityDef?.schema));
+                    // covered here without the provider restating anything. A base-form
+                    // child's own fields are too (`implicitEvalSites`): `base:` reads
+                    // them once at create().
+                    celSites = mergeCelEvalSites(celEvalSites(ownSchema), celEvalSites(capabilityDef?.schema), implicitEvalSites(e.definition));
                 }
                 else {
                     celSites = NO_CEL_EVAL_SITES;
@@ -2363,10 +2437,13 @@ export class StaticAnalyzer {
         diagnostics.push(...validateThrowsCoverage(allManifests, defs, aliases, this.celEnv, aliasesByModule, rootModules, libraryManifests));
         // Warn about declared variables / secrets / ports that no CEL references.
         diagnostics.push(...validateUnusedDeclarations(allManifests, this.celEnv));
-        // A `!ref` at a definition's dispatch slot must name a sibling `resources:`
-        // entry — the slot no reference pass reaches, so the tag would otherwise
-        // advertise a resolution nothing performs.
-        diagnostics.push(...validateTemplateDispatch(allManifests, rootModules));
+        // A template body's reference surface — its entry names, its dispatch slots
+        // and the ref slots inside each entry — which no reference pass reaches,
+        // since a `Telo.Definition` is in both skip sets.
+        diagnostics.push(...validateTemplateBody(allManifests, defs, aliases, aliasesByModule, rootModules));
+        // A library's export list, resolved against what it declares — otherwise a
+        // listed name that exists nowhere fails in the consumer's file.
+        diagnostics.push(...validateExports(allManifests, defs, aliases, rootModules));
         // A library's declared resource inputs, and every import that supplies them.
         diagnostics.push(...validateResourceInputs(allManifests, defs, aliases, rootModules, (supplied, required, isDeclaration) => kindSatisfies(supplied, required, defs, isDeclaration)));
         // Reroute diagnostics on synthetic (inline-extracted) resources back to

package/dist/builtins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AA8OvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EA+tB/C,CAAC"}
+{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAiFA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AA8OvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EA2pB/C,CAAC"}

package/dist/builtins.js

@@ -20,6 +20,60 @@ const observedStateSlot = {
     description: "What a resource of this kind reports while running, published at `resources.<name>.status.<field>`.",
     $ref: manifestFragmentRef("JsonSchema7"),
 };
+/** The `self`-only CEL scope a dispatch slot's name template is written in. */
+const dispatchSelfContext = {
+    type: "object",
+    additionalProperties: false,
+    properties: { self: { "x-telo-context-from-root": "schema" } },
+};
+/**
+ * A `Telo.Definition` dispatch slot: which `resources:` entry receives the call.
+ *
+ * Three shapes, and the union is what keeps the slot CONSTRAINED for manifests
+ * no pass walks — `validate-template-body` resolves the target and its
+ * capability, but it is entry-scoped, so a dependency's definition would
+ * otherwise have nothing checking this slot at all. An array or a number fails
+ * every branch here, which is the floor AJV used to provide.
+ *
+ * `anyOf`, never `oneOf`: a `!ref` sentinel is an object, so it would match both
+ * the sentinel branch and any permissive object branch and then fail for
+ * matching twice. That is also how the sentinel used to pass — the legacy object
+ * branch required nothing, so it accepted one by accident; here it is a branch
+ * of its own that says so.
+ */
+function dispatchSlot(title, description) {
+    return {
+        title,
+        description,
+        anyOf: [
+            // `!ref <entry>` — the spelling to write.
+            {
+                type: "object",
+                required: ["__tagged", "engine", "source"],
+                properties: {
+                    __tagged: { const: true },
+                    engine: { const: "ref" },
+                    source: { type: "string", minLength: 1 },
+                },
+                additionalProperties: false,
+            },
+            // Legacy: a name template expanded against `self`. Read forever, because
+            // published artifacts carry it; `DEPRECATED_TEMPLATE_DISPATCH_FORM` is
+            // what moves an author off it.
+            { type: "string", "x-telo-context": dispatchSelfContext },
+            // Legacy: `{ kind?, name }`, where `name` is that same template.
+            {
+                type: "object",
+                required: ["name"],
+                properties: {
+                    kind: { type: "string" },
+                    name: { type: "string", "x-telo-context": dispatchSelfContext },
+                },
+                additionalProperties: true,
+            },
+        ],
+    };
+}
 /** Descriptive provenance a module declares about itself, shared by
  *  `Telo.Application` and `Telo.Library`.
  *
@@ -459,99 +513,19 @@ export const KERNEL_BUILTINS = [
                         },
                     },
                 },
-                invoke: {
-                    oneOf: [
-                        {
-                            type: "string",
-                            "x-telo-context": {
-                                type: "object",
-                                additionalProperties: false,
-                                properties: {
-                                    self: { "x-telo-context-from-root": "schema" },
-                                },
-                            },
-                        },
-                        {
-                            type: "object",
-                            additionalProperties: true,
-                            properties: {
-                                kind: { type: "string" },
-                                name: {
-                                    type: "string",
-                                    "x-telo-context": {
-                                        type: "object",
-                                        additionalProperties: false,
-                                        properties: {
-                                            self: { "x-telo-context-from-root": "schema" },
-                                        },
-                                    },
-                                },
-                            },
-                        },
-                    ],
-                },
-                provide: {
-                    type: "object",
-                    additionalProperties: true,
-                    properties: {
-                        kind: { type: "string" },
-                        name: {
-                            type: "string",
-                            "x-telo-context": {
-                                type: "object",
-                                additionalProperties: false,
-                                properties: {
-                                    self: { "x-telo-context-from-root": "schema" },
-                                },
-                            },
-                        },
-                    },
-                },
-                run: {
-                    type: "string",
-                    "x-telo-context": {
-                        type: "object",
-                        additionalProperties: false,
-                        properties: {
-                            self: { "x-telo-context-from-root": "schema" },
-                        },
-                    },
-                },
-                // Mount dispatch: names the `resources:` entry (a Telo.Mount, e.g. an
-                // Http.Api) whose `register()` this definition delegates to. Same
-                // string / { kind, name } grammar as `invoke:`. The named child stays
-                // persistent so the produced mount's routes can `!ref` its siblings.
-                mount: {
-                    oneOf: [
-                        {
-                            type: "string",
-                            "x-telo-context": {
-                                type: "object",
-                                additionalProperties: false,
-                                properties: {
-                                    self: { "x-telo-context-from-root": "schema" },
-                                },
-                            },
-                        },
-                        {
-                            type: "object",
-                            additionalProperties: true,
-                            properties: {
-                                kind: { type: "string" },
-                                name: {
-                                    type: "string",
-                                    "x-telo-context": {
-                                        type: "object",
-                                        additionalProperties: false,
-                                        properties: {
-                                            self: { "x-telo-context-from-root": "schema" },
-                                        },
-                                    },
-                                },
-                            },
-                        },
-                    ],
-                },
+                // A dispatch slot names the `resources:` entry that receives the call,
+                // as `!ref <entry>` — the one spelling every reference in Telo has. The
+                // string and `{ kind, name }` forms it used to admit (a CEL name
+                // template matched against CEL-named entries) were the removed
+                // reference object surviving in the one place nothing resolved it;
+                // `validate-template-body` is what resolves this slot, so the schema
+                // stays open here rather than reporting the same defect twice.
+                invoke: dispatchSlot("Invoke target", "The `resources:` entry whose `invoke()` this kind dispatches to, as `!ref <entry>`."),
+                provide: dispatchSlot("Provide target", "The `resources:` entry whose `invoke()` produces this provider's value, as `!ref <entry>`."),
+                run: dispatchSlot("Run target", "The `resources:` entry whose `run()` this kind dispatches to, as `!ref <entry>`."),
+                // The named child stays persistent so the produced mount's routes can
+                // `!ref` its siblings.
+                mount: dispatchSlot("Mount target", "The `resources:` entry (a Telo.Mount, e.g. an Http.Api) whose `register()` this kind delegates to, as `!ref <entry>`."),
                 inputs: {
                     type: "object",
                     additionalProperties: true,
@@ -572,11 +546,11 @@ export const KERNEL_BUILTINS = [
                         additionalProperties: false,
                         properties: {
                             self: { "x-telo-context-from-root": "schema" },
+                            // Typed from the dispatch target's declared output: the slot
+                            // holds a `!ref` to a `resources:` entry, resolved to that
+                            // entry's kind (or its own `outputType`, where it narrows one).
                             result: {
-                                "x-telo-context-from-ref-kind": [
-                                    "provide/kind#outputType",
-                                    "invoke/kind#outputType",
-                                ],
+                                "x-telo-context-from-ref-kind": ["provide#outputType", "invoke#outputType"],
                             },
                         },
                     },

package/dist/catch-scope.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Which `catches:` lists answer for one dispatch site.
+ *
+ * A catch list is one rung of a SCOPE LADDER — a route's, its router's, its
+ * server's — and every rule over those lists needs the same two answers: what
+ * a scope list is checked against, and which scopes enclose a given site. This
+ * module owns that model; the rule checks in `validate-throws-coverage.ts` read
+ * one answer instead of rebuilding it beside four unrelated jobs.
+ *
+ * Browser-safe: no Node built-ins.
+ */
+import type { DefinitionRegistry } from "./definition-registry.js";
+import type { AliasResolver } from "./alias-resolver.js";
+import type { ResourceManifest } from "@telorun/sdk";
+import { type ResolveCtx } from "./resolve-throws-union.js";
+/** What a list proves it renders: the codes its coverage-proving `when:` clauses
+ *  name, and whether it ends in a catch-all.
+ *
+ *  Unfiltered by any denominator, because this is also what an enclosing scope
+ *  contributes DOWNWARD — a server entry naming a code the server's own closure
+ *  could not enumerate still renders it for the route that throws it. Filtering
+ *  the local answer against the declared union happens where that answer is
+ *  used, and subtracting from the declared set makes the two equivalent there. */
+export interface ProvenCoverage {
+    codes: Set<string>;
+    hasCatchAll: boolean;
+}
+export declare const NO_COVERAGE: ProvenCoverage;
+/** A declaration inside another resource's `x-telo-scope` array, kept with the
+ *  resource that encloses it and the path it is written at in that resource's
+ *  document. Both are needed: the owner is the only place its kind's alias scope
+ *  can be found, and the only document position lookup can reach. */
+export interface ScopedManifest {
+    manifest: ResourceManifest;
+    owner: ResourceManifest;
+    /** Concrete owner-relative path of the declaration (`with[0]`). */
+    path: string;
+}
+/** Every `with:`-scoped declaration in the set, once each.
+ *
+ *  Scoped resources are absent from the flat manifest list, so every check that
+ *  iterates it skips them — and standing a server up around a test is exactly
+ *  that shape, so the sanctioned pattern was the one the pass could not see.
+ *  Discovered through the shared visitor rather than a second scope walk. */
+export declare function collectScopedManifests(manifests: ResourceManifest[], defs: DefinitionRegistry, aliases: AliasResolver, aliasesByModule: Map<string, AliasResolver>, rootModules: Set<string>): ScopedManifest[];
+/** Which resources each resource's scope list encloses, along the slots that
+ *  declare `throwsThrough` — one fact stated once, since the edge a throws
+ *  closure crosses is the edge a catch scope encloses through. */
+export declare function buildEnclosers(manifests: ResourceManifest[], definitionOf: (m: ResourceManifest) => {
+    schema?: Record<string, any>;
+} | undefined, moduleOf: (m: ResourceManifest) => string | undefined, ctx: ResolveCtx): Map<ResourceManifest, ResourceManifest[]>;
+/**
+ * What every scope enclosing a resource is guaranteed to render for it.
+ *
+ * **Across enclosers this INTERSECTS, and that is the whole correctness of the
+ * reduction.** Coverage claims that a throw cannot escape unrendered, so it holds
+ * only when EVERY path to the site renders it — a router mounted on a public
+ * server with a catch-all and an internal one without is covered on one path and
+ * bare on the other, and unioning the two reported it as fully covered while the
+ * internal server answered with the built-in envelope. A resource with no
+ * encloser contributes nothing rather than everything: the empty set is the
+ * identity for the site's own coverage, and treating "no paths" as "all paths
+ * agree" would assert coverage no list provides.
+ *
+ * A resource's OWN scope list is unioned in, because it applies on every path.
+ *
+ * Memoized, and a cycle among `throwsThrough` edges resolves to what has been
+ * accumulated so far rather than raising: this answers what a scope renders, and
+ * no cycle makes that answer larger.
+ */
+export declare function enclosingCoverage(manifest: ResourceManifest, ownScope: Map<ResourceManifest, ProvenCoverage>, enclosers: Map<ResourceManifest, ResourceManifest[]>, memo?: Map<ResourceManifest, ProvenCoverage>, walking?: Set<ResourceManifest>): ProvenCoverage;
+//# sourceMappingURL=catch-scope.d.ts.map

package/dist/catch-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catch-scope.d.ts","sourceRoot":"","sources":["../src/catch-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrD,OAAO,EAAsB,KAAK,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAEhF;;;;;;;kFAOkF;AAClF,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,eAAO,MAAM,WAAW,EAAE,cAAyD,CAAC;AAEpF;;;qEAGqE;AACrE,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,KAAK,EAAE,gBAAgB,CAAC;IACxB,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;6EAK6E;AAC7E,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAC3C,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,GACvB,cAAc,EAAE,CAgBlB;AAED;;kEAEkE;AAClE,wBAAgB,cAAc,CAC5B,SAAS,EAAE,gBAAgB,EAAE,EAC7B,YAAY,EAAE,CAAC,CAAC,EAAE,gBAAgB,KAAK;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,GAAG,SAAS,EACnF,QAAQ,EAAE,CAAC,CAAC,EAAE,gBAAgB,KAAK,MAAM,GAAG,SAAS,EACrD,GAAG,EAAE,UAAU,GACd,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,CAAC,CAe3C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE,GAAG,CAAC,gBAAgB,EAAE,cAAc,CAAC,EAC/C,SAAS,EAAE,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,CAAC,EACpD,IAAI,GAAE,GAAG,CAAC,gBAAgB,EAAE,cAAc,CAAa,EACvD,OAAO,GAAE,GAAG,CAAC,gBAAgB,CAAa,GACzC,cAAc,CAgChB"}

package/dist/catch-scope.js

@@ -0,0 +1,102 @@
+import { visitManifest } from "./manifest-visitor.js";
+import { forEachDrivenSlot } from "./schema-walk.js";
+import { resolveRefManifest } from "./resolve-throws-union.js";
+export const NO_COVERAGE = { codes: new Set(), hasCatchAll: false };
+/** Every `with:`-scoped declaration in the set, once each.
+ *
+ *  Scoped resources are absent from the flat manifest list, so every check that
+ *  iterates it skips them — and standing a server up around a test is exactly
+ *  that shape, so the sanctioned pattern was the one the pass could not see.
+ *  Discovered through the shared visitor rather than a second scope walk. */
+export function collectScopedManifests(manifests, defs, aliases, aliasesByModule, rootModules) {
+    const scoped = [];
+    visitManifest(manifests, defs, {
+        onScope: (event) => {
+            for (const { manifest, path } of event.declarations) {
+                if (!manifest?.kind || !manifest.metadata?.name)
+                    continue;
+                scoped.push({ manifest, owner: event.source, path });
+            }
+        },
+    }, { aliases, aliasesByModule, rootModules });
+    return scoped;
+}
+/** Which resources each resource's scope list encloses, along the slots that
+ *  declare `throwsThrough` — one fact stated once, since the edge a throws
+ *  closure crosses is the edge a catch scope encloses through. */
+export function buildEnclosers(manifests, definitionOf, moduleOf, ctx) {
+    const enclosers = new Map();
+    for (const manifest of manifests) {
+        const definition = definitionOf(manifest);
+        if (!definition?.schema)
+            continue;
+        forEachDrivenSlot(definition.schema, manifest, (driven) => {
+            if (driven.kind !== "ref" || !driven.slot.throwsThrough)
+                return;
+            const target = resolveRefManifest(driven.data, ctx, moduleOf(manifest));
+            if (!target || target === manifest)
+                return;
+            const list = enclosers.get(target);
+            if (list)
+                list.push(manifest);
+            else
+                enclosers.set(target, [manifest]);
+        });
+    }
+    return enclosers;
+}
+/**
+ * What every scope enclosing a resource is guaranteed to render for it.
+ *
+ * **Across enclosers this INTERSECTS, and that is the whole correctness of the
+ * reduction.** Coverage claims that a throw cannot escape unrendered, so it holds
+ * only when EVERY path to the site renders it — a router mounted on a public
+ * server with a catch-all and an internal one without is covered on one path and
+ * bare on the other, and unioning the two reported it as fully covered while the
+ * internal server answered with the built-in envelope. A resource with no
+ * encloser contributes nothing rather than everything: the empty set is the
+ * identity for the site's own coverage, and treating "no paths" as "all paths
+ * agree" would assert coverage no list provides.
+ *
+ * A resource's OWN scope list is unioned in, because it applies on every path.
+ *
+ * Memoized, and a cycle among `throwsThrough` edges resolves to what has been
+ * accumulated so far rather than raising: this answers what a scope renders, and
+ * no cycle makes that answer larger.
+ */
+export function enclosingCoverage(manifest, ownScope, enclosers, memo = new Map(), walking = new Set()) {
+    const cached = memo.get(manifest);
+    if (cached)
+        return cached;
+    if (walking.has(manifest))
+        return NO_COVERAGE;
+    walking.add(manifest);
+    try {
+        const own = ownScope.get(manifest);
+        const result = {
+            codes: new Set(own?.codes ?? []),
+            hasCatchAll: own?.hasCatchAll ?? false,
+        };
+        const outer = (enclosers.get(manifest) ?? []).map((e) => enclosingCoverage(e, ownScope, enclosers, memo, walking));
+        if (outer.length > 0) {
+            const [first, ...rest] = outer;
+            const shared = new Set(first.codes);
+            let everyCatchAll = first.hasCatchAll;
+            for (const other of rest) {
+                for (const code of [...shared])
+                    if (!other.codes.has(code))
+                        shared.delete(code);
+                everyCatchAll &&= other.hasCatchAll;
+            }
+            for (const code of shared)
+                result.codes.add(code);
+            if (everyCatchAll)
+                result.hasCatchAll = true;
+        }
+        memo.set(manifest, result);
+        return result;
+    }
+    finally {
+        walking.delete(manifest);
+    }
+}

package/dist/cel-scope-query.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cel-scope-query.d.ts","sourceRoot":"","sources":["../src/cel-scope-query.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAqB,MAAM,qBAAqB,CAAC;AAEvE,OAAO,EAAoB,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAkB9D;;;sCAGsC;AACtC,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;;iEAI6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAoBD;gEACgE;AAChE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CAC7C;AAED;;;;;;GAMG;AACH,qBAAa,aAAa;IActB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAb5B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmB;IAC5C;;oDAEgD;IAChD,OAAO,CAAC,OAAO,CAA+B;IAC9C;;;;sEAIkE;IAClE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsD;gBAG9D,SAAS,EAAE,gBAAgB,EAAE,EAC9C,GAAG,EAAE,oBAAoB,EACzB,MAAM,CAAC,EAAE,WAAW;IAgCtB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAuB;IAE3C;+DAC2D;IAC3D,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,gBAAgB,GAAG,SAAS;IAI7F;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,GAAG,QAAQ;IAe3D;;;;;;;;;;;;;;;;;;OAkBG;IACH,sBAAsB,CACpB,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EAAE,GACd,sBAAsB,GAAG,SAAS;IA0CrC;oFACgF;IAChF,OAAO,CAAC,QAAQ;IAgFhB;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAqBrF;;;;;;;sDAOkD;IAClD,OAAO,CAAC,aAAa;IAOrB;wEACoE;IACpE,OAAO,CAAC,YAAY;CAarB"}
+{"version":3,"file":"cel-scope-query.d.ts","sourceRoot":"","sources":["../src/cel-scope-query.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAqB,MAAM,qBAAqB,CAAC;AAEvE,OAAO,EAAoB,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAmB9D;;;sCAGsC;AACtC,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;;iEAI6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAoBD;gEACgE;AAChE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CAC7C;AAED;;;;;;GAMG;AACH,qBAAa,aAAa;IActB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAb5B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmB;IAC5C;;oDAEgD;IAChD,OAAO,CAAC,OAAO,CAA+B;IAC9C;;;;sEAIkE;IAClE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsD;gBAG9D,SAAS,EAAE,gBAAgB,EAAE,EAC9C,GAAG,EAAE,oBAAoB,EACzB,MAAM,CAAC,EAAE,WAAW;IAgCtB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAuB;IAE3C;+DAC2D;IAC3D,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,gBAAgB,GAAG,SAAS;IAI7F;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,GAAG,QAAQ;IAe3D;;;;;;;;;;;;;;;;;;OAkBG;IACH,sBAAsB,CACpB,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EAAE,GACd,sBAAsB,GAAG,SAAS;IA0CrC;oFACgF;IAChF,OAAO,CAAC,QAAQ;IAkGhB;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAqBrF;;;;;;;sDAOkD;IAClD,OAAO,CAAC,aAAa;IAOrB;wEACoE;IACpE,OAAO,CAAC,YAAY;CAarB"}

package/dist/cel-scope-query.js

@@ -4,6 +4,7 @@ import { buildKernelGlobalsIndex } from "./kernel-globals.js";
 import { moduleAliasScope } from "./module-alias-scope.js";
 import { isModuleKind } from "./module-kinds.js";
 import { navigateConcretePath } from "./manifest-path.js";
+import { kindAtPath } from "./validate-cel-context.js";
 import { findManifest } from "./find-manifest.js";
 import { resolveLocalRef, walkStepArray } from "./schema-walk.js";
 import { readStepSlot } from "./step-slot.js";
@@ -200,16 +201,30 @@ export class CelScopeQuery {
             return { manifest: target, path: refFrom.slice(slash + 1).split("/").join("."), propertyMap: false };
         }
         // A kind's own declaration: the target is the `Telo.Definition` document,
-        // which is an ordinary manifest in the set.
+        // which is an ordinary manifest in the set. The slot holds a `!ref` to a
+        // `resources:` entry; the entry's own field wins where it narrows one, else
+        // the declaration is the entry's KIND. The first slot that resolves to an
+        // entry is the one the type resolver reads, so it is the one navigated.
         const fromRefKind = annotated["x-telo-context-from-ref-kind"];
-        const first = Array.isArray(fromRefKind) ? fromRefKind[0] : fromRefKind;
-        if (typeof first === "string") {
-            const hash = first.indexOf("#");
+        const slots = Array.isArray(fromRefKind) ? fromRefKind : [fromRefKind];
+        for (const slotSpec of slots) {
+            if (typeof slotSpec !== "string")
+                continue;
+            const hash = slotSpec.indexOf("#");
+            // `continue`, never `return`: a malformed spec is one entry of a list the
+            // type resolver walks to the end, and aborting here made the two answer
+            // differently for the same annotation.
             if (hash <= 0)
-                return undefined;
-            const kindValue = navigateConcretePath(root, first.slice(0, hash).split("/").join("."));
-            if (typeof kindValue !== "string")
-                return undefined;
+                continue;
+            const field = slotSpec.slice(hash + 1);
+            const namedKind = kindAtPath(root, slotSpec.slice(0, hash));
+            if (!namedKind)
+                continue;
+            if (namedKind.entry?.[field] !== undefined) {
+                const index = root.resources.indexOf(namedKind.entry);
+                return { manifest: resource, path: `resources[${index}].${field}`, propertyMap: false };
+            }
+            const kindValue = namedKind.kind;
             // The kind was read off THIS resource, so it is spelled in the alias scope
             // of the module that declared it — not the entry's.
             const scope = moduleAliasScope(resource.metadata, this.ctx.aliases, this.ctx.aliasesByModule);
@@ -229,10 +244,16 @@ export class CelScopeQuery {
             const target = (owningModule
                 ? named.find((m) => m.metadata?.module === owningModule)
                 : undefined) ?? (owningModule && named.length > 1 ? undefined : named[0]);
-            if (!target)
-                return undefined;
-            return { manifest: target, path: first.slice(hash + 1), propertyMap: false };
+            // Fall through to the next spec when this one names no kind, or names one
+            // that does not declare the field — the same order the TYPE resolver
+            // takes, so go-to-declaration lands where the type came from instead of on
+            // a field the target never had.
+            if (!target || target[field] === undefined)
+                continue;
+            return { manifest: target, path: field, propertyMap: false };
         }
+        if (slots.some((s) => typeof s === "string"))
+            return undefined;
         // `x-telo-context-element-from` / `-collection-from` type a binding from an
         // EXPRESSION, so there is no declaration to navigate to.
         return undefined;