@telorun/analyzer 0.71.0 → 0.73.0

package/src/analyzer.ts

@@ -24,7 +24,14 @@ import {
   type CelHandlers,
 } from "./cel-environment.js";
 import { DefinitionRegistry } from "./definition-registry.js";
-import { type ContractDirection, effectiveAuthorSchema } from "./extends-resolution.js";
+import { readDeprecation } from "./deprecation.js";
+import {
+  type ContractDirection,
+  type DefResolver,
+  effectiveAuthorSchema,
+  inheritedCapability,
+  inheritedRequiredFields,
+} from "./extends-resolution.js";
 import {
   analyzerContractScope,
   type ContractScope,
@@ -125,7 +132,12 @@ import {
   type SchemaIssue,
 } from "./schema-compat.js";
 import { collectValueSchemaIssues } from "./validate-value-schema.js";
-import { DiagnosticSeverity, type AnalysisDiagnostic, type AnalysisOptions } from "./types.js";
+import {
+  DiagnosticSeverity,
+  DiagnosticTag,
+  type AnalysisDiagnostic,
+  type AnalysisOptions,
+} from "./types.js";
 import {
   extractAccessChains,
   extractContextsFromSchema,
@@ -136,6 +148,7 @@ import {
 import {
   celEvalModeAt,
   celEvalSites,
+  implicitEvalSites,
   mergeCelEvalSites,
   NO_CEL_EVAL_SITES,
   type CelEvalSites,
@@ -166,7 +179,8 @@ import { kindSatisfies, validateReferences } from "./validate-references.js";
 import { validateReferenceForms } from "./validate-reference-forms.js";
 import { isInjectedDeclaration } from "./resource-input.js";
 import { validateResourceInputs } from "./validate-resource-inputs.js";
-import { validateTemplateDispatch } from "./validate-template-dispatch.js";
+import { validateExports } from "./validate-exports.js";
+import { validateTemplateBody } from "./validate-template-body.js";
 import { validateUnusedDeclarations } from "./validate-unused-declarations.js";
 import { validateThrowsCoverage } from "./validate-throws-coverage.js";
 import { readStepSlot } from "./step-slot.js";
@@ -1535,6 +1549,7 @@ export class StaticAnalyzer {
           aliases,
           rootModules,
           getCallGraph(),
+          { aliasesByModule, rootModules },
         ),
       );
       // A file embed resolves at resource creation, so one written on a doc that
@@ -1911,6 +1926,52 @@ export class StaticAnalyzer {
         continue;
       }
 
+      // A kind its own author marked `metadata.deprecated` still works exactly as
+      // it did — the manifest is valid and keeps running — so this is a WARNING,
+      // reported at the declaration because `kind:` is the line that has to
+      // change. Emitted here rather than in a pass of its own so it reads the
+      // kind THIS walk resolved: the resolution is alias- and gate-aware and
+      // scope-dependent, and a second implementation of it would eventually
+      // disagree about which definition a name means.
+      //
+      // Entry-module-scoped, like every other "not the consumer's to fix" check:
+      // a library's internal use of a kind its own author deprecated is that
+      // author's concern, and reporting it floods a consumer with lines they
+      // cannot act on.
+      //
+      // No `DiagnosticFix`. `replacedBy` names a kind through the DECLARING
+      // module's aliases; writing it into the consumer's file would produce a
+      // prefix that resolves to nothing there — and a kind swap is not a
+      // whole-value replacement anyway, since the successor needs its own import
+      // and usually a different configuration.
+      const deprecation = readDeprecation(definition.metadata);
+      if (deprecation && (!ownModule || rootModules.has(ownModule))) {
+        // Quoted CANONICALLY, not verbatim: `Self.Thing` is how the declaring
+        // library names its own kind and means nothing where the warning lands.
+        const declaringScope =
+          scopeResolverForModule(
+            (definition.metadata as { module?: string } | undefined)?.module,
+            rootModules,
+            aliasesByModule,
+          ) ?? aliases;
+        const replacement = deprecation.replacedBy
+          ? (declaringScope.resolveKind(deprecation.replacedBy) ?? deprecation.replacedBy)
+          : undefined;
+        diagnostics.push({
+          severity: DiagnosticSeverity.Warning,
+          code: "DEPRECATED_KIND",
+          source: SOURCE,
+          // Warning-grade AND a deprecation: the severity says it must
+          // eventually be dealt with, the tag says what it is, and an editor
+          // strikes the kind through on the strength of the second.
+          tags: [DiagnosticTag.Deprecated],
+          message:
+            `Kind '${m.kind}' is deprecated: ${deprecation.reason}` +
+            (replacement ? ` Use '${replacement}' instead.` : ""),
+          data: { resource, filePath, path: "kind" },
+        });
+      }
+
       // Validate resource config against the definition's AUTHOR-FACING schema —
       // inheritance-resolved, with `kind` / `metadata` injected. See
       // `validationSchemaFor`, which is where both derivations and the reason
@@ -1976,12 +2037,41 @@ export class StaticAnalyzer {
           allManifests as Record<string, any>[],
         );
         const issues = [...ajvIssues, ...valueSchemaIssues];
+        // WHY A FIELD THIS KIND EXISTS TO SUPPLY IS STILL REQUIRED OF ITS
+        // CONSUMER. A child that `extends` and declares no `base:` is authored
+        // against merge(parent, own), so the parent's `required` stays on the
+        // CHILD's surface — and a kind written to wire that field internally
+        // then demands it from the consumer anyway. The `base:` mapping is what
+        // narrows (with it the surface is the child's own schema alone), and
+        // nothing in "is missing required property" points there, which is what
+        // turns one mistake into a three-step dead end.
+        //
+        // Matched against names DERIVED from the parent, never by parsing the
+        // message: which fields are inherited is a fact about the definition,
+        // and a check that reads a validator's prose breaks when the prose does.
+        const inheritedRequired = inheritedRequiredFields(definition, (k) =>
+          defs.resolve(aliases.resolveKind(k) ?? k) ?? defs.resolve(k),
+        );
+        const parentKind = (definition as { extends?: string } | undefined)?.extends;
         for (const issue of issues) {
+          // Keyed on the STRUCTURED failure, never on the sentence: the field
+          // names are derived from the parent, and matching them against the
+          // validator's prose would break when the prose changes and mis-fire on
+          // any other issue quoting the same name (an `additionalProperties`
+          // rejection, an `enum` listing).
+          const inherited =
+            issue.keyword === "required" && issue.missingProperty !== undefined
+              ? inheritedRequired.filter((f) => f === issue.missingProperty)
+              : [];
+          const hint =
+            inherited.length > 0 && parentKind
+              ? ` — ${inherited.map((f) => `'${f}'`).join(", ")} ${inherited.length > 1 ? "come" : "comes"} from '${parentKind}', which this kind extends without a 'base:' mapping, so the parent's required fields stay on this kind's author surface. Add 'base:' to set them internally; that also narrows the surface to this kind's own schema.`
+              : "";
           diagnostics.push({
             severity: DiagnosticSeverity.Error,
             code: "SCHEMA_VIOLATION",
             source: SOURCE,
-            message: `${m.kind}/${resource.name}: ${issue.message}`,
+            message: `${m.kind}/${resource.name}: ${issue.message}${hint}`,
             data: { resource, filePath, path: issue.path },
           });
         }
@@ -2419,8 +2509,15 @@ export class StaticAnalyzer {
 
           // The non-eval-field check only applies to runtime resource instances:
           // structural / templating kinds (capability `Telo.Template`, or no
-          // definition) carry CEL the kernel evaluates by other rules.
-          const capability = e.definition?.capability;
+          // definition) carry CEL the kernel evaluates by other rules. The
+          // capability is INHERITED along `extends` — an inheritance kind
+          // writes none of its own — and reading the declared one left the
+          // rule off for every such kind, and its expressions untyped.
+          const resolveDef: DefResolver = (k) =>
+            defs.resolve(aliases.resolveKind(k) ?? k) ?? defs.resolve(k);
+          const capability = e.definition
+            ? inheritedCapability(e.definition as unknown as ResourceDefinition, resolveDef)
+            : undefined;
           celRuleApplies =
             !!e.definition?.schema && capability !== undefined && capability !== "Telo.Template";
           if (celRuleApplies) {
@@ -2434,15 +2531,18 @@ export class StaticAnalyzer {
             // disagreeing about what the manifest means.
             const ownSchema = effectiveAuthorSchema(
               e.definition as unknown as ResourceDefinition,
-              (k) => defs.resolve(aliases.resolveKind(k) ?? k) ?? defs.resolve(k),
+              resolveDef,
             ) as Record<string, any>;
             const capabilityDef = capability ? defs.resolve(capability) : undefined;
             // A `Telo.Provider`'s fields are implicitly compile-eval — the
             // capability abstract carries the root annotation — so its reads are
-            // covered here without the provider restating anything.
+            // covered here without the provider restating anything. A base-form
+            // child's own fields are too (`implicitEvalSites`): `base:` reads
+            // them once at create().
             celSites = mergeCelEvalSites(
               celEvalSites(ownSchema),
               celEvalSites(capabilityDef?.schema as Record<string, any> | undefined),
+              implicitEvalSites(e.definition as { base?: unknown }),
             );
           } else {
             celSites = NO_CEL_EVAL_SITES;
@@ -2748,10 +2848,16 @@ export class StaticAnalyzer {
     // Warn about declared variables / secrets / ports that no CEL references.
     diagnostics.push(...validateUnusedDeclarations(allManifests, this.celEnv));
 
-    // A `!ref` at a definition's dispatch slot must name a sibling `resources:`
-    // entry — the slot no reference pass reaches, so the tag would otherwise
-    // advertise a resolution nothing performs.
-    diagnostics.push(...validateTemplateDispatch(allManifests, rootModules));
+    // A template body's reference surface — its entry names, its dispatch slots
+    // and the ref slots inside each entry — which no reference pass reaches,
+    // since a `Telo.Definition` is in both skip sets.
+    diagnostics.push(
+      ...validateTemplateBody(allManifests, defs, aliases, aliasesByModule, rootModules),
+    );
+
+    // A library's export list, resolved against what it declares — otherwise a
+    // listed name that exists nowhere fails in the consumer's file.
+    diagnostics.push(...validateExports(allManifests, defs, aliases, rootModules));
 
     // A library's declared resource inputs, and every import that supplies them.
     diagnostics.push(

package/src/builtins.ts

@@ -23,6 +23,62 @@ const observedStateSlot = {
     "What a resource of this kind reports while running, published at `resources.<name>.status.<field>`.",
   $ref: manifestFragmentRef("JsonSchema7"),
 };
+
+/** The `self`-only CEL scope a dispatch slot's name template is written in. */
+const dispatchSelfContext = {
+  type: "object",
+  additionalProperties: false,
+  properties: { self: { "x-telo-context-from-root": "schema" } },
+};
+
+/**
+ * A `Telo.Definition` dispatch slot: which `resources:` entry receives the call.
+ *
+ * Three shapes, and the union is what keeps the slot CONSTRAINED for manifests
+ * no pass walks — `validate-template-body` resolves the target and its
+ * capability, but it is entry-scoped, so a dependency's definition would
+ * otherwise have nothing checking this slot at all. An array or a number fails
+ * every branch here, which is the floor AJV used to provide.
+ *
+ * `anyOf`, never `oneOf`: a `!ref` sentinel is an object, so it would match both
+ * the sentinel branch and any permissive object branch and then fail for
+ * matching twice. That is also how the sentinel used to pass — the legacy object
+ * branch required nothing, so it accepted one by accident; here it is a branch
+ * of its own that says so.
+ */
+function dispatchSlot(title: string, description: string): Record<string, unknown> {
+  return {
+    title,
+    description,
+    anyOf: [
+      // `!ref <entry>` — the spelling to write.
+      {
+        type: "object",
+        required: ["__tagged", "engine", "source"],
+        properties: {
+          __tagged: { const: true },
+          engine: { const: "ref" },
+          source: { type: "string", minLength: 1 },
+        },
+        additionalProperties: false,
+      },
+      // Legacy: a name template expanded against `self`. Read forever, because
+      // published artifacts carry it; `DEPRECATED_TEMPLATE_DISPATCH_FORM` is
+      // what moves an author off it.
+      { type: "string", "x-telo-context": dispatchSelfContext },
+      // Legacy: `{ kind?, name }`, where `name` is that same template.
+      {
+        type: "object",
+        required: ["name"],
+        properties: {
+          kind: { type: "string" },
+          name: { type: "string", "x-telo-context": dispatchSelfContext },
+        },
+        additionalProperties: true,
+      },
+    ],
+  };
+}
 import type { ResourceDefinition } from "@telorun/sdk";
 
 /** Descriptive provenance a module declares about itself, shared by
@@ -480,99 +536,31 @@ export const KERNEL_BUILTINS: ResourceDefinition[] = [
             },
           },
         },
-        invoke: {
-          oneOf: [
-            {
-              type: "string",
-              "x-telo-context": {
-                type: "object",
-                additionalProperties: false,
-                properties: {
-                  self: { "x-telo-context-from-root": "schema" },
-                },
-              },
-            },
-            {
-              type: "object",
-              additionalProperties: true,
-              properties: {
-                kind: { type: "string" },
-                name: {
-                  type: "string",
-                  "x-telo-context": {
-                    type: "object",
-                    additionalProperties: false,
-                    properties: {
-                      self: { "x-telo-context-from-root": "schema" },
-                    },
-                  },
-                },
-              },
-            },
-          ],
-        },
-        provide: {
-          type: "object",
-          additionalProperties: true,
-          properties: {
-            kind: { type: "string" },
-            name: {
-              type: "string",
-              "x-telo-context": {
-                type: "object",
-                additionalProperties: false,
-                properties: {
-                  self: { "x-telo-context-from-root": "schema" },
-                },
-              },
-            },
-          },
-        },
-        run: {
-          type: "string",
-          "x-telo-context": {
-            type: "object",
-            additionalProperties: false,
-            properties: {
-              self: { "x-telo-context-from-root": "schema" },
-            },
-          },
-        },
-        // Mount dispatch: names the `resources:` entry (a Telo.Mount, e.g. an
-        // Http.Api) whose `register()` this definition delegates to. Same
-        // string / { kind, name } grammar as `invoke:`. The named child stays
-        // persistent so the produced mount's routes can `!ref` its siblings.
-        mount: {
-          oneOf: [
-            {
-              type: "string",
-              "x-telo-context": {
-                type: "object",
-                additionalProperties: false,
-                properties: {
-                  self: { "x-telo-context-from-root": "schema" },
-                },
-              },
-            },
-            {
-              type: "object",
-              additionalProperties: true,
-              properties: {
-                kind: { type: "string" },
-                name: {
-                  type: "string",
-                  "x-telo-context": {
-                    type: "object",
-                    additionalProperties: false,
-                    properties: {
-                      self: { "x-telo-context-from-root": "schema" },
-                    },
-                  },
-                },
-              },
-            },
-          ],
-        },
+        // A dispatch slot names the `resources:` entry that receives the call,
+        // as `!ref <entry>` — the one spelling every reference in Telo has. The
+        // string and `{ kind, name }` forms it used to admit (a CEL name
+        // template matched against CEL-named entries) were the removed
+        // reference object surviving in the one place nothing resolved it;
+        // `validate-template-body` is what resolves this slot, so the schema
+        // stays open here rather than reporting the same defect twice.
+        invoke: dispatchSlot(
+          "Invoke target",
+          "The `resources:` entry whose `invoke()` this kind dispatches to, as `!ref <entry>`.",
+        ),
+        provide: dispatchSlot(
+          "Provide target",
+          "The `resources:` entry whose `invoke()` produces this provider's value, as `!ref <entry>`.",
+        ),
+        run: dispatchSlot(
+          "Run target",
+          "The `resources:` entry whose `run()` this kind dispatches to, as `!ref <entry>`.",
+        ),
+        // The named child stays persistent so the produced mount's routes can
+        // `!ref` its siblings.
+        mount: dispatchSlot(
+          "Mount target",
+          "The `resources:` entry (a Telo.Mount, e.g. an Http.Api) whose `register()` this kind delegates to, as `!ref <entry>`.",
+        ),
         inputs: {
           type: "object",
           additionalProperties: true,
@@ -593,11 +581,11 @@ export const KERNEL_BUILTINS: ResourceDefinition[] = [
             additionalProperties: false,
             properties: {
               self: { "x-telo-context-from-root": "schema" },
+              // Typed from the dispatch target's declared output: the slot
+              // holds a `!ref` to a `resources:` entry, resolved to that
+              // entry's kind (or its own `outputType`, where it narrows one).
               result: {
-                "x-telo-context-from-ref-kind": [
-                  "provide/kind#outputType",
-                  "invoke/kind#outputType",
-                ],
+                "x-telo-context-from-ref-kind": ["provide#outputType", "invoke#outputType"],
               },
             },
           },

package/src/catch-scope.ts

@@ -0,0 +1,157 @@
+/**
+ * Which `catches:` lists answer for one dispatch site.
+ *
+ * A catch list is one rung of a SCOPE LADDER — a route's, its router's, its
+ * server's — and every rule over those lists needs the same two answers: what
+ * a scope list is checked against, and which scopes enclose a given site. This
+ * module owns that model; the rule checks in `validate-throws-coverage.ts` read
+ * one answer instead of rebuilding it beside four unrelated jobs.
+ *
+ * Browser-safe: no Node built-ins.
+ */
+import type { DefinitionRegistry } from "./definition-registry.js";
+import type { AliasResolver } from "./alias-resolver.js";
+import type { ResourceManifest } from "@telorun/sdk";
+import { visitManifest } from "./manifest-visitor.js";
+import { forEachDrivenSlot } from "./schema-walk.js";
+import { resolveRefManifest, type ResolveCtx } from "./resolve-throws-union.js";
+
+/** What a list proves it renders: the codes its coverage-proving `when:` clauses
+ *  name, and whether it ends in a catch-all.
+ *
+ *  Unfiltered by any denominator, because this is also what an enclosing scope
+ *  contributes DOWNWARD — a server entry naming a code the server's own closure
+ *  could not enumerate still renders it for the route that throws it. Filtering
+ *  the local answer against the declared union happens where that answer is
+ *  used, and subtracting from the declared set makes the two equivalent there. */
+export interface ProvenCoverage {
+  codes: Set<string>;
+  hasCatchAll: boolean;
+}
+
+export const NO_COVERAGE: ProvenCoverage = { codes: new Set(), hasCatchAll: false };
+
+/** A declaration inside another resource's `x-telo-scope` array, kept with the
+ *  resource that encloses it and the path it is written at in that resource's
+ *  document. Both are needed: the owner is the only place its kind's alias scope
+ *  can be found, and the only document position lookup can reach. */
+export interface ScopedManifest {
+  manifest: ResourceManifest;
+  owner: ResourceManifest;
+  /** Concrete owner-relative path of the declaration (`with[0]`). */
+  path: string;
+}
+
+/** Every `with:`-scoped declaration in the set, once each.
+ *
+ *  Scoped resources are absent from the flat manifest list, so every check that
+ *  iterates it skips them — and standing a server up around a test is exactly
+ *  that shape, so the sanctioned pattern was the one the pass could not see.
+ *  Discovered through the shared visitor rather than a second scope walk. */
+export function collectScopedManifests(
+  manifests: ResourceManifest[],
+  defs: DefinitionRegistry,
+  aliases: AliasResolver,
+  aliasesByModule: Map<string, AliasResolver>,
+  rootModules: Set<string>,
+): ScopedManifest[] {
+  const scoped: ScopedManifest[] = [];
+  visitManifest(
+    manifests,
+    defs,
+    {
+      onScope: (event) => {
+        for (const { manifest, path } of event.declarations) {
+          if (!manifest?.kind || !manifest.metadata?.name) continue;
+          scoped.push({ manifest, owner: event.source, path });
+        }
+      },
+    },
+    { aliases, aliasesByModule, rootModules },
+  );
+  return scoped;
+}
+
+/** Which resources each resource's scope list encloses, along the slots that
+ *  declare `throwsThrough` — one fact stated once, since the edge a throws
+ *  closure crosses is the edge a catch scope encloses through. */
+export function buildEnclosers(
+  manifests: ResourceManifest[],
+  definitionOf: (m: ResourceManifest) => { schema?: Record<string, any> } | undefined,
+  moduleOf: (m: ResourceManifest) => string | undefined,
+  ctx: ResolveCtx,
+): Map<ResourceManifest, ResourceManifest[]> {
+  const enclosers = new Map<ResourceManifest, ResourceManifest[]>();
+  for (const manifest of manifests) {
+    const definition = definitionOf(manifest);
+    if (!definition?.schema) continue;
+    forEachDrivenSlot(definition.schema, manifest, (driven) => {
+      if (driven.kind !== "ref" || !driven.slot.throwsThrough) return;
+      const target = resolveRefManifest(driven.data, ctx, moduleOf(manifest));
+      if (!target || target === manifest) return;
+      const list = enclosers.get(target);
+      if (list) list.push(manifest);
+      else enclosers.set(target, [manifest]);
+    });
+  }
+  return enclosers;
+}
+
+/**
+ * What every scope enclosing a resource is guaranteed to render for it.
+ *
+ * **Across enclosers this INTERSECTS, and that is the whole correctness of the
+ * reduction.** Coverage claims that a throw cannot escape unrendered, so it holds
+ * only when EVERY path to the site renders it — a router mounted on a public
+ * server with a catch-all and an internal one without is covered on one path and
+ * bare on the other, and unioning the two reported it as fully covered while the
+ * internal server answered with the built-in envelope. A resource with no
+ * encloser contributes nothing rather than everything: the empty set is the
+ * identity for the site's own coverage, and treating "no paths" as "all paths
+ * agree" would assert coverage no list provides.
+ *
+ * A resource's OWN scope list is unioned in, because it applies on every path.
+ *
+ * Memoized, and a cycle among `throwsThrough` edges resolves to what has been
+ * accumulated so far rather than raising: this answers what a scope renders, and
+ * no cycle makes that answer larger.
+ */
+export function enclosingCoverage(
+  manifest: ResourceManifest,
+  ownScope: Map<ResourceManifest, ProvenCoverage>,
+  enclosers: Map<ResourceManifest, ResourceManifest[]>,
+  memo: Map<ResourceManifest, ProvenCoverage> = new Map(),
+  walking: Set<ResourceManifest> = new Set(),
+): ProvenCoverage {
+  const cached = memo.get(manifest);
+  if (cached) return cached;
+  if (walking.has(manifest)) return NO_COVERAGE;
+  walking.add(manifest);
+  try {
+    const own = ownScope.get(manifest);
+    const result: ProvenCoverage = {
+      codes: new Set(own?.codes ?? []),
+      hasCatchAll: own?.hasCatchAll ?? false,
+    };
+
+    const outer = (enclosers.get(manifest) ?? []).map((e) =>
+      enclosingCoverage(e, ownScope, enclosers, memo, walking),
+    );
+    if (outer.length > 0) {
+      const [first, ...rest] = outer;
+      const shared = new Set(first.codes);
+      let everyCatchAll = first.hasCatchAll;
+      for (const other of rest) {
+        for (const code of [...shared]) if (!other.codes.has(code)) shared.delete(code);
+        everyCatchAll &&= other.hasCatchAll;
+      }
+      for (const code of shared) result.codes.add(code);
+      if (everyCatchAll) result.hasCatchAll = true;
+    }
+
+    memo.set(manifest, result);
+    return result;
+  } finally {
+    walking.delete(manifest);
+  }
+}

package/src/cel-scope-query.ts

@@ -21,6 +21,7 @@ import { buildKernelGlobalsIndex } from "./kernel-globals.js";
 import { moduleAliasScope } from "./module-alias-scope.js";
 import { isModuleKind } from "./module-kinds.js";
 import { navigateConcretePath } from "./manifest-path.js";
+import { kindAtPath } from "./validate-cel-context.js";
 import { findManifest } from "./find-manifest.js";
 import { resolveLocalRef, walkStepArray } from "./schema-walk.js";
 import { readStepSlot } from "./step-slot.js";
@@ -269,14 +270,27 @@ export class CelScopeQuery {
     }
 
     // A kind's own declaration: the target is the `Telo.Definition` document,
-    // which is an ordinary manifest in the set.
+    // which is an ordinary manifest in the set. The slot holds a `!ref` to a
+    // `resources:` entry; the entry's own field wins where it narrows one, else
+    // the declaration is the entry's KIND. The first slot that resolves to an
+    // entry is the one the type resolver reads, so it is the one navigated.
     const fromRefKind = annotated["x-telo-context-from-ref-kind"];
-    const first = Array.isArray(fromRefKind) ? fromRefKind[0] : fromRefKind;
-    if (typeof first === "string") {
-      const hash = first.indexOf("#");
-      if (hash <= 0) return undefined;
-      const kindValue = navigateConcretePath(root, first.slice(0, hash).split("/").join("."));
-      if (typeof kindValue !== "string") return undefined;
+    const slots = Array.isArray(fromRefKind) ? fromRefKind : [fromRefKind];
+    for (const slotSpec of slots) {
+      if (typeof slotSpec !== "string") continue;
+      const hash = slotSpec.indexOf("#");
+      // `continue`, never `return`: a malformed spec is one entry of a list the
+      // type resolver walks to the end, and aborting here made the two answer
+      // differently for the same annotation.
+      if (hash <= 0) continue;
+      const field = slotSpec.slice(hash + 1);
+      const namedKind = kindAtPath(root, slotSpec.slice(0, hash));
+      if (!namedKind) continue;
+      if (namedKind.entry?.[field] !== undefined) {
+        const index = (root.resources as unknown[]).indexOf(namedKind.entry);
+        return { manifest: resource, path: `resources[${index}].${field}`, propertyMap: false };
+      }
+      const kindValue = namedKind.kind;
       // The kind was read off THIS resource, so it is spelled in the alias scope
       // of the module that declared it — not the entry's.
       const scope = moduleAliasScope(resource.metadata, this.ctx.aliases, this.ctx.aliasesByModule);
@@ -300,9 +314,14 @@ export class CelScopeQuery {
         (owningModule
           ? named.find((m) => (m.metadata as { module?: string } | undefined)?.module === owningModule)
           : undefined) ?? (owningModule && named.length > 1 ? undefined : named[0]);
-      if (!target) return undefined;
-      return { manifest: target, path: first.slice(hash + 1), propertyMap: false };
+      // Fall through to the next spec when this one names no kind, or names one
+      // that does not declare the field — the same order the TYPE resolver
+      // takes, so go-to-declaration lands where the type came from instead of on
+      // a field the target never had.
+      if (!target || target[field] === undefined) continue;
+      return { manifest: target, path: field, propertyMap: false };
     }
+    if (slots.some((s) => typeof s === "string")) return undefined;
 
     // `x-telo-context-element-from` / `-collection-from` type a binding from an
     // EXPRESSION, so there is no declaration to navigate to.

package/src/cel-scope.ts

@@ -651,6 +651,7 @@ export class CelScopeResolver {
       manifestRoot: rootForResolver,
       defs,
       aliases,
+      aliasesByModule: scopes?.aliasesByModule,
       allManifests: allManifests as Record<string, any>[],
     });
     return mergeKernelGlobalsIntoContext(