@telorun/analyzer 0.72.0 → 0.73.0

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAiBzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAgC9B,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAWvF,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AA4DjE,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACrB,MAAM,YAAY,CAAC;AAkGpB;0CAC0C;AAC1C,eAAO,MAAM,eAAe,GAAI,OAAO;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OACT,CAAC;AAErD;8EAC8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhD;AAqUD,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACtC;AA6DD,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAkFD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAsiEvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAyBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAiBzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAsC9B,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAWvF,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AA4DjE,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACrB,MAAM,YAAY,CAAC;AAoGpB;0CAC0C;AAC1C,eAAO,MAAM,eAAe,GAAI,OAAO;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OACT,CAAC;AAErD;8EAC8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhD;AAqUD,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACtC;AA6DD,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAkFD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAmlEvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAyBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -4,7 +4,7 @@ import { AliasResolver, scopeResolverForModule, } from "./alias-resolver.js";
 import { buildCelEnvironment, isKindDocument, } from "./cel-environment.js";
 import { DefinitionRegistry } from "./definition-registry.js";
 import { readDeprecation } from "./deprecation.js";
-import { effectiveAuthorSchema } from "./extends-resolution.js";
+import { effectiveAuthorSchema, inheritedCapability, inheritedRequiredFields, } from "./extends-resolution.js";
 import { analyzerContractScope, resolveContract, } from "./invocation-contract.js";
 import { buildCallGraph } from "./call-graph.js";
 import { buildDependencyGraph, formatCycle } from "./dependency-graph.js";
@@ -47,7 +47,7 @@ import { celTypeSatisfiesJsonSchema, checkSchemaCompatibility, navigateSchemaToE
 import { collectValueSchemaIssues } from "./validate-value-schema.js";
 import { DiagnosticSeverity, DiagnosticTag, } from "./types.js";
 import { extractAccessChains, } from "./validate-cel-context.js";
-import { celEvalModeAt, celEvalSites, mergeCelEvalSites, NO_CEL_EVAL_SITES, } from "./eval-paths.js";
+import { celEvalModeAt, celEvalSites, implicitEvalSites, mergeCelEvalSites, NO_CEL_EVAL_SITES, } from "./eval-paths.js";
 import { BINDINGS_ANNOTATION, findBindingSites, resolveBindingOrder, } from "./cel-bindings.js";
 import { CEL_RESERVED_WORDS, checkName } from "./identifier-name.js";
 import { validateIdentifierNames } from "./validate-identifier-names.js";
@@ -66,7 +66,8 @@ import { kindSatisfies, validateReferences } from "./validate-references.js";
 import { validateReferenceForms } from "./validate-reference-forms.js";
 import { isInjectedDeclaration } from "./resource-input.js";
 import { validateResourceInputs } from "./validate-resource-inputs.js";
-import { validateTemplateDispatch } from "./validate-template-dispatch.js";
+import { validateExports } from "./validate-exports.js";
+import { validateTemplateBody } from "./validate-template-body.js";
 import { validateUnusedDeclarations } from "./validate-unused-declarations.js";
 import { validateThrowsCoverage } from "./validate-throws-coverage.js";
 import { readStepSlot } from "./step-slot.js";
@@ -1746,12 +1747,37 @@ export class StaticAnalyzer {
                 // is caught here rather than on the one input that selects it.
                 const valueSchemaIssues = collectValueSchemaIssues(m, schema, allManifests);
                 const issues = [...ajvIssues, ...valueSchemaIssues];
+                // WHY A FIELD THIS KIND EXISTS TO SUPPLY IS STILL REQUIRED OF ITS
+                // CONSUMER. A child that `extends` and declares no `base:` is authored
+                // against merge(parent, own), so the parent's `required` stays on the
+                // CHILD's surface — and a kind written to wire that field internally
+                // then demands it from the consumer anyway. The `base:` mapping is what
+                // narrows (with it the surface is the child's own schema alone), and
+                // nothing in "is missing required property" points there, which is what
+                // turns one mistake into a three-step dead end.
+                //
+                // Matched against names DERIVED from the parent, never by parsing the
+                // message: which fields are inherited is a fact about the definition,
+                // and a check that reads a validator's prose breaks when the prose does.
+                const inheritedRequired = inheritedRequiredFields(definition, (k) => defs.resolve(aliases.resolveKind(k) ?? k) ?? defs.resolve(k));
+                const parentKind = definition?.extends;
                 for (const issue of issues) {
+                    // Keyed on the STRUCTURED failure, never on the sentence: the field
+                    // names are derived from the parent, and matching them against the
+                    // validator's prose would break when the prose changes and mis-fire on
+                    // any other issue quoting the same name (an `additionalProperties`
+                    // rejection, an `enum` listing).
+                    const inherited = issue.keyword === "required" && issue.missingProperty !== undefined
+                        ? inheritedRequired.filter((f) => f === issue.missingProperty)
+                        : [];
+                    const hint = inherited.length > 0 && parentKind
+                        ? ` — ${inherited.map((f) => `'${f}'`).join(", ")} ${inherited.length > 1 ? "come" : "comes"} from '${parentKind}', which this kind extends without a 'base:' mapping, so the parent's required fields stay on this kind's author surface. Add 'base:' to set them internally; that also narrows the surface to this kind's own schema.`
+                        : "";
                     diagnostics.push({
                         severity: DiagnosticSeverity.Error,
                         code: "SCHEMA_VIOLATION",
                         source: SOURCE,
-                        message: `${m.kind}/${resource.name}: ${issue.message}`,
+                        message: `${m.kind}/${resource.name}: ${issue.message}${hint}`,
                         data: { resource, filePath, path: issue.path },
                     });
                 }
@@ -2116,8 +2142,14 @@ export class StaticAnalyzer {
                 }
                 // The non-eval-field check only applies to runtime resource instances:
                 // structural / templating kinds (capability `Telo.Template`, or no
-                // definition) carry CEL the kernel evaluates by other rules.
-                const capability = e.definition?.capability;
+                // definition) carry CEL the kernel evaluates by other rules. The
+                // capability is INHERITED along `extends` — an inheritance kind
+                // writes none of its own — and reading the declared one left the
+                // rule off for every such kind, and its expressions untyped.
+                const resolveDef = (k) => defs.resolve(aliases.resolveKind(k) ?? k) ?? defs.resolve(k);
+                const capability = e.definition
+                    ? inheritedCapability(e.definition, resolveDef)
+                    : undefined;
                 celRuleApplies =
                     !!e.definition?.schema && capability !== undefined && capability !== "Telo.Template";
                 if (celRuleApplies) {
@@ -2129,12 +2161,14 @@ export class StaticAnalyzer {
                     // the own schema here reported `CEL_IN_NON_EVAL_FIELD` for an
                     // expression the runtime evaluates correctly, which is the two halves
                     // disagreeing about what the manifest means.
-                    const ownSchema = effectiveAuthorSchema(e.definition, (k) => defs.resolve(aliases.resolveKind(k) ?? k) ?? defs.resolve(k));
+                    const ownSchema = effectiveAuthorSchema(e.definition, resolveDef);
                     const capabilityDef = capability ? defs.resolve(capability) : undefined;
                     // A `Telo.Provider`'s fields are implicitly compile-eval — the
                     // capability abstract carries the root annotation — so its reads are
-                    // covered here without the provider restating anything.
-                    celSites = mergeCelEvalSites(celEvalSites(ownSchema), celEvalSites(capabilityDef?.schema));
+                    // covered here without the provider restating anything. A base-form
+                    // child's own fields are too (`implicitEvalSites`): `base:` reads
+                    // them once at create().
+                    celSites = mergeCelEvalSites(celEvalSites(ownSchema), celEvalSites(capabilityDef?.schema), implicitEvalSites(e.definition));
                 }
                 else {
                     celSites = NO_CEL_EVAL_SITES;
@@ -2403,10 +2437,13 @@ export class StaticAnalyzer {
         diagnostics.push(...validateThrowsCoverage(allManifests, defs, aliases, this.celEnv, aliasesByModule, rootModules, libraryManifests));
         // Warn about declared variables / secrets / ports that no CEL references.
         diagnostics.push(...validateUnusedDeclarations(allManifests, this.celEnv));
-        // A `!ref` at a definition's dispatch slot must name a sibling `resources:`
-        // entry — the slot no reference pass reaches, so the tag would otherwise
-        // advertise a resolution nothing performs.
-        diagnostics.push(...validateTemplateDispatch(allManifests, rootModules));
+        // A template body's reference surface — its entry names, its dispatch slots
+        // and the ref slots inside each entry — which no reference pass reaches,
+        // since a `Telo.Definition` is in both skip sets.
+        diagnostics.push(...validateTemplateBody(allManifests, defs, aliases, aliasesByModule, rootModules));
+        // A library's export list, resolved against what it declares — otherwise a
+        // listed name that exists nowhere fails in the consumer's file.
+        diagnostics.push(...validateExports(allManifests, defs, aliases, rootModules));
         // A library's declared resource inputs, and every import that supplies them.
         diagnostics.push(...validateResourceInputs(allManifests, defs, aliases, rootModules, (supplied, required, isDeclaration) => kindSatisfies(supplied, required, defs, isDeclaration)));
         // Reroute diagnostics on synthetic (inline-extracted) resources back to

package/dist/builtins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AA8OvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EA+tB/C,CAAC"}
+{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAiFA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AA8OvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EA2pB/C,CAAC"}

package/dist/builtins.js

@@ -20,6 +20,60 @@ const observedStateSlot = {
     description: "What a resource of this kind reports while running, published at `resources.<name>.status.<field>`.",
     $ref: manifestFragmentRef("JsonSchema7"),
 };
+/** The `self`-only CEL scope a dispatch slot's name template is written in. */
+const dispatchSelfContext = {
+    type: "object",
+    additionalProperties: false,
+    properties: { self: { "x-telo-context-from-root": "schema" } },
+};
+/**
+ * A `Telo.Definition` dispatch slot: which `resources:` entry receives the call.
+ *
+ * Three shapes, and the union is what keeps the slot CONSTRAINED for manifests
+ * no pass walks — `validate-template-body` resolves the target and its
+ * capability, but it is entry-scoped, so a dependency's definition would
+ * otherwise have nothing checking this slot at all. An array or a number fails
+ * every branch here, which is the floor AJV used to provide.
+ *
+ * `anyOf`, never `oneOf`: a `!ref` sentinel is an object, so it would match both
+ * the sentinel branch and any permissive object branch and then fail for
+ * matching twice. That is also how the sentinel used to pass — the legacy object
+ * branch required nothing, so it accepted one by accident; here it is a branch
+ * of its own that says so.
+ */
+function dispatchSlot(title, description) {
+    return {
+        title,
+        description,
+        anyOf: [
+            // `!ref <entry>` — the spelling to write.
+            {
+                type: "object",
+                required: ["__tagged", "engine", "source"],
+                properties: {
+                    __tagged: { const: true },
+                    engine: { const: "ref" },
+                    source: { type: "string", minLength: 1 },
+                },
+                additionalProperties: false,
+            },
+            // Legacy: a name template expanded against `self`. Read forever, because
+            // published artifacts carry it; `DEPRECATED_TEMPLATE_DISPATCH_FORM` is
+            // what moves an author off it.
+            { type: "string", "x-telo-context": dispatchSelfContext },
+            // Legacy: `{ kind?, name }`, where `name` is that same template.
+            {
+                type: "object",
+                required: ["name"],
+                properties: {
+                    kind: { type: "string" },
+                    name: { type: "string", "x-telo-context": dispatchSelfContext },
+                },
+                additionalProperties: true,
+            },
+        ],
+    };
+}
 /** Descriptive provenance a module declares about itself, shared by
  *  `Telo.Application` and `Telo.Library`.
  *
@@ -459,99 +513,19 @@ export const KERNEL_BUILTINS = [
                         },
                     },
                 },
-                invoke: {
-                    oneOf: [
-                        {
-                            type: "string",
-                            "x-telo-context": {
-                                type: "object",
-                                additionalProperties: false,
-                                properties: {
-                                    self: { "x-telo-context-from-root": "schema" },
-                                },
-                            },
-                        },
-                        {
-                            type: "object",
-                            additionalProperties: true,
-                            properties: {
-                                kind: { type: "string" },
-                                name: {
-                                    type: "string",
-                                    "x-telo-context": {
-                                        type: "object",
-                                        additionalProperties: false,
-                                        properties: {
-                                            self: { "x-telo-context-from-root": "schema" },
-                                        },
-                                    },
-                                },
-                            },
-                        },
-                    ],
-                },
-                provide: {
-                    type: "object",
-                    additionalProperties: true,
-                    properties: {
-                        kind: { type: "string" },
-                        name: {
-                            type: "string",
-                            "x-telo-context": {
-                                type: "object",
-                                additionalProperties: false,
-                                properties: {
-                                    self: { "x-telo-context-from-root": "schema" },
-                                },
-                            },
-                        },
-                    },
-                },
-                run: {
-                    type: "string",
-                    "x-telo-context": {
-                        type: "object",
-                        additionalProperties: false,
-                        properties: {
-                            self: { "x-telo-context-from-root": "schema" },
-                        },
-                    },
-                },
-                // Mount dispatch: names the `resources:` entry (a Telo.Mount, e.g. an
-                // Http.Api) whose `register()` this definition delegates to. Same
-                // string / { kind, name } grammar as `invoke:`. The named child stays
-                // persistent so the produced mount's routes can `!ref` its siblings.
-                mount: {
-                    oneOf: [
-                        {
-                            type: "string",
-                            "x-telo-context": {
-                                type: "object",
-                                additionalProperties: false,
-                                properties: {
-                                    self: { "x-telo-context-from-root": "schema" },
-                                },
-                            },
-                        },
-                        {
-                            type: "object",
-                            additionalProperties: true,
-                            properties: {
-                                kind: { type: "string" },
-                                name: {
-                                    type: "string",
-                                    "x-telo-context": {
-                                        type: "object",
-                                        additionalProperties: false,
-                                        properties: {
-                                            self: { "x-telo-context-from-root": "schema" },
-                                        },
-                                    },
-                                },
-                            },
-                        },
-                    ],
-                },
+                // A dispatch slot names the `resources:` entry that receives the call,
+                // as `!ref <entry>` — the one spelling every reference in Telo has. The
+                // string and `{ kind, name }` forms it used to admit (a CEL name
+                // template matched against CEL-named entries) were the removed
+                // reference object surviving in the one place nothing resolved it;
+                // `validate-template-body` is what resolves this slot, so the schema
+                // stays open here rather than reporting the same defect twice.
+                invoke: dispatchSlot("Invoke target", "The `resources:` entry whose `invoke()` this kind dispatches to, as `!ref <entry>`."),
+                provide: dispatchSlot("Provide target", "The `resources:` entry whose `invoke()` produces this provider's value, as `!ref <entry>`."),
+                run: dispatchSlot("Run target", "The `resources:` entry whose `run()` this kind dispatches to, as `!ref <entry>`."),
+                // The named child stays persistent so the produced mount's routes can
+                // `!ref` its siblings.
+                mount: dispatchSlot("Mount target", "The `resources:` entry (a Telo.Mount, e.g. an Http.Api) whose `register()` this kind delegates to, as `!ref <entry>`."),
                 inputs: {
                     type: "object",
                     additionalProperties: true,
@@ -572,11 +546,11 @@ export const KERNEL_BUILTINS = [
                         additionalProperties: false,
                         properties: {
                             self: { "x-telo-context-from-root": "schema" },
+                            // Typed from the dispatch target's declared output: the slot
+                            // holds a `!ref` to a `resources:` entry, resolved to that
+                            // entry's kind (or its own `outputType`, where it narrows one).
                             result: {
-                                "x-telo-context-from-ref-kind": [
-                                    "provide/kind#outputType",
-                                    "invoke/kind#outputType",
-                                ],
+                                "x-telo-context-from-ref-kind": ["provide#outputType", "invoke#outputType"],
                             },
                         },
                     },

package/dist/cel-scope-query.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cel-scope-query.d.ts","sourceRoot":"","sources":["../src/cel-scope-query.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAqB,MAAM,qBAAqB,CAAC;AAEvE,OAAO,EAAoB,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAkB9D;;;sCAGsC;AACtC,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;;iEAI6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAoBD;gEACgE;AAChE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CAC7C;AAED;;;;;;GAMG;AACH,qBAAa,aAAa;IActB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAb5B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmB;IAC5C;;oDAEgD;IAChD,OAAO,CAAC,OAAO,CAA+B;IAC9C;;;;sEAIkE;IAClE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsD;gBAG9D,SAAS,EAAE,gBAAgB,EAAE,EAC9C,GAAG,EAAE,oBAAoB,EACzB,MAAM,CAAC,EAAE,WAAW;IAgCtB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAuB;IAE3C;+DAC2D;IAC3D,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,gBAAgB,GAAG,SAAS;IAI7F;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,GAAG,QAAQ;IAe3D;;;;;;;;;;;;;;;;;;OAkBG;IACH,sBAAsB,CACpB,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EAAE,GACd,sBAAsB,GAAG,SAAS;IA0CrC;oFACgF;IAChF,OAAO,CAAC,QAAQ;IAgFhB;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAqBrF;;;;;;;sDAOkD;IAClD,OAAO,CAAC,aAAa;IAOrB;wEACoE;IACpE,OAAO,CAAC,YAAY;CAarB"}
+{"version":3,"file":"cel-scope-query.d.ts","sourceRoot":"","sources":["../src/cel-scope-query.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAqB,MAAM,qBAAqB,CAAC;AAEvE,OAAO,EAAoB,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAmB9D;;;sCAGsC;AACtC,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;;iEAI6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAoBD;gEACgE;AAChE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CAC7C;AAED;;;;;;GAMG;AACH,qBAAa,aAAa;IActB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAb5B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmB;IAC5C;;oDAEgD;IAChD,OAAO,CAAC,OAAO,CAA+B;IAC9C;;;;sEAIkE;IAClE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsD;gBAG9D,SAAS,EAAE,gBAAgB,EAAE,EAC9C,GAAG,EAAE,oBAAoB,EACzB,MAAM,CAAC,EAAE,WAAW;IAgCtB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAuB;IAE3C;+DAC2D;IAC3D,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,gBAAgB,GAAG,SAAS;IAI7F;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,GAAG,QAAQ;IAe3D;;;;;;;;;;;;;;;;;;OAkBG;IACH,sBAAsB,CACpB,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EAAE,GACd,sBAAsB,GAAG,SAAS;IA0CrC;oFACgF;IAChF,OAAO,CAAC,QAAQ;IAkGhB;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAqBrF;;;;;;;sDAOkD;IAClD,OAAO,CAAC,aAAa;IAOrB;wEACoE;IACpE,OAAO,CAAC,YAAY;CAarB"}

package/dist/cel-scope-query.js

@@ -4,6 +4,7 @@ import { buildKernelGlobalsIndex } from "./kernel-globals.js";
 import { moduleAliasScope } from "./module-alias-scope.js";
 import { isModuleKind } from "./module-kinds.js";
 import { navigateConcretePath } from "./manifest-path.js";
+import { kindAtPath } from "./validate-cel-context.js";
 import { findManifest } from "./find-manifest.js";
 import { resolveLocalRef, walkStepArray } from "./schema-walk.js";
 import { readStepSlot } from "./step-slot.js";
@@ -200,16 +201,30 @@ export class CelScopeQuery {
             return { manifest: target, path: refFrom.slice(slash + 1).split("/").join("."), propertyMap: false };
         }
         // A kind's own declaration: the target is the `Telo.Definition` document,
-        // which is an ordinary manifest in the set.
+        // which is an ordinary manifest in the set. The slot holds a `!ref` to a
+        // `resources:` entry; the entry's own field wins where it narrows one, else
+        // the declaration is the entry's KIND. The first slot that resolves to an
+        // entry is the one the type resolver reads, so it is the one navigated.
         const fromRefKind = annotated["x-telo-context-from-ref-kind"];
-        const first = Array.isArray(fromRefKind) ? fromRefKind[0] : fromRefKind;
-        if (typeof first === "string") {
-            const hash = first.indexOf("#");
+        const slots = Array.isArray(fromRefKind) ? fromRefKind : [fromRefKind];
+        for (const slotSpec of slots) {
+            if (typeof slotSpec !== "string")
+                continue;
+            const hash = slotSpec.indexOf("#");
+            // `continue`, never `return`: a malformed spec is one entry of a list the
+            // type resolver walks to the end, and aborting here made the two answer
+            // differently for the same annotation.
             if (hash <= 0)
-                return undefined;
-            const kindValue = navigateConcretePath(root, first.slice(0, hash).split("/").join("."));
-            if (typeof kindValue !== "string")
-                return undefined;
+                continue;
+            const field = slotSpec.slice(hash + 1);
+            const namedKind = kindAtPath(root, slotSpec.slice(0, hash));
+            if (!namedKind)
+                continue;
+            if (namedKind.entry?.[field] !== undefined) {
+                const index = root.resources.indexOf(namedKind.entry);
+                return { manifest: resource, path: `resources[${index}].${field}`, propertyMap: false };
+            }
+            const kindValue = namedKind.kind;
             // The kind was read off THIS resource, so it is spelled in the alias scope
             // of the module that declared it — not the entry's.
             const scope = moduleAliasScope(resource.metadata, this.ctx.aliases, this.ctx.aliasesByModule);
@@ -229,10 +244,16 @@ export class CelScopeQuery {
             const target = (owningModule
                 ? named.find((m) => m.metadata?.module === owningModule)
                 : undefined) ?? (owningModule && named.length > 1 ? undefined : named[0]);
-            if (!target)
-                return undefined;
-            return { manifest: target, path: first.slice(hash + 1), propertyMap: false };
+            // Fall through to the next spec when this one names no kind, or names one
+            // that does not declare the field — the same order the TYPE resolver
+            // takes, so go-to-declaration lands where the type came from instead of on
+            // a field the target never had.
+            if (!target || target[field] === undefined)
+                continue;
+            return { manifest: target, path: field, propertyMap: false };
         }
+        if (slots.some((s) => typeof s === "string"))
+            return undefined;
         // `x-telo-context-element-from` / `-collection-from` type a binding from an
         // EXPRESSION, so there is no declaration to navigate to.
         return undefined;

package/dist/cel-scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cel-scope.d.ts","sourceRoot":"","sources":["../src/cel-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAQvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAO9D,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,qBAAqB,CAAC;AAuE7B;;;;;;;;;;;oEAWoE;AACpE,wBAAgB,uBAAuB,CACrC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACtB,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,MAAM,EAAE,YAAY,GACnB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC7B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC9B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY,GACnB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAqGjC;AAED,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GACzC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAmClC;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,GACvC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAWjC;AAED;;;+DAG+D;AAC/D,wBAAgB,gBAAgB,CAC9B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAClC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAcrB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,QAAQ;IACvB,wDAAwD;IACxD,GAAG,EAAE,WAAW,CAAC;IACjB;+EAC2E;IAC3E,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;CAC3C;AAED;+CAC+C;AAC/C,MAAM,WAAW,cAAc;IAC7B,0CAA0C;IAC1C,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,YAAY,CAAC;IACrB,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,aAAa,EAAE,kBAAkB,CAAC;IAClC,sEAAsE;IACtE,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC,+EAA+E;IAC/E,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;CAClD;AAED;;;6BAG6B;AAC7B,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,gBAAgB,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,qBAAa,gBAAgB;IAsBf,OAAO,CAAC,QAAQ,CAAC,MAAM;IArBnC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA4C;IAE/E,4DAA4D;IAC5D,OAAO,CAAC,WAAW,CAAkC;IACrD,OAAO,CAAC,iBAAiB,CAAkC;IAC3D,OAAO,CAAC,WAAW,CAA+C;IAClE;;0EAEsE;IACtE,OAAO,CAAC,UAAU,CAMV;IACR;;8EAE0E;IAC1E,OAAO,CAAC,UAAU,CAAkC;gBAEvB,MAAM,EAAE,cAAc;IAEnD;;;uDAGmD;IACnD,IAAI,iBAAiB,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAEvD;IAED,sEAAsE;IACtE,IAAI,kBAAkB,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAEjE;IAED;;;+CAG2C;IAC3C,IAAI,uBAAuB,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAE7D;IAED,oDAAoD;IACpD,aAAa,CAAC,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,kBAAkB,GAAG,SAAS,GAAG,IAAI;IA6CpF;;;;;;;;;OASG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ;IAoCpC;;sEAEkE;IAClE,OAAO,CAAC,iBAAiB;CAgH1B"}
+{"version":3,"file":"cel-scope.d.ts","sourceRoot":"","sources":["../src/cel-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAQvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAO9D,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,qBAAqB,CAAC;AAuE7B;;;;;;;;;;;oEAWoE;AACpE,wBAAgB,uBAAuB,CACrC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACtB,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,MAAM,EAAE,YAAY,GACnB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC7B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC9B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY,GACnB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAqGjC;AAED,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GACzC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAmClC;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,GACvC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAWjC;AAED;;;+DAG+D;AAC/D,wBAAgB,gBAAgB,CAC9B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAClC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAcrB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,QAAQ;IACvB,wDAAwD;IACxD,GAAG,EAAE,WAAW,CAAC;IACjB;+EAC2E;IAC3E,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;CAC3C;AAED;+CAC+C;AAC/C,MAAM,WAAW,cAAc;IAC7B,0CAA0C;IAC1C,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,YAAY,CAAC;IACrB,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,aAAa,EAAE,kBAAkB,CAAC;IAClC,sEAAsE;IACtE,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC,+EAA+E;IAC/E,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;CAClD;AAED;;;6BAG6B;AAC7B,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,gBAAgB,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,qBAAa,gBAAgB;IAsBf,OAAO,CAAC,QAAQ,CAAC,MAAM;IArBnC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA4C;IAE/E,4DAA4D;IAC5D,OAAO,CAAC,WAAW,CAAkC;IACrD,OAAO,CAAC,iBAAiB,CAAkC;IAC3D,OAAO,CAAC,WAAW,CAA+C;IAClE;;0EAEsE;IACtE,OAAO,CAAC,UAAU,CAMV;IACR;;8EAE0E;IAC1E,OAAO,CAAC,UAAU,CAAkC;gBAEvB,MAAM,EAAE,cAAc;IAEnD;;;uDAGmD;IACnD,IAAI,iBAAiB,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAEvD;IAED,sEAAsE;IACtE,IAAI,kBAAkB,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAEjE;IAED;;;+CAG2C;IAC3C,IAAI,uBAAuB,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAE7D;IAED,oDAAoD;IACpD,aAAa,CAAC,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,kBAAkB,GAAG,SAAS,GAAG,IAAI;IA6CpF;;;;;;;;;OASG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ;IAoCpC;;sEAEkE;IAClE,OAAO,CAAC,iBAAiB;CAiH1B"}

package/dist/cel-scope.js

@@ -444,6 +444,7 @@ export class CelScopeResolver {
             manifestRoot: rootForResolver,
             defs,
             aliases,
+            aliasesByModule: scopes?.aliasesByModule,
             allManifests: allManifests,
         });
         return mergeKernelGlobalsIntoContext(withBindingNames(resolved, rootManifest), 

package/dist/eval-paths.d.ts

@@ -73,6 +73,32 @@ export interface CelEvalSites {
 }
 export declare const NO_CEL_EVAL_SITES: CelEvalSites;
 export declare function celEvalSites(schema: Record<string, any> | undefined): CelEvalSites;
+/**
+ * A BASE-FORM CHILD'S OWN FIELDS ARE COMPILE-EVAL WITHOUT ANNOTATION.
+ *
+ * A definition with `base:` has no controller of its own: the kernel evaluates
+ * the mapping once, at `create()`, against `self` — the instance's config — and
+ * hands the result to the inherited controller as the parent's config. The
+ * child's own schema fields never reach a controller; they exist to be read by
+ * `base:`, and the mapping expands whatever compiled value it reads. So every
+ * own field is evaluated exactly once at creation against the startup scope,
+ * which is what compile-eval IS. Declared here as the rule rather than left as a
+ * property of the mapping walk — the `Telo.Provider` posture, where a
+ * construction-time-only surface declares compile-eval once for all its fields
+ * rather than per field. Without it the rule was off for every inheritance kind
+ * (its capability is inherited, so the gate read `undefined`) and the
+ * expressions were never typed either: a `!cel "variables.whoo"` passed `telo
+ * check` and failed at boot.
+ *
+ * Read by the kernel's instance production and the analyzer's coverage decision,
+ * so the two cannot disagree about which fields a base child evaluates. An
+ * explicitly `runtime` own field still wins, through the same overlap rule a
+ * root `x-telo-eval: compile` follows.
+ */
+export declare const IMPLICIT_COMPILE_SITES: CelEvalSites;
+export declare function implicitEvalSites(definition: {
+    base?: unknown;
+} | undefined): CelEvalSites;
 /** The union of several schemas' sites — a kind's own and its capability
  *  abstract's, which is how a `Telo.Provider`'s implicit compile-eval reaches
  *  fields the provider never annotated. */
@@ -81,11 +107,16 @@ export declare function mergeCelEvalSites(...sites: CelEvalSites[]): CelEvalSite
  * Whether the value at `path` is evaluated, and when — null for a field whose
  * value is read as a literal.
  *
- * `compile` wins over `runtime`, and both win over a region: a field's own
- * annotation is more specific than the region it sits in, which is the same
- * precedence a nested annotation has over an enclosing one. A region resolves to
- * `runtime` because that is what a region IS — a per-invocation scope naming
- * what its expressions can read.
+ * An annotated field wins over the region it sits in — a field's own annotation
+ * is more specific than an enclosing one, and a region resolves to `runtime`
+ * because that is what a region IS, a per-invocation scope naming what its
+ * expressions can read. Between the two annotations, `runtime` wins wherever
+ * they OVERLAP and `compile` answers everywhere else.
+ *
+ * That overlap rule is the kernel's, read back: its compile expansion skips any
+ * compile path a runtime path contains or is contained by, and under a root
+ * `**` it skips per top-level key — so a runtime-annotated field under an
+ * implicit compile root stays runtime, here as at dispatch.
  *
  * `path` is the `walkCelExpressions` spelling (`routes[0].returns[1].when`).
  */

package/dist/eval-paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"eval-paths.d.ts","sourceRoot":"","sources":["../src/eval-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAKxE;AAED;+BAC+B;AAC/B,wBAAgB,cAAc,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEtF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG;IAC3D,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAcA;AAiCD;;uEAEuE;AACvE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAI1D;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,SAAM,GAAG,MAAM,EAAE,CAqBxF;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;yEACyE;AACzE,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B;AAED,eAAO,MAAM,iBAAiB,EAAE,YAAwD,CAAC;AAEzF,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,YAAY,CAIlF;AAED;;2CAE2C;AAC3C,wBAAgB,iBAAiB,CAAC,GAAG,KAAK,EAAE,YAAY,EAAE,GAAG,YAAY,CAMxE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,YAAY,EACnB,IAAI,EAAE,MAAM,GACX,SAAS,GAAG,SAAS,GAAG,IAAI,CAK9B"}
+{"version":3,"file":"eval-paths.d.ts","sourceRoot":"","sources":["../src/eval-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAKxE;AAED;+BAC+B;AAC/B,wBAAgB,cAAc,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEtF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG;IAC3D,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAcA;AAiCD;;uEAEuE;AACvE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAI1D;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,SAAM,GAAG,MAAM,EAAE,CAqBxF;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;yEACyE;AACzE,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B;AAED,eAAO,MAAM,iBAAiB,EAAE,YAAwD,CAAC;AAEzF,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,YAAY,CAIlF;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,sBAAsB,EAAE,YAA4D,CAAC;AAElG,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,GACzC,YAAY,CAEd;AAED;;2CAE2C;AAC3C,wBAAgB,iBAAiB,CAAC,GAAG,KAAK,EAAE,YAAY,EAAE,GAAG,YAAY,CAMxE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,YAAY,EACnB,IAAI,EAAE,MAAM,GACX,SAAS,GAAG,SAAS,GAAG,IAAI,CAY9B"}

package/dist/eval-paths.js

@@ -160,6 +160,32 @@ export function celEvalSites(schema) {
     const { compile, runtime } = buildEvalPaths(schema);
     return { compile, runtime, regions: extractCelRegionScopes(schema) };
 }
+/**
+ * A BASE-FORM CHILD'S OWN FIELDS ARE COMPILE-EVAL WITHOUT ANNOTATION.
+ *
+ * A definition with `base:` has no controller of its own: the kernel evaluates
+ * the mapping once, at `create()`, against `self` — the instance's config — and
+ * hands the result to the inherited controller as the parent's config. The
+ * child's own schema fields never reach a controller; they exist to be read by
+ * `base:`, and the mapping expands whatever compiled value it reads. So every
+ * own field is evaluated exactly once at creation against the startup scope,
+ * which is what compile-eval IS. Declared here as the rule rather than left as a
+ * property of the mapping walk — the `Telo.Provider` posture, where a
+ * construction-time-only surface declares compile-eval once for all its fields
+ * rather than per field. Without it the rule was off for every inheritance kind
+ * (its capability is inherited, so the gate read `undefined`) and the
+ * expressions were never typed either: a `!cel "variables.whoo"` passed `telo
+ * check` and failed at boot.
+ *
+ * Read by the kernel's instance production and the analyzer's coverage decision,
+ * so the two cannot disagree about which fields a base child evaluates. An
+ * explicitly `runtime` own field still wins, through the same overlap rule a
+ * root `x-telo-eval: compile` follows.
+ */
+export const IMPLICIT_COMPILE_SITES = { compile: ["**"], runtime: [], regions: [] };
+export function implicitEvalSites(definition) {
+    return definition?.base != null ? IMPLICIT_COMPILE_SITES : NO_CEL_EVAL_SITES;
+}
 /** The union of several schemas' sites — a kind's own and its capability
  *  abstract's, which is how a `Telo.Provider`'s implicit compile-eval reaches
  *  fields the provider never annotated. */
@@ -174,16 +200,27 @@ export function mergeCelEvalSites(...sites) {
  * Whether the value at `path` is evaluated, and when — null for a field whose
  * value is read as a literal.
  *
- * `compile` wins over `runtime`, and both win over a region: a field's own
- * annotation is more specific than the region it sits in, which is the same
- * precedence a nested annotation has over an enclosing one. A region resolves to
- * `runtime` because that is what a region IS — a per-invocation scope naming
- * what its expressions can read.
+ * An annotated field wins over the region it sits in — a field's own annotation
+ * is more specific than an enclosing one, and a region resolves to `runtime`
+ * because that is what a region IS, a per-invocation scope naming what its
+ * expressions can read. Between the two annotations, `runtime` wins wherever
+ * they OVERLAP and `compile` answers everywhere else.
+ *
+ * That overlap rule is the kernel's, read back: its compile expansion skips any
+ * compile path a runtime path contains or is contained by, and under a root
+ * `**` it skips per top-level key — so a runtime-annotated field under an
+ * implicit compile root stays runtime, here as at dispatch.
  *
  * `path` is the `walkCelExpressions` spelling (`routes[0].returns[1].when`).
  */
 export function celEvalModeAt(sites, path) {
-    if (evalPathsCover(sites.compile, path))
+    const compiled = sites.compile.some((p) => {
+        if (!evalPathCovers(p, path))
+            return false;
+        const effective = p === "**" ? topLevelKey(path) : p;
+        return !sites.runtime.some((rp) => evalPathCovers(rp, effective) || evalPathCovers(effective, rp));
+    });
+    if (compiled)
         return "compile";
     if (evalPathsCover(sites.runtime, path))
         return "runtime";
@@ -191,3 +228,7 @@ export function celEvalModeAt(sites, path) {
         return "runtime";
     return null;
 }
+function topLevelKey(path) {
+    const end = path.search(/[.[]/);
+    return end === -1 ? path : path.slice(0, end);
+}

package/dist/extends-resolution.d.ts

@@ -36,6 +36,18 @@ export declare function inheritedCapability(def: ResourceDefinition | undefined,
  *    `mergeTypeSchemas` that `Type.JsonSchema.extends` uses.
  *  - no `extends` → the own schema unchanged. */
 export declare function effectiveAuthorSchema(def: ResourceDefinition | undefined, resolve: DefResolver): Record<string, any>;
+/**
+ * The parent's required fields that a merge-form child leaves on its OWN author
+ * surface — inherited by the rule above, and not redeclared by the child.
+ *
+ * The one fact behind a confusing diagnostic: a kind written to wire a field
+ * internally still demands it from its consumer, because without `base:` the
+ * child is authored against merge(parent, own) and the parent's `required` comes
+ * along. Empty for a child with `base:` (its surface is its own schema) and for
+ * a kind that extends nothing, so a caller can use a non-empty result as the
+ * condition itself.
+ */
+export declare function inheritedRequiredFields(def: ResourceDefinition | undefined, resolve: DefResolver): string[];
 /**
  * The fields a merge-form inheriting child publishes over its parent's reading.
  *

package/dist/extends-resolution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extends-resolution.d.ts","sourceRoot":"","sources":["../src/extends-resolution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAGvD;;;;;;;2DAO2D;AAC3D,MAAM,MAAM,WAAW,GAAG,CACxB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,kBAAkB,KACtB,kBAAkB,GAAG,SAAS,CAAC;AA0BpC;sDACsD;AACtD,wBAAgB,aAAa,CAC3B,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,kBAAkB,GAAG,SAAS,CAIhC;AAED;6EAC6E;AAC7E,wBAAgB,aAAa,CAC3B,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,kBAAkB,EAAE,CAUtB;AAED;iFACiF;AACjF,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,kBAAkB,GAAG,SAAS,GAAG,OAAO,CAUvF;AAED;;mFAEmF;AACnF,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,kBAAkB,GAAG,SAAS,CAMhC;AAED;;sCAEsC;AACtC,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,OAAO,CAGT;AAED;2EAC2E;AAC3E,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,MAAM,GAAG,SAAS,CAMpB;AAED;;;;;;iDAMiD;AACjD,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAOrB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,MAAM,EAAE,CASV;AAED;;eAEe;AACf,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,YAAY,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,iBAAiB,GAC3B,OAAO,CAQT;AAED;;;6BAG6B;AAC7B,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,iBAAiB,GAC3B,kBAAkB,GAAG,SAAS,CAShC;AAED;;;;;8CAK8C;AAC9C,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,iBAAiB,GAC3B,OAAO,CAKT;AAED;;8EAE8E;AAC9E,wBAAgB,eAAe,CAAC,SAAS,EAAE,iBAAiB,GAAG,QAAQ,GAAG,QAAQ,CAEjF;AAED;;;;;;;;;gDASgD;AAChD,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CASjC"}
+{"version":3,"file":"extends-resolution.d.ts","sourceRoot":"","sources":["../src/extends-resolution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAGvD;;;;;;;2DAO2D;AAC3D,MAAM,MAAM,WAAW,GAAG,CACxB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,kBAAkB,KACtB,kBAAkB,GAAG,SAAS,CAAC;AA0BpC;sDACsD;AACtD,wBAAgB,aAAa,CAC3B,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,kBAAkB,GAAG,SAAS,CAIhC;AAED;6EAC6E;AAC7E,wBAAgB,aAAa,CAC3B,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,kBAAkB,EAAE,CAUtB;AAED;iFACiF;AACjF,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,kBAAkB,GAAG,SAAS,GAAG,OAAO,CAUvF;AAED;;mFAEmF;AACnF,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,kBAAkB,GAAG,SAAS,CAMhC;AAED;;sCAEsC;AACtC,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,OAAO,CAGT;AAED;2EAC2E;AAC3E,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,MAAM,GAAG,SAAS,CAMpB;AAED;;;;;;iDAMiD;AACjD,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAOrB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,MAAM,EAAE,CAQV;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,MAAM,EAAE,CASV;AAED;;eAEe;AACf,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,YAAY,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,iBAAiB,GAC3B,OAAO,CAQT;AAED;;;6BAG6B;AAC7B,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,iBAAiB,GAC3B,kBAAkB,GAAG,SAAS,CAShC;AAED;;;;;8CAK8C;AAC9C,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,iBAAiB,GAC3B,OAAO,CAKT;AAED;;8EAE8E;AAC9E,wBAAgB,eAAe,CAAC,SAAS,EAAE,iBAAiB,GAAG,QAAQ,GAAG,QAAQ,CAEjF;AAED;;;;;;;;;gDASgD;AAChD,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CASjC"}