@telorun/analyzer 0.72.0 → 0.73.0

package/dist/release/workspace-schema.js

@@ -0,0 +1,77 @@
+/**
+ * The shape of `telo-workspace.yaml`, declared as data.
+ *
+ * One declaration read by two consumers — the strict half that reports what a
+ * marker got wrong, and the editor's completion list. Two hand-maintained key
+ * lists drift, and the drift is silent in the worst direction: an editor
+ * offering a key the checker rejects.
+ *
+ * Written as JSON Schema because that is what the shape *is*, and because the
+ * `description` a completion item shows and the type a diagnostic names are the
+ * same two facts a schema already carries. It is not compiled by AJV — the
+ * strict half walks it, which is what lets a wrong value say `'registry' must be
+ * the publish destination base, as a string` instead of a keyword trace.
+ */
+/**
+ * Every block, and every key in it, is optional — a marker whose whole content
+ * is comments is valid, and is what a runner seeds for the cache anchor alone.
+ */
+export const WORKSPACE_SCHEMA = {
+    release: {
+        description: "How `telo release` behaves: where modules are, where they publish, and which of their paths are not release-relevant.",
+        properties: {
+            registry: {
+                type: "string",
+                description: "Publish destination base. A module's ref is `<registry>/<its own directory name>`. Omitted: --registry, then TELO_OCI_REGISTRY, then the base each module's own ledger entry recorded.",
+                examples: ["oci://ghcr.io/telorun"],
+            },
+            ignore: {
+                type: "string[]",
+                description: "Paths under a module whose changes are not release-relevant, so no changelog fragment is asked for. Module-relative, gitignore-style. Declaring it replaces the built-in default; [] ignores nothing.",
+                examples: ["**/tests/**", "**/docs/**", "**/plans/**", "**/README.md", "**/CHANGELOG.md"],
+            },
+            modules: {
+                type: "entry[]",
+                description: "The subtrees that may hold modules — a place to look, never a module: what makes a directory a module is its telo.yaml. Workspace-relative, gitignore-style, last match wins. A bare string is an entry with no overrides.",
+            },
+        },
+    },
+    env: {
+        description: "How `telo run` resolves a manifest's environment.",
+        properties: {
+            roots: {
+                type: "string[]",
+                description: "How far up the .env walk may climb. Workspace-relative, gitignore-style, matched against each ancestor directory; the nearest match stops the walk. Omitted: the walk stops at this file.",
+            },
+            files: {
+                type: "string[]",
+                description: "Which files are collected in each directory, later winning within one directory. Filenames only — a / or a glob is an error. Declaring it replaces the default; [] collects none.",
+                examples: [".env", ".env.local"],
+            },
+        },
+    },
+};
+/** Keys a `release.modules` entry may carry in its object form. `path` is the
+ *  pattern; the rest override the block's own keys, key-wise. */
+export const MODULE_ENTRY_KEYS = {
+    path: {
+        type: "string",
+        description: "The gitignore-style pattern this entry matches modules with.",
+    },
+    registry: WORKSPACE_SCHEMA.release.properties.registry,
+    ignore: WORKSPACE_SCHEMA.release.properties.ignore,
+};
+export const WORKSPACE_BLOCKS = Object.keys(WORKSPACE_SCHEMA);
+/** Built-in when `release.ignore` is absent. Every pattern carries `**\/` — the
+ *  anchoring at a module root is the defect this replaced, so anchoring some and
+ *  not others would reproduce it partially. */
+export const DEFAULT_RELEASE_IGNORE = [
+    "**/tests/**",
+    "**/docs/**",
+    "**/plans/**",
+    "**/README.md",
+    "**/CHANGELOG.md",
+];
+/** Built-in when `env.files` is absent — the pair the walk hardcoded before it
+ *  was authorable, in the order it applied them. */
+export const DEFAULT_ENV_FILES = [".env", ".env.local"];

package/dist/schema-error-report.d.ts

@@ -42,6 +42,13 @@ export interface SchemaIssue {
     message: string;
     /** Dotted path to the field (e.g. "config.handler"). Empty string means root. */
     path: string;
+    /** The AJV keyword that produced it, so a consumer can key on WHAT failed
+     *  rather than on how the sentence reads. Prose is the renderer's to change;
+     *  a caller matching on it breaks silently when it does, and mis-fires on any
+     *  other issue whose text happens to quote the same name. */
+    keyword?: string;
+    /** For `required`, the property that is missing. */
+    missingProperty?: string;
 }
 export declare function formatSingleError(err: AjvErrorLike): string;
 /**

package/dist/schema-error-report.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-error-report.d.ts","sourceRoot":"","sources":["../src/schema-error-report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;gDACgD;AAChD,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;CACd;AAuCD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,YAAY,GAAG,MAAM,CA6B3D;AAoGD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,YAAY,EAAE,CAsF5F;AAqHD;;sFAEsF;AACtF,wBAAgB,cAAc,CAAC,GAAG,EAAE,YAAY,GAAG,MAAM,CAaxD;AAED,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,WAAW,EAAE,CAKrF;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAIjF"}
+{"version":3,"file":"schema-error-report.d.ts","sourceRoot":"","sources":["../src/schema-error-report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;gDACgD;AAChD,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb;;;iEAG6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAuCD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,YAAY,GAAG,MAAM,CA6B3D;AAoGD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,YAAY,EAAE,CAsF5F;AAqHD;;sFAEsF;AACtF,wBAAgB,cAAc,CAAC,GAAG,EAAE,YAAY,GAAG,MAAM,CAaxD;AAED,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,WAAW,EAAE,CAUrF;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAIjF"}

package/dist/schema-error-report.js

@@ -386,10 +386,15 @@ export function ajvErrorToPath(err) {
 }
 /** Reduced, path-anchored issues — what a diagnostic list is built from. */
 export function schemaIssues(errors) {
-    return reduceSchemaErrors(errors).map((err) => ({
-        message: formatSingleError(err),
-        path: ajvErrorToPath(err),
-    }));
+    return reduceSchemaErrors(errors).map((err) => {
+        const missing = (err.params ?? {}).missingProperty;
+        return {
+            message: formatSingleError(err),
+            path: ajvErrorToPath(err),
+            ...(err.keyword ? { keyword: err.keyword } : {}),
+            ...(typeof missing === "string" ? { missingProperty: missing } : {}),
+        };
+    });
 }
 /** Reduced, rendered as one sentence — what a thrown runtime error carries. */
 export function formatAjvErrors(errors) {

package/dist/telo-version.d.ts

@@ -1,3 +1,3 @@
 /** The surface generation this analyzer implements. */
-export declare const TELO_SURFACE_VERSION = "0.88.0";
+export declare const TELO_SURFACE_VERSION = "0.89.0";
 //# sourceMappingURL=telo-version.d.ts.map

package/dist/telo-version.js

@@ -5,4 +5,4 @@
 // its release identity, this is the scale a module's `requires.telo` range is
 // written against, and every kernel in every language reports the same scale.
 /** The surface generation this analyzer implements. */
-export const TELO_SURFACE_VERSION = "0.88.0";
+export const TELO_SURFACE_VERSION = "0.89.0";

package/dist/template-body.d.ts

@@ -33,6 +33,16 @@ export interface TemplateBody {
 /** The template bodies a manifest declares — empty for anything that is not a
  *  `Telo.Definition` with a `resources:` array. */
 export declare function templateBodies(m: ResourceManifest, registry: DefinitionRegistry, aliases: AliasResolver | undefined, scopes: ModuleScopes | undefined): TemplateBody[];
+/** What a definition's dispatch slot names: the `resources:` entry a `!ref` at
+ *  `slot` (`invoke` / `provide` / `run` / `mount`) resolves to, with its kind.
+ *  The entry is matched by its LITERAL `metadata.name`; a slot holding anything
+ *  but a `!ref`, or naming no entry, resolves to nothing — `validate-template-body`
+ *  is what reports either. `Self.<entry>` is the explicit self-qualifier. */
+export declare function dispatchTargetOf(definition: Record<string, any>, slot: string): {
+    entry: Record<string, any> | undefined;
+    kind: string;
+    name: string;
+} | undefined;
 /** True when a CEL path lies at or inside a body's own subtree. */
 export declare function pathInBody(path: string, prefix: string): boolean;
 /** The body a CEL path belongs to, or undefined for a path in the definition's

package/dist/template-body.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"template-body.d.ts","sourceRoot":"","sources":["../src/template-body.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,YAAY;IAC3B;qBACiB;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,UAAU,EAAE,kBAAkB,GAAG,SAAS,CAAC;CAC5C;AAED;mDACmD;AACnD,wBAAgB,cAAc,CAC5B,CAAC,EAAE,gBAAgB,EACnB,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,MAAM,EAAE,YAAY,GAAG,SAAS,GAC/B,YAAY,EAAE,CA0BhB;AAED,mEAAmE;AACnE,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAIhE;AAED;;+EAE+E;AAC/E,wBAAgB,WAAW,CAAC,CAAC,SAAS;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,EACtD,MAAM,EAAE,SAAS,CAAC,EAAE,EACpB,IAAI,EAAE,MAAM,GACX,CAAC,GAAG,SAAS,CAEf;AAED;;;;6CAI6C;AAC7C,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQxF"}
+{"version":3,"file":"template-body.d.ts","sourceRoot":"","sources":["../src/template-body.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,YAAY;IAC3B;qBACiB;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,UAAU,EAAE,kBAAkB,GAAG,SAAS,CAAC;CAC5C;AAED;mDACmD;AACnD,wBAAgB,cAAc,CAC5B,CAAC,EAAE,gBAAgB,EACnB,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,MAAM,EAAE,YAAY,GAAG,SAAS,GAC/B,YAAY,EAAE,CA0BhB;AAED;;;;6EAI6E;AAC7E,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,IAAI,EAAE,MAAM,GACX;IAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAcpF;AAED,mEAAmE;AACnE,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAIhE;AAED;;+EAE+E;AAC/E,wBAAgB,WAAW,CAAC,CAAC,SAAS;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,EACtD,MAAM,EAAE,SAAS,CAAC,EAAE,EACpB,IAAI,EAAE,MAAM,GACX,CAAC,GAAG,SAAS,CAEf;AAED;;;;6CAI6C;AAC7C,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQxF"}

package/dist/template-body.js

@@ -1,3 +1,4 @@
+import { isRefSentinel } from "@telorun/templating";
 import { moduleAliasScope } from "./module-alias-scope.js";
 /** The template bodies a manifest declares — empty for anything that is not a
  *  `Telo.Definition` with a `resources:` array. */
@@ -30,6 +31,30 @@ export function templateBodies(m, registry, aliases, scopes) {
     }
     return out;
 }
+/** What a definition's dispatch slot names: the `resources:` entry a `!ref` at
+ *  `slot` (`invoke` / `provide` / `run` / `mount`) resolves to, with its kind.
+ *  The entry is matched by its LITERAL `metadata.name`; a slot holding anything
+ *  but a `!ref`, or naming no entry, resolves to nothing — `validate-template-body`
+ *  is what reports either. `Self.<entry>` is the explicit self-qualifier. */
+export function dispatchTargetOf(definition, slot) {
+    const value = definition[slot];
+    if (!isRefSentinel(value))
+        return undefined;
+    const source = value.source;
+    const name = source.startsWith("Self.") ? source.slice("Self.".length) : source;
+    const bodies = definition.resources;
+    if (!Array.isArray(bodies))
+        return undefined;
+    for (const body of bodies) {
+        if (!body || typeof body !== "object")
+            continue;
+        const entry = body;
+        if (entry.metadata?.name !== name || typeof entry.kind !== "string")
+            continue;
+        return { entry, kind: entry.kind, name };
+    }
+    return undefined;
+}
 /** True when a CEL path lies at or inside a body's own subtree. */
 export function pathInBody(path, prefix) {
     return (path === prefix || path.startsWith(`${prefix}.`) || path.startsWith(`${prefix}[`));

package/dist/validate-cel-context.d.ts

@@ -13,6 +13,11 @@ export interface ContextResolveOpts {
     aliases?: {
         resolveKind(kind: string): string | undefined;
     };
+    /** Per-declaring-module alias tables, so a kind read off a forwarded
+     *  definition resolves in the module that wrote it. */
+    aliasesByModule?: ReadonlyMap<string, {
+        resolveKind(kind: string): string | undefined;
+    }>;
     allManifests?: Record<string, any>[];
 }
 export declare function resolveTypeFieldToSchema(value: unknown, allManifests: Record<string, any>[], ancestry?: ReadonlySet<string>): Record<string, any> | undefined;
@@ -39,18 +44,20 @@ export declare function resolveTypeFieldToSchema(value: unknown, allManifests: R
  *   Example: `properties.self.x-telo-context-from-root: "schema"` reads
  *   `manifestRoot.schema` and uses it as the schema of the `self` CEL variable.
  *
- * - `x-telo-context-from-ref-kind`: reads a kind name from `manifestRoot.<refPath>`,
- *   resolves it via the definition registry, and returns that kind's `<field>` schema
- *   (e.g. `outputType`/`inputType`). Used to type `result` against the dispatch
- *   target's declared output shape.
+ * - `x-telo-context-from-ref-kind`: reads a KIND from `manifestRoot.<refPath>` —
+ *   a field holding a kind name, or a definition's dispatch slot holding a
+ *   `!ref` to a `resources:` entry (whose kind it is) — and returns the
+ *   `<field>` schema (e.g. `outputType`/`inputType`) the entry itself declares,
+ *   else the one the kind's definition declares. Used to type `result` against
+ *   the dispatch target's declared output shape.
  *
  *   Syntax: `<refPath>#<field>` — slashes traverse the manifest tree.
  *
- *   Example: `x-telo-context-from-ref-kind: "provide/kind#outputType"` reads
- *   `manifestRoot.provide.kind` as a kind name, looks up the kind's Telo.Definition,
- *   and returns the `outputType` schema.
+ *   Example: `x-telo-context-from-ref-kind: "provide#outputType"` resolves
+ *   `manifestRoot.provide` (`!ref source`) to the entry named `source`, and
+ *   returns its `outputType` schema, or its kind's.
  *
- *   Accepts either a single string or an array of strings. With an array, paths
+ *   Accepts either a single string or an array of strings. With an array, slots
  *   are tried in order and the first one that resolves to a usable schema wins —
  *   used by `result:` to find its dispatch target under whichever entry-point
  *   field (`provide:` or `invoke:`) the definition declares.
@@ -70,6 +77,14 @@ export declare function resolveContextAnnotations(schema: Record<string, any>, m
  * e.g. exprPath="routes[0].inputs.q", scope="$.routes[*].inputs" → manifest.routes[0]
  */
 export declare function getManifestItem(exprPath: string, scope: string, manifest: Record<string, any>): Record<string, any>;
+/** The kind an `x-telo-context-from-ref-kind` path names: a field holding a
+ *  kind NAME (`targetKind`), or a definition's dispatch slot holding a `!ref`
+ *  to a `resources:` entry, which carries the kind — and, where it narrows
+ *  one, the contract field itself. */
+export declare function kindAtPath(manifestRoot: Record<string, any>, refPath: string): {
+    kind: string;
+    entry?: Record<string, any>;
+} | undefined;
 /**
  * Walk a JSON Schema tree and collect all `x-telo-context` annotations,
  * returning them as `{ scope, schema }` pairs using JSONPath-style scopes —

package/dist/validate-cel-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAatF,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AA2B3E,MAAM,WAAW,kBAAkB;IACjC;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC;;kDAE8C;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;KACxD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AA4CD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CA0EjC;AAyID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAChD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAoLrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAuBrB;AAqBD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,SAAM,GACT,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAC,CAGvD"}
+{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAetF,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AA2B3E,MAAM,WAAW,kBAAkB;IACjC;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC;;kDAE8C;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;KACxD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF;2DACuD;IACvD,eAAe,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE;QAAE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC,CAAC;IACzF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AA4CD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CA0EjC;AAyID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAChD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAgMrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAuBrB;AAqBD;;;sCAGsC;AACtC,wBAAgB,UAAU,CACxB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,OAAO,EAAE,MAAM,GACd;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,GAAG,SAAS,CAa3D;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,SAAM,GACT,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAC,CAGvD"}

package/dist/validate-cel-context.js

@@ -1,7 +1,9 @@
 export { extractAccessChains, validateChainAgainstSchema } from "@telorun/templating";
 import { elementSchemaOf, isLiveSlot, mergeTypeSchemas, parseCanonicalTypeSchemaId, } from "@telorun/sdk";
 import { KERNEL_BUILTINS } from "./builtins.js";
+import { moduleAliasScope } from "./module-alias-scope.js";
 import { withRefSlotsAsReadings } from "./ref-slot-reading.js";
+import { dispatchTargetOf } from "./template-body.js";
 // Where CEL is evaluated is one reader (`eval-paths.ts`), and the region half of
 // it moved there so the scope walk and the `x-telo-eval` walk answer the same
 // question in one place. Re-exported: this module is where every existing
@@ -279,18 +281,20 @@ function collectionBindingWithheld(schema, manifestRoot, allManifests) {
  *   Example: `properties.self.x-telo-context-from-root: "schema"` reads
  *   `manifestRoot.schema` and uses it as the schema of the `self` CEL variable.
  *
- * - `x-telo-context-from-ref-kind`: reads a kind name from `manifestRoot.<refPath>`,
- *   resolves it via the definition registry, and returns that kind's `<field>` schema
- *   (e.g. `outputType`/`inputType`). Used to type `result` against the dispatch
- *   target's declared output shape.
+ * - `x-telo-context-from-ref-kind`: reads a KIND from `manifestRoot.<refPath>` —
+ *   a field holding a kind name, or a definition's dispatch slot holding a
+ *   `!ref` to a `resources:` entry (whose kind it is) — and returns the
+ *   `<field>` schema (e.g. `outputType`/`inputType`) the entry itself declares,
+ *   else the one the kind's definition declares. Used to type `result` against
+ *   the dispatch target's declared output shape.
  *
  *   Syntax: `<refPath>#<field>` — slashes traverse the manifest tree.
  *
- *   Example: `x-telo-context-from-ref-kind: "provide/kind#outputType"` reads
- *   `manifestRoot.provide.kind` as a kind name, looks up the kind's Telo.Definition,
- *   and returns the `outputType` schema.
+ *   Example: `x-telo-context-from-ref-kind: "provide#outputType"` resolves
+ *   `manifestRoot.provide` (`!ref source`) to the entry named `source`, and
+ *   returns its `outputType` schema, or its kind's.
  *
- *   Accepts either a single string or an array of strings. With an array, paths
+ *   Accepts either a single string or an array of strings. With an array, slots
  *   are tried in order and the first one that resolves to a usable schema wins —
  *   used by `result:` to find its dispatch target under whichever entry-point
  *   field (`provide:` or `invoke:`) the definition declares.
@@ -311,7 +315,7 @@ export function resolveContextAnnotations(schema, manifestItem, opts) {
     const normalizedOpts = Array.isArray(opts)
         ? { allManifests: opts }
         : (opts ?? {});
-    const { manifestRoot = manifestItem, defs, aliases, allManifests } = normalizedOpts;
+    const { manifestRoot = manifestItem, defs, aliases, aliasesByModule, allManifests } = normalizedOpts;
     const from = schema["x-telo-context-from"];
     if (from) {
         const navigated = navigatePath(manifestItem, from.split("/"));
@@ -391,20 +395,28 @@ export function resolveContextAnnotations(schema, manifestItem, opts) {
             }
         }
         if (defs) {
+            // The kind is read off THIS document, so it is spelled in the alias scope
+            // of the module that declared it — a library's dispatch target is written
+            // through an import the consumer has no reason to have.
+            const scope = moduleAliasScope(manifestRoot.metadata, aliases, aliasesByModule);
             for (const fromRefKind of fromRefKinds) {
                 const hashIdx = fromRefKind.indexOf("#");
                 if (hashIdx <= 0)
                     continue;
                 const refPath = fromRefKind.slice(0, hashIdx);
                 const field = fromRefKind.slice(hashIdx + 1);
-                const kindValue = navigatePath(manifestRoot, refPath.split("/"));
-                if (typeof kindValue !== "string" || kindValue.length === 0)
+                const target = kindAtPath(manifestRoot, refPath);
+                if (!target)
                     continue;
-                const canonical = aliases?.resolveKind(kindValue) ?? kindValue;
-                const def = defs.resolve(canonical);
-                const typeField = def
-                    ? def[field]
-                    : undefined;
+                // The entry's own field first — a per-instance narrowing (`outputType:`
+                // on the entry) is what the kernel binds — then the kind's.
+                const own = target.entry?.[field];
+                const ownResolved = own !== undefined ? resolveTypeFieldToSchema(own, allManifests ?? []) : undefined;
+                if (ownResolved && typeof ownResolved === "object")
+                    return ownResolved;
+                const canonical = scope?.resolveKind(target.kind) ?? target.kind;
+                const def = defs.resolve(canonical) ?? defs.resolve(target.kind);
+                const typeField = def ? def[field] : undefined;
                 const resolved = resolveTypeFieldToSchema(typeField, allManifests ?? []);
                 if (resolved && typeof resolved === "object") {
                     return resolved;
@@ -516,6 +528,26 @@ function navigatePath(obj, segments) {
     }
     return cur;
 }
+/** The kind an `x-telo-context-from-ref-kind` path names: a field holding a
+ *  kind NAME (`targetKind`), or a definition's dispatch slot holding a `!ref`
+ *  to a `resources:` entry, which carries the kind — and, where it narrows
+ *  one, the contract field itself. */
+export function kindAtPath(manifestRoot, refPath) {
+    const segments = refPath.split("/");
+    const value = navigatePath(manifestRoot, segments);
+    if (typeof value === "string")
+        return value.length > 0 ? { kind: value } : undefined;
+    // The dispatch-slot reading is a fact about ONE built-in document, not about
+    // the annotation: `resources:` is a `Telo.Definition`'s entry list. The
+    // annotation itself is generic vocabulary any kind may declare, and without
+    // this gate a third-party kind whose own `resources:` array means something
+    // else would have a slot silently resolved against it — a wrong answer with
+    // nothing reporting it, which is worse than no answer.
+    if (segments.length !== 1 || manifestRoot.kind !== "Telo.Definition")
+        return undefined;
+    const dispatch = dispatchTargetOf(manifestRoot, segments[0]);
+    return dispatch ? { kind: dispatch.kind, entry: dispatch.entry } : undefined;
+}
 /**
  * Walk a JSON Schema tree and collect all `x-telo-context` annotations,
  * returning them as `{ scope, schema }` pairs using JSONPath-style scopes —

package/dist/validate-exports.d.ts

@@ -0,0 +1,28 @@
+import type { ResourceManifest } from "@telorun/sdk";
+import type { AliasResolver } from "./alias-resolver.js";
+import type { DefinitionRegistry } from "./definition-registry.js";
+import { type AnalysisDiagnostic } from "./types.js";
+/**
+ * A LIBRARY'S EXPORT LIST IS CHECKED WHERE IT IS WRITTEN.
+ *
+ * `exports.kinds` and `exports.resources` are a library's public contract, and
+ * they were read as a GATE only: a listed name resolved when a consumer asked
+ * for it, and one that named nothing failed in the consumer's file
+ * (`UNDEFINED_KIND` on `kind: L.Client`, with nothing wrong in that file) while
+ * the author who could fix it saw a clean check. Both entries are resolved here,
+ * against what the library declares:
+ *
+ *  - a bare kind names a `Telo.Definition` / `Telo.Abstract` of this module, and
+ *    `Alias.Kind` re-exports through an import declared in this file
+ *    (`EXPORT_KIND_UNKNOWN`). The one mistake that reads as intended — a bare
+ *    name that IS a kind, of an imported module — gets the re-export spelling
+ *    in its message, because a clean check was read as confirmation it worked;
+ *  - a bare instance names a resource declared in this module, and
+ *    `Alias.name` an instance the aliased import exports
+ *    (`EXPORT_RESOURCE_UNKNOWN`).
+ *
+ * Runs on the library as an ENTRY — a consumer's flattened analysis drops the
+ * library doc, and the list is not the consumer's to fix. Browser-safe.
+ */
+export declare function validateExports(manifests: ResourceManifest[], registry: DefinitionRegistry, aliases: AliasResolver, rootModules: ReadonlySet<string>): AnalysisDiagnostic[];
+//# sourceMappingURL=validate-exports.d.ts.map

package/dist/validate-exports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-exports.d.ts","sourceRoot":"","sources":["../src/validate-exports.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,EACtB,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,GAC/B,kBAAkB,EAAE,CAoJtB"}

package/dist/validate-exports.js

@@ -0,0 +1,146 @@
+import { nearestName } from "./nearest-name.js";
+import { parseExportEntry } from "./flatten-for-analyzer.js";
+import { DiagnosticSeverity } from "./types.js";
+const SOURCE = "telo-analyzer";
+/**
+ * A LIBRARY'S EXPORT LIST IS CHECKED WHERE IT IS WRITTEN.
+ *
+ * `exports.kinds` and `exports.resources` are a library's public contract, and
+ * they were read as a GATE only: a listed name resolved when a consumer asked
+ * for it, and one that named nothing failed in the consumer's file
+ * (`UNDEFINED_KIND` on `kind: L.Client`, with nothing wrong in that file) while
+ * the author who could fix it saw a clean check. Both entries are resolved here,
+ * against what the library declares:
+ *
+ *  - a bare kind names a `Telo.Definition` / `Telo.Abstract` of this module, and
+ *    `Alias.Kind` re-exports through an import declared in this file
+ *    (`EXPORT_KIND_UNKNOWN`). The one mistake that reads as intended — a bare
+ *    name that IS a kind, of an imported module — gets the re-export spelling
+ *    in its message, because a clean check was read as confirmation it worked;
+ *  - a bare instance names a resource declared in this module, and
+ *    `Alias.name` an instance the aliased import exports
+ *    (`EXPORT_RESOURCE_UNKNOWN`).
+ *
+ * Runs on the library as an ENTRY — a consumer's flattened analysis drops the
+ * library doc, and the list is not the consumer's to fix. Browser-safe.
+ */
+export function validateExports(manifests, registry, aliases, rootModules) {
+    const out = [];
+    for (const lib of manifests) {
+        if (lib.kind !== "Telo.Library")
+            continue;
+        const moduleName = lib.metadata?.name;
+        if (!moduleName || !rootModules.has(moduleName))
+            continue;
+        const exports = lib.exports;
+        if (!exports || typeof exports !== "object")
+            continue;
+        const filePath = lib.metadata?.source;
+        const resource = { kind: lib.kind, name: moduleName };
+        const own = (m) => {
+            const mod = m.metadata?.module;
+            return mod === undefined || mod === moduleName;
+        };
+        const declaredKinds = new Set();
+        const instances = new Set();
+        const importAliases = new Map();
+        const forwardedByModule = new Map();
+        for (const m of manifests) {
+            const name = m.metadata?.name;
+            if (typeof name !== "string")
+                continue;
+            const meta = m.metadata;
+            if (meta.forwardedExport && meta.module) {
+                let set = forwardedByModule.get(meta.module);
+                if (!set)
+                    forwardedByModule.set(meta.module, (set = new Set()));
+                set.add(name);
+                continue;
+            }
+            if (!own(m))
+                continue;
+            if (m.kind === "Telo.Definition" || m.kind === "Telo.Abstract")
+                declaredKinds.add(name);
+            else if (m.kind === "Telo.Import")
+                importAliases.set(name, meta.resolvedModuleName);
+            else if (m.kind !== "Telo.Library" && m.kind !== "Telo.Application")
+                instances.add(name);
+        }
+        const report = (code, path, message, fix) => out.push({
+            severity: DiagnosticSeverity.Error,
+            code,
+            source: SOURCE,
+            message: `Telo.Library/${moduleName}: ${message}`,
+            data: { resource, filePath, path, ...(fix ? { fix: { replacement: fix } } : {}) },
+        });
+        const kinds = exports.kinds;
+        if (Array.isArray(kinds)) {
+            kinds.forEach((entry, i) => {
+                if (typeof entry !== "string")
+                    return;
+                const path = `exports.kinds[${i}]`;
+                const { alias, name } = parseExportEntry(entry);
+                if (alias) {
+                    if (!importAliases.has(alias)) {
+                        report("EXPORT_KIND_UNKNOWN", path, `'exports.kinds: ${entry}' re-exports through '${alias}', which is not an import ` +
+                            `of this library. Imports: ${[...importAliases.keys()].join(", ") || "(none)"}.`);
+                        return;
+                    }
+                    const canonical = aliases.resolveKind(entry);
+                    if (canonical && !registry.resolve(canonical)) {
+                        report("EXPORT_KIND_UNKNOWN", path, `'exports.kinds: ${entry}' names no kind '${name}' exported by '${alias}'.`);
+                    }
+                    return;
+                }
+                if (declaredKinds.has(name))
+                    return;
+                // The natural first attempt at a re-export: the imported kind's bare
+                // suffix. It resolves as a kind — just not as one this library owns.
+                const viaImport = [...importAliases.keys()].find((a) => {
+                    const canonical = aliases.resolveKind(`${a}.${name}`);
+                    return canonical !== undefined && registry.resolve(canonical) !== undefined;
+                });
+                if (viaImport) {
+                    report("EXPORT_KIND_UNKNOWN", path, `'exports.kinds: ${name}' is not a kind this library declares — it is ` +
+                        `'${viaImport}.${name}', an imported kind. Re-export it as '${viaImport}.${name}', ` +
+                        `or declare a local kind that extends it.`, `${viaImport}.${name}`);
+                    return;
+                }
+                const suggestion = nearestName(name, [...declaredKinds]);
+                report("EXPORT_KIND_UNKNOWN", path, `'exports.kinds: ${name}' names no Telo.Definition or Telo.Abstract of this library. ` +
+                    `Declared: ${[...declaredKinds].join(", ") || "(none)"}.` +
+                    (suggestion ? ` Did you mean '${suggestion}'?` : ""), suggestion);
+            });
+        }
+        const resources = exports.resources;
+        if (Array.isArray(resources)) {
+            resources.forEach((entry, i) => {
+                if (typeof entry !== "string")
+                    return;
+                const path = `exports.resources[${i}]`;
+                const { alias, name } = parseExportEntry(entry);
+                if (alias) {
+                    if (!importAliases.has(alias)) {
+                        report("EXPORT_RESOURCE_UNKNOWN", path, `'exports.resources: ${entry}' re-exports through '${alias}', which is not an ` +
+                            `import of this library. Imports: ${[...importAliases.keys()].join(", ") || "(none)"}.`);
+                        return;
+                    }
+                    const targetModule = importAliases.get(alias);
+                    const exported = targetModule ? forwardedByModule.get(targetModule) : undefined;
+                    if (exported && !exported.has(name)) {
+                        report("EXPORT_RESOURCE_UNKNOWN", path, `'exports.resources: ${entry}' names no instance '${name}' exported by '${alias}'. ` +
+                            `Exported: ${[...exported].join(", ") || "(none)"}.`);
+                    }
+                    return;
+                }
+                if (instances.has(name))
+                    return;
+                const suggestion = nearestName(name, [...instances]);
+                report("EXPORT_RESOURCE_UNKNOWN", path, `'exports.resources: ${name}' names no resource declared in this library. ` +
+                    `Declared: ${[...instances].join(", ") || "(none)"}.` +
+                    (suggestion ? ` Did you mean '${suggestion}'?` : ""), suggestion);
+            });
+        }
+    }
+    return out;
+}

package/dist/validate-extends.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-extends.d.ts","sourceRoot":"","sources":["../src/validate-extends.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAQnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAiCzE,wBAAgB,eAAe,CAC7B,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,GACrB,kBAAkB,EAAE,CAqMtB"}
+{"version":3,"file":"validate-extends.d.ts","sourceRoot":"","sources":["../src/validate-extends.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AASnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAiCzE,wBAAgB,eAAe,CAC7B,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,GACrB,kBAAkB,EAAE,CA2OtB"}

package/dist/validate-extends.js

@@ -1,4 +1,4 @@
-import { controllerBearingAncestor, effectiveAuthorSchema, inheritedCapability, isInheritedDelegation, } from "./extends-resolution.js";
+import { controllerBearingAncestor, effectiveAuthorSchema, hasOwnControllerOrTemplate, inheritedCapability, isInheritedDelegation, } from "./extends-resolution.js";
 import { DiagnosticSeverity } from "./types.js";
 const SOURCE = "telo-analyzer";
 /** Alias-form pattern for `extends`: "<Alias>.<AbstractName>", two PascalCase segments. */
@@ -59,6 +59,39 @@ export function validateExtends(manifests, registry, aliases) {
         const filePath = m.metadata?.source;
         const resource = { kind: m.kind, name };
         const label = `${m.kind}/${name}`;
+        // `base:` is read on exactly one path — the inherited-controller one, which
+        // the kernel takes only when the definition has NO body of its own. A
+        // `resources:` block or a dispatch slot selects the template path, and
+        // `base:` is then never evaluated: the kind silently became an empty
+        // template, and the failure landed in the CONSUMER's resource as a `{}`
+        // where a parent instance should have been. Refused here, where the two
+        // blocks sit side by side, and at registration in the kernel.
+        //
+        // WHETHER there is a body is `hasOwnControllerOrTemplate` — the same
+        // predicate the kernel branches on, so the two halves cannot disagree about
+        // what a body is. Deciding it here with a key scan did disagree: an empty
+        // `resources: []` is falsy to a length test and truthy to the kernel's, so
+        // it passed `telo check` and threw `ERR_BASE_WITH_TEMPLATE_BODY` at boot —
+        // a brand-new guard shipping with the very gap it was written to close. The
+        // scan survives for one job only: naming the offending key in the message.
+        if (m.base != null) {
+            const hasBody = hasOwnControllerOrTemplate(m);
+            const bodyKey = ["resources", "controllers", "invoke", "run", "provide", "mount"].find((key) => m[key] !== undefined) ?? "resources";
+            if (hasBody) {
+                diagnostics.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: "BASE_WITH_TEMPLATE_BODY",
+                    source: SOURCE,
+                    message: `${label}: 'base:' maps this kind's config onto the inherited controller of ` +
+                        `'${typeof extendsOf(m) === "string" ? extendsOf(m) : "<no extends>"}', so the ` +
+                        `definition may not also declare '${bodyKey}:'. With '${bodyKey}:' the kind is a ` +
+                        `template and 'base:' is never evaluated. Either drop 'base:' and dispatch to a ` +
+                        `'resources:' entry with '!ref', or drop '${bodyKey}:' and build the parent's config ` +
+                        `in 'base:' alone.`,
+                    data: { resource, filePath, path: bodyKey },
+                });
+            }
+        }
         // --- extends validation ---
         // At this point `m.extends` is whatever the manifest declared (alias form, e.g.
         // "Ai.Model"). Resolve through the AliasResolver to the canonical form before
@@ -219,3 +252,6 @@ export function validateExtends(manifests, registry, aliases) {
     }
     return diagnostics;
 }
+function extendsOf(m) {
+    return m.extends;
+}