@telorun/analyzer 0.72.0 → 0.73.0

package/src/schema-error-report.ts

@@ -44,6 +44,13 @@ export interface SchemaIssue {
   message: string;
   /** Dotted path to the field (e.g. "config.handler"). Empty string means root. */
   path: string;
+  /** The AJV keyword that produced it, so a consumer can key on WHAT failed
+   *  rather than on how the sentence reads. Prose is the renderer's to change;
+   *  a caller matching on it breaks silently when it does, and mis-fires on any
+   *  other issue whose text happens to quote the same name. */
+  keyword?: string;
+  /** For `required`, the property that is missing. */
+  missingProperty?: string;
 }
 
 const UNION_KEYWORDS = new Set(["anyOf", "oneOf"]);
@@ -447,10 +454,15 @@ export function ajvErrorToPath(err: AjvErrorLike): string {
 
 /** Reduced, path-anchored issues — what a diagnostic list is built from. */
 export function schemaIssues(errors: AjvErrorLike[] | null | undefined): SchemaIssue[] {
-  return reduceSchemaErrors(errors).map((err) => ({
-    message: formatSingleError(err),
-    path: ajvErrorToPath(err),
-  }));
+  return reduceSchemaErrors(errors).map((err) => {
+    const missing = (err.params ?? {}).missingProperty;
+    return {
+      message: formatSingleError(err),
+      path: ajvErrorToPath(err),
+      ...(err.keyword ? { keyword: err.keyword } : {}),
+      ...(typeof missing === "string" ? { missingProperty: missing } : {}),
+    };
+  });
 }
 
 /** Reduced, rendered as one sentence — what a thrown runtime error carries. */

package/src/telo-version.ts

@@ -6,4 +6,4 @@
 // written against, and every kernel in every language reports the same scale.
 
 /** The surface generation this analyzer implements. */
-export const TELO_SURFACE_VERSION = "0.88.0";
+export const TELO_SURFACE_VERSION = "0.89.0";

package/src/template-body.ts

@@ -1,4 +1,5 @@
 import type { ResourceDefinition, ResourceManifest } from "@telorun/sdk";
+import { isRefSentinel } from "@telorun/templating";
 import type { AliasResolver } from "./alias-resolver.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
 import type { ModuleScopes } from "./alias-resolver.js";
@@ -68,6 +69,30 @@ export function templateBodies(
   return out;
 }
 
+/** What a definition's dispatch slot names: the `resources:` entry a `!ref` at
+ *  `slot` (`invoke` / `provide` / `run` / `mount`) resolves to, with its kind.
+ *  The entry is matched by its LITERAL `metadata.name`; a slot holding anything
+ *  but a `!ref`, or naming no entry, resolves to nothing — `validate-template-body`
+ *  is what reports either. `Self.<entry>` is the explicit self-qualifier. */
+export function dispatchTargetOf(
+  definition: Record<string, any>,
+  slot: string,
+): { entry: Record<string, any> | undefined; kind: string; name: string } | undefined {
+  const value = definition[slot];
+  if (!isRefSentinel(value)) return undefined;
+  const source = value.source;
+  const name = source.startsWith("Self.") ? source.slice("Self.".length) : source;
+  const bodies = definition.resources;
+  if (!Array.isArray(bodies)) return undefined;
+  for (const body of bodies) {
+    if (!body || typeof body !== "object") continue;
+    const entry = body as Record<string, any>;
+    if (entry.metadata?.name !== name || typeof entry.kind !== "string") continue;
+    return { entry, kind: entry.kind, name };
+  }
+  return undefined;
+}
+
 /** True when a CEL path lies at or inside a body's own subtree. */
 export function pathInBody(path: string, prefix: string): boolean {
   return (

package/src/validate-cel-context.ts

@@ -6,7 +6,9 @@ import {
   parseCanonicalTypeSchemaId,
 } from "@telorun/sdk";
 import { KERNEL_BUILTINS } from "./builtins.js";
+import { moduleAliasScope } from "./module-alias-scope.js";
 import { withRefSlotsAsReadings } from "./ref-slot-reading.js";
+import { dispatchTargetOf } from "./template-body.js";
 // Where CEL is evaluated is one reader (`eval-paths.ts`), and the region half of
 // it moved there so the scope walk and the `x-telo-eval` walk answer the same
 // question in one place. Re-exported: this module is where every existing
@@ -51,6 +53,9 @@ export interface ContextResolveOpts {
   aliases?: {
     resolveKind(kind: string): string | undefined;
   };
+  /** Per-declaring-module alias tables, so a kind read off a forwarded
+   *  definition resolves in the module that wrote it. */
+  aliasesByModule?: ReadonlyMap<string, { resolveKind(kind: string): string | undefined }>;
   allManifests?: Record<string, any>[];
 }
 
@@ -334,18 +339,20 @@ function collectionBindingWithheld(
  *   Example: `properties.self.x-telo-context-from-root: "schema"` reads
  *   `manifestRoot.schema` and uses it as the schema of the `self` CEL variable.
  *
- * - `x-telo-context-from-ref-kind`: reads a kind name from `manifestRoot.<refPath>`,
- *   resolves it via the definition registry, and returns that kind's `<field>` schema
- *   (e.g. `outputType`/`inputType`). Used to type `result` against the dispatch
- *   target's declared output shape.
+ * - `x-telo-context-from-ref-kind`: reads a KIND from `manifestRoot.<refPath>` —
+ *   a field holding a kind name, or a definition's dispatch slot holding a
+ *   `!ref` to a `resources:` entry (whose kind it is) — and returns the
+ *   `<field>` schema (e.g. `outputType`/`inputType`) the entry itself declares,
+ *   else the one the kind's definition declares. Used to type `result` against
+ *   the dispatch target's declared output shape.
  *
  *   Syntax: `<refPath>#<field>` — slashes traverse the manifest tree.
  *
- *   Example: `x-telo-context-from-ref-kind: "provide/kind#outputType"` reads
- *   `manifestRoot.provide.kind` as a kind name, looks up the kind's Telo.Definition,
- *   and returns the `outputType` schema.
+ *   Example: `x-telo-context-from-ref-kind: "provide#outputType"` resolves
+ *   `manifestRoot.provide` (`!ref source`) to the entry named `source`, and
+ *   returns its `outputType` schema, or its kind's.
  *
- *   Accepts either a single string or an array of strings. With an array, paths
+ *   Accepts either a single string or an array of strings. With an array, slots
  *   are tried in order and the first one that resolves to a usable schema wins —
  *   used by `result:` to find its dispatch target under whichever entry-point
  *   field (`provide:` or `invoke:`) the definition declares.
@@ -370,7 +377,8 @@ export function resolveContextAnnotations(
   const normalizedOpts: ContextResolveOpts = Array.isArray(opts)
     ? { allManifests: opts }
     : (opts ?? {});
-  const { manifestRoot = manifestItem, defs, aliases, allManifests } = normalizedOpts;
+  const { manifestRoot = manifestItem, defs, aliases, aliasesByModule, allManifests } =
+    normalizedOpts;
 
   const from = schema["x-telo-context-from"] as string | undefined;
   if (from) {
@@ -459,18 +467,29 @@ export function resolveContextAnnotations(
       }
     }
     if (defs) {
+      // The kind is read off THIS document, so it is spelled in the alias scope
+      // of the module that declared it — a library's dispatch target is written
+      // through an import the consumer has no reason to have.
+      const scope = moduleAliasScope(
+        (manifestRoot as { metadata?: { module?: unknown } }).metadata,
+        aliases,
+        aliasesByModule,
+      );
       for (const fromRefKind of fromRefKinds) {
         const hashIdx = fromRefKind.indexOf("#");
         if (hashIdx <= 0) continue;
         const refPath = fromRefKind.slice(0, hashIdx);
         const field = fromRefKind.slice(hashIdx + 1);
-        const kindValue = navigatePath(manifestRoot, refPath.split("/"));
-        if (typeof kindValue !== "string" || kindValue.length === 0) continue;
-        const canonical = aliases?.resolveKind(kindValue) ?? kindValue;
-        const def = defs.resolve(canonical);
-        const typeField = def
-          ? (def as Record<string, unknown>)[field]
-          : undefined;
+        const target = kindAtPath(manifestRoot, refPath);
+        if (!target) continue;
+        // The entry's own field first — a per-instance narrowing (`outputType:`
+        // on the entry) is what the kernel binds — then the kind's.
+        const own = target.entry?.[field];
+        const ownResolved = own !== undefined ? resolveTypeFieldToSchema(own, allManifests ?? []) : undefined;
+        if (ownResolved && typeof ownResolved === "object") return ownResolved;
+        const canonical = scope?.resolveKind(target.kind) ?? target.kind;
+        const def = defs.resolve(canonical) ?? defs.resolve(target.kind);
+        const typeField = def ? (def as Record<string, unknown>)[field] : undefined;
         const resolved = resolveTypeFieldToSchema(typeField, allManifests ?? []);
         if (resolved && typeof resolved === "object") {
           return resolved;
@@ -597,6 +616,28 @@ function navigatePath(obj: unknown, segments: string[]): unknown {
   return cur;
 }
 
+/** The kind an `x-telo-context-from-ref-kind` path names: a field holding a
+ *  kind NAME (`targetKind`), or a definition's dispatch slot holding a `!ref`
+ *  to a `resources:` entry, which carries the kind — and, where it narrows
+ *  one, the contract field itself. */
+export function kindAtPath(
+  manifestRoot: Record<string, any>,
+  refPath: string,
+): { kind: string; entry?: Record<string, any> } | undefined {
+  const segments = refPath.split("/");
+  const value = navigatePath(manifestRoot, segments);
+  if (typeof value === "string") return value.length > 0 ? { kind: value } : undefined;
+  // The dispatch-slot reading is a fact about ONE built-in document, not about
+  // the annotation: `resources:` is a `Telo.Definition`'s entry list. The
+  // annotation itself is generic vocabulary any kind may declare, and without
+  // this gate a third-party kind whose own `resources:` array means something
+  // else would have a slot silently resolved against it — a wrong answer with
+  // nothing reporting it, which is worse than no answer.
+  if (segments.length !== 1 || manifestRoot.kind !== "Telo.Definition") return undefined;
+  const dispatch = dispatchTargetOf(manifestRoot, segments[0]!);
+  return dispatch ? { kind: dispatch.kind, entry: dispatch.entry } : undefined;
+}
+
 /**
  * Walk a JSON Schema tree and collect all `x-telo-context` annotations,
  * returning them as `{ scope, schema }` pairs using JSONPath-style scopes —

package/src/validate-exports.ts

@@ -0,0 +1,185 @@
+import { nearestName } from "./nearest-name.js";
+import type { ResourceManifest } from "@telorun/sdk";
+import type { AliasResolver } from "./alias-resolver.js";
+import type { DefinitionRegistry } from "./definition-registry.js";
+import { parseExportEntry } from "./flatten-for-analyzer.js";
+import { DiagnosticSeverity, type AnalysisDiagnostic } from "./types.js";
+
+const SOURCE = "telo-analyzer";
+
+/**
+ * A LIBRARY'S EXPORT LIST IS CHECKED WHERE IT IS WRITTEN.
+ *
+ * `exports.kinds` and `exports.resources` are a library's public contract, and
+ * they were read as a GATE only: a listed name resolved when a consumer asked
+ * for it, and one that named nothing failed in the consumer's file
+ * (`UNDEFINED_KIND` on `kind: L.Client`, with nothing wrong in that file) while
+ * the author who could fix it saw a clean check. Both entries are resolved here,
+ * against what the library declares:
+ *
+ *  - a bare kind names a `Telo.Definition` / `Telo.Abstract` of this module, and
+ *    `Alias.Kind` re-exports through an import declared in this file
+ *    (`EXPORT_KIND_UNKNOWN`). The one mistake that reads as intended — a bare
+ *    name that IS a kind, of an imported module — gets the re-export spelling
+ *    in its message, because a clean check was read as confirmation it worked;
+ *  - a bare instance names a resource declared in this module, and
+ *    `Alias.name` an instance the aliased import exports
+ *    (`EXPORT_RESOURCE_UNKNOWN`).
+ *
+ * Runs on the library as an ENTRY — a consumer's flattened analysis drops the
+ * library doc, and the list is not the consumer's to fix. Browser-safe.
+ */
+export function validateExports(
+  manifests: ResourceManifest[],
+  registry: DefinitionRegistry,
+  aliases: AliasResolver,
+  rootModules: ReadonlySet<string>,
+): AnalysisDiagnostic[] {
+  const out: AnalysisDiagnostic[] = [];
+
+  for (const lib of manifests) {
+    if (lib.kind !== "Telo.Library") continue;
+    const moduleName = lib.metadata?.name as string | undefined;
+    if (!moduleName || !rootModules.has(moduleName)) continue;
+    const exports = (lib as { exports?: { kinds?: unknown; resources?: unknown } }).exports;
+    if (!exports || typeof exports !== "object") continue;
+    const filePath = (lib.metadata as { source?: string } | undefined)?.source;
+    const resource = { kind: lib.kind, name: moduleName };
+
+    const own = (m: ResourceManifest): boolean => {
+      const mod = (m.metadata as { module?: string } | undefined)?.module;
+      return mod === undefined || mod === moduleName;
+    };
+    const declaredKinds = new Set<string>();
+    const instances = new Set<string>();
+    const importAliases = new Map<string, string | undefined>();
+    const forwardedByModule = new Map<string, Set<string>>();
+    for (const m of manifests) {
+      const name = m.metadata?.name;
+      if (typeof name !== "string") continue;
+      const meta = m.metadata as {
+        module?: string;
+        forwardedExport?: boolean;
+        resolvedModuleName?: string;
+      };
+      if (meta.forwardedExport && meta.module) {
+        let set = forwardedByModule.get(meta.module);
+        if (!set) forwardedByModule.set(meta.module, (set = new Set()));
+        set.add(name);
+        continue;
+      }
+      if (!own(m)) continue;
+      if (m.kind === "Telo.Definition" || m.kind === "Telo.Abstract") declaredKinds.add(name);
+      else if (m.kind === "Telo.Import") importAliases.set(name, meta.resolvedModuleName);
+      else if (m.kind !== "Telo.Library" && m.kind !== "Telo.Application") instances.add(name);
+    }
+
+    const report = (code: string, path: string, message: string, fix?: string) =>
+      out.push({
+        severity: DiagnosticSeverity.Error,
+        code,
+        source: SOURCE,
+        message: `Telo.Library/${moduleName}: ${message}`,
+        data: { resource, filePath, path, ...(fix ? { fix: { replacement: fix } } : {}) },
+      });
+
+    const kinds = exports.kinds;
+    if (Array.isArray(kinds)) {
+      kinds.forEach((entry, i) => {
+        if (typeof entry !== "string") return;
+        const path = `exports.kinds[${i}]`;
+        const { alias, name } = parseExportEntry(entry);
+        if (alias) {
+          if (!importAliases.has(alias)) {
+            report(
+              "EXPORT_KIND_UNKNOWN",
+              path,
+              `'exports.kinds: ${entry}' re-exports through '${alias}', which is not an import ` +
+                `of this library. Imports: ${[...importAliases.keys()].join(", ") || "(none)"}.`,
+            );
+            return;
+          }
+          const canonical = aliases.resolveKind(entry);
+          if (canonical && !registry.resolve(canonical)) {
+            report(
+              "EXPORT_KIND_UNKNOWN",
+              path,
+              `'exports.kinds: ${entry}' names no kind '${name}' exported by '${alias}'.`,
+            );
+          }
+          return;
+        }
+        if (declaredKinds.has(name)) return;
+        // The natural first attempt at a re-export: the imported kind's bare
+        // suffix. It resolves as a kind — just not as one this library owns.
+        const viaImport = [...importAliases.keys()].find((a) => {
+          const canonical = aliases.resolveKind(`${a}.${name}`);
+          return canonical !== undefined && registry.resolve(canonical) !== undefined;
+        });
+        if (viaImport) {
+          report(
+            "EXPORT_KIND_UNKNOWN",
+            path,
+            `'exports.kinds: ${name}' is not a kind this library declares — it is ` +
+              `'${viaImport}.${name}', an imported kind. Re-export it as '${viaImport}.${name}', ` +
+              `or declare a local kind that extends it.`,
+            `${viaImport}.${name}`,
+          );
+          return;
+        }
+        const suggestion = nearestName(name, [...declaredKinds]);
+        report(
+          "EXPORT_KIND_UNKNOWN",
+          path,
+          `'exports.kinds: ${name}' names no Telo.Definition or Telo.Abstract of this library. ` +
+            `Declared: ${[...declaredKinds].join(", ") || "(none)"}.` +
+            (suggestion ? ` Did you mean '${suggestion}'?` : ""),
+          suggestion,
+        );
+      });
+    }
+
+    const resources = exports.resources;
+    if (Array.isArray(resources)) {
+      resources.forEach((entry, i) => {
+        if (typeof entry !== "string") return;
+        const path = `exports.resources[${i}]`;
+        const { alias, name } = parseExportEntry(entry);
+        if (alias) {
+          if (!importAliases.has(alias)) {
+            report(
+              "EXPORT_RESOURCE_UNKNOWN",
+              path,
+              `'exports.resources: ${entry}' re-exports through '${alias}', which is not an ` +
+                `import of this library. Imports: ${[...importAliases.keys()].join(", ") || "(none)"}.`,
+            );
+            return;
+          }
+          const targetModule = importAliases.get(alias);
+          const exported = targetModule ? forwardedByModule.get(targetModule) : undefined;
+          if (exported && !exported.has(name)) {
+            report(
+              "EXPORT_RESOURCE_UNKNOWN",
+              path,
+              `'exports.resources: ${entry}' names no instance '${name}' exported by '${alias}'. ` +
+                `Exported: ${[...exported].join(", ") || "(none)"}.`,
+            );
+          }
+          return;
+        }
+        if (instances.has(name)) return;
+        const suggestion = nearestName(name, [...instances]);
+        report(
+          "EXPORT_RESOURCE_UNKNOWN",
+          path,
+          `'exports.resources: ${name}' names no resource declared in this library. ` +
+            `Declared: ${[...instances].join(", ") || "(none)"}.` +
+            (suggestion ? ` Did you mean '${suggestion}'?` : ""),
+          suggestion,
+        );
+      });
+    }
+  }
+
+  return out;
+}

package/src/validate-extends.ts

@@ -4,6 +4,7 @@ import type { DefinitionRegistry } from "./definition-registry.js";
 import {
   controllerBearingAncestor,
   effectiveAuthorSchema,
+  hasOwnControllerOrTemplate,
   inheritedCapability,
   isInheritedDelegation,
   type DefResolver,
@@ -74,6 +75,44 @@ export function validateExtends(
     const resource = { kind: m.kind, name };
     const label = `${m.kind}/${name}`;
 
+    // `base:` is read on exactly one path — the inherited-controller one, which
+    // the kernel takes only when the definition has NO body of its own. A
+    // `resources:` block or a dispatch slot selects the template path, and
+    // `base:` is then never evaluated: the kind silently became an empty
+    // template, and the failure landed in the CONSUMER's resource as a `{}`
+    // where a parent instance should have been. Refused here, where the two
+    // blocks sit side by side, and at registration in the kernel.
+    //
+    // WHETHER there is a body is `hasOwnControllerOrTemplate` — the same
+    // predicate the kernel branches on, so the two halves cannot disagree about
+    // what a body is. Deciding it here with a key scan did disagree: an empty
+    // `resources: []` is falsy to a length test and truthy to the kernel's, so
+    // it passed `telo check` and threw `ERR_BASE_WITH_TEMPLATE_BODY` at boot —
+    // a brand-new guard shipping with the very gap it was written to close. The
+    // scan survives for one job only: naming the offending key in the message.
+    if ((m as { base?: unknown }).base != null) {
+      const hasBody = hasOwnControllerOrTemplate(m as ResourceDefinition);
+      const bodyKey =
+        (["resources", "controllers", "invoke", "run", "provide", "mount"] as const).find(
+          (key) => (m as Record<string, unknown>)[key] !== undefined,
+        ) ?? "resources";
+      if (hasBody) {
+        diagnostics.push({
+          severity: DiagnosticSeverity.Error,
+          code: "BASE_WITH_TEMPLATE_BODY",
+          source: SOURCE,
+          message:
+            `${label}: 'base:' maps this kind's config onto the inherited controller of ` +
+            `'${typeof extendsOf(m) === "string" ? extendsOf(m) : "<no extends>"}', so the ` +
+            `definition may not also declare '${bodyKey}:'. With '${bodyKey}:' the kind is a ` +
+            `template and 'base:' is never evaluated. Either drop 'base:' and dispatch to a ` +
+            `'resources:' entry with '!ref', or drop '${bodyKey}:' and build the parent's config ` +
+            `in 'base:' alone.`,
+          data: { resource, filePath, path: bodyKey },
+        });
+      }
+    }
+
     // --- extends validation ---
     // At this point `m.extends` is whatever the manifest declared (alias form, e.g.
     // "Ai.Model"). Resolve through the AliasResolver to the canonical form before
@@ -243,3 +282,7 @@ export function validateExtends(
 
   return diagnostics;
 }
+
+function extendsOf(m: ResourceManifest): unknown {
+  return (m as { extends?: unknown }).extends;
+}

package/src/validate-provider-coherence.ts

@@ -1,7 +1,11 @@
 import type { ResourceDefinition, ResourceManifest } from "@telorun/sdk";
 import type { AliasResolver } from "./alias-resolver.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
-import { controllerBearingAncestor, type DefResolver } from "./extends-resolution.js";
+import {
+  controllerBearingAncestor,
+  inheritedCapability,
+  type DefResolver,
+} from "./extends-resolution.js";
 import { DiagnosticSeverity, type AnalysisDiagnostic } from "./types.js";
 
 const SOURCE = "telo-analyzer";
@@ -16,20 +20,16 @@ const SOURCE = "telo-analyzer";
  *    `capability` is not `Telo.Provider`.
  *  - PROVIDE_DISPATCHER_CONFLICT: `provide:` co-exists with `invoke:` or `run:`
  *    on the same definition.
- *  - PROVIDE_TARGET_UNKNOWN: `provide.name` does not resolve to an entry in
- *    `resources:`.
- *  - PROVIDE_TARGET_NOT_INVOCABLE: `provide.name` resolves to a resource whose
- *    kind is registered but not a `Telo.Invocable`.
  *  - PROVIDER_MISSING_IMPLEMENTATION: definition with `capability: Telo.Provider`
  *    declares neither `controllers:` (TS-backed) nor `provide:` (template-backed).
  *  - MOUNT_ON_NON_MOUNT: `mount:` declared on a definition whose `capability` is
  *    not `Telo.Mount`.
  *  - MOUNT_DISPATCHER_CONFLICT: `mount:` co-exists with another dispatch
  *    entry-point (`invoke:` / `run:` / `provide:`).
- *  - MOUNT_TARGET_UNKNOWN: `mount.name` does not resolve to an entry in
- *    `resources:`.
- *  - MOUNT_TARGET_NOT_MOUNTABLE: `mount.name` resolves to a resource whose kind
- *    is registered but not a `Telo.Mount`.
+ *
+ * What a dispatch slot NAMES — that it is a `!ref`, that the entry exists, that
+ * its capability carries the method — is `validate-template-body`'s, for every
+ * slot alike.
  */
 export function validateProviderCoherence(
   manifests: ResourceManifest[],
@@ -57,13 +57,19 @@ export function validateProviderCoherence(
     const label = `${m.kind}/${name}`;
 
     const md = m as Record<string, unknown>;
-    const capability = typeof md.capability === "string" ? md.capability : undefined;
+    const resolveDef: DefResolver = (k) =>
+      registry.resolve(aliases.resolveKind(k) ?? k) ?? registry.resolve(k);
+    // The INHERITED capability, not the declared one: an `extends` child writes
+    // none of its own, so reading `md.capability` reported a child that inherits
+    // `Telo.Provider` and declares `provide:` as PROVIDE_ON_NON_PROVIDER
+    // "(found '<unset>')" — the same defect `celRuleApplies` and
+    // `validate-template-body` were fixed for, in the file next door.
+    const capability = inheritedCapability(m as ResourceDefinition, resolveDef);
     const provide = md.provide;
     const invoke = md.invoke;
     const run = md.run;
     const mount = md.mount;
     const controllers = md.controllers;
-    const resources = md.resources;
 
     const hasProvide = provide !== undefined && provide !== null;
     const hasInvoke = invoke !== undefined && invoke !== null;
@@ -96,70 +102,6 @@ export function validateProviderCoherence(
       });
     }
 
-    if (hasProvide && typeof provide === "object" && !Array.isArray(provide)) {
-      const provideObj = provide as { kind?: unknown; name?: unknown };
-      const providedName = typeof provideObj.name === "string" ? provideObj.name : undefined;
-      const providedKind = typeof provideObj.kind === "string" ? provideObj.kind : undefined;
-      if (providedName && Array.isArray(resources)) {
-        const match = resources.find((r) => {
-          const meta = (r as { metadata?: { name?: unknown } })?.metadata;
-          return typeof meta?.name === "string" && meta.name === providedName;
-        }) as { kind?: unknown } | undefined;
-        if (!match) {
-          diagnostics.push({
-            severity: DiagnosticSeverity.Error,
-            code: "PROVIDE_TARGET_UNKNOWN",
-            source: SOURCE,
-            message:
-              `${label}: 'provide.name: ${providedName}' does not match any entry's ` +
-              `metadata.name in 'resources:'.`,
-            data: { resource, filePath, path: "provide.name" },
-          });
-        } else if (typeof match.kind === "string") {
-          // `provide.kind` is the type contract the analyzer uses to type
-          // `result` CEL against the target's `outputType`. The runtime
-          // dispatches on `provide.name` and ignores `provide.kind`, so a
-          // mismatch silently degrades `result` typing to an open schema
-          // (and at runtime quietly invokes the actually-matched resource).
-          // Flag the divergence so result-typing never lies.
-          if (providedKind) {
-            const providedCanonical = aliases.resolveKind(providedKind) ?? providedKind;
-            const matchCanonical = aliases.resolveKind(match.kind) ?? match.kind;
-            if (providedCanonical !== matchCanonical) {
-              diagnostics.push({
-                severity: DiagnosticSeverity.Error,
-                code: "PROVIDE_KIND_MISMATCH",
-                source: SOURCE,
-                message:
-                  `${label}: 'provide.kind: ${providedKind}' disagrees with the matched ` +
-                  `'resources:' entry's kind '${match.kind}' (matched by metadata.name ` +
-                  `'${providedName}'). The runtime dispatches by name, so 'provide.kind' ` +
-                  `is decorative — but the analyzer types 'result:' against it, and a ` +
-                  `mismatch silently turns off that typing.`,
-                data: { resource, filePath, path: "provide.kind" },
-              });
-            }
-          }
-          const resolvedKind = aliases.resolveKind(match.kind) ?? match.kind;
-          const targetDef = registry.resolve(resolvedKind) ?? registry.resolve(match.kind);
-          if (targetDef && targetDef.kind === "Telo.Definition") {
-            const targetCap = (targetDef as { capability?: unknown }).capability;
-            if (typeof targetCap === "string" && targetCap !== "Telo.Invocable") {
-              diagnostics.push({
-                severity: DiagnosticSeverity.Error,
-                code: "PROVIDE_TARGET_NOT_INVOCABLE",
-                source: SOURCE,
-                message:
-                  `${label}: 'provide.name: ${providedName}' resolves to a ${match.kind} ` +
-                  `(capability '${targetCap}'); 'provide:' requires a Telo.Invocable target.`,
-                data: { resource, filePath, path: "provide.name" },
-              });
-            }
-          }
-        }
-      }
-    }
-
     if (hasMount && capability !== "Telo.Mount") {
       diagnostics.push({
         severity: DiagnosticSeverity.Error,
@@ -185,61 +127,9 @@ export function validateProviderCoherence(
       });
     }
 
-    if (hasMount) {
-      // Resolve the target's name from either form: the bare string (the
-      // primary, documented form — `mount: api`) or the object's `name`. A CEL
-      // target (`${{ … }}`) can only be checked at runtime, so skip those.
-      let mountedName: string | undefined;
-      if (typeof mount === "string") {
-        if (!mount.includes("${{")) mountedName = mount;
-      } else if (typeof mount === "object" && !Array.isArray(mount)) {
-        const mountObj = mount as { name?: unknown };
-        if (typeof mountObj.name === "string" && !mountObj.name.includes("${{")) {
-          mountedName = mountObj.name;
-        }
-      }
-      const mountPath = typeof mount === "string" ? "mount" : "mount.name";
-      if (mountedName && Array.isArray(resources)) {
-        const match = resources.find((r) => {
-          const meta = (r as { metadata?: { name?: unknown } })?.metadata;
-          return typeof meta?.name === "string" && meta.name === mountedName;
-        }) as { kind?: unknown } | undefined;
-        if (!match) {
-          diagnostics.push({
-            severity: DiagnosticSeverity.Error,
-            code: "MOUNT_TARGET_UNKNOWN",
-            source: SOURCE,
-            message:
-              `${label}: '${mountPath}: ${mountedName}' does not match any entry's ` +
-              `metadata.name in 'resources:'.`,
-            data: { resource, filePath, path: mountPath },
-          });
-        } else if (typeof match.kind === "string") {
-          const resolvedKind = aliases.resolveKind(match.kind) ?? match.kind;
-          const targetDef = registry.resolve(resolvedKind) ?? registry.resolve(match.kind);
-          if (targetDef && targetDef.kind === "Telo.Definition") {
-            const targetCap = (targetDef as { capability?: unknown }).capability;
-            if (typeof targetCap === "string" && targetCap !== "Telo.Mount") {
-              diagnostics.push({
-                severity: DiagnosticSeverity.Error,
-                code: "MOUNT_TARGET_NOT_MOUNTABLE",
-                source: SOURCE,
-                message:
-                  `${label}: '${mountPath}: ${mountedName}' resolves to a ${match.kind} ` +
-                  `(capability '${targetCap}'); 'mount:' requires a Telo.Mount target.`,
-                data: { resource, filePath, path: mountPath },
-              });
-            }
-          }
-        }
-      }
-    }
-
     // A definition that inherits a controller by delegation (concrete `extends`,
     // no own controller/template) satisfies the implementation requirement
     // through its parent — `base:` supplies the parent's config.
-    const resolveDef: DefResolver = (k) =>
-      registry.resolve(aliases.resolveKind(k) ?? k) ?? registry.resolve(k);
     const inheritsController =
       typeof md.extends === "string" &&
       controllerBearingAncestor(m as ResourceDefinition, resolveDef) !== undefined;