@telorun/kernel 0.78.0 → 0.79.0

package/src/evaluation-context.ts

@@ -6,9 +6,11 @@ import {
   isCompiledValue,
   isInvokeError,
   isCancellationError,
+  isSuspension,
   resourceKey,
   UNCANCELLABLE_CONTEXT,
   type EvaluationContext as IEvaluationContext,
+  type SpanOutcome,
   type EmitEvent,
   type InstanceFactory,
   type InvokeContext,
@@ -230,6 +232,121 @@ const completedInstances = new WeakSet<object>();
  * `kind` is already canonical (`<module>.<Kind>`) on that path, so the resolver
  * needs no alias table.
  */
+/**
+ * The last published reading for an instance, by identity.
+ *
+ * CEL reads a resource through its PUBLISHED STATE — that is what
+ * `resources.<name>.<field>` has always meant — and a resource reached through a
+ * ref slot is no different: `self.table.table` and `resources.users.table` name
+ * the same fact and must answer the same way. A ref slot holds the live
+ * instance, which CEL cannot read a member off at all, so this is the table that
+ * makes the two agree.
+ *
+ * Keyed by instance rather than by name because a ref slot carries no name, and
+ * a `with:`-scoped resource has one published reading per scope run. Weak, so
+ * nothing here extends an instance's lifetime, and deliberately one-directional
+ * — an entry is a reading OF an instance, never a way to obtain one.
+ */
+const publishedByInstance = new WeakMap<object, Record<string, unknown>>();
+
+/** The published reading for an instance, or undefined if it has never
+ *  published — a resource that has not been created yet, or a foreign object. */
+export function publishedPropsForInstance(
+  instance: unknown,
+): Record<string, unknown> | undefined {
+  return instance && typeof instance === "object"
+    ? publishedByInstance.get(instance as object)
+    : undefined;
+}
+
+/**
+ * The CEL-facing view of a template's `self`.
+ *
+ * Ref slots hold live instances after Phase-5 injection; each is replaced by its
+ * published reading so a template body can read a scalar off a resource it
+ * references. A slot whose instance has never published is left as it is — a
+ * value CEL will reject on member access, which is the honest outcome rather
+ * than an invented empty object that would make a typo evaluate to null.
+ */
+/**
+ * A memoized `self` view, beside the exact readings it substituted.
+ *
+ * Invalidation is per view, checked against the reading each substituted
+ * instance currently has — `publishedPropsOf` publishes a NEW props object every
+ * time, so identity IS the version. A process-global counter was wrong twice
+ * over: every `invoke()` republishes, so under any concurrency the memo was
+ * defeated and the walk was back on the per-request path it was added for; and
+ * the counter is shared across in-process kernels, so one app's traffic
+ * invalidated another app's views.
+ *
+ * The check is O(substituted slots) — the refs, not the fields — and a view that
+ * substituted nothing has an empty source list and is therefore always valid,
+ * which is the common case.
+ */
+interface SelfView {
+  readonly view: Record<string, unknown>;
+  readonly sources: readonly [object, Record<string, unknown>][];
+}
+
+const selfViews = new WeakMap<object, SelfView>();
+
+function viewIsCurrent(cached: SelfView): boolean {
+  for (const [instance, props] of cached.sources) {
+    if (publishedByInstance.get(instance) !== props) return false;
+  }
+  return true;
+}
+
+export function celSelfView(self: Record<string, unknown>): Record<string, unknown> {
+  // A template's `invoke` expands its body on EVERY dispatch, so this sits on
+  // the per-request path: without the memo a repository rebuilt the whole view
+  // per call.
+  const cached = selfViews.get(self);
+  if (cached && viewIsCurrent(cached)) return cached.view;
+
+  const sources: [object, Record<string, unknown>][] = [];
+  let view: Record<string, unknown> | undefined;
+  for (const [key, value] of Object.entries(self)) {
+    const substituted = celValueView(value, sources);
+    if (substituted === value) continue;
+    view ??= { ...self };
+    view[key] = substituted;
+  }
+  const resolved = view ?? self;
+  selfViews.set(self, { view: resolved, sources });
+  return resolved;
+}
+
+/**
+ * A ref slot holds one instance or a LIST of them (`tables: [!ref a, !ref b]`),
+ * and both are ref slots — so converting only the first would make
+ * `self.tables[0].name` mean something different from `self.table.name`, which
+ * is the inconsistency this rule exists to remove.
+ *
+ * Arrays only: the walk stops at any other object, because a nested plain object
+ * in a manifest is the author's own data and a resource's published reading is
+ * not something to graft into the middle of it.
+ */
+function celValueView(
+  value: unknown,
+  sources: [object, Record<string, unknown>][],
+): unknown {
+  const published = publishedPropsForInstance(value);
+  if (published) {
+    sources.push([value as object, published]);
+    return published;
+  }
+  if (!Array.isArray(value)) return value;
+  let copy: unknown[] | undefined;
+  for (let i = 0; i < value.length; i++) {
+    const substituted = celValueView(value[i], sources);
+    if (substituted === value[i]) continue;
+    copy ??= [...value];
+    copy[i] = substituted;
+  }
+  return copy ?? value;
+}
+
 export async function publishedPropsOf(
   kind: string,
   name: string,
@@ -240,7 +357,7 @@ export async function publishedPropsOf(
     typeof instance.snapshot === "function"
       ? ((await Promise.resolve(instance.snapshot())) as Record<string, unknown> | undefined)
       : undefined;
-  return buildPublishedProps(snap, {
+  const props = buildPublishedProps(snap, {
     kind,
     name,
     module: kind.split(".")[0],
@@ -249,6 +366,8 @@ export async function publishedPropsOf(
     started: startedInstances.has(instance),
     completed: completedInstances.has(instance),
   });
+  publishedByInstance.set(instance, props);
+  return props;
 }
 
 /**
@@ -381,6 +500,19 @@ export class EvaluationContext implements IEvaluationContext {
   /** Resources queued for initialization on this context node. */
   private pendingResources: ResourceManifest[] = [];
 
+  /**
+   * Every manifest ever registered on this node, by name — kept after the
+   * resource has been created, unlike `pendingResources`, which drains.
+   *
+   * A DECLARATION-derived contract (`x-telo-schema-projection-from`) is resolved
+   * when the kernel binds a contract, which happens during create — so the
+   * pending queue has already given the target up by then. The declaration is
+   * what the projection reads (a table's `columns:`), not the instance, so this
+   * is the record it needs. Manifests only, one direction: nothing here yields
+   * an instance, and nothing here extends one's lifetime.
+   */
+  protected readonly declaredManifests = new Map<string, ResourceManifest>();
+
   /** Per-resource dependency names, captured at create() time — BEFORE Phase-5
    *  injection swaps refs for live instances, so the walk sees plain objects and
    *  cannot wander into a controller's (possibly cyclic) object graph. Read only
@@ -523,18 +655,17 @@ export class EvaluationContext implements IEvaluationContext {
       | Record<string, unknown>
       | undefined;
     const kind = entry.resource.kind as string;
-    this.onResourceSnapshotted(
+    const props = buildPublishedProps(snap, {
+      kind,
       name,
-      buildPublishedProps(snap, {
-        kind,
-        name,
-        module: entry.resource.metadata?.module as string | undefined,
-        statusSchema: this.statusSchemaOf(kind),
-        status: reportedStatus.get(entry.instance),
-        started: startedInstances.has(entry.instance),
-        completed: completedInstances.has(entry.instance),
-      }),
-    );
+      module: entry.resource.metadata?.module as string | undefined,
+      statusSchema: this.statusSchemaOf(kind),
+      status: reportedStatus.get(entry.instance),
+      started: startedInstances.has(entry.instance),
+      completed: completedInstances.has(entry.instance),
+    });
+    publishedByInstance.set(entry.instance, props);
+    this.onResourceSnapshotted(name, props);
   }
 
   get context(): Record<string, unknown> {
@@ -580,6 +711,35 @@ export class EvaluationContext implements IEvaluationContext {
       throw new RuntimeError("ERR_DUPLICATE_RESOURCE", `Resource '${name}' is already registered`);
     }
     this.pendingResources.push(resource);
+    this.declaredManifests.set(name, resource);
+  }
+
+  /**
+   * The manifest a name was DECLARED with, resolved scope-local first and then
+   * up the enclosing chain — the order `getInstance` and the CEL `resources`
+   * layering already use, so a declaration lookup and an instance lookup agree
+   * about what a name means inside a scope.
+   *
+   * `alias` routes into an import's exported instances, the one shape a bare
+   * name cannot reach. Returns undefined rather than throwing: a caller here is
+   * typing a contract, and a name that resolves to nothing is reported by the
+   * check that owns that failure, not by a lookup.
+   */
+  resolveDeclaredManifest(name: string, alias?: string): ResourceManifest | undefined {
+    if (alias && alias !== "Self") return this.resolveImportedManifest(alias, name);
+    let node: EvaluationContext | undefined = this;
+    while (node) {
+      const found = node.declaredManifests.get(name);
+      if (found) return found;
+      node = node.parent as EvaluationContext | undefined;
+    }
+    return undefined;
+  }
+
+  /** The manifest half of {@link resolveImportedInstance}. Overridden by
+   *  `ModuleContext`, which is the only node that has imports. */
+  resolveImportedManifest(alias: string, name: string): ResourceManifest | undefined {
+    return undefined;
   }
 
   /**
@@ -625,6 +785,7 @@ export class EvaluationContext implements IEvaluationContext {
       this.emit,
     );
     child.resolveImportedInstance = (alias, name) => this.resolveImportedInstance(alias, name);
+    child.resolveImportedManifest = (alias, name) => this.resolveImportedManifest(alias, name);
     child.kindResolver = (kind) => this.resolveKindSafe(kind);
     return this.spawnChild(child);
   }
@@ -1138,7 +1299,7 @@ export class EvaluationContext implements IEvaluationContext {
     traceId: string | undefined,
     capability: "invoke" | "run" | "provide" | "request",
     phase: "start" | "end",
-    outcome: "ok" | "failed" | "rejected" | "cancelled" | undefined,
+    outcome: SpanOutcome | undefined,
     detail: Record<string, unknown>,
   ): Record<string, unknown> {
     return {
@@ -1192,7 +1353,7 @@ export class EvaluationContext implements IEvaluationContext {
     const rootScope = tracing && parentInvocationId === undefined ? this.traceRootScope() : undefined;
     const span = (
       phase: "start" | "end",
-      outcome: "ok" | "failed" | "rejected" | "cancelled" | undefined,
+      outcome: SpanOutcome | undefined,
       detail: Record<string, unknown>,
     ) =>
       this.tracePayload(
@@ -1259,6 +1420,25 @@ export class EvaluationContext implements IEvaluationContext {
         await this.emit(`${name}.InvokeCancelled`, span("end", "cancelled", { inputs, reason }));
         throw err;
       }
+      // A SUSPENSION passes through untouched, exactly as a cancellation does,
+      // and for a sharper reason. It is not a failure — it is the run leaving —
+      // and the chokepoint is the one swallower that cannot be worked around:
+      // EVERY dispatch between a parking kind and the workflow that owns the run
+      // goes through here, so wrapping it once converts a park into an
+      // `ERR_EXECUTION_FAILED` at every hop. The latch would then catch the
+      // corruption at the boundary, which is a loud failure where nothing was
+      // wrong.
+      //
+      // Reported as its own outcome rather than as a rejection: a parked
+      // invocation neither succeeded nor failed, and a trace that recorded it
+      // as failed would say the run broke every time it waited.
+      if (isSuspension(err)) {
+        await this.emit(
+          `${name}.InvokeParked`,
+          span("end", "parked", { inputs, path: err.path, resource: err.resource }),
+        );
+        throw err;
+      }
       if (isInvokeError(err)) {
         const detail = { inputs, code: err.code, message: err.message, data: err.data };
         await this.emit(`${name}.InvokeRejected`, span("end", "rejected", detail));
@@ -1394,7 +1574,7 @@ export class EvaluationContext implements IEvaluationContext {
     };
     const payload = (
       phase: "start" | "end",
-      outcome: "ok" | "failed" | "rejected" | "cancelled" | undefined,
+      outcome: SpanOutcome | undefined,
       extra: Record<string, unknown> = {},
     ) =>
       this.tracePayload(

package/src/index.ts

@@ -35,6 +35,12 @@ export {
   type ResolvedControllerLayer,
 } from "./bundle/module-artifact.js";
 export { readOwnerManifest, type OwnerManifest } from "./bundle/module-manifest.js";
+export {
+  buildSiblingLibraries,
+  NO_SIBLING_LIBRARIES,
+  type SiblingLibraryMap,
+  type ResolvedSiblingLibrary,
+} from "./controller-loaders/sibling-libraries.js";
 export {
   buildControllerBundle,
   canBuildFromSource,

package/src/instance-declaration.ts

@@ -0,0 +1,36 @@
+import type { ResourceManifest } from "@telorun/sdk";
+
+/**
+ * Instance → the manifest it was DECLARED with, recorded at `create()` — the
+ * kernel's single instance-production site, beside where the handle is minted
+ * and the contract is bound.
+ *
+ * A contract typed from a referenced declaration
+ * (`x-telo-schema-projection-from`) is bound AFTER Phase-5 injection has already
+ * replaced the reference in the slot with the live instance, so the reference is
+ * gone by the time the contract needs it. This is what recovers the declaration
+ * behind it — and recovering it is what lets the kernel enforce exactly the
+ * schema the analyzer checked, rather than a reopened one.
+ *
+ * Its own module rather than a second table in `resource-handle.ts`, which
+ * guards an exact export list precisely so a new direction gets looked at: the
+ * rule there is that a HANDLE must never become someone else's live instance,
+ * and this is the unrelated instance→declaration direction. Weak and one-way —
+ * a manifest is obtainable FROM an instance, never an instance from a manifest —
+ * so nothing here extends a lifetime or hands out a reference to live state.
+ */
+const declarations = new WeakMap<object, ResourceManifest>();
+
+/** Record what a live instance was declared with. First record wins, matching
+ *  the handle rule: a `base:` child IS its parent instance, and the parent's
+ *  declaration is the one that produced it. */
+export function recordInstanceDeclaration(instance: object, manifest: ResourceManifest): void {
+  if (!declarations.has(instance)) declarations.set(instance, manifest);
+}
+
+/** The manifest a live instance was declared with, if it is one of ours. */
+export function declarationOfInstance(instance: unknown): ResourceManifest | undefined {
+  return instance && typeof instance === "object"
+    ? declarations.get(instance as object)
+    : undefined;
+}

package/src/invocation-contract-binding.ts

@@ -1,10 +1,14 @@
 import {
   type ContractDirection,
+  type ProjectionScope,
   declaredScalarPaths,
   type DeclaredScalarForm,
   type DeclaredScalarPath,
   defaultBearingPaths,
   effectiveContractField,
+  describeProjectionFailure,
+  resolveSchemaProjections,
+  type ProjectionFailure,
   type DefResolver,
   withLiveValuesSkipped,
 } from "@telorun/analyzer";
@@ -13,6 +17,7 @@ import {
   ERR_CONTRACT_UNRESOLVABLE,
   ERR_INPUT_INVALID,
   ERR_OUTPUT_INVALID,
+  ERR_SCHEMA_PROJECTION_UNRESOLVED,
   InvokeError,
 } from "@telorun/sdk";
 
@@ -120,6 +125,19 @@ export function resolveBoundContract(
   definition: ResourceDefinition | undefined,
   resolveDef: DefResolver,
   factory: ContractValidatorFactory,
+  /**
+   * Resolves a DECLARATION-derived slot (`x-telo-schema-projection-from`) to the
+   * shape the referenced declaration projects to.
+   *
+   * The kernel resolves it for the same reason the analyzer does, and it must be
+   * the SAME resolution: a projected contract enforced statically and not at
+   * dispatch is a contract with a hole exactly where a value is computed rather
+   * than written — `telo check` rejects a misspelled column in a literal and the
+   * identical key arriving from a CEL expression reaches the database. Omitted
+   * only by callers with no scope to resolve against, where the annotated node
+   * stays as it was.
+   */
+  projections?: ProjectionScope,
 ): BoundContract | undefined {
   const own = (manifest as unknown as Record<string, unknown>)[direction];
   const declared =
@@ -146,13 +164,43 @@ export function resolveBoundContract(
           `The type is not registered, so the contract cannot be enforced.`,
       );
     }
-    const stripped = withLiveValuesSkipped(schema, factory.resolveRef);
+    let projected = schema;
+    if (projections) {
+      const failures: ProjectionFailure[] = [];
+      projected = resolveSchemaProjections(
+        schema,
+        manifest as unknown as Record<string, any>,
+        projections,
+        failures,
+      ) as Record<string, any>;
+      if (failures.length > 0) {
+        // A slot that opted into a projection and got none is a DEFECT, not a
+        // default: leaving it means the contract silently reopens to the slot's
+        // own schema, which for a projected slot constrains nothing — the exact
+        // reopening this mechanism exists to prevent. The analyzer reports the
+        // same set, but only for the entry's own modules, so a dependency's
+        // consumer slot would otherwise be unreported at BOTH ends. Same rule as
+        // `ERR_CONTRACT_UNRESOLVABLE` above, for the same reason.
+        throw new InvokeError(
+          ERR_SCHEMA_PROJECTION_UNRESOLVED,
+          `declared \`${direction}\` could not be projected: ` +
+            failures.map(describeProjectionFailure).join(" ") +
+            ` The slot declares 'x-telo-schema-projection-from', so leaving it unresolved ` +
+            `would enforce nothing where it promises a declared shape.`,
+        );
+      }
+    }
+    const stripped = withLiveValuesSkipped(projected, factory.resolveRef);
     paths = defaultBearingPaths(stripped, factory.resolveRef);
     scalars = declaredScalarPaths(stripped, factory.resolveRef);
     // Compile by NAME whenever the declaration is one, so the type's CEL
     // `rules:` are composed in — including when a stream had to be stripped, in
     // which case the stream-bearing properties are dropped from the schema the
     // named validator sees rather than the reference being abandoned.
+    // A named type compiles BY NAME so its CEL `rules:` compose in — but only
+    // while the schema is untouched. Stripping a stream or resolving a
+    // projection both produce a different schema, so both take the
+    // rules-preserving path rather than the bare name.
     compiled = !isNamedTypeReference(declared)
       ? factory(stripped)
       : stripped === schema

package/src/kernel.ts

@@ -17,6 +17,7 @@ import {
   type ContractValidatorFactory,
   resolveBoundContract,
 } from "./invocation-contract-binding.js";
+import { readProjectionRef, type ProjectionScope } from "@telorun/analyzer";
 import {
   ControllerContext,
   ControllerPolicy,
@@ -26,6 +27,7 @@ import {
   ResourceDefinition,
   ResourceInstance,
   ResourceManifest,
+  stampRefIdentity,
   RuntimeError,
   RuntimeEvent,
   type BootTarget,
@@ -49,6 +51,7 @@ import { ambientInvokeContext } from "./evaluation-context.js";
 import { ModuleContext } from "./module-context.js";
 import { ResourceContextImpl } from "./resource-context.js";
 import { mintResourceHandle } from "./resource-handle.js";
+import { declarationOfInstance, recordInstanceDeclaration } from "./instance-declaration.js";
 import { nodeHostVersions } from "./host-versions.js";
 import { nodeCelHandlers } from "./cel-handlers.js";
 import { parseRef, seedInvokeSource } from "./invoke-dispatch.js";
@@ -1417,6 +1420,18 @@ export class Kernel implements IKernel {
       resolvedKind,
       (processedResource.metadata?.name as string | undefined) ?? "<unnamed>",
     );
+    recordInstanceDeclaration(instance, processedResource);
+    // Stamp the DECLARATION SITE here rather than at Phase-5 injection, because
+    // this is the only point where the instance and the context that declared it
+    // are both in hand: injection sees the consumer's context, not the target's,
+    // so a module stamped there would be whoever referenced it. Without it a
+    // durable step could not name its target anywhere the instance does not
+    // exist — the whole reason `step()` takes an identity at all.
+    const originPointer = originPointerOf(processedResource);
+    stampRefIdentity(instance, resolvedKind, processedResource.metadata?.name ?? "<unnamed>", {
+      ...(moduleCtx?.source ? { module: moduleCtx.source } : {}),
+      ...(originPointer === undefined ? {} : { pointer: originPointer }),
+    });
     (ctx as ResourceContextImpl).bindResourceIdentity(handle, resolvedKind, processedResource);
 
     // Bind the resolved invocation contract to the instance, here at the kernel's
@@ -1491,8 +1506,43 @@ export class Kernel implements IKernel {
     const resolveDef: DefResolver = (kind, from) =>
       this.registry.resolveDefinitionIn(kind, from?.metadata?.module);
 
-    const input = resolveBoundContract("inputType", resource, definition, resolveDef, factory);
-    const output = resolveBoundContract("outputType", resource, definition, resolveDef, factory);
+    // A DECLARATION-derived slot is resolved against the context that OWNS this
+    // resource, so a bare name means the same thing here as it does to `!ref`
+    // and to CEL — scope-local first, enclosing module as the fallback — and an
+    // alias routes into that import's exported instances.
+    const projections: ProjectionScope = {
+      resolveDefinition: (kind) =>
+        this.controllers.getDefinition(kind) as unknown as Record<string, any> | undefined,
+      // The slot holds the LIVE INSTANCE by now — Phase-5 injection runs before
+      // create — so the declaration is recovered by instance identity. The ref
+      // shape is still accepted, because a ref slot on a `with:`-scoped resource
+      // is not an injection site and reaches the controller unresolved.
+      resolveManifest: (value) => {
+        const injected = declarationOfInstance(value);
+        if (injected) return { manifest: injected as unknown as Record<string, any> };
+        const ref = readProjectionRef(value);
+        if (!ref) return undefined;
+        const found = impl.resolveDeclaredManifest(ref.name, ref.alias);
+        return found ? { manifest: found as unknown as Record<string, any> } : undefined;
+      },
+    };
+
+    const input = resolveBoundContract(
+      "inputType",
+      resource,
+      definition,
+      resolveDef,
+      factory,
+      projections,
+    );
+    const output = resolveBoundContract(
+      "outputType",
+      resource,
+      definition,
+      resolveDef,
+      factory,
+      projections,
+    );
     if (!input && !output) return;
 
     bindContract(instance, {
@@ -1576,3 +1626,28 @@ export class Kernel implements IKernel {
     );
   }
 }
+
+/**
+ * The JSON pointer to an inline declaration, from the origin the loader stamped.
+ *
+ * `xTeloOrigin.pathFromParent` is a dotted path with `[N]` indices — the loader's
+ * own spelling, which addresses the manifest tree and nothing else. A pointer is
+ * what crosses a boundary, so the conversion happens here rather than being left
+ * to each recipient to reinvent: segments are identifiers and indices, so the
+ * rewrite is mechanical and total.
+ */
+function originPointerOf(resource: ResourceManifest): string | undefined {
+  const origin = resource.metadata?.xTeloOrigin as
+    | { parentName?: unknown; pathFromParent?: unknown }
+    | undefined;
+  if (typeof origin?.parentName !== "string" || typeof origin.pathFromParent !== "string") {
+    return undefined;
+  }
+  const pointer = origin.pathFromParent
+    .replace(/\[(\d+)\]/g, ".$1")
+    .split(".")
+    .filter((segment) => segment.length > 0)
+    .map((segment) => segment.replace(/~/g, "~0").replace(/\//g, "~1"))
+    .join("/");
+  return `${origin.parentName}#/${pointer}`;
+}

package/src/manifest-schemas.ts

@@ -22,6 +22,7 @@ export {
   manifestFragmentRef,
   ResourceRefSchema,
   RetryPolicySchema,
+  StepSchema,
   withSchemaFragments,
 } from "@telorun/analyzer";
 

package/src/module-context.ts

@@ -15,6 +15,7 @@ import type {
   InvokeStepContext,
   ModuleContext as IModuleContext,
   ResourceInstance,
+  ResourceManifest,
 } from "@telorun/sdk";
 import type { EmitEvent, InstanceFactory } from "@telorun/sdk";
 import { EvaluationContext } from "./evaluation-context.js";
@@ -106,7 +107,11 @@ export class ModuleContext extends EvaluationContext implements IModuleContext {
       names: Set<string>;
       terminal: (
         name: string,
-      ) => (() => { kind: string; instance: ResourceInstance } | undefined) | undefined;
+      ) =>
+        | (() =>
+            | { kind: string; instance: ResourceInstance; manifest?: ResourceManifest }
+            | undefined)
+        | undefined;
     }
   >();
 
@@ -292,7 +297,11 @@ export class ModuleContext extends EvaluationContext implements IModuleContext {
     names: string[],
     terminal: (
       name: string,
-    ) => (() => { kind: string; instance: ResourceInstance } | undefined) | undefined,
+    ) =>
+      | (() =>
+          | { kind: string; instance: ResourceInstance; manifest?: ResourceManifest }
+          | undefined)
+      | undefined,
   ): void {
     this.importedScopes.set(alias, { names: new Set(names), terminal });
   }
@@ -369,7 +378,11 @@ export class ModuleContext extends EvaluationContext implements IModuleContext {
         const kind = rawKind.startsWith("Self.")
           ? `${moduleName}.${rawKind.slice("Self.".length)}`
           : rawKind;
-        return { kind, instance: inst.instance };
+        // The manifest rides along because a DECLARATION-derived contract
+        // (`x-telo-schema-projection-from`) reads the target's own declaration,
+        // and a re-export forwards this getter verbatim — so carrying it here
+        // makes it reachable at any depth with no second table.
+        return { kind, instance: inst.instance, manifest: inst.resource };
       });
     }
     for (const k of kindEntries) {
@@ -407,6 +420,14 @@ export class ModuleContext extends EvaluationContext implements IModuleContext {
     return scope.terminal(name)?.()?.instance;
   }
 
+  /** The manifest half of `resolveImportedInstance` — what a name was DECLARED
+   *  with, for a contract typed from a referenced declaration. */
+  override resolveImportedManifest(alias: string, name: string): ResourceManifest | undefined {
+    const scope = this.importedScopes.get(alias);
+    if (!scope || !scope.names.has(name)) return undefined;
+    return scope.terminal(name)?.()?.manifest;
+  }
+
   /** Like `resolveImportedInstance`, but returns the `{kind, name}` ref (canonical kind)
    *  for controllers that resolve step/handler invokes to refs rather than live instances
    *  (e.g. Run.Sequence via `ensureKindRef`). The alias is reattached by the caller. */

package/src/resource-context.ts

@@ -26,6 +26,7 @@ import {
   type ResourceHandle,
   type RuntimeSeam,
   type TypeRule,
+  type OpenZoneAttributes,
   type ZoneEntry,
 } from "@telorun/sdk";
 import { registerTeloKeywords } from "@telorun/analyzer";
@@ -426,6 +427,10 @@ export class ResourceContextImpl implements ResourceContext {
     return this.zoneContext().zonesFor(instance, ctx);
   }
 
+  zoneAttributes(ctx?: InvokeContext): readonly OpenZoneAttributes[] {
+    return this.zoneContext().zoneAttributes(ctx);
+  }
+
   /** The root context for runtime-driven inbound work — inherits nothing from
    *  whatever ambient happens to be live at the registration site. */
   rootContext(opts?: { cancellation?: CancellationSource }): InvokeContext {
@@ -514,6 +519,19 @@ export class ResourceContextImpl implements ResourceContext {
     return this.moduleContext.resolveImportedInstance(alias, name);
   }
 
+  /**
+   * The manifest a name was DECLARED with, resolved in the context that OWNS
+   * this resource — scope-local first, enclosing module as the fallback, an
+   * alias routing into that import's exports. The same order `resolveRef` and
+   * the CEL `resources` layering use, so a declaration lookup cannot disagree
+   * with them about what a name means.
+   *
+   * Used to resolve a DECLARATION-derived contract slot at bind time.
+   */
+  resolveDeclaredManifest(name: string, alias?: string): ResourceManifest | undefined {
+    return this.owningContext.resolveDeclaredManifest?.(name, alias);
+  }
+
   resolveRef<T>(
     value: unknown,
     guard: (candidate: unknown) => candidate is T,