@telorun/language-server 0.102.0 → 0.103.1

package/dist/language-server.mjs

@@ -17440,8 +17440,8 @@ function normalizePath(path) {
 function splitSource(source) {
   const match = SCHEME.exec(source);
   if (match) return { prefix: `${match[1]}://${match[2]}`, path: match[3] || "/" };
-  const unc = /^(\/\/[^/]+)(.*)$/.exec(source);
-  if (unc) return { prefix: unc[1], path: unc[2] || "/" };
+  const root = /^(\/\/[^/]+|\/[A-Za-z]:(?=\/|$))(.*)$/.exec(source);
+  if (root) return { prefix: root[1], path: root[2] || "/" };
   return { prefix: "", path: source };
 }
 function dirnameOf(source) {
@@ -17478,7 +17478,7 @@ function resolveAgainst(base, relative) {
 }
 
 // src/engine-version.ts
-var TELO_ENGINE_VERSION = "0.102.0";
+var TELO_ENGINE_VERSION = "0.103.1";
 
 // src/engine-port.ts
 var import_browser = __toESM(require_main3(), 1);
@@ -38699,21 +38699,22 @@ function createAjv() {
 }
 var ajv = createAjv();
 var compiledSchemaValidators = /* @__PURE__ */ new WeakMap();
+var DEFAULT_ROLES = { source: "source", target: "target" };
 function unionBranches(schema4) {
   const branches = schema4.anyOf ?? schema4.oneOf;
   if (!Array.isArray(branches) || branches.length === 0) return void 0;
   return branches.filter((b) => b && typeof b === "object");
 }
-function checkSchemaCompatibility(source, target, resolveRef2) {
+function checkSchemaCompatibility(source, target, resolveRef2, roles = DEFAULT_ROLES) {
   const issues = [];
-  compare(source, target, "", issues, resolveRef2, /* @__PURE__ */ new Set());
+  compare(source, target, "", issues, resolveRef2, /* @__PURE__ */ new Set(), roles);
   return { compatible: issues.length === 0, issues };
 }
 function deref(schema4, resolveRef2) {
   if (!resolveRef2 || typeof schema4.$ref !== "string") return schema4;
   return resolveRef2(schema4.$ref) ?? schema4;
 }
-function compare(rawSource, rawTarget, path, issues, resolveRef2, seen) {
+function compare(rawSource, rawTarget, path, issues, resolveRef2, seen, roles) {
   if (!rawSource || !rawTarget || typeof rawSource !== "object" || typeof rawTarget !== "object") {
     return;
   }
@@ -38734,7 +38735,7 @@ function compare(rawSource, rawTarget, path, issues, resolveRef2, seen) {
     for (const left of lefts) {
       for (const right of rights) {
         const probe = [];
-        compare(left, right, path, probe, resolveRef2, new Set(seen));
+        compare(left, right, path, probe, resolveRef2, new Set(seen), roles);
         if (probe.length === 0) return;
         reasons.push(...probe);
       }
@@ -38749,7 +38750,7 @@ function compare(rawSource, rawTarget, path, issues, resolveRef2, seen) {
   if (sourceType && targetType) {
     if (sourceType.name !== targetType.name) {
       issues.push(
-        `${path || "/"}: value type mismatch \u2014 source is '${sourceType.name}', target expects '${targetType.name}'`
+        `${path || "/"}: value type mismatch \u2014 ${roles.source} is '${sourceType.name}', ${roles.target} expects '${targetType.name}'`
       );
       return;
     }
@@ -38762,7 +38763,8 @@ function compare(rawSource, rawTarget, path, issues, resolveRef2, seen) {
         `${path}<${argument}>`,
         issues,
         resolveRef2,
-        seen
+        seen,
+        roles
       );
     }
     return;
@@ -38772,7 +38774,7 @@ function compare(rawSource, rawTarget, path, issues, resolveRef2, seen) {
     const other = sourceType ? target : source;
     if (targetType?.entry?.fromHost !== void 0 && (source.type !== void 0 || source.const !== void 0 || source.enum !== void 0)) {
       issues.push(
-        `${path || "/"}: value type mismatch \u2014 target expects '${targetType.name}', source is a plain value`
+        `${path || "/"}: value type mismatch \u2014 ${roles.target} expects '${targetType.name}', ${roles.source} is a plain value`
       );
       return;
     }
@@ -38781,7 +38783,7 @@ function compare(rawSource, rawTarget, path, issues, resolveRef2, seen) {
       const asJson = base === void 0 ? void 0 : declared.entry.base;
       if (asJson !== other.type) {
         issues.push(
-          `${path || "/"}: value type mismatch \u2014 ${sourceType ? "source is" : "target expects"} '${declared.name}', ${sourceType ? "target expects" : "source is"} '${other.type}'`
+          `${path || "/"}: value type mismatch \u2014 ${sourceType ? `${roles.source} is` : `${roles.target} expects`} '${declared.name}', ${sourceType ? `${roles.target} expects` : `${roles.source} is`} '${other.type}'`
         );
         return;
       }
@@ -38789,7 +38791,7 @@ function compare(rawSource, rawTarget, path, issues, resolveRef2, seen) {
   }
   if (typeof source.type === "string" && typeof target.type === "string" && source.type !== target.type) {
     issues.push(
-      `${path || "/"}: type mismatch \u2014 source is '${source.type}', target expects '${target.type}'`
+      `${path || "/"}: type mismatch \u2014 ${roles.source} is '${source.type}', ${roles.target} expects '${target.type}'`
     );
     return;
   }
@@ -38800,7 +38802,8 @@ function compare(rawSource, rawTarget, path, issues, resolveRef2, seen) {
       `${path}[]`,
       issues,
       resolveRef2,
-      seen
+      seen,
+      roles
     );
   }
   const targetRequired = Array.isArray(target.required) ? target.required : [];
@@ -38809,13 +38812,13 @@ function compare(rawSource, rawTarget, path, issues, resolveRef2, seen) {
   for (const field of targetRequired) {
     if (!(field in sourceProps)) {
       if (source.properties === void 0) continue;
-      issues.push(`${path}/${field}: required by target but missing from source`);
+      issues.push(`${path}/${field}: required by ${roles.target} but missing from ${roles.source}`);
       continue;
     }
     const srcProp = sourceProps[field];
     const tgtProp = targetProps[field];
     if (tgtProp && srcProp) {
-      compare(srcProp, tgtProp, `${path}/${field}`, issues, resolveRef2, seen);
+      compare(srcProp, tgtProp, `${path}/${field}`, issues, resolveRef2, seen, roles);
     }
   }
 }
@@ -39914,6 +39917,7 @@ function readRefSlot(node) {
   let useCases;
   let inputs;
   let throwsThrough = false;
+  let outputType;
   for (const carrier of nodes) {
     const annotation = carrier["x-telo-ref"];
     for (const kind of readKinds(annotation)) {
@@ -39925,6 +39929,7 @@ function readRefSlot(node) {
     useCases ??= readUseCases(obj.use);
     if (typeof obj.inputs === "string") inputs ??= obj.inputs;
     if (obj.throwsThrough === true) throwsThrough = true;
+    if (isSchemaObject(obj.outputType)) outputType ??= obj.outputType;
   }
   const slot = {
     kinds,
@@ -39935,8 +39940,12 @@ function readRefSlot(node) {
   if (useCases) slot.useCases = useCases;
   if (inputs !== void 0) slot.inputs = inputs;
   if (throwsThrough) slot.throwsThrough = true;
+  if (outputType) slot.outputType = outputType;
   return slot;
 }
+function isSchemaObject(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
 function isRefSlot(node) {
   return annotationNodes(node).length > 0;
 }
@@ -39949,6 +39958,7 @@ function refSlotAnnotation(slot) {
   else if (slot.uses.length > 1) annotation.use = slot.uses;
   if (slot.inputs !== void 0) annotation.inputs = slot.inputs;
   if (slot.throwsThrough) annotation.throwsThrough = true;
+  if (slot.outputType) annotation.outputType = slot.outputType;
   return annotation;
 }
 function rewriteRefSlotKinds(annotationHolder, map3) {
@@ -41990,6 +42000,7 @@ function refSlotOfEntry(entry) {
   if (entry.useCases) slot.useCases = entry.useCases;
   if (entry.inputs !== void 0) slot.inputs = entry.inputs;
   if (entry.throwsThrough) slot.throwsThrough = true;
+  if (entry.outputType) slot.outputType = entry.outputType;
   return slot;
 }
 function isRefEntry(entry) {
@@ -42197,6 +42208,7 @@ function traverseNode(node, path, sink, root, onStack = /* @__PURE__ */ new Map(
     if (node["x-telo-context"]) entry.context = node["x-telo-context"];
     if (slot.inline) entry.inline = true;
     if (slot.throwsThrough) entry.throwsThrough = true;
+    if (slot.outputType) entry.outputType = slot.outputType;
     sink.ref(path, entry, node);
     for (const variantKey2 of ["oneOf", "anyOf", "allOf"]) {
       const variants = node[variantKey2];
@@ -46153,690 +46165,195 @@ function dataEdges(node, manifest, fromModule, resolveName, rowIdByPath, rowsByO
   return out;
 }
 
-// ../../analyzer/nodejs/src/manifest-analysis.ts
-var ManifestAnalysis = class {
-  constructor(manifests, ctx) {
-    this.manifests = manifests;
-    this.ctx = ctx;
-    const rootModules = /* @__PURE__ */ new Set();
-    for (const m of manifests) {
-      if (isModuleKind(m.kind) && m.metadata?.name) rootModules.add(m.metadata.name);
-    }
-    this.scopes = { aliasesByModule: ctx.aliasesByModule, rootModules };
-  }
-  scopes;
-  celScopeQuery;
-  callGraphMemo;
-  moduleGraphMemo;
-  /** What CEL sees, per site. Built on first use — its indices are a function of
-   *  the whole set, and a host that never opens a CEL body should not pay for
-   *  them. */
-  get celScope() {
-    return this.celScopeQuery ??= new CelScopeQuery(this.manifests, this.ctx);
-  }
-  /** What calls what. Built on first use and kept, so the projection and any
-   *  other consumer over this set share one. */
-  get callGraph() {
-    return this.callGraphMemo ??= buildCallGraph(this.manifests, this.ctx.defs, {
-      aliases: this.ctx.aliases,
-      aliasesByModule: this.ctx.aliasesByModule
-    });
-  }
-  /**
-   * The module graph: boxes, ordered rows and classed edges — the projection an
-   * editor draws.
-   *
-   * Here rather than on the registry because it is the registry AND a manifest
-   * set, which is the pairing this class exists to name; a fifth
-   * `registry.x(manifests, …)` factory is the accretion naming it stopped. It
-   * shares this analysis's call graph rather than building one of its own.
-   *
-   * `deps` is supplied by the registry, which owns capability resolution — this
-   * class holds the manifests, not the rules for reading a kind.
-   */
-  moduleGraph(deps, options = {}) {
-    return this.moduleGraphMemo ??= buildModuleGraph(
-      this.manifests,
-      this.callGraph,
-      deps,
-      options
-    );
-  }
-  /** Whether a resource's name denotes a type or a value — the rule the naming
-   *  check applies to it, so a rename proposes only a name `telo check` accepts. */
-  nameLevel(manifest) {
-    const resolveDef = moduleScopedDefResolver(this.ctx.defs, this.ctx.aliases, this.scopes);
-    return levelFor(manifest, resolveDef, manifest.metadata?.module);
-  }
-  /** The manifest a `(kind, name)` pair addresses. */
-  resourceFor(kind, name) {
-    return findManifest(this.manifests, kind, name);
-  }
-  /**
-   * The invocation contract of the resource a reference names.
-   *
-   * The shared resolver, so an editor offering a target's input keys is offering
-   * exactly what `telo check` validates that call site against and what the
-   * kernel binds at dispatch. Layered instance-first: a resource declaring its
-   * own `inputType:` narrows the kind's, which is the common case for a
-   * `Run.Sequence` used as a handler.
-   */
-  contractFor(ref, direction) {
-    const target = this.resolveRef(ref);
-    const definition = ref.kind ? this.definitionFor(ref.kind) : void 0;
-    if (!target && !definition) return void 0;
-    return resolveContract(
-      direction,
-      target,
-      definition,
-      analyzerContractScope(
-        this.ctx.defs,
-        this.ctx.aliases,
-        this.scopes,
-        this.manifests
-      )
-    )?.schema;
-  }
-  /**
-   * The manifest a reference names.
-   *
-   * An ALIAS narrows before the name does: a flattened set carries every
-   * imported library's exported instances, so two libraries exporting a `store`
-   * are two manifests with one name. Matching the alias to its target module
-   * picks the right one; where the alias resolves to nothing the name alone is
-   * used, which is what a local reference needs anyway.
-   */
-  resolveRef(ref) {
-    if (!ref.name) return void 0;
-    const byName = this.manifests.filter(
-      (m) => m.metadata?.name === ref.name
-    );
-    if (byName.length === 0) return void 0;
-    if (byName.length === 1) return byName[0];
-    const targetModule = ref.alias ? this.ctx.aliases.moduleForAlias?.(ref.alias) : void 0;
-    if (targetModule) {
-      const scoped = byName.find(
-        (m) => m.metadata?.module === targetModule
-      );
-      if (scoped) return scoped;
+// ../../analyzer/nodejs/src/plain-literal-decoding.ts
+function decodePlainLiterals(value, schema4, external, rootSchema = schema4) {
+  return mapTextLeaves(value, schema4, decodePlainText, external, rootSchema);
+}
+function mapTextLeaves(value, schema4, leaf, external, rootSchema = schema4, visit4) {
+  const walk4 = (node, raw, base, pointer) => {
+    const entered = resolveRefIn(raw, base, external);
+    const selected = selectUnionBranch(entered.schema, node, entered.root, external);
+    const { schema: here, root } = resolveRefIn(selected, entered.root, external);
+    visit4?.(here, node, pointer);
+    if (typeof node === "string") return leaf(here, node, pointer);
+    if (!node || typeof node !== "object") return node;
+    if (here["x-telo-ref"] !== void 0) return node;
+    if (isCompiledValue(node) || isTaggedSentinel(node)) return node;
+    if (Array.isArray(node)) {
+      const item = resolveRefIn(here.items ?? {}, root, external);
+      for (let i = 0; i < node.length; i++) node[i] = walk4(node[i], item.schema, item.root, `${pointer}/${i}`);
+      return node;
     }
-    return ref.kind ? byName.find((m) => m.kind === ref.kind) : void 0;
-  }
-  definitionFor(kind) {
-    const canonical = this.ctx.aliases.resolveKind(kind);
-    return this.ctx.defs.resolve(kind) ?? (canonical ? this.ctx.defs.resolve(canonical) : void 0);
-  }
-};
-
-// ../../analyzer/nodejs/src/schema-tag-text.ts
-function schemaWithTagsAsText(value) {
-  if (isCompiledValue(value) || isTaggedSentinel(value)) {
-    return typeof value.source === "string" ? value.source : "";
-  }
-  if (Array.isArray(value)) return value.map(schemaWithTagsAsText);
-  if (value && typeof value === "object") {
-    const out = {};
-    for (const [k, v] of Object.entries(value)) {
-      out[k] = schemaWithTagsAsText(v);
+    const proto = Object.getPrototypeOf(node);
+    if (proto !== Object.prototype && proto !== null) return node;
+    const properties = collectProperties(here);
+    const additional = here.additionalProperties && typeof here.additionalProperties === "object" ? here.additionalProperties : void 0;
+    const record = node;
+    for (const key of Object.keys(record)) {
+      const child = properties[key] ?? additional;
+      if (child) {
+        record[key] = walk4(record[key], child, root, `${pointer}/${key.replace(/~/g, "~0").replace(/\//g, "~1")}`);
+      }
     }
-    return out;
+    return node;
+  };
+  return walk4(value, schema4, rootSchema, "");
+}
+function substituteDecodedCelFields(data, schema4, rootSchema, options = {}) {
+  const decoded = decodePlainLiterals(
+    copyPlainContainers(data),
+    schema4,
+    options.external,
+    rootSchema ?? schema4
+  );
+  return substituteCelFields(decoded, schema4, rootSchema, options);
+}
+function copyPlainContainers(value) {
+  if (Array.isArray(value)) return value.map(copyPlainContainers);
+  if (!value || typeof value !== "object" || isCompiledValue(value) || isTaggedSentinel(value)) {
+    return value;
   }
-  return value;
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null) return value;
+  return Object.fromEntries(
+    Object.entries(value).map(([key, item]) => [
+      key,
+      copyPlainContainers(item)
+    ])
+  );
 }
 
-// ../../analyzer/nodejs/src/definition-registry.ts
-var DefinitionRegistry = class {
-  constructor() {
-    for (const def of KERNEL_BUILTINS) this.add(def, true);
-  }
-  /** Per-instance AJV for cross-module $ref resolution. Isolated so each registry
-   *  (and thus each AnalysisContext) has its own schema store — no stale schemas
-   *  across analyze() calls and no unbounded growth across the process lifetime. */
-  ajv = createAjv();
-  registeredSchemaIds = /* @__PURE__ */ new Set();
-  compiledValidators = /* @__PURE__ */ new WeakMap();
-  /** The subset of `registeredSchemaIds` claimed by a kind's schema. Kinds and
-   *  named `Telo.Type`s share one `telo://<module>/<Name>` id space, so this is
-   *  what lets a colliding type name be reported instead of silently dropped. */
-  definitionSchemaIds = /* @__PURE__ */ new Set();
-  defs = /* @__PURE__ */ new Map();
-  fieldMaps = /* @__PURE__ */ new Map();
-  /** Reverse inheritance index: parent kind → direct child kinds. */
-  extendedBy = /* @__PURE__ */ new Map();
-  /** Memoized inheritance-resolved schemas. `null` records "resolved to
-   *  nothing", so a kind with no schema is not re-walked on every resource. */
-  effectiveSchemas = /* @__PURE__ */ new Map();
-  /** DEPRECATED module identity table: identity string → canonical module name
-   *  ("std/pipeline" → "pipeline"). Serves only the legacy
-   *  `<namespace>/<module>#<Kind>` form of `x-telo-ref`, kept resolvable for
-   *  module versions published before constraints named their target by import
-   *  alias. Fed by `metadata.namespace`, which nothing else reads. */
-  identityMap = /* @__PURE__ */ new Map();
-  register(definition) {
-    this.add(definition, false);
-  }
-  /** `trustedSchema` skips meta-validating the schema — only for the built-ins,
-   *  whose validity a test asserts once. */
-  add(definition, trustedSchema) {
-    const { name, module: mod } = definition.metadata;
-    const key = mod ? `${mod}.${name}` : name;
-    this.defs.set(key, definition);
-    this.fieldMaps.clear();
-    this.effectiveSchemas.clear();
-    if (definition.capability) {
-      this.addExtendedBy(definition.capability, key);
+// ../../analyzer/nodejs/src/resolve-schema-type-refs.ts
+var SCHEMA_FIELDS = ["schema", "inputType", "outputType"];
+var SIGNATURE_FIELDS = ["params", "returns"];
+function resolveSchemaTypeRefs(resources, aliases, aliasesByModule) {
+  const walk4 = (value, resolveAuthority, ownModule, isSlotRoot) => {
+    if (value === null || typeof value !== "object") return;
+    if (Array.isArray(value)) {
+      for (const item of value) walk4(item, resolveAuthority, ownModule, false);
+      return;
     }
-    if (definition.extends) {
-      this.addExtendedBy(definition.extends, key);
+    const obj = value;
+    const parsed = parseTeloTypeRef(obj.$ref);
+    if (parsed) {
+      const module = resolveAuthority(parsed.authority);
+      if (module) obj.$ref = canonicalTypeSchemaId(module, parsed.typeName);
     }
-    if (definition.kind === "Telo.Abstract" && mod === "Telo") {
-      this.identityMap.set("telo", "Telo");
+    const named = resolvedRefInSchema(obj);
+    if (named) {
+      const module = named.alias === void 0 ? ownModule : resolveAuthority(named.alias);
+      if (module) {
+        const canonical = canonicalTypeSchemaId(module, named.name);
+        if (isSlotRoot) {
+          obj.$ref = canonical;
+        } else {
+          delete obj.kind;
+          delete obj.name;
+          delete obj.alias;
+          obj.$ref = canonical;
+        }
+      }
     }
-    if (mod && definition.schema) {
-      this.tryRegisterSchema(
-        mod,
-        name,
-        definition.schema,
-        trustedSchema
-      );
+    for (const key of Object.keys(obj)) walk4(obj[key], resolveAuthority, ownModule, false);
+  };
+  for (const r of resources) {
+    const ownModule = r.metadata?.module;
+    const resolver = moduleAliasScope(r.metadata, aliases, aliasesByModule);
+    const resolveAuthority = (authority) => authority === "Self" ? ownModule : resolver?.moduleForAlias(authority);
+    for (const field of SCHEMA_FIELDS) {
+      walk4(r[field], resolveAuthority, ownModule, true);
     }
-  }
-  addExtendedBy(parent, child) {
-    const children = this.extendedBy.get(parent);
-    if (children) {
-      if (!children.includes(child)) children.push(child);
-    } else {
-      this.extendedBy.set(parent, [child]);
+    for (const field of SIGNATURE_FIELDS) {
+      walk4(r[field], resolveAuthority, ownModule, false);
     }
   }
-  /** DEPRECATED. Register a module identity so the legacy
-   *  `<namespace>/<module>#<Kind>` form of `x-telo-ref` still resolves for module
-   *  versions published before constraints named their target by import alias.
-   *  New manifests declare no namespace and need no identity — their constraints
-   *  are canonicalized to `<module>.<Kind>` before registration.
-   *
-   *  The "telo" identity is reserved for the built-in module and is populated
-   *  automatically when a `Telo.Abstract` registers. A namespace-less module must
-   *  not claim it: overwriting the entry would repoint every legacy `telo#…`
-   *  constraint at a module that declares no such kind, and the resulting
-   *  unresolvable ref reads as partial context rather than an error.
-   *
-   *  @param namespace  The module's `metadata.namespace`, or null when it declares none.
-   *  @param moduleName The module's `metadata.name` (e.g. "pipeline", "http-server"). */
-  registerModuleIdentity(namespace, moduleName2) {
-    if (!namespace || moduleName2 === "Telo") return;
-    this.identityMap.set(`${namespace}/${moduleName2}`, moduleName2);
-  }
-  /** Registers a named `Telo.Type` resource's schema under its canonical
-   *  module-scoped URI `$id` (`telo://<module>/<name>`), so a sibling schema's
-   *  `$ref: "telo://Self/<name>"` (rewritten to the canonical form by
-   *  `resolveSchemaTypeRefs`) resolves during AJV compilation. Mirrors the
-   *  kernel type controller's `registerSchema(canonicalTypeSchemaId(...))`.
-   *
-   *  Returns `false` when a kind schema in the same module already owns the id —
-   *  a name collision between a kind and a named type. Definitions register
-   *  first, so the type is the one that would be dropped, and every
-   *  `$ref: "telo://<module>/<Name>"` would then silently validate against the
-   *  kind's schema instead. The caller reports it; nothing is overwritten. */
-  registerNamedTypeSchema(id, schema4) {
-    if (this.definitionSchemaIds.has(id)) return false;
-    if (this.registeredSchemaIds.has(id) || this.ajv.getSchema(id)) return true;
-    if (!this.tryAddSchema(schema4, id)) return true;
-    this.registeredSchemaIds.add(id);
-    return true;
-  }
-  /**
-   * Register a schema, surviving one AJV refuses.
-   *
-   * `addSchema` META-VALIDATES and THROWS, and a throw here escapes the whole
-   * analyze pass: one author schema with `minimum: "3"` in it aborted the run
-   * with AJV's own unanchored text and took every other diagnostic in the file
-   * down with it — including the anchored one that says exactly which keyword is
-   * wrong. Registration is a lookup table for `$ref` resolution, so failing to
-   * fill one entry costs a reference that could not have resolved anyway.
-   *
-   * Nothing is swallowed: an unregisterable schema is invalid, and the two
-   * checks that report it both run afterwards and both anchor on the offending
-   * line — `SCHEMA_VIOLATION` from the `KindSchema` / `JsonSchema7` fragment the
-   * slot points at, and `SCHEMA_COMPILE_ERROR` from {@link schemaCompileError},
-   * which wraps `compile` for this same reason.
-   */
-  tryAddSchema(schema4, id, trusted = false) {
-    try {
-      this.ajv.addSchema(schemaWithTagsAsText(schema4), id, void 0, !trusted);
-      return true;
-    } catch {
-      return false;
-    }
+}
+function withCanonicalRefSentinels(value, ownModule, resolveModule) {
+  const target = refSentinelTarget(value);
+  if (target) {
+    const module = target.alias === void 0 || target.alias === "Self" ? ownModule : resolveModule(target.alias);
+    return module ? { $ref: canonicalTypeSchemaId(module, target.name) } : value;
   }
-  /** True when a schema is registered under `id` (a canonical `telo://` type id
-   *  or a definition `$id`). Used to flag schema `$ref`s that resolve to nothing. */
-  hasSchemaId(id) {
-    return this.registeredSchemaIds.has(id) || this.ajv.getSchema(id) !== void 0;
+  if (Array.isArray(value)) {
+    return value.map((item) => withCanonicalRefSentinels(item, ownModule, resolveModule));
   }
-  /** The schema registered under `id`, for a structural comparison that must see
-   *  THROUGH a named shape. Declaring a shape once and referencing it is the
-   *  sanctioned way to reuse one, so a comparator that cannot follow the
-   *  reference judges two opaque nodes and learns nothing.
-   *
-   *  A registered id is READ, never compiled: this is a structural lookup, and
-   *  compiling a shape the registry holds but cannot compile throws out of
-   *  whichever walk asked. That shape's compile failure is reported where the
-   *  shape is validated, not here. */
-  schemaForId(id) {
-    let entry = this.ajv.schemas[id] ?? this.ajv.refs[id];
-    while (typeof entry === "string") entry = this.ajv.schemas[entry] ?? this.ajv.refs[entry];
-    const schema4 = entry ? entry.schema : this.ajv.getSchema(id)?.schema;
-    return schema4 && typeof schema4 === "object" ? schema4 : void 0;
+  if (value === null || typeof value !== "object") return value;
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) return value;
+  const out = {};
+  for (const [key, child] of Object.entries(value)) {
+    out[key] = withCanonicalRefSentinels(child, ownModule, resolveModule);
   }
-  /**
-   * Validates a resource's configuration against its kind's schema, with the
-   * offending field's path — what a `SCHEMA_VIOLATION` diagnostic is built from.
-   *
-   * On THIS registry's AJV, which is the point: it holds every registered
-   * definition schema and every named `Telo.Type`, so a kind whose schema
-   * references a shape declared elsewhere is checked rather than skipped. The
-   * module-level instance this used to run on had none of them registered, so
-   * such a schema failed to compile and the failure was swallowed — a resource
-   * could be arbitrarily wrong and `telo check` reported nothing, while the
-   * kernel (whose validator does resolve the reference) rejected it at boot.
-   * Two AJVs answering one question is what made that possible; there is now
-   * one, and it is the same one `schemaCompileError` reports through.
-   */
-  validateWithRefs(data, schema4) {
-    const validate2 = this.compiledFor(schema4);
-    if (!validate2 || validate2(data)) return [];
-    return reduceSchemaErrors(explainFormatErrors(validate2.errors, data)).map(formatSingleError);
+  return out;
+}
+function resolvedRefInSchema(obj) {
+  if (typeof obj.kind !== "string" || typeof obj.name !== "string") return null;
+  for (const key of Object.keys(obj)) {
+    if (key !== "kind" && key !== "name" && key !== "alias" && key !== "$ref") return null;
   }
-  /** {@link validateWithRefs}, with the path each issue is anchored at. */
-  validateResourceConfig(data, schema4) {
-    const validate2 = this.compiledFor(schema4);
-    if (!validate2 || validate2(data)) return [];
-    return schemaIssues(validate2.errors, data);
+  return typeof obj.alias === "string" ? { name: obj.name, alias: obj.alias } : { name: obj.name };
+}
+
+// ../../analyzer/nodejs/src/schema-from-sites.ts
+function schemaFromSites(resource, fieldPath, schemaFrom, ctx) {
+  const out = [];
+  const label2 = `${resource.kind}/${resource.metadata?.name}`;
+  const isAbsolute = schemaFrom.startsWith("/");
+  const expr = isAbsolute ? schemaFrom.slice(1) : schemaFrom;
+  const slashIdx = expr.indexOf("/");
+  if (slashIdx === -1) {
+    out.push({
+      code: "INVALID_SCHEMA_FROM",
+      message: `${label2}: x-telo-schema-from "${schemaFrom}" must contain at least one "/" to separate anchor from JSON Pointer`,
+      path: fieldPath
+    });
+    return out;
   }
-  /** Memoized per schema OBJECT — the analyzer validates every resource of a
-   *  kind against the same one, and this runs at keystroke time in an editor.
-   *  A schema AJV refuses compiles to `undefined`; that is reported once,
-   *  anchored on the owning definition, by `schemaCompileError`. */
-  compiledFor(schema4) {
-    const cached = this.compiledValidators.get(schema4);
-    if (cached) return cached;
-    try {
-      const validate2 = this.ajv.compile(schemaWithTagsAsText(schema4));
-      this.compiledValidators.set(schema4, validate2);
-      return validate2;
-    } catch {
-      return void 0;
+  const anchorName = expr.slice(0, slashIdx);
+  const jsonPointer = "/" + expr.slice(slashIdx + 1);
+  if (!isAbsolute && anchorName.includes(".")) {
+    const resolvedResourceKind = ctx.aliases.resolveKind(resource.kind) ?? resource.kind;
+    const resourceDef = ctx.defs.resolve(resource.kind) ?? ctx.defs.resolve(resolvedResourceKind);
+    const ownerScope = moduleAliasScope(resourceDef?.metadata, ctx.aliases, ctx.aliasesByModule);
+    const targetKind = ownerScope.resolveKind(anchorName);
+    if (!targetKind) {
+      const aliasName = anchorName.slice(0, anchorName.indexOf("."));
+      out.push({
+        code: "SCHEMA_FROM_MISSING_PATH",
+        message: `${label2}: x-telo-schema-from at '${fieldPath}' \u2192 cannot resolve alias '${aliasName}' (in '${anchorName}'). Check the import that declares it.`,
+        path: fieldPath
+      });
+      return out;
     }
-  }
-  /** Returns the AJV compile error for `schema`, or `undefined` when it compiles.
-   *  Compiles on this registry's instance, which has every loaded module schema
-   *  plus the manifest root registered, so local `#/$defs`, `telo://manifest`,
-   *  and cross-module `$ref`s all resolve. Used to fail loud on a definition
-   *  schema that AJV cannot compile — otherwise `validateAgainstSchema` /
-   *  `validateWithRefs` would swallow the failure and silently skip every
-   *  resource of that kind. */
-  schemaCompileError(schema4) {
-    try {
-      this.ajv.compile(schemaWithTagsAsText(schema4));
-      return void 0;
-    } catch (err) {
-      return err instanceof Error ? err.message : String(err);
+    const targetDef = ctx.defs.resolve(targetKind);
+    if (!targetDef?.schema) {
+      out.push({
+        code: "SCHEMA_FROM_MISSING_PATH",
+        message: `${label2}: x-telo-schema-from at '${fieldPath}' \u2192 kind '${targetKind}' has no schema`,
+        path: fieldPath
+      });
+      return out;
     }
-  }
-  /** Registers a definition schema under the same module-scoped `telo://` id a
-   *  named `Telo.Type` uses, so a kind schema and a type schema are addressable
-   *  the same way and a `$ref` between them resolves at AJV compile time. One id
-   *  space per module: a kind and a named type may not share a name, which
-   *  `registerNamedTypeSchema` reports rather than resolving silently. */
-  tryRegisterSchema(moduleName2, typeName2, schema4, trusted) {
-    const id = canonicalTypeSchemaId(moduleName2, typeName2);
-    if (this.registeredSchemaIds.has(id)) {
-      this.definitionSchemaIds.add(id);
-      return;
+    const subSchema = navigateJsonPointer(targetDef.schema, jsonPointer);
+    if (subSchema === void 0) {
+      out.push({
+        code: "SCHEMA_FROM_MISSING_PATH",
+        message: `${label2}: x-telo-schema-from at '${fieldPath}' \u2192 kind '${targetKind}' has no schema path '${jsonPointer}'`,
+        path: fieldPath
+      });
+      return out;
     }
-    if (this.ajv.getSchema(id)) {
-      throw new Error(`Duplicate definition schema $id: "${id}" is already registered`);
+    for (const { value, path } of resolveFieldEntries(resource, fieldPath)) {
+      if (value == null) continue;
+      out.push({
+        path,
+        value,
+        schema: subSchema,
+        source: `${anchorName}${jsonPointer}`,
+        form: "anchored"
+      });
     }
-    this.tryAddSchema(schema4, id, trusted);
-    this.registeredSchemaIds.add(id);
-    this.definitionSchemaIds.add(id);
-  }
-  /** Resolves an `x-telo-ref` constraint to a canonical registry kind key.
-   *
-   *  The constraint is already canonical `<module>.<Kind>`: alias-form values
-   *  (`KvStore.Store`, `Self.Store`, `Telo.Invocable`) are rewritten in the
-   *  declaring module's scope by `resolveSchemaRefKinds` before registration, so
-   *  no module context is needed here.
-   *
-   *  The legacy `<namespace>/<module>#<Kind>` form still resolves through the
-   *  identity table for module versions published before the alias form existed:
-   *
-   *    "telo#Invocable"         → "Telo.Invocable"
-   *    "std/http-server#Server" → "http-server.Server"
-   *
-   *  Returns undefined when a legacy string is malformed or its identity was
-   *  never registered. */
-  resolveRef(xTeloRef) {
-    const hash = xTeloRef.indexOf("#");
-    if (hash === -1) return xTeloRef;
-    if (hash === xTeloRef.length - 1) return void 0;
-    const moduleName2 = this.identityMap.get(xTeloRef.slice(0, hash));
-    if (!moduleName2) return void 0;
-    return `${moduleName2}.${xTeloRef.slice(hash + 1)}`;
-  }
-  resolve(kind) {
-    return this.defs.get(kind);
-  }
-  /**
-   * The kind's AUTHOR-FACING schema — its own merged with everything it
-   * inherits along `extends` — memoized per kind.
-   *
-   * This is what every consumer reading a kind's schema to interpret an
-   * INSTANCE must use, because that is the schema the instance was authored
-   * against and the one the kernel stamps at definition registration. Reading
-   * `resolve(kind).schema` instead sees only what the leaf declared, so an
-   * annotation on a parent — a CEL context region, a step body, an error
-   * context — is invisible on every child, silently and per consumer. Sharing
-   * one memo is what keeps those consumers from drifting apart.
-   *
-   * Lazy for the same reason `getFieldMap` is: a child registered before its
-   * parent still sees the inherited half once both are present.
-   */
-  effectiveSchema(kind) {
-    const cached = this.effectiveSchemas.get(kind);
-    if (cached !== void 0) return cached ?? void 0;
-    const def = this.defs.get(kind);
-    if (!def) return void 0;
-    const schema4 = effectiveAuthorSchema(def, (k) => this.resolve(k));
-    this.effectiveSchemas.set(kind, schema4 ?? null);
-    return schema4;
-  }
-  /** The effective schema for a definition, by the kind it is registered under.
-   *  Falls back to the definition's own schema when it is not in this registry
-   *  (a synthesized or not-yet-registered kind), which is the pre-inheritance
-   *  behaviour and the safe direction: it types less, never wrongly. */
-  effectiveSchemaOf(definition) {
-    if (!definition) return void 0;
-    const { name, module: mod } = definition.metadata;
-    const resolved = this.effectiveSchema(mod ? `${mod}.${name}` : name);
-    return resolved ?? definition.schema;
-  }
-  /** Returns the reference field map for the given kind, computed lazily from the
-   *  kind's AUTHOR-FACING (inheritance-resolved) schema and memoized. Lazy so a
-   *  child registered before its parent still sees the parent's inherited ref
-   *  slots once both are present. */
-  getFieldMap(kind) {
-    const cached = this.fieldMaps.get(kind);
-    if (cached) return cached;
-    const def = this.defs.get(kind);
-    if (!def) return void 0;
-    const schema4 = effectiveAuthorSchema(def, (k) => this.resolve(k));
-    const map3 = buildReferenceFieldMap(schema4 ?? {});
-    this.fieldMaps.set(kind, map3);
-    return map3;
-  }
-  /** Returns the field map for `kind`, falling back to the alias-resolved kind when not found. */
-  getFieldMapForKind(kind, aliases) {
-    const fm = this.getFieldMap(kind);
-    if (fm) return fm;
-    const resolved = aliases?.resolveKind(kind);
-    return resolved ? this.getFieldMap(resolved) : void 0;
-  }
-  /** Returns the field map for `resource.kind` with x-telo-schema-from entries replaced
-   *  by their nested ref/scope slots — so Phase 2 inline normalization and Phase 5
-   *  injection see encoders nested behind a schema-from indirection (e.g.
-   *  http-server `Server.notFoundHandler.returns[].content[mime].encoder`).
-   *
-   *  Only static absolute schema-from paths with a dotted alias anchor are expanded
-   *  (e.g. "HttpDispatch.Outcomes/$defs/Returns"). Relative and unqualified absolute
-   *  anchors depend on a sibling property at runtime and stay unexpanded; the
-   *  analyzer's reference validation phase already flags the cases that matter. */
-  expandedFieldMapForResource(resource, aliases, aliasesByModule) {
-    const moduleScope = moduleAliasScope(resource.metadata, aliases, aliasesByModule);
-    const baseMap = this.getFieldMapForKind(resource.kind, moduleScope);
-    if (!baseMap) return void 0;
-    const resolvedKind = moduleScope.resolveKind(resource.kind) ?? resource.kind;
-    const def = this.resolve(resource.kind) ?? this.resolve(resolvedKind);
-    const ownerScope = moduleAliasScope(def?.metadata, aliases, aliasesByModule);
-    const expanded = /* @__PURE__ */ new Map();
-    for (const [path, entry] of baseMap) {
-      if (!isSchemaFromEntry(entry)) {
-        expanded.set(path, entry);
-        continue;
-      }
-      const sub = this.resolveSchemaFromSubMap(entry.schemaFrom, path, ownerScope);
-      if (!sub) continue;
-      for (const [subPath, subEntry] of sub) expanded.set(subPath, subEntry);
-    }
-    return expanded;
-  }
-  /**
-   * The schema an `x-telo-schema-from` slot derives its shape from.
-   *
-   * Only the STATIC form resolves: an anchor that is a dotted alias-qualified
-   * kind (`HttpDispatch.Request/$defs/Matcher`). The polymorphic forms — a
-   * relative anchor, or a single-segment absolute one — name a sibling property
-   * whose value is known per resource, so a definition-level lookup would be
-   * guessing at one instance's shape.
-   *
-   * Its own method because a schema-from slot is otherwise INVISIBLE to anything
-   * reading `properties`: the field map needs the nested ref slots, and an IDE
-   * needs the very same node to offer a key or describe one. Two resolutions of
-   * one annotation would eventually disagree about which anchors are static.
-   */
-  resolveSchemaFromNode(schemaFrom, ownerScope) {
-    const isAbsolute = schemaFrom.startsWith("/");
-    const expr = isAbsolute ? schemaFrom.slice(1) : schemaFrom;
-    const slashIdx = expr.indexOf("/");
-    if (slashIdx === -1) return void 0;
-    const anchorName = expr.slice(0, slashIdx);
-    const jsonPointer = "/" + expr.slice(slashIdx + 1);
-    if (!anchorName.includes(".")) return void 0;
-    const targetKind = ownerScope.resolveKind(anchorName);
-    if (!targetKind) return void 0;
-    const targetDef = this.resolve(targetKind);
-    if (!targetDef?.schema) return void 0;
-    const subSchema = navigateJsonPointer(
-      targetDef.schema,
-      jsonPointer
-    );
-    if (!subSchema || typeof subSchema !== "object") return void 0;
-    return subSchema;
-  }
-  resolveSchemaFromSubMap(schemaFrom, fieldPath, ownerScope) {
-    const subSchema = this.resolveSchemaFromNode(schemaFrom, ownerScope);
-    if (!subSchema) return null;
-    return buildFieldMapAtPath(subSchema, fieldPath);
-  }
-  /** The kinds a definition descends from DIRECTLY — the same two edges
-   *  `register` feeds into `extendedBy`, read the other way.
-   *
-   *  Both spellings, because either can carry the edge that satisfies a slot:
-   *  `capability:` is the legacy implements-this form, `extends:` the canonical
-   *  one. A consumer walking these by hand would be a second reading of what an
-   *  inheritance edge IS, and the downward index and the upward walk have to
-   *  agree about that forever. */
-  parentsOf(kind) {
-    const def = this.defs.get(kind);
-    if (!def) return [];
-    return [def.capability, def.extends].filter(
-      (parent) => typeof parent === "string" && parent.length > 0
-    );
-  }
-  /** Whether every kind this one descends from is registered.
-   *
-   *  When it is, what the kind implements is FULLY KNOWN: a target it does not
-   *  reach is one it genuinely does not implement, so a mismatch is a verdict.
-   *  When a hop is missing — an unimported abstract, an alias the declaring file
-   *  could not resolve — a mismatch cannot be told from a missing dependency,
-   *  which is the partial context every reference check stays lenient in. */
-  ancestryResolved(kind) {
-    const queue = [kind];
-    const seen = /* @__PURE__ */ new Set();
-    while (queue.length > 0) {
-      const current = queue.shift();
-      if (seen.has(current)) continue;
-      seen.add(current);
-      if (!this.defs.has(current)) return false;
-      queue.push(...this.parentsOf(current));
-    }
-    return true;
-  }
-  /** Returns all definitions that transitively extend the given abstract kind.
-   *  Follows the capability chain to any depth (equivalent to instanceof in OOP).
-   *  Definitions are included regardless of registration order. */
-  getByExtends(abstractKind) {
-    const result = [];
-    const queue = [abstractKind];
-    while (queue.length > 0) {
-      const parent = queue.shift();
-      const children = this.extendedBy.get(parent);
-      if (!children) continue;
-      for (const child of children) {
-        const def = this.defs.get(child);
-        if (def) result.push(def);
-        queue.push(child);
-      }
-    }
-    return result;
-  }
-  kinds() {
-    return Array.from(this.defs.keys());
-  }
-};
-
-// ../../analyzer/nodejs/src/resolve-schema-type-refs.ts
-var SCHEMA_FIELDS = ["schema", "inputType", "outputType"];
-var SIGNATURE_FIELDS = ["params", "returns"];
-function resolveSchemaTypeRefs(resources, aliases, aliasesByModule) {
-  const walk4 = (value, resolveAuthority, ownModule, isSlotRoot) => {
-    if (value === null || typeof value !== "object") return;
-    if (Array.isArray(value)) {
-      for (const item of value) walk4(item, resolveAuthority, ownModule, false);
-      return;
-    }
-    const obj = value;
-    const parsed = parseTeloTypeRef(obj.$ref);
-    if (parsed) {
-      const module = resolveAuthority(parsed.authority);
-      if (module) obj.$ref = canonicalTypeSchemaId(module, parsed.typeName);
-    }
-    const named = resolvedRefInSchema(obj);
-    if (named) {
-      const module = named.alias === void 0 ? ownModule : resolveAuthority(named.alias);
-      if (module) {
-        const canonical = canonicalTypeSchemaId(module, named.name);
-        if (isSlotRoot) {
-          obj.$ref = canonical;
-        } else {
-          delete obj.kind;
-          delete obj.name;
-          delete obj.alias;
-          obj.$ref = canonical;
-        }
-      }
-    }
-    for (const key of Object.keys(obj)) walk4(obj[key], resolveAuthority, ownModule, false);
-  };
-  for (const r of resources) {
-    const ownModule = r.metadata?.module;
-    const resolver = moduleAliasScope(r.metadata, aliases, aliasesByModule);
-    const resolveAuthority = (authority) => authority === "Self" ? ownModule : resolver?.moduleForAlias(authority);
-    for (const field of SCHEMA_FIELDS) {
-      walk4(r[field], resolveAuthority, ownModule, true);
-    }
-    for (const field of SIGNATURE_FIELDS) {
-      walk4(r[field], resolveAuthority, ownModule, false);
-    }
-  }
-}
-function withCanonicalRefSentinels(value, ownModule, resolveModule) {
-  const target = refSentinelTarget(value);
-  if (target) {
-    const module = target.alias === void 0 || target.alias === "Self" ? ownModule : resolveModule(target.alias);
-    return module ? { $ref: canonicalTypeSchemaId(module, target.name) } : value;
-  }
-  if (Array.isArray(value)) {
-    return value.map((item) => withCanonicalRefSentinels(item, ownModule, resolveModule));
-  }
-  if (value === null || typeof value !== "object") return value;
-  const prototype = Object.getPrototypeOf(value);
-  if (prototype !== Object.prototype && prototype !== null) return value;
-  const out = {};
-  for (const [key, child] of Object.entries(value)) {
-    out[key] = withCanonicalRefSentinels(child, ownModule, resolveModule);
-  }
-  return out;
-}
-function resolvedRefInSchema(obj) {
-  if (typeof obj.kind !== "string" || typeof obj.name !== "string") return null;
-  for (const key of Object.keys(obj)) {
-    if (key !== "kind" && key !== "name" && key !== "alias" && key !== "$ref") return null;
-  }
-  return typeof obj.alias === "string" ? { name: obj.name, alias: obj.alias } : { name: obj.name };
-}
-
-// ../../analyzer/nodejs/src/schema-from-sites.ts
-function schemaFromSites(resource, fieldPath, schemaFrom, ctx) {
-  const out = [];
-  const label2 = `${resource.kind}/${resource.metadata?.name}`;
-  const isAbsolute = schemaFrom.startsWith("/");
-  const expr = isAbsolute ? schemaFrom.slice(1) : schemaFrom;
-  const slashIdx = expr.indexOf("/");
-  if (slashIdx === -1) {
-    out.push({
-      code: "INVALID_SCHEMA_FROM",
-      message: `${label2}: x-telo-schema-from "${schemaFrom}" must contain at least one "/" to separate anchor from JSON Pointer`,
-      path: fieldPath
-    });
-    return out;
-  }
-  const anchorName = expr.slice(0, slashIdx);
-  const jsonPointer = "/" + expr.slice(slashIdx + 1);
-  if (!isAbsolute && anchorName.includes(".")) {
-    const resolvedResourceKind = ctx.aliases.resolveKind(resource.kind) ?? resource.kind;
-    const resourceDef = ctx.defs.resolve(resource.kind) ?? ctx.defs.resolve(resolvedResourceKind);
-    const ownerScope = moduleAliasScope(resourceDef?.metadata, ctx.aliases, ctx.aliasesByModule);
-    const targetKind = ownerScope.resolveKind(anchorName);
-    if (!targetKind) {
-      const aliasName = anchorName.slice(0, anchorName.indexOf("."));
-      out.push({
-        code: "SCHEMA_FROM_MISSING_PATH",
-        message: `${label2}: x-telo-schema-from at '${fieldPath}' \u2192 cannot resolve alias '${aliasName}' (in '${anchorName}'). Check the import that declares it.`,
-        path: fieldPath
-      });
-      return out;
-    }
-    const targetDef = ctx.defs.resolve(targetKind);
-    if (!targetDef?.schema) {
-      out.push({
-        code: "SCHEMA_FROM_MISSING_PATH",
-        message: `${label2}: x-telo-schema-from at '${fieldPath}' \u2192 kind '${targetKind}' has no schema`,
-        path: fieldPath
-      });
-      return out;
-    }
-    const subSchema = navigateJsonPointer(targetDef.schema, jsonPointer);
-    if (subSchema === void 0) {
-      out.push({
-        code: "SCHEMA_FROM_MISSING_PATH",
-        message: `${label2}: x-telo-schema-from at '${fieldPath}' \u2192 kind '${targetKind}' has no schema path '${jsonPointer}'`,
-        path: fieldPath
-      });
-      return out;
-    }
-    for (const { value, path } of resolveFieldEntries(resource, fieldPath)) {
-      if (value == null) continue;
-      out.push({
-        path,
-        value,
-        schema: subSchema,
-        source: `${anchorName}${jsonPointer}`,
-        form: "anchored"
-      });
-    }
-    return out;
+    return out;
   }
   let anchorPath;
   if (isAbsolute) {
@@ -46958,132 +46475,913 @@ function stepCallSites(manifest, defSchema, ctx) {
       );
     });
   }
-  return out;
-}
-function slotCallSites(manifest, fieldMap, ctx) {
-  const out = [];
-  if (!fieldMap) return out;
-  for (const [fieldPath, entry] of fieldMap) {
-    if (!isRefEntry(entry) || !entry.inputs) continue;
-    const pointer = pointerSegments(entry.inputs);
-    if (!pointer) continue;
-    for (const { value: invoke, path: slotPath } of resolveFieldEntries(manifest, fieldPath)) {
-      if (!invoke || typeof invoke !== "object" || Array.isArray(invoke)) continue;
-      const enclosing = slotPath.slice(0, Math.max(0, slotPath.lastIndexOf(".")));
-      const inputsPath = [enclosing, ...pointer].filter(Boolean).join(".");
-      const values = navigateConcretePath2(manifest, inputsPath);
-      if (!values || typeof values !== "object" || Array.isArray(values)) continue;
-      out.push(
-        callSite("slot", inputsPath, values, invoke, manifest, ctx)
-      );
-    }
+  return out;
+}
+function slotCallSites(manifest, fieldMap, ctx) {
+  const out = [];
+  if (!fieldMap) return out;
+  for (const [fieldPath, entry] of fieldMap) {
+    if (!isRefEntry(entry) || !entry.inputs) continue;
+    const pointer = pointerSegments(entry.inputs);
+    if (!pointer) continue;
+    for (const { value: invoke, path: slotPath } of resolveFieldEntries(manifest, fieldPath)) {
+      if (!invoke || typeof invoke !== "object" || Array.isArray(invoke)) continue;
+      const enclosing = slotPath.slice(0, Math.max(0, slotPath.lastIndexOf(".")));
+      const inputsPath = [enclosing, ...pointer].filter(Boolean).join(".");
+      const values = navigateConcretePath2(manifest, inputsPath);
+      if (!values || typeof values !== "object" || Array.isArray(values)) continue;
+      out.push(
+        callSite("slot", inputsPath, values, invoke, manifest, ctx)
+      );
+    }
+  }
+  return out;
+}
+function pointerSegments(pointer) {
+  if (!pointer.startsWith("/")) return void 0;
+  const segments = pointer.slice(1).split("/").map((s) => s.replace(/~1/g, "/").replace(/~0/g, "~"));
+  return segments.every((s) => s.length > 0 && !/^\d+$/.test(s)) ? segments : void 0;
+}
+function templateCallSite(manifest, ctx) {
+  if (manifest.kind !== "Telo.Definition") return void 0;
+  const values = manifest.inputs;
+  if (!values || typeof values !== "object" || Array.isArray(values)) return void 0;
+  const scope = contractScopeOf(ctx);
+  const module = manifest.metadata?.module;
+  for (const slot of ["invoke", "provide"]) {
+    const target = dispatchTargetOf(manifest, slot);
+    if (!target) continue;
+    const definition2 = scope.resolveIn(target.kind, module);
+    const aliases = moduleAliasScope(manifest.metadata, ctx.aliases, ctx.aliasesByModule);
+    const entry = target.entry && {
+      ...target.entry,
+      inputType: withCanonicalRefSentinels(
+        target.entry.inputType,
+        module,
+        (alias) => aliases?.moduleForAlias(alias)
+      )
+    };
+    return {
+      origin: "template",
+      path: "inputs",
+      values,
+      invoke: { kind: target.kind, name: target.name },
+      invokedManifest: entry,
+      invokedDefinition: definition2,
+      contract: resolveContract("inputType", entry, definition2, scope)
+    };
+  }
+  const dispatch = [manifest.invoke, manifest.provide].find(
+    (d) => d && typeof d === "object" && !Array.isArray(d) && typeof d.kind === "string"
+  );
+  if (!dispatch) return void 0;
+  const definition = scope.resolveIn(dispatch.kind, module);
+  return {
+    origin: "template",
+    path: "inputs",
+    values,
+    invoke: { kind: dispatch.kind },
+    invokedManifest: void 0,
+    invokedDefinition: definition,
+    contract: resolveContract("inputType", void 0, definition, scope)
+  };
+}
+function valueSchemaSites(manifest, defSchema, ctx) {
+  if (!defSchema) return [];
+  const out = [];
+  for (const { scope, from } of valueSchemaSlots(defSchema)) {
+    const schema4 = resolveTypeFieldToSchema(manifest[from], ctx.typeManifests);
+    if (!schema4 || typeof schema4 !== "object") continue;
+    for (const { path, value } of resolveScopeValues(manifest, scope)) {
+      out.push({ path, value, schema: schema4, from });
+    }
+  }
+  return out;
+}
+function derivedSlotsOf(resource, ctx) {
+  const manifest = resource;
+  const moduleScope = moduleAliasScope(resource.metadata, ctx.aliases, ctx.aliasesByModule);
+  const resolvedKind = moduleScope.resolveKind(resource.kind);
+  const definition = ctx.defs.resolve(resource.kind) ?? (resolvedKind ? ctx.defs.resolve(resolvedKind) : void 0);
+  const schema4 = ctx.defs.effectiveSchemaOf(definition);
+  const out = [];
+  const at2 = (path, value, schema5) => out.push({ path, value, schema: schema5, replace: (next) => assignConcretePath(manifest, path, next) });
+  const calls = [
+    ...schema4 ? stepCallSites(manifest, schema4, ctx) : [],
+    ...slotCallSites(
+      manifest,
+      ctx.defs.expandedFieldMapForResource(resource, ctx.aliases, ctx.aliasesByModule),
+      ctx
+    )
+  ];
+  const template = templateCallSite(manifest, ctx);
+  if (template) calls.push(template);
+  for (const call of calls) {
+    if (call.contract) at2(call.path, call.values, call.contract.schema);
+  }
+  for (const site of valueSchemaSites(manifest, schema4, ctx)) {
+    at2(site.path, site.value, site.schema);
+  }
+  visitManifest(
+    [resource],
+    ctx.defs,
+    {
+      onSchemaFrom: (e) => {
+        for (const site of schemaFromSites(manifest, e.fieldPath, e.entry.schemaFrom, ctx)) {
+          if (isSchemaFromSite(site)) at2(site.path, site.value, site.schema);
+        }
+      }
+    },
+    {
+      aliases: ctx.aliases,
+      aliasesByModule: ctx.aliasesByModule,
+      skipKinds: REF_VALIDATION_SKIP_KINDS,
+      expand: false
+    }
+  );
+  return out;
+}
+
+// ../../analyzer/nodejs/src/validate-step-inputs.ts
+var missingRequired = (issue) => /is missing required property/.test(issue.message);
+function containerOf(path) {
+  const dot = path.lastIndexOf(".");
+  return dot === -1 ? "" : path.slice(0, dot);
+}
+var declarationsByName = /* @__PURE__ */ new WeakMap();
+function byNameOf(allManifests) {
+  let byName = declarationsByName.get(allManifests);
+  if (!byName) {
+    byName = /* @__PURE__ */ new Map();
+    for (const m of allManifests) {
+      const name = m.metadata?.name;
+      if (typeof name !== "string" || m.kind === "Telo.Import") continue;
+      const list2 = byName.get(name);
+      if (list2) list2.push(m);
+      else byName.set(name, [m]);
+    }
+    declarationsByName.set(allManifests, byName);
+  }
+  return byName;
+}
+function callSiteContext(manifest, allManifests, defs, aliases, scopes) {
+  const fromModule = manifest.metadata?.module;
+  const scope = moduleAliasScope({ module: fromModule }, aliases, scopes.aliasesByModule);
+  return {
+    defs,
+    aliases,
+    aliasesByModule: scopes.aliasesByModule,
+    rootModules: scopes.rootModules,
+    typeManifests: allManifests,
+    resolveTarget: (ref) => typeof ref.name === "string" ? resolveReferenceTarget(
+      byNameOf(allManifests),
+      { name: ref.name, ...typeof ref.alias === "string" ? { alias: ref.alias } : {} },
+      fromModule,
+      (alias) => scope.moduleForAlias(alias)
+    ) : void 0
+  };
+}
+function collectStepInputIssues(manifest, defSchema, allManifests, defs, aliases, scopes, stepContext) {
+  const ctx = callSiteContext(manifest, allManifests, defs, aliases, scopes);
+  return stepCallSites(manifest, defSchema, ctx).flatMap(
+    (site) => checkCallSite(site, manifest, allManifests, defs, aliases, scopes, stepContext)
+  );
+}
+function collectRefInputIssues(manifest, fieldMap, allManifests, defs, aliases, scopes) {
+  const ctx = callSiteContext(manifest, allManifests, defs, aliases, scopes);
+  return slotCallSites(manifest, fieldMap, ctx).flatMap(
+    (site) => checkCallSite(site, manifest, allManifests, defs, aliases, scopes)
+  );
+}
+function checkCallSite(site, manifest, allManifests, defs, aliases, scopes, stepContext) {
+  const out = [];
+  const { contract, values, invoke, invokedManifest, invokedDefinition } = site;
+  if (!contract) return out;
+  const targetLabel2 = invoke.name ?? invoke.kind ?? "the invoked resource";
+  const contractScope = analyzerContractScope(defs, aliases, scopes, allManifests);
+  const readingModule = manifest.metadata?.module;
+  const celPaths = /* @__PURE__ */ new Set();
+  const substituted = substituteDecodedCelFields(values, contract.schema, void 0, {
+    onSubstitute: (p) => celPaths.add(p),
+    // A contract may name a shape declared elsewhere. Both halves need the
+    // resolver or they disagree about the same slot.
+    external: (ref) => defs.schemaForId(ref)
+  });
+  const roots = [];
+  if (stepContext) roots.push(["steps.", stepContext]);
+  const ownContract = resolveContract(
+    "inputType",
+    manifest,
+    contractScope.resolveIn(manifest.kind, readingModule),
+    contractScope
+  );
+  if (ownContract) roots.push(["inputs.", ownContract.schema]);
+  if (roots.length > 0) {
+    for (const [inputName, inputValue] of Object.entries(values)) {
+      const chain = plainChainOf(inputValue);
+      const root = chain ? roots.find(([prefix]) => chain.startsWith(prefix)) : void 0;
+      if (!chain || !root) continue;
+      const produced = navigateSchemaToExprPath(root[1], chain.slice(root[0].length));
+      const slotSchema = contract.schema.properties?.[inputName];
+      if (!produced || !slotSchema) continue;
+      if (isLiveSlot(produced)) {
+        const retry = site.step ? declaredRetry(site.step.value, site.step.schema, invokedManifest, invokedDefinition) : void 0;
+        if (retry !== void 0) {
+          out.push({
+            path: `${site.path}.${inputName}`,
+            targetLabel: targetLabel2,
+            message: `'${inputName}' is a live value, which is consumed by reading and so exists once \u2014 but ${retry} re-attempts the dispatch, and a re-attempt would pass nothing. Collect it to a value first, or chunk the work so each attempt carries its own replayable piece.`,
+            code: "LIVE_VALUE_RETRIED"
+          });
+          continue;
+        }
+      }
+      if (!valueTypeOf(produced) || !valueTypeOf(slotSchema)) continue;
+      const { compatible, issues } = checkSchemaCompatibility(
+        produced,
+        slotSchema,
+        (ref) => defs.schemaForId(ref)
+      );
+      if (compatible) continue;
+      out.push({
+        path: `${site.path}.${inputName}`,
+        targetLabel: targetLabel2,
+        message: issues.join("; "),
+        code: "CEL_TYPE_ARGUMENT_MISMATCH"
+      });
+    }
+  }
+  for (const issue of defs.validateResourceConfig(substituted, contract.schema)) {
+    if (celPaths.has(issue.path)) continue;
+    const anchor = missingRequired(issue) ? containerOf(issue.path) : issue.path;
+    out.push({
+      path: anchor ? `${site.path}.${anchor}` : site.path,
+      targetLabel: targetLabel2,
+      message: issue.message
+    });
+  }
+  return out;
+}
+function declaredRetry(step, stepItemSchema, invokedManifest, invokedDef) {
+  for (const [field, budget] of retryFields(stepItemSchema)) {
+    if (budget(step?.[field]) > 0) return `the step's \`${field}\``;
+  }
+  for (const [field, budget] of retryFields(invokedDef?.schema)) {
+    if (budget(invokedManifest?.[field]) > 0) return `the target's \`${field}\``;
+  }
+  return void 0;
+}
+var RETRY_BUDGET = {
+  RetryPolicy: (value) => {
+    if (!value || typeof value !== "object") return 0;
+    const attempts = value.attempts;
+    return typeof attempts === "number" ? attempts : 0;
+  },
+  RetryAttempts: (value) => typeof value === "number" ? value : 0
+};
+function retryFields(schema4) {
+  if (!schema4) return [];
+  const out = [];
+  for (const [key, sub] of gatherPropertySchemas(schema4)) {
+    const budget = RETRY_BUDGET[manifestFragmentOf(sub) ?? ""];
+    if (budget) out.push([key, budget]);
+  }
+  return out;
+}
+
+// ../../analyzer/nodejs/src/validate-reference-output.ts
+function producedOutputContract(target, definition, scope, defs) {
+  return resolveContract("outputType", target, definition, scope)?.schema ?? valueDerivedContract(
+    target,
+    defs.effectiveSchemaOf(definition),
+    "outputType"
+  );
+}
+var OUTPUT_ROLES = { source: "the target's output", target: "this slot" };
+function referenceOutputRefusal(slot, produced, defs) {
+  if (!slot.outputType || !produced) return [];
+  const { compatible, issues } = checkSchemaCompatibility(
+    produced,
+    slot.outputType,
+    (id) => defs.schemaForId(id),
+    OUTPUT_ROLES
+  );
+  return compatible ? [] : issues;
+}
+function targetLabel(target) {
+  const metadata = target.metadata;
+  if (metadata?.xTeloOrigin !== void 0 || typeof metadata?.name !== "string") {
+    return `the inline ${String(target.kind)}`;
+  }
+  return `${String(target.kind)} '${metadata.name}'`;
+}
+function collectReferenceOutputIssues(manifest, fieldMap, allManifests, defs, aliases, scopes) {
+  const out = [];
+  if (!fieldMap) return out;
+  const ctx = callSiteContext(manifest, allManifests, defs, aliases, scopes);
+  const contractScope = analyzerContractScope(defs, aliases, scopes, allManifests);
+  const readingModule = manifest.metadata?.module;
+  for (const [fieldPath, entry] of fieldMap) {
+    if (!isRefEntry(entry) || !entry.outputType) continue;
+    const slot = refSlotOfEntry(entry);
+    for (const { value: ref, path } of resolveFieldEntries(manifest, fieldPath)) {
+      if (!ref || typeof ref !== "object" || Array.isArray(ref)) continue;
+      const reference = ref;
+      if (typeof reference.kind !== "string") continue;
+      const target = typeof reference.name === "string" ? ctx.resolveTarget(reference) : reference;
+      if (!target) continue;
+      const definition = contractScope.resolveIn(reference.kind, readingModule);
+      const issues = referenceOutputRefusal(
+        slot,
+        producedOutputContract(target, definition, contractScope, defs),
+        defs
+      );
+      if (issues.length === 0) continue;
+      out.push({
+        path,
+        message: `${targetLabel(target)} does not return what this slot reads from it. The slot requires an output of ${JSON.stringify(slot.outputType)}; its declared output contract disagrees: ${issues.join("; ")}.`
+      });
+    }
+  }
+  return out;
+}
+
+// ../../analyzer/nodejs/src/manifest-analysis.ts
+var ManifestAnalysis = class {
+  constructor(manifests, ctx) {
+    this.manifests = manifests;
+    this.ctx = ctx;
+    const rootModules = /* @__PURE__ */ new Set();
+    for (const m of manifests) {
+      if (isModuleKind(m.kind) && m.metadata?.name) rootModules.add(m.metadata.name);
+    }
+    this.scopes = { aliasesByModule: ctx.aliasesByModule, rootModules };
+  }
+  scopes;
+  celScopeQuery;
+  callGraphMemo;
+  moduleGraphMemo;
+  /** What CEL sees, per site. Built on first use — its indices are a function of
+   *  the whole set, and a host that never opens a CEL body should not pay for
+   *  them. */
+  get celScope() {
+    return this.celScopeQuery ??= new CelScopeQuery(this.manifests, this.ctx);
+  }
+  /** What calls what. Built on first use and kept, so the projection and any
+   *  other consumer over this set share one. */
+  get callGraph() {
+    return this.callGraphMemo ??= buildCallGraph(this.manifests, this.ctx.defs, {
+      aliases: this.ctx.aliases,
+      aliasesByModule: this.ctx.aliasesByModule
+    });
+  }
+  /**
+   * The module graph: boxes, ordered rows and classed edges — the projection an
+   * editor draws.
+   *
+   * Here rather than on the registry because it is the registry AND a manifest
+   * set, which is the pairing this class exists to name; a fifth
+   * `registry.x(manifests, …)` factory is the accretion naming it stopped. It
+   * shares this analysis's call graph rather than building one of its own.
+   *
+   * `deps` is supplied by the registry, which owns capability resolution — this
+   * class holds the manifests, not the rules for reading a kind.
+   */
+  moduleGraph(deps, options = {}) {
+    return this.moduleGraphMemo ??= buildModuleGraph(
+      this.manifests,
+      this.callGraph,
+      deps,
+      options
+    );
+  }
+  /** Whether a resource's name denotes a type or a value — the rule the naming
+   *  check applies to it, so a rename proposes only a name `telo check` accepts. */
+  nameLevel(manifest) {
+    const resolveDef = moduleScopedDefResolver(this.ctx.defs, this.ctx.aliases, this.scopes);
+    return levelFor(manifest, resolveDef, manifest.metadata?.module);
+  }
+  /** The manifest a `(kind, name)` pair addresses. */
+  resourceFor(kind, name) {
+    return findManifest(this.manifests, kind, name);
+  }
+  /**
+   * The invocation contract of the resource a reference names.
+   *
+   * The shared resolver, so an editor offering a target's input keys is offering
+   * exactly what `telo check` validates that call site against and what the
+   * kernel binds at dispatch. Layered instance-first: a resource declaring its
+   * own `inputType:` narrows the kind's, which is the common case for a
+   * `Run.Sequence` used as a handler.
+   */
+  contractFor(ref, direction) {
+    const target = this.resolveRef(ref);
+    const definition = ref.kind ? this.definitionFor(ref.kind) : void 0;
+    if (!target && !definition) return void 0;
+    return resolveContract(
+      direction,
+      target,
+      definition,
+      analyzerContractScope(
+        this.ctx.defs,
+        this.ctx.aliases,
+        this.scopes,
+        this.manifests
+      )
+    )?.schema;
+  }
+  /**
+   * Why the resource `ref` names cannot fill `slot`, by what it RETURNS — one
+   * line per definite mismatch against the slot's `x-telo-ref` `outputType`,
+   * empty when it can. The verdict `telo check` reports as
+   * `REFERENCE_OUTPUT_MISMATCH`, so an editor never offers a target the checker
+   * then refuses.
+   */
+  outputRefusal(slot, ref) {
+    if (!slot.outputType) return [];
+    const target = this.resolveRef(ref);
+    const definition = ref.kind ? this.definitionFor(ref.kind) : void 0;
+    if (!target && !definition) return [];
+    const scope = analyzerContractScope(
+      this.ctx.defs,
+      this.ctx.aliases,
+      this.scopes,
+      this.manifests
+    );
+    return referenceOutputRefusal(
+      slot,
+      producedOutputContract(target, definition, scope, this.ctx.defs),
+      this.ctx.defs
+    );
+  }
+  /**
+   * The manifest a reference names.
+   *
+   * An ALIAS narrows before the name does: a flattened set carries every
+   * imported library's exported instances, so two libraries exporting a `store`
+   * are two manifests with one name. Matching the alias to its target module
+   * picks the right one; where the alias resolves to nothing the name alone is
+   * used, which is what a local reference needs anyway.
+   */
+  resolveRef(ref) {
+    if (!ref.name) return void 0;
+    const byName = this.manifests.filter(
+      (m) => m.metadata?.name === ref.name
+    );
+    if (byName.length === 0) return void 0;
+    if (byName.length === 1) return byName[0];
+    const targetModule = ref.alias ? this.ctx.aliases.moduleForAlias?.(ref.alias) : void 0;
+    if (targetModule) {
+      const scoped = byName.find(
+        (m) => m.metadata?.module === targetModule
+      );
+      if (scoped) return scoped;
+    }
+    return ref.kind ? byName.find((m) => m.kind === ref.kind) : void 0;
+  }
+  definitionFor(kind) {
+    const canonical = this.ctx.aliases.resolveKind(kind);
+    return this.ctx.defs.resolve(kind) ?? (canonical ? this.ctx.defs.resolve(canonical) : void 0);
+  }
+};
+
+// ../../analyzer/nodejs/src/schema-tag-text.ts
+function schemaWithTagsAsText(value) {
+  if (isCompiledValue(value) || isTaggedSentinel(value)) {
+    return typeof value.source === "string" ? value.source : "";
+  }
+  if (Array.isArray(value)) return value.map(schemaWithTagsAsText);
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = schemaWithTagsAsText(v);
+    }
+    return out;
+  }
+  return value;
+}
+
+// ../../analyzer/nodejs/src/definition-registry.ts
+var DefinitionRegistry = class {
+  constructor() {
+    for (const def of KERNEL_BUILTINS) this.add(def, true);
+  }
+  /** Per-instance AJV for cross-module $ref resolution. Isolated so each registry
+   *  (and thus each AnalysisContext) has its own schema store — no stale schemas
+   *  across analyze() calls and no unbounded growth across the process lifetime. */
+  ajv = createAjv();
+  registeredSchemaIds = /* @__PURE__ */ new Set();
+  compiledValidators = /* @__PURE__ */ new WeakMap();
+  /** The subset of `registeredSchemaIds` claimed by a kind's schema. Kinds and
+   *  named `Telo.Type`s share one `telo://<module>/<Name>` id space, so this is
+   *  what lets a colliding type name be reported instead of silently dropped. */
+  definitionSchemaIds = /* @__PURE__ */ new Set();
+  defs = /* @__PURE__ */ new Map();
+  fieldMaps = /* @__PURE__ */ new Map();
+  /** Reverse inheritance index: parent kind → direct child kinds. */
+  extendedBy = /* @__PURE__ */ new Map();
+  /** Memoized inheritance-resolved schemas. `null` records "resolved to
+   *  nothing", so a kind with no schema is not re-walked on every resource. */
+  effectiveSchemas = /* @__PURE__ */ new Map();
+  /** DEPRECATED module identity table: identity string → canonical module name
+   *  ("std/pipeline" → "pipeline"). Serves only the legacy
+   *  `<namespace>/<module>#<Kind>` form of `x-telo-ref`, kept resolvable for
+   *  module versions published before constraints named their target by import
+   *  alias. Fed by `metadata.namespace`, which nothing else reads. */
+  identityMap = /* @__PURE__ */ new Map();
+  register(definition) {
+    this.add(definition, false);
+  }
+  /** `trustedSchema` skips meta-validating the schema — only for the built-ins,
+   *  whose validity a test asserts once. */
+  add(definition, trustedSchema) {
+    const { name, module: mod } = definition.metadata;
+    const key = mod ? `${mod}.${name}` : name;
+    this.defs.set(key, definition);
+    this.fieldMaps.clear();
+    this.effectiveSchemas.clear();
+    if (definition.capability) {
+      this.addExtendedBy(definition.capability, key);
+    }
+    if (definition.extends) {
+      this.addExtendedBy(definition.extends, key);
+    }
+    if (definition.kind === "Telo.Abstract" && mod === "Telo") {
+      this.identityMap.set("telo", "Telo");
+    }
+    if (mod && definition.schema) {
+      this.tryRegisterSchema(
+        mod,
+        name,
+        definition.schema,
+        trustedSchema
+      );
+    }
+  }
+  addExtendedBy(parent, child) {
+    const children = this.extendedBy.get(parent);
+    if (children) {
+      if (!children.includes(child)) children.push(child);
+    } else {
+      this.extendedBy.set(parent, [child]);
+    }
+  }
+  /** DEPRECATED. Register a module identity so the legacy
+   *  `<namespace>/<module>#<Kind>` form of `x-telo-ref` still resolves for module
+   *  versions published before constraints named their target by import alias.
+   *  New manifests declare no namespace and need no identity — their constraints
+   *  are canonicalized to `<module>.<Kind>` before registration.
+   *
+   *  The "telo" identity is reserved for the built-in module and is populated
+   *  automatically when a `Telo.Abstract` registers. A namespace-less module must
+   *  not claim it: overwriting the entry would repoint every legacy `telo#…`
+   *  constraint at a module that declares no such kind, and the resulting
+   *  unresolvable ref reads as partial context rather than an error.
+   *
+   *  @param namespace  The module's `metadata.namespace`, or null when it declares none.
+   *  @param moduleName The module's `metadata.name` (e.g. "pipeline", "http-server"). */
+  registerModuleIdentity(namespace, moduleName2) {
+    if (!namespace || moduleName2 === "Telo") return;
+    this.identityMap.set(`${namespace}/${moduleName2}`, moduleName2);
+  }
+  /** Registers a named `Telo.Type` resource's schema under its canonical
+   *  module-scoped URI `$id` (`telo://<module>/<name>`), so a sibling schema's
+   *  `$ref: "telo://Self/<name>"` (rewritten to the canonical form by
+   *  `resolveSchemaTypeRefs`) resolves during AJV compilation. Mirrors the
+   *  kernel type controller's `registerSchema(canonicalTypeSchemaId(...))`.
+   *
+   *  Returns `false` when a kind schema in the same module already owns the id —
+   *  a name collision between a kind and a named type. Definitions register
+   *  first, so the type is the one that would be dropped, and every
+   *  `$ref: "telo://<module>/<Name>"` would then silently validate against the
+   *  kind's schema instead. The caller reports it; nothing is overwritten. */
+  registerNamedTypeSchema(id, schema4) {
+    if (this.definitionSchemaIds.has(id)) return false;
+    if (this.registeredSchemaIds.has(id) || this.ajv.getSchema(id)) return true;
+    if (!this.tryAddSchema(schema4, id)) return true;
+    this.registeredSchemaIds.add(id);
+    return true;
+  }
+  /**
+   * Register a schema, surviving one AJV refuses.
+   *
+   * `addSchema` META-VALIDATES and THROWS, and a throw here escapes the whole
+   * analyze pass: one author schema with `minimum: "3"` in it aborted the run
+   * with AJV's own unanchored text and took every other diagnostic in the file
+   * down with it — including the anchored one that says exactly which keyword is
+   * wrong. Registration is a lookup table for `$ref` resolution, so failing to
+   * fill one entry costs a reference that could not have resolved anyway.
+   *
+   * Nothing is swallowed: an unregisterable schema is invalid, and the two
+   * checks that report it both run afterwards and both anchor on the offending
+   * line — `SCHEMA_VIOLATION` from the `KindSchema` / `JsonSchema7` fragment the
+   * slot points at, and `SCHEMA_COMPILE_ERROR` from {@link schemaCompileError},
+   * which wraps `compile` for this same reason.
+   */
+  tryAddSchema(schema4, id, trusted = false) {
+    try {
+      this.ajv.addSchema(schemaWithTagsAsText(schema4), id, void 0, !trusted);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  /** True when a schema is registered under `id` (a canonical `telo://` type id
+   *  or a definition `$id`). Used to flag schema `$ref`s that resolve to nothing. */
+  hasSchemaId(id) {
+    return this.registeredSchemaIds.has(id) || this.ajv.getSchema(id) !== void 0;
+  }
+  /** The schema registered under `id`, for a structural comparison that must see
+   *  THROUGH a named shape. Declaring a shape once and referencing it is the
+   *  sanctioned way to reuse one, so a comparator that cannot follow the
+   *  reference judges two opaque nodes and learns nothing.
+   *
+   *  A registered id is READ, never compiled: this is a structural lookup, and
+   *  compiling a shape the registry holds but cannot compile throws out of
+   *  whichever walk asked. That shape's compile failure is reported where the
+   *  shape is validated, not here. */
+  schemaForId(id) {
+    let entry = this.ajv.schemas[id] ?? this.ajv.refs[id];
+    while (typeof entry === "string") entry = this.ajv.schemas[entry] ?? this.ajv.refs[entry];
+    const schema4 = entry ? entry.schema : this.ajv.getSchema(id)?.schema;
+    return schema4 && typeof schema4 === "object" ? schema4 : void 0;
+  }
+  /**
+   * Validates a resource's configuration against its kind's schema, with the
+   * offending field's path — what a `SCHEMA_VIOLATION` diagnostic is built from.
+   *
+   * On THIS registry's AJV, which is the point: it holds every registered
+   * definition schema and every named `Telo.Type`, so a kind whose schema
+   * references a shape declared elsewhere is checked rather than skipped. The
+   * module-level instance this used to run on had none of them registered, so
+   * such a schema failed to compile and the failure was swallowed — a resource
+   * could be arbitrarily wrong and `telo check` reported nothing, while the
+   * kernel (whose validator does resolve the reference) rejected it at boot.
+   * Two AJVs answering one question is what made that possible; there is now
+   * one, and it is the same one `schemaCompileError` reports through.
+   */
+  validateWithRefs(data, schema4) {
+    const validate2 = this.compiledFor(schema4);
+    if (!validate2 || validate2(data)) return [];
+    return reduceSchemaErrors(explainFormatErrors(validate2.errors, data)).map(formatSingleError);
+  }
+  /** {@link validateWithRefs}, with the path each issue is anchored at. */
+  validateResourceConfig(data, schema4) {
+    const validate2 = this.compiledFor(schema4);
+    if (!validate2 || validate2(data)) return [];
+    return schemaIssues(validate2.errors, data);
+  }
+  /** Memoized per schema OBJECT — the analyzer validates every resource of a
+   *  kind against the same one, and this runs at keystroke time in an editor.
+   *  A schema AJV refuses compiles to `undefined`; that is reported once,
+   *  anchored on the owning definition, by `schemaCompileError`. */
+  compiledFor(schema4) {
+    const cached = this.compiledValidators.get(schema4);
+    if (cached) return cached;
+    try {
+      const validate2 = this.ajv.compile(schemaWithTagsAsText(schema4));
+      this.compiledValidators.set(schema4, validate2);
+      return validate2;
+    } catch {
+      return void 0;
+    }
+  }
+  /** Returns the AJV compile error for `schema`, or `undefined` when it compiles.
+   *  Compiles on this registry's instance, which has every loaded module schema
+   *  plus the manifest root registered, so local `#/$defs`, `telo://manifest`,
+   *  and cross-module `$ref`s all resolve. Used to fail loud on a definition
+   *  schema that AJV cannot compile — otherwise `validateAgainstSchema` /
+   *  `validateWithRefs` would swallow the failure and silently skip every
+   *  resource of that kind. */
+  schemaCompileError(schema4) {
+    try {
+      this.ajv.compile(schemaWithTagsAsText(schema4));
+      return void 0;
+    } catch (err) {
+      return err instanceof Error ? err.message : String(err);
+    }
+  }
+  /** Registers a definition schema under the same module-scoped `telo://` id a
+   *  named `Telo.Type` uses, so a kind schema and a type schema are addressable
+   *  the same way and a `$ref` between them resolves at AJV compile time. One id
+   *  space per module: a kind and a named type may not share a name, which
+   *  `registerNamedTypeSchema` reports rather than resolving silently. */
+  tryRegisterSchema(moduleName2, typeName2, schema4, trusted) {
+    const id = canonicalTypeSchemaId(moduleName2, typeName2);
+    if (this.registeredSchemaIds.has(id)) {
+      this.definitionSchemaIds.add(id);
+      return;
+    }
+    if (this.ajv.getSchema(id)) {
+      throw new Error(`Duplicate definition schema $id: "${id}" is already registered`);
+    }
+    this.tryAddSchema(schema4, id, trusted);
+    this.registeredSchemaIds.add(id);
+    this.definitionSchemaIds.add(id);
+  }
+  /** Resolves an `x-telo-ref` constraint to a canonical registry kind key.
+   *
+   *  The constraint is already canonical `<module>.<Kind>`: alias-form values
+   *  (`KvStore.Store`, `Self.Store`, `Telo.Invocable`) are rewritten in the
+   *  declaring module's scope by `resolveSchemaRefKinds` before registration, so
+   *  no module context is needed here.
+   *
+   *  The legacy `<namespace>/<module>#<Kind>` form still resolves through the
+   *  identity table for module versions published before the alias form existed:
+   *
+   *    "telo#Invocable"         → "Telo.Invocable"
+   *    "std/http-server#Server" → "http-server.Server"
+   *
+   *  Returns undefined when a legacy string is malformed or its identity was
+   *  never registered. */
+  resolveRef(xTeloRef) {
+    const hash = xTeloRef.indexOf("#");
+    if (hash === -1) return xTeloRef;
+    if (hash === xTeloRef.length - 1) return void 0;
+    const moduleName2 = this.identityMap.get(xTeloRef.slice(0, hash));
+    if (!moduleName2) return void 0;
+    return `${moduleName2}.${xTeloRef.slice(hash + 1)}`;
+  }
+  resolve(kind) {
+    return this.defs.get(kind);
+  }
+  /**
+   * The kind's AUTHOR-FACING schema — its own merged with everything it
+   * inherits along `extends` — memoized per kind.
+   *
+   * This is what every consumer reading a kind's schema to interpret an
+   * INSTANCE must use, because that is the schema the instance was authored
+   * against and the one the kernel stamps at definition registration. Reading
+   * `resolve(kind).schema` instead sees only what the leaf declared, so an
+   * annotation on a parent — a CEL context region, a step body, an error
+   * context — is invisible on every child, silently and per consumer. Sharing
+   * one memo is what keeps those consumers from drifting apart.
+   *
+   * Lazy for the same reason `getFieldMap` is: a child registered before its
+   * parent still sees the inherited half once both are present.
+   */
+  effectiveSchema(kind) {
+    const cached = this.effectiveSchemas.get(kind);
+    if (cached !== void 0) return cached ?? void 0;
+    const def = this.defs.get(kind);
+    if (!def) return void 0;
+    const schema4 = effectiveAuthorSchema(def, (k) => this.resolve(k));
+    this.effectiveSchemas.set(kind, schema4 ?? null);
+    return schema4;
+  }
+  /** The effective schema for a definition, by the kind it is registered under.
+   *  Falls back to the definition's own schema when it is not in this registry
+   *  (a synthesized or not-yet-registered kind), which is the pre-inheritance
+   *  behaviour and the safe direction: it types less, never wrongly. */
+  effectiveSchemaOf(definition) {
+    if (!definition) return void 0;
+    const { name, module: mod } = definition.metadata;
+    const resolved = this.effectiveSchema(mod ? `${mod}.${name}` : name);
+    return resolved ?? definition.schema;
   }
-  return out;
-}
-function pointerSegments(pointer) {
-  if (!pointer.startsWith("/")) return void 0;
-  const segments = pointer.slice(1).split("/").map((s) => s.replace(/~1/g, "/").replace(/~0/g, "~"));
-  return segments.every((s) => s.length > 0 && !/^\d+$/.test(s)) ? segments : void 0;
-}
-function templateCallSite(manifest, ctx) {
-  if (manifest.kind !== "Telo.Definition") return void 0;
-  const values = manifest.inputs;
-  if (!values || typeof values !== "object" || Array.isArray(values)) return void 0;
-  const scope = contractScopeOf(ctx);
-  const module = manifest.metadata?.module;
-  for (const slot of ["invoke", "provide"]) {
-    const target = dispatchTargetOf(manifest, slot);
-    if (!target) continue;
-    const definition2 = scope.resolveIn(target.kind, module);
-    const aliases = moduleAliasScope(manifest.metadata, ctx.aliases, ctx.aliasesByModule);
-    const entry = target.entry && {
-      ...target.entry,
-      inputType: withCanonicalRefSentinels(
-        target.entry.inputType,
-        module,
-        (alias) => aliases?.moduleForAlias(alias)
-      )
-    };
-    return {
-      origin: "template",
-      path: "inputs",
-      values,
-      invoke: { kind: target.kind, name: target.name },
-      invokedManifest: entry,
-      invokedDefinition: definition2,
-      contract: resolveContract("inputType", entry, definition2, scope)
-    };
+  /** Returns the reference field map for the given kind, computed lazily from the
+   *  kind's AUTHOR-FACING (inheritance-resolved) schema and memoized. Lazy so a
+   *  child registered before its parent still sees the parent's inherited ref
+   *  slots once both are present. */
+  getFieldMap(kind) {
+    const cached = this.fieldMaps.get(kind);
+    if (cached) return cached;
+    const def = this.defs.get(kind);
+    if (!def) return void 0;
+    const schema4 = effectiveAuthorSchema(def, (k) => this.resolve(k));
+    const map3 = buildReferenceFieldMap(schema4 ?? {});
+    this.fieldMaps.set(kind, map3);
+    return map3;
   }
-  const dispatch = [manifest.invoke, manifest.provide].find(
-    (d) => d && typeof d === "object" && !Array.isArray(d) && typeof d.kind === "string"
-  );
-  if (!dispatch) return void 0;
-  const definition = scope.resolveIn(dispatch.kind, module);
-  return {
-    origin: "template",
-    path: "inputs",
-    values,
-    invoke: { kind: dispatch.kind },
-    invokedManifest: void 0,
-    invokedDefinition: definition,
-    contract: resolveContract("inputType", void 0, definition, scope)
-  };
-}
-function valueSchemaSites(manifest, defSchema, ctx) {
-  if (!defSchema) return [];
-  const out = [];
-  for (const { scope, from } of valueSchemaSlots(defSchema)) {
-    const schema4 = resolveTypeFieldToSchema(manifest[from], ctx.typeManifests);
-    if (!schema4 || typeof schema4 !== "object") continue;
-    for (const { path, value } of resolveScopeValues(manifest, scope)) {
-      out.push({ path, value, schema: schema4, from });
+  /** Returns the field map for `kind`, falling back to the alias-resolved kind when not found. */
+  getFieldMapForKind(kind, aliases) {
+    const fm = this.getFieldMap(kind);
+    if (fm) return fm;
+    const resolved = aliases?.resolveKind(kind);
+    return resolved ? this.getFieldMap(resolved) : void 0;
+  }
+  /** Returns the field map for `resource.kind` with x-telo-schema-from entries replaced
+   *  by their nested ref/scope slots — so Phase 2 inline normalization and Phase 5
+   *  injection see encoders nested behind a schema-from indirection (e.g.
+   *  http-server `Server.notFoundHandler.returns[].content[mime].encoder`).
+   *
+   *  Only static absolute schema-from paths with a dotted alias anchor are expanded
+   *  (e.g. "HttpDispatch.Outcomes/$defs/Returns"). Relative and unqualified absolute
+   *  anchors depend on a sibling property at runtime and stay unexpanded; the
+   *  analyzer's reference validation phase already flags the cases that matter. */
+  expandedFieldMapForResource(resource, aliases, aliasesByModule) {
+    const moduleScope = moduleAliasScope(resource.metadata, aliases, aliasesByModule);
+    const baseMap = this.getFieldMapForKind(resource.kind, moduleScope);
+    if (!baseMap) return void 0;
+    const resolvedKind = moduleScope.resolveKind(resource.kind) ?? resource.kind;
+    const def = this.resolve(resource.kind) ?? this.resolve(resolvedKind);
+    const ownerScope = moduleAliasScope(def?.metadata, aliases, aliasesByModule);
+    const expanded = /* @__PURE__ */ new Map();
+    for (const [path, entry] of baseMap) {
+      if (!isSchemaFromEntry(entry)) {
+        expanded.set(path, entry);
+        continue;
+      }
+      const sub = this.resolveSchemaFromSubMap(entry.schemaFrom, path, ownerScope);
+      if (!sub) continue;
+      for (const [subPath, subEntry] of sub) expanded.set(subPath, subEntry);
     }
+    return expanded;
   }
-  return out;
-}
-function derivedSlotsOf(resource, ctx) {
-  const manifest = resource;
-  const moduleScope = moduleAliasScope(resource.metadata, ctx.aliases, ctx.aliasesByModule);
-  const resolvedKind = moduleScope.resolveKind(resource.kind);
-  const definition = ctx.defs.resolve(resource.kind) ?? (resolvedKind ? ctx.defs.resolve(resolvedKind) : void 0);
-  const schema4 = ctx.defs.effectiveSchemaOf(definition);
-  const out = [];
-  const at2 = (path, value, schema5) => out.push({ path, value, schema: schema5, replace: (next) => assignConcretePath(manifest, path, next) });
-  const calls = [
-    ...schema4 ? stepCallSites(manifest, schema4, ctx) : [],
-    ...slotCallSites(
-      manifest,
-      ctx.defs.expandedFieldMapForResource(resource, ctx.aliases, ctx.aliasesByModule),
-      ctx
-    )
-  ];
-  const template = templateCallSite(manifest, ctx);
-  if (template) calls.push(template);
-  for (const call of calls) {
-    if (call.contract) at2(call.path, call.values, call.contract.schema);
+  /**
+   * The schema an `x-telo-schema-from` slot derives its shape from.
+   *
+   * Only the STATIC form resolves: an anchor that is a dotted alias-qualified
+   * kind (`HttpDispatch.Request/$defs/Matcher`). The polymorphic forms — a
+   * relative anchor, or a single-segment absolute one — name a sibling property
+   * whose value is known per resource, so a definition-level lookup would be
+   * guessing at one instance's shape.
+   *
+   * Its own method because a schema-from slot is otherwise INVISIBLE to anything
+   * reading `properties`: the field map needs the nested ref slots, and an IDE
+   * needs the very same node to offer a key or describe one. Two resolutions of
+   * one annotation would eventually disagree about which anchors are static.
+   */
+  resolveSchemaFromNode(schemaFrom, ownerScope) {
+    const isAbsolute = schemaFrom.startsWith("/");
+    const expr = isAbsolute ? schemaFrom.slice(1) : schemaFrom;
+    const slashIdx = expr.indexOf("/");
+    if (slashIdx === -1) return void 0;
+    const anchorName = expr.slice(0, slashIdx);
+    const jsonPointer = "/" + expr.slice(slashIdx + 1);
+    if (!anchorName.includes(".")) return void 0;
+    const targetKind = ownerScope.resolveKind(anchorName);
+    if (!targetKind) return void 0;
+    const targetDef = this.resolve(targetKind);
+    if (!targetDef?.schema) return void 0;
+    const subSchema = navigateJsonPointer(
+      targetDef.schema,
+      jsonPointer
+    );
+    if (!subSchema || typeof subSchema !== "object") return void 0;
+    return subSchema;
   }
-  for (const site of valueSchemaSites(manifest, schema4, ctx)) {
-    at2(site.path, site.value, site.schema);
+  resolveSchemaFromSubMap(schemaFrom, fieldPath, ownerScope) {
+    const subSchema = this.resolveSchemaFromNode(schemaFrom, ownerScope);
+    if (!subSchema) return null;
+    return buildFieldMapAtPath(subSchema, fieldPath);
   }
-  visitManifest(
-    [resource],
-    ctx.defs,
-    {
-      onSchemaFrom: (e) => {
-        for (const site of schemaFromSites(manifest, e.fieldPath, e.entry.schemaFrom, ctx)) {
-          if (isSchemaFromSite(site)) at2(site.path, site.value, site.schema);
-        }
+  /** The kinds a definition descends from DIRECTLY — the same two edges
+   *  `register` feeds into `extendedBy`, read the other way.
+   *
+   *  Both spellings, because either can carry the edge that satisfies a slot:
+   *  `capability:` is the legacy implements-this form, `extends:` the canonical
+   *  one. A consumer walking these by hand would be a second reading of what an
+   *  inheritance edge IS, and the downward index and the upward walk have to
+   *  agree about that forever. */
+  parentsOf(kind) {
+    const def = this.defs.get(kind);
+    if (!def) return [];
+    return [def.capability, def.extends].filter(
+      (parent) => typeof parent === "string" && parent.length > 0
+    );
+  }
+  /** Whether every kind this one descends from is registered.
+   *
+   *  When it is, what the kind implements is FULLY KNOWN: a target it does not
+   *  reach is one it genuinely does not implement, so a mismatch is a verdict.
+   *  When a hop is missing — an unimported abstract, an alias the declaring file
+   *  could not resolve — a mismatch cannot be told from a missing dependency,
+   *  which is the partial context every reference check stays lenient in. */
+  ancestryResolved(kind) {
+    const queue = [kind];
+    const seen = /* @__PURE__ */ new Set();
+    while (queue.length > 0) {
+      const current = queue.shift();
+      if (seen.has(current)) continue;
+      seen.add(current);
+      if (!this.defs.has(current)) return false;
+      queue.push(...this.parentsOf(current));
+    }
+    return true;
+  }
+  /** Returns all definitions that transitively extend the given abstract kind.
+   *  Follows the capability chain to any depth (equivalent to instanceof in OOP).
+   *  Definitions are included regardless of registration order. */
+  getByExtends(abstractKind) {
+    const result = [];
+    const queue = [abstractKind];
+    while (queue.length > 0) {
+      const parent = queue.shift();
+      const children = this.extendedBy.get(parent);
+      if (!children) continue;
+      for (const child of children) {
+        const def = this.defs.get(child);
+        if (def) result.push(def);
+        queue.push(child);
       }
-    },
-    {
-      aliases: ctx.aliases,
-      aliasesByModule: ctx.aliasesByModule,
-      skipKinds: REF_VALIDATION_SKIP_KINDS,
-      expand: false
     }
-  );
-  return out;
-}
+    return result;
+  }
+  kinds() {
+    return Array.from(this.defs.keys());
+  }
+};
 
 // ../../analyzer/nodejs/src/instantiable-kind.ts
 function isInstantiableDefinition(def) {
@@ -47782,6 +48080,32 @@ var AnalysisRegistry = class _AnalysisRegistry {
       typeManifestsFor: () => []
     })?.schema;
   }
+  /**
+   * Why a resource of `candidate.kind` — configured as `candidate.config`, when
+   * the caller holds its configuration — cannot fill `slot`, by what it RETURNS:
+   * one line per definite mismatch against the slot's `x-telo-ref`
+   * `outputType`, empty when it can. The same derivation and comparator
+   * `telo check`'s `REFERENCE_OUTPUT_MISMATCH` runs, for a host that has a kind
+   * (and perhaps its fields) but not the analyzed manifest set. A named shape an
+   * instance's own `outputType` points at resolves through no manifest here, so
+   * that layer gives no verdict and the kind's contract decides.
+   */
+  outputRefusal(slot, candidate) {
+    if (!slot.outputType) return [];
+    const definition = this.resolveDefinition(candidate.kind);
+    if (!definition) return [];
+    const target = candidate.config ? { kind: candidate.kind, ...candidate.config } : void 0;
+    return referenceOutputRefusal(
+      slot,
+      producedOutputContract(
+        target,
+        definition,
+        { resolveDefinition: this.scopedDefResolver(), typeManifestsFor: () => [] },
+        this.defs
+      ),
+      this.defs
+    );
+  }
   /** A resolver that re-scopes at every hop of an `extends` chain: each kind is
    *  resolved in the module that DECLARED the definition it was read off, since
    *  `extends` aliases are lexical. `resolveParent` always passes that definition
@@ -51237,6 +51561,14 @@ function checkAnnotation(annotation, manifest, path, issues) {
       message: `x-telo-ref at '${path}' declares 'throwsThrough: ${JSON.stringify(obj.throwsThrough)}', which is not a boolean. Only 'true' declares that throws from this slot's target surface through the declaring resource; anything else reads as absent, which silently stops its catch list from enclosing what it holds.`
     });
   }
+  if (obj.outputType !== void 0 && (!obj.outputType || typeof obj.outputType !== "object" || Array.isArray(obj.outputType))) {
+    issues.push({
+      code: "X_TELO_REF_INVALID_OUTPUT_TYPE",
+      manifest,
+      path,
+      message: `x-telo-ref at '${path}' declares 'outputType: ${JSON.stringify(obj.outputType)}', which is not a JSON Schema object. It names the shape the target's output must have (e.g. '{ type: object, required: [output] }'); anything else reads as absent, so the slot would accept a target returning anything.`
+    });
+  }
   for (const key of Object.keys(obj)) {
     if (REF_ANNOTATION_KEYS.has(key)) continue;
     issues.push({
@@ -51248,7 +51580,7 @@ function checkAnnotation(annotation, manifest, path, issues) {
   }
   return declaredUses(use);
 }
-var REF_ANNOTATION_KEYS = /* @__PURE__ */ new Set(["kind", "use", "inputs", "throwsThrough"]);
+var REF_ANNOTATION_KEYS = /* @__PURE__ */ new Set(["kind", "use", "inputs", "throwsThrough", "outputType"]);
 function carriesRefAnnotation(obj) {
   if (obj["x-telo-ref"] !== void 0) return true;
   for (const key of ["anyOf", "oneOf"]) {
@@ -51705,64 +52037,6 @@ function formatSegments(segments) {
   return out;
 }
 
-// ../../analyzer/nodejs/src/plain-literal-decoding.ts
-function decodePlainLiterals(value, schema4, external, rootSchema = schema4) {
-  return mapTextLeaves(value, schema4, decodePlainText, external, rootSchema);
-}
-function mapTextLeaves(value, schema4, leaf, external, rootSchema = schema4, visit4) {
-  const walk4 = (node, raw, base, pointer) => {
-    const entered = resolveRefIn(raw, base, external);
-    const selected = selectUnionBranch(entered.schema, node, entered.root, external);
-    const { schema: here, root } = resolveRefIn(selected, entered.root, external);
-    visit4?.(here, node, pointer);
-    if (typeof node === "string") return leaf(here, node, pointer);
-    if (!node || typeof node !== "object") return node;
-    if (here["x-telo-ref"] !== void 0) return node;
-    if (isCompiledValue(node) || isTaggedSentinel(node)) return node;
-    if (Array.isArray(node)) {
-      const item = resolveRefIn(here.items ?? {}, root, external);
-      for (let i = 0; i < node.length; i++) node[i] = walk4(node[i], item.schema, item.root, `${pointer}/${i}`);
-      return node;
-    }
-    const proto = Object.getPrototypeOf(node);
-    if (proto !== Object.prototype && proto !== null) return node;
-    const properties = collectProperties(here);
-    const additional = here.additionalProperties && typeof here.additionalProperties === "object" ? here.additionalProperties : void 0;
-    const record = node;
-    for (const key of Object.keys(record)) {
-      const child = properties[key] ?? additional;
-      if (child) {
-        record[key] = walk4(record[key], child, root, `${pointer}/${key.replace(/~/g, "~0").replace(/\//g, "~1")}`);
-      }
-    }
-    return node;
-  };
-  return walk4(value, schema4, rootSchema, "");
-}
-function substituteDecodedCelFields(data, schema4, rootSchema, options = {}) {
-  const decoded = decodePlainLiterals(
-    copyPlainContainers(data),
-    schema4,
-    options.external,
-    rootSchema ?? schema4
-  );
-  return substituteCelFields(decoded, schema4, rootSchema, options);
-}
-function copyPlainContainers(value) {
-  if (Array.isArray(value)) return value.map(copyPlainContainers);
-  if (!value || typeof value !== "object" || isCompiledValue(value) || isTaggedSentinel(value)) {
-    return value;
-  }
-  const proto = Object.getPrototypeOf(value);
-  if (proto !== Object.prototype && proto !== null) return value;
-  return Object.fromEntries(
-    Object.entries(value).map(([key, item]) => [
-      key,
-      copyPlainContainers(item)
-    ])
-  );
-}
-
 // ../../analyzer/nodejs/src/validate-value-schema.ts
 function collectValueSchemaIssues(manifest, defSchema, allManifests, validator) {
   const issues = [];
@@ -58704,7 +58978,7 @@ function describe3(value) {
 }
 
 // ../../analyzer/nodejs/src/telo-version.ts
-var TELO_SURFACE_VERSION = "0.102.0";
+var TELO_SURFACE_VERSION = "0.103.1";
 
 // ../../analyzer/nodejs/src/validate-requires.ts
 var SOURCE19 = "telo-analyzer";
@@ -59259,153 +59533,6 @@ function findInModule(manifests, name, module) {
   return byName.length === 1 ? byName[0] : void 0;
 }
 
-// ../../analyzer/nodejs/src/validate-step-inputs.ts
-var missingRequired = (issue) => /is missing required property/.test(issue.message);
-function containerOf(path) {
-  const dot = path.lastIndexOf(".");
-  return dot === -1 ? "" : path.slice(0, dot);
-}
-var declarationsByName = /* @__PURE__ */ new WeakMap();
-function byNameOf(allManifests) {
-  let byName = declarationsByName.get(allManifests);
-  if (!byName) {
-    byName = /* @__PURE__ */ new Map();
-    for (const m of allManifests) {
-      const name = m.metadata?.name;
-      if (typeof name !== "string" || m.kind === "Telo.Import") continue;
-      const list2 = byName.get(name);
-      if (list2) list2.push(m);
-      else byName.set(name, [m]);
-    }
-    declarationsByName.set(allManifests, byName);
-  }
-  return byName;
-}
-function callSiteContext(manifest, allManifests, defs, aliases, scopes) {
-  const fromModule = manifest.metadata?.module;
-  const scope = moduleAliasScope({ module: fromModule }, aliases, scopes.aliasesByModule);
-  return {
-    defs,
-    aliases,
-    aliasesByModule: scopes.aliasesByModule,
-    rootModules: scopes.rootModules,
-    typeManifests: allManifests,
-    resolveTarget: (ref) => typeof ref.name === "string" ? resolveReferenceTarget(
-      byNameOf(allManifests),
-      { name: ref.name, ...typeof ref.alias === "string" ? { alias: ref.alias } : {} },
-      fromModule,
-      (alias) => scope.moduleForAlias(alias)
-    ) : void 0
-  };
-}
-function collectStepInputIssues(manifest, defSchema, allManifests, defs, aliases, scopes, stepContext) {
-  const ctx = callSiteContext(manifest, allManifests, defs, aliases, scopes);
-  return stepCallSites(manifest, defSchema, ctx).flatMap(
-    (site) => checkCallSite(site, manifest, allManifests, defs, aliases, scopes, stepContext)
-  );
-}
-function collectRefInputIssues(manifest, fieldMap, allManifests, defs, aliases, scopes) {
-  const ctx = callSiteContext(manifest, allManifests, defs, aliases, scopes);
-  return slotCallSites(manifest, fieldMap, ctx).flatMap(
-    (site) => checkCallSite(site, manifest, allManifests, defs, aliases, scopes)
-  );
-}
-function checkCallSite(site, manifest, allManifests, defs, aliases, scopes, stepContext) {
-  const out = [];
-  const { contract, values, invoke, invokedManifest, invokedDefinition } = site;
-  if (!contract) return out;
-  const targetLabel = invoke.name ?? invoke.kind ?? "the invoked resource";
-  const contractScope = analyzerContractScope(defs, aliases, scopes, allManifests);
-  const readingModule = manifest.metadata?.module;
-  const celPaths = /* @__PURE__ */ new Set();
-  const substituted = substituteDecodedCelFields(values, contract.schema, void 0, {
-    onSubstitute: (p) => celPaths.add(p),
-    // A contract may name a shape declared elsewhere. Both halves need the
-    // resolver or they disagree about the same slot.
-    external: (ref) => defs.schemaForId(ref)
-  });
-  const roots = [];
-  if (stepContext) roots.push(["steps.", stepContext]);
-  const ownContract = resolveContract(
-    "inputType",
-    manifest,
-    contractScope.resolveIn(manifest.kind, readingModule),
-    contractScope
-  );
-  if (ownContract) roots.push(["inputs.", ownContract.schema]);
-  if (roots.length > 0) {
-    for (const [inputName, inputValue] of Object.entries(values)) {
-      const chain = plainChainOf(inputValue);
-      const root = chain ? roots.find(([prefix]) => chain.startsWith(prefix)) : void 0;
-      if (!chain || !root) continue;
-      const produced = navigateSchemaToExprPath(root[1], chain.slice(root[0].length));
-      const slotSchema = contract.schema.properties?.[inputName];
-      if (!produced || !slotSchema) continue;
-      if (isLiveSlot(produced)) {
-        const retry = site.step ? declaredRetry(site.step.value, site.step.schema, invokedManifest, invokedDefinition) : void 0;
-        if (retry !== void 0) {
-          out.push({
-            path: `${site.path}.${inputName}`,
-            targetLabel,
-            message: `'${inputName}' is a live value, which is consumed by reading and so exists once \u2014 but ${retry} re-attempts the dispatch, and a re-attempt would pass nothing. Collect it to a value first, or chunk the work so each attempt carries its own replayable piece.`,
-            code: "LIVE_VALUE_RETRIED"
-          });
-          continue;
-        }
-      }
-      if (!valueTypeOf(produced) || !valueTypeOf(slotSchema)) continue;
-      const { compatible, issues } = checkSchemaCompatibility(
-        produced,
-        slotSchema,
-        (ref) => defs.schemaForId(ref)
-      );
-      if (compatible) continue;
-      out.push({
-        path: `${site.path}.${inputName}`,
-        targetLabel,
-        message: issues.join("; "),
-        code: "CEL_TYPE_ARGUMENT_MISMATCH"
-      });
-    }
-  }
-  for (const issue of defs.validateResourceConfig(substituted, contract.schema)) {
-    if (celPaths.has(issue.path)) continue;
-    const anchor = missingRequired(issue) ? containerOf(issue.path) : issue.path;
-    out.push({
-      path: anchor ? `${site.path}.${anchor}` : site.path,
-      targetLabel,
-      message: issue.message
-    });
-  }
-  return out;
-}
-function declaredRetry(step, stepItemSchema, invokedManifest, invokedDef) {
-  for (const [field, budget] of retryFields(stepItemSchema)) {
-    if (budget(step?.[field]) > 0) return `the step's \`${field}\``;
-  }
-  for (const [field, budget] of retryFields(invokedDef?.schema)) {
-    if (budget(invokedManifest?.[field]) > 0) return `the target's \`${field}\``;
-  }
-  return void 0;
-}
-var RETRY_BUDGET = {
-  RetryPolicy: (value) => {
-    if (!value || typeof value !== "object") return 0;
-    const attempts = value.attempts;
-    return typeof attempts === "number" ? attempts : 0;
-  },
-  RetryAttempts: (value) => typeof value === "number" ? value : 0
-};
-function retryFields(schema4) {
-  if (!schema4) return [];
-  const out = [];
-  for (const [key, sub] of gatherPropertySchemas(schema4)) {
-    const budget = RETRY_BUDGET[manifestFragmentOf(sub) ?? ""];
-    if (budget) out.push([key, budget]);
-  }
-  return out;
-}
-
 // ../../analyzer/nodejs/src/validate-nested-inline.ts
 var SOURCE22 = "telo-analyzer";
 function validateNestedInlineResources(manifest, rootSchema, lookupDefinition, allManifests, validator, implementationsOf) {
@@ -63448,10 +63575,31 @@ var StaticAnalyzer = class {
           if (effectiveSchema) {
             const stepName = m.metadata?.name;
             const stepFile = m.metadata?.source;
+            const expandedFieldMap = defs.expandedFieldMapForResource(m, aliases, aliasesByModule);
+            for (const issue of collectReferenceOutputIssues(
+              m,
+              expandedFieldMap,
+              allManifests,
+              defs,
+              aliases,
+              { aliasesByModule, rootModules }
+            )) {
+              diagnostics.push({
+                severity: DiagnosticSeverity2.Error,
+                code: "REFERENCE_OUTPUT_MISMATCH",
+                source: SOURCE35,
+                message: `${m.kind}/${stepName}: at '${issue.path}', ${issue.message}`,
+                data: {
+                  resource: { kind: m.kind, name: stepName ?? "" },
+                  filePath: stepFile,
+                  path: issue.path
+                }
+              });
+            }
             const inputIssues = [
               ...collectRefInputIssues(
                 m,
-                defs.expandedFieldMapForResource(m, aliases, aliasesByModule),
+                expandedFieldMap,
                 allManifests,
                 defs,
                 aliases,
@@ -67160,9 +67308,11 @@ function unionLeaves(parent, leaves) {
   return out;
 }
 function lookupRefConstraints(definitionSchema, yamlPath, schemaFrom) {
+  return lookupRefSlot(definitionSchema, yamlPath, schemaFrom)?.kinds ?? [];
+}
+function lookupRefSlot(definitionSchema, yamlPath, schemaFrom) {
   const node = navigateSchema2(definitionSchema, yamlPath, schemaFrom);
-  if (!node) return [];
-  return readRefSlot(node)?.kinds ?? [];
+  return node ? readRefSlot(node) : void 0;
 }
 function detectContext(text, line, character, docs) {
   const resolved = resolveNodeAtPosition(text, docs ?? parseToAst(text), line, character);
@@ -67905,8 +68055,9 @@ function extractInFileResources(docs) {
   }
   return out;
 }
-function refNameCompletions(docs, refKind, refConstraints, registry, replaceRange) {
+function refNameCompletions(docs, refKind, slot, registry, analysis, replaceRange) {
   const resources = extractInFileResources(docs);
+  const refConstraints = slot?.kinds ?? [];
   let acceptable;
   if (refKind) {
     acceptable = /* @__PURE__ */ new Set([refKind]);
@@ -67920,6 +68071,7 @@ function refNameCompletions(docs, refKind, refConstraints, registry, replaceRang
   const out = [];
   for (const r of resources) {
     if (acceptable && !acceptable.has(r.kind)) continue;
+    if (slot && outputRefused(slot, r, registry, analysis)) continue;
     if (seen.has(r.name)) continue;
     seen.add(r.name);
     out.push({
@@ -67933,18 +68085,25 @@ function refNameCompletions(docs, refKind, refConstraints, registry, replaceRang
   }
   return out;
 }
+function outputRefused(slot, candidate, registry, analysis) {
+  if (!slot.outputType) return false;
+  const refusal = analysis ? analysis.outputRefusal(slot, { kind: candidate.kind, name: candidate.name }) : registry?.outputRefusal(slot, { kind: candidate.kind }) ?? [];
+  return refusal.length > 0;
+}
 function refConstrainedKinds(registry, parentDocKind, parentYamlPath) {
   const definition = registry.resolveDefinition(parentDocKind);
   if (!definition?.schema) return void 0;
-  const constraints = lookupRefConstraints(
+  const slot = lookupRefSlot(
     definition.schema,
     parentYamlPath,
     (from) => registry.resolveSchemaFrom(from, parentDocKind)
   );
-  if (constraints.length === 0) return void 0;
-  const resolved = constraints.map((c) => registry.userFacingKindsForRef(c));
+  if (!slot || slot.kinds.length === 0) return void 0;
+  const resolved = slot.kinds.map((c) => registry.userFacingKindsForRef(c));
   if (!resolved.some(Boolean)) return void 0;
-  return [...new Set(resolved.flatMap((kinds) => kinds ?? []))];
+  return [...new Set(resolved.flatMap((kinds) => kinds ?? []))].filter(
+    (kind) => !outputRefused(slot, { kind }, registry, void 0)
+  );
 }
 function kindCompletions(registry, docKind, yamlPath, replaceRange) {
   let kinds;
@@ -68019,12 +68178,12 @@ async function buildCompletions(text, line, character, registry, adapter, docs,
   }
   if (ctx.type === "ref-name") {
     const definition = registry?.resolveDefinition(ctx.docKind);
-    const refConstraints = registry && definition?.schema ? lookupRefConstraints(
+    const slot = registry && definition?.schema ? lookupRefSlot(
       definition.schema,
       ctx.yamlPath,
       (from) => registry.resolveSchemaFrom(from, ctx.docKind)
-    ) : [];
-    return refNameCompletions(astDocs, ctx.refKind, refConstraints, registry, ctx.replaceRange);
+    ) : void 0;
+    return refNameCompletions(astDocs, ctx.refKind, slot, registry, analysis, ctx.replaceRange);
   }
   if (ctx.type === "field-value") {
     if (ctx.field === "import-source") {