@telorun/analyzer 0.1.1

package/LICENSE

@@ -0,0 +1,17 @@
+# SUSTAINABLE USE LICENSE (Fair-code)
+
+Copyright (c) 2026 DiglyAI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to use, copy, modify, and distribute the Software for any purpose—including commercial purposes—subject to the following conditions:
+
+1. ANTI-COMPETITION RESTRICTION: The Software may not be provided to third parties as a managed service, commercial SaaS (Software-as-a-Service), PaaS (Platform-as-a-Service), BaaS (Backend-as-a-Service), or similar offering where the primary value provided to the user is the functionality of the Software itself, without a separate commercial license from the copyright holder.
+
+2. PERMITTED COMMERCIAL USE: You are free to use the Software to build, host, and monetize your own commercial applications, products, and services, provided such use does not violate Clause 1.
+
+3. ATTRIBUTION: This copyright notice and license must be included in all copies or substantial portions of the Software.
+
+4. CONTRIBUTIONS: Contributions to the Software are welcome and encouraged. By contributing, you agree that your contributions may be incorporated into the Software and distributed under this license.
+
+5. DISCLAIMER: The Software is provided "as is", without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose and noninfringement. In no event shall the authors or copyright holders be liable for any claim, damages or other liability, whether in an action of contract, tort or otherwise, arising from, out of or in connection with the Software or the use or other dealings in the Software.
+
+For commercial licensing, managed hosting exemptions, or enterprise inquiries, please contact DiglyAI.

package/dist/adapters/http-adapter.d.ts

@@ -0,0 +1,10 @@
+import type { ManifestAdapter } from "../types.js";
+export declare class HttpAdapter implements ManifestAdapter {
+    supports(url: string): boolean;
+    read(url: string): Promise<{
+        text: string;
+        source: string;
+    }>;
+    resolveRelative(base: string, relative: string): string;
+}
+//# sourceMappingURL=http-adapter.d.ts.map

package/dist/adapters/http-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/http-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,qBAAa,WAAY,YAAW,eAAe;IACjD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAIxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAWlE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;CAIxD"}

package/dist/adapters/http-adapter.js

@@ -0,0 +1,17 @@
+export class HttpAdapter {
+    supports(url) {
+        return url.startsWith("http://") || url.startsWith("https://");
+    }
+    async read(url) {
+        const fetchUrl = url.includes(".yaml") ? url : `${url}/module.yaml`;
+        const response = await fetch(fetchUrl);
+        if (!response.ok) {
+            throw new Error(`Failed to fetch manifest from ${fetchUrl}: ${response.status} ${response.statusText}`);
+        }
+        return { text: await response.text(), source: fetchUrl };
+    }
+    resolveRelative(base, relative) {
+        const baseWithSlash = base.endsWith("/") ? base : `${base}/`;
+        return new URL(relative, baseWithSlash).href;
+    }
+}

package/dist/adapters/node-adapter.d.ts

@@ -0,0 +1,15 @@
+import type { ManifestAdapter } from "../types.js";
+/** Node.js fs-based ManifestAdapter for local files. Not browser-compatible. */
+export declare class NodeAdapter implements ManifestAdapter {
+    private readonly cwd;
+    constructor(cwd?: string);
+    supports(url: string): boolean;
+    read(url: string): Promise<{
+        text: string;
+        source: string;
+    }>;
+    resolveRelative(base: string, relative: string): string;
+}
+/** @deprecated Use `new NodeAdapter(cwd)` instead */
+export declare function createNodeAdapter(cwd?: string): ManifestAdapter;
+//# sourceMappingURL=node-adapter.d.ts.map

package/dist/adapters/node-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/node-adapter.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,gFAAgF;AAChF,qBAAa,WAAY,YAAW,eAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,GAAE,MAAsB;IAExD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAUxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IASlE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;CAKxD;AAED,qDAAqD;AACrD,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAsB,GAAG,eAAe,CAE9E"}

package/dist/adapters/node-adapter.js

@@ -0,0 +1,32 @@
+import * as fs from "fs/promises";
+import * as path from "path";
+/** Node.js fs-based ManifestAdapter for local files. Not browser-compatible. */
+export class NodeAdapter {
+    cwd;
+    constructor(cwd = process.cwd()) {
+        this.cwd = cwd;
+    }
+    supports(url) {
+        return (url.startsWith("file://") ||
+            url.startsWith("/") ||
+            url.startsWith("./") ||
+            url.startsWith("../") ||
+            (!url.includes("://") && !url.includes("@")));
+    }
+    async read(url) {
+        const filePath = url.startsWith("file://") ? new URL(url).pathname : url;
+        const stat = await fs.stat(filePath).catch(() => null);
+        const resolvedPath = stat?.isDirectory() ? path.join(filePath, "module.yaml") : filePath;
+        const text = await fs.readFile(resolvedPath, "utf8");
+        return { text, source: resolvedPath };
+    }
+    resolveRelative(base, relative) {
+        const basePath = base.startsWith("file://") ? new URL(base).pathname : base;
+        const baseDir = path.dirname(path.resolve(this.cwd, basePath));
+        return path.resolve(baseDir, relative);
+    }
+}
+/** @deprecated Use `new NodeAdapter(cwd)` instead */
+export function createNodeAdapter(cwd = process.cwd()) {
+    return new NodeAdapter(cwd);
+}

package/dist/adapters/registry-adapter.d.ts

@@ -0,0 +1,11 @@
+import type { ManifestAdapter } from "../types.js";
+export declare class RegistryAdapter implements ManifestAdapter {
+    supports(url: string): boolean;
+    read(moduleRef: string): Promise<{
+        text: string;
+        source: string;
+    }>;
+    resolveRelative(base: string, relative: string): string;
+    private toRegistryUrl;
+}
+//# sourceMappingURL=registry-adapter.d.ts.map

package/dist/adapters/registry-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/registry-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAInD,qBAAa,eAAgB,YAAW,eAAe;IACrD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAWxB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAWxE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAQvD,OAAO,CAAC,aAAa;CAOtB"}

package/dist/adapters/registry-adapter.js

@@ -0,0 +1,33 @@
+const REGISTRY_BASE = "https://registry.telo.run";
+export class RegistryAdapter {
+    supports(url) {
+        return (!url.startsWith("http://") &&
+            !url.startsWith("https://") &&
+            !url.startsWith("/") &&
+            !url.startsWith(".") &&
+            url.includes("@") &&
+            url.includes("/"));
+    }
+    async read(moduleRef) {
+        const fetchUrl = this.toRegistryUrl(moduleRef);
+        const response = await fetch(fetchUrl);
+        if (!response.ok) {
+            throw new Error(`Failed to fetch manifest ${moduleRef}: ${response.status} ${response.statusText}`);
+        }
+        return { text: await response.text(), source: fetchUrl };
+    }
+    resolveRelative(base, relative) {
+        const baseUrl = this.supports(base)
+            ? this.toRegistryUrl(base).replace("/module.yaml", "")
+            : base;
+        const baseWithSlash = baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`;
+        return new URL(relative, baseWithSlash).href;
+    }
+    toRegistryUrl(moduleRef) {
+        const atIdx = moduleRef.lastIndexOf("@");
+        const modulePath = moduleRef.slice(0, atIdx);
+        const version = moduleRef.slice(atIdx + 1);
+        const versionSegment = version.startsWith("v") ? version.substring(1) : version;
+        return `${REGISTRY_BASE}/${modulePath}/${versionSegment}/module.yaml`;
+    }
+}

package/dist/alias-resolver.d.ts

@@ -0,0 +1,12 @@
+/** Pure alias → real module name resolver.
+ *  Ported from ModuleContext.resolveKind() without any lifecycle dependency. */
+export declare class AliasResolver {
+    private readonly importAliases;
+    private readonly importedKinds;
+    registerImport(alias: string, targetModule: string, exportedKinds: string[]): void;
+    /** Resolves "Http.Api" → "http-server.Api". Returns undefined if alias is unknown. */
+    resolveKind(kind: string): string | undefined;
+    hasAlias(alias: string): boolean;
+    knownAliases(): string[];
+}
+//# sourceMappingURL=alias-resolver.d.ts.map

package/dist/alias-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"alias-resolver.d.ts","sourceRoot":"","sources":["../src/alias-resolver.ts"],"names":[],"mappings":"AAAA;gFACgF;AAChF,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6B;IAC3D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAkC;IAEhE,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI;IAOlF,sFAAsF;IACtF,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAe7C,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIhC,YAAY,IAAI,MAAM,EAAE;CAGzB"}

package/dist/alias-resolver.js

@@ -0,0 +1,36 @@
+/** Pure alias → real module name resolver.
+ *  Ported from ModuleContext.resolveKind() without any lifecycle dependency. */
+export class AliasResolver {
+    importAliases = new Map();
+    importedKinds = new Map();
+    registerImport(alias, targetModule, exportedKinds) {
+        this.importAliases.set(alias, targetModule);
+        if (exportedKinds.length > 0) {
+            this.importedKinds.set(alias, new Set(exportedKinds));
+        }
+    }
+    /** Resolves "Http.Api" → "http-server.Api". Returns undefined if alias is unknown. */
+    resolveKind(kind) {
+        if (!kind) {
+            return undefined;
+        }
+        const dot = kind.indexOf(".");
+        if (dot === -1)
+            return undefined;
+        const prefix = kind.slice(0, dot);
+        const suffix = kind.slice(dot + 1);
+        const realModule = this.importAliases.get(prefix);
+        if (!realModule)
+            return undefined;
+        const allowed = this.importedKinds.get(prefix);
+        if (allowed !== undefined && !allowed.has(suffix))
+            return undefined;
+        return `${realModule}.${suffix}`;
+    }
+    hasAlias(alias) {
+        return this.importAliases.has(alias);
+    }
+    knownAliases() {
+        return Array.from(this.importAliases.keys());
+    }
+}

package/dist/analysis-registry.d.ts

@@ -0,0 +1,29 @@
+import type { ResourceDefinition, ResourceManifest } from "@telorun/sdk";
+import type { AnalysisContext } from "./types.js";
+/**
+ * Accumulates type and alias knowledge for a running kernel or analysis session.
+ * Wraps AliasResolver and DefinitionRegistry into a single domain-level interface
+ * so callers never touch the raw registries directly.
+ */
+export declare class AnalysisRegistry {
+    private readonly defs;
+    private readonly aliases;
+    registerDefinition(def: ResourceDefinition): void;
+    registerModuleIdentity(namespace: string | null, name: string): void;
+    registerImport(alias: string, target: string, kinds: string[]): void;
+    resolveKind(kind: string): string | undefined;
+    /**
+     * Iterates a resource's reference and scope fields as declared by its definition.
+     * Calls onRef for each plain reference field and onScope for each scope field.
+     */
+    iterateFieldEntries(resource: ResourceManifest, onRef: (fieldPath: string) => void, onScope: (fieldPath: string) => void): void;
+    /**
+     * Returns the built-in kernel definitions. The underlying DefinitionRegistry already
+     * seeds these on construction; this method exposes them so callers (e.g. the kernel's
+     * controller registry) can iterate them without importing KERNEL_BUILTINS directly.
+     */
+    builtinDefinitions(): ResourceDefinition[];
+    /** @internal Bridge for StaticAnalyzer — do not use outside the analyzer package. */
+    _context(): AnalysisContext;
+}
+//# sourceMappingURL=analysis-registry.d.ts.map

package/dist/analysis-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analysis-registry.d.ts","sourceRoot":"","sources":["../src/analysis-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;;;GAIG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAE/C,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI;IAIjD,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAIpE,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAIpE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI7C;;;OAGG;IACH,mBAAmB,CACjB,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,EAClC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GACnC,IAAI;IAcP;;;;OAIG;IACH,kBAAkB,IAAI,kBAAkB,EAAE;IAI1C,qFAAqF;IACrF,QAAQ,IAAI,eAAe;CAG5B"}

package/dist/analysis-registry.js

@@ -0,0 +1,55 @@
+import { AliasResolver } from "./alias-resolver.js";
+import { KERNEL_BUILTINS } from "./builtins.js";
+import { DefinitionRegistry } from "./definition-registry.js";
+import { isRefEntry, isScopeEntry } from "./reference-field-map.js";
+/**
+ * Accumulates type and alias knowledge for a running kernel or analysis session.
+ * Wraps AliasResolver and DefinitionRegistry into a single domain-level interface
+ * so callers never touch the raw registries directly.
+ */
+export class AnalysisRegistry {
+    defs = new DefinitionRegistry();
+    aliases = new AliasResolver();
+    registerDefinition(def) {
+        this.defs.register(def);
+    }
+    registerModuleIdentity(namespace, name) {
+        this.defs.registerModuleIdentity(namespace, name);
+    }
+    registerImport(alias, target, kinds) {
+        this.aliases.registerImport(alias, target, kinds);
+    }
+    resolveKind(kind) {
+        return this.aliases.resolveKind(kind);
+    }
+    /**
+     * Iterates a resource's reference and scope fields as declared by its definition.
+     * Calls onRef for each plain reference field and onScope for each scope field.
+     */
+    iterateFieldEntries(resource, onRef, onScope) {
+        const fieldMap = this.defs.getFieldMapForKind(resource.kind, this.aliases);
+        if (!fieldMap)
+            return;
+        for (const [fieldPath, entry] of fieldMap) {
+            if (isScopeEntry(entry)) {
+                onScope(fieldPath);
+                continue;
+            }
+            if (isRefEntry(entry)) {
+                onRef(fieldPath);
+            }
+        }
+    }
+    /**
+     * Returns the built-in kernel definitions. The underlying DefinitionRegistry already
+     * seeds these on construction; this method exposes them so callers (e.g. the kernel's
+     * controller registry) can iterate them without importing KERNEL_BUILTINS directly.
+     */
+    builtinDefinitions() {
+        return KERNEL_BUILTINS;
+    }
+    /** @internal Bridge for StaticAnalyzer — do not use outside the analyzer package. */
+    _context() {
+        return { aliases: this.aliases, definitions: this.defs };
+    }
+}

package/dist/analyzer.d.ts

@@ -0,0 +1,14 @@
+import type { ResourceManifest } from "@telorun/sdk";
+import { AnalysisRegistry } from "./analysis-registry.js";
+import { type AnalysisDiagnostic, type AnalysisOptions } from "./types.js";
+export declare class StaticAnalyzer {
+    analyze(manifests: ResourceManifest[], options?: AnalysisOptions, registry?: AnalysisRegistry): AnalysisDiagnostic[];
+    analyzeErrors(manifests: ResourceManifest[], options?: AnalysisOptions, registry?: AnalysisRegistry): AnalysisDiagnostic[];
+    normalize(manifests: ResourceManifest[], registry: AnalysisRegistry): ResourceManifest[];
+    prepare(manifests: ResourceManifest[], registry: AnalysisRegistry): {
+        diagnostics: AnalysisDiagnostic[];
+        order: string[] | null;
+        cycleError: string | null;
+    };
+}
+//# sourceMappingURL=analyzer.d.ts.map

package/dist/analyzer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAW1D,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA+I/F,qBAAa,cAAc;IACzB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IA0MvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,GAAG,gBAAgB,EAAE;IAKxF,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAiB5F"}

package/dist/analyzer.js

@@ -0,0 +1,314 @@
+import { AliasResolver } from "./alias-resolver.js";
+import { buildTypedCelEnvironment, celEnvironment } from "./cel-environment.js";
+import { DefinitionRegistry } from "./definition-registry.js";
+import { buildDependencyGraph, formatCycle } from "./dependency-graph.js";
+import { normalizeInlineResources } from "./normalize-inline-resources.js";
+import { celTypeSatisfiesJsonSchema, substituteCelFields, validateAgainstSchema, } from "./schema-compat.js";
+import { DiagnosticSeverity } from "./types.js";
+import { extractAccessChains, pathMatchesScope, validateChainAgainstSchema, } from "./validate-cel-context.js";
+import { validateReferences } from "./validate-references.js";
+const TEMPLATE_REGEX = /\$\{\{\s*([^}]+?)\s*\}\}/g;
+function walkCelExpressions(value, path, cb) {
+    if (typeof value === "string") {
+        for (const m of value.matchAll(TEMPLATE_REGEX)) {
+            cb(m[1].trim(), path);
+        }
+    }
+    else if (Array.isArray(value)) {
+        value.forEach((v, i) => walkCelExpressions(v, `${path}[${i}]`, cb));
+    }
+    else if (value !== null && typeof value === "object") {
+        for (const [k, v] of Object.entries(value)) {
+            walkCelExpressions(v, path ? `${path}.${k}` : k, cb);
+        }
+    }
+}
+const SOURCE = "telo-analyzer";
+/**
+ * Walk a JSON Schema tree and collect all `x-telo-context` annotations,
+ * returning them as `{ scope, schema }` pairs using JSONPath-style scopes —
+ * the same format the analyzer uses for CEL context validation.
+ */
+function extractContextsFromSchema(schema, path = "$") {
+    if (!schema || typeof schema !== "object")
+        return [];
+    const results = [];
+    if (schema["x-telo-context"]) {
+        results.push({ scope: path, schema: schema["x-telo-context"] });
+    }
+    if (schema.properties) {
+        for (const [key, value] of Object.entries(schema.properties)) {
+            results.push(...extractContextsFromSchema(value, `${path}.${key}`));
+        }
+    }
+    if (schema.items && typeof schema.items === "object") {
+        results.push(...extractContextsFromSchema(schema.items, `${path}[*]`));
+    }
+    for (const key of ["oneOf", "anyOf", "allOf"]) {
+        if (Array.isArray(schema[key])) {
+            for (const subschema of schema[key]) {
+                results.push(...extractContextsFromSchema(subschema, path));
+            }
+        }
+    }
+    return results;
+}
+const CEL_PURE_RE = /^\s*\$\{\{[^}]*\}\}\s*$/;
+const CEL_EXPR_RE = /\$\{\{\s*([^}]+?)\s*\}\}/;
+/** Recursively walk `data`+`schema` together, type-checking every pure CEL template
+ *  string via `env.check()`. Returns `SchemaIssue[]` for any type mismatches found. */
+function collectCelTypeIssues(data, schema, path, definition, manifest, baseEnv) {
+    const issues = [];
+    if (typeof data === "string" && CEL_PURE_RE.test(data)) {
+        const exprMatch = data.match(CEL_EXPR_RE);
+        if (exprMatch) {
+            const expr = exprMatch[1].trim();
+            // Merge x-telo-context variables for this path if applicable
+            let typedEnv = baseEnv;
+            if (definition.schema) {
+                for (const ctx of extractContextsFromSchema(definition.schema)) {
+                    if (!pathMatchesScope(path, ctx.scope))
+                        continue;
+                    typedEnv = buildTypedCelEnvironment(manifest, ctx.schema);
+                    break;
+                }
+            }
+            let checkResult;
+            try {
+                checkResult = typedEnv.check(expr);
+            }
+            catch {
+                /* degrade gracefully */
+            }
+            if (checkResult?.valid && checkResult.type && schema) {
+                const celType = checkResult.type.split("<")[0];
+                if (!celTypeSatisfiesJsonSchema(celType, schema)) {
+                    issues.push({
+                        message: `CEL returns '${checkResult.type}' but field expects '${schema.type ?? "unknown"}'`,
+                        path,
+                    });
+                }
+            }
+        }
+        return issues;
+    }
+    if (Array.isArray(data)) {
+        const itemSchema = (schema.items ?? {});
+        for (let i = 0; i < data.length; i++) {
+            issues.push(...collectCelTypeIssues(data[i], itemSchema, `${path}[${i}]`, definition, manifest, baseEnv));
+        }
+    }
+    else if (data !== null && typeof data === "object") {
+        const props = (schema.properties ?? {});
+        for (const [k, v] of Object.entries(data)) {
+            issues.push(...collectCelTypeIssues(v, (props[k] ?? {}), path ? `${path}.${k}` : k, definition, manifest, baseEnv));
+        }
+    }
+    return issues;
+}
+export class StaticAnalyzer {
+    analyze(manifests, options, registry) {
+        const diagnostics = [];
+        // Use pre-seeded registries from the provided AnalysisRegistry, or create fresh ones.
+        // New aliases/definitions found in the manifests are accumulated into the provided instance
+        // so state builds up across successive calls (e.g. incremental editor validation).
+        const ctx = registry?._context();
+        const aliases = ctx?.aliases ?? new AliasResolver();
+        const defs = ctx?.definitions ?? new DefinitionRegistry();
+        // Register module identities and aliases.
+        // The root Kernel.Module provides its own identity; imported modules surface their
+        // identity via resolvedModuleName/resolvedNamespace stamped onto the Kernel.Import
+        // by the loader (so we don't need to include imported Kernel.Module manifests in
+        // the analysis set, avoiding false reference errors in the parent context).
+        for (const m of manifests) {
+            if (m.kind === "Kernel.Module") {
+                const namespace = m.metadata.namespace ?? null;
+                const moduleName = m.metadata.name;
+                if (moduleName)
+                    defs.registerModuleIdentity(namespace, moduleName);
+            }
+            if (m.kind === "Kernel.Import") {
+                const alias = m.metadata.name;
+                const source = m.source;
+                const exportedKinds = m.exports?.kinds ?? [];
+                const resolvedModuleName = m.metadata.resolvedModuleName;
+                const resolvedNamespace = m.metadata.resolvedNamespace;
+                if (alias && source) {
+                    const targetModule = resolvedModuleName ?? source.split("/").filter(Boolean).pop() ?? source;
+                    aliases.registerImport(alias, targetModule, exportedKinds);
+                    if (resolvedModuleName) {
+                        defs.registerModuleIdentity(resolvedNamespace ?? null, resolvedModuleName);
+                    }
+                }
+            }
+        }
+        // Register definitions from Kernel.Definition resources.
+        // Normalize alias-prefixed `capability` to canonical form so extendedBy lookup works
+        // (e.g. "Workflow.Backend" → "workflow.Backend" when "Workflow" is a known alias).
+        for (const m of manifests) {
+            if (m.kind === "Kernel.Definition") {
+                const def = m;
+                const resolvedCapability = def.capability
+                    ? (aliases.resolveKind(def.capability) ?? def.capability)
+                    : def.capability;
+                defs.register(resolvedCapability !== def.capability ? { ...def, capability: resolvedCapability } : def);
+            }
+        }
+        // Phase 2: extract inline resources from x-telo-ref slots into first-class manifests
+        const allManifests = normalizeInlineResources(manifests, defs, aliases);
+        // Build a name→manifest map for looking up referenced resources
+        const byName = new Map();
+        for (const m of allManifests) {
+            if (m.metadata?.name) {
+                byName.set(m.metadata.name, m);
+            }
+        }
+        // Validate each non-definition, non-system resource
+        for (const m of allManifests) {
+            if (!m.kind || !m.metadata?.name) {
+                diagnostics.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: "MISSING_KIND_OR_NAME",
+                    source: SOURCE,
+                    message: "Resource is missing required 'kind' or 'metadata.name' field.",
+                    data: { path: !m.kind ? "kind" : "metadata.name" },
+                });
+                continue;
+            }
+            if (m.kind === "Kernel.Definition" || m.kind === "Kernel.Abstract") {
+                continue;
+            }
+            const resource = { kind: m.kind, name: m.metadata?.name };
+            // Resolve kind through alias if needed; direct lookup takes priority so that
+            // aliases whose name matches the module name (the common case) work without
+            // path-derived name mangling.
+            const resolvedKind = aliases.resolveKind(m.kind);
+            const definition = defs.resolve(m.kind) ?? (resolvedKind ? defs.resolve(resolvedKind) : undefined);
+            if (!definition) {
+                const knownAliases = aliases.knownAliases();
+                const knownKinds = defs.kinds();
+                const parts = [];
+                if (knownAliases.length > 0)
+                    parts.push(`imports: ${knownAliases.join(", ")}`);
+                if (knownKinds.length > 0)
+                    parts.push(`kinds: ${knownKinds.join(", ")}`);
+                const hint = parts.length > 0 ? ` Known ${parts.join(" | ")}` : "";
+                diagnostics.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: "UNDEFINED_KIND",
+                    source: SOURCE,
+                    message: `No Kernel.Definition found for kind '${m.kind}'.${hint}`,
+                    data: { resource, path: "kind" },
+                });
+                continue;
+            }
+            // Validate resource config against definition schema.
+            // `kind` and `metadata` are implicit on every resource — inject them so module
+            // authors don't have to repeat them when using additionalProperties: false.
+            if (definition.schema) {
+                const schema = definition.schema.additionalProperties === false
+                    ? {
+                        ...definition.schema,
+                        properties: {
+                            kind: { type: "string" },
+                            metadata: { type: "object" },
+                            ...definition.schema.properties,
+                        },
+                    }
+                    : definition.schema;
+                // Phase 1: CEL type checking — walk data+schema together, check env.check() return types
+                const baseEnv = buildTypedCelEnvironment(m);
+                const celIssues = collectCelTypeIssues(m, schema, "", definition, m, baseEnv);
+                // Phase 2+3: AJV on substituted data — CEL fields replaced with typed placeholders
+                const ajvIssues = validateAgainstSchema(substituteCelFields(m, schema), schema);
+                const issues = [...celIssues, ...ajvIssues];
+                for (const issue of issues) {
+                    diagnostics.push({
+                        severity: DiagnosticSeverity.Error,
+                        code: "SCHEMA_VIOLATION",
+                        source: SOURCE,
+                        message: `${m.kind}/${resource.name}: ${issue.message}`,
+                        data: { resource, path: issue.path },
+                    });
+                }
+            }
+            // (Invocation context compatibility check is handled via x-telo-context in the CEL pass below)
+        }
+        // Validate CEL syntax and context variable access in all manifests
+        for (const m of allManifests) {
+            const resource = { kind: m.kind, name: m.metadata?.name };
+            const resolvedKind = aliases.resolveKind(m.kind);
+            const mDefinition = defs.resolve(m.kind) ?? (resolvedKind ? defs.resolve(resolvedKind) : undefined);
+            walkCelExpressions(m, "", (expr, path) => {
+                let parsed;
+                try {
+                    parsed = celEnvironment.parse(expr);
+                }
+                catch (e) {
+                    diagnostics.push({
+                        severity: DiagnosticSeverity.Error,
+                        code: "CEL_SYNTAX_ERROR",
+                        source: SOURCE,
+                        message: `CEL syntax error at ${path}: ${e instanceof Error ? e.message : String(e)}`,
+                        data: { resource, path },
+                    });
+                    return;
+                }
+                const contexts = mDefinition?.schema ? extractContextsFromSchema(mDefinition.schema) : [];
+                const invocationContext = m.metadata?.xTeloInvocationContext;
+                if (contexts.length === 0 && !invocationContext)
+                    return;
+                let matchedContext;
+                for (const ctx of contexts) {
+                    if (pathMatchesScope(path, ctx.scope)) {
+                        matchedContext = ctx.schema;
+                        break;
+                    }
+                }
+                if (!matchedContext)
+                    matchedContext = invocationContext;
+                if (!matchedContext)
+                    return;
+                for (const chain of extractAccessChains(parsed.ast)) {
+                    const err = validateChainAgainstSchema(chain, matchedContext);
+                    if (!err)
+                        continue;
+                    diagnostics.push({
+                        severity: DiagnosticSeverity.Error,
+                        code: "CEL_UNKNOWN_FIELD",
+                        source: SOURCE,
+                        message: `${m.kind}/${resource.name}: CEL at '${path}': ${err}`,
+                        data: { resource, path },
+                    });
+                }
+            });
+        }
+        // Validate resource references (Phase 3)
+        diagnostics.push(...validateReferences(allManifests, { aliases, definitions: defs }));
+        return diagnostics;
+    }
+    analyzeErrors(manifests, options, registry) {
+        return this.analyze(manifests, options, registry).filter((d) => d.severity === DiagnosticSeverity.Error);
+    }
+    normalize(manifests, registry) {
+        const ctx = registry._context();
+        return normalizeInlineResources(manifests, ctx.definitions, ctx.aliases);
+    }
+    prepare(manifests, registry) {
+        const ctx = registry._context();
+        const diagnostics = validateReferences(manifests, ctx);
+        const errors = diagnostics.filter((d) => d.severity === DiagnosticSeverity.Error);
+        if (errors.length > 0) {
+            return { diagnostics: errors, order: null, cycleError: null };
+        }
+        const graph = buildDependencyGraph(manifests, ctx.definitions, ctx.aliases);
+        if (graph.cycle) {
+            return { diagnostics: [], order: null, cycleError: formatCycle(graph.cycle) };
+        }
+        return {
+            diagnostics: [],
+            order: graph.order ? graph.order.map((n) => n.name) : null,
+            cycleError: null,
+        };
+    }
+}

package/dist/builtins.d.ts

@@ -0,0 +1,3 @@
+import type { ResourceDefinition } from "@telorun/sdk";
+export declare const KERNEL_BUILTINS: ResourceDefinition[];
+//# sourceMappingURL=builtins.d.ts.map

package/dist/builtins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EA4G/C,CAAC"}