@telorun/analyzer 0.1.1 → 0.1.3

package/README.md

@@ -0,0 +1,233 @@
+# ⚡ Telo
+
+Runtime for declarative backends.
+
+Telo is an execution engine (Micro-Kernel) that runs logic defined entirely in YAML manifests. Instead of writing imperative backend code, you define your routes, databases, schemas, and AI workflows as atomic, interconnected YAML documents. Telo takes those manifests and runs them.
+
+Built to be language-agnostic and infinitely extensible.
+
+```bash
+# Reconcile your manifest into a running backend
+$ telo ./examples/hello-api.yaml
+
+{"level":30,"time":1771610393008,"pid":1310178,"hostname":"dev","msg":"Server listening at http://127.0.0.1:8844"}
+```
+
+## Why use Telo?
+
+- **Open Standards:** Built on YAML, JSON Schema, and CEL — no proprietary DSL.
+- **Static Analysis:** CEL type checking, reference validation, and IDE diagnostics catch errors before runtime.
+- **Micro-Kernel Architecture:** Telo itself knows nothing about HTTP or SQL. Everything is a module you import, scope, and compose with typed variable and secret contracts.
+- **Language Agnostic:** Available as a Node.js runtime today, with a shared YAML runtime contract that allows for future Rust or Go implementations without changing your manifests.
+
+## What It Does
+
+- **Loads** YAML resources and compiles CEL expressions (`${{ }}`) into an in-memory registry.
+- **Resolves** resource dependencies via a multi-pass init loop, handling ordering automatically.
+- **Indexes** resources by Kind and Name for constant-time lookup.
+- **Dispatches** execution to the controller that owns each Kind.
+
+Manifests also support directives for dynamic generation: `$let`, `$if`, `$for`, `$eval`, and `$include`. See [CEL-YAML Templating](./yaml-cel-templating/README.md) for documentation.
+
+## Example manifest
+
+Here is an example Telo application that defines a simple HTTP API:
+
+```yaml
+kind: Kernel.Module
+metadata:
+  name: feedback
+  version: 1.0.0
+  description: |
+    A complete feedback collection REST API — no code, pure YAML.
+    Persists entries to SQLite and serves them over HTTP.
+targets:
+  - Migrations
+  - Server
+---
+kind: Kernel.Import
+metadata:
+  name: Http
+source: ../modules/http-server
+---
+kind: Kernel.Import
+metadata:
+  name: Sql
+source: ../modules/sql
+---
+# SQLite database — swap driver/host/database for PostgreSQL with zero YAML changes
+kind: Sql.Connection
+metadata:
+  name: Db
+driver: sqlite
+file: ./tmp/feedback.db
+---
+# Migrations: applied automatically before the server starts
+kind: Sql.Migrations
+metadata:
+  name: Migrations
+connection:
+  kind: Sql.Connection
+  name: Db
+---
+kind: Sql.Migration
+metadata:
+  name: Migration_20260413_182154_CreateFeedback
+sql: |
+  CREATE TABLE IF NOT EXISTS feedback (
+    id        INTEGER PRIMARY KEY AUTOINCREMENT,
+    text      TEXT    NOT NULL,
+    source    TEXT,
+    score     INTEGER NOT NULL DEFAULT 0,
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+  )
+---
+kind: Http.Server
+metadata:
+  name: Server
+baseUrl: http://localhost:8844
+port: 8844
+logger: true
+openapi:
+  info:
+    title: Feedback API
+    version: 1.0.0
+mounts:
+  - path: /v1
+    type: Http.Api.FeedbackRoutes
+---
+kind: Http.Api
+metadata:
+  name: FeedbackRoutes
+routes:
+  # POST /v1/feedback — insert a new entry, score derived from body length heuristic
+  - request:
+      path: /feedback
+      method: POST
+      schema:
+        body:
+          type: object
+          properties:
+            text:
+              type: string
+              minLength: 1
+            source:
+              type: string
+          required: [text]
+    handler:
+      kind: Sql.Exec
+      connection:
+        kind: Sql.Connection
+        name: Db
+    inputs:
+      sql: "INSERT INTO feedback (text, source, score) VALUES (?, ?, ?)"
+      bindings:
+        - "${{ request.body.text }}"
+        - "${{ request.body.source }}"
+        - "${{ size(request.body.text) }}"
+    response:
+      - status: 201
+        headers:
+          Content-Type: application/json
+        body:
+          ok: true
+          message: Feedback received
+
+  # GET /v1/feedback — list all entries, newest first
+  - request:
+      path: /feedback
+      method: GET
+    handler:
+      kind: Sql.Select
+      connection:
+        kind: Sql.Connection
+        name: Db
+      from: feedback
+      columns: [id, text, source, score, created_at]
+      orderBy:
+        - { column: created_at, direction: desc }
+    response:
+      - status: 200
+        headers:
+          Content-Type: application/json
+        body: "${{ result.rows }}"
+
+  # GET /v1/feedback/{id} — fetch a single entry
+  - request:
+      path: /feedback/{id}
+      method: GET
+      schema:
+        params:
+          type: object
+          properties:
+            id:
+              type: integer
+          required: [id]
+    handler:
+      kind: Sql.Select
+      connection:
+        kind: Sql.Connection
+        name: Db
+      from: feedback
+      columns: [id, text, source, score, created_at]
+      where:
+        - { column: id, op: "=", value: "${{ request.params.id }}" }
+    response:
+      - status: 200
+        when: "size(result.rows) > 0"
+        headers:
+          Content-Type: application/json
+        body: "${{ result.rows[0] }}"
+      - status: 404
+        headers:
+          Content-Type: application/json
+        body:
+          ok: false
+          message: Not found
+```
+
+## Status
+
+Telo is under **active development**. The core runtime, module system, and standard library are functional, but the API surface — including YAML shapes — may change without notice. Not yet recommended for production use.
+
+## The Meaning of Telo
+
+The name Telo is derived from the Greek root Telos - meaning the "end goal", "purpose", or "final state". That is exactly the philosophy behind this runtime. In standard imperative programming, you have to write thousands of lines of code to tell a server exactly how to start. With Telo, you simply declare your desired final state.
+
+You define the end state. Telo makes it real.
+
+## Philosophy
+
+Modern platforms often spend disproportionate effort on technical mechanics-wiring frameworks, managing infrastructure, and negotiating toolchains-while the original business problem gets delayed or diluted. Telo pushes in the opposite direction: it treats kernel execution as a stable, predictable host so teams can concentrate on the **business logic and outcomes** instead of the plumbing.
+
+By separating "what the system should do" from "how it is hosted", the runtime reduces friction for domain‑level changes. Teams can move faster on product requirements, experiment more safely, and keep conversations centered on value delivered rather than implementation trivia.
+
+Telo also aims to **join forces across all programming language communities**, so the best ideas, patterns, and implementations can converge into a shared kernel truth without forcing everyone into a single stack.
+
+YAML also makes the system more **AI‑friendly** than traditional programming languages: it is explicit, structured, and easier for tools to generate, review, and transform without losing intent.
+
+## Modularity
+
+Telo is built around **modules** that own specific resource kinds. A module is loaded from a manifest, declares which kinds it implements, and then receives only the resources of those kinds. This keeps concerns isolated and lets teams compose systems from focused building blocks rather than monolithic services.
+
+At kernel execution time, execution is always routed by **Kind.Name**. The kernel resolves the Kind to its owning module and hands off execution. Modules can call back into the kernel to execute other resources, enabling composition without tight coupling.
+
+## Architecture
+
+The architecture is inspired by Kubernetes-style manifests: declarative resources, explicit kinds, and a control plane that routes work based on those definitions.
+Those manifests were taken to the next level by allowing them to run inside a standalone runtime host.
+
+## See more at
+
+- [Telo Kernel](./kernel/README.md)
+- [CEL-YAML Templating](./yaml-cel-templating/README.md)
+- [Telo SDK for module authors](sdk/README.md)
+- [Modules](modules/README.md)
+
+## License
+
+See [LICENSE](https://github.com/telorun/telo/blob/main/LICENSE).
+
+## Contribution Note
+
+By contributing, you agree that code and examples in this repository may be translated or re‑implemented in other programming languages (including by AI systems) to support the project’s polyglot goals.

package/dist/adapters/http-adapter.d.ts

@@ -1,4 +1,4 @@
-import type { ManifestAdapter } from "../types.js";
+import { type ManifestAdapter } from "../types.js";
 export declare class HttpAdapter implements ManifestAdapter {
     supports(url: string): boolean;
     read(url: string): Promise<{

package/dist/adapters/http-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/http-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,qBAAa,WAAY,YAAW,eAAe;IACjD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAIxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAWlE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;CAIxD"}
+{"version":3,"file":"http-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/http-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9E,qBAAa,WAAY,YAAW,eAAe;IACjD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAIxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAWlE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;CAIxD"}

package/dist/adapters/http-adapter.js

@@ -1,9 +1,10 @@
+import { DEFAULT_MANIFEST_FILENAME } from "../types.js";
 export class HttpAdapter {
     supports(url) {
         return url.startsWith("http://") || url.startsWith("https://");
     }
     async read(url) {
-        const fetchUrl = url.includes(".yaml") ? url : `${url}/module.yaml`;
+        const fetchUrl = url.includes(".yaml") ? url : `${url}/${DEFAULT_MANIFEST_FILENAME}`;
         const response = await fetch(fetchUrl);
         if (!response.ok) {
             throw new Error(`Failed to fetch manifest from ${fetchUrl}: ${response.status} ${response.statusText}`);
@@ -11,7 +12,7 @@ export class HttpAdapter {
         return { text: await response.text(), source: fetchUrl };
     }
     resolveRelative(base, relative) {
-        const baseWithSlash = base.endsWith("/") ? base : `${base}/`;
-        return new URL(relative, baseWithSlash).href;
+        const baseDir = base.endsWith("/") ? base : base.slice(0, base.lastIndexOf("/") + 1);
+        return new URL(relative, baseDir).href;
     }
 }

package/dist/adapters/node-adapter.d.ts

@@ -1,4 +1,4 @@
-import type { ManifestAdapter } from "../types.js";
+import { type ManifestAdapter } from "../types.js";
 /** Node.js fs-based ManifestAdapter for local files. Not browser-compatible. */
 export declare class NodeAdapter implements ManifestAdapter {
     private readonly cwd;

package/dist/adapters/node-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/node-adapter.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,gFAAgF;AAChF,qBAAa,WAAY,YAAW,eAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,GAAE,MAAsB;IAExD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAUxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IASlE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;CAKxD;AAED,qDAAqD;AACrD,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAsB,GAAG,eAAe,CAE9E"}
+{"version":3,"file":"node-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/node-adapter.ts"],"names":[],"mappings":"AAEA,OAAO,EAA6B,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9E,gFAAgF;AAChF,qBAAa,WAAY,YAAW,eAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,GAAE,MAAsB;IAExD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAUxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IASlE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;CAKxD;AAED,qDAAqD;AACrD,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAsB,GAAG,eAAe,CAE9E"}

package/dist/adapters/node-adapter.js

@@ -1,5 +1,6 @@
 import * as fs from "fs/promises";
 import * as path from "path";
+import { DEFAULT_MANIFEST_FILENAME } from "../types.js";
 /** Node.js fs-based ManifestAdapter for local files. Not browser-compatible. */
 export class NodeAdapter {
     cwd;
@@ -16,7 +17,7 @@ export class NodeAdapter {
     async read(url) {
         const filePath = url.startsWith("file://") ? new URL(url).pathname : url;
         const stat = await fs.stat(filePath).catch(() => null);
-        const resolvedPath = stat?.isDirectory() ? path.join(filePath, "module.yaml") : filePath;
+        const resolvedPath = stat?.isDirectory() ? path.join(filePath, DEFAULT_MANIFEST_FILENAME) : filePath;
         const text = await fs.readFile(resolvedPath, "utf8");
         return { text, source: resolvedPath };
     }

package/dist/adapters/registry-adapter.d.ts

@@ -1,11 +1,15 @@
-import type { ManifestAdapter } from "../types.js";
+import { type ManifestAdapter } from "../types.js";
 export declare class RegistryAdapter implements ManifestAdapter {
+    private registryUrl;
+    constructor(registryUrl?: string);
     supports(url: string): boolean;
     read(moduleRef: string): Promise<{
         text: string;
         source: string;
     }>;
     resolveRelative(base: string, relative: string): string;
+    private toRegistryModuleBase;
     private toRegistryUrl;
+    private parseModuleRef;
 }
 //# sourceMappingURL=registry-adapter.d.ts.map

package/dist/adapters/registry-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/registry-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAInD,qBAAa,eAAgB,YAAW,eAAe;IACrD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAWxB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAWxE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAQvD,OAAO,CAAC,aAAa;CAOtB"}
+{"version":3,"file":"registry-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/registry-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAI9E,qBAAa,eAAgB,YAAW,eAAe;IACzC,OAAO,CAAC,WAAW;gBAAX,WAAW,SAAuB;IAEtD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAWxB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAWxE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAMvD,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,cAAc;CAmBvB"}

package/dist/adapters/registry-adapter.js

@@ -1,5 +1,10 @@
-const REGISTRY_BASE = "https://registry.telo.run";
+import { DEFAULT_MANIFEST_FILENAME } from "../types.js";
+const DEFAULT_REGISTRY_URL = "https://registry.telo.run";
 export class RegistryAdapter {
+    registryUrl;
+    constructor(registryUrl = DEFAULT_REGISTRY_URL) {
+        this.registryUrl = registryUrl;
+    }
     supports(url) {
         return (!url.startsWith("http://") &&
             !url.startsWith("https://") &&
@@ -17,17 +22,32 @@ export class RegistryAdapter {
         return { text: await response.text(), source: fetchUrl };
     }
     resolveRelative(base, relative) {
-        const baseUrl = this.supports(base)
-            ? this.toRegistryUrl(base).replace("/module.yaml", "")
-            : base;
+        const baseUrl = this.supports(base) ? this.toRegistryModuleBase(base) : base;
         const baseWithSlash = baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`;
         return new URL(relative, baseWithSlash).href;
     }
+    toRegistryModuleBase(moduleRef) {
+        const parsed = this.parseModuleRef(moduleRef);
+        const normalizedBase = this.registryUrl.replace(/\/+$/, "");
+        return `${normalizedBase}/${parsed.modulePath}/${parsed.version}`;
+    }
     toRegistryUrl(moduleRef) {
+        return `${this.toRegistryModuleBase(moduleRef)}/${DEFAULT_MANIFEST_FILENAME}`;
+    }
+    parseModuleRef(moduleRef) {
         const atIdx = moduleRef.lastIndexOf("@");
+        if (atIdx <= 0 || atIdx === moduleRef.length - 1) {
+            throw new Error(`Invalid module reference '${moduleRef}', expected namespace/name@version`);
+        }
         const modulePath = moduleRef.slice(0, atIdx);
-        const version = moduleRef.slice(atIdx + 1);
-        const versionSegment = version.startsWith("v") ? version.substring(1) : version;
-        return `${REGISTRY_BASE}/${modulePath}/${versionSegment}/module.yaml`;
+        if (!modulePath.includes("/")) {
+            throw new Error(`Invalid module reference '${moduleRef}', expected namespace/name@version`);
+        }
+        const rawVersion = moduleRef.slice(atIdx + 1);
+        const version = rawVersion.startsWith("v") ? rawVersion.substring(1) : rawVersion;
+        if (!version) {
+            throw new Error(`Invalid module reference '${moduleRef}', expected namespace/name@version`);
+        }
+        return { modulePath, version };
     }
 }

package/dist/analysis-registry.d.ts

@@ -23,6 +23,8 @@ export declare class AnalysisRegistry {
      * controller registry) can iterate them without importing KERNEL_BUILTINS directly.
      */
     builtinDefinitions(): ResourceDefinition[];
+    resolveDefinition(kind: string): ResourceDefinition | undefined;
+    allKinds(): string[];
     /** @internal Bridge for StaticAnalyzer — do not use outside the analyzer package. */
     _context(): AnalysisContext;
 }

package/dist/analysis-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analysis-registry.d.ts","sourceRoot":"","sources":["../src/analysis-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;;;GAIG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAE/C,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI;IAIjD,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAIpE,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAIpE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI7C;;;OAGG;IACH,mBAAmB,CACjB,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,EAClC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GACnC,IAAI;IAcP;;;;OAIG;IACH,kBAAkB,IAAI,kBAAkB,EAAE;IAI1C,qFAAqF;IACrF,QAAQ,IAAI,eAAe;CAG5B"}
+{"version":3,"file":"analysis-registry.d.ts","sourceRoot":"","sources":["../src/analysis-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;;;GAIG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAE/C,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI;IAIjD,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAIpE,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAIpE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI7C;;;OAGG;IACH,mBAAmB,CACjB,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,EAClC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GACnC,IAAI;IAcP;;;;OAIG;IACH,kBAAkB,IAAI,kBAAkB,EAAE;IAI1C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAM/D,QAAQ,IAAI,MAAM,EAAE;IAIpB,qFAAqF;IACrF,QAAQ,IAAI,eAAe;CAG5B"}

package/dist/analysis-registry.js

@@ -48,6 +48,14 @@ export class AnalysisRegistry {
     builtinDefinitions() {
         return KERNEL_BUILTINS;
     }
+    resolveDefinition(kind) {
+        const ctx = this._context();
+        const resolved = ctx.aliases?.resolveKind(kind);
+        return ctx.definitions?.resolve(kind) ?? (resolved ? ctx.definitions?.resolve(resolved) : undefined);
+    }
+    allKinds() {
+        return this._context().definitions?.kinds() ?? [];
+    }
     /** @internal Bridge for StaticAnalyzer — do not use outside the analyzer package. */
     _context() {
         return { aliases: this.aliases, definitions: this.defs };

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAW1D,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA+I/F,qBAAa,cAAc;IACzB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IA0MvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,GAAG,gBAAgB,EAAE;IAKxF,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAiB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAY1D,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA0O/F,qBAAa,cAAc;IACzB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAoPvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,GAAG,gBAAgB,EAAE;IAKxF,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAiB5F"}

package/dist/analyzer.js

@@ -2,10 +2,11 @@ import { AliasResolver } from "./alias-resolver.js";
 import { buildTypedCelEnvironment, celEnvironment } from "./cel-environment.js";
 import { DefinitionRegistry } from "./definition-registry.js";
 import { buildDependencyGraph, formatCycle } from "./dependency-graph.js";
+import { buildKernelGlobalsSchema, mergeKernelGlobalsIntoContext } from "./kernel-globals.js";
 import { normalizeInlineResources } from "./normalize-inline-resources.js";
 import { celTypeSatisfiesJsonSchema, substituteCelFields, validateAgainstSchema, } from "./schema-compat.js";
 import { DiagnosticSeverity } from "./types.js";
-import { extractAccessChains, pathMatchesScope, validateChainAgainstSchema, } from "./validate-cel-context.js";
+import { extractAccessChains, getManifestItem, pathMatchesScope, resolveContextAnnotations, resolveTypeFieldToSchema, validateChainAgainstSchema, } from "./validate-cel-context.js";
 import { validateReferences } from "./validate-references.js";
 const TEMPLATE_REGEX = /\$\{\{\s*([^}]+?)\s*\}\}/g;
 function walkCelExpressions(value, path, cb) {
@@ -53,6 +54,81 @@ function extractContextsFromSchema(schema, path = "$") {
     }
     return results;
 }
+/**
+ * Build a `steps` context schema from `x-telo-step-context` annotation.
+ * Walks each step in the manifest array, resolves the invoked resource's outputType,
+ * and builds `steps.<name>.result` context entries.
+ */
+function buildStepContextSchema(manifest, defSchema, allManifests) {
+    const props = defSchema.properties;
+    if (!props)
+        return undefined;
+    for (const [fieldName, fieldSchema] of Object.entries(props)) {
+        const stepCtx = fieldSchema["x-telo-step-context"];
+        if (!stepCtx)
+            continue;
+        const invokeField = stepCtx.invoke;
+        const outputTypeField = stepCtx.outputType;
+        if (!invokeField || !outputTypeField)
+            continue;
+        const steps = manifest[fieldName];
+        if (!Array.isArray(steps))
+            continue;
+        const stepProperties = {};
+        const collectSteps = (items) => {
+            for (const step of items) {
+                if (!step || typeof step !== "object")
+                    continue;
+                const s = step;
+                const name = s.name;
+                if (typeof name === "string") {
+                    const invoke = s[invokeField];
+                    let outputSchema;
+                    if (invoke && typeof invoke === "object") {
+                        const invokedKind = invoke.kind;
+                        const invokedName = invoke.name;
+                        if (invokedName) {
+                            const invokedManifest = allManifests.find((m) => m.metadata?.name === invokedName &&
+                                (!invokedKind || m.kind === invokedKind));
+                            if (invokedManifest) {
+                                outputSchema = resolveTypeFieldToSchema(invokedManifest[outputTypeField], allManifests);
+                            }
+                        }
+                        else {
+                            outputSchema = resolveTypeFieldToSchema(invoke[outputTypeField], allManifests);
+                        }
+                    }
+                    stepProperties[name] = {
+                        type: "object",
+                        properties: {
+                            result: outputSchema ?? { type: "object", additionalProperties: true },
+                        },
+                    };
+                }
+                // Recurse into nested step arrays (then, else, do, catch, finally, try, default, cases)
+                for (const nested of ["then", "else", "do", "catch", "finally", "try", "default"]) {
+                    if (Array.isArray(s[nested]))
+                        collectSteps(s[nested]);
+                }
+                // cases is an object map of arrays
+                if (s.cases && typeof s.cases === "object") {
+                    for (const arr of Object.values(s.cases)) {
+                        if (Array.isArray(arr))
+                            collectSteps(arr);
+                    }
+                }
+            }
+        };
+        collectSteps(steps);
+        if (Object.keys(stepProperties).length > 0) {
+            return {
+                type: "object",
+                properties: stepProperties,
+            };
+        }
+    }
+    return undefined;
+}
 const CEL_PURE_RE = /^\s*\$\{\{[^}]*\}\}\s*$/;
 const CEL_EXPR_RE = /\$\{\{\s*([^}]+?)\s*\}\}/;
 /** Recursively walk `data`+`schema` together, type-checking every pure CEL template
@@ -163,6 +239,9 @@ export class StaticAnalyzer {
                 byName.set(m.metadata.name, m);
             }
         }
+        // Build typed kernel globals schema so x-telo-context chain validation
+        // recognises variables, secrets, resources, env automatically
+        const kernelGlobals = buildKernelGlobalsSchema(allManifests);
         // Validate each non-definition, non-system resource
         for (const m of allManifests) {
             if (!m.kind || !m.metadata?.name) {
@@ -239,6 +318,10 @@ export class StaticAnalyzer {
             const resource = { kind: m.kind, name: m.metadata?.name };
             const resolvedKind = aliases.resolveKind(m.kind);
             const mDefinition = defs.resolve(m.kind) ?? (resolvedKind ? defs.resolve(resolvedKind) : undefined);
+            // Pre-compute step context for manifests with x-telo-step-context
+            const stepContextSchema = mDefinition?.schema
+                ? buildStepContextSchema(m, mDefinition.schema, allManifests)
+                : undefined;
             walkCelExpressions(m, "", (expr, path) => {
                 let parsed;
                 try {
@@ -254,23 +337,43 @@ export class StaticAnalyzer {
                     });
                     return;
                 }
+                const accessChains = extractAccessChains(parsed.ast);
                 const contexts = mDefinition?.schema ? extractContextsFromSchema(mDefinition.schema) : [];
                 const invocationContext = m.metadata?.xTeloInvocationContext;
-                if (contexts.length === 0 && !invocationContext)
+                // If no static context but we have step context, inject it
+                if (contexts.length === 0 && !invocationContext && !stepContextSchema)
                     return;
                 let matchedContext;
+                let matchedScope;
                 for (const ctx of contexts) {
                     if (pathMatchesScope(path, ctx.scope)) {
                         matchedContext = ctx.schema;
+                        matchedScope = ctx.scope;
                         break;
                     }
                 }
                 if (!matchedContext)
                     matchedContext = invocationContext;
+                // Merge step context into the effective context
+                if (stepContextSchema) {
+                    const base = matchedContext ?? { type: "object", properties: {}, additionalProperties: true };
+                    matchedContext = {
+                        ...base,
+                        properties: {
+                            ...(base.properties ?? {}),
+                            steps: stepContextSchema,
+                        },
+                    };
+                }
                 if (!matchedContext)
                     return;
-                for (const chain of extractAccessChains(parsed.ast)) {
-                    const err = validateChainAgainstSchema(chain, matchedContext);
+                const manifestItem = matchedScope
+                    ? getManifestItem(path, matchedScope, m)
+                    : m;
+                const resolvedContext = resolveContextAnnotations(matchedContext, manifestItem, allManifests);
+                const effectiveContext = mergeKernelGlobalsIntoContext(resolvedContext, kernelGlobals);
+                for (const chain of accessChains) {
+                    const err = validateChainAgainstSchema(chain, effectiveContext);
                     if (!err)
                         continue;
                     diagnostics.push({

package/dist/cel-environment.d.ts

@@ -6,7 +6,10 @@ export declare const celEnvironment: Environment;
  *
  *  - `variables`: typed from the manifest's `variables` field if it is a schema map
  *    (only `Kernel.Module` resources carry this); otherwise registered as `map` (dyn).
- *  - `secrets`, `resources`, `imports`, `env`: always `map` (dyn — output schemas unknown).
- *  - `extraContextSchema`: additional variables from an `x-telo-context` annotation. */
+ *  - `secrets`, `resources`, `env`: always `map` (dyn — output schemas unknown).
+ *  - `extraContextSchema`: additional variables from an `x-telo-context` annotation.
+ *
+ *  NOTE: The set of kernel globals registered here must match `KERNEL_GLOBAL_NAMES`
+ *  in kernel-globals.ts, which is used for chain-access validation. */
 export declare function buildTypedCelEnvironment(manifest: ResourceManifest, extraContextSchema?: Record<string, any> | null): Environment;
 //# sourceMappingURL=cel-environment.d.ts.map

package/dist/cel-environment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cel-environment.d.ts","sourceRoot":"","sources":["../src/cel-environment.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAGnD,eAAO,MAAM,cAAc,aAWvB,CAAC;AAEL;;;;;;wFAMwF;AACxF,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,gBAAgB,EAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,GAC9C,WAAW,CA0Cb"}
+{"version":3,"file":"cel-environment.d.ts","sourceRoot":"","sources":["../src/cel-environment.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAGnD,eAAO,MAAM,cAAc,aAWvB,CAAC;AAEL;;;;;;;;;uEASuE;AACvE,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,gBAAgB,EAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,GAC9C,WAAW,CAyCb"}

package/dist/cel-environment.js

@@ -17,8 +17,11 @@ export const celEnvironment = new Environment({ unlistedVariablesAreDyn: true })
  *
  *  - `variables`: typed from the manifest's `variables` field if it is a schema map
  *    (only `Kernel.Module` resources carry this); otherwise registered as `map` (dyn).
- *  - `secrets`, `resources`, `imports`, `env`: always `map` (dyn — output schemas unknown).
- *  - `extraContextSchema`: additional variables from an `x-telo-context` annotation. */
+ *  - `secrets`, `resources`, `env`: always `map` (dyn — output schemas unknown).
+ *  - `extraContextSchema`: additional variables from an `x-telo-context` annotation.
+ *
+ *  NOTE: The set of kernel globals registered here must match `KERNEL_GLOBAL_NAMES`
+ *  in kernel-globals.ts, which is used for chain-access validation. */
 export function buildTypedCelEnvironment(manifest, extraContextSchema) {
     try {
         const env = celEnvironment.clone();
@@ -42,7 +45,6 @@ export function buildTypedCelEnvironment(manifest, extraContextSchema) {
         }
         env.registerVariable("secrets", "map");
         env.registerVariable("resources", "map");
-        env.registerVariable("imports", "map");
         env.registerVariable("env", "map");
         if (extraContextSchema?.properties) {
             for (const [name, propSchema] of Object.entries(extraContextSchema.properties)) {

package/dist/index.d.ts

@@ -4,6 +4,6 @@ export { RegistryAdapter } from "./adapters/registry-adapter.js";
 export { AnalysisRegistry } from "./analysis-registry.js";
 export { StaticAnalyzer } from "./analyzer.js";
 export { Loader } from "./manifest-loader.js";
-export { DiagnosticSeverity } from "./types.js";
-export type { AnalysisDiagnostic, AnalysisOptions, LoadOptions, ManifestAdapter, Position, PositionIndex, Range } from "./types.js";
+export { DEFAULT_MANIFEST_FILENAME, DiagnosticSeverity } from "./types.js";
+export type { AnalysisDiagnostic, AnalysisOptions, LoaderInitOptions, LoadOptions, ManifestAdapter, Position, PositionIndex, Range } from "./types.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,eAAe,EACf,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,eAAe,EAChE,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -4,4 +4,4 @@ export { RegistryAdapter } from "./adapters/registry-adapter.js";
 export { AnalysisRegistry } from "./analysis-registry.js";
 export { StaticAnalyzer } from "./analyzer.js";
 export { Loader } from "./manifest-loader.js";
-export { DiagnosticSeverity } from "./types.js";
+export { DEFAULT_MANIFEST_FILENAME, DiagnosticSeverity } from "./types.js";