@telorun/analyzer 0.1.2 → 0.1.4

package/README.md

@@ -0,0 +1,233 @@
+# ⚡ Telo
+
+Runtime for declarative backends.
+
+Telo is an execution engine (Micro-Kernel) that runs logic defined entirely in YAML manifests. Instead of writing imperative backend code, you define your routes, databases, schemas, and AI workflows as atomic, interconnected YAML documents. Telo takes those manifests and runs them.
+
+Built to be language-agnostic and infinitely extensible.
+
+```bash
+# Reconcile your manifest into a running backend
+$ telo ./examples/hello-api.yaml
+
+{"level":30,"time":1771610393008,"pid":1310178,"hostname":"dev","msg":"Server listening at http://127.0.0.1:8844"}
+```
+
+## Why use Telo?
+
+- **Open Standards:** Built on YAML, JSON Schema, and CEL — no proprietary DSL.
+- **Static Analysis:** CEL type checking, reference validation, and IDE diagnostics catch errors before runtime.
+- **Micro-Kernel Architecture:** Telo itself knows nothing about HTTP or SQL. Everything is a module you import, scope, and compose with typed variable and secret contracts.
+- **Language Agnostic:** Available as a Node.js runtime today, with a shared YAML runtime contract that allows for future Rust or Go implementations without changing your manifests.
+
+## What It Does
+
+- **Loads** YAML resources and compiles CEL expressions (`${{ }}`) into an in-memory registry.
+- **Resolves** resource dependencies via a multi-pass init loop, handling ordering automatically.
+- **Indexes** resources by Kind and Name for constant-time lookup.
+- **Dispatches** execution to the controller that owns each Kind.
+
+Manifests also support directives for dynamic generation: `$let`, `$if`, `$for`, `$eval`, and `$include`. See [CEL-YAML Templating](./yaml-cel-templating/README.md) for documentation.
+
+## Example manifest
+
+Here is an example Telo application that defines a simple HTTP API:
+
+```yaml
+kind: Kernel.Module
+metadata:
+  name: feedback
+  version: 1.0.0
+  description: |
+    A complete feedback collection REST API — no code, pure YAML.
+    Persists entries to SQLite and serves them over HTTP.
+targets:
+  - Migrations
+  - Server
+---
+kind: Kernel.Import
+metadata:
+  name: Http
+source: ../modules/http-server
+---
+kind: Kernel.Import
+metadata:
+  name: Sql
+source: ../modules/sql
+---
+# SQLite database — swap driver/host/database for PostgreSQL with zero YAML changes
+kind: Sql.Connection
+metadata:
+  name: Db
+driver: sqlite
+file: ./tmp/feedback.db
+---
+# Migrations: applied automatically before the server starts
+kind: Sql.Migrations
+metadata:
+  name: Migrations
+connection:
+  kind: Sql.Connection
+  name: Db
+---
+kind: Sql.Migration
+metadata:
+  name: Migration_20260413_182154_CreateFeedback
+sql: |
+  CREATE TABLE IF NOT EXISTS feedback (
+    id        INTEGER PRIMARY KEY AUTOINCREMENT,
+    text      TEXT    NOT NULL,
+    source    TEXT,
+    score     INTEGER NOT NULL DEFAULT 0,
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+  )
+---
+kind: Http.Server
+metadata:
+  name: Server
+baseUrl: http://localhost:8844
+port: 8844
+logger: true
+openapi:
+  info:
+    title: Feedback API
+    version: 1.0.0
+mounts:
+  - path: /v1
+    type: Http.Api.FeedbackRoutes
+---
+kind: Http.Api
+metadata:
+  name: FeedbackRoutes
+routes:
+  # POST /v1/feedback — insert a new entry, score derived from body length heuristic
+  - request:
+      path: /feedback
+      method: POST
+      schema:
+        body:
+          type: object
+          properties:
+            text:
+              type: string
+              minLength: 1
+            source:
+              type: string
+          required: [text]
+    handler:
+      kind: Sql.Exec
+      connection:
+        kind: Sql.Connection
+        name: Db
+    inputs:
+      sql: "INSERT INTO feedback (text, source, score) VALUES (?, ?, ?)"
+      bindings:
+        - "${{ request.body.text }}"
+        - "${{ request.body.source }}"
+        - "${{ size(request.body.text) }}"
+    response:
+      - status: 201
+        headers:
+          Content-Type: application/json
+        body:
+          ok: true
+          message: Feedback received
+
+  # GET /v1/feedback — list all entries, newest first
+  - request:
+      path: /feedback
+      method: GET
+    handler:
+      kind: Sql.Select
+      connection:
+        kind: Sql.Connection
+        name: Db
+      from: feedback
+      columns: [id, text, source, score, created_at]
+      orderBy:
+        - { column: created_at, direction: desc }
+    response:
+      - status: 200
+        headers:
+          Content-Type: application/json
+        body: "${{ result.rows }}"
+
+  # GET /v1/feedback/{id} — fetch a single entry
+  - request:
+      path: /feedback/{id}
+      method: GET
+      schema:
+        params:
+          type: object
+          properties:
+            id:
+              type: integer
+          required: [id]
+    handler:
+      kind: Sql.Select
+      connection:
+        kind: Sql.Connection
+        name: Db
+      from: feedback
+      columns: [id, text, source, score, created_at]
+      where:
+        - { column: id, op: "=", value: "${{ request.params.id }}" }
+    response:
+      - status: 200
+        when: "size(result.rows) > 0"
+        headers:
+          Content-Type: application/json
+        body: "${{ result.rows[0] }}"
+      - status: 404
+        headers:
+          Content-Type: application/json
+        body:
+          ok: false
+          message: Not found
+```
+
+## Status
+
+Telo is under **active development**. The core runtime, module system, and standard library are functional, but the API surface — including YAML shapes — may change without notice. Not yet recommended for production use.
+
+## The Meaning of Telo
+
+The name Telo is derived from the Greek root Telos - meaning the "end goal", "purpose", or "final state". That is exactly the philosophy behind this runtime. In standard imperative programming, you have to write thousands of lines of code to tell a server exactly how to start. With Telo, you simply declare your desired final state.
+
+You define the end state. Telo makes it real.
+
+## Philosophy
+
+Modern platforms often spend disproportionate effort on technical mechanics-wiring frameworks, managing infrastructure, and negotiating toolchains-while the original business problem gets delayed or diluted. Telo pushes in the opposite direction: it treats kernel execution as a stable, predictable host so teams can concentrate on the **business logic and outcomes** instead of the plumbing.
+
+By separating "what the system should do" from "how it is hosted", the runtime reduces friction for domain‑level changes. Teams can move faster on product requirements, experiment more safely, and keep conversations centered on value delivered rather than implementation trivia.
+
+Telo also aims to **join forces across all programming language communities**, so the best ideas, patterns, and implementations can converge into a shared kernel truth without forcing everyone into a single stack.
+
+YAML also makes the system more **AI‑friendly** than traditional programming languages: it is explicit, structured, and easier for tools to generate, review, and transform without losing intent.
+
+## Modularity
+
+Telo is built around **modules** that own specific resource kinds. A module is loaded from a manifest, declares which kinds it implements, and then receives only the resources of those kinds. This keeps concerns isolated and lets teams compose systems from focused building blocks rather than monolithic services.
+
+At kernel execution time, execution is always routed by **Kind.Name**. The kernel resolves the Kind to its owning module and hands off execution. Modules can call back into the kernel to execute other resources, enabling composition without tight coupling.
+
+## Architecture
+
+The architecture is inspired by Kubernetes-style manifests: declarative resources, explicit kinds, and a control plane that routes work based on those definitions.
+Those manifests were taken to the next level by allowing them to run inside a standalone runtime host.
+
+## See more at
+
+- [Telo Kernel](./kernel/README.md)
+- [CEL-YAML Templating](./yaml-cel-templating/README.md)
+- [Telo SDK for module authors](sdk/README.md)
+- [Modules](modules/README.md)
+
+## License
+
+See [LICENSE](https://github.com/telorun/telo/blob/main/LICENSE).
+
+## Contribution Note
+
+By contributing, you agree that code and examples in this repository may be translated or re‑implemented in other programming languages (including by AI systems) to support the project’s polyglot goals.

package/dist/adapters/http-adapter.d.ts

@@ -1,4 +1,4 @@
-import type { ManifestAdapter } from "../types.js";
+import { type ManifestAdapter } from "../types.js";
 export declare class HttpAdapter implements ManifestAdapter {
     supports(url: string): boolean;
     read(url: string): Promise<{

package/dist/adapters/http-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/http-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,qBAAa,WAAY,YAAW,eAAe;IACjD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAIxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAWlE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;CAIxD"}
+{"version":3,"file":"http-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/http-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9E,qBAAa,WAAY,YAAW,eAAe;IACjD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAIxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAWlE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;CAIxD"}

package/dist/adapters/http-adapter.js

@@ -1,9 +1,10 @@
+import { DEFAULT_MANIFEST_FILENAME } from "../types.js";
 export class HttpAdapter {
     supports(url) {
         return url.startsWith("http://") || url.startsWith("https://");
     }
     async read(url) {
-        const fetchUrl = url.includes(".yaml") ? url : `${url}/module.yaml`;
+        const fetchUrl = url.includes(".yaml") ? url : `${url}/${DEFAULT_MANIFEST_FILENAME}`;
         const response = await fetch(fetchUrl);
         if (!response.ok) {
             throw new Error(`Failed to fetch manifest from ${fetchUrl}: ${response.status} ${response.statusText}`);

package/dist/adapters/node-adapter.d.ts

@@ -1,4 +1,4 @@
-import type { ManifestAdapter } from "../types.js";
+import { type ManifestAdapter } from "../types.js";
 /** Node.js fs-based ManifestAdapter for local files. Not browser-compatible. */
 export declare class NodeAdapter implements ManifestAdapter {
     private readonly cwd;
@@ -9,6 +9,8 @@ export declare class NodeAdapter implements ManifestAdapter {
         source: string;
     }>;
     resolveRelative(base: string, relative: string): string;
+    expandGlob(base: string, patterns: string[]): Promise<string[]>;
+    resolveOwnerOf(fileUrl: string): Promise<string | null>;
 }
 /** @deprecated Use `new NodeAdapter(cwd)` instead */
 export declare function createNodeAdapter(cwd?: string): ManifestAdapter;

package/dist/adapters/node-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/node-adapter.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,gFAAgF;AAChF,qBAAa,WAAY,YAAW,eAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,GAAE,MAAsB;IAExD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAUxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IASlE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;CAKxD;AAED,qDAAqD;AACrD,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAsB,GAAG,eAAe,CAE9E"}
+{"version":3,"file":"node-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/node-adapter.ts"],"names":[],"mappings":"AAIA,OAAO,EAA6B,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAM9E,gFAAgF;AAChF,qBAAa,WAAY,YAAW,eAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,GAAE,MAAsB;IAExD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAUxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IASlE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAKjD,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAc/D,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAoB9D;AAED,qDAAqD;AACrD,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAsB,GAAG,eAAe,CAE9E"}

package/dist/adapters/node-adapter.js

@@ -1,5 +1,11 @@
 import * as fs from "fs/promises";
 import * as path from "path";
+import { fileURLToPath } from "url";
+import { minimatch } from "minimatch";
+import { DEFAULT_MANIFEST_FILENAME } from "../types.js";
+function toFilePath(url) {
+    return url.startsWith("file://") ? fileURLToPath(url) : url;
+}
 /** Node.js fs-based ManifestAdapter for local files. Not browser-compatible. */
 export class NodeAdapter {
     cwd;
@@ -14,17 +20,50 @@ export class NodeAdapter {
             (!url.includes("://") && !url.includes("@")));
     }
     async read(url) {
-        const filePath = url.startsWith("file://") ? new URL(url).pathname : url;
+        const filePath = toFilePath(url);
         const stat = await fs.stat(filePath).catch(() => null);
-        const resolvedPath = stat?.isDirectory() ? path.join(filePath, "module.yaml") : filePath;
+        const resolvedPath = stat?.isDirectory() ? path.join(filePath, DEFAULT_MANIFEST_FILENAME) : filePath;
         const text = await fs.readFile(resolvedPath, "utf8");
         return { text, source: resolvedPath };
     }
     resolveRelative(base, relative) {
-        const basePath = base.startsWith("file://") ? new URL(base).pathname : base;
-        const baseDir = path.dirname(path.resolve(this.cwd, basePath));
+        const baseDir = path.dirname(path.resolve(this.cwd, toFilePath(base)));
         return path.resolve(baseDir, relative);
     }
+    async expandGlob(base, patterns) {
+        const baseDir = path.dirname(path.resolve(this.cwd, toFilePath(base)));
+        const entries = await fs.readdir(baseDir, { recursive: true, encoding: "utf8" });
+        const normalizedPatterns = patterns.map((p) => p.replace(/\\/g, "/").replace(/^\.\//, ""));
+        const matched = [];
+        for (const entry of entries) {
+            const normalized = entry.replace(/\\/g, "/");
+            if (normalizedPatterns.some((p) => minimatch(normalized, p))) {
+                matched.push(path.resolve(baseDir, entry));
+            }
+        }
+        return matched.sort();
+    }
+    async resolveOwnerOf(fileUrl) {
+        const resolved = path.resolve(this.cwd, toFilePath(fileUrl));
+        let dir = path.dirname(resolved);
+        while (true) {
+            const candidate = path.join(dir, DEFAULT_MANIFEST_FILENAME);
+            if (candidate !== resolved) {
+                try {
+                    await fs.access(candidate);
+                    return candidate;
+                }
+                catch {
+                    // telo.yaml not found at this level
+                }
+            }
+            const parent = path.dirname(dir);
+            if (parent === dir)
+                break;
+            dir = parent;
+        }
+        return null;
+    }
 }
 /** @deprecated Use `new NodeAdapter(cwd)` instead */
 export function createNodeAdapter(cwd = process.cwd()) {

package/dist/adapters/registry-adapter.d.ts

@@ -1,4 +1,4 @@
-import type { ManifestAdapter } from "../types.js";
+import { type ManifestAdapter } from "../types.js";
 export declare class RegistryAdapter implements ManifestAdapter {
     private registryUrl;
     constructor(registryUrl?: string);

package/dist/adapters/registry-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/registry-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAInD,qBAAa,eAAgB,YAAW,eAAe;IACzC,OAAO,CAAC,WAAW;gBAAX,WAAW,SAAuB;IAEtD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAWxB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAWxE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAMvD,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,cAAc;CAmBvB"}
+{"version":3,"file":"registry-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/registry-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAI9E,qBAAa,eAAgB,YAAW,eAAe;IACzC,OAAO,CAAC,WAAW;gBAAX,WAAW,SAAuB;IAEtD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAWxB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAWxE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAMvD,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,cAAc;CAmBvB"}

package/dist/adapters/registry-adapter.js

@@ -1,3 +1,4 @@
+import { DEFAULT_MANIFEST_FILENAME } from "../types.js";
 const DEFAULT_REGISTRY_URL = "https://registry.telo.run";
 export class RegistryAdapter {
     registryUrl;
@@ -31,7 +32,7 @@ export class RegistryAdapter {
         return `${normalizedBase}/${parsed.modulePath}/${parsed.version}`;
     }
     toRegistryUrl(moduleRef) {
-        return `${this.toRegistryModuleBase(moduleRef)}/module.yaml`;
+        return `${this.toRegistryModuleBase(moduleRef)}/${DEFAULT_MANIFEST_FILENAME}`;
     }
     parseModuleRef(moduleRef) {
         const atIdx = moduleRef.lastIndexOf("@");

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAW1D,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA0O/F,qBAAa,cAAc;IACzB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IA+OvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,GAAG,gBAAgB,EAAE;IAKxF,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAiB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAY1D,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA0O/F,qBAAa,cAAc;IACzB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAoPvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,GAAG,gBAAgB,EAAE;IAKxF,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAiB5F"}

package/dist/analyzer.js

@@ -2,6 +2,7 @@ import { AliasResolver } from "./alias-resolver.js";
 import { buildTypedCelEnvironment, celEnvironment } from "./cel-environment.js";
 import { DefinitionRegistry } from "./definition-registry.js";
 import { buildDependencyGraph, formatCycle } from "./dependency-graph.js";
+import { buildKernelGlobalsSchema, mergeKernelGlobalsIntoContext } from "./kernel-globals.js";
 import { normalizeInlineResources } from "./normalize-inline-resources.js";
 import { celTypeSatisfiesJsonSchema, substituteCelFields, validateAgainstSchema, } from "./schema-compat.js";
 import { DiagnosticSeverity } from "./types.js";
@@ -238,6 +239,9 @@ export class StaticAnalyzer {
                 byName.set(m.metadata.name, m);
             }
         }
+        // Build typed kernel globals schema so x-telo-context chain validation
+        // recognises variables, secrets, resources, env automatically
+        const kernelGlobals = buildKernelGlobalsSchema(allManifests);
         // Validate each non-definition, non-system resource
         for (const m of allManifests) {
             if (!m.kind || !m.metadata?.name) {
@@ -366,7 +370,8 @@ export class StaticAnalyzer {
                 const manifestItem = matchedScope
                     ? getManifestItem(path, matchedScope, m)
                     : m;
-                const effectiveContext = resolveContextAnnotations(matchedContext, manifestItem, allManifests);
+                const resolvedContext = resolveContextAnnotations(matchedContext, manifestItem, allManifests);
+                const effectiveContext = mergeKernelGlobalsIntoContext(resolvedContext, kernelGlobals);
                 for (const chain of accessChains) {
                     const err = validateChainAgainstSchema(chain, effectiveContext);
                     if (!err)

package/dist/builtins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EA4G/C,CAAC"}
+{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EAgH/C,CAAC"}

package/dist/builtins.js

@@ -94,6 +94,10 @@ export const KERNEL_BUILTINS = [
                         ],
                     },
                 },
+                include: {
+                    type: "array",
+                    items: { type: "string" },
+                },
                 exports: {
                     type: "object",
                     properties: {

package/dist/cel-environment.d.ts

@@ -6,7 +6,10 @@ export declare const celEnvironment: Environment;
  *
  *  - `variables`: typed from the manifest's `variables` field if it is a schema map
  *    (only `Kernel.Module` resources carry this); otherwise registered as `map` (dyn).
- *  - `secrets`, `resources`, `imports`, `env`: always `map` (dyn — output schemas unknown).
- *  - `extraContextSchema`: additional variables from an `x-telo-context` annotation. */
+ *  - `secrets`, `resources`, `env`: always `map` (dyn — output schemas unknown).
+ *  - `extraContextSchema`: additional variables from an `x-telo-context` annotation.
+ *
+ *  NOTE: The set of kernel globals registered here must match `KERNEL_GLOBAL_NAMES`
+ *  in kernel-globals.ts, which is used for chain-access validation. */
 export declare function buildTypedCelEnvironment(manifest: ResourceManifest, extraContextSchema?: Record<string, any> | null): Environment;
 //# sourceMappingURL=cel-environment.d.ts.map

package/dist/cel-environment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cel-environment.d.ts","sourceRoot":"","sources":["../src/cel-environment.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAGnD,eAAO,MAAM,cAAc,aAWvB,CAAC;AAEL;;;;;;wFAMwF;AACxF,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,gBAAgB,EAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,GAC9C,WAAW,CA0Cb"}
+{"version":3,"file":"cel-environment.d.ts","sourceRoot":"","sources":["../src/cel-environment.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAGnD,eAAO,MAAM,cAAc,aAWvB,CAAC;AAEL;;;;;;;;;uEASuE;AACvE,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,gBAAgB,EAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,GAC9C,WAAW,CAyCb"}

package/dist/cel-environment.js

@@ -17,8 +17,11 @@ export const celEnvironment = new Environment({ unlistedVariablesAreDyn: true })
  *
  *  - `variables`: typed from the manifest's `variables` field if it is a schema map
  *    (only `Kernel.Module` resources carry this); otherwise registered as `map` (dyn).
- *  - `secrets`, `resources`, `imports`, `env`: always `map` (dyn — output schemas unknown).
- *  - `extraContextSchema`: additional variables from an `x-telo-context` annotation. */
+ *  - `secrets`, `resources`, `env`: always `map` (dyn — output schemas unknown).
+ *  - `extraContextSchema`: additional variables from an `x-telo-context` annotation.
+ *
+ *  NOTE: The set of kernel globals registered here must match `KERNEL_GLOBAL_NAMES`
+ *  in kernel-globals.ts, which is used for chain-access validation. */
 export function buildTypedCelEnvironment(manifest, extraContextSchema) {
     try {
         const env = celEnvironment.clone();
@@ -42,7 +45,6 @@ export function buildTypedCelEnvironment(manifest, extraContextSchema) {
         }
         env.registerVariable("secrets", "map");
         env.registerVariable("resources", "map");
-        env.registerVariable("imports", "map");
         env.registerVariable("env", "map");
         if (extraContextSchema?.properties) {
             for (const [name, propSchema] of Object.entries(extraContextSchema.properties)) {

package/dist/index.d.ts

@@ -1,9 +1,8 @@
 export { HttpAdapter } from "./adapters/http-adapter.js";
-export { createNodeAdapter, NodeAdapter } from "./adapters/node-adapter.js";
 export { RegistryAdapter } from "./adapters/registry-adapter.js";
 export { AnalysisRegistry } from "./analysis-registry.js";
 export { StaticAnalyzer } from "./analyzer.js";
 export { Loader } from "./manifest-loader.js";
-export { DiagnosticSeverity } from "./types.js";
+export { DEFAULT_MANIFEST_FILENAME, DiagnosticSeverity } from "./types.js";
 export type { AnalysisDiagnostic, AnalysisOptions, LoaderInitOptions, LoadOptions, ManifestAdapter, Position, PositionIndex, Range } from "./types.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,YAAY,EACR,kBAAkB,EAClB,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,eAAe,EAChE,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,eAAe,EAChE,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,7 +1,6 @@
 export { HttpAdapter } from "./adapters/http-adapter.js";
-export { createNodeAdapter, NodeAdapter } from "./adapters/node-adapter.js";
 export { RegistryAdapter } from "./adapters/registry-adapter.js";
 export { AnalysisRegistry } from "./analysis-registry.js";
 export { StaticAnalyzer } from "./analyzer.js";
 export { Loader } from "./manifest-loader.js";
-export { DiagnosticSeverity } from "./types.js";
+export { DEFAULT_MANIFEST_FILENAME, DiagnosticSeverity } from "./types.js";

package/dist/kernel-globals.d.ts

@@ -0,0 +1,34 @@
+import type { ResourceManifest } from "@telorun/sdk";
+/**
+ * Kernel global names available in every CEL evaluation context at runtime.
+ * Both `buildKernelGlobalsSchema` (chain-access validation) and
+ * `buildTypedCelEnvironment` in cel-environment.ts (CEL type-checking)
+ * must stay in sync with this list.
+ *
+ * Note: `env` is only available in the root module context. Child modules
+ * loaded via Kernel.Import do not receive host environment variables.
+ * There is no `imports` namespace at runtime — import snapshots are stored
+ * under `resources.<alias>`.
+ */
+export declare const KERNEL_GLOBAL_NAMES: readonly ["variables", "secrets", "resources", "env"];
+/**
+ * Build a typed JSON Schema describing the kernel globals available in the
+ * given manifest set. Used to merge into `x-telo-context` schemas so that
+ * chain-access validation recognises kernel globals without module authors
+ * having to re-declare them.
+ *
+ * - `variables` / `secrets`: typed from the `Kernel.Module` declaration
+ * - `resources`: enumerates all non-system resource names
+ * - `env`: dynamic (runtime env vars, root module only)
+ */
+export declare function buildKernelGlobalsSchema(manifests: ResourceManifest[]): Record<string, any>;
+/**
+ * Merge kernel globals into an `x-telo-context` schema so chain-access
+ * validation recognises `variables`, `secrets`, `resources`, `env`
+ * without module authors having to re-declare them.
+ *
+ * Context-specific properties take precedence over globals (spread order).
+ * The original `additionalProperties` setting is preserved.
+ */
+export declare function mergeKernelGlobalsIntoContext(contextSchema: Record<string, any>, globalsSchema: Record<string, any>): Record<string, any>;
+//# sourceMappingURL=kernel-globals.d.ts.map

package/dist/kernel-globals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kernel-globals.d.ts","sourceRoot":"","sources":["../src/kernel-globals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,uDAAwD,CAAC;AAQzF;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,gBAAgB,EAAE,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CA6BrB;AA2BD;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAClC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACjC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CASrB"}

package/dist/kernel-globals.js

@@ -0,0 +1,94 @@
+/**
+ * Kernel global names available in every CEL evaluation context at runtime.
+ * Both `buildKernelGlobalsSchema` (chain-access validation) and
+ * `buildTypedCelEnvironment` in cel-environment.ts (CEL type-checking)
+ * must stay in sync with this list.
+ *
+ * Note: `env` is only available in the root module context. Child modules
+ * loaded via Kernel.Import do not receive host environment variables.
+ * There is no `imports` namespace at runtime — import snapshots are stored
+ * under `resources.<alias>`.
+ */
+export const KERNEL_GLOBAL_NAMES = ["variables", "secrets", "resources", "env"];
+const SYSTEM_KINDS = new Set([
+    "Kernel.Definition",
+    "Kernel.Module",
+    "Kernel.Abstract",
+]);
+/**
+ * Build a typed JSON Schema describing the kernel globals available in the
+ * given manifest set. Used to merge into `x-telo-context` schemas so that
+ * chain-access validation recognises kernel globals without module authors
+ * having to re-declare them.
+ *
+ * - `variables` / `secrets`: typed from the `Kernel.Module` declaration
+ * - `resources`: enumerates all non-system resource names
+ * - `env`: dynamic (runtime env vars, root module only)
+ */
+export function buildKernelGlobalsSchema(manifests) {
+    const moduleManifest = manifests.find((m) => m.kind === "Kernel.Module");
+    const resourceProps = {};
+    for (const m of manifests) {
+        const name = m.metadata?.name;
+        if (!name || !m.kind)
+            continue;
+        // Kernel.Import snapshots are stored under resources.<alias> at runtime,
+        // so they appear here alongside regular resources.
+        if (!SYSTEM_KINDS.has(m.kind)) {
+            resourceProps[name] = { type: "object", additionalProperties: true };
+        }
+    }
+    return {
+        type: "object",
+        properties: {
+            variables: buildSchemaMapSchema(moduleManifest?.variables),
+            secrets: buildSchemaMapSchema(moduleManifest?.secrets),
+            resources: {
+                type: "object",
+                properties: resourceProps,
+                additionalProperties: false,
+            },
+            env: { type: "object", additionalProperties: true },
+        },
+    };
+}
+/** Wrap a JSON Schema property map (like `Kernel.Module.variables`) into a
+ *  closed object schema suitable for chain-access validation. Falls back to
+ *  an open map when the module declares no variables/secrets. */
+function buildSchemaMapSchema(schemaMap) {
+    if (!schemaMap || typeof schemaMap !== "object" || Array.isArray(schemaMap)) {
+        return { type: "object", additionalProperties: true };
+    }
+    const props = {};
+    for (const [key, value] of Object.entries(schemaMap)) {
+        if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+            props[key] = value;
+        }
+    }
+    if (Object.keys(props).length === 0) {
+        return { type: "object", additionalProperties: true };
+    }
+    return {
+        type: "object",
+        properties: props,
+        additionalProperties: false,
+    };
+}
+/**
+ * Merge kernel globals into an `x-telo-context` schema so chain-access
+ * validation recognises `variables`, `secrets`, `resources`, `env`
+ * without module authors having to re-declare them.
+ *
+ * Context-specific properties take precedence over globals (spread order).
+ * The original `additionalProperties` setting is preserved.
+ */
+export function mergeKernelGlobalsIntoContext(contextSchema, globalsSchema) {
+    return {
+        ...contextSchema,
+        properties: {
+            ...globalsSchema.properties,
+            ...(contextSchema.properties ?? {}),
+        },
+        additionalProperties: contextSchema.additionalProperties ?? false,
+    };
+}

package/dist/manifest-loader.d.ts

@@ -1,12 +1,20 @@
-import type { ResourceManifest } from "@telorun/sdk";
-import type { LoadOptions, LoaderInitOptions, ManifestAdapter } from "./types.js";
+import { type ResourceManifest } from "@telorun/sdk";
+import { type LoadOptions, type LoaderInitOptions, type ManifestAdapter } from "./types.js";
 export declare class Loader {
+    private static readonly moduleCache;
     protected adapters: ManifestAdapter[];
     constructor(extraAdaptersOrOptions?: ManifestAdapter[] | LoaderInitOptions);
     register(adapter: ManifestAdapter): this;
     private pick;
     resolveEntryPoint(url: string): Promise<string>;
     loadModule(url: string, options?: LoadOptions): Promise<ResourceManifest[]>;
+    private resolveIncludes;
+    private loadPartialFile;
+    loadModuleForFile(fileUrl: string): Promise<{
+        ownerUrl: string;
+        manifests: ResourceManifest[];
+        sourceManifests: Map<string, ResourceManifest[]>;
+    } | null>;
     loadModuleGraph(entryUrl: string, onError?: (url: string, error: Error) => void): Promise<Map<string, ResourceManifest[]>>;
     loadManifests(entryUrl: string): Promise<ResourceManifest[]>;
 }