@telorun/analyzer 0.1.2 → 0.1.4

package/dist/manifest-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest-loader.d.ts","sourceRoot":"","sources":["../src/manifest-loader.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKrD,OAAO,KAAK,EACV,WAAW,EACX,iBAAiB,EACjB,eAAe,EAGhB,MAAM,YAAY,CAAC;AAEpB,qBAAa,MAAM;IACjB,SAAS,CAAC,QAAQ,EAAE,eAAe,EAAE,CAAC;gBAE1B,sBAAsB,GAAE,eAAe,EAAE,GAAG,iBAAsB;IAiB9E,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI;IAKxC,OAAO,CAAC,IAAI;IAMN,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK/C,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAyE3E,eAAe,CACnB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,KAAK,IAAI,GAC5C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAsCrC,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;CAoDnE"}
+{"version":3,"file":"manifest-loader.d.ts","sourceRoot":"","sources":["../src/manifest-loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKtE,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EAGrB,MAAM,YAAY,CAAC;AAIpB,qBAAa,MAAM;IACjB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAG/B;IAEJ,SAAS,CAAC,QAAQ,EAAE,eAAe,EAAE,CAAC;gBAE1B,sBAAsB,GAAE,eAAe,EAAE,GAAG,iBAAsB;IAiB9E,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI;IAKxC,OAAO,CAAC,IAAI;IAMN,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK/C,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAmGnE,eAAe;YAoBf,eAAe;IAgEvB,iBAAiB,CACrB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;QACT,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,gBAAgB,EAAE,CAAC;QAC9B,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;KAClD,GAAG,IAAI,CAAC;IAiCH,eAAe,CACnB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,KAAK,IAAI,GAC5C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAsCrC,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;CAoDnE"}

package/dist/manifest-loader.js

@@ -1,8 +1,12 @@
+import { isCompiledValue } from "@telorun/sdk";
 import { isMap, isPair, isScalar, isSeq, parseAllDocuments } from "yaml";
 import { HttpAdapter } from "./adapters/http-adapter.js";
 import { RegistryAdapter } from "./adapters/registry-adapter.js";
 import { precompileDoc } from "./precompile.js";
+import { DEFAULT_MANIFEST_FILENAME, } from "./types.js";
+const SYSTEM_KINDS = new Set(["Kernel.Module", "Kernel.Import", "Kernel.Definition"]);
 export class Loader {
+    static moduleCache = new Map();
     adapters;
     constructor(extraAdaptersOrOptions = []) {
         const options = Array.isArray(extraAdaptersOrOptions)
@@ -35,6 +39,11 @@ export class Loader {
     }
     async loadModule(url, options) {
         const { text, source } = await this.pick(url).read(url);
+        const cacheKey = `${options?.compile ? "compiled" : "raw"}:${source}`;
+        const cached = Loader.moduleCache.get(cacheKey);
+        if (cached && cached.text === text) {
+            return cloneManifestArray(cached.manifests);
+        }
         const parsedDocuments = parseAllDocuments(text);
         const rawDocs = parsedDocuments.map((d) => d.toJSON());
         const offsets = documentLineOffsets(text);
@@ -98,8 +107,126 @@ export class Loader {
                 }
             }
         }
+        // Expand include directives — load partial files into the same module scope.
+        // Results with includes are NOT cached because partial file content is not
+        // tracked in the cache key — the cache would serve stale data if a partial changes.
+        let hasIncludes = false;
+        if (moduleManifest) {
+            const includePatterns = moduleManifest.include;
+            if (includePatterns?.length) {
+                hasIncludes = true;
+                const adapter = this.pick(source);
+                const includedFiles = await this.resolveIncludes(source, includePatterns, adapter);
+                for (const includedUrl of includedFiles) {
+                    const partialManifests = await this.loadPartialFile(includedUrl, moduleName, options);
+                    resolved.push(...partialManifests);
+                }
+            }
+        }
+        if (!hasIncludes) {
+            Loader.moduleCache.set(cacheKey, { text, manifests: resolved });
+        }
+        return cloneManifestArray(resolved);
+    }
+    async resolveIncludes(ownerSource, patterns, adapter) {
+        const hasGlobs = patterns.some((p) => /[*?{}\[\]]/.test(p));
+        if (hasGlobs) {
+            if (!adapter.expandGlob) {
+                throw new Error(`Include patterns in '${ownerSource}' contain globs but the adapter for this source ` +
+                    `does not support glob expansion. Use explicit file paths instead of patterns like: ` +
+                    patterns.filter((p) => /[*?{}\[\]]/.test(p)).join(", "));
+            }
+            return adapter.expandGlob(ownerSource, patterns);
+        }
+        // Literal relative paths — deduplicate in case the same file appears under multiple patterns.
+        return [...new Set(patterns.map((p) => adapter.resolveRelative(ownerSource, p)))];
+    }
+    async loadPartialFile(url, ownerModuleName, options) {
+        const { text, source } = await this.pick(url).read(url);
+        const parsedDocuments = parseAllDocuments(text);
+        const rawDocs = parsedDocuments.map((d) => d.toJSON());
+        const offsets = documentLineOffsets(text);
+        const lineOffsets = buildLineOffsets(text);
+        const resolved = [];
+        let docIdx = 0;
+        for (const rawDoc of rawDocs) {
+            const currentDocIdx = docIdx++;
+            const sourceLine = offsets[currentDocIdx] ?? 0;
+            const positionIndex = buildPositionIndex(parsedDocuments[currentDocIdx], lineOffsets);
+            if (rawDoc === null || rawDoc === undefined)
+                continue;
+            const kind = rawDoc.kind;
+            if (kind && SYSTEM_KINDS.has(kind)) {
+                throw new Error(`Included file '${source}' contains '${kind}' which is not allowed in partial files. ` +
+                    `Only the owner telo.yaml may declare ${kind} resources.`);
+            }
+            let compiledDocs;
+            if (options?.compile) {
+                try {
+                    const result = precompileDoc(rawDoc);
+                    compiledDocs = Array.isArray(result) ? result : [result];
+                }
+                catch (error) {
+                    throw new Error(`Failed to compile manifest in ${source}: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+            else {
+                compiledDocs = [rawDoc];
+            }
+            for (const doc of compiledDocs) {
+                if (doc === null || doc === undefined)
+                    continue;
+                const manifest = doc;
+                const metadata = {
+                    ...manifest.metadata,
+                    source,
+                    sourceLine,
+                    ...(ownerModuleName && !manifest.metadata?.module ? { module: ownerModuleName } : {}),
+                };
+                Object.defineProperty(metadata, "positionIndex", {
+                    value: positionIndex,
+                    enumerable: false,
+                    writable: true,
+                    configurable: true,
+                });
+                resolved.push({ ...manifest, metadata });
+            }
+        }
         return resolved;
     }
+    async loadModuleForFile(fileUrl) {
+        // Try loading as a regular module first (it might be a telo.yaml itself).
+        // Use loadManifests (not loadModule) so imported definitions are included —
+        // otherwise the analyzer won't know about kinds from Kernel.Import sources.
+        try {
+            const docs = await this.loadModule(fileUrl);
+            const hasModule = docs.some((d) => d.kind === "Kernel.Module");
+            if (hasModule) {
+                const { source } = await this.pick(fileUrl).read(fileUrl);
+                const manifests = await this.loadManifests(fileUrl);
+                return { ownerUrl: source, manifests, sourceManifests: groupBySource(manifests) };
+            }
+        }
+        catch (err) {
+            // If the file looks like an owner manifest (named telo.yaml), rethrow —
+            // a broken owner shouldn't silently fall through to parent lookup.
+            const normalized = fileUrl.replace(/\\/g, "/");
+            if (normalized.endsWith(`/${DEFAULT_MANIFEST_FILENAME}`) || normalized === DEFAULT_MANIFEST_FILENAME) {
+                throw err;
+            }
+            // Otherwise fall through to owner lookup — this is likely a partial file
+        }
+        // Find the owning telo.yaml via parent-directory traversal
+        const adapter = this.pick(fileUrl);
+        if (!adapter.resolveOwnerOf)
+            return null;
+        const ownerUrl = await adapter.resolveOwnerOf(fileUrl);
+        if (!ownerUrl)
+            return null;
+        // Load the owner module (which will load included files via include expansion)
+        const manifests = await this.loadManifests(ownerUrl);
+        return { ownerUrl, manifests, sourceManifests: groupBySource(manifests) };
+    }
     async loadModuleGraph(entryUrl, onError) {
         const visited = new Set([entryUrl]);
         const result = new Map();
@@ -192,6 +319,43 @@ export class Loader {
         return [...entry, ...importedDefs];
     }
 }
+function cloneManifestArray(manifests) {
+    return manifests.map((manifest) => cloneManifestValue(manifest));
+}
+function cloneManifestValue(value) {
+    if (Array.isArray(value)) {
+        return value.map((entry) => cloneManifestValue(entry));
+    }
+    if (isCompiledValue(value)) {
+        return value;
+    }
+    if (value !== null && typeof value === "object") {
+        const source = value;
+        const clone = {};
+        for (const [key, entry] of Object.entries(source)) {
+            clone[key] = cloneManifestValue(entry);
+        }
+        const positionIndex = Object.getOwnPropertyDescriptor(source, "positionIndex");
+        if (positionIndex) {
+            Object.defineProperty(clone, "positionIndex", positionIndex);
+        }
+        return clone;
+    }
+    return value;
+}
+function groupBySource(manifests) {
+    const map = new Map();
+    for (const m of manifests) {
+        const src = m.metadata?.source ?? "unknown";
+        let list = map.get(src);
+        if (!list) {
+            list = [];
+            map.set(src, list);
+        }
+        list.push(m);
+    }
+    return map;
+}
 function documentLineOffsets(text) {
     const offsets = [0];
     const lines = text.split("\n");

package/dist/schema-compat.d.ts

@@ -37,6 +37,6 @@ export declare function celTypeSatisfiesJsonSchema(celType: string, schema: Reco
 export declare function celPlaceholderForSchema(schema: Record<string, any>): unknown;
 /** Deep-clone `data`, replacing every pure CEL template string (`${{ expr }}`) with a
  *  schema-appropriate placeholder so AJV can validate non-CEL fields without false positives. */
-export declare function substituteCelFields(data: unknown, schema: Record<string, any>): unknown;
+export declare function substituteCelFields(data: unknown, schema: Record<string, any>, rootSchema?: Record<string, any>): unknown;
 export {};
 //# sourceMappingURL=schema-compat.d.ts.map

package/dist/schema-compat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-compat.d.ts","sourceRoot":"","sources":["../src/schema-compat.ts"],"names":[],"mappings":"AAGA,QAAA,MAAM,GAAG,KAA0C,CAAC;AAEpD;0FAC0F;AAC1F,wBAAgB,SAAS,IAAI,YAAY,CAAC,OAAO,GAAG,CAAC,CAMpD;AAID,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;oEAEoE;AACpE,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC1B,mBAAmB,CAIrB;AAiDD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAelD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAGxE;AAuBD,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;CACd;AAED,0GAA0G;AAC1G,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,WAAW,EAAE,CAY/F;AAED;qFACqF;AACrF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAQ7E;AAED;;;;6DAI6D;AAC7D,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,EAAE,MAAM,GACX,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAsBjC;AAED,8DAA8D;AAC9D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,CAuBnF;AAED,wFAAwF;AACxF,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAqBhG;AAED,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAiB5E;AAID;iGACiG;AACjG,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAqBvF"}
+{"version":3,"file":"schema-compat.d.ts","sourceRoot":"","sources":["../src/schema-compat.ts"],"names":[],"mappings":"AAGA,QAAA,MAAM,GAAG,KAA0C,CAAC;AAEpD;0FAC0F;AAC1F,wBAAgB,SAAS,IAAI,YAAY,CAAC,OAAO,GAAG,CAAC,CAMpD;AAKD,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;oEAEoE;AACpE,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC1B,mBAAmB,CAIrB;AAiDD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAelD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAGxE;AAuBD,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;CACd;AAED,0GAA0G;AAC1G,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,WAAW,EAAE,CAe/F;AAED;qFACqF;AACrF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAQ7E;AAED;;;;6DAI6D;AAC7D,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,EAAE,MAAM,GACX,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAsBjC;AAED,8DAA8D;AAC9D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,CAuBnF;AAED,wFAAwF;AACxF,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAqBhG;AAED,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAiB5E;AA2BD;iGACiG;AACjG,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC/B,OAAO,CAwBT"}

package/dist/schema-compat.js

@@ -11,6 +11,7 @@ export function createAjv() {
     return instance;
 }
 const ajv = createAjv();
+const compiledSchemaValidators = new WeakMap();
 /** Conservative structural JSON Schema compatibility check.
  *  Only flags definite mismatches: missing required fields and primitive type conflicts.
  *  Ambiguous cases (anyOf/oneOf/etc.) are treated as compatible. */
@@ -93,12 +94,15 @@ function ajvErrorToPath(err) {
 }
 /** Validate actual data against a JSON Schema. Returns issues with path info, or empty array if valid. */
 export function validateAgainstSchema(data, schema) {
-    let validate;
-    try {
-        validate = ajv.compile(schema);
-    }
-    catch {
-        return [];
+    let validate = compiledSchemaValidators.get(schema);
+    if (!validate) {
+        try {
+            validate = ajv.compile(schema);
+            compiledSchemaValidators.set(schema, validate);
+        }
+        catch {
+            return [];
+        }
     }
     if (validate(data))
         return [];
@@ -234,24 +238,49 @@ export function celPlaceholderForSchema(schema) {
     }
 }
 const CEL_PURE_RE = /^\s*\$\{\{[^}]*\}\}\s*$/;
+/** Resolve a `$ref` (only `#/$defs/...` form) against the root schema. */
+function resolveRef(schema, root) {
+    if (schema.$ref && typeof schema.$ref === "string" && schema.$ref.startsWith("#/$defs/")) {
+        const defName = schema.$ref.slice("#/$defs/".length);
+        const resolved = root.$defs?.[defName];
+        if (resolved)
+            return resolved;
+    }
+    return schema;
+}
+/** Collect property schemas from top-level `properties` and all `oneOf`/`anyOf` sub-schemas. */
+function collectProperties(schema) {
+    const props = { ...(schema.properties ?? {}) };
+    for (const sub of schema.oneOf ?? schema.anyOf ?? []) {
+        if (sub && typeof sub === "object" && sub.properties) {
+            for (const [k, v] of Object.entries(sub.properties)) {
+                if (!(k in props))
+                    props[k] = v;
+            }
+        }
+    }
+    return props;
+}
 /** Deep-clone `data`, replacing every pure CEL template string (`${{ expr }}`) with a
  *  schema-appropriate placeholder so AJV can validate non-CEL fields without false positives. */
-export function substituteCelFields(data, schema) {
+export function substituteCelFields(data, schema, rootSchema) {
+    const root = rootSchema ?? schema;
+    const resolved = resolveRef(schema, root);
     if (typeof data === "string" && CEL_PURE_RE.test(data)) {
-        return celPlaceholderForSchema(schema);
+        return celPlaceholderForSchema(resolved);
     }
     if (Array.isArray(data)) {
-        const itemSchema = (schema.items ?? {});
-        return data.map((item) => substituteCelFields(item, itemSchema));
+        const itemSchema = resolveRef((resolved.items ?? {}), root);
+        return data.map((item) => substituteCelFields(item, itemSchema, root));
     }
     if (data !== null && typeof data === "object") {
-        const props = (schema.properties ?? {});
-        const addlProps = schema.additionalProperties && typeof schema.additionalProperties === "object"
-            ? schema.additionalProperties
+        const props = collectProperties(resolved);
+        const addlProps = resolved.additionalProperties && typeof resolved.additionalProperties === "object"
+            ? resolved.additionalProperties
             : undefined;
         const result = {};
         for (const [k, v] of Object.entries(data)) {
-            result[k] = substituteCelFields(v, (props[k] ?? addlProps ?? {}));
+            result[k] = substituteCelFields(v, (props[k] ?? addlProps ?? {}), root);
         }
         return result;
     }

package/dist/types.d.ts

@@ -7,6 +7,8 @@ export declare const DiagnosticSeverity: {
     readonly Hint: 4;
 };
 export type DiagnosticSeverity = (typeof DiagnosticSeverity)[keyof typeof DiagnosticSeverity];
+/** Default entry-point filename when a directory is given instead of a file. */
+export declare const DEFAULT_MANIFEST_FILENAME = "telo.yaml";
 export interface Position {
     /** 0-based line number */
     line: number;
@@ -40,6 +42,14 @@ export interface ManifestAdapter {
         source: string;
     }>;
     resolveRelative(base: string, relative: string): string;
+    /** Expand glob patterns relative to a base source. Returns sources in the same
+     *  format as read().source — suitable to pass back into read() / resolveRelative().
+     *  Optional — only filesystem-capable adapters implement this. */
+    expandGlob?(base: string, patterns: string[]): Promise<string[]>;
+    /** Walk parent directories from fileUrl looking for the nearest telo.yaml.
+     *  Returns the source in the same format as read().source, or null if none found.
+     *  Optional — only filesystem-capable adapters implement this. */
+    resolveOwnerOf?(fileUrl: string): Promise<string | null>;
 }
 export interface LoadOptions {
     /** When true, each YAML document is passed through the CEL precompiler before being

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;qHACqH;AACrH,eAAO,MAAM,kBAAkB;;;;;CAKrB,CAAC;AACX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAC;AAE9F,MAAM,WAAW,QAAQ;IACvB,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,KAAK;IACpB,KAAK,EAAE,QAAQ,CAAC;IAChB,GAAG,EAAE,QAAQ,CAAC;CACf;AAED;;oDAEoD;AACpD,MAAM,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAE/C;6EAC6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,2BAA2B;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;CACzD;AAED,MAAM,WAAW,WAAW;IAC1B;;;+EAG2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,aAAa,CAAC,EAAE,eAAe,EAAE,CAAC;IAClC,sDAAsD;IACtD,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,0DAA0D;IAC1D,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;gEAKgE;AAChE,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,OAAO,qBAAqB,EAAE,aAAa,CAAC;IACtD,WAAW,CAAC,EAAE,OAAO,0BAA0B,EAAE,kBAAkB,CAAC;CACrE"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;qHACqH;AACrH,eAAO,MAAM,kBAAkB;;;;;CAKrB,CAAC;AACX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAC;AAE9F,gFAAgF;AAChF,eAAO,MAAM,yBAAyB,cAAc,CAAC;AAErD,MAAM,WAAW,QAAQ;IACvB,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,KAAK;IACpB,KAAK,EAAE,QAAQ,CAAC;IAChB,GAAG,EAAE,QAAQ,CAAC;CACf;AAED;;oDAEoD;AACpD,MAAM,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAE/C;6EAC6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,2BAA2B;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAExD;;sEAEkE;IAClE,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEjE;;sEAEkE;IAClE,cAAc,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,WAAW;IAC1B;;;+EAG2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,aAAa,CAAC,EAAE,eAAe,EAAE,CAAC;IAClC,sDAAsD;IACtD,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,0DAA0D;IAC1D,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;gEAKgE;AAChE,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,OAAO,qBAAqB,EAAE,aAAa,CAAC;IACtD,WAAW,CAAC,EAAE,OAAO,0BAA0B,EAAE,kBAAkB,CAAC;CACrE"}

package/dist/types.js

@@ -6,3 +6,5 @@ export const DiagnosticSeverity = {
     Information: 3,
     Hint: 4,
 };
+/** Default entry-point filename when a directory is given instead of a file. */
+export const DEFAULT_MANIFEST_FILENAME = "telo.yaml";

package/dist/validate-references.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-references.d.ts","sourceRoot":"","sources":["../src/validate-references.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA6C/F;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,GACvB,kBAAkB,EAAE,CAoPtB"}
+{"version":3,"file":"validate-references.d.ts","sourceRoot":"","sources":["../src/validate-references.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA6C/F;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,GACvB,kBAAkB,EAAE,CAgQtB"}

package/dist/validate-references.js

@@ -111,9 +111,21 @@ export function validateReferences(resources, context) {
                 if (!val)
                     continue;
                 // Name-only reference (plain string) — look up by name to validate.
+                // Qualified references use "Kind.Name" format (e.g. "Http.Api.PaymentApi");
+                // extract the resource name from the last dot segment.
                 if (typeof val === "string") {
-                    const target = byName.get(val) ?? visibleScopeManifests.find((m) => m.metadata?.name === val);
+                    const lastDot = val.lastIndexOf(".");
+                    const refName = lastDot > 0 ? val.slice(lastDot + 1) : val;
+                    const refKindPrefix = lastDot > 0 ? val.slice(0, lastDot) : undefined;
+                    const target = byName.get(refName) ?? visibleScopeManifests.find((m) => m.metadata?.name === refName);
                     if (!target) {
+                        // Cross-module reference: "Alias.ResourceName" (single dot, bare alias prefix).
+                        // The resource lives in the imported module's scope and can't be validated here.
+                        // Multi-dot prefixes like "Alias.Kind.Name" are local resources with qualified
+                        // kinds — those must be validated.
+                        if (refKindPrefix && !refKindPrefix.includes(".") && aliases.hasAlias(refKindPrefix)) {
+                            continue;
+                        }
                         diagnostics.push({
                             severity: DiagnosticSeverity.Error,
                             code: "UNRESOLVED_REFERENCE",

package/package.json

@@ -1,6 +1,25 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.1.2",
+  "version": "0.1.4",
+  "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
+  "keywords": [
+    "telo",
+    "analyzer",
+    "validator",
+    "manifest",
+    "yaml"
+  ],
+  "author": "Bartosz Pasiński <bartosz.pasinski@codenet.pl>",
+  "license": "SEE LICENSE IN LICENSE",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/telorun/telo.git",
+    "directory": "analyzer/nodejs"
+  },
+  "homepage": "https://github.com/telorun/telo#readme",
+  "bugs": {
+    "url": "https://github.com/telorun/telo/issues"
+  },
   "type": "module",
   "main": "./dist/index.js",
   "exports": {
@@ -20,9 +39,9 @@
     "@marcbachmann/cel-js": "^7.5.3",
     "ajv": "^8.17.1",
     "ajv-formats": "^3.0.1",
-    "yaml": "^2.8.3",
     "jsonpath-plus": "^10.3.0",
-    "@telorun/sdk": "0.2.7"
+    "yaml": "^2.8.3",
+    "@telorun/sdk": "0.2.8"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",

package/src/adapters/http-adapter.ts

@@ -1,4 +1,4 @@
-import type { ManifestAdapter } from "../types.js";
+import { DEFAULT_MANIFEST_FILENAME, type ManifestAdapter } from "../types.js";
 
 export class HttpAdapter implements ManifestAdapter {
   supports(url: string): boolean {
@@ -6,7 +6,7 @@ export class HttpAdapter implements ManifestAdapter {
   }
 
   async read(url: string): Promise<{ text: string; source: string }> {
-    const fetchUrl = url.includes(".yaml") ? url : `${url}/module.yaml`;
+    const fetchUrl = url.includes(".yaml") ? url : `${url}/${DEFAULT_MANIFEST_FILENAME}`;
     const response = await fetch(fetchUrl);
     if (!response.ok) {
       throw new Error(

package/src/adapters/registry-adapter.ts

@@ -1,4 +1,4 @@
-import type { ManifestAdapter } from "../types.js";
+import { DEFAULT_MANIFEST_FILENAME, type ManifestAdapter } from "../types.js";
 
 const DEFAULT_REGISTRY_URL = "https://registry.telo.run";
 
@@ -40,7 +40,7 @@ export class RegistryAdapter implements ManifestAdapter {
   }
 
   private toRegistryUrl(moduleRef: string): string {
-    return `${this.toRegistryModuleBase(moduleRef)}/module.yaml`;
+    return `${this.toRegistryModuleBase(moduleRef)}/${DEFAULT_MANIFEST_FILENAME}`;
   }
 
   private parseModuleRef(moduleRef: string): { modulePath: string; version: string } {

package/src/analyzer.ts

@@ -4,6 +4,7 @@ import { AnalysisRegistry } from "./analysis-registry.js";
 import { buildTypedCelEnvironment, celEnvironment } from "./cel-environment.js";
 import { DefinitionRegistry } from "./definition-registry.js";
 import { buildDependencyGraph, formatCycle } from "./dependency-graph.js";
+import { buildKernelGlobalsSchema, mergeKernelGlobalsIntoContext } from "./kernel-globals.js";
 import { normalizeInlineResources } from "./normalize-inline-resources.js";
 import {
   celTypeSatisfiesJsonSchema,
@@ -317,6 +318,10 @@ export class StaticAnalyzer {
       }
     }
 
+    // Build typed kernel globals schema so x-telo-context chain validation
+    // recognises variables, secrets, resources, env automatically
+    const kernelGlobals = buildKernelGlobalsSchema(allManifests);
+
     // Validate each non-definition, non-system resource
     for (const m of allManifests) {
       if (!m.kind || !m.metadata?.name) {
@@ -463,11 +468,12 @@ export class StaticAnalyzer {
         const manifestItem = matchedScope
           ? getManifestItem(path, matchedScope, m as Record<string, any>)
           : (m as Record<string, any>);
-        const effectiveContext = resolveContextAnnotations(
+        const resolvedContext = resolveContextAnnotations(
           matchedContext,
           manifestItem,
           allManifests as Record<string, any>[],
         );
+        const effectiveContext = mergeKernelGlobalsIntoContext(resolvedContext, kernelGlobals);
 
         for (const chain of accessChains) {
           const err = validateChainAgainstSchema(chain, effectiveContext);

package/src/builtins.ts

@@ -96,6 +96,10 @@ export const KERNEL_BUILTINS: ResourceDefinition[] = [
             ],
           },
         },
+        include: {
+          type: "array",
+          items: { type: "string" },
+        },
         exports: {
           type: "object",
           properties: {

package/src/cel-environment.ts

@@ -20,8 +20,11 @@ export const celEnvironment = new Environment({ unlistedVariablesAreDyn: true })
  *
  *  - `variables`: typed from the manifest's `variables` field if it is a schema map
  *    (only `Kernel.Module` resources carry this); otherwise registered as `map` (dyn).
- *  - `secrets`, `resources`, `imports`, `env`: always `map` (dyn — output schemas unknown).
- *  - `extraContextSchema`: additional variables from an `x-telo-context` annotation. */
+ *  - `secrets`, `resources`, `env`: always `map` (dyn — output schemas unknown).
+ *  - `extraContextSchema`: additional variables from an `x-telo-context` annotation.
+ *
+ *  NOTE: The set of kernel globals registered here must match `KERNEL_GLOBAL_NAMES`
+ *  in kernel-globals.ts, which is used for chain-access validation. */
 export function buildTypedCelEnvironment(
   manifest: ResourceManifest,
   extraContextSchema?: Record<string, any> | null,
@@ -50,7 +53,6 @@ export function buildTypedCelEnvironment(
 
     env.registerVariable("secrets", "map");
     env.registerVariable("resources", "map");
-    env.registerVariable("imports", "map");
     env.registerVariable("env", "map");
 
     if (extraContextSchema?.properties) {

package/src/index.ts

@@ -1,10 +1,9 @@
 export { HttpAdapter } from "./adapters/http-adapter.js";
-export { createNodeAdapter, NodeAdapter } from "./adapters/node-adapter.js";
 export { RegistryAdapter } from "./adapters/registry-adapter.js";
 export { AnalysisRegistry } from "./analysis-registry.js";
 export { StaticAnalyzer } from "./analyzer.js";
 export { Loader } from "./manifest-loader.js";
-export { DiagnosticSeverity } from "./types.js";
+export { DEFAULT_MANIFEST_FILENAME, DiagnosticSeverity } from "./types.js";
 export type {
     AnalysisDiagnostic,
     AnalysisOptions, LoaderInitOptions, LoadOptions, ManifestAdapter,

package/src/kernel-globals.ts

@@ -0,0 +1,110 @@
+import type { ResourceManifest } from "@telorun/sdk";
+
+/**
+ * Kernel global names available in every CEL evaluation context at runtime.
+ * Both `buildKernelGlobalsSchema` (chain-access validation) and
+ * `buildTypedCelEnvironment` in cel-environment.ts (CEL type-checking)
+ * must stay in sync with this list.
+ *
+ * Note: `env` is only available in the root module context. Child modules
+ * loaded via Kernel.Import do not receive host environment variables.
+ * There is no `imports` namespace at runtime — import snapshots are stored
+ * under `resources.<alias>`.
+ */
+export const KERNEL_GLOBAL_NAMES = ["variables", "secrets", "resources", "env"] as const;
+
+const SYSTEM_KINDS = new Set([
+  "Kernel.Definition",
+  "Kernel.Module",
+  "Kernel.Abstract",
+]);
+
+/**
+ * Build a typed JSON Schema describing the kernel globals available in the
+ * given manifest set. Used to merge into `x-telo-context` schemas so that
+ * chain-access validation recognises kernel globals without module authors
+ * having to re-declare them.
+ *
+ * - `variables` / `secrets`: typed from the `Kernel.Module` declaration
+ * - `resources`: enumerates all non-system resource names
+ * - `env`: dynamic (runtime env vars, root module only)
+ */
+export function buildKernelGlobalsSchema(
+  manifests: ResourceManifest[],
+): Record<string, any> {
+  const moduleManifest = manifests.find((m) => m.kind === "Kernel.Module") as
+    | Record<string, any>
+    | undefined;
+
+  const resourceProps: Record<string, any> = {};
+  for (const m of manifests) {
+    const name = m.metadata?.name as string | undefined;
+    if (!name || !m.kind) continue;
+    // Kernel.Import snapshots are stored under resources.<alias> at runtime,
+    // so they appear here alongside regular resources.
+    if (!SYSTEM_KINDS.has(m.kind)) {
+      resourceProps[name] = { type: "object", additionalProperties: true };
+    }
+  }
+
+  return {
+    type: "object",
+    properties: {
+      variables: buildSchemaMapSchema(moduleManifest?.variables),
+      secrets: buildSchemaMapSchema(moduleManifest?.secrets),
+      resources: {
+        type: "object",
+        properties: resourceProps,
+        additionalProperties: false,
+      },
+      env: { type: "object", additionalProperties: true },
+    },
+  };
+}
+
+/** Wrap a JSON Schema property map (like `Kernel.Module.variables`) into a
+ *  closed object schema suitable for chain-access validation. Falls back to
+ *  an open map when the module declares no variables/secrets. */
+function buildSchemaMapSchema(
+  schemaMap: Record<string, any> | null | undefined,
+): Record<string, any> {
+  if (!schemaMap || typeof schemaMap !== "object" || Array.isArray(schemaMap)) {
+    return { type: "object", additionalProperties: true };
+  }
+  const props: Record<string, any> = {};
+  for (const [key, value] of Object.entries(schemaMap)) {
+    if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+      props[key] = value;
+    }
+  }
+  if (Object.keys(props).length === 0) {
+    return { type: "object", additionalProperties: true };
+  }
+  return {
+    type: "object",
+    properties: props,
+    additionalProperties: false,
+  };
+}
+
+/**
+ * Merge kernel globals into an `x-telo-context` schema so chain-access
+ * validation recognises `variables`, `secrets`, `resources`, `env`
+ * without module authors having to re-declare them.
+ *
+ * Context-specific properties take precedence over globals (spread order).
+ * The original `additionalProperties` setting is preserved.
+ */
+export function mergeKernelGlobalsIntoContext(
+  contextSchema: Record<string, any>,
+  globalsSchema: Record<string, any>,
+): Record<string, any> {
+  return {
+    ...contextSchema,
+    properties: {
+      ...globalsSchema.properties,
+      ...(contextSchema.properties ?? {}),
+    },
+    additionalProperties: contextSchema.additionalProperties ?? false,
+  };
+}