@telorun/analyzer 0.1.3 → 0.2.0

package/dist/index.js

@@ -1,7 +1,7 @@
 export { HttpAdapter } from "./adapters/http-adapter.js";
-export { createNodeAdapter, NodeAdapter } from "./adapters/node-adapter.js";
 export { RegistryAdapter } from "./adapters/registry-adapter.js";
 export { AnalysisRegistry } from "./analysis-registry.js";
 export { StaticAnalyzer } from "./analyzer.js";
 export { Loader } from "./manifest-loader.js";
+export { MODULE_KINDS, isModuleKind } from "./module-kinds.js";
 export { DEFAULT_MANIFEST_FILENAME, DiagnosticSeverity } from "./types.js";

package/dist/kernel-globals.d.ts

@@ -6,7 +6,7 @@ import type { ResourceManifest } from "@telorun/sdk";
  * must stay in sync with this list.
  *
  * Note: `env` is only available in the root module context. Child modules
- * loaded via Kernel.Import do not receive host environment variables.
+ * loaded via Telo.Import do not receive host environment variables.
  * There is no `imports` namespace at runtime — import snapshots are stored
  * under `resources.<alias>`.
  */
@@ -17,7 +17,11 @@ export declare const KERNEL_GLOBAL_NAMES: readonly ["variables", "secrets", "res
  * chain-access validation recognises kernel globals without module authors
  * having to re-declare them.
  *
- * - `variables` / `secrets`: typed from the `Kernel.Module` declaration
+ * - `variables` / `secrets`: typed from the root module doc — prefer
+ *   Telo.Application when present, otherwise fall back to Telo.Library.
+ *   Applications are the root whose variables/secrets contract governs CEL
+ *   in the outer module; Libraries are only relevant when the caller scoped
+ *   the manifest list to a single library's file.
  * - `resources`: enumerates all non-system resource names
  * - `env`: dynamic (runtime env vars, root module only)
  */

package/dist/kernel-globals.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kernel-globals.d.ts","sourceRoot":"","sources":["../src/kernel-globals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,uDAAwD,CAAC;AAQzF;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,gBAAgB,EAAE,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CA6BrB;AA2BD;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAClC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACjC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CASrB"}
+{"version":3,"file":"kernel-globals.d.ts","sourceRoot":"","sources":["../src/kernel-globals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,uDAAwD,CAAC;AASzF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,gBAAgB,EAAE,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAiCrB;AA2BD;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAClC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACjC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CASrB"}

package/dist/kernel-globals.js

@@ -5,15 +5,16 @@
  * must stay in sync with this list.
  *
  * Note: `env` is only available in the root module context. Child modules
- * loaded via Kernel.Import do not receive host environment variables.
+ * loaded via Telo.Import do not receive host environment variables.
  * There is no `imports` namespace at runtime — import snapshots are stored
  * under `resources.<alias>`.
  */
 export const KERNEL_GLOBAL_NAMES = ["variables", "secrets", "resources", "env"];
 const SYSTEM_KINDS = new Set([
-    "Kernel.Definition",
-    "Kernel.Module",
-    "Kernel.Abstract",
+    "Telo.Definition",
+    "Telo.Application",
+    "Telo.Library",
+    "Telo.Abstract",
 ]);
 /**
  * Build a typed JSON Schema describing the kernel globals available in the
@@ -21,18 +22,23 @@ const SYSTEM_KINDS = new Set([
  * chain-access validation recognises kernel globals without module authors
  * having to re-declare them.
  *
- * - `variables` / `secrets`: typed from the `Kernel.Module` declaration
+ * - `variables` / `secrets`: typed from the root module doc — prefer
+ *   Telo.Application when present, otherwise fall back to Telo.Library.
+ *   Applications are the root whose variables/secrets contract governs CEL
+ *   in the outer module; Libraries are only relevant when the caller scoped
+ *   the manifest list to a single library's file.
  * - `resources`: enumerates all non-system resource names
  * - `env`: dynamic (runtime env vars, root module only)
  */
 export function buildKernelGlobalsSchema(manifests) {
-    const moduleManifest = manifests.find((m) => m.kind === "Kernel.Module");
+    const moduleManifest = manifests.find((m) => m.kind === "Telo.Application") ??
+        manifests.find((m) => m.kind === "Telo.Library");
     const resourceProps = {};
     for (const m of manifests) {
         const name = m.metadata?.name;
         if (!name || !m.kind)
             continue;
-        // Kernel.Import snapshots are stored under resources.<alias> at runtime,
+        // Telo.Import snapshots are stored under resources.<alias> at runtime,
         // so they appear here alongside regular resources.
         if (!SYSTEM_KINDS.has(m.kind)) {
             resourceProps[name] = { type: "object", additionalProperties: true };
@@ -52,7 +58,7 @@ export function buildKernelGlobalsSchema(manifests) {
         },
     };
 }
-/** Wrap a JSON Schema property map (like `Kernel.Module.variables`) into a
+/** Wrap a JSON Schema property map (like `Telo.Application.variables`) into a
  *  closed object schema suitable for chain-access validation. Falls back to
  *  an open map when the module declares no variables/secrets. */
 function buildSchemaMapSchema(schemaMap) {

package/dist/manifest-loader.d.ts

@@ -1,13 +1,21 @@
 import { type ResourceManifest } from "@telorun/sdk";
-import type { LoadOptions, LoaderInitOptions, ManifestAdapter } from "./types.js";
+import { type LoadOptions, type LoaderInitOptions, type ManifestAdapter } from "./types.js";
 export declare class Loader {
     private static readonly moduleCache;
     protected adapters: ManifestAdapter[];
+    private readonly celEnv;
     constructor(extraAdaptersOrOptions?: ManifestAdapter[] | LoaderInitOptions);
     register(adapter: ManifestAdapter): this;
     private pick;
     resolveEntryPoint(url: string): Promise<string>;
     loadModule(url: string, options?: LoadOptions): Promise<ResourceManifest[]>;
+    private resolveIncludes;
+    private loadPartialFile;
+    loadModuleForFile(fileUrl: string): Promise<{
+        ownerUrl: string;
+        manifests: ResourceManifest[];
+        sourceManifests: Map<string, ResourceManifest[]>;
+    } | null>;
     loadModuleGraph(entryUrl: string, onError?: (url: string, error: Error) => void): Promise<Map<string, ResourceManifest[]>>;
     loadManifests(entryUrl: string): Promise<ResourceManifest[]>;
 }

package/dist/manifest-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest-loader.d.ts","sourceRoot":"","sources":["../src/manifest-loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKtE,OAAO,KAAK,EACV,WAAW,EACX,iBAAiB,EACjB,eAAe,EAGhB,MAAM,YAAY,CAAC;AAEpB,qBAAa,MAAM;IACjB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAG/B;IAEJ,SAAS,CAAC,QAAQ,EAAE,eAAe,EAAE,CAAC;gBAE1B,sBAAsB,GAAE,eAAe,EAAE,GAAG,iBAAsB;IAiB9E,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI;IAKxC,OAAO,CAAC,IAAI;IAMN,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK/C,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAgF3E,eAAe,CACnB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,KAAK,IAAI,GAC5C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAsCrC,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;CAoDnE"}
+{"version":3,"file":"manifest-loader.d.ts","sourceRoot":"","sources":["../src/manifest-loader.ts"],"names":[],"mappings":"AACA,OAAO,EAAmB,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAOtE,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EAGrB,MAAM,YAAY,CAAC;AASpB,qBAAa,MAAM;IACjB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAG/B;IAEJ,SAAS,CAAC,QAAQ,EAAE,eAAe,EAAE,CAAC;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,sBAAsB,GAAE,eAAe,EAAE,GAAG,iBAAsB;IAmB9E,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI;IAKxC,OAAO,CAAC,IAAI;IAMN,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK/C,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAqGnE,eAAe;YAoBf,eAAe;IAgEvB,iBAAiB,CACrB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;QACT,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,gBAAgB,EAAE,CAAC;QAC9B,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;KAClD,GAAG,IAAI,CAAC;IAiCH,eAAe,CACnB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,KAAK,IAAI,GAC5C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAsCrC,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;CAiEnE"}

package/dist/manifest-loader.js

@@ -2,10 +2,20 @@ import { isCompiledValue } from "@telorun/sdk";
 import { isMap, isPair, isScalar, isSeq, parseAllDocuments } from "yaml";
 import { HttpAdapter } from "./adapters/http-adapter.js";
 import { RegistryAdapter } from "./adapters/registry-adapter.js";
+import { buildCelEnvironment } from "./cel-environment.js";
+import { isModuleKind } from "./module-kinds.js";
 import { precompileDoc } from "./precompile.js";
+import { DEFAULT_MANIFEST_FILENAME, } from "./types.js";
+const SYSTEM_KINDS = new Set([
+    "Telo.Application",
+    "Telo.Library",
+    "Telo.Import",
+    "Telo.Definition",
+]);
 export class Loader {
     static moduleCache = new Map();
     adapters;
+    celEnv;
     constructor(extraAdaptersOrOptions = []) {
         const options = Array.isArray(extraAdaptersOrOptions)
             ? { extraAdapters: extraAdaptersOrOptions }
@@ -20,6 +30,7 @@ export class Loader {
         if (options.extraAdapters?.length) {
             this.adapters.unshift(...options.extraAdapters);
         }
+        this.celEnv = buildCelEnvironment(options.celHandlers);
     }
     register(adapter) {
         this.adapters.unshift(adapter);
@@ -57,7 +68,7 @@ export class Loader {
             let compiledDocs;
             if (options?.compile) {
                 try {
-                    const result = precompileDoc(rawDoc);
+                    const result = precompileDoc(rawDoc, this.celEnv);
                     compiledDocs = Array.isArray(result) ? result : [result];
                 }
                 catch (error) {
@@ -83,15 +94,17 @@ export class Loader {
                 resolved.push({ ...manifest, metadata });
             }
         }
-        const moduleManifests = resolved.filter((m) => m.kind === "Kernel.Module");
+        const moduleManifests = resolved.filter((m) => isModuleKind(m.kind));
         if (moduleManifests.length > 1) {
-            throw new Error(`File '${source}' contains ${moduleManifests.length} Kernel.Module declarations. Maximum one is allowed.`);
+            const kinds = moduleManifests.map((m) => m.kind).join(", ");
+            throw new Error(`File '${source}' contains ${moduleManifests.length} module declarations (${kinds}). ` +
+                `A file may declare at most one Telo.Application or Telo.Library.`);
         }
         const moduleManifest = moduleManifests[0];
         const moduleName = moduleManifest?.metadata?.name;
         if (moduleName) {
             for (const manifest of resolved) {
-                if (manifest.kind !== "Kernel.Module" && !manifest.metadata?.module) {
+                if (!isModuleKind(manifest.kind) && !manifest.metadata?.module) {
                     const pi = manifest.metadata?.positionIndex;
                     manifest.metadata = { ...manifest.metadata, module: moduleName };
                     if (pi) {
@@ -105,9 +118,126 @@ export class Loader {
                 }
             }
         }
-        Loader.moduleCache.set(cacheKey, { text, manifests: resolved });
+        // Expand include directives — load partial files into the same module scope.
+        // Results with includes are NOT cached because partial file content is not
+        // tracked in the cache key — the cache would serve stale data if a partial changes.
+        let hasIncludes = false;
+        if (moduleManifest) {
+            const includePatterns = moduleManifest.include;
+            if (includePatterns?.length) {
+                hasIncludes = true;
+                const adapter = this.pick(source);
+                const includedFiles = await this.resolveIncludes(source, includePatterns, adapter);
+                for (const includedUrl of includedFiles) {
+                    const partialManifests = await this.loadPartialFile(includedUrl, moduleName, options);
+                    resolved.push(...partialManifests);
+                }
+            }
+        }
+        if (!hasIncludes) {
+            Loader.moduleCache.set(cacheKey, { text, manifests: resolved });
+        }
         return cloneManifestArray(resolved);
     }
+    async resolveIncludes(ownerSource, patterns, adapter) {
+        const hasGlobs = patterns.some((p) => /[*?{}\[\]]/.test(p));
+        if (hasGlobs) {
+            if (!adapter.expandGlob) {
+                throw new Error(`Include patterns in '${ownerSource}' contain globs but the adapter for this source ` +
+                    `does not support glob expansion. Use explicit file paths instead of patterns like: ` +
+                    patterns.filter((p) => /[*?{}\[\]]/.test(p)).join(", "));
+            }
+            return adapter.expandGlob(ownerSource, patterns);
+        }
+        // Literal relative paths — deduplicate in case the same file appears under multiple patterns.
+        return [...new Set(patterns.map((p) => adapter.resolveRelative(ownerSource, p)))];
+    }
+    async loadPartialFile(url, ownerModuleName, options) {
+        const { text, source } = await this.pick(url).read(url);
+        const parsedDocuments = parseAllDocuments(text);
+        const rawDocs = parsedDocuments.map((d) => d.toJSON());
+        const offsets = documentLineOffsets(text);
+        const lineOffsets = buildLineOffsets(text);
+        const resolved = [];
+        let docIdx = 0;
+        for (const rawDoc of rawDocs) {
+            const currentDocIdx = docIdx++;
+            const sourceLine = offsets[currentDocIdx] ?? 0;
+            const positionIndex = buildPositionIndex(parsedDocuments[currentDocIdx], lineOffsets);
+            if (rawDoc === null || rawDoc === undefined)
+                continue;
+            const kind = rawDoc.kind;
+            if (kind && SYSTEM_KINDS.has(kind)) {
+                throw new Error(`Included file '${source}' contains '${kind}' which is not allowed in partial files. ` +
+                    `Only the owner telo.yaml may declare ${kind} resources.`);
+            }
+            let compiledDocs;
+            if (options?.compile) {
+                try {
+                    const result = precompileDoc(rawDoc, this.celEnv);
+                    compiledDocs = Array.isArray(result) ? result : [result];
+                }
+                catch (error) {
+                    throw new Error(`Failed to compile manifest in ${source}: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+            else {
+                compiledDocs = [rawDoc];
+            }
+            for (const doc of compiledDocs) {
+                if (doc === null || doc === undefined)
+                    continue;
+                const manifest = doc;
+                const metadata = {
+                    ...manifest.metadata,
+                    source,
+                    sourceLine,
+                    ...(ownerModuleName && !manifest.metadata?.module ? { module: ownerModuleName } : {}),
+                };
+                Object.defineProperty(metadata, "positionIndex", {
+                    value: positionIndex,
+                    enumerable: false,
+                    writable: true,
+                    configurable: true,
+                });
+                resolved.push({ ...manifest, metadata });
+            }
+        }
+        return resolved;
+    }
+    async loadModuleForFile(fileUrl) {
+        // Try loading as a regular module first (it might be a telo.yaml itself).
+        // Use loadManifests (not loadModule) so imported definitions are included —
+        // otherwise the analyzer won't know about kinds from Telo.Import sources.
+        try {
+            const docs = await this.loadModule(fileUrl);
+            const hasModule = docs.some((d) => isModuleKind(d.kind));
+            if (hasModule) {
+                const { source } = await this.pick(fileUrl).read(fileUrl);
+                const manifests = await this.loadManifests(fileUrl);
+                return { ownerUrl: source, manifests, sourceManifests: groupBySource(manifests) };
+            }
+        }
+        catch (err) {
+            // If the file looks like an owner manifest (named telo.yaml), rethrow —
+            // a broken owner shouldn't silently fall through to parent lookup.
+            const normalized = fileUrl.replace(/\\/g, "/");
+            if (normalized.endsWith(`/${DEFAULT_MANIFEST_FILENAME}`) || normalized === DEFAULT_MANIFEST_FILENAME) {
+                throw err;
+            }
+            // Otherwise fall through to owner lookup — this is likely a partial file
+        }
+        // Find the owning telo.yaml via parent-directory traversal
+        const adapter = this.pick(fileUrl);
+        if (!adapter.resolveOwnerOf)
+            return null;
+        const ownerUrl = await adapter.resolveOwnerOf(fileUrl);
+        if (!ownerUrl)
+            return null;
+        // Load the owner module (which will load included files via include expansion)
+        const manifests = await this.loadManifests(ownerUrl);
+        return { ownerUrl, manifests, sourceManifests: groupBySource(manifests) };
+    }
     async loadModuleGraph(entryUrl, onError) {
         const visited = new Set([entryUrl]);
         const result = new Map();
@@ -116,7 +246,7 @@ export class Loader {
         const queue = [...entry];
         while (queue.length > 0) {
             const m = queue.shift();
-            if (m.kind !== "Kernel.Import")
+            if (m.kind !== "Telo.Import")
                 continue;
             const importSource = m.source;
             if (!importSource)
@@ -139,7 +269,7 @@ export class Loader {
             }
             result.set(importUrl, imported);
             for (const im of imported) {
-                if (im.kind === "Kernel.Import")
+                if (im.kind === "Telo.Import")
                     queue.push(im);
             }
         }
@@ -152,7 +282,7 @@ export class Loader {
         const queue = [...entry];
         while (queue.length > 0) {
             const m = queue.shift();
-            if (m.kind !== "Kernel.Import")
+            if (m.kind !== "Telo.Import")
                 continue;
             const importSource = m.source;
             if (!importSource)
@@ -173,7 +303,18 @@ export class Loader {
                 e.sourceLine = m.metadata?.sourceLine ?? 0;
                 throw e;
             }
-            const importedModule = imported.find((im) => im.kind === "Kernel.Module");
+            // Import target must be a Telo.Library. Check the Library branch
+            // explicitly rather than "anything that's a module kind" so that a
+            // future third kind can't silently slip past as a valid import target.
+            const importedLibrary = imported.find((im) => im.kind === "Telo.Library");
+            const importedApplication = imported.find((im) => im.kind === "Telo.Application");
+            if (importedApplication) {
+                const e = new Error(`Telo.Import target '${importSource}' is a Telo.Application. ` +
+                    `Only Telo.Library modules may be imported. Applications are run directly, not imported.`);
+                e.sourceLine = m.metadata?.sourceLine ?? 0;
+                throw e;
+            }
+            const importedModule = importedLibrary;
             if (importedModule?.metadata?.name) {
                 const pi = m.metadata?.positionIndex;
                 m.metadata = {
@@ -191,9 +332,9 @@ export class Loader {
                 }
             }
             for (const im of imported) {
-                if (im.kind === "Kernel.Definition")
+                if (im.kind === "Telo.Definition")
                     importedDefs.push(im);
-                if (im.kind === "Kernel.Import")
+                if (im.kind === "Telo.Import")
                     queue.push(im);
             }
         }
@@ -224,6 +365,19 @@ function cloneManifestValue(value) {
     }
     return value;
 }
+function groupBySource(manifests) {
+    const map = new Map();
+    for (const m of manifests) {
+        const src = m.metadata?.source ?? "unknown";
+        let list = map.get(src);
+        if (!list) {
+            list = [];
+            map.set(src, list);
+        }
+        list.push(m);
+    }
+    return map;
+}
 function documentLineOffsets(text) {
     const offsets = [0];
     const lines = text.split("\n");

package/dist/module-kinds.d.ts

@@ -0,0 +1,4 @@
+export declare const MODULE_KINDS: readonly ["Telo.Application", "Telo.Library"];
+export type ModuleKind = (typeof MODULE_KINDS)[number];
+export declare function isModuleKind(kind: string | undefined): kind is ModuleKind;
+//# sourceMappingURL=module-kinds.d.ts.map

package/dist/module-kinds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-kinds.d.ts","sourceRoot":"","sources":["../src/module-kinds.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,YAAY,+CAAgD,CAAC;AAC1E,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,IAAI,UAAU,CAEzE"}

package/dist/module-kinds.js

@@ -0,0 +1,4 @@
+export const MODULE_KINDS = ["Telo.Application", "Telo.Library"];
+export function isModuleKind(kind) {
+    return kind === "Telo.Application" || kind === "Telo.Library";
+}

package/dist/normalize-inline-resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"normalize-inline-resources.d.ts","sourceRoot":"","sources":["../src/normalize-inline-resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASzD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE,aAAa,GACtB,gBAAgB,EAAE,CAkDpB"}
+{"version":3,"file":"normalize-inline-resources.d.ts","sourceRoot":"","sources":["../src/normalize-inline-resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAczD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE,aAAa,GACtB,gBAAgB,EAAE,CAkDpB"}

package/dist/normalize-inline-resources.js

@@ -1,5 +1,10 @@
 import { isRefEntry, isScopeEntry, isInlineResource } from "./reference-field-map.js";
-const SYSTEM_KINDS = new Set(["Kernel.Definition", "Kernel.Module", "Kernel.Import"]);
+const SYSTEM_KINDS = new Set([
+    "Telo.Definition",
+    "Telo.Application",
+    "Telo.Library",
+    "Telo.Import",
+]);
 /** Replaces characters outside [a-zA-Z0-9_] with underscores. */
 function sanitizeName(raw) {
     return raw.replace(/[^a-zA-Z0-9_]/g, "_");

package/dist/precompile.d.ts

@@ -1,9 +1,10 @@
+import type { Environment } from "@marcbachmann/cel-js";
 /**
  * Walks a raw YAML document and replaces all "${{ expr }}" strings with
  * CompiledValue wrappers. Throws on CEL syntax errors.
  * Intended to be called once per document at load time.
- * Kernel.Definition documents are returned unchanged — their schema fields
+ * Telo.Definition documents are returned unchanged — their schema fields
  * are static metadata and must not be treated as CEL templates.
  */
-export declare function precompileDoc(doc: unknown): unknown;
+export declare function precompileDoc(doc: unknown, env: Environment): unknown;
 //# sourceMappingURL=precompile.d.ts.map

package/dist/precompile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"precompile.d.ts","sourceRoot":"","sources":["../src/precompile.ts"],"names":[],"mappings":"AAMA;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAanD"}
+{"version":3,"file":"precompile.d.ts","sourceRoot":"","sources":["../src/precompile.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAKxD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAarE"}

package/dist/precompile.js

@@ -1,36 +1,36 @@
-import { celEnvironment } from "./cel-environment.js";
 const TEMPLATE_REGEX = /\$\{\{\s*([^}]+?)\s*\}\}/g;
 const EXACT_TEMPLATE_REGEX = /^\s*\$\{\{\s*([^}]+?)\s*\}\}\s*$/;
 /**
  * Walks a raw YAML document and replaces all "${{ expr }}" strings with
  * CompiledValue wrappers. Throws on CEL syntax errors.
  * Intended to be called once per document at load time.
- * Kernel.Definition documents are returned unchanged — their schema fields
+ * Telo.Definition documents are returned unchanged — their schema fields
  * are static metadata and must not be treated as CEL templates.
  */
-export function precompileDoc(doc) {
+export function precompileDoc(doc, env) {
     if (typeof doc === "string")
-        return compileString(doc);
+        return compileString(doc, env);
     if (Array.isArray(doc))
-        return doc.map(precompileDoc);
+        return doc.map((item) => precompileDoc(item, env));
     // Only recurse into plain objects. Class instances (ResourceInstance, ScopeHandle, etc.)
     // are returned as-is — their prototype methods must not be lost by object reconstruction.
     if (doc !== null && typeof doc === "object" && Object.getPrototypeOf(doc) === Object.prototype) {
         const result = {};
         for (const [k, v] of Object.entries(doc)) {
-            result[k] = precompileDoc(v);
+            result[k] = precompileDoc(v, env);
         }
         return result;
     }
     return doc;
 }
-function compileString(s) {
+function compileString(s, env) {
     if (!s.includes("${{"))
         return s;
     const exact = s.match(EXACT_TEMPLATE_REGEX);
     if (exact) {
-        const fn = celEnvironment.parse(exact[1].trim());
-        return { __compiled: true, call: (ctx) => fn(ctx) };
+        const expr = exact[1].trim();
+        const fn = env.parse(expr);
+        return { __compiled: true, source: expr, call: (ctx) => fn(ctx) };
     }
     // Interpolated template — collect literal parts + compiled sub-expressions
     const parts = [];
@@ -38,14 +38,16 @@ function compileString(s) {
     for (const m of s.matchAll(TEMPLATE_REGEX)) {
         if (m.index > last)
             parts.push(s.slice(last, m.index));
-        const fn = celEnvironment.parse(m[1].trim());
-        parts.push({ __compiled: true, call: (ctx) => fn(ctx) });
+        const expr = m[1].trim();
+        const fn = env.parse(expr);
+        parts.push({ __compiled: true, source: expr, call: (ctx) => fn(ctx) });
         last = m.index + m[0].length;
     }
     if (last < s.length)
         parts.push(s.slice(last));
     return {
         __compiled: true,
+        source: s,
         call: (ctx) => parts.map((p) => (typeof p === "string" ? p : String(p.call(ctx) ?? ""))).join(""),
     };
 }

package/dist/reference-field-map.d.ts

@@ -1,6 +1,6 @@
 /** An entry for a field that carries one or more x-telo-ref constraints. */
 export interface RefFieldEntry {
-    /** One or more canonical ref strings ("namespace/module#TypeName" or "kernel#TypeName").
+    /** One or more canonical ref strings ("namespace/module#TypeName" or "telo#TypeName").
      *  Multiple entries arise from anyOf branches. */
     refs: string[];
     /** True when the field path traversed through at least one array (path contains "[]"). */

package/dist/resolve-throws-union.d.ts

@@ -0,0 +1,30 @@
+import type { ResourceManifest } from "@telorun/sdk";
+import type { AliasResolver } from "./alias-resolver.js";
+import type { DefinitionRegistry } from "./definition-registry.js";
+export interface ThrowsCodeMeta {
+    data?: Record<string, any>;
+}
+export interface ThrowsUnion {
+    /** Code → per-code metadata (data schema, etc). Keys are the declared codes. */
+    codes: Map<string, ThrowsCodeMeta>;
+    /** True when the union cannot be fully resolved statically — e.g. a
+     *  `passthrough` call site uses a CEL expression the analyzer can't narrow,
+     *  an unknown kind was encountered, or a cycle short-circuited resolution.
+     *  Callers must treat unbounded unions as requiring a catch-all entry. */
+    unbounded: boolean;
+}
+export interface ResolveCtx {
+    allManifests: ResourceManifest[];
+    defs: DefinitionRegistry;
+    aliases: AliasResolver;
+    memo: Map<string, ThrowsUnion>;
+    inProgress: Set<string>;
+}
+export declare function createResolveCtx(allManifests: ResourceManifest[], defs: DefinitionRegistry, aliases: AliasResolver): ResolveCtx;
+/** Resolve the effective throw union for a named manifest. The result combines
+ *  explicit `throws.codes`, `throws.inherit: true` dataflow (step-context
+ *  traversal with try/catch subtraction), and unbounded markers for
+ *  unresolvable passthrough call sites. Cycles short-circuit to an empty
+ *  result so resolution always terminates. */
+export declare function resolveThrowsUnion(manifest: ResourceManifest, ctx: ResolveCtx): ThrowsUnion;
+//# sourceMappingURL=resolve-throws-union.d.ts.map

package/dist/resolve-throws-union.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-throws-union.d.ts","sourceRoot":"","sources":["../src/resolve-throws-union.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,gFAAgF;IAChF,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACnC;;;8EAG0E;IAC1E,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC/B,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACzB;AAED,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,gBAAgB,EAAE,EAChC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,GACrB,UAAU,CAQZ;AA+BD;;;;8CAI8C;AAC9C,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,gBAAgB,EAC1B,GAAG,EAAE,UAAU,GACd,WAAW,CA+Cb"}