@telorun/analyzer 0.1.3 → 0.2.0

package/dist/resolve-throws-union.js

@@ -0,0 +1,252 @@
+export function createResolveCtx(allManifests, defs, aliases) {
+    return {
+        allManifests,
+        defs,
+        aliases,
+        memo: new Map(),
+        inProgress: new Set(),
+    };
+}
+function emptyUnion() {
+    return { codes: new Map(), unbounded: false };
+}
+function unionInto(target, src) {
+    for (const [code, meta] of src.codes) {
+        if (!target.codes.has(code))
+            target.codes.set(code, meta);
+    }
+    if (src.unbounded)
+        target.unbounded = true;
+}
+function definitionFor(kind, defs, aliases) {
+    const resolved = aliases.resolveKind(kind);
+    return defs.resolve(kind) ?? (resolved ? defs.resolve(resolved) : undefined);
+}
+function codesFromDefinition(definition) {
+    const out = new Map();
+    const raw = definition.throws?.codes ?? {};
+    for (const [code, meta] of Object.entries(raw)) {
+        out.set(code, { data: meta.data });
+    }
+    return out;
+}
+/** Resolve the effective throw union for a named manifest. The result combines
+ *  explicit `throws.codes`, `throws.inherit: true` dataflow (step-context
+ *  traversal with try/catch subtraction), and unbounded markers for
+ *  unresolvable passthrough call sites. Cycles short-circuit to an empty
+ *  result so resolution always terminates. */
+export function resolveThrowsUnion(manifest, ctx) {
+    const name = manifest.metadata?.name;
+    if (name) {
+        const cached = ctx.memo.get(name);
+        if (cached)
+            return cached;
+        if (ctx.inProgress.has(name))
+            return emptyUnion();
+    }
+    const definition = definitionFor(manifest.kind, ctx.defs, ctx.aliases);
+    if (!definition) {
+        const u = { codes: new Map(), unbounded: true };
+        if (name)
+            ctx.memo.set(name, u);
+        return u;
+    }
+    const throws = definition.throws;
+    if (!throws) {
+        const u = emptyUnion();
+        if (name)
+            ctx.memo.set(name, u);
+        return u;
+    }
+    if (name)
+        ctx.inProgress.add(name);
+    try {
+        const result = { codes: new Map(), unbounded: false };
+        for (const [code, meta] of codesFromDefinition(definition)) {
+            result.codes.set(code, meta);
+        }
+        if (throws.passthrough) {
+            // Definition-level passthrough can't be resolved without a call site.
+            // resolveStepInvokeThrows handles passthrough call sites directly.
+            result.unbounded = true;
+        }
+        if (throws.inherit) {
+            const inherited = resolveInherited(manifest, definition, ctx);
+            unionInto(result, inherited);
+        }
+        if (name)
+            ctx.memo.set(name, result);
+        return result;
+    }
+    finally {
+        if (name)
+            ctx.inProgress.delete(name);
+    }
+}
+function resolveInherited(manifest, definition, ctx) {
+    const result = { codes: new Map(), unbounded: false };
+    const props = definition.schema?.properties;
+    if (!props)
+        return result;
+    for (const [fieldName, fieldSchema] of Object.entries(props)) {
+        const stepCtx = fieldSchema["x-telo-step-context"];
+        if (!stepCtx?.invoke)
+            continue;
+        const steps = manifest[fieldName];
+        if (!Array.isArray(steps))
+            continue;
+        unionInto(result, collectStepArrayThrows(steps, stepCtx.invoke, undefined, ctx));
+    }
+    return result;
+}
+function collectStepArrayThrows(steps, invokeField, enclosingTryCodes, ctx) {
+    const result = emptyUnion();
+    for (const step of steps) {
+        if (!step || typeof step !== "object")
+            continue;
+        unionInto(result, collectStepThrows(step, invokeField, enclosingTryCodes, ctx));
+    }
+    return result;
+}
+/** Walk one step, dispatching by shape. Generic for any Run.Sequence-style
+ *  composer: the step keys it recognises (`try` / `catch` / `finally` / `then`
+ *  / `else` / `elseif` / `do` / `cases` / `default`) are the same set already
+ *  traversed by the analyzer's `x-telo-step-context` schema builder, so future
+ *  composers that reuse those shape conventions work without changes here. */
+function collectStepThrows(step, invokeField, enclosingTryCodes, ctx) {
+    if (step[invokeField]) {
+        return resolveStepInvokeThrows(step, invokeField, enclosingTryCodes, ctx);
+    }
+    if (step.throw && typeof step.throw === "object") {
+        return resolveThrowStepCode(step.throw, enclosingTryCodes);
+    }
+    if (Array.isArray(step.try)) {
+        const tryUnion = collectStepArrayThrows(step.try, invokeField, enclosingTryCodes, ctx);
+        let propagated;
+        if (Array.isArray(step.catch)) {
+            // Catch absorbs the try block's codes; the catch's own throws propagate
+            // out instead. Sequence-specific subtraction — the plan explicitly
+            // anchors this to Run.Sequence's try/catch schema shape.
+            const tryCodes = new Set(tryUnion.codes.keys());
+            propagated = collectStepArrayThrows(step.catch, invokeField, tryCodes, ctx);
+            // Unbounded in the try block still signals the caller to expect
+            // arbitrary codes to flow through the catch (e.g. via passthrough).
+            if (tryUnion.unbounded)
+                propagated.unbounded = true;
+        }
+        else {
+            propagated = cloneUnion(tryUnion);
+        }
+        if (Array.isArray(step.finally)) {
+            unionInto(propagated, collectStepArrayThrows(step.finally, invokeField, enclosingTryCodes, ctx));
+        }
+        return propagated;
+    }
+    if (Array.isArray(step.then)) {
+        const result = emptyUnion();
+        unionInto(result, collectStepArrayThrows(step.then, invokeField, enclosingTryCodes, ctx));
+        if (Array.isArray(step.else)) {
+            unionInto(result, collectStepArrayThrows(step.else, invokeField, enclosingTryCodes, ctx));
+        }
+        if (Array.isArray(step.elseif)) {
+            for (const branch of step.elseif) {
+                if (Array.isArray(branch?.then)) {
+                    unionInto(result, collectStepArrayThrows(branch.then, invokeField, enclosingTryCodes, ctx));
+                }
+            }
+        }
+        return result;
+    }
+    if (Array.isArray(step.do)) {
+        return collectStepArrayThrows(step.do, invokeField, enclosingTryCodes, ctx);
+    }
+    if (step.cases && typeof step.cases === "object") {
+        const result = emptyUnion();
+        for (const arr of Object.values(step.cases)) {
+            if (Array.isArray(arr)) {
+                unionInto(result, collectStepArrayThrows(arr, invokeField, enclosingTryCodes, ctx));
+            }
+        }
+        if (Array.isArray(step.default)) {
+            unionInto(result, collectStepArrayThrows(step.default, invokeField, enclosingTryCodes, ctx));
+        }
+        return result;
+    }
+    return emptyUnion();
+}
+function cloneUnion(u) {
+    const out = emptyUnion();
+    for (const [c, m] of u.codes)
+        out.codes.set(c, m);
+    out.unbounded = u.unbounded;
+    return out;
+}
+function resolveStepInvokeThrows(step, invokeField, enclosingTryCodes, ctx) {
+    const invokeRef = step[invokeField];
+    if (!invokeRef || typeof invokeRef !== "object")
+        return emptyUnion();
+    const invokedKind = invokeRef.kind;
+    if (!invokedKind)
+        return emptyUnion();
+    const definition = definitionFor(invokedKind, ctx.defs, ctx.aliases);
+    if (!definition)
+        return { codes: new Map(), unbounded: true };
+    if (definition.throws?.passthrough) {
+        return resolvePassthroughAtCallSite(step, enclosingTryCodes);
+    }
+    // Named manifest: resolve the full chain (covers transitive inherit).
+    const invokeName = invokeRef.name;
+    if (invokeName) {
+        const target = ctx.allManifests.find((m) => m.metadata?.name === invokeName &&
+            (m.kind === invokedKind ||
+                ctx.aliases.resolveKind(m.kind) === invokedKind ||
+                m.kind === ctx.aliases.resolveKind(invokedKind)));
+        if (target)
+            return resolveThrowsUnion(target, ctx);
+    }
+    // Fall back to the definition's own explicit codes. Mark unbounded when the
+    // definition depends on call-site or transitive resolution we couldn't
+    // perform (no specific target manifest to recurse into).
+    const codes = codesFromDefinition(definition);
+    const unbounded = definition.throws?.inherit === true || definition.throws?.passthrough === true;
+    return { codes, unbounded };
+}
+/** Resolve a passthrough-style invocable at a specific call site. Recognised forms
+ *  (see "passthrough: true" in the plan):
+ *  - constant literal (no template) → `{ <literal> }`
+ *  - `${{ 'FOO' }}` constant expression → `{ FOO }`
+ *  - `${{ error.code }}` inside a catch → enclosing try's propagated union
+ *  Anything else is unbounded; the analyzer flags it downstream. */
+function resolvePassthroughAtCallSite(step, enclosingTryCodes) {
+    return resolveCodeExpression(step.inputs?.code, enclosingTryCodes);
+}
+/** Resolve the `code:` of a `throw:` step to a throws union. Uses the same
+ *  recognised forms as passthrough call sites. */
+function resolveThrowStepCode(throwSpec, enclosingTryCodes) {
+    return resolveCodeExpression(throwSpec.code, enclosingTryCodes);
+}
+function resolveCodeExpression(codeInput, enclosingTryCodes) {
+    if (typeof codeInput !== "string" || codeInput.length === 0) {
+        return { codes: new Map(), unbounded: true };
+    }
+    const match = codeInput.match(/^\s*\$\{\{\s*([\s\S]+?)\s*\}\}\s*$/);
+    if (!match) {
+        return { codes: new Map([[codeInput, {}]]), unbounded: false };
+    }
+    const expr = match[1].trim();
+    const litMatch = expr.match(/^'([^']+)'$|^"([^"]+)"$/);
+    if (litMatch) {
+        const code = litMatch[1] ?? litMatch[2];
+        return { codes: new Map([[code, {}]]), unbounded: false };
+    }
+    if (expr === "error.code") {
+        if (enclosingTryCodes) {
+            const codes = new Map();
+            for (const c of enclosingTryCodes)
+                codes.set(c, {});
+            return { codes, unbounded: false };
+        }
+        return { codes: new Map(), unbounded: true };
+    }
+    return { codes: new Map(), unbounded: true };
+}

package/dist/types.d.ts

@@ -42,6 +42,14 @@ export interface ManifestAdapter {
         source: string;
     }>;
     resolveRelative(base: string, relative: string): string;
+    /** Expand glob patterns relative to a base source. Returns sources in the same
+     *  format as read().source — suitable to pass back into read() / resolveRelative().
+     *  Optional — only filesystem-capable adapters implement this. */
+    expandGlob?(base: string, patterns: string[]): Promise<string[]>;
+    /** Walk parent directories from fileUrl looking for the nearest telo.yaml.
+     *  Returns the source in the same format as read().source, or null if none found.
+     *  Optional — only filesystem-capable adapters implement this. */
+    resolveOwnerOf?(fileUrl: string): Promise<string | null>;
 }
 export interface LoadOptions {
     /** When true, each YAML document is passed through the CEL precompiler before being
@@ -59,6 +67,9 @@ export interface LoaderInitOptions {
     includeRegistryAdapter?: boolean;
     /** Base URL used by built-in RegistryAdapter when enabled. */
     registryUrl?: string;
+    /** Handlers for CEL stdlib functions (e.g. `sha256`). Analyzer-only callers may
+     *  omit this and get throwing stubs; runtime callers (kernel) must supply real impls. */
+    celHandlers?: import("./cel-environment.js").CelHandlers;
 }
 export interface AnalysisOptions {
     strictContexts?: boolean;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;qHACqH;AACrH,eAAO,MAAM,kBAAkB;;;;;CAKrB,CAAC;AACX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAC;AAE9F,gFAAgF;AAChF,eAAO,MAAM,yBAAyB,cAAc,CAAC;AAErD,MAAM,WAAW,QAAQ;IACvB,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,KAAK;IACpB,KAAK,EAAE,QAAQ,CAAC;IAChB,GAAG,EAAE,QAAQ,CAAC;CACf;AAED;;oDAEoD;AACpD,MAAM,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAE/C;6EAC6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,2BAA2B;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;CACzD;AAED,MAAM,WAAW,WAAW;IAC1B;;;+EAG2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,aAAa,CAAC,EAAE,eAAe,EAAE,CAAC;IAClC,sDAAsD;IACtD,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,0DAA0D;IAC1D,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;gEAKgE;AAChE,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,OAAO,qBAAqB,EAAE,aAAa,CAAC;IACtD,WAAW,CAAC,EAAE,OAAO,0BAA0B,EAAE,kBAAkB,CAAC;CACrE"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;qHACqH;AACrH,eAAO,MAAM,kBAAkB;;;;;CAKrB,CAAC;AACX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAC;AAE9F,gFAAgF;AAChF,eAAO,MAAM,yBAAyB,cAAc,CAAC;AAErD,MAAM,WAAW,QAAQ;IACvB,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,KAAK;IACpB,KAAK,EAAE,QAAQ,CAAC;IAChB,GAAG,EAAE,QAAQ,CAAC;CACf;AAED;;oDAEoD;AACpD,MAAM,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAE/C;6EAC6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,2BAA2B;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAExD;;sEAEkE;IAClE,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEjE;;sEAEkE;IAClE,cAAc,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,WAAW;IAC1B;;;+EAG2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,aAAa,CAAC,EAAE,eAAe,EAAE,CAAC;IAClC,sDAAsD;IACtD,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,0DAA0D;IAC1D,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;6FACyF;IACzF,WAAW,CAAC,EAAE,OAAO,sBAAsB,EAAE,WAAW,CAAC;CAC1D;AAED,MAAM,WAAW,eAAe;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;gEAKgE;AAChE,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,OAAO,qBAAqB,EAAE,aAAa,CAAC;IACtD,WAAW,CAAC,EAAE,OAAO,0BAA0B,EAAE,kBAAkB,CAAC;CACrE"}

package/dist/validate-cel-context.js

@@ -8,7 +8,7 @@ export function resolveTypeFieldToSchema(value, allManifests) {
     if (!value)
         return undefined;
     if (typeof value === "string") {
-        // Named type reference — find a Kernel.Type resource by name
+        // Named type reference — find a Telo.Type resource by name
         const typeManifest = allManifests.find((m) => m.metadata?.name === value &&
             typeof m.kind === "string" &&
             /\bType\b/.test(m.kind) &&

package/dist/validate-references.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-references.d.ts","sourceRoot":"","sources":["../src/validate-references.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA6C/F;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,GACvB,kBAAkB,EAAE,CAgQtB"}
+{"version":3,"file":"validate-references.d.ts","sourceRoot":"","sources":["../src/validate-references.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAkD/F;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,GACvB,kBAAkB,EAAE,CAkQtB"}

package/dist/validate-references.js

@@ -2,7 +2,12 @@ import { isRefEntry, isScopeEntry, isSchemaFromEntry, isInlineResource, resolveF
 import { navigateJsonPointer } from "./schema-compat.js";
 import { DiagnosticSeverity } from "./types.js";
 const SOURCE = "telo-analyzer";
-const SYSTEM_KINDS = new Set(["Kernel.Definition", "Kernel.Abstract"]);
+/** Kinds skipped by reference validation. Telo.Application and Telo.Library
+ *  are intentionally not here: Application has `targets` with x-telo-ref that
+ *  must be validated, and Library has no ref-bearing fields so flows through
+ *  harmlessly. Telo.Import is also not here for the same reason — its
+ *  `source` field isn't x-telo-ref, so nothing gets checked. */
+const SYSTEM_KINDS = new Set(["Telo.Definition", "Telo.Abstract"]);
 /**
  * Checks whether `kind` satisfies the ref constraint in `entry`.
  * Returns an empty array when valid, or mismatch error strings when not.
@@ -19,7 +24,7 @@ function checkKind(kind, entry, registry, aliases) {
         const targetDef = registry.resolve(targetKind);
         if (!targetDef)
             return [];
-        if (targetDef.kind === "Kernel.Abstract") {
+        if (targetDef.kind === "Telo.Abstract") {
             const implementing = registry.getByExtends(targetKind);
             if (implementing.length === 0)
                 return []; // partial context — no implementations loaded yet
@@ -59,7 +64,7 @@ export function validateReferences(resources, context) {
     if (!aliases || !registry)
         return diagnostics;
     // Build outer resource lookup by name for resolution check.
-    // Exclude system kinds (Kernel.Definition) — they are type blueprints, not instances,
+    // Exclude system kinds (Telo.Definition) — they are type blueprints, not instances,
     // and their names (e.g. "Server", "Job") would shadow user-defined resource instances.
     const byName = new Map();
     for (const r of resources) {
@@ -74,6 +79,7 @@ export function validateReferences(resources, context) {
             continue;
         const resourceLabel = `${r.kind}/${r.metadata.name}`;
         const resourceData = { kind: r.kind, name: r.metadata.name };
+        const filePath = r.metadata?.source;
         // Collect scope visibility prefixes (JSON Pointer → dot prefix) and their manifests.
         // scope field path → flat array of ResourceManifest declared in that scope.
         const scopeManifestsByPointer = new Map();
@@ -131,7 +137,7 @@ export function validateReferences(resources, context) {
                             code: "UNRESOLVED_REFERENCE",
                             source: SOURCE,
                             message: `${resourceLabel}: reference at '${fieldPath}' → resource '${val}' not found`,
-                            data: { resource: resourceData, path: fieldPath },
+                            data: { resource: resourceData, filePath, path: fieldPath },
                         });
                         continue;
                     }
@@ -142,7 +148,7 @@ export function validateReferences(resources, context) {
                             code: "REFERENCE_KIND_MISMATCH",
                             source: SOURCE,
                             message: `${resourceLabel}: reference at '${fieldPath}' → ${kindErrors.join("; ")}`,
-                            data: { resource: resourceData, path: fieldPath },
+                            data: { resource: resourceData, filePath, path: fieldPath },
                         });
                     }
                     continue;
@@ -160,7 +166,7 @@ export function validateReferences(resources, context) {
                         code: "INVALID_REFERENCE",
                         source: SOURCE,
                         message: `${resourceLabel}: reference at '${fieldPath}' must have string 'kind' and 'name' fields`,
-                        data: { resource: resourceData, path: fieldPath },
+                        data: { resource: resourceData, filePath, path: fieldPath },
                     });
                     continue;
                 }
@@ -172,7 +178,7 @@ export function validateReferences(resources, context) {
                         code: "REFERENCE_KIND_MISMATCH",
                         source: SOURCE,
                         message: `${resourceLabel}: reference at '${fieldPath}' → ${kindErrors.join("; ")}`,
-                        data: { resource: resourceData, path: fieldPath },
+                        data: { resource: resourceData, filePath, path: fieldPath },
                     });
                 }
                 // 3. Resolution check — resource with this name must exist.
@@ -184,7 +190,7 @@ export function validateReferences(resources, context) {
                         code: "UNRESOLVED_REFERENCE",
                         source: SOURCE,
                         message: `${resourceLabel}: reference at '${fieldPath}' → resource '${refVal.name}' not found`,
-                        data: { resource: resourceData, path: fieldPath },
+                        data: { resource: resourceData, filePath, path: fieldPath },
                     });
                 }
             }
@@ -202,6 +208,7 @@ export function validateReferences(resources, context) {
             continue;
         const resourceLabel = `${r.kind}/${r.metadata.name}`;
         const resourceData = { kind: r.kind, name: r.metadata.name };
+        const filePath = r.metadata?.source;
         for (const [fieldPath, entry] of fieldMap) {
             if (!isSchemaFromEntry(entry))
                 continue;
@@ -215,7 +222,7 @@ export function validateReferences(resources, context) {
                     code: "INVALID_SCHEMA_FROM",
                     source: SOURCE,
                     message: `${resourceLabel}: x-telo-schema-from "${schemaFrom}" must contain at least one "/" to separate anchor from JSON Pointer`,
-                    data: { resource: resourceData, path: fieldPath },
+                    data: { resource: resourceData, filePath, path: fieldPath },
                 });
                 continue;
             }
@@ -255,7 +262,7 @@ export function validateReferences(resources, context) {
                         code: "SCHEMA_FROM_MISSING_PATH",
                         source: SOURCE,
                         message: `${resourceLabel}: x-telo-schema-from at '${fieldPath}' → kind '${refVal.kind}' has no schema`,
-                        data: { resource: resourceData, path: fieldPath },
+                        data: { resource: resourceData, filePath, path: fieldPath },
                     });
                     continue;
                 }
@@ -266,7 +273,7 @@ export function validateReferences(resources, context) {
                         code: "SCHEMA_FROM_MISSING_PATH",
                         source: SOURCE,
                         message: `${resourceLabel}: x-telo-schema-from at '${fieldPath}' → kind '${refVal.kind}' has no schema path '${jsonPointer}'`,
-                        data: { resource: resourceData, path: fieldPath },
+                        data: { resource: resourceData, filePath, path: fieldPath },
                     });
                     continue;
                 }
@@ -277,7 +284,7 @@ export function validateReferences(resources, context) {
                         code: "DEPENDENT_SCHEMA_MISMATCH",
                         source: SOURCE,
                         message: `${resourceLabel}: '${fieldPath}' does not match schema from '${refVal.kind}${jsonPointer}': ${issue}`,
-                        data: { resource: resourceData, path: fieldPath },
+                        data: { resource: resourceData, filePath, path: fieldPath },
                     });
                 }
             }

package/dist/validate-throws-coverage.d.ts

@@ -0,0 +1,8 @@
+import type { Environment } from "@marcbachmann/cel-js";
+import type { ResourceManifest } from "@telorun/sdk";
+import type { AliasResolver } from "./alias-resolver.js";
+import type { DefinitionRegistry } from "./definition-registry.js";
+import { type AnalysisDiagnostic } from "./types.js";
+/** Entry point — invoked once per analyze() run. */
+export declare function validateThrowsCoverage(manifests: ResourceManifest[], defs: DefinitionRegistry, aliases: AliasResolver, env: Environment): AnalysisDiagnostic[];
+//# sourceMappingURL=validate-throws-coverage.d.ts.map

package/dist/validate-throws-coverage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-throws-coverage.d.ts","sourceRoot":"","sources":["../src/validate-throws-coverage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAOnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AA4dzE,oDAAoD;AACpD,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,WAAW,GACf,kBAAkB,EAAE,CAwCtB"}