@telorun/analyzer 0.1.4 → 0.2.1

package/README.md

@@ -34,7 +34,7 @@ Manifests also support directives for dynamic generation: `$let`, `$if`, `$for`,
 Here is an example Telo application that defines a simple HTTP API:
 
 ```yaml
-kind: Kernel.Module
+kind: Telo.Application
 metadata:
   name: feedback
   version: 1.0.0
@@ -45,12 +45,12 @@ targets:
   - Migrations
   - Server
 ---
-kind: Kernel.Import
+kind: Telo.Import
 metadata:
   name: Http
 source: ../modules/http-server
 ---
-kind: Kernel.Import
+kind: Telo.Import
 metadata:
   name: Sql
 source: ../modules/sql

package/dist/analyzer.d.ts

@@ -1,7 +1,13 @@
 import type { ResourceManifest } from "@telorun/sdk";
 import { AnalysisRegistry } from "./analysis-registry.js";
+import { type CelHandlers } from "./cel-environment.js";
 import { type AnalysisDiagnostic, type AnalysisOptions } from "./types.js";
+export interface StaticAnalyzerOptions {
+    celHandlers?: CelHandlers;
+}
 export declare class StaticAnalyzer {
+    private readonly celEnv;
+    constructor(options?: StaticAnalyzerOptions);
     analyze(manifests: ResourceManifest[], options?: AnalysisOptions, registry?: AnalysisRegistry): AnalysisDiagnostic[];
     analyzeErrors(manifests: ResourceManifest[], options?: AnalysisOptions, registry?: AnalysisRegistry): AnalysisDiagnostic[];
     normalize(manifests: ResourceManifest[], registry: AnalysisRegistry): ResourceManifest[];

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAY1D,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA0O/F,qBAAa,cAAc;IACzB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAoPvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,GAAG,gBAAgB,EAAE;IAKxF,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAiB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAY9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAsP/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IA0PvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,GAAG,gBAAgB,EAAE;IAKxF,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAiB5F"}

package/dist/analyzer.js

@@ -1,13 +1,15 @@
 import { AliasResolver } from "./alias-resolver.js";
-import { buildTypedCelEnvironment, celEnvironment } from "./cel-environment.js";
+import { buildCelEnvironment, buildTypedCelEnvironment, } from "./cel-environment.js";
 import { DefinitionRegistry } from "./definition-registry.js";
 import { buildDependencyGraph, formatCycle } from "./dependency-graph.js";
 import { buildKernelGlobalsSchema, mergeKernelGlobalsIntoContext } from "./kernel-globals.js";
+import { isModuleKind } from "./module-kinds.js";
 import { normalizeInlineResources } from "./normalize-inline-resources.js";
 import { celTypeSatisfiesJsonSchema, substituteCelFields, validateAgainstSchema, } from "./schema-compat.js";
 import { DiagnosticSeverity } from "./types.js";
 import { extractAccessChains, getManifestItem, pathMatchesScope, resolveContextAnnotations, resolveTypeFieldToSchema, validateChainAgainstSchema, } from "./validate-cel-context.js";
 import { validateReferences } from "./validate-references.js";
+import { validateThrowsCoverage } from "./validate-throws-coverage.js";
 const TEMPLATE_REGEX = /\$\{\{\s*([^}]+?)\s*\}\}/g;
 function walkCelExpressions(value, path, cb) {
     if (typeof value === "string") {
@@ -133,19 +135,19 @@ const CEL_PURE_RE = /^\s*\$\{\{[^}]*\}\}\s*$/;
 const CEL_EXPR_RE = /\$\{\{\s*([^}]+?)\s*\}\}/;
 /** Recursively walk `data`+`schema` together, type-checking every pure CEL template
  *  string via `env.check()`. Returns `SchemaIssue[]` for any type mismatches found. */
-function collectCelTypeIssues(data, schema, path, definition, manifest, baseEnv) {
+function collectCelTypeIssues(data, schema, path, definition, manifest, baseTypedEnv, rootEnv) {
     const issues = [];
     if (typeof data === "string" && CEL_PURE_RE.test(data)) {
         const exprMatch = data.match(CEL_EXPR_RE);
         if (exprMatch) {
             const expr = exprMatch[1].trim();
             // Merge x-telo-context variables for this path if applicable
-            let typedEnv = baseEnv;
+            let typedEnv = baseTypedEnv;
             if (definition.schema) {
                 for (const ctx of extractContextsFromSchema(definition.schema)) {
                     if (!pathMatchesScope(path, ctx.scope))
                         continue;
-                    typedEnv = buildTypedCelEnvironment(manifest, ctx.schema);
+                    typedEnv = buildTypedCelEnvironment(rootEnv, manifest, ctx.schema);
                     break;
                 }
             }
@@ -156,7 +158,16 @@ function collectCelTypeIssues(data, schema, path, definition, manifest, baseEnv)
             catch {
                 /* degrade gracefully */
             }
-            if (checkResult?.valid && checkResult.type && schema) {
+            if (checkResult?.valid === false && checkResult.error) {
+                // env.check() rejected the expression itself — e.g. wrong method, wrong
+                // argument types, wrong operator overload. Surface the first line of the
+                // error message; the tail is a source-code caret diagram we don't need.
+                const message = String(checkResult.error.message ?? checkResult.error)
+                    .split("\n")[0]
+                    .trim();
+                issues.push({ message: `CEL type error: ${message}`, path });
+            }
+            else if (checkResult?.valid && checkResult.type && schema) {
                 const celType = checkResult.type.split("<")[0];
                 if (!celTypeSatisfiesJsonSchema(celType, schema)) {
                     issues.push({
@@ -171,18 +182,22 @@ function collectCelTypeIssues(data, schema, path, definition, manifest, baseEnv)
     if (Array.isArray(data)) {
         const itemSchema = (schema.items ?? {});
         for (let i = 0; i < data.length; i++) {
-            issues.push(...collectCelTypeIssues(data[i], itemSchema, `${path}[${i}]`, definition, manifest, baseEnv));
+            issues.push(...collectCelTypeIssues(data[i], itemSchema, `${path}[${i}]`, definition, manifest, baseTypedEnv, rootEnv));
         }
     }
     else if (data !== null && typeof data === "object") {
         const props = (schema.properties ?? {});
         for (const [k, v] of Object.entries(data)) {
-            issues.push(...collectCelTypeIssues(v, (props[k] ?? {}), path ? `${path}.${k}` : k, definition, manifest, baseEnv));
+            issues.push(...collectCelTypeIssues(v, (props[k] ?? {}), path ? `${path}.${k}` : k, definition, manifest, baseTypedEnv, rootEnv));
         }
     }
     return issues;
 }
 export class StaticAnalyzer {
+    celEnv;
+    constructor(options = {}) {
+        this.celEnv = buildCelEnvironment(options.celHandlers);
+    }
     analyze(manifests, options, registry) {
         const diagnostics = [];
         // Use pre-seeded registries from the provided AnalysisRegistry, or create fresh ones.
@@ -192,18 +207,19 @@ export class StaticAnalyzer {
         const aliases = ctx?.aliases ?? new AliasResolver();
         const defs = ctx?.definitions ?? new DefinitionRegistry();
         // Register module identities and aliases.
-        // The root Kernel.Module provides its own identity; imported modules surface their
-        // identity via resolvedModuleName/resolvedNamespace stamped onto the Kernel.Import
-        // by the loader (so we don't need to include imported Kernel.Module manifests in
-        // the analysis set, avoiding false reference errors in the parent context).
+        // The root module doc (Telo.Application or Telo.Library) provides its own
+        // identity; imported modules surface their identity via resolvedModuleName/
+        // resolvedNamespace stamped onto the Telo.Import by the loader (so we don't
+        // need to include imported module manifests in the analysis set, avoiding false
+        // reference errors in the parent context).
         for (const m of manifests) {
-            if (m.kind === "Kernel.Module") {
+            if (isModuleKind(m.kind)) {
                 const namespace = m.metadata.namespace ?? null;
                 const moduleName = m.metadata.name;
                 if (moduleName)
                     defs.registerModuleIdentity(namespace, moduleName);
             }
-            if (m.kind === "Kernel.Import") {
+            if (m.kind === "Telo.Import") {
                 const alias = m.metadata.name;
                 const source = m.source;
                 const exportedKinds = m.exports?.kinds ?? [];
@@ -218,11 +234,11 @@ export class StaticAnalyzer {
                 }
             }
         }
-        // Register definitions from Kernel.Definition resources.
+        // Register definitions from Telo.Definition resources.
         // Normalize alias-prefixed `capability` to canonical form so extendedBy lookup works
         // (e.g. "Workflow.Backend" → "workflow.Backend" when "Workflow" is a known alias).
         for (const m of manifests) {
-            if (m.kind === "Kernel.Definition") {
+            if (m.kind === "Telo.Definition") {
                 const def = m;
                 const resolvedCapability = def.capability
                     ? (aliases.resolveKind(def.capability) ?? def.capability)
@@ -244,17 +260,18 @@ export class StaticAnalyzer {
         const kernelGlobals = buildKernelGlobalsSchema(allManifests);
         // Validate each non-definition, non-system resource
         for (const m of allManifests) {
+            const filePath = m.metadata?.source;
             if (!m.kind || !m.metadata?.name) {
                 diagnostics.push({
                     severity: DiagnosticSeverity.Error,
                     code: "MISSING_KIND_OR_NAME",
                     source: SOURCE,
                     message: "Resource is missing required 'kind' or 'metadata.name' field.",
-                    data: { path: !m.kind ? "kind" : "metadata.name" },
+                    data: { filePath, path: !m.kind ? "kind" : "metadata.name" },
                 });
                 continue;
             }
-            if (m.kind === "Kernel.Definition" || m.kind === "Kernel.Abstract") {
+            if (m.kind === "Telo.Definition" || m.kind === "Telo.Abstract") {
                 continue;
             }
             const resource = { kind: m.kind, name: m.metadata?.name };
@@ -276,8 +293,8 @@ export class StaticAnalyzer {
                     severity: DiagnosticSeverity.Error,
                     code: "UNDEFINED_KIND",
                     source: SOURCE,
-                    message: `No Kernel.Definition found for kind '${m.kind}'.${hint}`,
-                    data: { resource, path: "kind" },
+                    message: `No Telo.Definition found for kind '${m.kind}'.${hint}`,
+                    data: { resource, filePath, path: "kind" },
                 });
                 continue;
             }
@@ -296,8 +313,8 @@ export class StaticAnalyzer {
                     }
                     : definition.schema;
                 // Phase 1: CEL type checking — walk data+schema together, check env.check() return types
-                const baseEnv = buildTypedCelEnvironment(m);
-                const celIssues = collectCelTypeIssues(m, schema, "", definition, m, baseEnv);
+                const baseTypedEnv = buildTypedCelEnvironment(this.celEnv, m);
+                const celIssues = collectCelTypeIssues(m, schema, "", definition, m, baseTypedEnv, this.celEnv);
                 // Phase 2+3: AJV on substituted data — CEL fields replaced with typed placeholders
                 const ajvIssues = validateAgainstSchema(substituteCelFields(m, schema), schema);
                 const issues = [...celIssues, ...ajvIssues];
@@ -307,7 +324,7 @@ export class StaticAnalyzer {
                         code: "SCHEMA_VIOLATION",
                         source: SOURCE,
                         message: `${m.kind}/${resource.name}: ${issue.message}`,
-                        data: { resource, path: issue.path },
+                        data: { resource, filePath, path: issue.path },
                     });
                 }
             }
@@ -316,6 +333,7 @@ export class StaticAnalyzer {
         // Validate CEL syntax and context variable access in all manifests
         for (const m of allManifests) {
             const resource = { kind: m.kind, name: m.metadata?.name };
+            const filePath = m.metadata?.source;
             const resolvedKind = aliases.resolveKind(m.kind);
             const mDefinition = defs.resolve(m.kind) ?? (resolvedKind ? defs.resolve(resolvedKind) : undefined);
             // Pre-compute step context for manifests with x-telo-step-context
@@ -325,7 +343,7 @@ export class StaticAnalyzer {
             walkCelExpressions(m, "", (expr, path) => {
                 let parsed;
                 try {
-                    parsed = celEnvironment.parse(expr);
+                    parsed = this.celEnv.parse(expr);
                 }
                 catch (e) {
                     diagnostics.push({
@@ -333,7 +351,7 @@ export class StaticAnalyzer {
                         code: "CEL_SYNTAX_ERROR",
                         source: SOURCE,
                         message: `CEL syntax error at ${path}: ${e instanceof Error ? e.message : String(e)}`,
-                        data: { resource, path },
+                        data: { resource, filePath, path },
                     });
                     return;
                 }
@@ -381,13 +399,15 @@ export class StaticAnalyzer {
                         code: "CEL_UNKNOWN_FIELD",
                         source: SOURCE,
                         message: `${m.kind}/${resource.name}: CEL at '${path}': ${err}`,
-                        data: { resource, path },
+                        data: { resource, filePath, path },
                     });
                 }
             });
         }
         // Validate resource references (Phase 3)
         diagnostics.push(...validateReferences(allManifests, { aliases, definitions: defs }));
+        // Validate throws: declarations and catches: coverage (rules 1, 2, 4, 7)
+        diagnostics.push(...validateThrowsCoverage(allManifests, defs, aliases, this.celEnv));
         return diagnostics;
     }
     analyzeErrors(manifests, options, registry) {

package/dist/builtins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EAgH/C,CAAC"}
+{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EA4I/C,CAAC"}

package/dist/builtins.js

@@ -1,19 +1,19 @@
 export const KERNEL_BUILTINS = [
-    { kind: "Kernel.Abstract", metadata: { name: "Template", module: "Kernel" } },
-    { kind: "Kernel.Abstract", metadata: { name: "Runnable", module: "Kernel" } },
-    { kind: "Kernel.Abstract", metadata: { name: "Service", module: "Kernel" } },
-    { kind: "Kernel.Abstract", metadata: { name: "Invocable", module: "Kernel" } },
-    { kind: "Kernel.Abstract", metadata: { name: "Mount", module: "Kernel" } },
-    { kind: "Kernel.Abstract", metadata: { name: "Type", module: "Kernel" } },
+    { kind: "Telo.Abstract", metadata: { name: "Template", module: "Telo" } },
+    { kind: "Telo.Abstract", metadata: { name: "Runnable", module: "Telo" } },
+    { kind: "Telo.Abstract", metadata: { name: "Service", module: "Telo" } },
+    { kind: "Telo.Abstract", metadata: { name: "Invocable", module: "Telo" } },
+    { kind: "Telo.Abstract", metadata: { name: "Mount", module: "Telo" } },
+    { kind: "Telo.Abstract", metadata: { name: "Type", module: "Telo" } },
     {
-        kind: "Kernel.Abstract",
-        metadata: { name: "Provider", module: "Kernel" },
+        kind: "Telo.Abstract",
+        metadata: { name: "Provider", module: "Telo" },
         schema: { "x-telo-eval": "compile" },
     },
     {
-        kind: "Kernel.Definition",
-        metadata: { name: "Abstract", module: "Kernel" },
-        capability: "Kernel.Template",
+        kind: "Telo.Definition",
+        metadata: { name: "Abstract", module: "Telo" },
+        capability: "Telo.Template",
         schema: {
             type: "object",
             properties: {
@@ -31,15 +31,15 @@ export const KERNEL_BUILTINS = [
         },
     },
     {
-        kind: "Kernel.Definition",
-        metadata: { name: "Definition", module: "Kernel" },
-        capability: "Kernel.Template",
+        kind: "Telo.Definition",
+        metadata: { name: "Definition", module: "Telo" },
+        capability: "Telo.Template",
         schema: { type: "object" },
     },
     {
-        kind: "Kernel.Definition",
-        metadata: { name: "Import", module: "Kernel" },
-        capability: "Kernel.Template",
+        kind: "Telo.Definition",
+        metadata: { name: "Import", module: "Telo" },
+        capability: "Telo.Template",
         schema: {
             type: "object",
             properties: {
@@ -59,9 +59,9 @@ export const KERNEL_BUILTINS = [
         },
     },
     {
-        kind: "Kernel.Definition",
-        metadata: { name: "Module", module: "Kernel" },
-        capability: "Kernel.Template",
+        kind: "Telo.Definition",
+        metadata: { name: "Application", module: "Telo" },
+        capability: "Telo.Template",
         schema: {
             type: "object",
             properties: {
@@ -83,14 +83,12 @@ export const KERNEL_BUILTINS = [
                     default: "shared",
                 },
                 keepAlive: { type: "boolean", default: false },
-                variables: { type: "object" },
-                secrets: { type: "object" },
                 targets: {
                     type: "array",
                     items: {
                         anyOf: [
-                            { type: "string", "x-telo-ref": "kernel#Runnable" },
-                            { type: "string", "x-telo-ref": "kernel#Service" },
+                            { type: "string", "x-telo-ref": "telo#Runnable" },
+                            { type: "string", "x-telo-ref": "telo#Service" },
                         ],
                     },
                 },
@@ -98,6 +96,36 @@ export const KERNEL_BUILTINS = [
                     type: "array",
                     items: { type: "string" },
                 },
+            },
+            required: ["metadata"],
+            additionalProperties: false,
+        },
+    },
+    {
+        kind: "Telo.Definition",
+        metadata: { name: "Library", module: "Telo" },
+        capability: "Telo.Template",
+        schema: {
+            type: "object",
+            properties: {
+                kind: { type: "string" },
+                metadata: {
+                    type: "object",
+                    properties: {
+                        name: { type: "string" },
+                        version: { type: "string" },
+                        source: { type: "string" },
+                        module: { type: "string" },
+                    },
+                    required: ["name"],
+                    additionalProperties: true,
+                },
+                variables: { type: "object" },
+                secrets: { type: "object" },
+                include: {
+                    type: "array",
+                    items: { type: "string" },
+                },
                 exports: {
                     type: "object",
                     properties: {

package/dist/cel-environment.d.ts

@@ -1,15 +1,22 @@
-import type { ResourceManifest } from "@telorun/sdk";
 import { Environment } from "@marcbachmann/cel-js";
-export declare const celEnvironment: Environment;
-/** Clone `celEnvironment` and register typed variable declarations so that
+import type { ResourceManifest } from "@telorun/sdk";
+export interface CelHandlers {
+    sha256: (s: string) => string;
+}
+/** Build a CEL `Environment` with Telo's stdlib of functions. Always registers the
+ *  same function signatures (so `env.check()` succeeds for type-inference) — the
+ *  handlers govern what the function does when called at runtime. Analyzer-only
+ *  callers can omit handlers; runtime callers (kernel) must supply real ones. */
+export declare function buildCelEnvironment(handlers?: CelHandlers): Environment;
+/** Clone `baseEnv` and register typed variable declarations so that
  *  `env.check(expr)` can infer return types for expressions referencing known variables.
  *
  *  - `variables`: typed from the manifest's `variables` field if it is a schema map
- *    (only `Kernel.Module` resources carry this); otherwise registered as `map` (dyn).
+ *    (only module-identity docs — `Telo.Application` / `Telo.Library` — carry this); otherwise registered as `map` (dyn).
  *  - `secrets`, `resources`, `env`: always `map` (dyn — output schemas unknown).
  *  - `extraContextSchema`: additional variables from an `x-telo-context` annotation.
  *
  *  NOTE: The set of kernel globals registered here must match `KERNEL_GLOBAL_NAMES`
  *  in kernel-globals.ts, which is used for chain-access validation. */
-export declare function buildTypedCelEnvironment(manifest: ResourceManifest, extraContextSchema?: Record<string, any> | null): Environment;
+export declare function buildTypedCelEnvironment(baseEnv: Environment, manifest: ResourceManifest, extraContextSchema?: Record<string, any> | null): Environment;
 //# sourceMappingURL=cel-environment.d.ts.map

package/dist/cel-environment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cel-environment.d.ts","sourceRoot":"","sources":["../src/cel-environment.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAGnD,eAAO,MAAM,cAAc,aAWvB,CAAC;AAEL;;;;;;;;;uEASuE;AACvE,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,gBAAgB,EAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,GAC9C,WAAW,CAyCb"}
+{"version":3,"file":"cel-environment.d.ts","sourceRoot":"","sources":["../src/cel-environment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrD,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;CAC/B;AAaD;;;iFAGiF;AACjF,wBAAgB,mBAAmB,CAAC,QAAQ,GAAE,WAA2B,GAAG,WAAW,CActF;AAED;;;;;;;;;uEASuE;AACvE,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,gBAAgB,EAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,GAC9C,WAAW,CAyCb"}

package/dist/cel-environment.js

@@ -1,30 +1,44 @@
 import { Environment } from "@marcbachmann/cel-js";
 import { jsonSchemaToCelType } from "./schema-compat.js";
-export const celEnvironment = new Environment({ unlistedVariablesAreDyn: true })
-    .registerFunction("join(list, string): string", (list, sep) => list.map(String).join(sep))
-    .registerFunction("keys(map): list", (map) => {
-    if (map instanceof Map)
-        return [...map.keys()];
-    return Object.keys(map);
-})
-    .registerFunction("values(map): list", (map) => {
-    if (map instanceof Map)
-        return [...map.values()];
-    return Object.values(map);
-});
-/** Clone `celEnvironment` and register typed variable declarations so that
+const stub = (name) => () => {
+    throw new Error(`${name}() is not available in this environment. ` +
+        `Construct StaticAnalyzer or Loader with celHandlers to enable it.`);
+};
+const STUB_HANDLERS = {
+    sha256: stub("sha256"),
+};
+/** Build a CEL `Environment` with Telo's stdlib of functions. Always registers the
+ *  same function signatures (so `env.check()` succeeds for type-inference) — the
+ *  handlers govern what the function does when called at runtime. Analyzer-only
+ *  callers can omit handlers; runtime callers (kernel) must supply real ones. */
+export function buildCelEnvironment(handlers = STUB_HANDLERS) {
+    return new Environment({ unlistedVariablesAreDyn: true })
+        .registerFunction("join(list, string): string", (list, sep) => list.map(String).join(sep))
+        .registerFunction("keys(map): list", (map) => {
+        if (map instanceof Map)
+            return [...map.keys()];
+        return Object.keys(map);
+    })
+        .registerFunction("values(map): list", (map) => {
+        if (map instanceof Map)
+            return [...map.values()];
+        return Object.values(map);
+    })
+        .registerFunction("sha256(string): string", (s) => handlers.sha256(s));
+}
+/** Clone `baseEnv` and register typed variable declarations so that
  *  `env.check(expr)` can infer return types for expressions referencing known variables.
  *
  *  - `variables`: typed from the manifest's `variables` field if it is a schema map
- *    (only `Kernel.Module` resources carry this); otherwise registered as `map` (dyn).
+ *    (only module-identity docs — `Telo.Application` / `Telo.Library` — carry this); otherwise registered as `map` (dyn).
  *  - `secrets`, `resources`, `env`: always `map` (dyn — output schemas unknown).
  *  - `extraContextSchema`: additional variables from an `x-telo-context` annotation.
  *
  *  NOTE: The set of kernel globals registered here must match `KERNEL_GLOBAL_NAMES`
  *  in kernel-globals.ts, which is used for chain-access validation. */
-export function buildTypedCelEnvironment(manifest, extraContextSchema) {
+export function buildTypedCelEnvironment(baseEnv, manifest, extraContextSchema) {
     try {
-        const env = celEnvironment.clone();
+        const env = baseEnv.clone();
         // Build typed ObjectSchema from manifest.variables if it looks like a schema map
         const vars = manifest.variables;
         if (vars !== null && typeof vars === "object" && !Array.isArray(vars)) {
@@ -56,6 +70,6 @@ export function buildTypedCelEnvironment(manifest, extraContextSchema) {
         return env;
     }
     catch {
-        return celEnvironment.clone();
+        return baseEnv.clone();
     }
 }

package/dist/definition-registry.d.ts

@@ -13,16 +13,16 @@ export declare class DefinitionRegistry {
     /** Reverse inheritance index: parent kind → direct child kinds. */
     private readonly extendedBy;
     /** Module identity table: identity string → canonical module name.
-     *  "kernel" → "Kernel", "std/pipeline" → "pipeline", etc. */
+     *  "telo" → "Telo", "std/pipeline" → "pipeline", etc. */
     private readonly identityMap;
     /** Reverse identity table: canonical module name → full identity string.
-     *  "Kernel" → "kernel", "pipeline" → "std/pipeline", etc.
+     *  "Telo" → "telo", "pipeline" → "std/pipeline", etc.
      *  Used to compute definition $id values for the AJV schema store. */
     private readonly reverseIdentityMap;
     register(definition: ResourceDefinition): void;
     /** Register a module identity for x-telo-ref resolution.
-     *  Call once per Kernel.Module manifest when the manifest is loaded.
-     *  @param namespace  The module's metadata.namespace (e.g. "std"), or null for kernel built-ins.
+     *  Call once per module doc (Telo.Application or Telo.Library) when the manifest is loaded.
+     *  @param namespace  The module's metadata.namespace (e.g. "std"), or null for telo built-ins.
      *  @param moduleName The module's metadata.name (e.g. "pipeline", "http-server"). */
     registerModuleIdentity(namespace: string | null, moduleName: string): void;
     /** Computes the $id for a definition schema: "<identity>/<TypeName>".
@@ -36,7 +36,7 @@ export declare class DefinitionRegistry {
      *  Splits on "#", looks up the left side in the identity table, and returns
      *  "<canonicalModule>.<TypeName>".
      *
-     *  "kernel#Invocable"       → "Kernel.Invocable"
+     *  "telo#Invocable"         → "Telo.Invocable"
      *  "std/pipeline#Job"       → "pipeline.Job"
      *  "std/http-server#Server" → "http-server.Server"
      *

package/dist/definition-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"definition-registry.d.ts","sourceRoot":"","sources":["../src/definition-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAA0B,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAG1F,+EAA+E;AAC/E,qBAAa,kBAAkB;;IAK7B;;sFAEkF;IAClF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IAEzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyC;IAC9D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D;iEAC6D;IAC7D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD;;0EAEsE;IACtE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA6B;IAEhE,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI;IAwB9C;;;yFAGqF;IACrF,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAgB1E;4EACwE;IACxE,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAMnE;wFACoF;IACpF,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE;IAWtE,OAAO,CAAC,iBAAiB;IAczB;;;;;;;;4FAQwF;IACxF,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAUhD,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAIrD,+FAA+F;IAC/F,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAIxD,gGAAgG;IAChG,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,GACvD,iBAAiB,GAAG,SAAS;IAOhC;;qEAEiE;IACjE,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAgBxD,KAAK,IAAI,MAAM,EAAE;CAGlB"}
+{"version":3,"file":"definition-registry.d.ts","sourceRoot":"","sources":["../src/definition-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAA0B,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAG1F,+EAA+E;AAC/E,qBAAa,kBAAkB;;IAK7B;;sFAEkF;IAClF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IAEzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyC;IAC9D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D;6DACyD;IACzD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD;;0EAEsE;IACtE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA6B;IAEhE,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI;IAwB9C;;;yFAGqF;IACrF,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAgB1E;4EACwE;IACxE,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAMnE;wFACoF;IACpF,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE;IAWtE,OAAO,CAAC,iBAAiB;IAczB;;;;;;;;4FAQwF;IACxF,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAUhD,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAIrD,+FAA+F;IAC/F,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAIxD,gGAAgG;IAChG,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,GACvD,iBAAiB,GAAG,SAAS;IAOhC;;qEAEiE;IACjE,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAgBxD,KAAK,IAAI,MAAM,EAAE;CAGlB"}

package/dist/definition-registry.js

@@ -17,10 +17,10 @@ export class DefinitionRegistry {
     /** Reverse inheritance index: parent kind → direct child kinds. */
     extendedBy = new Map();
     /** Module identity table: identity string → canonical module name.
-     *  "kernel" → "Kernel", "std/pipeline" → "pipeline", etc. */
+     *  "telo" → "Telo", "std/pipeline" → "pipeline", etc. */
     identityMap = new Map();
     /** Reverse identity table: canonical module name → full identity string.
-     *  "Kernel" → "kernel", "pipeline" → "std/pipeline", etc.
+     *  "Telo" → "telo", "pipeline" → "std/pipeline", etc.
      *  Used to compute definition $id values for the AJV schema store. */
     reverseIdentityMap = new Map();
     register(definition) {
@@ -37,10 +37,10 @@ export class DefinitionRegistry {
                 this.extendedBy.set(definition.capability, [key]);
             }
         }
-        // Auto-register the kernel identity when any Kernel built-in is registered.
-        if (definition.kind === "Kernel.Abstract" && mod === "Kernel") {
-            this.identityMap.set("kernel", "Kernel");
-            this.reverseIdentityMap.set("Kernel", "kernel");
+        // Auto-register the telo identity when any Telo built-in is registered.
+        if (definition.kind === "Telo.Abstract" && mod === "Telo") {
+            this.identityMap.set("telo", "Telo");
+            this.reverseIdentityMap.set("Telo", "telo");
         }
         // If identity is already known, register the schema in AJV immediately.
         if (mod && definition.schema) {
@@ -48,11 +48,11 @@ export class DefinitionRegistry {
         }
     }
     /** Register a module identity for x-telo-ref resolution.
-     *  Call once per Kernel.Module manifest when the manifest is loaded.
-     *  @param namespace  The module's metadata.namespace (e.g. "std"), or null for kernel built-ins.
+     *  Call once per module doc (Telo.Application or Telo.Library) when the manifest is loaded.
+     *  @param namespace  The module's metadata.namespace (e.g. "std"), or null for telo built-ins.
      *  @param moduleName The module's metadata.name (e.g. "pipeline", "http-server"). */
     registerModuleIdentity(namespace, moduleName) {
-        const identity = namespace ? `${namespace}/${moduleName}` : "kernel";
+        const identity = namespace ? `${namespace}/${moduleName}` : "telo";
         this.identityMap.set(identity, moduleName);
         this.reverseIdentityMap.set(moduleName, identity);
         // Retroactively register AJV schemas for definitions of this module already in the registry.
@@ -98,7 +98,7 @@ export class DefinitionRegistry {
      *  Splits on "#", looks up the left side in the identity table, and returns
      *  "<canonicalModule>.<TypeName>".
      *
-     *  "kernel#Invocable"       → "Kernel.Invocable"
+     *  "telo#Invocable"         → "Telo.Invocable"
      *  "std/pipeline#Job"       → "pipeline.Job"
      *  "std/http-server#Server" → "http-server.Server"
      *

package/dist/dependency-graph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dependency-graph.d.ts","sourceRoot":"","sources":["../src/dependency-graph.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAGnE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B;kDAC8C;IAC9C,KAAK,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;IACpC;oFACgF;IAChF,KAAK,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;CACrC;AAOD;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE,aAAa,GACtB,eAAe,CAsFjB;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,aAAa,CAAC,YAAY,CAAC,GAAG,MAAM,CAOtE"}
+{"version":3,"file":"dependency-graph.d.ts","sourceRoot":"","sources":["../src/dependency-graph.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAGnE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B;kDAC8C;IAC9C,KAAK,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;IACpC;oFACgF;IAChF,KAAK,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;CACrC;AAcD;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE,aAAa,GACtB,eAAe,CAsFjB;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,aAAa,CAAC,YAAY,CAAC,GAAG,MAAM,CAOtE"}

package/dist/dependency-graph.js

@@ -1,6 +1,13 @@
 import { isRefEntry, isScopeEntry, resolveFieldValues } from "./reference-field-map.js";
-/** System resource kinds that are not runtime nodes in the dependency graph. */
-const SYSTEM_KINDS = new Set(["Kernel.Definition", "Kernel.Import"]);
+/** System resource kinds that are not runtime nodes in the dependency graph.
+ *  Module-identity docs (Telo.Application, Telo.Library) are intentionally
+ *  not in this set: an Application's `targets` use `x-telo-ref` to real
+ *  Runnable/Service resources, so the Application legitimately depends on
+ *  them in boot order — modeling that as a graph edge is correct. A Library
+ *  has no `targets`, so it becomes a zero-edge node, which is harmless.
+ *  If the graph is ever consumed as "things to init", skip these kinds at
+ *  the consumer site; the controller already runs them separately. */
+const SYSTEM_KINDS = new Set(["Telo.Definition", "Telo.Import"]);
 const nodeKey = (kind, name) => `${kind}\0${name}`;
 /**
  * Builds a directed acyclic graph (DAG) of runtime resource dependencies and

package/dist/index.d.ts

@@ -3,6 +3,8 @@ export { RegistryAdapter } from "./adapters/registry-adapter.js";
 export { AnalysisRegistry } from "./analysis-registry.js";
 export { StaticAnalyzer } from "./analyzer.js";
 export { Loader } from "./manifest-loader.js";
+export { MODULE_KINDS, isModuleKind } from "./module-kinds.js";
+export type { ModuleKind } from "./module-kinds.js";
 export { DEFAULT_MANIFEST_FILENAME, DiagnosticSeverity } from "./types.js";
 export type { AnalysisDiagnostic, AnalysisOptions, LoaderInitOptions, LoadOptions, ManifestAdapter, Position, PositionIndex, Range } from "./types.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,eAAe,EAChE,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,eAAe,EAChE,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -3,4 +3,5 @@ export { RegistryAdapter } from "./adapters/registry-adapter.js";
 export { AnalysisRegistry } from "./analysis-registry.js";
 export { StaticAnalyzer } from "./analyzer.js";
 export { Loader } from "./manifest-loader.js";
+export { MODULE_KINDS, isModuleKind } from "./module-kinds.js";
 export { DEFAULT_MANIFEST_FILENAME, DiagnosticSeverity } from "./types.js";