@telorun/analyzer 0.1.4 → 0.2.1

package/dist/kernel-globals.d.ts

@@ -6,7 +6,7 @@ import type { ResourceManifest } from "@telorun/sdk";
  * must stay in sync with this list.
  *
  * Note: `env` is only available in the root module context. Child modules
- * loaded via Kernel.Import do not receive host environment variables.
+ * loaded via Telo.Import do not receive host environment variables.
  * There is no `imports` namespace at runtime — import snapshots are stored
  * under `resources.<alias>`.
  */
@@ -17,7 +17,11 @@ export declare const KERNEL_GLOBAL_NAMES: readonly ["variables", "secrets", "res
  * chain-access validation recognises kernel globals without module authors
  * having to re-declare them.
  *
- * - `variables` / `secrets`: typed from the `Kernel.Module` declaration
+ * - `variables` / `secrets`: typed from the root module doc — prefer
+ *   Telo.Application when present, otherwise fall back to Telo.Library.
+ *   Applications are the root whose variables/secrets contract governs CEL
+ *   in the outer module; Libraries are only relevant when the caller scoped
+ *   the manifest list to a single library's file.
  * - `resources`: enumerates all non-system resource names
  * - `env`: dynamic (runtime env vars, root module only)
  */

package/dist/kernel-globals.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kernel-globals.d.ts","sourceRoot":"","sources":["../src/kernel-globals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,uDAAwD,CAAC;AAQzF;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,gBAAgB,EAAE,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CA6BrB;AA2BD;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAClC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACjC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CASrB"}
+{"version":3,"file":"kernel-globals.d.ts","sourceRoot":"","sources":["../src/kernel-globals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,uDAAwD,CAAC;AASzF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,gBAAgB,EAAE,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAiCrB;AA2BD;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAClC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACjC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CASrB"}

package/dist/kernel-globals.js

@@ -5,15 +5,16 @@
  * must stay in sync with this list.
  *
  * Note: `env` is only available in the root module context. Child modules
- * loaded via Kernel.Import do not receive host environment variables.
+ * loaded via Telo.Import do not receive host environment variables.
  * There is no `imports` namespace at runtime — import snapshots are stored
  * under `resources.<alias>`.
  */
 export const KERNEL_GLOBAL_NAMES = ["variables", "secrets", "resources", "env"];
 const SYSTEM_KINDS = new Set([
-    "Kernel.Definition",
-    "Kernel.Module",
-    "Kernel.Abstract",
+    "Telo.Definition",
+    "Telo.Application",
+    "Telo.Library",
+    "Telo.Abstract",
 ]);
 /**
  * Build a typed JSON Schema describing the kernel globals available in the
@@ -21,18 +22,23 @@ const SYSTEM_KINDS = new Set([
  * chain-access validation recognises kernel globals without module authors
  * having to re-declare them.
  *
- * - `variables` / `secrets`: typed from the `Kernel.Module` declaration
+ * - `variables` / `secrets`: typed from the root module doc — prefer
+ *   Telo.Application when present, otherwise fall back to Telo.Library.
+ *   Applications are the root whose variables/secrets contract governs CEL
+ *   in the outer module; Libraries are only relevant when the caller scoped
+ *   the manifest list to a single library's file.
  * - `resources`: enumerates all non-system resource names
  * - `env`: dynamic (runtime env vars, root module only)
  */
 export function buildKernelGlobalsSchema(manifests) {
-    const moduleManifest = manifests.find((m) => m.kind === "Kernel.Module");
+    const moduleManifest = manifests.find((m) => m.kind === "Telo.Application") ??
+        manifests.find((m) => m.kind === "Telo.Library");
     const resourceProps = {};
     for (const m of manifests) {
         const name = m.metadata?.name;
         if (!name || !m.kind)
             continue;
-        // Kernel.Import snapshots are stored under resources.<alias> at runtime,
+        // Telo.Import snapshots are stored under resources.<alias> at runtime,
         // so they appear here alongside regular resources.
         if (!SYSTEM_KINDS.has(m.kind)) {
             resourceProps[name] = { type: "object", additionalProperties: true };
@@ -52,7 +58,7 @@ export function buildKernelGlobalsSchema(manifests) {
         },
     };
 }
-/** Wrap a JSON Schema property map (like `Kernel.Module.variables`) into a
+/** Wrap a JSON Schema property map (like `Telo.Application.variables`) into a
  *  closed object schema suitable for chain-access validation. Falls back to
  *  an open map when the module declares no variables/secrets. */
 function buildSchemaMapSchema(schemaMap) {

package/dist/manifest-loader.d.ts

@@ -3,6 +3,7 @@ import { type LoadOptions, type LoaderInitOptions, type ManifestAdapter } from "
 export declare class Loader {
     private static readonly moduleCache;
     protected adapters: ManifestAdapter[];
+    private readonly celEnv;
     constructor(extraAdaptersOrOptions?: ManifestAdapter[] | LoaderInitOptions);
     register(adapter: ManifestAdapter): this;
     private pick;

package/dist/manifest-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest-loader.d.ts","sourceRoot":"","sources":["../src/manifest-loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKtE,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EAGrB,MAAM,YAAY,CAAC;AAIpB,qBAAa,MAAM;IACjB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAG/B;IAEJ,SAAS,CAAC,QAAQ,EAAE,eAAe,EAAE,CAAC;gBAE1B,sBAAsB,GAAE,eAAe,EAAE,GAAG,iBAAsB;IAiB9E,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI;IAKxC,OAAO,CAAC,IAAI;IAMN,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK/C,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAmGnE,eAAe;YAoBf,eAAe;IAgEvB,iBAAiB,CACrB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;QACT,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,gBAAgB,EAAE,CAAC;QAC9B,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;KAClD,GAAG,IAAI,CAAC;IAiCH,eAAe,CACnB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,KAAK,IAAI,GAC5C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAsCrC,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;CAoDnE"}
+{"version":3,"file":"manifest-loader.d.ts","sourceRoot":"","sources":["../src/manifest-loader.ts"],"names":[],"mappings":"AACA,OAAO,EAAmB,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAOtE,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EAGrB,MAAM,YAAY,CAAC;AASpB,qBAAa,MAAM;IACjB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAG/B;IAEJ,SAAS,CAAC,QAAQ,EAAE,eAAe,EAAE,CAAC;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,sBAAsB,GAAE,eAAe,EAAE,GAAG,iBAAsB;IAmB9E,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI;IAKxC,OAAO,CAAC,IAAI;IAMN,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK/C,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAqGnE,eAAe;YAoBf,eAAe;IAgEvB,iBAAiB,CACrB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;QACT,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,gBAAgB,EAAE,CAAC;QAC9B,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;KAClD,GAAG,IAAI,CAAC;IAiCH,eAAe,CACnB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,KAAK,IAAI,GAC5C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAsCrC,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;CAiEnE"}

package/dist/manifest-loader.js

@@ -2,12 +2,20 @@ import { isCompiledValue } from "@telorun/sdk";
 import { isMap, isPair, isScalar, isSeq, parseAllDocuments } from "yaml";
 import { HttpAdapter } from "./adapters/http-adapter.js";
 import { RegistryAdapter } from "./adapters/registry-adapter.js";
+import { buildCelEnvironment } from "./cel-environment.js";
+import { isModuleKind } from "./module-kinds.js";
 import { precompileDoc } from "./precompile.js";
 import { DEFAULT_MANIFEST_FILENAME, } from "./types.js";
-const SYSTEM_KINDS = new Set(["Kernel.Module", "Kernel.Import", "Kernel.Definition"]);
+const SYSTEM_KINDS = new Set([
+    "Telo.Application",
+    "Telo.Library",
+    "Telo.Import",
+    "Telo.Definition",
+]);
 export class Loader {
     static moduleCache = new Map();
     adapters;
+    celEnv;
     constructor(extraAdaptersOrOptions = []) {
         const options = Array.isArray(extraAdaptersOrOptions)
             ? { extraAdapters: extraAdaptersOrOptions }
@@ -22,6 +30,7 @@ export class Loader {
         if (options.extraAdapters?.length) {
             this.adapters.unshift(...options.extraAdapters);
         }
+        this.celEnv = buildCelEnvironment(options.celHandlers);
     }
     register(adapter) {
         this.adapters.unshift(adapter);
@@ -59,7 +68,7 @@ export class Loader {
             let compiledDocs;
             if (options?.compile) {
                 try {
-                    const result = precompileDoc(rawDoc);
+                    const result = precompileDoc(rawDoc, this.celEnv);
                     compiledDocs = Array.isArray(result) ? result : [result];
                 }
                 catch (error) {
@@ -85,15 +94,17 @@ export class Loader {
                 resolved.push({ ...manifest, metadata });
             }
         }
-        const moduleManifests = resolved.filter((m) => m.kind === "Kernel.Module");
+        const moduleManifests = resolved.filter((m) => isModuleKind(m.kind));
         if (moduleManifests.length > 1) {
-            throw new Error(`File '${source}' contains ${moduleManifests.length} Kernel.Module declarations. Maximum one is allowed.`);
+            const kinds = moduleManifests.map((m) => m.kind).join(", ");
+            throw new Error(`File '${source}' contains ${moduleManifests.length} module declarations (${kinds}). ` +
+                `A file may declare at most one Telo.Application or Telo.Library.`);
         }
         const moduleManifest = moduleManifests[0];
         const moduleName = moduleManifest?.metadata?.name;
         if (moduleName) {
             for (const manifest of resolved) {
-                if (manifest.kind !== "Kernel.Module" && !manifest.metadata?.module) {
+                if (!isModuleKind(manifest.kind) && !manifest.metadata?.module) {
                     const pi = manifest.metadata?.positionIndex;
                     manifest.metadata = { ...manifest.metadata, module: moduleName };
                     if (pi) {
@@ -163,7 +174,7 @@ export class Loader {
             let compiledDocs;
             if (options?.compile) {
                 try {
-                    const result = precompileDoc(rawDoc);
+                    const result = precompileDoc(rawDoc, this.celEnv);
                     compiledDocs = Array.isArray(result) ? result : [result];
                 }
                 catch (error) {
@@ -197,10 +208,10 @@ export class Loader {
     async loadModuleForFile(fileUrl) {
         // Try loading as a regular module first (it might be a telo.yaml itself).
         // Use loadManifests (not loadModule) so imported definitions are included —
-        // otherwise the analyzer won't know about kinds from Kernel.Import sources.
+        // otherwise the analyzer won't know about kinds from Telo.Import sources.
         try {
             const docs = await this.loadModule(fileUrl);
-            const hasModule = docs.some((d) => d.kind === "Kernel.Module");
+            const hasModule = docs.some((d) => isModuleKind(d.kind));
             if (hasModule) {
                 const { source } = await this.pick(fileUrl).read(fileUrl);
                 const manifests = await this.loadManifests(fileUrl);
@@ -235,7 +246,7 @@ export class Loader {
         const queue = [...entry];
         while (queue.length > 0) {
             const m = queue.shift();
-            if (m.kind !== "Kernel.Import")
+            if (m.kind !== "Telo.Import")
                 continue;
             const importSource = m.source;
             if (!importSource)
@@ -258,7 +269,7 @@ export class Loader {
             }
             result.set(importUrl, imported);
             for (const im of imported) {
-                if (im.kind === "Kernel.Import")
+                if (im.kind === "Telo.Import")
                     queue.push(im);
             }
         }
@@ -271,7 +282,7 @@ export class Loader {
         const queue = [...entry];
         while (queue.length > 0) {
             const m = queue.shift();
-            if (m.kind !== "Kernel.Import")
+            if (m.kind !== "Telo.Import")
                 continue;
             const importSource = m.source;
             if (!importSource)
@@ -292,7 +303,18 @@ export class Loader {
                 e.sourceLine = m.metadata?.sourceLine ?? 0;
                 throw e;
             }
-            const importedModule = imported.find((im) => im.kind === "Kernel.Module");
+            // Import target must be a Telo.Library. Check the Library branch
+            // explicitly rather than "anything that's a module kind" so that a
+            // future third kind can't silently slip past as a valid import target.
+            const importedLibrary = imported.find((im) => im.kind === "Telo.Library");
+            const importedApplication = imported.find((im) => im.kind === "Telo.Application");
+            if (importedApplication) {
+                const e = new Error(`Telo.Import target '${importSource}' is a Telo.Application. ` +
+                    `Only Telo.Library modules may be imported. Applications are run directly, not imported.`);
+                e.sourceLine = m.metadata?.sourceLine ?? 0;
+                throw e;
+            }
+            const importedModule = importedLibrary;
             if (importedModule?.metadata?.name) {
                 const pi = m.metadata?.positionIndex;
                 m.metadata = {
@@ -310,9 +332,9 @@ export class Loader {
                 }
             }
             for (const im of imported) {
-                if (im.kind === "Kernel.Definition")
+                if (im.kind === "Telo.Definition")
                     importedDefs.push(im);
-                if (im.kind === "Kernel.Import")
+                if (im.kind === "Telo.Import")
                     queue.push(im);
             }
         }

package/dist/module-kinds.d.ts

@@ -0,0 +1,4 @@
+export declare const MODULE_KINDS: readonly ["Telo.Application", "Telo.Library"];
+export type ModuleKind = (typeof MODULE_KINDS)[number];
+export declare function isModuleKind(kind: string | undefined): kind is ModuleKind;
+//# sourceMappingURL=module-kinds.d.ts.map

package/dist/module-kinds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-kinds.d.ts","sourceRoot":"","sources":["../src/module-kinds.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,YAAY,+CAAgD,CAAC;AAC1E,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,IAAI,UAAU,CAEzE"}

package/dist/module-kinds.js

@@ -0,0 +1,4 @@
+export const MODULE_KINDS = ["Telo.Application", "Telo.Library"];
+export function isModuleKind(kind) {
+    return kind === "Telo.Application" || kind === "Telo.Library";
+}

package/dist/normalize-inline-resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"normalize-inline-resources.d.ts","sourceRoot":"","sources":["../src/normalize-inline-resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASzD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE,aAAa,GACtB,gBAAgB,EAAE,CAkDpB"}
+{"version":3,"file":"normalize-inline-resources.d.ts","sourceRoot":"","sources":["../src/normalize-inline-resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAczD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE,aAAa,GACtB,gBAAgB,EAAE,CAkDpB"}

package/dist/normalize-inline-resources.js

@@ -1,5 +1,10 @@
 import { isRefEntry, isScopeEntry, isInlineResource } from "./reference-field-map.js";
-const SYSTEM_KINDS = new Set(["Kernel.Definition", "Kernel.Module", "Kernel.Import"]);
+const SYSTEM_KINDS = new Set([
+    "Telo.Definition",
+    "Telo.Application",
+    "Telo.Library",
+    "Telo.Import",
+]);
 /** Replaces characters outside [a-zA-Z0-9_] with underscores. */
 function sanitizeName(raw) {
     return raw.replace(/[^a-zA-Z0-9_]/g, "_");

package/dist/precompile.d.ts

@@ -1,9 +1,10 @@
+import type { Environment } from "@marcbachmann/cel-js";
 /**
  * Walks a raw YAML document and replaces all "${{ expr }}" strings with
  * CompiledValue wrappers. Throws on CEL syntax errors.
  * Intended to be called once per document at load time.
- * Kernel.Definition documents are returned unchanged — their schema fields
+ * Telo.Definition documents are returned unchanged — their schema fields
  * are static metadata and must not be treated as CEL templates.
  */
-export declare function precompileDoc(doc: unknown): unknown;
+export declare function precompileDoc(doc: unknown, env: Environment): unknown;
 //# sourceMappingURL=precompile.d.ts.map

package/dist/precompile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"precompile.d.ts","sourceRoot":"","sources":["../src/precompile.ts"],"names":[],"mappings":"AAMA;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAanD"}
+{"version":3,"file":"precompile.d.ts","sourceRoot":"","sources":["../src/precompile.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAKxD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAarE"}

package/dist/precompile.js

@@ -1,36 +1,36 @@
-import { celEnvironment } from "./cel-environment.js";
 const TEMPLATE_REGEX = /\$\{\{\s*([^}]+?)\s*\}\}/g;
 const EXACT_TEMPLATE_REGEX = /^\s*\$\{\{\s*([^}]+?)\s*\}\}\s*$/;
 /**
  * Walks a raw YAML document and replaces all "${{ expr }}" strings with
  * CompiledValue wrappers. Throws on CEL syntax errors.
  * Intended to be called once per document at load time.
- * Kernel.Definition documents are returned unchanged — their schema fields
+ * Telo.Definition documents are returned unchanged — their schema fields
  * are static metadata and must not be treated as CEL templates.
  */
-export function precompileDoc(doc) {
+export function precompileDoc(doc, env) {
     if (typeof doc === "string")
-        return compileString(doc);
+        return compileString(doc, env);
     if (Array.isArray(doc))
-        return doc.map(precompileDoc);
+        return doc.map((item) => precompileDoc(item, env));
     // Only recurse into plain objects. Class instances (ResourceInstance, ScopeHandle, etc.)
     // are returned as-is — their prototype methods must not be lost by object reconstruction.
     if (doc !== null && typeof doc === "object" && Object.getPrototypeOf(doc) === Object.prototype) {
         const result = {};
         for (const [k, v] of Object.entries(doc)) {
-            result[k] = precompileDoc(v);
+            result[k] = precompileDoc(v, env);
         }
         return result;
     }
     return doc;
 }
-function compileString(s) {
+function compileString(s, env) {
     if (!s.includes("${{"))
         return s;
     const exact = s.match(EXACT_TEMPLATE_REGEX);
     if (exact) {
-        const fn = celEnvironment.parse(exact[1].trim());
-        return { __compiled: true, call: (ctx) => fn(ctx) };
+        const expr = exact[1].trim();
+        const fn = env.parse(expr);
+        return { __compiled: true, source: expr, call: (ctx) => fn(ctx) };
     }
     // Interpolated template — collect literal parts + compiled sub-expressions
     const parts = [];
@@ -38,14 +38,16 @@ function compileString(s) {
     for (const m of s.matchAll(TEMPLATE_REGEX)) {
         if (m.index > last)
             parts.push(s.slice(last, m.index));
-        const fn = celEnvironment.parse(m[1].trim());
-        parts.push({ __compiled: true, call: (ctx) => fn(ctx) });
+        const expr = m[1].trim();
+        const fn = env.parse(expr);
+        parts.push({ __compiled: true, source: expr, call: (ctx) => fn(ctx) });
         last = m.index + m[0].length;
     }
     if (last < s.length)
         parts.push(s.slice(last));
     return {
         __compiled: true,
+        source: s,
         call: (ctx) => parts.map((p) => (typeof p === "string" ? p : String(p.call(ctx) ?? ""))).join(""),
     };
 }

package/dist/reference-field-map.d.ts

@@ -1,6 +1,6 @@
 /** An entry for a field that carries one or more x-telo-ref constraints. */
 export interface RefFieldEntry {
-    /** One or more canonical ref strings ("namespace/module#TypeName" or "kernel#TypeName").
+    /** One or more canonical ref strings ("namespace/module#TypeName" or "telo#TypeName").
      *  Multiple entries arise from anyOf branches. */
     refs: string[];
     /** True when the field path traversed through at least one array (path contains "[]"). */

package/dist/resolve-throws-union.d.ts

@@ -0,0 +1,30 @@
+import type { ResourceManifest } from "@telorun/sdk";
+import type { AliasResolver } from "./alias-resolver.js";
+import type { DefinitionRegistry } from "./definition-registry.js";
+export interface ThrowsCodeMeta {
+    data?: Record<string, any>;
+}
+export interface ThrowsUnion {
+    /** Code → per-code metadata (data schema, etc). Keys are the declared codes. */
+    codes: Map<string, ThrowsCodeMeta>;
+    /** True when the union cannot be fully resolved statically — e.g. a
+     *  `passthrough` call site uses a CEL expression the analyzer can't narrow,
+     *  an unknown kind was encountered, or a cycle short-circuited resolution.
+     *  Callers must treat unbounded unions as requiring a catch-all entry. */
+    unbounded: boolean;
+}
+export interface ResolveCtx {
+    allManifests: ResourceManifest[];
+    defs: DefinitionRegistry;
+    aliases: AliasResolver;
+    memo: Map<string, ThrowsUnion>;
+    inProgress: Set<string>;
+}
+export declare function createResolveCtx(allManifests: ResourceManifest[], defs: DefinitionRegistry, aliases: AliasResolver): ResolveCtx;
+/** Resolve the effective throw union for a named manifest. The result combines
+ *  explicit `throws.codes`, `throws.inherit: true` dataflow (step-context
+ *  traversal with try/catch subtraction), and unbounded markers for
+ *  unresolvable passthrough call sites. Cycles short-circuit to an empty
+ *  result so resolution always terminates. */
+export declare function resolveThrowsUnion(manifest: ResourceManifest, ctx: ResolveCtx): ThrowsUnion;
+//# sourceMappingURL=resolve-throws-union.d.ts.map

package/dist/resolve-throws-union.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-throws-union.d.ts","sourceRoot":"","sources":["../src/resolve-throws-union.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,gFAAgF;IAChF,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACnC;;;8EAG0E;IAC1E,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC/B,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACzB;AAED,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,gBAAgB,EAAE,EAChC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,GACrB,UAAU,CAQZ;AA+BD;;;;8CAI8C;AAC9C,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,gBAAgB,EAC1B,GAAG,EAAE,UAAU,GACd,WAAW,CA+Cb"}

package/dist/resolve-throws-union.js

@@ -0,0 +1,252 @@
+export function createResolveCtx(allManifests, defs, aliases) {
+    return {
+        allManifests,
+        defs,
+        aliases,
+        memo: new Map(),
+        inProgress: new Set(),
+    };
+}
+function emptyUnion() {
+    return { codes: new Map(), unbounded: false };
+}
+function unionInto(target, src) {
+    for (const [code, meta] of src.codes) {
+        if (!target.codes.has(code))
+            target.codes.set(code, meta);
+    }
+    if (src.unbounded)
+        target.unbounded = true;
+}
+function definitionFor(kind, defs, aliases) {
+    const resolved = aliases.resolveKind(kind);
+    return defs.resolve(kind) ?? (resolved ? defs.resolve(resolved) : undefined);
+}
+function codesFromDefinition(definition) {
+    const out = new Map();
+    const raw = definition.throws?.codes ?? {};
+    for (const [code, meta] of Object.entries(raw)) {
+        out.set(code, { data: meta.data });
+    }
+    return out;
+}
+/** Resolve the effective throw union for a named manifest. The result combines
+ *  explicit `throws.codes`, `throws.inherit: true` dataflow (step-context
+ *  traversal with try/catch subtraction), and unbounded markers for
+ *  unresolvable passthrough call sites. Cycles short-circuit to an empty
+ *  result so resolution always terminates. */
+export function resolveThrowsUnion(manifest, ctx) {
+    const name = manifest.metadata?.name;
+    if (name) {
+        const cached = ctx.memo.get(name);
+        if (cached)
+            return cached;
+        if (ctx.inProgress.has(name))
+            return emptyUnion();
+    }
+    const definition = definitionFor(manifest.kind, ctx.defs, ctx.aliases);
+    if (!definition) {
+        const u = { codes: new Map(), unbounded: true };
+        if (name)
+            ctx.memo.set(name, u);
+        return u;
+    }
+    const throws = definition.throws;
+    if (!throws) {
+        const u = emptyUnion();
+        if (name)
+            ctx.memo.set(name, u);
+        return u;
+    }
+    if (name)
+        ctx.inProgress.add(name);
+    try {
+        const result = { codes: new Map(), unbounded: false };
+        for (const [code, meta] of codesFromDefinition(definition)) {
+            result.codes.set(code, meta);
+        }
+        if (throws.passthrough) {
+            // Definition-level passthrough can't be resolved without a call site.
+            // resolveStepInvokeThrows handles passthrough call sites directly.
+            result.unbounded = true;
+        }
+        if (throws.inherit) {
+            const inherited = resolveInherited(manifest, definition, ctx);
+            unionInto(result, inherited);
+        }
+        if (name)
+            ctx.memo.set(name, result);
+        return result;
+    }
+    finally {
+        if (name)
+            ctx.inProgress.delete(name);
+    }
+}
+function resolveInherited(manifest, definition, ctx) {
+    const result = { codes: new Map(), unbounded: false };
+    const props = definition.schema?.properties;
+    if (!props)
+        return result;
+    for (const [fieldName, fieldSchema] of Object.entries(props)) {
+        const stepCtx = fieldSchema["x-telo-step-context"];
+        if (!stepCtx?.invoke)
+            continue;
+        const steps = manifest[fieldName];
+        if (!Array.isArray(steps))
+            continue;
+        unionInto(result, collectStepArrayThrows(steps, stepCtx.invoke, undefined, ctx));
+    }
+    return result;
+}
+function collectStepArrayThrows(steps, invokeField, enclosingTryCodes, ctx) {
+    const result = emptyUnion();
+    for (const step of steps) {
+        if (!step || typeof step !== "object")
+            continue;
+        unionInto(result, collectStepThrows(step, invokeField, enclosingTryCodes, ctx));
+    }
+    return result;
+}
+/** Walk one step, dispatching by shape. Generic for any Run.Sequence-style
+ *  composer: the step keys it recognises (`try` / `catch` / `finally` / `then`
+ *  / `else` / `elseif` / `do` / `cases` / `default`) are the same set already
+ *  traversed by the analyzer's `x-telo-step-context` schema builder, so future
+ *  composers that reuse those shape conventions work without changes here. */
+function collectStepThrows(step, invokeField, enclosingTryCodes, ctx) {
+    if (step[invokeField]) {
+        return resolveStepInvokeThrows(step, invokeField, enclosingTryCodes, ctx);
+    }
+    if (step.throw && typeof step.throw === "object") {
+        return resolveThrowStepCode(step.throw, enclosingTryCodes);
+    }
+    if (Array.isArray(step.try)) {
+        const tryUnion = collectStepArrayThrows(step.try, invokeField, enclosingTryCodes, ctx);
+        let propagated;
+        if (Array.isArray(step.catch)) {
+            // Catch absorbs the try block's codes; the catch's own throws propagate
+            // out instead. Sequence-specific subtraction — the plan explicitly
+            // anchors this to Run.Sequence's try/catch schema shape.
+            const tryCodes = new Set(tryUnion.codes.keys());
+            propagated = collectStepArrayThrows(step.catch, invokeField, tryCodes, ctx);
+            // Unbounded in the try block still signals the caller to expect
+            // arbitrary codes to flow through the catch (e.g. via passthrough).
+            if (tryUnion.unbounded)
+                propagated.unbounded = true;
+        }
+        else {
+            propagated = cloneUnion(tryUnion);
+        }
+        if (Array.isArray(step.finally)) {
+            unionInto(propagated, collectStepArrayThrows(step.finally, invokeField, enclosingTryCodes, ctx));
+        }
+        return propagated;
+    }
+    if (Array.isArray(step.then)) {
+        const result = emptyUnion();
+        unionInto(result, collectStepArrayThrows(step.then, invokeField, enclosingTryCodes, ctx));
+        if (Array.isArray(step.else)) {
+            unionInto(result, collectStepArrayThrows(step.else, invokeField, enclosingTryCodes, ctx));
+        }
+        if (Array.isArray(step.elseif)) {
+            for (const branch of step.elseif) {
+                if (Array.isArray(branch?.then)) {
+                    unionInto(result, collectStepArrayThrows(branch.then, invokeField, enclosingTryCodes, ctx));
+                }
+            }
+        }
+        return result;
+    }
+    if (Array.isArray(step.do)) {
+        return collectStepArrayThrows(step.do, invokeField, enclosingTryCodes, ctx);
+    }
+    if (step.cases && typeof step.cases === "object") {
+        const result = emptyUnion();
+        for (const arr of Object.values(step.cases)) {
+            if (Array.isArray(arr)) {
+                unionInto(result, collectStepArrayThrows(arr, invokeField, enclosingTryCodes, ctx));
+            }
+        }
+        if (Array.isArray(step.default)) {
+            unionInto(result, collectStepArrayThrows(step.default, invokeField, enclosingTryCodes, ctx));
+        }
+        return result;
+    }
+    return emptyUnion();
+}
+function cloneUnion(u) {
+    const out = emptyUnion();
+    for (const [c, m] of u.codes)
+        out.codes.set(c, m);
+    out.unbounded = u.unbounded;
+    return out;
+}
+function resolveStepInvokeThrows(step, invokeField, enclosingTryCodes, ctx) {
+    const invokeRef = step[invokeField];
+    if (!invokeRef || typeof invokeRef !== "object")
+        return emptyUnion();
+    const invokedKind = invokeRef.kind;
+    if (!invokedKind)
+        return emptyUnion();
+    const definition = definitionFor(invokedKind, ctx.defs, ctx.aliases);
+    if (!definition)
+        return { codes: new Map(), unbounded: true };
+    if (definition.throws?.passthrough) {
+        return resolvePassthroughAtCallSite(step, enclosingTryCodes);
+    }
+    // Named manifest: resolve the full chain (covers transitive inherit).
+    const invokeName = invokeRef.name;
+    if (invokeName) {
+        const target = ctx.allManifests.find((m) => m.metadata?.name === invokeName &&
+            (m.kind === invokedKind ||
+                ctx.aliases.resolveKind(m.kind) === invokedKind ||
+                m.kind === ctx.aliases.resolveKind(invokedKind)));
+        if (target)
+            return resolveThrowsUnion(target, ctx);
+    }
+    // Fall back to the definition's own explicit codes. Mark unbounded when the
+    // definition depends on call-site or transitive resolution we couldn't
+    // perform (no specific target manifest to recurse into).
+    const codes = codesFromDefinition(definition);
+    const unbounded = definition.throws?.inherit === true || definition.throws?.passthrough === true;
+    return { codes, unbounded };
+}
+/** Resolve a passthrough-style invocable at a specific call site. Recognised forms
+ *  (see "passthrough: true" in the plan):
+ *  - constant literal (no template) → `{ <literal> }`
+ *  - `${{ 'FOO' }}` constant expression → `{ FOO }`
+ *  - `${{ error.code }}` inside a catch → enclosing try's propagated union
+ *  Anything else is unbounded; the analyzer flags it downstream. */
+function resolvePassthroughAtCallSite(step, enclosingTryCodes) {
+    return resolveCodeExpression(step.inputs?.code, enclosingTryCodes);
+}
+/** Resolve the `code:` of a `throw:` step to a throws union. Uses the same
+ *  recognised forms as passthrough call sites. */
+function resolveThrowStepCode(throwSpec, enclosingTryCodes) {
+    return resolveCodeExpression(throwSpec.code, enclosingTryCodes);
+}
+function resolveCodeExpression(codeInput, enclosingTryCodes) {
+    if (typeof codeInput !== "string" || codeInput.length === 0) {
+        return { codes: new Map(), unbounded: true };
+    }
+    const match = codeInput.match(/^\s*\$\{\{\s*([\s\S]+?)\s*\}\}\s*$/);
+    if (!match) {
+        return { codes: new Map([[codeInput, {}]]), unbounded: false };
+    }
+    const expr = match[1].trim();
+    const litMatch = expr.match(/^'([^']+)'$|^"([^"]+)"$/);
+    if (litMatch) {
+        const code = litMatch[1] ?? litMatch[2];
+        return { codes: new Map([[code, {}]]), unbounded: false };
+    }
+    if (expr === "error.code") {
+        if (enclosingTryCodes) {
+            const codes = new Map();
+            for (const c of enclosingTryCodes)
+                codes.set(c, {});
+            return { codes, unbounded: false };
+        }
+        return { codes: new Map(), unbounded: true };
+    }
+    return { codes: new Map(), unbounded: true };
+}