@telorun/analyzer 0.1.4 → 0.2.1

package/dist/types.d.ts

@@ -67,6 +67,9 @@ export interface LoaderInitOptions {
     includeRegistryAdapter?: boolean;
     /** Base URL used by built-in RegistryAdapter when enabled. */
     registryUrl?: string;
+    /** Handlers for CEL stdlib functions (e.g. `sha256`). Analyzer-only callers may
+     *  omit this and get throwing stubs; runtime callers (kernel) must supply real impls. */
+    celHandlers?: import("./cel-environment.js").CelHandlers;
 }
 export interface AnalysisOptions {
     strictContexts?: boolean;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;qHACqH;AACrH,eAAO,MAAM,kBAAkB;;;;;CAKrB,CAAC;AACX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAC;AAE9F,gFAAgF;AAChF,eAAO,MAAM,yBAAyB,cAAc,CAAC;AAErD,MAAM,WAAW,QAAQ;IACvB,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,KAAK;IACpB,KAAK,EAAE,QAAQ,CAAC;IAChB,GAAG,EAAE,QAAQ,CAAC;CACf;AAED;;oDAEoD;AACpD,MAAM,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAE/C;6EAC6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,2BAA2B;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAExD;;sEAEkE;IAClE,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEjE;;sEAEkE;IAClE,cAAc,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,WAAW;IAC1B;;;+EAG2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,aAAa,CAAC,EAAE,eAAe,EAAE,CAAC;IAClC,sDAAsD;IACtD,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,0DAA0D;IAC1D,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;gEAKgE;AAChE,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,OAAO,qBAAqB,EAAE,aAAa,CAAC;IACtD,WAAW,CAAC,EAAE,OAAO,0BAA0B,EAAE,kBAAkB,CAAC;CACrE"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;qHACqH;AACrH,eAAO,MAAM,kBAAkB;;;;;CAKrB,CAAC;AACX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAC;AAE9F,gFAAgF;AAChF,eAAO,MAAM,yBAAyB,cAAc,CAAC;AAErD,MAAM,WAAW,QAAQ;IACvB,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,KAAK;IACpB,KAAK,EAAE,QAAQ,CAAC;IAChB,GAAG,EAAE,QAAQ,CAAC;CACf;AAED;;oDAEoD;AACpD,MAAM,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAE/C;6EAC6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,2BAA2B;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAExD;;sEAEkE;IAClE,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEjE;;sEAEkE;IAClE,cAAc,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,WAAW;IAC1B;;;+EAG2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,aAAa,CAAC,EAAE,eAAe,EAAE,CAAC;IAClC,sDAAsD;IACtD,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,0DAA0D;IAC1D,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;6FACyF;IACzF,WAAW,CAAC,EAAE,OAAO,sBAAsB,EAAE,WAAW,CAAC;CAC1D;AAED,MAAM,WAAW,eAAe;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;gEAKgE;AAChE,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,OAAO,qBAAqB,EAAE,aAAa,CAAC;IACtD,WAAW,CAAC,EAAE,OAAO,0BAA0B,EAAE,kBAAkB,CAAC;CACrE"}

package/dist/validate-cel-context.js

@@ -8,7 +8,7 @@ export function resolveTypeFieldToSchema(value, allManifests) {
     if (!value)
         return undefined;
     if (typeof value === "string") {
-        // Named type reference — find a Kernel.Type resource by name
+        // Named type reference — find a Telo.Type resource by name
         const typeManifest = allManifests.find((m) => m.metadata?.name === value &&
             typeof m.kind === "string" &&
             /\bType\b/.test(m.kind) &&

package/dist/validate-references.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-references.d.ts","sourceRoot":"","sources":["../src/validate-references.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA6C/F;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,GACvB,kBAAkB,EAAE,CAgQtB"}
+{"version":3,"file":"validate-references.d.ts","sourceRoot":"","sources":["../src/validate-references.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAkD/F;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,GACvB,kBAAkB,EAAE,CAkQtB"}

package/dist/validate-references.js

@@ -2,7 +2,12 @@ import { isRefEntry, isScopeEntry, isSchemaFromEntry, isInlineResource, resolveF
 import { navigateJsonPointer } from "./schema-compat.js";
 import { DiagnosticSeverity } from "./types.js";
 const SOURCE = "telo-analyzer";
-const SYSTEM_KINDS = new Set(["Kernel.Definition", "Kernel.Abstract"]);
+/** Kinds skipped by reference validation. Telo.Application and Telo.Library
+ *  are intentionally not here: Application has `targets` with x-telo-ref that
+ *  must be validated, and Library has no ref-bearing fields so flows through
+ *  harmlessly. Telo.Import is also not here for the same reason — its
+ *  `source` field isn't x-telo-ref, so nothing gets checked. */
+const SYSTEM_KINDS = new Set(["Telo.Definition", "Telo.Abstract"]);
 /**
  * Checks whether `kind` satisfies the ref constraint in `entry`.
  * Returns an empty array when valid, or mismatch error strings when not.
@@ -19,7 +24,7 @@ function checkKind(kind, entry, registry, aliases) {
         const targetDef = registry.resolve(targetKind);
         if (!targetDef)
             return [];
-        if (targetDef.kind === "Kernel.Abstract") {
+        if (targetDef.kind === "Telo.Abstract") {
             const implementing = registry.getByExtends(targetKind);
             if (implementing.length === 0)
                 return []; // partial context — no implementations loaded yet
@@ -59,7 +64,7 @@ export function validateReferences(resources, context) {
     if (!aliases || !registry)
         return diagnostics;
     // Build outer resource lookup by name for resolution check.
-    // Exclude system kinds (Kernel.Definition) — they are type blueprints, not instances,
+    // Exclude system kinds (Telo.Definition) — they are type blueprints, not instances,
     // and their names (e.g. "Server", "Job") would shadow user-defined resource instances.
     const byName = new Map();
     for (const r of resources) {
@@ -74,6 +79,7 @@ export function validateReferences(resources, context) {
             continue;
         const resourceLabel = `${r.kind}/${r.metadata.name}`;
         const resourceData = { kind: r.kind, name: r.metadata.name };
+        const filePath = r.metadata?.source;
         // Collect scope visibility prefixes (JSON Pointer → dot prefix) and their manifests.
         // scope field path → flat array of ResourceManifest declared in that scope.
         const scopeManifestsByPointer = new Map();
@@ -131,7 +137,7 @@ export function validateReferences(resources, context) {
                             code: "UNRESOLVED_REFERENCE",
                             source: SOURCE,
                             message: `${resourceLabel}: reference at '${fieldPath}' → resource '${val}' not found`,
-                            data: { resource: resourceData, path: fieldPath },
+                            data: { resource: resourceData, filePath, path: fieldPath },
                         });
                         continue;
                     }
@@ -142,7 +148,7 @@ export function validateReferences(resources, context) {
                             code: "REFERENCE_KIND_MISMATCH",
                             source: SOURCE,
                             message: `${resourceLabel}: reference at '${fieldPath}' → ${kindErrors.join("; ")}`,
-                            data: { resource: resourceData, path: fieldPath },
+                            data: { resource: resourceData, filePath, path: fieldPath },
                         });
                     }
                     continue;
@@ -160,7 +166,7 @@ export function validateReferences(resources, context) {
                         code: "INVALID_REFERENCE",
                         source: SOURCE,
                         message: `${resourceLabel}: reference at '${fieldPath}' must have string 'kind' and 'name' fields`,
-                        data: { resource: resourceData, path: fieldPath },
+                        data: { resource: resourceData, filePath, path: fieldPath },
                     });
                     continue;
                 }
@@ -172,7 +178,7 @@ export function validateReferences(resources, context) {
                         code: "REFERENCE_KIND_MISMATCH",
                         source: SOURCE,
                         message: `${resourceLabel}: reference at '${fieldPath}' → ${kindErrors.join("; ")}`,
-                        data: { resource: resourceData, path: fieldPath },
+                        data: { resource: resourceData, filePath, path: fieldPath },
                     });
                 }
                 // 3. Resolution check — resource with this name must exist.
@@ -184,7 +190,7 @@ export function validateReferences(resources, context) {
                         code: "UNRESOLVED_REFERENCE",
                         source: SOURCE,
                         message: `${resourceLabel}: reference at '${fieldPath}' → resource '${refVal.name}' not found`,
-                        data: { resource: resourceData, path: fieldPath },
+                        data: { resource: resourceData, filePath, path: fieldPath },
                     });
                 }
             }
@@ -202,6 +208,7 @@ export function validateReferences(resources, context) {
             continue;
         const resourceLabel = `${r.kind}/${r.metadata.name}`;
         const resourceData = { kind: r.kind, name: r.metadata.name };
+        const filePath = r.metadata?.source;
         for (const [fieldPath, entry] of fieldMap) {
             if (!isSchemaFromEntry(entry))
                 continue;
@@ -215,7 +222,7 @@ export function validateReferences(resources, context) {
                     code: "INVALID_SCHEMA_FROM",
                     source: SOURCE,
                     message: `${resourceLabel}: x-telo-schema-from "${schemaFrom}" must contain at least one "/" to separate anchor from JSON Pointer`,
-                    data: { resource: resourceData, path: fieldPath },
+                    data: { resource: resourceData, filePath, path: fieldPath },
                 });
                 continue;
             }
@@ -255,7 +262,7 @@ export function validateReferences(resources, context) {
                         code: "SCHEMA_FROM_MISSING_PATH",
                         source: SOURCE,
                         message: `${resourceLabel}: x-telo-schema-from at '${fieldPath}' → kind '${refVal.kind}' has no schema`,
-                        data: { resource: resourceData, path: fieldPath },
+                        data: { resource: resourceData, filePath, path: fieldPath },
                     });
                     continue;
                 }
@@ -266,7 +273,7 @@ export function validateReferences(resources, context) {
                         code: "SCHEMA_FROM_MISSING_PATH",
                         source: SOURCE,
                         message: `${resourceLabel}: x-telo-schema-from at '${fieldPath}' → kind '${refVal.kind}' has no schema path '${jsonPointer}'`,
-                        data: { resource: resourceData, path: fieldPath },
+                        data: { resource: resourceData, filePath, path: fieldPath },
                     });
                     continue;
                 }
@@ -277,7 +284,7 @@ export function validateReferences(resources, context) {
                         code: "DEPENDENT_SCHEMA_MISMATCH",
                         source: SOURCE,
                         message: `${resourceLabel}: '${fieldPath}' does not match schema from '${refVal.kind}${jsonPointer}': ${issue}`,
-                        data: { resource: resourceData, path: fieldPath },
+                        data: { resource: resourceData, filePath, path: fieldPath },
                     });
                 }
             }

package/dist/validate-throws-coverage.d.ts

@@ -0,0 +1,8 @@
+import type { Environment } from "@marcbachmann/cel-js";
+import type { ResourceManifest } from "@telorun/sdk";
+import type { AliasResolver } from "./alias-resolver.js";
+import type { DefinitionRegistry } from "./definition-registry.js";
+import { type AnalysisDiagnostic } from "./types.js";
+/** Entry point — invoked once per analyze() run. */
+export declare function validateThrowsCoverage(manifests: ResourceManifest[], defs: DefinitionRegistry, aliases: AliasResolver, env: Environment): AnalysisDiagnostic[];
+//# sourceMappingURL=validate-throws-coverage.d.ts.map

package/dist/validate-throws-coverage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-throws-coverage.d.ts","sourceRoot":"","sources":["../src/validate-throws-coverage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAOnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AA4dzE,oDAAoD;AACpD,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,WAAW,GACf,kBAAkB,EAAE,CAwCtB"}

package/dist/validate-throws-coverage.js

@@ -0,0 +1,461 @@
+import { createResolveCtx, resolveThrowsUnion, } from "./resolve-throws-union.js";
+import { DiagnosticSeverity } from "./types.js";
+import { extractAccessChains, validateChainAgainstSchema } from "./validate-cel-context.js";
+const SOURCE = "telo-analyzer";
+const TEMPLATE_REGEX = /\$\{\{\s*([^}]+?)\s*\}\}/g;
+/** Walk `definition.schema` and `data` in tandem, invoking `onOutcome` each
+ *  time an array schema annotated with `x-telo-outcome-list` is encountered.
+ *  Keeps schema/data in lockstep so callers can resolve sibling fields. */
+function collectOutcomeLists(manifest, schema, onReturns, onCatches) {
+    if (!schema)
+        return;
+    walkSchemaData(schema, manifest, "", {
+        manifest,
+        onReturns,
+        onCatches,
+    });
+}
+function walkSchemaData(schema, data, path, ctx) {
+    if (!schema || typeof schema !== "object")
+        return;
+    const outcomeKind = schema["x-telo-outcome-list"];
+    if (outcomeKind && Array.isArray(data)) {
+        // The sibling data is the parent object (not reachable here without tracking).
+        // collectOutcomeListsInObject passes the parent; this branch is a fallback
+        // for top-level outcome lists (never occurs in practice).
+        if (outcomeKind === "returns") {
+            ctx.onReturns({ manifest: ctx.manifest, entries: data, arrayPath: path });
+        }
+        return;
+    }
+    if (schema.properties && typeof data === "object" && data !== null && !Array.isArray(data)) {
+        const dataObj = data;
+        for (const [key, propSchema] of Object.entries(schema.properties)) {
+            const nextPath = path ? `${path}.${key}` : key;
+            const child = dataObj[key];
+            const outcome = propSchema["x-telo-outcome-list"];
+            if (outcome) {
+                const entries = Array.isArray(child) ? child : [];
+                if (outcome === "returns") {
+                    // Only fire for present arrays — rule 6 (missing returns) is
+                    // enforced by schema required fields, not here.
+                    if (Array.isArray(child)) {
+                        ctx.onReturns({ manifest: ctx.manifest, entries, arrayPath: nextPath });
+                    }
+                }
+                else {
+                    const catchesFor = propSchema["x-telo-catches-for"];
+                    if (catchesFor) {
+                        // Fire even when absent so the coverage check can flag handlers
+                        // whose declared union is non-empty but the list is missing.
+                        ctx.onCatches(entries, nextPath, dataObj, catchesFor);
+                    }
+                }
+                continue;
+            }
+            if (child !== undefined)
+                walkSchemaData(propSchema, child, nextPath, ctx);
+        }
+    }
+    if (schema.items && Array.isArray(data)) {
+        for (const [i, item] of data.entries()) {
+            walkSchemaData(schema.items, item, `${path}[${i}]`, ctx);
+        }
+    }
+}
+/** Read a referenced handler's `{kind, name}` from a sibling field. Handles
+ *  both `"Alias.Kind"` strings and `{ kind, name? }` objects. */
+function resolveHandlerRef(sibling) {
+    if (!sibling)
+        return null;
+    if (typeof sibling === "string")
+        return { kind: sibling };
+    if (typeof sibling === "object") {
+        const obj = sibling;
+        if (typeof obj.kind === "string") {
+            return { kind: obj.kind, name: obj.name };
+        }
+    }
+    return null;
+}
+/** Parse a `when:` CEL expression and extract the set of `error.code` literals
+ *  it covers. Recognised forms (per the plan's "coverage-proving" list):
+ *  - `error.code == 'FOO'`
+ *  - a disjunction of the above (`||`)
+ *  - `error.code in ['FOO', 'BAR']`
+ *  Parenthesised nestings of `||` over equality/in are flattened.
+ *  Any non-matching sub-expression forfeits coverage for the whole `when:`. */
+function extractCoveredCodes(whenExpr, env) {
+    const match = whenExpr.match(/\$\{\{\s*([^}]+?)\s*\}\}/);
+    if (!match)
+        return { proven: false, codes: new Set() };
+    let ast;
+    try {
+        ast = env.parse(match[1].trim()).ast;
+    }
+    catch {
+        return { proven: false, codes: new Set() };
+    }
+    const codes = new Set();
+    const proven = extractFromNode(ast, codes);
+    return { proven, codes };
+}
+function extractFromNode(node, codes) {
+    if (node.op === "||") {
+        const [l, r] = node.args;
+        return extractFromNode(l, codes) && extractFromNode(r, codes);
+    }
+    if (node.op === "==") {
+        const [l, r] = node.args;
+        const lit = readErrorCodeEq(l, r) ?? readErrorCodeEq(r, l);
+        if (lit === null)
+            return false;
+        codes.add(lit);
+        return true;
+    }
+    if (node.op === "in") {
+        const [l, r] = node.args;
+        if (!isErrorCodeRef(l) || r.op !== "list")
+            return false;
+        for (const item of r.args) {
+            if (item.op !== "value" || typeof item.args !== "string")
+                return false;
+            codes.add(item.args);
+        }
+        return true;
+    }
+    return false;
+}
+function readErrorCodeEq(ref, lit) {
+    if (!isErrorCodeRef(ref))
+        return null;
+    if (lit.op !== "value" || typeof lit.args !== "string")
+        return null;
+    return lit.args;
+}
+function isErrorCodeRef(node) {
+    if (node.op !== ".")
+        return false;
+    const [obj, field] = node.args;
+    if (field !== "code")
+        return false;
+    return obj.op === "id" && obj.args === "error";
+}
+/** Rule 7: within an outcome list, a no-`when:` entry must be the last entry. */
+function checkCatchAllPlacement(entries, resource, channel, filePath, arrayPath) {
+    const diagnostics = [];
+    for (let i = 0; i < entries.length - 1; i++) {
+        const e = entries[i];
+        if (!e?.when) {
+            diagnostics.push({
+                severity: DiagnosticSeverity.Error,
+                code: "CATCHALL_NOT_LAST",
+                source: SOURCE,
+                message: `${channel}: catch-all entry (no \`when:\`) at index ${i} must be last — entries after it are unreachable.`,
+                data: { resource, filePath, path: `${arrayPath}[${i}]` },
+            });
+        }
+    }
+    return diagnostics;
+}
+/** Rule 1 + Rule 4: check declared-union coverage and reject undeclared codes
+ *  in coverage-proving `when:` clauses. Phase 2 accepts inherit/passthrough
+ *  handler unions too — when the resolved union is unbounded, a catch-all is
+ *  required (rule 4 extension). */
+function checkCatchesCoverage(entries, union, resource, filePath, arrayPath, env) {
+    const diagnostics = [];
+    const declaredCodes = new Set(union.codes.keys());
+    const covered = new Set();
+    let hasCatchAll = false;
+    for (let i = 0; i < entries.length; i++) {
+        const e = entries[i];
+        if (!e)
+            continue;
+        if (!e.when) {
+            hasCatchAll = true;
+            continue;
+        }
+        const { proven, codes } = extractCoveredCodes(e.when, env);
+        if (proven) {
+            for (const c of codes) {
+                if (!declaredCodes.has(c)) {
+                    diagnostics.push({
+                        severity: DiagnosticSeverity.Error,
+                        code: "UNDECLARED_THROW_CODE",
+                        source: SOURCE,
+                        message: `catches[${i}] references code '${c}' which is not in the handler's declared throw union {${[...declaredCodes].sort().join(", ") || "∅"}}${union.unbounded ? " (union is unbounded — a catch-all is required)" : ""}.`,
+                        data: { resource, filePath, path: `${arrayPath}[${i}].when` },
+                    });
+                }
+                else {
+                    covered.add(c);
+                }
+            }
+        }
+    }
+    // Unbounded union (passthrough or transitive): authors can't enumerate the
+    // codes, so a catch-all is mandatory.
+    if (union.unbounded && !hasCatchAll) {
+        diagnostics.push({
+            severity: DiagnosticSeverity.Error,
+            code: "UNBOUNDED_UNION_NEEDS_CATCHALL",
+            source: SOURCE,
+            message: `The handler's throw union is unbounded (inherit/passthrough resolution couldn't enumerate all codes). The catches: list must include a catch-all entry (no \`when:\`).`,
+            data: { resource, filePath, path: arrayPath },
+        });
+    }
+    if (!hasCatchAll) {
+        for (const code of declaredCodes) {
+            if (!covered.has(code)) {
+                diagnostics.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: "UNCOVERED_THROW_CODE",
+                    source: SOURCE,
+                    message: `Code '${code}' is declared by the handler but not covered by any catches: entry (no matching \`when:\` and no catch-all).`,
+                    data: { resource, filePath, path: arrayPath },
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+/** Rule 2: for each `error.data.<field>` chain in a catches entry's expressions,
+ *  type-check against the data schema declared for the matched code(s). When the
+ *  matching `when:` disjunctively covers multiple codes, use the intersection
+ *  of their data schemas so only fields present on every code narrow through. */
+function checkTypedErrorData(entries, union, resource, filePath, arrayPath, env) {
+    const diagnostics = [];
+    // If the union is unbounded we can't narrow data schemas reliably — skip
+    // typed-data checks for those entries. The catch-all path still provides
+    // runtime access to error.data as an opaque value.
+    if (union.unbounded || union.codes.size === 0)
+        return diagnostics;
+    const dataByCode = {};
+    for (const [code, meta] of union.codes) {
+        dataByCode[code] = meta.data;
+    }
+    const allCodes = Object.keys(dataByCode);
+    for (let i = 0; i < entries.length; i++) {
+        const e = entries[i];
+        if (!e)
+            continue;
+        const covered = e.when
+            ? extractCoveredCodes(e.when, env)
+            : { proven: false, codes: new Set() };
+        // Codes applicable to this entry:
+        //  - coverage-proving `when:` → exactly those codes
+        //  - catch-all (no `when:`) or non-proven expr → all declared codes
+        const applicable = covered.proven
+            ? [...covered.codes].filter((c) => c in dataByCode)
+            : allCodes;
+        if (applicable.length === 0)
+            continue;
+        const schemas = applicable.map((c) => dataByCode[c]).filter(Boolean);
+        if (schemas.length === 0)
+            continue;
+        const dataSchema = intersectDataSchemas(schemas);
+        // Walk CEL expressions inside this entry's body / headers — only
+        // string-valued fields can contain CEL templates.
+        collectCelStrings(e.body, `${arrayPath}[${i}].body`).forEach((entry) => {
+            diagnostics.push(...checkCelChainAgainstDataSchema(entry, dataSchema, resource, filePath, env));
+        });
+        if (e.headers) {
+            collectCelStrings(e.headers, `${arrayPath}[${i}].headers`).forEach((entry) => {
+                diagnostics.push(...checkCelChainAgainstDataSchema(entry, dataSchema, resource, filePath, env));
+            });
+        }
+    }
+    return diagnostics;
+}
+/** Intersection of JSON Schemas (object type, explicit properties only). Only
+ *  retains properties present in every input; picks the most-specific of the
+ *  sub-schemas when they agree on `type`, else widens to `{}`. */
+function intersectDataSchemas(schemas) {
+    if (schemas.length === 1)
+        return schemas[0];
+    const commonProps = {};
+    const firstProps = (schemas[0].properties ?? {});
+    for (const propName of Object.keys(firstProps)) {
+        const sub = schemas.map((s) => (s.properties ?? {})[propName]);
+        if (sub.some((p) => p === undefined))
+            continue;
+        commonProps[propName] = intersectPropertySchemas(sub);
+    }
+    return {
+        type: "object",
+        properties: commonProps,
+        additionalProperties: false,
+    };
+}
+function intersectPropertySchemas(schemas) {
+    const types = new Set(schemas.map((s) => s?.type).filter(Boolean));
+    if (types.size === 1) {
+        const type = [...types][0];
+        if (type === "object")
+            return intersectDataSchemas(schemas);
+        return { type };
+    }
+    return {};
+}
+function collectCelStrings(value, path) {
+    const out = [];
+    if (typeof value === "string") {
+        for (const m of value.matchAll(TEMPLATE_REGEX)) {
+            out.push({ expr: m[1].trim(), path });
+        }
+        return out;
+    }
+    if (Array.isArray(value)) {
+        for (const [i, v] of value.entries()) {
+            out.push(...collectCelStrings(v, `${path}[${i}]`));
+        }
+        return out;
+    }
+    if (value !== null && typeof value === "object") {
+        for (const [k, v] of Object.entries(value)) {
+            out.push(...collectCelStrings(v, path ? `${path}.${k}` : k));
+        }
+    }
+    return out;
+}
+function checkCelChainAgainstDataSchema(entry, dataSchema, resource, filePath, env) {
+    let ast;
+    try {
+        ast = env.parse(entry.expr).ast;
+    }
+    catch {
+        return [];
+    }
+    const chains = extractAccessChains(ast);
+    const diagnostics = [];
+    for (const chain of chains) {
+        // Only interested in chains that start with error.data.*
+        if (chain[0] !== "error" || chain[1] !== "data" || chain.length <= 2)
+            continue;
+        const subChain = chain.slice(2); // strip "error", "data"
+        const err = validateChainAgainstSchema(subChain, dataSchema);
+        if (err) {
+            diagnostics.push({
+                severity: DiagnosticSeverity.Error,
+                code: "CEL_UNKNOWN_FIELD",
+                source: SOURCE,
+                message: `${resource.kind}/${resource.name}: CEL at '${entry.path}': error.data.${err}`,
+                data: { resource, filePath, path: entry.path },
+            });
+        }
+    }
+    return diagnostics;
+}
+/** Rule 8 extension: `inherit: true` only makes sense on a definition whose
+ *  schema contains at least one `x-telo-step-context` array — the annotation
+ *  that drives the resolver's generic step traversal. A definition with
+ *  `inherit: true` and no such array has no invocables to inherit from. */
+function validateThrowsDeclarations(manifests) {
+    const diagnostics = [];
+    for (const m of manifests) {
+        if (m.kind !== "Telo.Definition")
+            continue;
+        const throws = m.throws;
+        if (!throws)
+            continue;
+        const name = m.metadata?.name ?? "<unnamed>";
+        const filePath = m.metadata?.source;
+        if (throws.inherit === true) {
+            const schema = m.schema;
+            if (!schemaHasStepContext(schema)) {
+                diagnostics.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: "INHERIT_WITHOUT_STEP_CONTEXT",
+                    source: SOURCE,
+                    message: `Telo.Definition '${name}' declares throws.inherit: true but its schema has no field annotated with x-telo-step-context. inherit is only meaningful on definitions that drive invocables via step arrays.`,
+                    data: { resource: { kind: m.kind, name }, filePath, path: "throws.inherit" },
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+function schemaHasStepContext(schema) {
+    if (!schema || typeof schema !== "object")
+        return false;
+    if ("x-telo-step-context" in schema)
+        return true;
+    const props = schema.properties;
+    if (props && typeof props === "object") {
+        for (const v of Object.values(props)) {
+            if (schemaHasStepContext(v))
+                return true;
+        }
+    }
+    if (schema.items && schemaHasStepContext(schema.items))
+        return true;
+    for (const key of ["oneOf", "anyOf", "allOf"]) {
+        const arr = schema[key];
+        if (Array.isArray(arr)) {
+            for (const sub of arr)
+                if (schemaHasStepContext(sub))
+                    return true;
+        }
+    }
+    if (schema.$defs && typeof schema.$defs === "object") {
+        for (const v of Object.values(schema.$defs)) {
+            if (schemaHasStepContext(v))
+                return true;
+        }
+    }
+    return false;
+}
+/** Entry point — invoked once per analyze() run. */
+export function validateThrowsCoverage(manifests, defs, aliases, env) {
+    const diagnostics = [];
+    diagnostics.push(...validateThrowsDeclarations(manifests));
+    const resolveCtx = createResolveCtx(manifests, defs, aliases);
+    for (const manifest of manifests) {
+        if (!manifest.kind || !manifest.metadata?.name)
+            continue;
+        if (manifest.kind === "Telo.Definition" || manifest.kind === "Telo.Abstract")
+            continue;
+        const resolvedKind = aliases.resolveKind(manifest.kind);
+        const definition = defs.resolve(manifest.kind) ?? (resolvedKind ? defs.resolve(resolvedKind) : undefined);
+        if (!definition?.schema)
+            continue;
+        const resource = { kind: manifest.kind, name: manifest.metadata.name };
+        const filePath = manifest.metadata?.source;
+        collectOutcomeLists(manifest, definition.schema, (ret) => {
+            diagnostics.push(...checkCatchAllPlacement(ret.entries, resource, "returns", filePath, ret.arrayPath));
+        }, (entries, arrayPath, siblingData, catchesFor) => {
+            diagnostics.push(...checkCatchAllPlacement(entries, resource, "catches", filePath, arrayPath));
+            const handlerRef = resolveHandlerRef(siblingData[catchesFor]);
+            const union = handlerRefUnion(handlerRef, manifests, resolveCtx);
+            diagnostics.push(...checkCatchesCoverage(entries, union, resource, filePath, arrayPath, env));
+            diagnostics.push(...checkTypedErrorData(entries, union, resource, filePath, arrayPath, env));
+        });
+    }
+    return diagnostics;
+}
+/** Resolve a handler ref's effective throw union. Prefers the named manifest
+ *  (so `inherit: true` handlers expose their transitive union); falls back to
+ *  the definition's own codes when no name is given. */
+function handlerRefUnion(handlerRef, manifests, ctx) {
+    if (!handlerRef)
+        return { codes: new Map(), unbounded: false };
+    if (handlerRef.name) {
+        const resolvedKind = ctx.aliases.resolveKind(handlerRef.kind);
+        const targetManifest = manifests.find((m) => m.metadata?.name === handlerRef.name &&
+            (m.kind === handlerRef.kind ||
+                m.kind === resolvedKind ||
+                ctx.aliases.resolveKind(m.kind) === handlerRef.kind));
+        if (targetManifest)
+            return resolveThrowsUnion(targetManifest, ctx);
+    }
+    const resolved = ctx.aliases.resolveKind(handlerRef.kind);
+    const def = ctx.defs.resolve(handlerRef.kind) ?? (resolved ? ctx.defs.resolve(resolved) : undefined);
+    if (!def?.throws)
+        return { codes: new Map(), unbounded: false };
+    const codes = new Map();
+    for (const [c, meta] of Object.entries(def.throws.codes ?? {})) {
+        codes.set(c, { data: meta.data });
+    }
+    const unbounded = def.throws.passthrough === true || def.throws.inherit === true;
+    return { codes, unbounded };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.1.4",
+  "version": "0.2.1",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",
@@ -41,7 +41,7 @@
     "ajv-formats": "^3.0.1",
     "jsonpath-plus": "^10.3.0",
     "yaml": "^2.8.3",
-    "@telorun/sdk": "0.2.8"
+    "@telorun/sdk": "0.3.2"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",