@telorun/analyzer 0.1.4 → 0.2.1

package/src/manifest-loader.ts

@@ -1,7 +1,10 @@
+import type { Environment } from "@marcbachmann/cel-js";
 import { isCompiledValue, type ResourceManifest } from "@telorun/sdk";
 import { isMap, isPair, isScalar, isSeq, parseAllDocuments, type Document } from "yaml";
 import { HttpAdapter } from "./adapters/http-adapter.js";
 import { RegistryAdapter } from "./adapters/registry-adapter.js";
+import { buildCelEnvironment } from "./cel-environment.js";
+import { isModuleKind } from "./module-kinds.js";
 import { precompileDoc } from "./precompile.js";
 import {
   DEFAULT_MANIFEST_FILENAME,
@@ -12,7 +15,12 @@ import {
   type PositionIndex,
 } from "./types.js";
 
-const SYSTEM_KINDS = new Set(["Kernel.Module", "Kernel.Import", "Kernel.Definition"]);
+const SYSTEM_KINDS = new Set([
+  "Telo.Application",
+  "Telo.Library",
+  "Telo.Import",
+  "Telo.Definition",
+]);
 
 export class Loader {
   private static readonly moduleCache = new Map<
@@ -21,6 +29,7 @@ export class Loader {
   >();
 
   protected adapters: ManifestAdapter[];
+  private readonly celEnv: Environment;
 
   constructor(extraAdaptersOrOptions: ManifestAdapter[] | LoaderInitOptions = []) {
     const options: LoaderInitOptions = Array.isArray(extraAdaptersOrOptions)
@@ -37,6 +46,8 @@ export class Loader {
     if (options.extraAdapters?.length) {
       this.adapters.unshift(...options.extraAdapters);
     }
+
+    this.celEnv = buildCelEnvironment(options.celHandlers);
   }
 
   register(adapter: ManifestAdapter): this {
@@ -79,7 +90,7 @@ export class Loader {
       let compiledDocs: unknown[];
       if (options?.compile) {
         try {
-          const result = precompileDoc(rawDoc);
+          const result = precompileDoc(rawDoc, this.celEnv);
           compiledDocs = Array.isArray(result) ? result : [result];
         } catch (error) {
           throw new Error(
@@ -106,17 +117,19 @@ export class Loader {
       }
     }
 
-    const moduleManifests = resolved.filter((m) => m.kind === "Kernel.Module");
+    const moduleManifests = resolved.filter((m) => isModuleKind(m.kind));
     if (moduleManifests.length > 1) {
+      const kinds = moduleManifests.map((m) => m.kind).join(", ");
       throw new Error(
-        `File '${source}' contains ${moduleManifests.length} Kernel.Module declarations. Maximum one is allowed.`,
+        `File '${source}' contains ${moduleManifests.length} module declarations (${kinds}). ` +
+          `A file may declare at most one Telo.Application or Telo.Library.`,
       );
     }
     const moduleManifest = moduleManifests[0];
     const moduleName = moduleManifest?.metadata?.name as string | undefined;
     if (moduleName) {
       for (const manifest of resolved) {
-        if (manifest.kind !== "Kernel.Module" && !manifest.metadata?.module) {
+        if (!isModuleKind(manifest.kind) && !manifest.metadata?.module) {
           const pi = (manifest.metadata as any)?.positionIndex;
           manifest.metadata = { ...manifest.metadata, module: moduleName };
           if (pi) {
@@ -205,7 +218,7 @@ export class Loader {
       let compiledDocs: unknown[];
       if (options?.compile) {
         try {
-          const result = precompileDoc(rawDoc);
+          const result = precompileDoc(rawDoc, this.celEnv);
           compiledDocs = Array.isArray(result) ? result : [result];
         } catch (error) {
           throw new Error(
@@ -247,10 +260,10 @@ export class Loader {
   } | null> {
     // Try loading as a regular module first (it might be a telo.yaml itself).
     // Use loadManifests (not loadModule) so imported definitions are included —
-    // otherwise the analyzer won't know about kinds from Kernel.Import sources.
+    // otherwise the analyzer won't know about kinds from Telo.Import sources.
     try {
       const docs = await this.loadModule(fileUrl);
-      const hasModule = docs.some((d) => d.kind === "Kernel.Module");
+      const hasModule = docs.some((d) => isModuleKind(d.kind));
       if (hasModule) {
         const { source } = await this.pick(fileUrl).read(fileUrl);
         const manifests = await this.loadManifests(fileUrl);
@@ -291,7 +304,7 @@ export class Loader {
 
     while (queue.length > 0) {
       const m = queue.shift()!;
-      if (m.kind !== "Kernel.Import") continue;
+      if (m.kind !== "Telo.Import") continue;
       const importSource = (m as any).source as string | undefined;
       if (!importSource) continue;
       const base = (m.metadata as any)?.source ?? entryUrl;
@@ -311,7 +324,7 @@ export class Loader {
       }
       result.set(importUrl, imported);
       for (const im of imported) {
-        if (im.kind === "Kernel.Import") queue.push(im);
+        if (im.kind === "Telo.Import") queue.push(im);
       }
     }
 
@@ -327,7 +340,7 @@ export class Loader {
 
     while (queue.length > 0) {
       const m = queue.shift()!;
-      if (m.kind !== "Kernel.Import") continue;
+      if (m.kind !== "Telo.Import") continue;
       const importSource = (m as any).source as string | undefined;
       if (!importSource) continue;
       const base = (m.metadata as any)?.source ?? entryUrl;
@@ -345,7 +358,20 @@ export class Loader {
         (e as any).sourceLine = (m.metadata as any)?.sourceLine ?? 0;
         throw e;
       }
-      const importedModule = imported.find((im) => im.kind === "Kernel.Module");
+      // Import target must be a Telo.Library. Check the Library branch
+      // explicitly rather than "anything that's a module kind" so that a
+      // future third kind can't silently slip past as a valid import target.
+      const importedLibrary = imported.find((im) => im.kind === "Telo.Library");
+      const importedApplication = imported.find((im) => im.kind === "Telo.Application");
+      if (importedApplication) {
+        const e = new Error(
+          `Telo.Import target '${importSource}' is a Telo.Application. ` +
+            `Only Telo.Library modules may be imported. Applications are run directly, not imported.`,
+        );
+        (e as any).sourceLine = (m.metadata as any)?.sourceLine ?? 0;
+        throw e;
+      }
+      const importedModule = importedLibrary;
       if (importedModule?.metadata?.name) {
         const pi = (m.metadata as any)?.positionIndex;
         m.metadata = {
@@ -363,8 +389,8 @@ export class Loader {
         }
       }
       for (const im of imported) {
-        if (im.kind === "Kernel.Definition") importedDefs.push(im);
-        if (im.kind === "Kernel.Import") queue.push(im);
+        if (im.kind === "Telo.Definition") importedDefs.push(im);
+        if (im.kind === "Telo.Import") queue.push(im);
       }
     }
 

package/src/module-kinds.ts

@@ -0,0 +1,6 @@
+export const MODULE_KINDS = ["Telo.Application", "Telo.Library"] as const;
+export type ModuleKind = (typeof MODULE_KINDS)[number];
+
+export function isModuleKind(kind: string | undefined): kind is ModuleKind {
+  return kind === "Telo.Application" || kind === "Telo.Library";
+}

package/src/normalize-inline-resources.ts

@@ -3,7 +3,12 @@ import { isRefEntry, isScopeEntry, isInlineResource } from "./reference-field-ma
 import type { DefinitionRegistry } from "./definition-registry.js";
 import type { AliasResolver } from "./alias-resolver.js";
 
-const SYSTEM_KINDS = new Set(["Kernel.Definition", "Kernel.Module", "Kernel.Import"]);
+const SYSTEM_KINDS = new Set([
+  "Telo.Definition",
+  "Telo.Application",
+  "Telo.Library",
+  "Telo.Import",
+]);
 
 /** Replaces characters outside [a-zA-Z0-9_] with underscores. */
 function sanitizeName(raw: string): string {

package/src/precompile.ts

@@ -1,5 +1,5 @@
 import type { CompiledValue } from "@telorun/sdk";
-import { celEnvironment } from "./cel-environment.js";
+import type { Environment } from "@marcbachmann/cel-js";
 
 const TEMPLATE_REGEX = /\$\{\{\s*([^}]+?)\s*\}\}/g;
 const EXACT_TEMPLATE_REGEX = /^\s*\$\{\{\s*([^}]+?)\s*\}\}\s*$/;
@@ -8,31 +8,32 @@ const EXACT_TEMPLATE_REGEX = /^\s*\$\{\{\s*([^}]+?)\s*\}\}\s*$/;
  * Walks a raw YAML document and replaces all "${{ expr }}" strings with
  * CompiledValue wrappers. Throws on CEL syntax errors.
  * Intended to be called once per document at load time.
- * Kernel.Definition documents are returned unchanged — their schema fields
+ * Telo.Definition documents are returned unchanged — their schema fields
  * are static metadata and must not be treated as CEL templates.
  */
-export function precompileDoc(doc: unknown): unknown {
-  if (typeof doc === "string") return compileString(doc);
-  if (Array.isArray(doc)) return doc.map(precompileDoc);
+export function precompileDoc(doc: unknown, env: Environment): unknown {
+  if (typeof doc === "string") return compileString(doc, env);
+  if (Array.isArray(doc)) return doc.map((item) => precompileDoc(item, env));
   // Only recurse into plain objects. Class instances (ResourceInstance, ScopeHandle, etc.)
   // are returned as-is — their prototype methods must not be lost by object reconstruction.
   if (doc !== null && typeof doc === "object" && Object.getPrototypeOf(doc) === Object.prototype) {
     const result: Record<string, unknown> = {};
     for (const [k, v] of Object.entries(doc as Record<string, unknown>)) {
-      result[k] = precompileDoc(v);
+      result[k] = precompileDoc(v, env);
     }
     return result;
   }
   return doc;
 }
 
-function compileString(s: string): unknown {
+function compileString(s: string, env: Environment): unknown {
   if (!s.includes("${{")) return s;
 
   const exact = s.match(EXACT_TEMPLATE_REGEX);
   if (exact) {
-    const fn = celEnvironment.parse(exact[1].trim());
-    return { __compiled: true, call: (ctx: Record<string, unknown>) => fn(ctx) } satisfies CompiledValue;
+    const expr = exact[1].trim();
+    const fn = env.parse(expr);
+    return { __compiled: true, source: expr, call: (ctx: Record<string, unknown>) => fn(ctx) } satisfies CompiledValue;
   }
 
   // Interpolated template — collect literal parts + compiled sub-expressions
@@ -40,14 +41,16 @@ function compileString(s: string): unknown {
   let last = 0;
   for (const m of s.matchAll(TEMPLATE_REGEX)) {
     if (m.index! > last) parts.push(s.slice(last, m.index));
-    const fn = celEnvironment.parse(m[1].trim());
-    parts.push({ __compiled: true, call: (ctx: Record<string, unknown>) => fn(ctx) } satisfies CompiledValue);
+    const expr = m[1].trim();
+    const fn = env.parse(expr);
+    parts.push({ __compiled: true, source: expr, call: (ctx: Record<string, unknown>) => fn(ctx) } satisfies CompiledValue);
     last = m.index! + m[0].length;
   }
   if (last < s.length) parts.push(s.slice(last));
 
   return {
     __compiled: true,
+    source: s,
     call: (ctx: Record<string, unknown>) =>
       parts.map((p) => (typeof p === "string" ? p : String(p.call(ctx) ?? ""))).join(""),
   } satisfies CompiledValue;

package/src/reference-field-map.ts

@@ -1,6 +1,6 @@
 /** An entry for a field that carries one or more x-telo-ref constraints. */
 export interface RefFieldEntry {
-  /** One or more canonical ref strings ("namespace/module#TypeName" or "kernel#TypeName").
+  /** One or more canonical ref strings ("namespace/module#TypeName" or "telo#TypeName").
    *  Multiple entries arise from anyOf branches. */
   refs: string[];
   /** True when the field path traversed through at least one array (path contains "[]"). */

package/src/resolve-throws-union.ts

@@ -0,0 +1,345 @@
+import type { ResourceDefinition, ResourceManifest } from "@telorun/sdk";
+import type { AliasResolver } from "./alias-resolver.js";
+import type { DefinitionRegistry } from "./definition-registry.js";
+
+export interface ThrowsCodeMeta {
+  data?: Record<string, any>;
+}
+
+export interface ThrowsUnion {
+  /** Code → per-code metadata (data schema, etc). Keys are the declared codes. */
+  codes: Map<string, ThrowsCodeMeta>;
+  /** True when the union cannot be fully resolved statically — e.g. a
+   *  `passthrough` call site uses a CEL expression the analyzer can't narrow,
+   *  an unknown kind was encountered, or a cycle short-circuited resolution.
+   *  Callers must treat unbounded unions as requiring a catch-all entry. */
+  unbounded: boolean;
+}
+
+export interface ResolveCtx {
+  allManifests: ResourceManifest[];
+  defs: DefinitionRegistry;
+  aliases: AliasResolver;
+  memo: Map<string, ThrowsUnion>;
+  inProgress: Set<string>;
+}
+
+export function createResolveCtx(
+  allManifests: ResourceManifest[],
+  defs: DefinitionRegistry,
+  aliases: AliasResolver,
+): ResolveCtx {
+  return {
+    allManifests,
+    defs,
+    aliases,
+    memo: new Map(),
+    inProgress: new Set(),
+  };
+}
+
+function emptyUnion(): ThrowsUnion {
+  return { codes: new Map(), unbounded: false };
+}
+
+function unionInto(target: ThrowsUnion, src: ThrowsUnion): void {
+  for (const [code, meta] of src.codes) {
+    if (!target.codes.has(code)) target.codes.set(code, meta);
+  }
+  if (src.unbounded) target.unbounded = true;
+}
+
+function definitionFor(
+  kind: string,
+  defs: DefinitionRegistry,
+  aliases: AliasResolver,
+): ResourceDefinition | undefined {
+  const resolved = aliases.resolveKind(kind);
+  return defs.resolve(kind) ?? (resolved ? defs.resolve(resolved) : undefined);
+}
+
+function codesFromDefinition(definition: ResourceDefinition): Map<string, ThrowsCodeMeta> {
+  const out = new Map<string, ThrowsCodeMeta>();
+  const raw = definition.throws?.codes ?? {};
+  for (const [code, meta] of Object.entries(raw)) {
+    out.set(code, { data: (meta as { data?: Record<string, any> }).data });
+  }
+  return out;
+}
+
+/** Resolve the effective throw union for a named manifest. The result combines
+ *  explicit `throws.codes`, `throws.inherit: true` dataflow (step-context
+ *  traversal with try/catch subtraction), and unbounded markers for
+ *  unresolvable passthrough call sites. Cycles short-circuit to an empty
+ *  result so resolution always terminates. */
+export function resolveThrowsUnion(
+  manifest: ResourceManifest,
+  ctx: ResolveCtx,
+): ThrowsUnion {
+  const name = manifest.metadata?.name as string | undefined;
+
+  if (name) {
+    const cached = ctx.memo.get(name);
+    if (cached) return cached;
+    if (ctx.inProgress.has(name)) return emptyUnion();
+  }
+
+  const definition = definitionFor(manifest.kind, ctx.defs, ctx.aliases);
+  if (!definition) {
+    const u: ThrowsUnion = { codes: new Map(), unbounded: true };
+    if (name) ctx.memo.set(name, u);
+    return u;
+  }
+
+  const throws = definition.throws;
+  if (!throws) {
+    const u = emptyUnion();
+    if (name) ctx.memo.set(name, u);
+    return u;
+  }
+
+  if (name) ctx.inProgress.add(name);
+  try {
+    const result: ThrowsUnion = { codes: new Map(), unbounded: false };
+
+    for (const [code, meta] of codesFromDefinition(definition)) {
+      result.codes.set(code, meta);
+    }
+
+    if (throws.passthrough) {
+      // Definition-level passthrough can't be resolved without a call site.
+      // resolveStepInvokeThrows handles passthrough call sites directly.
+      result.unbounded = true;
+    }
+
+    if (throws.inherit) {
+      const inherited = resolveInherited(manifest, definition, ctx);
+      unionInto(result, inherited);
+    }
+
+    if (name) ctx.memo.set(name, result);
+    return result;
+  } finally {
+    if (name) ctx.inProgress.delete(name);
+  }
+}
+
+function resolveInherited(
+  manifest: ResourceManifest,
+  definition: ResourceDefinition,
+  ctx: ResolveCtx,
+): ThrowsUnion {
+  const result: ThrowsUnion = { codes: new Map(), unbounded: false };
+  const props = definition.schema?.properties as Record<string, any> | undefined;
+  if (!props) return result;
+
+  for (const [fieldName, fieldSchema] of Object.entries(props)) {
+    const stepCtx = fieldSchema["x-telo-step-context"] as Record<string, string> | undefined;
+    if (!stepCtx?.invoke) continue;
+    const steps = (manifest as Record<string, any>)[fieldName];
+    if (!Array.isArray(steps)) continue;
+    unionInto(result, collectStepArrayThrows(steps, stepCtx.invoke, undefined, ctx));
+  }
+
+  return result;
+}
+
+function collectStepArrayThrows(
+  steps: unknown[],
+  invokeField: string,
+  enclosingTryCodes: Set<string> | undefined,
+  ctx: ResolveCtx,
+): ThrowsUnion {
+  const result = emptyUnion();
+  for (const step of steps) {
+    if (!step || typeof step !== "object") continue;
+    unionInto(
+      result,
+      collectStepThrows(step as Record<string, any>, invokeField, enclosingTryCodes, ctx),
+    );
+  }
+  return result;
+}
+
+/** Walk one step, dispatching by shape. Generic for any Run.Sequence-style
+ *  composer: the step keys it recognises (`try` / `catch` / `finally` / `then`
+ *  / `else` / `elseif` / `do` / `cases` / `default`) are the same set already
+ *  traversed by the analyzer's `x-telo-step-context` schema builder, so future
+ *  composers that reuse those shape conventions work without changes here. */
+function collectStepThrows(
+  step: Record<string, any>,
+  invokeField: string,
+  enclosingTryCodes: Set<string> | undefined,
+  ctx: ResolveCtx,
+): ThrowsUnion {
+  if (step[invokeField]) {
+    return resolveStepInvokeThrows(step, invokeField, enclosingTryCodes, ctx);
+  }
+
+  if (step.throw && typeof step.throw === "object") {
+    return resolveThrowStepCode(step.throw as Record<string, any>, enclosingTryCodes);
+  }
+
+  if (Array.isArray(step.try)) {
+    const tryUnion = collectStepArrayThrows(step.try, invokeField, enclosingTryCodes, ctx);
+    let propagated: ThrowsUnion;
+    if (Array.isArray(step.catch)) {
+      // Catch absorbs the try block's codes; the catch's own throws propagate
+      // out instead. Sequence-specific subtraction — the plan explicitly
+      // anchors this to Run.Sequence's try/catch schema shape.
+      const tryCodes = new Set(tryUnion.codes.keys());
+      propagated = collectStepArrayThrows(step.catch, invokeField, tryCodes, ctx);
+      // Unbounded in the try block still signals the caller to expect
+      // arbitrary codes to flow through the catch (e.g. via passthrough).
+      if (tryUnion.unbounded) propagated.unbounded = true;
+    } else {
+      propagated = cloneUnion(tryUnion);
+    }
+    if (Array.isArray(step.finally)) {
+      unionInto(
+        propagated,
+        collectStepArrayThrows(step.finally, invokeField, enclosingTryCodes, ctx),
+      );
+    }
+    return propagated;
+  }
+
+  if (Array.isArray(step.then)) {
+    const result = emptyUnion();
+    unionInto(result, collectStepArrayThrows(step.then, invokeField, enclosingTryCodes, ctx));
+    if (Array.isArray(step.else)) {
+      unionInto(result, collectStepArrayThrows(step.else, invokeField, enclosingTryCodes, ctx));
+    }
+    if (Array.isArray(step.elseif)) {
+      for (const branch of step.elseif) {
+        if (Array.isArray(branch?.then)) {
+          unionInto(
+            result,
+            collectStepArrayThrows(branch.then, invokeField, enclosingTryCodes, ctx),
+          );
+        }
+      }
+    }
+    return result;
+  }
+
+  if (Array.isArray(step.do)) {
+    return collectStepArrayThrows(step.do, invokeField, enclosingTryCodes, ctx);
+  }
+
+  if (step.cases && typeof step.cases === "object") {
+    const result = emptyUnion();
+    for (const arr of Object.values(step.cases as Record<string, unknown>)) {
+      if (Array.isArray(arr)) {
+        unionInto(result, collectStepArrayThrows(arr, invokeField, enclosingTryCodes, ctx));
+      }
+    }
+    if (Array.isArray(step.default)) {
+      unionInto(result, collectStepArrayThrows(step.default, invokeField, enclosingTryCodes, ctx));
+    }
+    return result;
+  }
+
+  return emptyUnion();
+}
+
+function cloneUnion(u: ThrowsUnion): ThrowsUnion {
+  const out = emptyUnion();
+  for (const [c, m] of u.codes) out.codes.set(c, m);
+  out.unbounded = u.unbounded;
+  return out;
+}
+
+function resolveStepInvokeThrows(
+  step: Record<string, any>,
+  invokeField: string,
+  enclosingTryCodes: Set<string> | undefined,
+  ctx: ResolveCtx,
+): ThrowsUnion {
+  const invokeRef = step[invokeField];
+  if (!invokeRef || typeof invokeRef !== "object") return emptyUnion();
+  const invokedKind = invokeRef.kind as string | undefined;
+  if (!invokedKind) return emptyUnion();
+
+  const definition = definitionFor(invokedKind, ctx.defs, ctx.aliases);
+  if (!definition) return { codes: new Map(), unbounded: true };
+
+  if (definition.throws?.passthrough) {
+    return resolvePassthroughAtCallSite(step, enclosingTryCodes);
+  }
+
+  // Named manifest: resolve the full chain (covers transitive inherit).
+  const invokeName = invokeRef.name as string | undefined;
+  if (invokeName) {
+    const target = ctx.allManifests.find(
+      (m) =>
+        m.metadata?.name === invokeName &&
+        (m.kind === invokedKind ||
+          ctx.aliases.resolveKind(m.kind) === invokedKind ||
+          m.kind === ctx.aliases.resolveKind(invokedKind)),
+    );
+    if (target) return resolveThrowsUnion(target, ctx);
+  }
+
+  // Fall back to the definition's own explicit codes. Mark unbounded when the
+  // definition depends on call-site or transitive resolution we couldn't
+  // perform (no specific target manifest to recurse into).
+  const codes = codesFromDefinition(definition);
+  const unbounded =
+    definition.throws?.inherit === true || definition.throws?.passthrough === true;
+  return { codes, unbounded };
+}
+
+/** Resolve a passthrough-style invocable at a specific call site. Recognised forms
+ *  (see "passthrough: true" in the plan):
+ *  - constant literal (no template) → `{ <literal> }`
+ *  - `${{ 'FOO' }}` constant expression → `{ FOO }`
+ *  - `${{ error.code }}` inside a catch → enclosing try's propagated union
+ *  Anything else is unbounded; the analyzer flags it downstream. */
+function resolvePassthroughAtCallSite(
+  step: Record<string, any>,
+  enclosingTryCodes: Set<string> | undefined,
+): ThrowsUnion {
+  return resolveCodeExpression(step.inputs?.code, enclosingTryCodes);
+}
+
+/** Resolve the `code:` of a `throw:` step to a throws union. Uses the same
+ *  recognised forms as passthrough call sites. */
+function resolveThrowStepCode(
+  throwSpec: Record<string, any>,
+  enclosingTryCodes: Set<string> | undefined,
+): ThrowsUnion {
+  return resolveCodeExpression(throwSpec.code, enclosingTryCodes);
+}
+
+function resolveCodeExpression(
+  codeInput: unknown,
+  enclosingTryCodes: Set<string> | undefined,
+): ThrowsUnion {
+  if (typeof codeInput !== "string" || codeInput.length === 0) {
+    return { codes: new Map(), unbounded: true };
+  }
+
+  const match = codeInput.match(/^\s*\$\{\{\s*([\s\S]+?)\s*\}\}\s*$/);
+  if (!match) {
+    return { codes: new Map([[codeInput, {}]]), unbounded: false };
+  }
+
+  const expr = match[1].trim();
+  const litMatch = expr.match(/^'([^']+)'$|^"([^"]+)"$/);
+  if (litMatch) {
+    const code = litMatch[1] ?? litMatch[2]!;
+    return { codes: new Map([[code, {}]]), unbounded: false };
+  }
+
+  if (expr === "error.code") {
+    if (enclosingTryCodes) {
+      const codes = new Map<string, ThrowsCodeMeta>();
+      for (const c of enclosingTryCodes) codes.set(c, {});
+      return { codes, unbounded: false };
+    }
+    return { codes: new Map(), unbounded: true };
+  }
+
+  return { codes: new Map(), unbounded: true };
+}

package/src/types.ts

@@ -74,6 +74,9 @@ export interface LoaderInitOptions {
   includeRegistryAdapter?: boolean;
   /** Base URL used by built-in RegistryAdapter when enabled. */
   registryUrl?: string;
+  /** Handlers for CEL stdlib functions (e.g. `sha256`). Analyzer-only callers may
+   *  omit this and get throwing stubs; runtime callers (kernel) must supply real impls. */
+  celHandlers?: import("./cel-environment.js").CelHandlers;
 }
 
 export interface AnalysisOptions {

package/src/validate-cel-context.ts

@@ -13,7 +13,7 @@ export function resolveTypeFieldToSchema(
   if (!value) return undefined;
 
   if (typeof value === "string") {
-    // Named type reference — find a Kernel.Type resource by name
+    // Named type reference — find a Telo.Type resource by name
     const typeManifest = allManifests.find(
       (m) =>
         (m.metadata as any)?.name === value &&