@telorun/analyzer 0.10.1 → 0.12.0

package/dist/validate-cel-context.d.ts

@@ -1,4 +1,19 @@
 export { extractAccessChains, validateChainAgainstSchema } from "@telorun/templating";
+export interface ContextResolveOpts {
+    /** When provided, used to resolve `x-telo-context-from-root` annotations against the
+     *  root manifest. When omitted, defaults to `manifestItem`. */
+    manifestRoot?: Record<string, any>;
+    /** When provided alongside `aliases`, used to resolve `x-telo-context-from-ref-kind`
+     *  annotations: read a kind name from a path on `manifestRoot` and return the
+     *  declared definition's `<field>` schema. */
+    defs?: {
+        resolve(kind: string): Record<string, any> | undefined;
+    };
+    aliases?: {
+        resolveKind(kind: string): string | undefined;
+    };
+    allManifests?: Record<string, any>[];
+}
 /**
  * Resolve a type field value (string name, inline type, or raw schema) to a JSON Schema.
  * - String: look up the named type in allManifests (Type.JsonSchema resources)
@@ -15,15 +30,54 @@ export declare function resolveTypeFieldToSchema(value: unknown, allManifests: R
  */
 export declare function pathMatchesScope(exprPath: string, scope: string): boolean;
 /**
- * Resolves `x-telo-context-from` annotations in a context schema using the concrete
- * manifest item. Navigates the manifest item at the given slash-separated path and merges
- * the result as named properties into the annotated node (locking additionalProperties: false).
+ * Resolves `x-telo-context-*` annotations in a context schema using the concrete
+ * manifest item (per-scope) and the manifest root.
  *
- * Example: `x-telo-context-from: "request/schema"` on the `request` context node replaces
- * the open `request` schema with a closed schema whose properties are the keys of
- * `manifestItem.request.schema` (e.g. `query`, `body`, `params`, `headers`).
+ * Annotation forms:
+ *
+ * - `x-telo-context-from`: navigates `manifestItem.<path>` and treats the resolved
+ *   value as a **property map** (keys → sub-schemas) that is merged into the
+ *   annotated node's properties. Used for HTTP-style scopes where the navigated
+ *   value is itself a map of variable names.
+ *
+ *   Example: `x-telo-context-from: "request/schema"` reads `manifestItem.request.schema`
+ *   (= `{ query: {...}, body: {...}, … }`) and merges those keys as named properties
+ *   of the context node.
+ *
+ * - `x-telo-context-from-root`: navigates `manifestRoot.<path>` and **replaces** the
+ *   annotated node's schema with the resolved value. Used on individual property
+ *   schemas (e.g. `properties.self`) where the resolved value is a single variable's
+ *   full schema, not a property map.
+ *
+ *   Example: `properties.self.x-telo-context-from-root: "schema"` reads
+ *   `manifestRoot.schema` and uses it as the schema of the `self` CEL variable.
+ *
+ * - `x-telo-context-from-ref-kind`: reads a kind name from `manifestRoot.<refPath>`,
+ *   resolves it via the definition registry, and returns that kind's `<field>` schema
+ *   (e.g. `outputType`/`inputType`). Used to type `result` against the dispatch
+ *   target's declared output shape.
+ *
+ *   Syntax: `<refPath>#<field>` — slashes traverse the manifest tree.
+ *
+ *   Example: `x-telo-context-from-ref-kind: "provide/kind#outputType"` reads
+ *   `manifestRoot.provide.kind` as a kind name, looks up the kind's Telo.Definition,
+ *   and returns the `outputType` schema.
+ *
+ *   Accepts either a single string or an array of strings. With an array, paths
+ *   are tried in order and the first one that resolves to a usable schema wins —
+ *   used by `result:` to find its dispatch target under whichever entry-point
+ *   field (`provide:` or `invoke:`) the definition declares.
+ *
+ * - `x-telo-context-ref-from`: existing form — reads `{kind, name}` object from
+ *   `manifestItem.<path>`, looks up the named manifest, returns its `<subpath>` field.
+ *
+ * **Fallback chain.** When both `x-telo-context-from-root` and
+ * `x-telo-context-from-ref-kind` are present on the same node, the resolver tries
+ * `from-root` first; if that produces no usable schema, it falls back to `from-ref-kind`.
+ * This lets a definition declare typing from its own field with a sibling-kind fallback
+ * (e.g. `inputType` direct → `extends`-declared abstract's `inputType`).
  */
-export declare function resolveContextAnnotations(schema: Record<string, any>, manifestItem: Record<string, any>, allManifests?: Record<string, any>[]): Record<string, any>;
+export declare function resolveContextAnnotations(schema: Record<string, any>, manifestItem: Record<string, any>, opts?: ContextResolveOpts | Record<string, any>[]): Record<string, any>;
 /**
  * Extracts the concrete manifest array item for a given expression path + scope.
  * e.g. exprPath="routes[0].inputs.q", scope="$.routes[*].inputs" → manifest.routes[0]

package/dist/validate-cel-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAEtF;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CA6BjC;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GACnC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAqDrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB"}
+{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAEtF,MAAM,WAAW,kBAAkB;IACjC;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC;;kDAE8C;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;KACxD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CA6BjC;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAChD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAqGrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB"}

package/dist/validate-cel-context.js

@@ -61,17 +61,61 @@ export function pathMatchesScope(exprPath, scope) {
     return remaining === "" || remaining[0] === "." || remaining[0] === "[";
 }
 /**
- * Resolves `x-telo-context-from` annotations in a context schema using the concrete
- * manifest item. Navigates the manifest item at the given slash-separated path and merges
- * the result as named properties into the annotated node (locking additionalProperties: false).
+ * Resolves `x-telo-context-*` annotations in a context schema using the concrete
+ * manifest item (per-scope) and the manifest root.
  *
- * Example: `x-telo-context-from: "request/schema"` on the `request` context node replaces
- * the open `request` schema with a closed schema whose properties are the keys of
- * `manifestItem.request.schema` (e.g. `query`, `body`, `params`, `headers`).
+ * Annotation forms:
+ *
+ * - `x-telo-context-from`: navigates `manifestItem.<path>` and treats the resolved
+ *   value as a **property map** (keys → sub-schemas) that is merged into the
+ *   annotated node's properties. Used for HTTP-style scopes where the navigated
+ *   value is itself a map of variable names.
+ *
+ *   Example: `x-telo-context-from: "request/schema"` reads `manifestItem.request.schema`
+ *   (= `{ query: {...}, body: {...}, … }`) and merges those keys as named properties
+ *   of the context node.
+ *
+ * - `x-telo-context-from-root`: navigates `manifestRoot.<path>` and **replaces** the
+ *   annotated node's schema with the resolved value. Used on individual property
+ *   schemas (e.g. `properties.self`) where the resolved value is a single variable's
+ *   full schema, not a property map.
+ *
+ *   Example: `properties.self.x-telo-context-from-root: "schema"` reads
+ *   `manifestRoot.schema` and uses it as the schema of the `self` CEL variable.
+ *
+ * - `x-telo-context-from-ref-kind`: reads a kind name from `manifestRoot.<refPath>`,
+ *   resolves it via the definition registry, and returns that kind's `<field>` schema
+ *   (e.g. `outputType`/`inputType`). Used to type `result` against the dispatch
+ *   target's declared output shape.
+ *
+ *   Syntax: `<refPath>#<field>` — slashes traverse the manifest tree.
+ *
+ *   Example: `x-telo-context-from-ref-kind: "provide/kind#outputType"` reads
+ *   `manifestRoot.provide.kind` as a kind name, looks up the kind's Telo.Definition,
+ *   and returns the `outputType` schema.
+ *
+ *   Accepts either a single string or an array of strings. With an array, paths
+ *   are tried in order and the first one that resolves to a usable schema wins —
+ *   used by `result:` to find its dispatch target under whichever entry-point
+ *   field (`provide:` or `invoke:`) the definition declares.
+ *
+ * - `x-telo-context-ref-from`: existing form — reads `{kind, name}` object from
+ *   `manifestItem.<path>`, looks up the named manifest, returns its `<subpath>` field.
+ *
+ * **Fallback chain.** When both `x-telo-context-from-root` and
+ * `x-telo-context-from-ref-kind` are present on the same node, the resolver tries
+ * `from-root` first; if that produces no usable schema, it falls back to `from-ref-kind`.
+ * This lets a definition declare typing from its own field with a sibling-kind fallback
+ * (e.g. `inputType` direct → `extends`-declared abstract's `inputType`).
  */
-export function resolveContextAnnotations(schema, manifestItem, allManifests) {
+export function resolveContextAnnotations(schema, manifestItem, opts) {
     if (!schema || typeof schema !== "object")
         return schema;
+    // Back-compat: third positional arg used to be `allManifests: Record<string, any>[]`.
+    const normalizedOpts = Array.isArray(opts)
+        ? { allManifests: opts }
+        : (opts ?? {});
+    const { manifestRoot = manifestItem, defs, aliases, allManifests } = normalizedOpts;
     const from = schema["x-telo-context-from"];
     if (from) {
         const resolved = navigatePath(manifestItem, from.split("/"));
@@ -82,6 +126,44 @@ export function resolveContextAnnotations(schema, manifestItem, allManifests) {
             additionalProperties: false,
         };
     }
+    const fromRoot = schema["x-telo-context-from-root"];
+    const fromRefKindRaw = schema["x-telo-context-from-ref-kind"];
+    const fromRefKinds = fromRefKindRaw == null
+        ? []
+        : Array.isArray(fromRefKindRaw)
+            ? fromRefKindRaw
+            : [fromRefKindRaw];
+    if (fromRoot || fromRefKinds.length > 0) {
+        if (fromRoot) {
+            const resolved = navigatePath(manifestRoot, fromRoot.split("/"));
+            if (resolved && typeof resolved === "object" && !Array.isArray(resolved)) {
+                return resolved;
+            }
+        }
+        if (defs) {
+            for (const fromRefKind of fromRefKinds) {
+                const hashIdx = fromRefKind.indexOf("#");
+                if (hashIdx <= 0)
+                    continue;
+                const refPath = fromRefKind.slice(0, hashIdx);
+                const field = fromRefKind.slice(hashIdx + 1);
+                const kindValue = navigatePath(manifestRoot, refPath.split("/"));
+                if (typeof kindValue !== "string" || kindValue.length === 0)
+                    continue;
+                const canonical = aliases?.resolveKind(kindValue) ?? kindValue;
+                const def = defs.resolve(canonical);
+                const typeField = def
+                    ? def[field]
+                    : undefined;
+                const resolved = resolveTypeFieldToSchema(typeField, allManifests ?? []);
+                if (resolved && typeof resolved === "object") {
+                    return resolved;
+                }
+            }
+        }
+        // Open fallback so unresolved types never produce false-positive CEL diagnostics.
+        return { type: "object", additionalProperties: true };
+    }
     const refFrom = schema["x-telo-context-ref-from"];
     if (refFrom && allManifests) {
         const slashIdx = refFrom.indexOf("/");
@@ -107,7 +189,7 @@ export function resolveContextAnnotations(schema, manifestItem, allManifests) {
     if (schema.properties) {
         const props = {};
         for (const [k, v] of Object.entries(schema.properties)) {
-            props[k] = resolveContextAnnotations(v, manifestItem, allManifests);
+            props[k] = resolveContextAnnotations(v, manifestItem, normalizedOpts);
         }
         return { ...schema, properties: props };
     }

package/dist/validate-provider-coherence.d.ts

@@ -0,0 +1,23 @@
+import type { ResourceManifest } from "@telorun/sdk";
+import type { AliasResolver } from "./alias-resolver.js";
+import type { DefinitionRegistry } from "./definition-registry.js";
+import { type AnalysisDiagnostic } from "./types.js";
+/**
+ * Validates coherence rules for `Telo.Definition` documents that use the `provide:`
+ * template target, plus the implementation-presence rule on `Telo.Provider`
+ * definitions.
+ *
+ * Diagnostics:
+ *  - PROVIDE_ON_NON_PROVIDER: `provide:` declared on a definition whose
+ *    `capability` is not `Telo.Provider`.
+ *  - PROVIDE_DISPATCHER_CONFLICT: `provide:` co-exists with `invoke:` or `run:`
+ *    on the same definition.
+ *  - PROVIDE_TARGET_UNKNOWN: `provide.name` does not resolve to an entry in
+ *    `resources:`.
+ *  - PROVIDE_TARGET_NOT_INVOCABLE: `provide.name` resolves to a resource whose
+ *    kind is registered but not a `Telo.Invocable`.
+ *  - PROVIDER_MISSING_IMPLEMENTATION: definition with `capability: Telo.Provider`
+ *    declares neither `controllers:` (TS-backed) nor `provide:` (template-backed).
+ */
+export declare function validateProviderCoherence(manifests: ResourceManifest[], registry: DefinitionRegistry, aliases: AliasResolver): AnalysisDiagnostic[];
+//# sourceMappingURL=validate-provider-coherence.d.ts.map

package/dist/validate-provider-coherence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-provider-coherence.d.ts","sourceRoot":"","sources":["../src/validate-provider-coherence.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,GACrB,kBAAkB,EAAE,CAyItB"}

package/dist/validate-provider-coherence.js

@@ -0,0 +1,148 @@
+import { DiagnosticSeverity } from "./types.js";
+const SOURCE = "telo-analyzer";
+/**
+ * Validates coherence rules for `Telo.Definition` documents that use the `provide:`
+ * template target, plus the implementation-presence rule on `Telo.Provider`
+ * definitions.
+ *
+ * Diagnostics:
+ *  - PROVIDE_ON_NON_PROVIDER: `provide:` declared on a definition whose
+ *    `capability` is not `Telo.Provider`.
+ *  - PROVIDE_DISPATCHER_CONFLICT: `provide:` co-exists with `invoke:` or `run:`
+ *    on the same definition.
+ *  - PROVIDE_TARGET_UNKNOWN: `provide.name` does not resolve to an entry in
+ *    `resources:`.
+ *  - PROVIDE_TARGET_NOT_INVOCABLE: `provide.name` resolves to a resource whose
+ *    kind is registered but not a `Telo.Invocable`.
+ *  - PROVIDER_MISSING_IMPLEMENTATION: definition with `capability: Telo.Provider`
+ *    declares neither `controllers:` (TS-backed) nor `provide:` (template-backed).
+ */
+export function validateProviderCoherence(manifests, registry, aliases) {
+    const diagnostics = [];
+    const importedModules = new Set();
+    for (const m of manifests) {
+        if (m.kind !== "Telo.Import")
+            continue;
+        const resolved = m.metadata
+            ?.resolvedModuleName;
+        if (resolved)
+            importedModules.add(resolved);
+    }
+    for (const m of manifests) {
+        if (m.kind !== "Telo.Definition")
+            continue;
+        const name = m.metadata?.name;
+        if (!name)
+            continue;
+        const ownModule = m.metadata?.module;
+        if (ownModule && importedModules.has(ownModule))
+            continue;
+        const filePath = m.metadata?.source;
+        const resource = { kind: m.kind, name };
+        const label = `${m.kind}/${name}`;
+        const md = m;
+        const capability = typeof md.capability === "string" ? md.capability : undefined;
+        const provide = md.provide;
+        const invoke = md.invoke;
+        const run = md.run;
+        const controllers = md.controllers;
+        const resources = md.resources;
+        const hasProvide = provide !== undefined && provide !== null;
+        const hasInvoke = invoke !== undefined && invoke !== null;
+        const hasRun = run !== undefined && run !== null;
+        const hasControllers = Array.isArray(controllers) && controllers.length > 0;
+        if (hasProvide && capability !== "Telo.Provider") {
+            diagnostics.push({
+                severity: DiagnosticSeverity.Error,
+                code: "PROVIDE_ON_NON_PROVIDER",
+                source: SOURCE,
+                message: `${label}: 'provide:' is only valid on definitions with 'capability: Telo.Provider' ` +
+                    `(found '${capability ?? "<unset>"}'). Use 'invoke:' or 'run:' for other capabilities.`,
+                data: { resource, filePath, path: "provide" },
+            });
+        }
+        if (hasProvide && (hasInvoke || hasRun)) {
+            const conflict = hasInvoke ? "invoke" : "run";
+            diagnostics.push({
+                severity: DiagnosticSeverity.Error,
+                code: "PROVIDE_DISPATCHER_CONFLICT",
+                source: SOURCE,
+                message: `${label}: 'provide:' cannot co-exist with '${conflict}:'. ` +
+                    `A definition declares exactly one dispatch entry-point.`,
+                data: { resource, filePath, path: "provide" },
+            });
+        }
+        if (hasProvide && typeof provide === "object" && !Array.isArray(provide)) {
+            const provideObj = provide;
+            const providedName = typeof provideObj.name === "string" ? provideObj.name : undefined;
+            const providedKind = typeof provideObj.kind === "string" ? provideObj.kind : undefined;
+            if (providedName && Array.isArray(resources)) {
+                const match = resources.find((r) => {
+                    const meta = r?.metadata;
+                    return typeof meta?.name === "string" && meta.name === providedName;
+                });
+                if (!match) {
+                    diagnostics.push({
+                        severity: DiagnosticSeverity.Error,
+                        code: "PROVIDE_TARGET_UNKNOWN",
+                        source: SOURCE,
+                        message: `${label}: 'provide.name: ${providedName}' does not match any entry's ` +
+                            `metadata.name in 'resources:'.`,
+                        data: { resource, filePath, path: "provide.name" },
+                    });
+                }
+                else if (typeof match.kind === "string") {
+                    // `provide.kind` is the type contract the analyzer uses to type
+                    // `result` CEL against the target's `outputType`. The runtime
+                    // dispatches on `provide.name` and ignores `provide.kind`, so a
+                    // mismatch silently degrades `result` typing to an open schema
+                    // (and at runtime quietly invokes the actually-matched resource).
+                    // Flag the divergence so result-typing never lies.
+                    if (providedKind) {
+                        const providedCanonical = aliases.resolveKind(providedKind) ?? providedKind;
+                        const matchCanonical = aliases.resolveKind(match.kind) ?? match.kind;
+                        if (providedCanonical !== matchCanonical) {
+                            diagnostics.push({
+                                severity: DiagnosticSeverity.Error,
+                                code: "PROVIDE_KIND_MISMATCH",
+                                source: SOURCE,
+                                message: `${label}: 'provide.kind: ${providedKind}' disagrees with the matched ` +
+                                    `'resources:' entry's kind '${match.kind}' (matched by metadata.name ` +
+                                    `'${providedName}'). The runtime dispatches by name, so 'provide.kind' ` +
+                                    `is decorative — but the analyzer types 'result:' against it, and a ` +
+                                    `mismatch silently turns off that typing.`,
+                                data: { resource, filePath, path: "provide.kind" },
+                            });
+                        }
+                    }
+                    const resolvedKind = aliases.resolveKind(match.kind) ?? match.kind;
+                    const targetDef = registry.resolve(resolvedKind) ?? registry.resolve(match.kind);
+                    if (targetDef && targetDef.kind === "Telo.Definition") {
+                        const targetCap = targetDef.capability;
+                        if (typeof targetCap === "string" && targetCap !== "Telo.Invocable") {
+                            diagnostics.push({
+                                severity: DiagnosticSeverity.Error,
+                                code: "PROVIDE_TARGET_NOT_INVOCABLE",
+                                source: SOURCE,
+                                message: `${label}: 'provide.name: ${providedName}' resolves to a ${match.kind} ` +
+                                    `(capability '${targetCap}'); 'provide:' requires a Telo.Invocable target.`,
+                                data: { resource, filePath, path: "provide.name" },
+                            });
+                        }
+                    }
+                }
+            }
+        }
+        if (capability === "Telo.Provider" && !hasControllers && !hasProvide) {
+            diagnostics.push({
+                severity: DiagnosticSeverity.Error,
+                code: "PROVIDER_MISSING_IMPLEMENTATION",
+                source: SOURCE,
+                message: `${label}: 'capability: Telo.Provider' requires either 'controllers:' ` +
+                    `(TS-backed) or 'provide:' (template-backed) to declare an implementation.`,
+                data: { resource, filePath, path: "capability" },
+            });
+        }
+    }
+    return diagnostics;
+}

package/dist/validate-references.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-references.d.ts","sourceRoot":"","sources":["../src/validate-references.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAkD/F;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,GACvB,kBAAkB,EAAE,CA2UtB"}
+{"version":3,"file":"validate-references.d.ts","sourceRoot":"","sources":["../src/validate-references.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA4C/F;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,GACvB,kBAAkB,EAAE,CAsbtB"}