@telorun/analyzer 0.10.1 → 1.1.0

package/README.md

@@ -1,5 +1,5 @@
 <p align="center">
-  <img src="./assets/telo.png" alt="Telo" width="200" />
+  <img src="https://raw.githubusercontent.com/telorun/telo/main/assets/telo.png" alt="Telo" width="200" />
 </p>
 
 <h1 align="center">Telo</h1>
@@ -61,12 +61,12 @@ targets:
 kind: Telo.Import
 metadata:
   name: Http
-source: ../modules/http-server
+source: std/http-server@0.4.0
 ---
 kind: Telo.Import
 metadata:
   name: Sql
-source: ../modules/sql
+source: std/sql@0.2.3
 ---
 # SQLite database — swap driver/host/database for PostgreSQL with zero YAML changes
 kind: Sql.Connection

package/dist/analysis-registry.d.ts

@@ -41,6 +41,13 @@ export declare class AnalysisRegistry {
     /** Returns the closest user-facing kind to `badKind`, or undefined when nothing
      *  is close enough (or multiple candidates tie). Case-sensitive. */
     suggestKind(badKind: string): string | undefined;
+    /** Returns every user-facing (alias-form) kind that satisfies the given
+     *  `x-telo-ref` constraint string (e.g. `"telo#Invocable"`, `"std/sql#Connection"`).
+     *  Resolution mirrors `validateReferences.checkKind`: abstract targets expand to
+     *  the set of definitions extending them; concrete targets yield just themselves.
+     *  Returns `undefined` when the ref can't be resolved (e.g. unregistered identity),
+     *  so callers can fall back to the unfiltered kind list. */
+    userFacingKindsForRef(xTeloRef: string): string[] | undefined;
     /** @internal Bridge for StaticAnalyzer — do not use outside the analyzer package. */
     _context(): AnalysisContext;
 }

package/dist/analysis-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analysis-registry.d.ts","sourceRoot":"","sources":["../src/analysis-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAMzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;;;GAIG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IAEpE,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI;IAIjD,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAIpE,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAIpE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI7C;;;;;;;OAOG;IACH,mBAAmB,CACjB,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,EAClC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GACnC,IAAI;IAkBP;;;;OAIG;IACH,kBAAkB,IAAI,kBAAkB,EAAE;IAI1C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAM/D,QAAQ,IAAI,MAAM,EAAE;IAIpB;mEAC+D;IAC/D,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE;IAIxC;;;gCAG4B;IAC5B,oBAAoB,IAAI,MAAM,EAAE;IAIhC;wEACoE;IACpE,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIhD,qFAAqF;IACrF,QAAQ,IAAI,eAAe;CAG5B"}
+{"version":3,"file":"analysis-registry.d.ts","sourceRoot":"","sources":["../src/analysis-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAMzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;;;GAIG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IAEpE,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI;IAIjD,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAIpE,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAIpE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI7C;;;;;;;OAOG;IACH,mBAAmB,CACjB,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,EAClC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GACnC,IAAI;IAkBP;;;;OAIG;IACH,kBAAkB,IAAI,kBAAkB,EAAE;IAI1C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAM/D,QAAQ,IAAI,MAAM,EAAE;IAIpB;mEAC+D;IAC/D,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE;IAIxC;;;gCAG4B;IAC5B,oBAAoB,IAAI,MAAM,EAAE;IAIhC;wEACoE;IACpE,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIhD;;;;;gEAK4D;IAC5D,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;IA+B7D,qFAAqF;IACrF,QAAQ,IAAI,eAAe;CAG5B"}

package/dist/analysis-registry.js

@@ -79,6 +79,44 @@ export class AnalysisRegistry {
     suggestKind(badKind) {
         return computeSuggestKind(badKind, this.aliases, this.defs);
     }
+    /** Returns every user-facing (alias-form) kind that satisfies the given
+     *  `x-telo-ref` constraint string (e.g. `"telo#Invocable"`, `"std/sql#Connection"`).
+     *  Resolution mirrors `validateReferences.checkKind`: abstract targets expand to
+     *  the set of definitions extending them; concrete targets yield just themselves.
+     *  Returns `undefined` when the ref can't be resolved (e.g. unregistered identity),
+     *  so callers can fall back to the unfiltered kind list. */
+    userFacingKindsForRef(xTeloRef) {
+        const targetKind = this.defs.resolveRef(xTeloRef);
+        if (!targetKind)
+            return undefined;
+        const targetDef = this.defs.resolve(targetKind);
+        if (!targetDef)
+            return undefined;
+        const canonicalKinds = [];
+        if (targetDef.kind === "Telo.Abstract") {
+            for (const def of this.defs.getByExtends(targetKind)) {
+                const module = def.metadata?.module;
+                if (module && def.metadata?.name) {
+                    canonicalKinds.push(`${module}.${def.metadata.name}`);
+                }
+            }
+        }
+        else {
+            canonicalKinds.push(targetKind);
+        }
+        const out = new Set();
+        for (const kind of canonicalKinds) {
+            const dot = kind.indexOf(".");
+            if (dot === -1)
+                continue;
+            const moduleName = kind.slice(0, dot);
+            const typeName = kind.slice(dot + 1);
+            for (const alias of this.aliases.aliasesFor(moduleName)) {
+                out.add(`${alias}.${typeName}`);
+            }
+        }
+        return Array.from(out);
+    }
     /** @internal Bridge for StaticAnalyzer — do not use outside the analyzer package. */
     _context() {
         return { aliases: this.aliases, definitions: this.defs, aliasesByModule: this.aliasesByModule };

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAa9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAgX/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAqUvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,GAAG,gBAAgB,EAAE;IAUxF,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAc9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA+c/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IA6cvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,GAAG,gBAAgB,EAAE;IAUxF,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -7,10 +7,12 @@ import { buildKernelGlobalsSchema, mergeKernelGlobalsIntoContext } from "./kerne
 import { computeSuggestKind } from "./kind-suggest.js";
 import { isModuleKind } from "./module-kinds.js";
 import { normalizeInlineResources } from "./normalize-inline-resources.js";
+import { rewriteSyntheticOrigins } from "./rewrite-synthetic-origins.js";
 import { celTypeSatisfiesJsonSchema, substituteCelFields, validateAgainstSchema, } from "./schema-compat.js";
 import { DiagnosticSeverity } from "./types.js";
 import { getManifestItem, pathMatchesScope, resolveContextAnnotations, resolveTypeFieldToSchema, } from "./validate-cel-context.js";
 import { validateExtends } from "./validate-extends.js";
+import { validateProviderCoherence } from "./validate-provider-coherence.js";
 import { validateReferences } from "./validate-references.js";
 import { validateThrowsCoverage } from "./validate-throws-coverage.js";
 const SELF_PREFIX = "Self.";
@@ -37,12 +39,89 @@ function lookupDefinitionTypeField(invokedKind, fieldName, defs, aliases, allMan
     return resolveTypeFieldToSchema(value, allManifests);
 }
 const SOURCE = "telo-analyzer";
+/** Build a closed JSON Schema for the `self` CEL variable available inside a
+ *  `Telo.Definition` template body. Mirrors the runtime template controller's
+ *  `const self = { ...resource, name: resource.metadata.name };` — every
+ *  property the user declared in `schema:` plus synthetic `name` / `kind` and
+ *  the metadata sub-object (kept open since metadata legitimately carries
+ *  arbitrary user-added fields). */
+function buildSelfSchema(definition) {
+    const userSchema = (definition.schema ?? {});
+    const userProps = (userSchema.properties ?? {});
+    const userRequired = Array.isArray(userSchema.required) ? userSchema.required : [];
+    return {
+        type: "object",
+        additionalProperties: false,
+        properties: {
+            ...userProps,
+            name: { type: "string" },
+            kind: { type: "string" },
+            metadata: {
+                type: "object",
+                additionalProperties: true,
+                properties: { name: { type: "string" } },
+            },
+        },
+        required: [...userRequired, "name", "kind"],
+    };
+}
+/** Build the JSON Schema for the `inputs` CEL variable available inside an
+ *  invocable template body. Three-layer fallback mirroring the runtime's
+ *  caller-supplied inputs:
+ *    1. The definition's own `inputType:` field (preferred).
+ *    2. The `extends:`-declared abstract's `inputType:` (so a concrete
+ *       definition inheriting a contract gets typed inputs without
+ *       redeclaring them).
+ *    3. Undefined — caller signals opaque `map<string, dyn>` upstream. */
+function lookupTemplateInputsSchema(definition, defs, aliases, allManifests) {
+    const own = resolveTypeFieldToSchema(definition.inputType, allManifests);
+    if (own)
+        return own;
+    const ext = definition.extends;
+    if (typeof ext === "string" && ext.length > 0) {
+        const canonical = aliases.resolveKind(ext) ?? ext;
+        const abstractDef = defs.resolve(canonical);
+        if (abstractDef) {
+            const inherited = resolveTypeFieldToSchema(abstractDef.inputType, allManifests);
+            if (inherited)
+                return inherited;
+        }
+    }
+    return undefined;
+}
+/** Returns a "resolver-facing" view of the manifest where the fields used as
+ *  navigation roots by Telo.Definition's `x-telo-context-from-root` annotations
+ *  have been pre-augmented:
+ *    - `schema`     → augmented `self` schema (synthetic `name`/`kind`/metadata).
+ *    - `inputType`  → resolved with extends fallback when the field isn't
+ *                     declared directly on the definition.
+ *
+ *  For non-definition manifests the original object is returned. */
+function manifestRootForResolver(m, defs, aliases, allManifests) {
+    if (m.kind !== "Telo.Definition")
+        return m;
+    const inputs = lookupTemplateInputsSchema(m, defs, aliases, allManifests);
+    return {
+        ...m,
+        schema: buildSelfSchema(m),
+        ...(inputs ? { inputType: inputs } : {}),
+    };
+}
 /**
  * Walk a JSON Schema tree and collect all `x-telo-context` annotations,
  * returning them as `{ scope, schema }` pairs using JSONPath-style scopes —
  * the same format the analyzer uses for CEL context validation.
+ *
+ * Result is sorted by scope specificity (longer scope first) so that the
+ * per-expression resolver's first-match-wins logic picks the most-specific
+ * context. Without this, a broader ancestor scope (e.g. `$.resources[*]`)
+ * could shadow a narrower descendant scope whose activation differs.
  */
 function extractContextsFromSchema(schema, path = "$") {
+    const all = collectContexts(schema, path);
+    return all.sort((a, b) => b.scope.length - a.scope.length);
+}
+function collectContexts(schema, path) {
     if (!schema || typeof schema !== "object")
         return [];
     const results = [];
@@ -51,16 +130,16 @@ function extractContextsFromSchema(schema, path = "$") {
     }
     if (schema.properties) {
         for (const [key, value] of Object.entries(schema.properties)) {
-            results.push(...extractContextsFromSchema(value, `${path}.${key}`));
+            results.push(...collectContexts(value, `${path}.${key}`));
         }
     }
     if (schema.items && typeof schema.items === "object") {
-        results.push(...extractContextsFromSchema(schema.items, `${path}[*]`));
+        results.push(...collectContexts(schema.items, `${path}[*]`));
     }
     for (const key of ["oneOf", "anyOf", "allOf"]) {
         if (Array.isArray(schema[key])) {
             for (const subschema of schema[key]) {
-                results.push(...extractContextsFromSchema(subschema, path));
+                results.push(...collectContexts(subschema, path));
             }
         }
     }
@@ -420,6 +499,36 @@ export class StaticAnalyzer {
                 byName.set(m.metadata.name, m);
             }
         }
+        // Library env: rejection — `env:` on a Library `variables` / `secrets`
+        // entry is forbidden. The Library entry schema is otherwise open so that
+        // any JSON Schema property schema is valid; this targeted check produces
+        // a clear diagnostic instead of a generic "additional property" error.
+        for (const m of allManifests) {
+            if (m.kind !== "Telo.Library")
+                continue;
+            const filePath = m.metadata?.source;
+            const moduleName = m.metadata?.name;
+            const resource = moduleName ? { kind: m.kind, name: moduleName } : undefined;
+            for (const block of ["variables", "secrets"]) {
+                const entries = m[block];
+                if (!entries || typeof entries !== "object" || Array.isArray(entries))
+                    continue;
+                for (const [entryName, entry] of Object.entries(entries)) {
+                    if (!entry || typeof entry !== "object" || Array.isArray(entry))
+                        continue;
+                    if ("env" in entry) {
+                        diagnostics.push({
+                            severity: DiagnosticSeverity.Error,
+                            code: "LIBRARY_ENV_KEY_REJECTED",
+                            source: SOURCE,
+                            message: `Telo.Library ${block}/${entryName}: 'env:' is only permitted on Telo.Application entries. ` +
+                                `Libraries must receive values from importers via the parent manifest's variables / secrets block.`,
+                            data: { resource, filePath, path: `${block}.${entryName}.env` },
+                        });
+                    }
+                }
+            }
+        }
         // Build typed kernel globals schema so x-telo-context chain validation
         // recognises variables, secrets, resources, env automatically
         const kernelGlobals = buildKernelGlobalsSchema(allManifests);
@@ -436,7 +545,11 @@ export class StaticAnalyzer {
                 });
                 continue;
             }
-            if (m.kind === "Telo.Definition" || m.kind === "Telo.Abstract") {
+            // Abstracts carry only inputType / outputType schema fields and no template
+            // body — nothing for the per-resource walk to validate. Definitions are now
+            // walked: their template bodies (`resources` / `invoke` / `run` / `provide`)
+            // contain CEL that must be checked against `self` / `inputs` / `result`.
+            if (m.kind === "Telo.Abstract") {
                 continue;
             }
             const resource = { kind: m.kind, name: m.metadata?.name };
@@ -489,6 +602,75 @@ export class StaticAnalyzer {
             }
             // (Invocation context compatibility check is handled via x-telo-context in the CEL pass below)
         }
+        // Template-body structural validations: check that template entry-points produce
+        // values matching the contract of their dispatch target and (for `provide:`)
+        // the abstract this definition `extends`. CEL fields inside the templated
+        // values are replaced with type-appropriate placeholders before AJV runs —
+        // same pattern as the per-resource schema validation above.
+        for (const m of allManifests) {
+            if (m.kind !== "Telo.Definition")
+                continue;
+            const filePath = m.metadata?.source;
+            const name = m.metadata?.name;
+            if (!name)
+                continue;
+            const resource = { kind: m.kind, name };
+            const md = m;
+            const emitTargetMismatch = (targetKind, valueSchema, value, path) => {
+                const substituted = substituteCelFields(value, valueSchema);
+                const issues = validateAgainstSchema(substituted, valueSchema);
+                for (const issue of issues) {
+                    diagnostics.push({
+                        severity: DiagnosticSeverity.Error,
+                        code: "TEMPLATE_TARGET_MISMATCH",
+                        source: SOURCE,
+                        message: `${m.kind}/${name}: ${path} does not satisfy ${targetKind}'s contract: ${issue.message}`,
+                        data: { resource, filePath, path: issue.path ? `${path}.${issue.path}` : path },
+                    });
+                }
+            };
+            // Resolve the dispatch target's kind, if statically known. Object-form
+            // `invoke: { kind, name }` and `provide: { kind, name }` carry it; the
+            // string-form `invoke: "name"` does not (the matching resource entry would
+            // need to be located by expanded name — out of scope here).
+            const invoke = md.invoke;
+            const provide = md.provide;
+            let dispatchKind;
+            if (invoke && typeof invoke === "object" && !Array.isArray(invoke) && typeof invoke.kind === "string") {
+                dispatchKind = invoke.kind;
+            }
+            else if (provide &&
+                typeof provide === "object" &&
+                !Array.isArray(provide) &&
+                typeof provide.kind === "string") {
+                dispatchKind = provide.kind;
+            }
+            // Top-level `inputs:` (sibling of `invoke:` / `provide:`) carries the
+            // values passed to the dispatch target's invoke(). Validate against the
+            // target's declared `inputType` when both sides have one.
+            if (dispatchKind && md.inputs && typeof md.inputs === "object") {
+                const targetSchema = lookupDefinitionTypeField(dispatchKind, "inputType", defs, aliases, allManifests);
+                if (targetSchema) {
+                    emitTargetMismatch(dispatchKind, targetSchema, md.inputs, "inputs");
+                }
+            }
+            // Top-level `result:` is a post-call mapping that must satisfy the abstract
+            // this definition `extends` (`outputType`). It's a sibling of whichever
+            // dispatch entry-point declared a kind-typed target (`provide:` or
+            // `invoke:`). The target's outputType lives on the dispatcher's `kind`
+            // and is what `result` is typed against *inside* CEL — separate role.
+            const hasDispatchObject = (provide && typeof provide === "object" && !Array.isArray(provide)) ||
+                (invoke && typeof invoke === "object" && !Array.isArray(invoke));
+            if (hasDispatchObject && md.result && typeof md.result === "object") {
+                const extendsValue = md.extends;
+                if (typeof extendsValue === "string" && extendsValue.length > 0) {
+                    const abstractSchema = lookupDefinitionTypeField(extendsValue, "outputType", defs, aliases, allManifests);
+                    if (abstractSchema) {
+                        emitTargetMismatch(extendsValue, abstractSchema, md.result, "result");
+                    }
+                }
+            }
+        }
         // Validate CEL syntax and context variable access in all manifests
         for (const m of allManifests) {
             const resource = { kind: m.kind, name: m.metadata?.name };
@@ -533,7 +715,13 @@ export class StaticAnalyzer {
                     const manifestItem = matchedScope
                         ? getManifestItem(path, matchedScope, m)
                         : m;
-                    const resolvedContext = resolveContextAnnotations(matchedContext, manifestItem, allManifests);
+                    const rootForResolver = manifestRootForResolver(m, defs, aliases, allManifests);
+                    const resolvedContext = resolveContextAnnotations(matchedContext, manifestItem, {
+                        manifestRoot: rootForResolver,
+                        defs,
+                        aliases,
+                        allManifests: allManifests,
+                    });
                     effectiveContext = mergeKernelGlobalsIntoContext(resolvedContext, kernelGlobals);
                 }
                 const engine = defaultRegistry().get(engineName);
@@ -578,9 +766,13 @@ export class StaticAnalyzer {
         diagnostics.push(...validateReferences(allManifests, { aliases, definitions: defs, aliasesByModule }));
         // Validate `extends` fields and flag legacy `capability: <UserAbstract>` overload.
         diagnostics.push(...validateExtends(allManifests, defs, aliases));
+        // Validate provider coherence rules for `provide:` template-target definitions.
+        diagnostics.push(...validateProviderCoherence(allManifests, defs, aliases));
         // Validate throws: declarations and catches: coverage (rules 1, 2, 4, 7)
         diagnostics.push(...validateThrowsCoverage(allManifests, defs, aliases, this.celEnv));
-        return diagnostics;
+        // Reroute diagnostics on synthetic (inline-extracted) resources back to
+        // the chain root so position-index lookups land on the parent doc.
+        return rewriteSyntheticOrigins(diagnostics, allManifests);
     }
     analyzeErrors(manifests, options, registry) {
         return this.analyze(manifests, options, registry).filter((d) => d.severity === DiagnosticSeverity.Error);

package/dist/builtins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EAsJ/C,CAAC"}
+{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EAmT/C,CAAC"}

package/dist/builtins.js

@@ -38,7 +38,126 @@ export const KERNEL_BUILTINS = [
         kind: "Telo.Definition",
         metadata: { name: "Definition", module: "Telo" },
         capability: "Telo.Template",
-        schema: { type: "object" },
+        // Top-level shape stays open (`additionalProperties: true`) so this change
+        // attaches x-telo-context annotations to known template-body fields without
+        // tightening the Telo.Definition shape itself. The annotations drive
+        // static CEL validation of expressions inside `resources:` / `invoke:` /
+        // `run:` / `provide:` / top-level `inputs:` / top-level `result:` against
+        // `self` (typed from `schema:`) and `inputs` (typed from `inputType:`,
+        // falling back to the extends-declared abstract).
+        //
+        // `inputs:` and `result:` live as top-level siblings of `invoke:` / `provide:`,
+        // matching how Run.Sequence steps factor dispatch from data. The dispatch
+        // entry-point (`invoke` / `provide` / `run`) determines how `inputs`/`result`
+        // are interpreted at runtime. See analyzer/nodejs/plans/template-internal-cel-validation.md.
+        schema: {
+            type: "object",
+            additionalProperties: true,
+            properties: {
+                resources: {
+                    type: "array",
+                    items: {
+                        type: "object",
+                        additionalProperties: true,
+                        "x-telo-context": {
+                            type: "object",
+                            additionalProperties: false,
+                            properties: {
+                                self: { "x-telo-context-from-root": "schema" },
+                                inputs: { "x-telo-context-from-root": "inputType" },
+                            },
+                        },
+                    },
+                },
+                invoke: {
+                    oneOf: [
+                        {
+                            type: "string",
+                            "x-telo-context": {
+                                type: "object",
+                                additionalProperties: false,
+                                properties: {
+                                    self: { "x-telo-context-from-root": "schema" },
+                                },
+                            },
+                        },
+                        {
+                            type: "object",
+                            additionalProperties: true,
+                            properties: {
+                                kind: { type: "string" },
+                                name: {
+                                    type: "string",
+                                    "x-telo-context": {
+                                        type: "object",
+                                        additionalProperties: false,
+                                        properties: {
+                                            self: { "x-telo-context-from-root": "schema" },
+                                        },
+                                    },
+                                },
+                            },
+                        },
+                    ],
+                },
+                provide: {
+                    type: "object",
+                    additionalProperties: true,
+                    properties: {
+                        kind: { type: "string" },
+                        name: {
+                            type: "string",
+                            "x-telo-context": {
+                                type: "object",
+                                additionalProperties: false,
+                                properties: {
+                                    self: { "x-telo-context-from-root": "schema" },
+                                },
+                            },
+                        },
+                    },
+                },
+                run: {
+                    type: "string",
+                    "x-telo-context": {
+                        type: "object",
+                        additionalProperties: false,
+                        properties: {
+                            self: { "x-telo-context-from-root": "schema" },
+                        },
+                    },
+                },
+                inputs: {
+                    type: "object",
+                    additionalProperties: true,
+                    "x-telo-context": {
+                        type: "object",
+                        additionalProperties: false,
+                        properties: {
+                            self: { "x-telo-context-from-root": "schema" },
+                            inputs: { "x-telo-context-from-root": "inputType" },
+                        },
+                    },
+                },
+                result: {
+                    type: "object",
+                    additionalProperties: true,
+                    "x-telo-context": {
+                        type: "object",
+                        additionalProperties: false,
+                        properties: {
+                            self: { "x-telo-context-from-root": "schema" },
+                            result: {
+                                "x-telo-context-from-ref-kind": [
+                                    "provide/kind#outputType",
+                                    "invoke/kind#outputType",
+                                ],
+                            },
+                        },
+                    },
+                },
+            },
+        },
     },
     {
         kind: "Telo.Definition",
@@ -106,6 +225,44 @@ export const KERNEL_BUILTINS = [
                     type: "array",
                     items: { type: "string" },
                 },
+                // Application-level environment contract. Each entry layers `env:`
+                // (required, names the source env var) and `default:` (optional, used
+                // when the env var is unset) on top of an open JSON Schema property
+                // schema. `type:` constrains the coercion rule applied to the raw env
+                // string (scalars per-type; `object` / `array` via JSON.parse with the
+                // matching top-level type). All other JSON Schema keywords are passed
+                // through unchanged and applied to the coerced value via the standard
+                // schema validator. See kernel/nodejs/src/application-env.ts.
+                variables: {
+                    type: "object",
+                    additionalProperties: {
+                        type: "object",
+                        required: ["env", "type"],
+                        properties: {
+                            env: { type: "string" },
+                            type: {
+                                type: "string",
+                                enum: ["string", "integer", "number", "boolean", "object", "array"],
+                            },
+                            default: {},
+                        },
+                    },
+                },
+                secrets: {
+                    type: "object",
+                    additionalProperties: {
+                        type: "object",
+                        required: ["env", "type"],
+                        properties: {
+                            env: { type: "string" },
+                            type: {
+                                type: "string",
+                                enum: ["string", "integer", "number", "boolean", "object", "array"],
+                            },
+                            default: {},
+                        },
+                    },
+                },
             },
             required: ["metadata"],
             additionalProperties: false,

package/dist/index.d.ts

@@ -7,6 +7,7 @@ export { isModuleKind, MODULE_KINDS } from "./module-kinds.js";
 export type { ModuleKind } from "./module-kinds.js";
 export { parseLoadedFile } from "./parse-loaded-file.js";
 export type { ParseOptions } from "./parse-loaded-file.js";
+export { residualEntrySchema, residualEntrySchemaMap } from "./residual-schema.js";
 export { buildDocumentPositions, buildLineOffsets, buildPositionIndex, documentLineOffsets, } from "./position-metadata.js";
 export type { DocumentPosition } from "./position-metadata.js";
 export { HttpSource } from "./sources/http-source.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -4,6 +4,7 @@ export { flattenForAnalyzer, flattenLoadedModule } from "./flatten-for-analyzer.
 export { Loader } from "./manifest-loader.js";
 export { isModuleKind, MODULE_KINDS } from "./module-kinds.js";
 export { parseLoadedFile } from "./parse-loaded-file.js";
+export { residualEntrySchema, residualEntrySchemaMap } from "./residual-schema.js";
 export { buildDocumentPositions, buildLineOffsets, buildPositionIndex, documentLineOffsets, } from "./position-metadata.js";
 export { HttpSource } from "./sources/http-source.js";
 export { RegistrySource } from "./sources/registry-source.js";

package/dist/kernel-globals.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kernel-globals.d.ts","sourceRoot":"","sources":["../src/kernel-globals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,uDAAwD,CAAC;AASzF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,gBAAgB,EAAE,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAiCrB;AA2BD;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAClC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACjC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CASrB"}
+{"version":3,"file":"kernel-globals.d.ts","sourceRoot":"","sources":["../src/kernel-globals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,uDAAwD,CAAC;AASzF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,gBAAgB,EAAE,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAiCrB;AAwBD;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAClC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACjC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CASrB"}

package/dist/kernel-globals.js

@@ -1,3 +1,4 @@
+import { residualEntrySchemaMap } from "./residual-schema.js";
 /**
  * Kernel global names available in every CEL evaluation context at runtime.
  * Both `buildKernelGlobalsSchema` (chain-access validation) and
@@ -59,18 +60,15 @@ export function buildKernelGlobalsSchema(manifests) {
     };
 }
 /** Wrap a JSON Schema property map (like `Telo.Application.variables`) into a
- *  closed object schema suitable for chain-access validation. Falls back to
- *  an open map when the module declares no variables/secrets. */
+ *  closed object schema suitable for chain-access validation. For Application
+ *  entries the per-entry shape carries kernel-specific keys (`env`, `default`)
+ *  on top of an otherwise-standard JSON Schema property schema; those keys are
+ *  stripped via `residualEntrySchemaMap` so CEL sees the coerced shape, not
+ *  the env-binding wrapper. Library entries are pure JSON Schema property
+ *  schemas and pass through the same call unchanged. Falls back to an open map
+ *  when the module declares no variables/secrets. */
 function buildSchemaMapSchema(schemaMap) {
-    if (!schemaMap || typeof schemaMap !== "object" || Array.isArray(schemaMap)) {
-        return { type: "object", additionalProperties: true };
-    }
-    const props = {};
-    for (const [key, value] of Object.entries(schemaMap)) {
-        if (value !== null && typeof value === "object" && !Array.isArray(value)) {
-            props[key] = value;
-        }
-    }
+    const props = residualEntrySchemaMap(schemaMap);
     if (Object.keys(props).length === 0) {
         return { type: "object", additionalProperties: true };
     }

package/dist/normalize-inline-resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"normalize-inline-resources.d.ts","sourceRoot":"","sources":["../src/normalize-inline-resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAczD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE,aAAa,EACvB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC3C,gBAAgB,EAAE,CAwDpB"}
+{"version":3,"file":"normalize-inline-resources.d.ts","sourceRoot":"","sources":["../src/normalize-inline-resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAczD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE,aAAa,EACvB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC3C,gBAAgB,EAAE,CA+DpB"}