@telorun/analyzer 0.11.0 → 0.12.0

package/LICENSE

@@ -1,6 +1,6 @@
 # SUSTAINABLE USE LICENSE (Fair-code)
 
-Copyright (c) 2026 DiglyAI
+Copyright (c) 2026 CodeNet Sp. z o.o.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to use, copy, modify, and distribute the Software for any purpose—including commercial purposes—subject to the following conditions:
 
@@ -14,4 +14,4 @@ Permission is hereby granted, free of charge, to any person obtaining a copy of
 
 5. DISCLAIMER: The Software is provided "as is", without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose and noninfringement. In no event shall the authors or copyright holders be liable for any claim, damages or other liability, whether in an action of contract, tort or otherwise, arising from, out of or in connection with the Software or the use or other dealings in the Software.
 
-For commercial licensing, managed hosting exemptions, or enterprise inquiries, please contact DiglyAI.
+For commercial licensing, managed hosting exemptions, or enterprise inquiries, please contact <contact@codenet.pl>.

package/README.md

@@ -1,5 +1,5 @@
 <p align="center">
-  <img src="./assets/telo.png" alt="Telo" width="200" />
+  <img src="https://raw.githubusercontent.com/telorun/telo/main/assets/telo.png" alt="Telo" width="200" />
 </p>
 
 <h1 align="center">Telo</h1>
@@ -61,12 +61,12 @@ targets:
 kind: Telo.Import
 metadata:
   name: Http
-source: ../modules/http-server
+source: std/http-server@0.4.0
 ---
 kind: Telo.Import
 metadata:
   name: Sql
-source: ../modules/sql
+source: std/sql@0.2.3
 ---
 # SQLite database — swap driver/host/database for PostgreSQL with zero YAML changes
 kind: Sql.Connection

package/dist/adapters/http-adapter.d.ts

@@ -0,0 +1,10 @@
+import { type ManifestAdapter } from "../types.js";
+export declare class HttpAdapter implements ManifestAdapter {
+    supports(url: string): boolean;
+    read(url: string): Promise<{
+        text: string;
+        source: string;
+    }>;
+    resolveRelative(base: string, relative: string): string;
+}
+//# sourceMappingURL=http-adapter.d.ts.map

package/dist/adapters/http-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/http-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9E,qBAAa,WAAY,YAAW,eAAe;IACjD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAIxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAWlE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;CAIxD"}

package/dist/adapters/http-adapter.js

@@ -0,0 +1,18 @@
+import { DEFAULT_MANIFEST_FILENAME } from "../types.js";
+export class HttpAdapter {
+    supports(url) {
+        return url.startsWith("http://") || url.startsWith("https://");
+    }
+    async read(url) {
+        const fetchUrl = url.includes(".yaml") ? url : `${url}/${DEFAULT_MANIFEST_FILENAME}`;
+        const response = await fetch(fetchUrl);
+        if (!response.ok) {
+            throw new Error(`Failed to fetch manifest from ${fetchUrl}: ${response.status} ${response.statusText}`);
+        }
+        return { text: await response.text(), source: fetchUrl };
+    }
+    resolveRelative(base, relative) {
+        const baseDir = base.endsWith("/") ? base : base.slice(0, base.lastIndexOf("/") + 1);
+        return new URL(relative, baseDir).href;
+    }
+}

package/dist/adapters/node-adapter.d.ts

@@ -0,0 +1,17 @@
+import { type ManifestAdapter } from "../types.js";
+/** Node.js fs-based ManifestAdapter for local files. Not browser-compatible. */
+export declare class NodeAdapter implements ManifestAdapter {
+    private readonly cwd;
+    constructor(cwd?: string);
+    supports(url: string): boolean;
+    read(url: string): Promise<{
+        text: string;
+        source: string;
+    }>;
+    resolveRelative(base: string, relative: string): string;
+    expandGlob(base: string, patterns: string[]): Promise<string[]>;
+    resolveOwnerOf(fileUrl: string): Promise<string | null>;
+}
+/** @deprecated Use `new NodeAdapter(cwd)` instead */
+export declare function createNodeAdapter(cwd?: string): ManifestAdapter;
+//# sourceMappingURL=node-adapter.d.ts.map

package/dist/adapters/node-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/node-adapter.ts"],"names":[],"mappings":"AAIA,OAAO,EAA6B,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAM9E,gFAAgF;AAChF,qBAAa,WAAY,YAAW,eAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,GAAE,MAAsB;IAExD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAUxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IASlE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAKjD,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAc/D,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAoB9D;AAED,qDAAqD;AACrD,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAsB,GAAG,eAAe,CAE9E"}

package/dist/adapters/node-adapter.js

@@ -0,0 +1,71 @@
+import * as fs from "fs/promises";
+import * as path from "path";
+import { fileURLToPath } from "url";
+import { minimatch } from "minimatch";
+import { DEFAULT_MANIFEST_FILENAME } from "../types.js";
+function toFilePath(url) {
+    return url.startsWith("file://") ? fileURLToPath(url) : url;
+}
+/** Node.js fs-based ManifestAdapter for local files. Not browser-compatible. */
+export class NodeAdapter {
+    cwd;
+    constructor(cwd = process.cwd()) {
+        this.cwd = cwd;
+    }
+    supports(url) {
+        return (url.startsWith("file://") ||
+            url.startsWith("/") ||
+            url.startsWith("./") ||
+            url.startsWith("../") ||
+            (!url.includes("://") && !url.includes("@")));
+    }
+    async read(url) {
+        const filePath = toFilePath(url);
+        const stat = await fs.stat(filePath).catch(() => null);
+        const resolvedPath = stat?.isDirectory() ? path.join(filePath, DEFAULT_MANIFEST_FILENAME) : filePath;
+        const text = await fs.readFile(resolvedPath, "utf8");
+        return { text, source: resolvedPath };
+    }
+    resolveRelative(base, relative) {
+        const baseDir = path.dirname(path.resolve(this.cwd, toFilePath(base)));
+        return path.resolve(baseDir, relative);
+    }
+    async expandGlob(base, patterns) {
+        const baseDir = path.dirname(path.resolve(this.cwd, toFilePath(base)));
+        const entries = await fs.readdir(baseDir, { recursive: true, encoding: "utf8" });
+        const normalizedPatterns = patterns.map((p) => p.replace(/\\/g, "/").replace(/^\.\//, ""));
+        const matched = [];
+        for (const entry of entries) {
+            const normalized = entry.replace(/\\/g, "/");
+            if (normalizedPatterns.some((p) => minimatch(normalized, p))) {
+                matched.push(path.resolve(baseDir, entry));
+            }
+        }
+        return matched.sort();
+    }
+    async resolveOwnerOf(fileUrl) {
+        const resolved = path.resolve(this.cwd, toFilePath(fileUrl));
+        let dir = path.dirname(resolved);
+        while (true) {
+            const candidate = path.join(dir, DEFAULT_MANIFEST_FILENAME);
+            if (candidate !== resolved) {
+                try {
+                    await fs.access(candidate);
+                    return candidate;
+                }
+                catch {
+                    // telo.yaml not found at this level
+                }
+            }
+            const parent = path.dirname(dir);
+            if (parent === dir)
+                break;
+            dir = parent;
+        }
+        return null;
+    }
+}
+/** @deprecated Use `new NodeAdapter(cwd)` instead */
+export function createNodeAdapter(cwd = process.cwd()) {
+    return new NodeAdapter(cwd);
+}

package/dist/adapters/registry-adapter.d.ts

@@ -0,0 +1,15 @@
+import { type ManifestAdapter } from "../types.js";
+export declare class RegistryAdapter implements ManifestAdapter {
+    private registryUrl;
+    constructor(registryUrl?: string);
+    supports(url: string): boolean;
+    read(moduleRef: string): Promise<{
+        text: string;
+        source: string;
+    }>;
+    resolveRelative(base: string, relative: string): string;
+    private toRegistryModuleBase;
+    private toRegistryUrl;
+    private parseModuleRef;
+}
+//# sourceMappingURL=registry-adapter.d.ts.map

package/dist/adapters/registry-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/registry-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAI9E,qBAAa,eAAgB,YAAW,eAAe;IACzC,OAAO,CAAC,WAAW;gBAAX,WAAW,SAAuB;IAEtD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAWxB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAWxE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAMvD,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,cAAc;CAmBvB"}

package/dist/adapters/registry-adapter.js

@@ -0,0 +1,53 @@
+import { DEFAULT_MANIFEST_FILENAME } from "../types.js";
+const DEFAULT_REGISTRY_URL = "https://registry.telo.run";
+export class RegistryAdapter {
+    registryUrl;
+    constructor(registryUrl = DEFAULT_REGISTRY_URL) {
+        this.registryUrl = registryUrl;
+    }
+    supports(url) {
+        return (!url.startsWith("http://") &&
+            !url.startsWith("https://") &&
+            !url.startsWith("/") &&
+            !url.startsWith(".") &&
+            url.includes("@") &&
+            url.includes("/"));
+    }
+    async read(moduleRef) {
+        const fetchUrl = this.toRegistryUrl(moduleRef);
+        const response = await fetch(fetchUrl);
+        if (!response.ok) {
+            throw new Error(`Failed to fetch manifest ${moduleRef}: ${response.status} ${response.statusText}`);
+        }
+        return { text: await response.text(), source: fetchUrl };
+    }
+    resolveRelative(base, relative) {
+        const baseUrl = this.supports(base) ? this.toRegistryModuleBase(base) : base;
+        const baseWithSlash = baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`;
+        return new URL(relative, baseWithSlash).href;
+    }
+    toRegistryModuleBase(moduleRef) {
+        const parsed = this.parseModuleRef(moduleRef);
+        const normalizedBase = this.registryUrl.replace(/\/+$/, "");
+        return `${normalizedBase}/${parsed.modulePath}/${parsed.version}`;
+    }
+    toRegistryUrl(moduleRef) {
+        return `${this.toRegistryModuleBase(moduleRef)}/${DEFAULT_MANIFEST_FILENAME}`;
+    }
+    parseModuleRef(moduleRef) {
+        const atIdx = moduleRef.lastIndexOf("@");
+        if (atIdx <= 0 || atIdx === moduleRef.length - 1) {
+            throw new Error(`Invalid module reference '${moduleRef}', expected namespace/name@version`);
+        }
+        const modulePath = moduleRef.slice(0, atIdx);
+        if (!modulePath.includes("/")) {
+            throw new Error(`Invalid module reference '${moduleRef}', expected namespace/name@version`);
+        }
+        const rawVersion = moduleRef.slice(atIdx + 1);
+        const version = rawVersion.startsWith("v") ? rawVersion.substring(1) : rawVersion;
+        if (!version) {
+            throw new Error(`Invalid module reference '${moduleRef}', expected namespace/name@version`);
+        }
+        return { modulePath, version };
+    }
+}

package/dist/analysis-registry.d.ts

@@ -41,6 +41,13 @@ export declare class AnalysisRegistry {
     /** Returns the closest user-facing kind to `badKind`, or undefined when nothing
      *  is close enough (or multiple candidates tie). Case-sensitive. */
     suggestKind(badKind: string): string | undefined;
+    /** Returns every user-facing (alias-form) kind that satisfies the given
+     *  `x-telo-ref` constraint string (e.g. `"telo#Invocable"`, `"std/sql#Connection"`).
+     *  Resolution mirrors `validateReferences.checkKind`: abstract targets expand to
+     *  the set of definitions extending them; concrete targets yield just themselves.
+     *  Returns `undefined` when the ref can't be resolved (e.g. unregistered identity),
+     *  so callers can fall back to the unfiltered kind list. */
+    userFacingKindsForRef(xTeloRef: string): string[] | undefined;
     /** @internal Bridge for StaticAnalyzer — do not use outside the analyzer package. */
     _context(): AnalysisContext;
 }

package/dist/analysis-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analysis-registry.d.ts","sourceRoot":"","sources":["../src/analysis-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAMzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;;;GAIG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IAEpE,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI;IAIjD,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAIpE,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAIpE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI7C;;;;;;;OAOG;IACH,mBAAmB,CACjB,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,EAClC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GACnC,IAAI;IAkBP;;;;OAIG;IACH,kBAAkB,IAAI,kBAAkB,EAAE;IAI1C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAM/D,QAAQ,IAAI,MAAM,EAAE;IAIpB;mEAC+D;IAC/D,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE;IAIxC;;;gCAG4B;IAC5B,oBAAoB,IAAI,MAAM,EAAE;IAIhC;wEACoE;IACpE,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIhD,qFAAqF;IACrF,QAAQ,IAAI,eAAe;CAG5B"}
+{"version":3,"file":"analysis-registry.d.ts","sourceRoot":"","sources":["../src/analysis-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAMzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;;;GAIG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IAEpE,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI;IAIjD,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAIpE,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAIpE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI7C;;;;;;;OAOG;IACH,mBAAmB,CACjB,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,EAClC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GACnC,IAAI;IAkBP;;;;OAIG;IACH,kBAAkB,IAAI,kBAAkB,EAAE;IAI1C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAM/D,QAAQ,IAAI,MAAM,EAAE;IAIpB;mEAC+D;IAC/D,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE;IAIxC;;;gCAG4B;IAC5B,oBAAoB,IAAI,MAAM,EAAE;IAIhC;wEACoE;IACpE,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIhD;;;;;gEAK4D;IAC5D,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;IA+B7D,qFAAqF;IACrF,QAAQ,IAAI,eAAe;CAG5B"}

package/dist/analysis-registry.js

@@ -79,6 +79,44 @@ export class AnalysisRegistry {
     suggestKind(badKind) {
         return computeSuggestKind(badKind, this.aliases, this.defs);
     }
+    /** Returns every user-facing (alias-form) kind that satisfies the given
+     *  `x-telo-ref` constraint string (e.g. `"telo#Invocable"`, `"std/sql#Connection"`).
+     *  Resolution mirrors `validateReferences.checkKind`: abstract targets expand to
+     *  the set of definitions extending them; concrete targets yield just themselves.
+     *  Returns `undefined` when the ref can't be resolved (e.g. unregistered identity),
+     *  so callers can fall back to the unfiltered kind list. */
+    userFacingKindsForRef(xTeloRef) {
+        const targetKind = this.defs.resolveRef(xTeloRef);
+        if (!targetKind)
+            return undefined;
+        const targetDef = this.defs.resolve(targetKind);
+        if (!targetDef)
+            return undefined;
+        const canonicalKinds = [];
+        if (targetDef.kind === "Telo.Abstract") {
+            for (const def of this.defs.getByExtends(targetKind)) {
+                const module = def.metadata?.module;
+                if (module && def.metadata?.name) {
+                    canonicalKinds.push(`${module}.${def.metadata.name}`);
+                }
+            }
+        }
+        else {
+            canonicalKinds.push(targetKind);
+        }
+        const out = new Set();
+        for (const kind of canonicalKinds) {
+            const dot = kind.indexOf(".");
+            if (dot === -1)
+                continue;
+            const moduleName = kind.slice(0, dot);
+            const typeName = kind.slice(dot + 1);
+            for (const alias of this.aliases.aliasesFor(moduleName)) {
+                out.add(`${alias}.${typeName}`);
+            }
+        }
+        return Array.from(out);
+    }
     /** @internal Bridge for StaticAnalyzer — do not use outside the analyzer package. */
     _context() {
         return { aliases: this.aliases, definitions: this.defs, aliasesByModule: this.aliasesByModule };

package/dist/analyzer.d.ts

@@ -8,6 +8,21 @@ export interface StaticAnalyzerOptions {
 export declare class StaticAnalyzer {
     private readonly celEnv;
     constructor(options?: StaticAnalyzerOptions);
+    /**
+     * Run static analysis over a flattened manifest list.
+     *
+     * **Contract**: every non-system manifest (anything outside `Telo.Definition`,
+     * `Telo.Abstract`) must carry `metadata.source` (non-empty string) and
+     * `metadata.sourceLine` (number). The dedup that backs
+     * `DUPLICATE_RESOURCE_NAME` reads those fields to tell a pipeline echo
+     * apart from a genuine collision, and downstream diagnostic positioning
+     * depends on them too. Real callers stamp positions already (the `Loader`,
+     * `flattenForAnalyzer`, the telo-editor's `emitDocsFor`, the VSCode
+     * extension). Programmatic callers — tests, ad-hoc scripts — should pass
+     * their inputs through `withSyntheticPositions(...)` before calling
+     * `analyze()`. A missing position throws a clear error rather than
+     * silently producing wrong diagnostics.
+     */
     analyze(manifests: ResourceManifest[], options?: AnalysisOptions, registry?: AnalysisRegistry): AnalysisDiagnostic[];
     analyzeErrors(manifests: ResourceManifest[], options?: AnalysisOptions, registry?: AnalysisRegistry): AnalysisDiagnostic[];
     normalize(manifests: ResourceManifest[], registry: AnalysisRegistry): ResourceManifest[];

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAa9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA8c/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IA6avB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,GAAG,gBAAgB,EAAE;IAUxF,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAgB9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAgf/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IA8dvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,GAAG,gBAAgB,EAAE;IAexF,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -7,13 +7,49 @@ import { buildKernelGlobalsSchema, mergeKernelGlobalsIntoContext } from "./kerne
 import { computeSuggestKind } from "./kind-suggest.js";
 import { isModuleKind } from "./module-kinds.js";
 import { normalizeInlineResources } from "./normalize-inline-resources.js";
+import { REF_VALIDATION_SKIP_KINDS } from "./system-kinds.js";
+import { resolveRefSentinels } from "./resolve-ref-sentinels.js";
+import { rewriteSyntheticOrigins } from "./rewrite-synthetic-origins.js";
 import { celTypeSatisfiesJsonSchema, substituteCelFields, validateAgainstSchema, } from "./schema-compat.js";
 import { DiagnosticSeverity } from "./types.js";
 import { getManifestItem, pathMatchesScope, resolveContextAnnotations, resolveTypeFieldToSchema, } from "./validate-cel-context.js";
 import { validateExtends } from "./validate-extends.js";
+import { validateProviderCoherence } from "./validate-provider-coherence.js";
 import { validateReferences } from "./validate-references.js";
 import { validateThrowsCoverage } from "./validate-throws-coverage.js";
 const SELF_PREFIX = "Self.";
+/**
+ * `StaticAnalyzer.analyze()` requires `metadata.source` (non-empty) and
+ * `metadata.sourceLine` (number) on every non-system manifest — see the
+ * JSDoc on `analyze()`. Production callers stamp these via the `Loader` /
+ * `flattenForAnalyzer` / `emitDocsFor` paths; programmatic callers (tests,
+ * scripts) should pre-process inputs with `withSyntheticPositions(...)`.
+ * Surfacing the violation here turns silent dedup misbehaviour into a
+ * loud, actionable error.
+ */
+function assertManifestPositions(manifests) {
+    for (let i = 0; i < manifests.length; i++) {
+        const m = manifests[i];
+        if (REF_VALIDATION_SKIP_KINDS.has(m.kind))
+            continue;
+        const meta = m.metadata;
+        const okSource = typeof meta?.source === "string" && meta.source.length > 0;
+        const okLine = typeof meta?.sourceLine === "number";
+        if (okSource && okLine)
+            continue;
+        const label = `${m.kind}/${m.metadata?.name ?? "(unnamed)"}`;
+        const missing = [
+            !okSource ? "metadata.source" : null,
+            !okLine ? "metadata.sourceLine" : null,
+        ]
+            .filter(Boolean)
+            .join(" and ");
+        throw new Error(`StaticAnalyzer.analyze(): manifest #${i} (${label}) is missing ${missing}. ` +
+            `Real callers stamp positions automatically; programmatic callers ` +
+            `(tests, ad-hoc scripts) should pass inputs through ` +
+            `\`withSyntheticPositions(manifests)\` before calling analyze().`);
+    }
+}
 /** Resolve an alias-prefixed kind value (e.g. `Self.Encoder` or `Ai.Model`)
  *  to its canonical form. `Self.<Name>` resolves to `<ownModule>.<Name>` —
  *  the magic alias for "this library's own module" — and other prefixes
@@ -373,7 +409,23 @@ export class StaticAnalyzer {
     constructor(options = {}) {
         this.celEnv = buildCelEnvironment(options.celHandlers);
     }
+    /**
+     * Run static analysis over a flattened manifest list.
+     *
+     * **Contract**: every non-system manifest (anything outside `Telo.Definition`,
+     * `Telo.Abstract`) must carry `metadata.source` (non-empty string) and
+     * `metadata.sourceLine` (number). The dedup that backs
+     * `DUPLICATE_RESOURCE_NAME` reads those fields to tell a pipeline echo
+     * apart from a genuine collision, and downstream diagnostic positioning
+     * depends on them too. Real callers stamp positions already (the `Loader`,
+     * `flattenForAnalyzer`, the telo-editor's `emitDocsFor`, the VSCode
+     * extension). Programmatic callers — tests, ad-hoc scripts — should pass
+     * their inputs through `withSyntheticPositions(...)` before calling
+     * `analyze()`. A missing position throws a clear error rather than
+     * silently producing wrong diagnostics.
+     */
     analyze(manifests, options, registry) {
+        assertManifestPositions(manifests);
         const diagnostics = [];
         // Use pre-seeded registries from the provided AnalysisRegistry, or create fresh ones.
         // New aliases/definitions found in the manifests are accumulated into the provided instance
@@ -490,6 +542,20 @@ export class StaticAnalyzer {
         }
         // Phase 2: extract inline resources from x-telo-ref slots into first-class manifests
         const allManifests = normalizeInlineResources(manifests, defs, aliases, aliasesByModule);
+        // Phase 2.5: resolve `!ref <name>` sentinels at every ref slot to canonical
+        // {kind, name} objects so downstream phases (validation, dependency graph,
+        // kernel controllers) see a uniform shape. Runs after normalize so both
+        // original and inline-extracted manifests have their sentinels resolved.
+        resolveRefSentinels(allManifests, defs, aliases, aliasesByModule);
+        // Trusted-input fast path: when the caller has already attested that
+        // this exact manifest set passes analysis (e.g. via the kernel's
+        // hash-stamped `.validated.json` cache), skip the validation walk.
+        // Registration of identities / aliases / definitions and inline-resource
+        // normalisation have already run above; that's all downstream
+        // consumers (prepare, init loop) require.
+        if (options?.skipValidation) {
+            return diagnostics;
+        }
         // Build a name→manifest map for looking up referenced resources
         const byName = new Map();
         for (const m of allManifests) {
@@ -497,6 +563,36 @@ export class StaticAnalyzer {
                 byName.set(m.metadata.name, m);
             }
         }
+        // Library env: rejection — `env:` on a Library `variables` / `secrets`
+        // entry is forbidden. The Library entry schema is otherwise open so that
+        // any JSON Schema property schema is valid; this targeted check produces
+        // a clear diagnostic instead of a generic "additional property" error.
+        for (const m of allManifests) {
+            if (m.kind !== "Telo.Library")
+                continue;
+            const filePath = m.metadata?.source;
+            const moduleName = m.metadata?.name;
+            const resource = moduleName ? { kind: m.kind, name: moduleName } : undefined;
+            for (const block of ["variables", "secrets"]) {
+                const entries = m[block];
+                if (!entries || typeof entries !== "object" || Array.isArray(entries))
+                    continue;
+                for (const [entryName, entry] of Object.entries(entries)) {
+                    if (!entry || typeof entry !== "object" || Array.isArray(entry))
+                        continue;
+                    if ("env" in entry) {
+                        diagnostics.push({
+                            severity: DiagnosticSeverity.Error,
+                            code: "LIBRARY_ENV_KEY_REJECTED",
+                            source: SOURCE,
+                            message: `Telo.Library ${block}/${entryName}: 'env:' is only permitted on Telo.Application entries. ` +
+                                `Libraries must receive values from importers via the parent manifest's variables / secrets block.`,
+                            data: { resource, filePath, path: `${block}.${entryName}.env` },
+                        });
+                    }
+                }
+            }
+        }
         // Build typed kernel globals schema so x-telo-context chain validation
         // recognises variables, secrets, resources, env automatically
         const kernelGlobals = buildKernelGlobalsSchema(allManifests);
@@ -622,15 +718,14 @@ export class StaticAnalyzer {
                     emitTargetMismatch(dispatchKind, targetSchema, md.inputs, "inputs");
                 }
             }
-            // Top-level `result:` (a sibling, only meaningful with `provide:`) is a
-            // post-call mapping that must satisfy the abstract this definition
-            // `extends` (`outputType`). The target's outputType lives on `provide.kind`
+            // Top-level `result:` is a post-call mapping that must satisfy the abstract
+            // this definition `extends` (`outputType`). It's a sibling of whichever
+            // dispatch entry-point declared a kind-typed target (`provide:` or
+            // `invoke:`). The target's outputType lives on the dispatcher's `kind`
             // and is what `result` is typed against *inside* CEL — separate role.
-            if (provide &&
-                typeof provide === "object" &&
-                !Array.isArray(provide) &&
-                md.result &&
-                typeof md.result === "object") {
+            const hasDispatchObject = (provide && typeof provide === "object" && !Array.isArray(provide)) ||
+                (invoke && typeof invoke === "object" && !Array.isArray(invoke));
+            if (hasDispatchObject && md.result && typeof md.result === "object") {
                 const extendsValue = md.extends;
                 if (typeof extendsValue === "string" && extendsValue.length > 0) {
                     const abstractSchema = lookupDefinitionTypeField(extendsValue, "outputType", defs, aliases, allManifests);
@@ -735,16 +830,25 @@ export class StaticAnalyzer {
         diagnostics.push(...validateReferences(allManifests, { aliases, definitions: defs, aliasesByModule }));
         // Validate `extends` fields and flag legacy `capability: <UserAbstract>` overload.
         diagnostics.push(...validateExtends(allManifests, defs, aliases));
+        // Validate provider coherence rules for `provide:` template-target definitions.
+        diagnostics.push(...validateProviderCoherence(allManifests, defs, aliases));
         // Validate throws: declarations and catches: coverage (rules 1, 2, 4, 7)
         diagnostics.push(...validateThrowsCoverage(allManifests, defs, aliases, this.celEnv));
-        return diagnostics;
+        // Reroute diagnostics on synthetic (inline-extracted) resources back to
+        // the chain root so position-index lookups land on the parent doc.
+        return rewriteSyntheticOrigins(diagnostics, allManifests);
     }
     analyzeErrors(manifests, options, registry) {
         return this.analyze(manifests, options, registry).filter((d) => d.severity === DiagnosticSeverity.Error);
     }
     normalize(manifests, registry) {
         const ctx = registry._context();
-        return normalizeInlineResources(manifests, ctx.definitions, ctx.aliases, ctx.aliasesByModule);
+        const normalized = normalizeInlineResources(manifests, ctx.definitions, ctx.aliases, ctx.aliasesByModule);
+        // Resolve !ref sentinels after normalize so both the original and
+        // inline-extracted manifests get their refs canonicalized to
+        // {kind, name} for the kernel that consumes this output.
+        resolveRefSentinels(normalized, ctx.definitions, ctx.aliases, ctx.aliasesByModule);
+        return normalized;
     }
     prepare(manifests, registry) {
         const ctx = registry._context();

package/dist/builtins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EAwQ/C,CAAC"}
+{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EAiU/C,CAAC"}

package/dist/builtins.js

@@ -147,7 +147,12 @@ export const KERNEL_BUILTINS = [
                         additionalProperties: false,
                         properties: {
                             self: { "x-telo-context-from-root": "schema" },
-                            result: { "x-telo-context-from-ref-kind": "provide/kind#outputType" },
+                            result: {
+                                "x-telo-context-from-ref-kind": [
+                                    "provide/kind#outputType",
+                                    "invoke/kind#outputType",
+                                ],
+                            },
                         },
                     },
                 },
@@ -213,6 +218,20 @@ export const KERNEL_BUILTINS = [
                         anyOf: [
                             { type: "string", "x-telo-ref": "telo#Runnable" },
                             { type: "string", "x-telo-ref": "telo#Service" },
+                            // Post-resolution shape that `resolveRefSentinels`
+                            // substitutes a `!ref <name>` sentinel into. The
+                            // adjacent `x-telo-ref` constraints govern the kind
+                            // check; this branch only admits the structural form so
+                            // AJV doesn't reject a resolved ref.
+                            {
+                                type: "object",
+                                required: ["kind", "name"],
+                                properties: {
+                                    kind: { type: "string" },
+                                    name: { type: "string" },
+                                },
+                                additionalProperties: true,
+                            },
                         ],
                     },
                 },
@@ -220,6 +239,44 @@ export const KERNEL_BUILTINS = [
                     type: "array",
                     items: { type: "string" },
                 },
+                // Application-level environment contract. Each entry layers `env:`
+                // (required, names the source env var) and `default:` (optional, used
+                // when the env var is unset) on top of an open JSON Schema property
+                // schema. `type:` constrains the coercion rule applied to the raw env
+                // string (scalars per-type; `object` / `array` via JSON.parse with the
+                // matching top-level type). All other JSON Schema keywords are passed
+                // through unchanged and applied to the coerced value via the standard
+                // schema validator. See kernel/nodejs/src/application-env.ts.
+                variables: {
+                    type: "object",
+                    additionalProperties: {
+                        type: "object",
+                        required: ["env", "type"],
+                        properties: {
+                            env: { type: "string" },
+                            type: {
+                                type: "string",
+                                enum: ["string", "integer", "number", "boolean", "object", "array"],
+                            },
+                            default: {},
+                        },
+                    },
+                },
+                secrets: {
+                    type: "object",
+                    additionalProperties: {
+                        type: "object",
+                        required: ["env", "type"],
+                        properties: {
+                            env: { type: "string" },
+                            type: {
+                                type: "string",
+                                enum: ["string", "integer", "number", "boolean", "object", "array"],
+                            },
+                            default: {},
+                        },
+                    },
+                },
             },
             required: ["metadata"],
             additionalProperties: false,

package/dist/definition-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"definition-registry.d.ts","sourceRoot":"","sources":["../src/definition-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAGlC,+EAA+E;AAC/E,qBAAa,kBAAkB;;IAK7B;;sFAEkF;IAClF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IAEzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyC;IAC9D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D;6DACyD;IACzD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD;;0EAEsE;IACtE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA6B;IAEhE,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI;IAiC9C,OAAO,CAAC,aAAa;IASrB;;;yFAGqF;IACrF,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAgB1E;4EACwE;IACxE,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAMnE;wFACoF;IACpF,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE;IAWtE,OAAO,CAAC,iBAAiB;IAczB;;;;;;;;4FAQwF;IACxF,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAUhD,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAIrD,+FAA+F;IAC/F,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAIxD,gGAAgG;IAChG,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,GACvD,iBAAiB,GAAG,SAAS;IAOhC;;;;;;;;qFAQiF;IACjF,2BAA2B,CACzB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC1C,iBAAiB,GAAG,SAAS;IAuBhC,OAAO,CAAC,uBAAuB;IA+B/B;;qEAEiE;IACjE,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAgBxD,KAAK,IAAI,MAAM,EAAE;CAGlB"}
+{"version":3,"file":"definition-registry.d.ts","sourceRoot":"","sources":["../src/definition-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAGlC,+EAA+E;AAC/E,qBAAa,kBAAkB;;IAK7B;;sFAEkF;IAClF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IAEzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyC;IAC9D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D;6DACyD;IACzD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD;;0EAEsE;IACtE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA6B;IAEhE,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI;IAiC9C,OAAO,CAAC,aAAa;IASrB;;;yFAGqF;IACrF,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IA+B1E;4EACwE;IACxE,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAMnE;wFACoF;IACpF,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE;IAWtE,OAAO,CAAC,iBAAiB;IAczB;;;;;;;;4FAQwF;IACxF,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAUhD,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAIrD,+FAA+F;IAC/F,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAIxD,gGAAgG;IAChG,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,GACvD,iBAAiB,GAAG,SAAS;IAOhC;;;;;;;;qFAQiF;IACjF,2BAA2B,CACzB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC1C,iBAAiB,GAAG,SAAS;IAuBhC,OAAO,CAAC,uBAAuB;IA+B/B;;qEAEiE;IACjE,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAgBxD,KAAK,IAAI,MAAM,EAAE;CAGlB"}

package/dist/definition-registry.js

@@ -70,6 +70,22 @@ export class DefinitionRegistry {
      *  @param namespace  The module's metadata.namespace (e.g. "std"), or null for telo built-ins.
      *  @param moduleName The module's metadata.name (e.g. "pipeline", "http-server"). */
     registerModuleIdentity(namespace, moduleName) {
+        // The "telo" identity is reserved for the Telo built-in module and gets
+        // populated automatically when a Telo.Abstract definition registers (see
+        // `register` below). A user app / library without a namespace must NOT
+        // claim it — silently overwriting the built-in entry breaks every
+        // x-telo-ref that resolves through "telo#…". Concretely, the
+        // `Http.Api.routes[].handler` slot in the http-server schema carries
+        // `x-telo-ref: "telo#Invocable"`. If the entry application is, say,
+        // `Telo.Application/HelloApi` (no namespace), this method previously
+        // overwrote `"telo" → "Telo"` with `"telo" → "HelloApi"`. The handler's
+        // ref then resolved to a nonexistent `HelloApi.Invocable`, the
+        // kind-mismatch check inside `validate-references.ts` short-circuited
+        // on partial context, and the analyzer reported zero issues for a
+        // manifest that explodes at runtime. Skip non-Telo no-namespace modules;
+        // they have no x-telo-ref identity to declare anyway.
+        if (!namespace && moduleName !== "Telo")
+            return;
         const identity = namespace ? `${namespace}/${moduleName}` : "telo";
         this.identityMap.set(identity, moduleName);
         this.reverseIdentityMap.set(moduleName, identity);