@telorun/analyzer 0.11.0 → 0.12.1

package/dist/types.d.ts

@@ -73,6 +73,18 @@ export interface LoaderInitOptions {
 }
 export interface AnalysisOptions {
     strictContexts?: boolean;
+    /** When true, `analyze()` runs the state-mutating setup (module identity /
+     *  alias / definition registration plus `normalizeInlineResources`) but
+     *  skips every diagnostic-producing pass — per-resource validation, the
+     *  Library `env:` check, `validateExtends`, `validateProviderCoherence`,
+     *  and `validateThrowsCoverage`. Used by the kernel when a previous load
+     *  has already stamped the manifest set as valid (by content hash), so
+     *  the registry still gets populated without paying the validation walk
+     *  on every cold start. The caller takes responsibility for the
+     *  correctness guarantee — pass this only when something durable
+     *  (on-disk stamp) attests that the manifests passed a real analyze
+     *  pass at the same analyzer / kernel version. */
+    skipValidation?: boolean;
 }
 /** Pre-seeded state for incremental analysis. Passed to StaticAnalyzer.analyze() so it does
  *  not rebuild from scratch on every call. The provided instances are mutated — new definitions

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;qHACqH;AACrH,eAAO,MAAM,kBAAkB;;;;;CAKrB,CAAC;AACX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAC;AAE9F,gFAAgF;AAChF,eAAO,MAAM,yBAAyB,cAAc,CAAC;AAErD,MAAM,WAAW,QAAQ;IACvB,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,KAAK;IACpB,KAAK,EAAE,QAAQ,CAAC;IAChB,GAAG,EAAE,QAAQ,CAAC;CACf;AAED;;oDAEoD;AACpD,MAAM,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAE/C;6EAC6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,2BAA2B;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAExD;;qEAEiE;IACjE,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEjE;;qEAEiE;IACjE,cAAc,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,WAAW;IAC1B;;;+EAG2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,YAAY,CAAC,EAAE,cAAc,EAAE,CAAC;IAChC,qDAAqD;IACrD,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,yDAAyD;IACzD,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,6DAA6D;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;6FACyF;IACzF,WAAW,CAAC,EAAE,OAAO,sBAAsB,EAAE,WAAW,CAAC;CAC1D;AAED,MAAM,WAAW,eAAe;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;gEAKgE;AAChE,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,OAAO,qBAAqB,EAAE,aAAa,CAAC;IACtD,WAAW,CAAC,EAAE,OAAO,0BAA0B,EAAE,kBAAkB,CAAC;IACpE;;;;+EAI2E;IAC3E,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,qBAAqB,EAAE,aAAa,CAAC,CAAC;CAC5E"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;qHACqH;AACrH,eAAO,MAAM,kBAAkB;;;;;CAKrB,CAAC;AACX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAC;AAE9F,gFAAgF;AAChF,eAAO,MAAM,yBAAyB,cAAc,CAAC;AAErD,MAAM,WAAW,QAAQ;IACvB,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,KAAK;IACpB,KAAK,EAAE,QAAQ,CAAC;IAChB,GAAG,EAAE,QAAQ,CAAC;CACf;AAED;;oDAEoD;AACpD,MAAM,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAE/C;6EAC6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,2BAA2B;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAExD;;qEAEiE;IACjE,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEjE;;qEAEiE;IACjE,cAAc,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,WAAW;IAC1B;;;+EAG2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,YAAY,CAAC,EAAE,cAAc,EAAE,CAAC;IAChC,qDAAqD;IACrD,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,yDAAyD;IACzD,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,6DAA6D;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;6FACyF;IACzF,WAAW,CAAC,EAAE,OAAO,sBAAsB,EAAE,WAAW,CAAC;CAC1D;AAED,MAAM,WAAW,eAAe;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;;;;;sDAUkD;IAClD,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;gEAKgE;AAChE,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,OAAO,qBAAqB,EAAE,aAAa,CAAC;IACtD,WAAW,CAAC,EAAE,OAAO,0BAA0B,EAAE,kBAAkB,CAAC;IACpE;;;;+EAI2E;IAC3E,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,qBAAqB,EAAE,aAAa,CAAC,CAAC;CAC5E"}

package/dist/validate-cel-context.d.ts

@@ -63,6 +63,11 @@ export declare function pathMatchesScope(exprPath: string, scope: string): boole
  *   `manifestRoot.provide.kind` as a kind name, looks up the kind's Telo.Definition,
  *   and returns the `outputType` schema.
  *
+ *   Accepts either a single string or an array of strings. With an array, paths
+ *   are tried in order and the first one that resolves to a usable schema wins —
+ *   used by `result:` to find its dispatch target under whichever entry-point
+ *   field (`provide:` or `invoke:`) the definition declares.
+ *
  * - `x-telo-context-ref-from`: existing form — reads `{kind, name}` object from
  *   `manifestItem.<path>`, looks up the named manifest, returns its `<subpath>` field.
  *

package/dist/validate-cel-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAEtF,MAAM,WAAW,kBAAkB;IACjC;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC;;kDAE8C;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;KACxD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CA6BjC;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAChD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CA6FrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB"}
+{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAEtF,MAAM,WAAW,kBAAkB;IACjC;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC;;kDAE8C;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;KACxD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CA6BjC;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAChD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAqGrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB"}

package/dist/validate-cel-context.js

@@ -94,6 +94,11 @@ export function pathMatchesScope(exprPath, scope) {
  *   `manifestRoot.provide.kind` as a kind name, looks up the kind's Telo.Definition,
  *   and returns the `outputType` schema.
  *
+ *   Accepts either a single string or an array of strings. With an array, paths
+ *   are tried in order and the first one that resolves to a usable schema wins —
+ *   used by `result:` to find its dispatch target under whichever entry-point
+ *   field (`provide:` or `invoke:`) the definition declares.
+ *
  * - `x-telo-context-ref-from`: existing form — reads `{kind, name}` object from
  *   `manifestItem.<path>`, looks up the named manifest, returns its `<subpath>` field.
  *
@@ -122,30 +127,37 @@ export function resolveContextAnnotations(schema, manifestItem, opts) {
         };
     }
     const fromRoot = schema["x-telo-context-from-root"];
-    const fromRefKind = schema["x-telo-context-from-ref-kind"];
-    if (fromRoot || fromRefKind) {
+    const fromRefKindRaw = schema["x-telo-context-from-ref-kind"];
+    const fromRefKinds = fromRefKindRaw == null
+        ? []
+        : Array.isArray(fromRefKindRaw)
+            ? fromRefKindRaw
+            : [fromRefKindRaw];
+    if (fromRoot || fromRefKinds.length > 0) {
         if (fromRoot) {
             const resolved = navigatePath(manifestRoot, fromRoot.split("/"));
             if (resolved && typeof resolved === "object" && !Array.isArray(resolved)) {
                 return resolved;
             }
         }
-        if (fromRefKind && defs) {
-            const hashIdx = fromRefKind.indexOf("#");
-            if (hashIdx > 0) {
+        if (defs) {
+            for (const fromRefKind of fromRefKinds) {
+                const hashIdx = fromRefKind.indexOf("#");
+                if (hashIdx <= 0)
+                    continue;
                 const refPath = fromRefKind.slice(0, hashIdx);
                 const field = fromRefKind.slice(hashIdx + 1);
                 const kindValue = navigatePath(manifestRoot, refPath.split("/"));
-                if (typeof kindValue === "string" && kindValue.length > 0) {
-                    const canonical = aliases?.resolveKind(kindValue) ?? kindValue;
-                    const def = defs.resolve(canonical);
-                    const typeField = def
-                        ? def[field]
-                        : undefined;
-                    const resolved = resolveTypeFieldToSchema(typeField, allManifests ?? []);
-                    if (resolved && typeof resolved === "object") {
-                        return resolved;
-                    }
+                if (typeof kindValue !== "string" || kindValue.length === 0)
+                    continue;
+                const canonical = aliases?.resolveKind(kindValue) ?? kindValue;
+                const def = defs.resolve(canonical);
+                const typeField = def
+                    ? def[field]
+                    : undefined;
+                const resolved = resolveTypeFieldToSchema(typeField, allManifests ?? []);
+                if (resolved && typeof resolved === "object") {
+                    return resolved;
                 }
             }
         }

package/dist/validate-nested-inline.d.ts

@@ -0,0 +1,30 @@
+import type { ResourceManifest } from "@telorun/sdk";
+import { type AnalysisDiagnostic } from "./types.js";
+/** Minimal view of a definition needed to validate an inline resource's config. */
+export interface InlineDefinitionLookup {
+    (kind: string): {
+        schema?: Record<string, any>;
+    } | undefined;
+}
+/**
+ * Validates inline resources nested inside a resource body against their kind's
+ * config schema. The per-resource walk in `analyze()` validates a resource's
+ * own top-level config; inline resources at `x-telo-ref` slots reachable only
+ * through a local `$ref` (notably `Run.Sequence`'s `steps[].invoke`, hidden
+ * behind `#/$defs/step`) never reach the reference field map, so they would
+ * otherwise escape schema validation — e.g. `invoke: { kind: Console.ReadLine,
+ * prompt: "…" }`, where `prompt` belongs in the step's `inputs`, not the config.
+ *
+ * Walks the manifest data together with its definition schema, resolving local
+ * `$ref`s (so step trees of arbitrary depth are covered). At each `x-telo-ref`
+ * slot holding an inline resource, the inline's config is validated against its
+ * own kind's schema, then recursed into so inline resources nested inside
+ * inline resources are covered.
+ *
+ * Non-mutating: reads `manifest` and emits diagnostics anchored to its identity
+ * and a concrete dotted path matching the position-index key format;
+ * `rewriteSyntheticOrigins` reroutes those on inline-extracted (synthetic)
+ * manifests back to the root doc.
+ */
+export declare function validateNestedInlineResources(manifest: ResourceManifest, rootSchema: Record<string, any>, lookupDefinition: InlineDefinitionLookup): AnalysisDiagnostic[];
+//# sourceMappingURL=validate-nested-inline.d.ts.map

package/dist/validate-nested-inline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-nested-inline.d.ts","sourceRoot":"","sources":["../src/validate-nested-inline.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAQrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE,mFAAmF;AACnF,MAAM,WAAW,sBAAsB;IACrC,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;KAAE,GAAG,SAAS,CAAC;CAC9D;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,gBAAgB,EAC1B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,gBAAgB,EAAE,sBAAsB,GACvC,kBAAkB,EAAE,CAoHtB"}

package/dist/validate-nested-inline.js

@@ -0,0 +1,129 @@
+import { collectRefs, isInlineResource } from "./reference-field-map.js";
+import { collectProperties, resolveRef, substituteCelFields, validateAgainstSchema, } from "./schema-compat.js";
+import { DiagnosticSeverity } from "./types.js";
+const SOURCE = "telo-analyzer";
+/**
+ * Validates inline resources nested inside a resource body against their kind's
+ * config schema. The per-resource walk in `analyze()` validates a resource's
+ * own top-level config; inline resources at `x-telo-ref` slots reachable only
+ * through a local `$ref` (notably `Run.Sequence`'s `steps[].invoke`, hidden
+ * behind `#/$defs/step`) never reach the reference field map, so they would
+ * otherwise escape schema validation — e.g. `invoke: { kind: Console.ReadLine,
+ * prompt: "…" }`, where `prompt` belongs in the step's `inputs`, not the config.
+ *
+ * Walks the manifest data together with its definition schema, resolving local
+ * `$ref`s (so step trees of arbitrary depth are covered). At each `x-telo-ref`
+ * slot holding an inline resource, the inline's config is validated against its
+ * own kind's schema, then recursed into so inline resources nested inside
+ * inline resources are covered.
+ *
+ * Non-mutating: reads `manifest` and emits diagnostics anchored to its identity
+ * and a concrete dotted path matching the position-index key format;
+ * `rewriteSyntheticOrigins` reroutes those on inline-extracted (synthetic)
+ * manifests back to the root doc.
+ */
+export function validateNestedInlineResources(manifest, rootSchema, lookupDefinition) {
+    const diagnostics = [];
+    const resource = { kind: manifest.kind, name: manifest.metadata?.name };
+    const filePath = manifest.metadata?.source;
+    function validateInline(inline, path) {
+        const kind = inline.kind;
+        const def = lookupDefinition(kind);
+        // Unknown kind: these `$ref`-hidden slots are invisible to the field-map
+        // driven reference checks too, so nothing else would flag it — report here.
+        if (!def) {
+            diagnostics.push({
+                severity: DiagnosticSeverity.Error,
+                code: "UNDEFINED_KIND",
+                source: SOURCE,
+                message: `${resource.kind}/${resource.name}: inline ${kind} at '${path}': No Telo.Definition found for kind '${kind}'.`,
+                data: { resource, filePath, path: `${path}.kind` },
+            });
+            return;
+        }
+        // Kind exists but declares no config schema (e.g. a pure Telo.Type): no
+        // config to validate and no schema-declared slots to nest resources in.
+        if (!def.schema)
+            return;
+        const schema = def.schema;
+        // `kind` / `metadata` are implicit on every resource; inject them so a
+        // strict `additionalProperties: false` config schema doesn't reject them.
+        const effectiveSchema = schema.additionalProperties === false
+            ? {
+                ...schema,
+                properties: {
+                    kind: { type: "string" },
+                    metadata: { type: "object" },
+                    ...schema.properties,
+                },
+            }
+            : schema;
+        // Inline resources omit `metadata` — it is synthesized when the kernel
+        // registers them (and by `normalizeInlineResources` for extracted slots,
+        // which assigns a derived `metadata.name`). Config schemas conventionally
+        // declare `required: ["metadata", …]` with `metadata.name` required, so add
+        // a placeholder before validating to mirror the post-registration shape.
+        const existingMeta = inline.metadata && typeof inline.metadata === "object"
+            ? inline.metadata
+            : {};
+        const data = { ...inline, metadata: { name: "__inline__", ...existingMeta } };
+        const substituted = substituteCelFields(data, effectiveSchema, effectiveSchema);
+        for (const issue of validateAgainstSchema(substituted, effectiveSchema)) {
+            diagnostics.push({
+                severity: DiagnosticSeverity.Error,
+                code: "SCHEMA_VIOLATION",
+                source: SOURCE,
+                message: `${resource.kind}/${resource.name}: inline ${kind} at '${path}': ${issue.message}`,
+                data: { resource, filePath, path: issue.path ? `${path}.${issue.path}` : path },
+            });
+        }
+        // Recurse into the inline body against its own schema so deeper inline
+        // resources (e.g. an inline Run.Sequence's own steps) are validated too.
+        walk(inline, schema, schema, path);
+    }
+    function walk(data, schema, schemaRoot, path) {
+        if (!schema || typeof schema !== "object")
+            return;
+        const resolved = resolveRef(schema, schemaRoot);
+        // Reference slot: the value is either a named reference (`{kind, name}`,
+        // validated as its own manifest) or an inline resource to validate here.
+        if (collectRefs(resolved).length > 0) {
+            if (data &&
+                typeof data === "object" &&
+                !Array.isArray(data) &&
+                isInlineResource(data)) {
+                validateInline(data, path);
+            }
+            return;
+        }
+        if (Array.isArray(data)) {
+            const itemSchema = resolved.items;
+            if (!itemSchema)
+                return;
+            for (let i = 0; i < data.length; i++) {
+                walk(data[i], itemSchema, schemaRoot, `${path}[${i}]`);
+            }
+            return;
+        }
+        if (data && typeof data === "object") {
+            const props = collectProperties(resolved);
+            const additional = resolved.additionalProperties &&
+                typeof resolved.additionalProperties === "object" &&
+                !Array.isArray(resolved.additionalProperties)
+                ? resolved.additionalProperties
+                : undefined;
+            // Descend only where the schema declares structure. Freeform fields
+            // (`additionalProperties: true`, e.g. step `inputs`) carry caller data
+            // that may coincidentally look like `{kind: …}`; not descending there
+            // keeps the inline-resource detection anchored to real ref slots.
+            for (const [key, value] of Object.entries(data)) {
+                const propSchema = props[key] ?? additional;
+                if (!propSchema)
+                    continue;
+                walk(value, propSchema, schemaRoot, path ? `${path}.${key}` : key);
+            }
+        }
+    }
+    walk(manifest, rootSchema, rootSchema, "");
+    return diagnostics;
+}

package/dist/validate-provider-coherence.d.ts

@@ -0,0 +1,23 @@
+import type { ResourceManifest } from "@telorun/sdk";
+import type { AliasResolver } from "./alias-resolver.js";
+import type { DefinitionRegistry } from "./definition-registry.js";
+import { type AnalysisDiagnostic } from "./types.js";
+/**
+ * Validates coherence rules for `Telo.Definition` documents that use the `provide:`
+ * template target, plus the implementation-presence rule on `Telo.Provider`
+ * definitions.
+ *
+ * Diagnostics:
+ *  - PROVIDE_ON_NON_PROVIDER: `provide:` declared on a definition whose
+ *    `capability` is not `Telo.Provider`.
+ *  - PROVIDE_DISPATCHER_CONFLICT: `provide:` co-exists with `invoke:` or `run:`
+ *    on the same definition.
+ *  - PROVIDE_TARGET_UNKNOWN: `provide.name` does not resolve to an entry in
+ *    `resources:`.
+ *  - PROVIDE_TARGET_NOT_INVOCABLE: `provide.name` resolves to a resource whose
+ *    kind is registered but not a `Telo.Invocable`.
+ *  - PROVIDER_MISSING_IMPLEMENTATION: definition with `capability: Telo.Provider`
+ *    declares neither `controllers:` (TS-backed) nor `provide:` (template-backed).
+ */
+export declare function validateProviderCoherence(manifests: ResourceManifest[], registry: DefinitionRegistry, aliases: AliasResolver): AnalysisDiagnostic[];
+//# sourceMappingURL=validate-provider-coherence.d.ts.map

package/dist/validate-provider-coherence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-provider-coherence.d.ts","sourceRoot":"","sources":["../src/validate-provider-coherence.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,GACrB,kBAAkB,EAAE,CAyItB"}

package/dist/validate-provider-coherence.js

@@ -0,0 +1,148 @@
+import { DiagnosticSeverity } from "./types.js";
+const SOURCE = "telo-analyzer";
+/**
+ * Validates coherence rules for `Telo.Definition` documents that use the `provide:`
+ * template target, plus the implementation-presence rule on `Telo.Provider`
+ * definitions.
+ *
+ * Diagnostics:
+ *  - PROVIDE_ON_NON_PROVIDER: `provide:` declared on a definition whose
+ *    `capability` is not `Telo.Provider`.
+ *  - PROVIDE_DISPATCHER_CONFLICT: `provide:` co-exists with `invoke:` or `run:`
+ *    on the same definition.
+ *  - PROVIDE_TARGET_UNKNOWN: `provide.name` does not resolve to an entry in
+ *    `resources:`.
+ *  - PROVIDE_TARGET_NOT_INVOCABLE: `provide.name` resolves to a resource whose
+ *    kind is registered but not a `Telo.Invocable`.
+ *  - PROVIDER_MISSING_IMPLEMENTATION: definition with `capability: Telo.Provider`
+ *    declares neither `controllers:` (TS-backed) nor `provide:` (template-backed).
+ */
+export function validateProviderCoherence(manifests, registry, aliases) {
+    const diagnostics = [];
+    const importedModules = new Set();
+    for (const m of manifests) {
+        if (m.kind !== "Telo.Import")
+            continue;
+        const resolved = m.metadata
+            ?.resolvedModuleName;
+        if (resolved)
+            importedModules.add(resolved);
+    }
+    for (const m of manifests) {
+        if (m.kind !== "Telo.Definition")
+            continue;
+        const name = m.metadata?.name;
+        if (!name)
+            continue;
+        const ownModule = m.metadata?.module;
+        if (ownModule && importedModules.has(ownModule))
+            continue;
+        const filePath = m.metadata?.source;
+        const resource = { kind: m.kind, name };
+        const label = `${m.kind}/${name}`;
+        const md = m;
+        const capability = typeof md.capability === "string" ? md.capability : undefined;
+        const provide = md.provide;
+        const invoke = md.invoke;
+        const run = md.run;
+        const controllers = md.controllers;
+        const resources = md.resources;
+        const hasProvide = provide !== undefined && provide !== null;
+        const hasInvoke = invoke !== undefined && invoke !== null;
+        const hasRun = run !== undefined && run !== null;
+        const hasControllers = Array.isArray(controllers) && controllers.length > 0;
+        if (hasProvide && capability !== "Telo.Provider") {
+            diagnostics.push({
+                severity: DiagnosticSeverity.Error,
+                code: "PROVIDE_ON_NON_PROVIDER",
+                source: SOURCE,
+                message: `${label}: 'provide:' is only valid on definitions with 'capability: Telo.Provider' ` +
+                    `(found '${capability ?? "<unset>"}'). Use 'invoke:' or 'run:' for other capabilities.`,
+                data: { resource, filePath, path: "provide" },
+            });
+        }
+        if (hasProvide && (hasInvoke || hasRun)) {
+            const conflict = hasInvoke ? "invoke" : "run";
+            diagnostics.push({
+                severity: DiagnosticSeverity.Error,
+                code: "PROVIDE_DISPATCHER_CONFLICT",
+                source: SOURCE,
+                message: `${label}: 'provide:' cannot co-exist with '${conflict}:'. ` +
+                    `A definition declares exactly one dispatch entry-point.`,
+                data: { resource, filePath, path: "provide" },
+            });
+        }
+        if (hasProvide && typeof provide === "object" && !Array.isArray(provide)) {
+            const provideObj = provide;
+            const providedName = typeof provideObj.name === "string" ? provideObj.name : undefined;
+            const providedKind = typeof provideObj.kind === "string" ? provideObj.kind : undefined;
+            if (providedName && Array.isArray(resources)) {
+                const match = resources.find((r) => {
+                    const meta = r?.metadata;
+                    return typeof meta?.name === "string" && meta.name === providedName;
+                });
+                if (!match) {
+                    diagnostics.push({
+                        severity: DiagnosticSeverity.Error,
+                        code: "PROVIDE_TARGET_UNKNOWN",
+                        source: SOURCE,
+                        message: `${label}: 'provide.name: ${providedName}' does not match any entry's ` +
+                            `metadata.name in 'resources:'.`,
+                        data: { resource, filePath, path: "provide.name" },
+                    });
+                }
+                else if (typeof match.kind === "string") {
+                    // `provide.kind` is the type contract the analyzer uses to type
+                    // `result` CEL against the target's `outputType`. The runtime
+                    // dispatches on `provide.name` and ignores `provide.kind`, so a
+                    // mismatch silently degrades `result` typing to an open schema
+                    // (and at runtime quietly invokes the actually-matched resource).
+                    // Flag the divergence so result-typing never lies.
+                    if (providedKind) {
+                        const providedCanonical = aliases.resolveKind(providedKind) ?? providedKind;
+                        const matchCanonical = aliases.resolveKind(match.kind) ?? match.kind;
+                        if (providedCanonical !== matchCanonical) {
+                            diagnostics.push({
+                                severity: DiagnosticSeverity.Error,
+                                code: "PROVIDE_KIND_MISMATCH",
+                                source: SOURCE,
+                                message: `${label}: 'provide.kind: ${providedKind}' disagrees with the matched ` +
+                                    `'resources:' entry's kind '${match.kind}' (matched by metadata.name ` +
+                                    `'${providedName}'). The runtime dispatches by name, so 'provide.kind' ` +
+                                    `is decorative — but the analyzer types 'result:' against it, and a ` +
+                                    `mismatch silently turns off that typing.`,
+                                data: { resource, filePath, path: "provide.kind" },
+                            });
+                        }
+                    }
+                    const resolvedKind = aliases.resolveKind(match.kind) ?? match.kind;
+                    const targetDef = registry.resolve(resolvedKind) ?? registry.resolve(match.kind);
+                    if (targetDef && targetDef.kind === "Telo.Definition") {
+                        const targetCap = targetDef.capability;
+                        if (typeof targetCap === "string" && targetCap !== "Telo.Invocable") {
+                            diagnostics.push({
+                                severity: DiagnosticSeverity.Error,
+                                code: "PROVIDE_TARGET_NOT_INVOCABLE",
+                                source: SOURCE,
+                                message: `${label}: 'provide.name: ${providedName}' resolves to a ${match.kind} ` +
+                                    `(capability '${targetCap}'); 'provide:' requires a Telo.Invocable target.`,
+                                data: { resource, filePath, path: "provide.name" },
+                            });
+                        }
+                    }
+                }
+            }
+        }
+        if (capability === "Telo.Provider" && !hasControllers && !hasProvide) {
+            diagnostics.push({
+                severity: DiagnosticSeverity.Error,
+                code: "PROVIDER_MISSING_IMPLEMENTATION",
+                source: SOURCE,
+                message: `${label}: 'capability: Telo.Provider' requires either 'controllers:' ` +
+                    `(TS-backed) or 'provide:' (template-backed) to declare an implementation.`,
+                data: { resource, filePath, path: "capability" },
+            });
+        }
+    }
+    return diagnostics;
+}

package/dist/validate-references.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-references.d.ts","sourceRoot":"","sources":["../src/validate-references.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAkD/F;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,GACvB,kBAAkB,EAAE,CA2UtB"}
+{"version":3,"file":"validate-references.d.ts","sourceRoot":"","sources":["../src/validate-references.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA4C/F;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,GACvB,kBAAkB,EAAE,CAsbtB"}