@telorun/analyzer 0.11.0 → 1.2.0

package/LICENSE

@@ -1,6 +1,6 @@
 # SUSTAINABLE USE LICENSE (Fair-code)
 
-Copyright (c) 2026 DiglyAI
+Copyright (c) 2026 CodeNet Sp. z o.o.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to use, copy, modify, and distribute the Software for any purpose—including commercial purposes—subject to the following conditions:
 
@@ -14,4 +14,4 @@ Permission is hereby granted, free of charge, to any person obtaining a copy of
 
 5. DISCLAIMER: The Software is provided "as is", without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose and noninfringement. In no event shall the authors or copyright holders be liable for any claim, damages or other liability, whether in an action of contract, tort or otherwise, arising from, out of or in connection with the Software or the use or other dealings in the Software.
 
-For commercial licensing, managed hosting exemptions, or enterprise inquiries, please contact DiglyAI.
+For commercial licensing, managed hosting exemptions, or enterprise inquiries, please contact <contact@codenet.pl>.

package/README.md

@@ -1,5 +1,5 @@
 <p align="center">
-  <img src="./assets/telo.png" alt="Telo" width="200" />
+  <img src="https://raw.githubusercontent.com/telorun/telo/main/assets/telo.png" alt="Telo" width="200" />
 </p>
 
 <h1 align="center">Telo</h1>
@@ -61,12 +61,12 @@ targets:
 kind: Telo.Import
 metadata:
   name: Http
-source: ../modules/http-server
+source: std/http-server@0.4.0
 ---
 kind: Telo.Import
 metadata:
   name: Sql
-source: ../modules/sql
+source: std/sql@0.2.3
 ---
 # SQLite database — swap driver/host/database for PostgreSQL with zero YAML changes
 kind: Sql.Connection

package/dist/analysis-registry.d.ts

@@ -41,6 +41,13 @@ export declare class AnalysisRegistry {
     /** Returns the closest user-facing kind to `badKind`, or undefined when nothing
      *  is close enough (or multiple candidates tie). Case-sensitive. */
     suggestKind(badKind: string): string | undefined;
+    /** Returns every user-facing (alias-form) kind that satisfies the given
+     *  `x-telo-ref` constraint string (e.g. `"telo#Invocable"`, `"std/sql#Connection"`).
+     *  Resolution mirrors `validateReferences.checkKind`: abstract targets expand to
+     *  the set of definitions extending them; concrete targets yield just themselves.
+     *  Returns `undefined` when the ref can't be resolved (e.g. unregistered identity),
+     *  so callers can fall back to the unfiltered kind list. */
+    userFacingKindsForRef(xTeloRef: string): string[] | undefined;
     /** @internal Bridge for StaticAnalyzer — do not use outside the analyzer package. */
     _context(): AnalysisContext;
 }

package/dist/analysis-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analysis-registry.d.ts","sourceRoot":"","sources":["../src/analysis-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAMzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;;;GAIG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IAEpE,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI;IAIjD,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAIpE,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAIpE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI7C;;;;;;;OAOG;IACH,mBAAmB,CACjB,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,EAClC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GACnC,IAAI;IAkBP;;;;OAIG;IACH,kBAAkB,IAAI,kBAAkB,EAAE;IAI1C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAM/D,QAAQ,IAAI,MAAM,EAAE;IAIpB;mEAC+D;IAC/D,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE;IAIxC;;;gCAG4B;IAC5B,oBAAoB,IAAI,MAAM,EAAE;IAIhC;wEACoE;IACpE,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIhD,qFAAqF;IACrF,QAAQ,IAAI,eAAe;CAG5B"}
+{"version":3,"file":"analysis-registry.d.ts","sourceRoot":"","sources":["../src/analysis-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAMzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;;;GAIG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IAEpE,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI;IAIjD,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAIpE,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAIpE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI7C;;;;;;;OAOG;IACH,mBAAmB,CACjB,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,EAClC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GACnC,IAAI;IAkBP;;;;OAIG;IACH,kBAAkB,IAAI,kBAAkB,EAAE;IAI1C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAM/D,QAAQ,IAAI,MAAM,EAAE;IAIpB;mEAC+D;IAC/D,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE;IAIxC;;;gCAG4B;IAC5B,oBAAoB,IAAI,MAAM,EAAE;IAIhC;wEACoE;IACpE,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIhD;;;;;gEAK4D;IAC5D,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;IA+B7D,qFAAqF;IACrF,QAAQ,IAAI,eAAe;CAG5B"}

package/dist/analysis-registry.js

@@ -79,6 +79,44 @@ export class AnalysisRegistry {
     suggestKind(badKind) {
         return computeSuggestKind(badKind, this.aliases, this.defs);
     }
+    /** Returns every user-facing (alias-form) kind that satisfies the given
+     *  `x-telo-ref` constraint string (e.g. `"telo#Invocable"`, `"std/sql#Connection"`).
+     *  Resolution mirrors `validateReferences.checkKind`: abstract targets expand to
+     *  the set of definitions extending them; concrete targets yield just themselves.
+     *  Returns `undefined` when the ref can't be resolved (e.g. unregistered identity),
+     *  so callers can fall back to the unfiltered kind list. */
+    userFacingKindsForRef(xTeloRef) {
+        const targetKind = this.defs.resolveRef(xTeloRef);
+        if (!targetKind)
+            return undefined;
+        const targetDef = this.defs.resolve(targetKind);
+        if (!targetDef)
+            return undefined;
+        const canonicalKinds = [];
+        if (targetDef.kind === "Telo.Abstract") {
+            for (const def of this.defs.getByExtends(targetKind)) {
+                const module = def.metadata?.module;
+                if (module && def.metadata?.name) {
+                    canonicalKinds.push(`${module}.${def.metadata.name}`);
+                }
+            }
+        }
+        else {
+            canonicalKinds.push(targetKind);
+        }
+        const out = new Set();
+        for (const kind of canonicalKinds) {
+            const dot = kind.indexOf(".");
+            if (dot === -1)
+                continue;
+            const moduleName = kind.slice(0, dot);
+            const typeName = kind.slice(dot + 1);
+            for (const alias of this.aliases.aliasesFor(moduleName)) {
+                out.add(`${alias}.${typeName}`);
+            }
+        }
+        return Array.from(out);
+    }
     /** @internal Bridge for StaticAnalyzer — do not use outside the analyzer package. */
     _context() {
         return { aliases: this.aliases, definitions: this.defs, aliasesByModule: this.aliasesByModule };

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAa9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA8c/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IA6avB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,GAAG,gBAAgB,EAAE;IAUxF,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAc9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA+c/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAudvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,GAAG,gBAAgB,EAAE;IAUxF,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -7,10 +7,12 @@ import { buildKernelGlobalsSchema, mergeKernelGlobalsIntoContext } from "./kerne
 import { computeSuggestKind } from "./kind-suggest.js";
 import { isModuleKind } from "./module-kinds.js";
 import { normalizeInlineResources } from "./normalize-inline-resources.js";
+import { rewriteSyntheticOrigins } from "./rewrite-synthetic-origins.js";
 import { celTypeSatisfiesJsonSchema, substituteCelFields, validateAgainstSchema, } from "./schema-compat.js";
 import { DiagnosticSeverity } from "./types.js";
 import { getManifestItem, pathMatchesScope, resolveContextAnnotations, resolveTypeFieldToSchema, } from "./validate-cel-context.js";
 import { validateExtends } from "./validate-extends.js";
+import { validateProviderCoherence } from "./validate-provider-coherence.js";
 import { validateReferences } from "./validate-references.js";
 import { validateThrowsCoverage } from "./validate-throws-coverage.js";
 const SELF_PREFIX = "Self.";
@@ -490,6 +492,15 @@ export class StaticAnalyzer {
         }
         // Phase 2: extract inline resources from x-telo-ref slots into first-class manifests
         const allManifests = normalizeInlineResources(manifests, defs, aliases, aliasesByModule);
+        // Trusted-input fast path: when the caller has already attested that
+        // this exact manifest set passes analysis (e.g. via the kernel's
+        // hash-stamped `.validated.json` cache), skip the validation walk.
+        // Registration of identities / aliases / definitions and inline-resource
+        // normalisation have already run above; that's all downstream
+        // consumers (prepare, init loop) require.
+        if (options?.skipValidation) {
+            return diagnostics;
+        }
         // Build a name→manifest map for looking up referenced resources
         const byName = new Map();
         for (const m of allManifests) {
@@ -497,6 +508,36 @@ export class StaticAnalyzer {
                 byName.set(m.metadata.name, m);
             }
         }
+        // Library env: rejection — `env:` on a Library `variables` / `secrets`
+        // entry is forbidden. The Library entry schema is otherwise open so that
+        // any JSON Schema property schema is valid; this targeted check produces
+        // a clear diagnostic instead of a generic "additional property" error.
+        for (const m of allManifests) {
+            if (m.kind !== "Telo.Library")
+                continue;
+            const filePath = m.metadata?.source;
+            const moduleName = m.metadata?.name;
+            const resource = moduleName ? { kind: m.kind, name: moduleName } : undefined;
+            for (const block of ["variables", "secrets"]) {
+                const entries = m[block];
+                if (!entries || typeof entries !== "object" || Array.isArray(entries))
+                    continue;
+                for (const [entryName, entry] of Object.entries(entries)) {
+                    if (!entry || typeof entry !== "object" || Array.isArray(entry))
+                        continue;
+                    if ("env" in entry) {
+                        diagnostics.push({
+                            severity: DiagnosticSeverity.Error,
+                            code: "LIBRARY_ENV_KEY_REJECTED",
+                            source: SOURCE,
+                            message: `Telo.Library ${block}/${entryName}: 'env:' is only permitted on Telo.Application entries. ` +
+                                `Libraries must receive values from importers via the parent manifest's variables / secrets block.`,
+                            data: { resource, filePath, path: `${block}.${entryName}.env` },
+                        });
+                    }
+                }
+            }
+        }
         // Build typed kernel globals schema so x-telo-context chain validation
         // recognises variables, secrets, resources, env automatically
         const kernelGlobals = buildKernelGlobalsSchema(allManifests);
@@ -622,15 +663,14 @@ export class StaticAnalyzer {
                     emitTargetMismatch(dispatchKind, targetSchema, md.inputs, "inputs");
                 }
             }
-            // Top-level `result:` (a sibling, only meaningful with `provide:`) is a
-            // post-call mapping that must satisfy the abstract this definition
-            // `extends` (`outputType`). The target's outputType lives on `provide.kind`
+            // Top-level `result:` is a post-call mapping that must satisfy the abstract
+            // this definition `extends` (`outputType`). It's a sibling of whichever
+            // dispatch entry-point declared a kind-typed target (`provide:` or
+            // `invoke:`). The target's outputType lives on the dispatcher's `kind`
             // and is what `result` is typed against *inside* CEL — separate role.
-            if (provide &&
-                typeof provide === "object" &&
-                !Array.isArray(provide) &&
-                md.result &&
-                typeof md.result === "object") {
+            const hasDispatchObject = (provide && typeof provide === "object" && !Array.isArray(provide)) ||
+                (invoke && typeof invoke === "object" && !Array.isArray(invoke));
+            if (hasDispatchObject && md.result && typeof md.result === "object") {
                 const extendsValue = md.extends;
                 if (typeof extendsValue === "string" && extendsValue.length > 0) {
                     const abstractSchema = lookupDefinitionTypeField(extendsValue, "outputType", defs, aliases, allManifests);
@@ -735,9 +775,13 @@ export class StaticAnalyzer {
         diagnostics.push(...validateReferences(allManifests, { aliases, definitions: defs, aliasesByModule }));
         // Validate `extends` fields and flag legacy `capability: <UserAbstract>` overload.
         diagnostics.push(...validateExtends(allManifests, defs, aliases));
+        // Validate provider coherence rules for `provide:` template-target definitions.
+        diagnostics.push(...validateProviderCoherence(allManifests, defs, aliases));
         // Validate throws: declarations and catches: coverage (rules 1, 2, 4, 7)
         diagnostics.push(...validateThrowsCoverage(allManifests, defs, aliases, this.celEnv));
-        return diagnostics;
+        // Reroute diagnostics on synthetic (inline-extracted) resources back to
+        // the chain root so position-index lookups land on the parent doc.
+        return rewriteSyntheticOrigins(diagnostics, allManifests);
     }
     analyzeErrors(manifests, options, registry) {
         return this.analyze(manifests, options, registry).filter((d) => d.severity === DiagnosticSeverity.Error);

package/dist/builtins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EAwQ/C,CAAC"}
+{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EAmT/C,CAAC"}

package/dist/builtins.js

@@ -147,7 +147,12 @@ export const KERNEL_BUILTINS = [
                         additionalProperties: false,
                         properties: {
                             self: { "x-telo-context-from-root": "schema" },
-                            result: { "x-telo-context-from-ref-kind": "provide/kind#outputType" },
+                            result: {
+                                "x-telo-context-from-ref-kind": [
+                                    "provide/kind#outputType",
+                                    "invoke/kind#outputType",
+                                ],
+                            },
                         },
                     },
                 },
@@ -220,6 +225,44 @@ export const KERNEL_BUILTINS = [
                     type: "array",
                     items: { type: "string" },
                 },
+                // Application-level environment contract. Each entry layers `env:`
+                // (required, names the source env var) and `default:` (optional, used
+                // when the env var is unset) on top of an open JSON Schema property
+                // schema. `type:` constrains the coercion rule applied to the raw env
+                // string (scalars per-type; `object` / `array` via JSON.parse with the
+                // matching top-level type). All other JSON Schema keywords are passed
+                // through unchanged and applied to the coerced value via the standard
+                // schema validator. See kernel/nodejs/src/application-env.ts.
+                variables: {
+                    type: "object",
+                    additionalProperties: {
+                        type: "object",
+                        required: ["env", "type"],
+                        properties: {
+                            env: { type: "string" },
+                            type: {
+                                type: "string",
+                                enum: ["string", "integer", "number", "boolean", "object", "array"],
+                            },
+                            default: {},
+                        },
+                    },
+                },
+                secrets: {
+                    type: "object",
+                    additionalProperties: {
+                        type: "object",
+                        required: ["env", "type"],
+                        properties: {
+                            env: { type: "string" },
+                            type: {
+                                type: "string",
+                                enum: ["string", "integer", "number", "boolean", "object", "array"],
+                            },
+                            default: {},
+                        },
+                    },
+                },
             },
             required: ["metadata"],
             additionalProperties: false,

package/dist/index.d.ts

@@ -7,6 +7,7 @@ export { isModuleKind, MODULE_KINDS } from "./module-kinds.js";
 export type { ModuleKind } from "./module-kinds.js";
 export { parseLoadedFile } from "./parse-loaded-file.js";
 export type { ParseOptions } from "./parse-loaded-file.js";
+export { residualEntrySchema, residualEntrySchemaMap } from "./residual-schema.js";
 export { buildDocumentPositions, buildLineOffsets, buildPositionIndex, documentLineOffsets, } from "./position-metadata.js";
 export type { DocumentPosition } from "./position-metadata.js";
 export { HttpSource } from "./sources/http-source.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -4,6 +4,7 @@ export { flattenForAnalyzer, flattenLoadedModule } from "./flatten-for-analyzer.
 export { Loader } from "./manifest-loader.js";
 export { isModuleKind, MODULE_KINDS } from "./module-kinds.js";
 export { parseLoadedFile } from "./parse-loaded-file.js";
+export { residualEntrySchema, residualEntrySchemaMap } from "./residual-schema.js";
 export { buildDocumentPositions, buildLineOffsets, buildPositionIndex, documentLineOffsets, } from "./position-metadata.js";
 export { HttpSource } from "./sources/http-source.js";
 export { RegistrySource } from "./sources/registry-source.js";

package/dist/kernel-globals.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kernel-globals.d.ts","sourceRoot":"","sources":["../src/kernel-globals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,uDAAwD,CAAC;AASzF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,gBAAgB,EAAE,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAiCrB;AA2BD;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAClC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACjC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CASrB"}
+{"version":3,"file":"kernel-globals.d.ts","sourceRoot":"","sources":["../src/kernel-globals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,uDAAwD,CAAC;AASzF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,gBAAgB,EAAE,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAiCrB;AAwBD;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAClC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACjC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CASrB"}

package/dist/kernel-globals.js

@@ -1,3 +1,4 @@
+import { residualEntrySchemaMap } from "./residual-schema.js";
 /**
  * Kernel global names available in every CEL evaluation context at runtime.
  * Both `buildKernelGlobalsSchema` (chain-access validation) and
@@ -59,18 +60,15 @@ export function buildKernelGlobalsSchema(manifests) {
     };
 }
 /** Wrap a JSON Schema property map (like `Telo.Application.variables`) into a
- *  closed object schema suitable for chain-access validation. Falls back to
- *  an open map when the module declares no variables/secrets. */
+ *  closed object schema suitable for chain-access validation. For Application
+ *  entries the per-entry shape carries kernel-specific keys (`env`, `default`)
+ *  on top of an otherwise-standard JSON Schema property schema; those keys are
+ *  stripped via `residualEntrySchemaMap` so CEL sees the coerced shape, not
+ *  the env-binding wrapper. Library entries are pure JSON Schema property
+ *  schemas and pass through the same call unchanged. Falls back to an open map
+ *  when the module declares no variables/secrets. */
 function buildSchemaMapSchema(schemaMap) {
-    if (!schemaMap || typeof schemaMap !== "object" || Array.isArray(schemaMap)) {
-        return { type: "object", additionalProperties: true };
-    }
-    const props = {};
-    for (const [key, value] of Object.entries(schemaMap)) {
-        if (value !== null && typeof value === "object" && !Array.isArray(value)) {
-            props[key] = value;
-        }
-    }
+    const props = residualEntrySchemaMap(schemaMap);
     if (Object.keys(props).length === 0) {
         return { type: "object", additionalProperties: true };
     }

package/dist/manifest-loader.d.ts

@@ -6,12 +6,25 @@ export declare class Loader {
      *  caller (kernel) and a raw-mode caller (analyzer/editor) on the same file
      *  get distinct entries, so neither sees the wrong manifest tree. */
     private readonly fileCache;
+    /** requestUrl → canonical `source`. Lets `loadFile` skip the source read
+     *  when a URL it has already canonicalised is requested again — kernel
+     *  load → boot and the import-controller each ask the loader for the same
+     *  modules. Without this fast path every duplicate request re-runs the
+     *  source's `read()` (a `fetch` for `RegistrySource`, a disk read for
+     *  `LocalFileSource`). */
+    private readonly urlToSource;
     protected sources: ManifestSource[];
     private readonly celEnv;
     constructor(extraSourcesOrOptions?: ManifestSource[] | LoaderInitOptions);
     register(source: ManifestSource): this;
     private pick;
     resolveEntryPoint(url: string): Promise<string>;
+    /** Returns the canonical source URL the loader has already mapped `url`
+     *  to during a prior `loadFile`/`loadModule`/`loadGraph` call, or
+     *  `undefined` when the URL has not been seen. Callers use it to test
+     *  set-membership against a previous graph walk's modules without
+     *  triggering an extra source read. */
+    canonicalize(url: string): string | undefined;
     /** Read one file via the source chain and parse it into a LoadedFile.
      *  The result is shared with `Loader.fileCache`. Callers that want a
      *  private mutable copy must call `parseLoadedFile` directly with the
@@ -26,7 +39,16 @@ export declare class Loader {
      *  `importEdges` mapping each importing file's PascalCase aliases to their
      *  target's canonical source. */
     loadGraph(entryUrl: string, options?: LoadOptions): Promise<LoadedGraph>;
-    private resolveImportUrl;
+    /** Resolve an `import` URL against the file it appears in. Relative /
+     *  absolute-path forms run through the owning `ManifestSource`'s
+     *  `resolveRelative`; registry refs and full URLs pass through
+     *  unchanged. Exposed so the import-controller (and any other
+     *  caller-side resolver) lands on the *exact same* canonical URL the
+     *  loader used when walking the entry graph — divergent resolution
+     *  would silently break optimizations like `canonicalize()`-keyed
+     *  cache hits whenever a non-trivial `ManifestSource.resolveRelative`
+     *  is in play. */
+    resolveImportUrl(fromSource: string, importSource: string): string;
     private assertSingleModuleDeclaration;
     private assertNoSystemKindsInPartialContext;
     private assertImportTargetIsLibrary;

package/dist/manifest-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest-loader.d.ts","sourceRoot":"","sources":["../src/manifest-loader.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAGV,UAAU,EACV,WAAW,EACX,YAAY,EACb,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACpB,MAAM,YAAY,CAAC;AASpB,qBAAa,MAAM;IACjB;;;yEAGqE;IACrE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiC;IAE3D,SAAS,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,qBAAqB,GAAE,cAAc,EAAE,GAAG,iBAAsB;IAmB5E,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;IAKtC,OAAO,CAAC,IAAI;IAMN,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAOrD;;;+BAG2B;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAcvE;;wEAEoE;IAC9D,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;IAsB3E;;;qCAGiC;IAC3B,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAwG9E,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,6BAA6B;IAarC,OAAO,CAAC,mCAAmC;IAc3C,OAAO,CAAC,2BAA2B;YAkCrB,eAAe;IAmB7B;;;0CAGsC;IAChC,gBAAgB,CACpB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,KAAK,EAAE,WAAW,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CA0B5D"}
+{"version":3,"file":"manifest-loader.d.ts","sourceRoot":"","sources":["../src/manifest-loader.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAGV,UAAU,EACV,WAAW,EACX,YAAY,EACb,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACpB,MAAM,YAAY,CAAC;AASpB,qBAAa,MAAM;IACjB;;;yEAGqE;IACrE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiC;IAE3D;;;;;8BAK0B;IAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IAEzD,SAAS,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,qBAAqB,GAAE,cAAc,EAAE,GAAG,iBAAsB;IAmB5E,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;IAKtC,OAAO,CAAC,IAAI;IAMN,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUrD;;;;2CAIuC;IACvC,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAM7C;;;+BAG2B;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAgDvE;;wEAEoE;IAC9D,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;IAsB3E;;;qCAGiC;IAC3B,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAwG9E;;;;;;;;sBAQkB;IAClB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAOlE,OAAO,CAAC,6BAA6B;IAarC,OAAO,CAAC,mCAAmC;IAc3C,OAAO,CAAC,2BAA2B;YAkCrB,eAAe;IAmB7B;;;0CAGsC;IAChC,gBAAgB,CACpB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,KAAK,EAAE,WAAW,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CA0B5D"}

package/dist/manifest-loader.js

@@ -16,6 +16,13 @@ export class Loader {
      *  caller (kernel) and a raw-mode caller (analyzer/editor) on the same file
      *  get distinct entries, so neither sees the wrong manifest tree. */
     fileCache = new Map();
+    /** requestUrl → canonical `source`. Lets `loadFile` skip the source read
+     *  when a URL it has already canonicalised is requested again — kernel
+     *  load → boot and the import-controller each ask the loader for the same
+     *  modules. Without this fast path every duplicate request re-runs the
+     *  source's `read()` (a `fetch` for `RegistrySource`, a disk read for
+     *  `LocalFileSource`). */
+    urlToSource = new Map();
     sources;
     celEnv;
     constructor(extraSourcesOrOptions = []) {
@@ -45,8 +52,21 @@ export class Loader {
         return s;
     }
     async resolveEntryPoint(url) {
-        const { source } = await this.pick(url).read(url);
-        return source;
+        // Route through `loadFile` so the resolved source URL and parsed
+        // entry are populated in `urlToSource` + `fileCache` in one read.
+        // Callers (kernel.load) immediately call `loadGraph(entryUrl)`
+        // afterwards — without this priming, the entry file would be read
+        // twice (twice over the network for `RegistrySource`).
+        const file = await this.loadFile(url);
+        return file.source;
+    }
+    /** Returns the canonical source URL the loader has already mapped `url`
+     *  to during a prior `loadFile`/`loadModule`/`loadGraph` call, or
+     *  `undefined` when the URL has not been seen. Callers use it to test
+     *  set-membership against a previous graph walk's modules without
+     *  triggering an extra source read. */
+    canonicalize(url) {
+        return this.urlToSource.get(url);
     }
     // --- New API: returns LoadedFile / LoadedModule / LoadedGraph ----------
     /** Read one file via the source chain and parse it into a LoadedFile.
@@ -54,8 +74,42 @@ export class Loader {
      *  private mutable copy must call `parseLoadedFile` directly with the
      *  LoadedFile's `text`. */
     async loadFile(url, options) {
+        const compileKey = options?.compile ? "compiled" : "raw";
+        const knownSource = this.urlToSource.get(url);
+        if (knownSource) {
+            const cached = this.fileCache.get(`${compileKey}:${knownSource}`);
+            if (cached)
+                return cached;
+            // The other compile-mode entry is cached — reparse from its text
+            // instead of re-reading the source.
+            //
+            // NOTE for watch-mode reactivation (cli/nodejs/src/commands/run.ts
+            // currently has `setupWatchMode` commented out): this branch
+            // assumes file contents don't change underneath a single Loader.
+            // Reviving watch mode will need a public `invalidate(url)` (or
+            // similar) that drops both `urlToSource[url]` and the cached
+            // entries for its canonical source before the loader serves the
+            // file again.
+            const altKey = `${compileKey === "compiled" ? "raw" : "compiled"}:${knownSource}`;
+            const alt = this.fileCache.get(altKey);
+            if (alt) {
+                const reparsed = parseLoadedFile(knownSource, url, alt.text, {
+                    compile: options?.compile,
+                    celEnv: this.celEnv,
+                });
+                this.fileCache.set(`${compileKey}:${knownSource}`, reparsed);
+                return reparsed;
+            }
+        }
         const { text, source } = await this.pick(url).read(url);
-        const cacheKey = `${options?.compile ? "compiled" : "raw"}:${source}`;
+        this.urlToSource.set(url, source);
+        // Also map the canonical source to itself so subsequent `loadFile`
+        // calls that already received a canonical URL — `kernel.load` passes
+        // the result of `resolveEntryPoint` to `loadGraph`, which then asks
+        // for that exact URL — hit the urlToSource fast path instead of
+        // falling through to a redundant `pick(url).read(url)`.
+        this.urlToSource.set(source, source);
+        const cacheKey = `${compileKey}:${source}`;
         const cached = this.fileCache.get(cacheKey);
         if (cached && cached.text === text)
             return cached;
@@ -190,6 +244,15 @@ export class Loader {
         }
         return { rootSource, entry, modules, importEdges, errors };
     }
+    /** Resolve an `import` URL against the file it appears in. Relative /
+     *  absolute-path forms run through the owning `ManifestSource`'s
+     *  `resolveRelative`; registry refs and full URLs pass through
+     *  unchanged. Exposed so the import-controller (and any other
+     *  caller-side resolver) lands on the *exact same* canonical URL the
+     *  loader used when walking the entry graph — divergent resolution
+     *  would silently break optimizations like `canonicalize()`-keyed
+     *  cache hits whenever a non-trivial `ManifestSource.resolveRelative`
+     *  is in play. */
     resolveImportUrl(fromSource, importSource) {
         if (importSource.startsWith(".") || importSource.startsWith("/")) {
             return this.pick(fromSource).resolveRelative(fromSource, importSource);

package/dist/normalize-inline-resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"normalize-inline-resources.d.ts","sourceRoot":"","sources":["../src/normalize-inline-resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAczD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE,aAAa,EACvB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC3C,gBAAgB,EAAE,CAwDpB"}
+{"version":3,"file":"normalize-inline-resources.d.ts","sourceRoot":"","sources":["../src/normalize-inline-resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAczD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE,aAAa,EACvB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC3C,gBAAgB,EAAE,CA+DpB"}

package/dist/normalize-inline-resources.js

@@ -60,7 +60,7 @@ export function normalizeInlineResources(resources, registry, aliases, aliasesBy
                 fieldPath.startsWith(prefix + ".") ||
                 fieldPath.startsWith(prefix + "["));
             const invocationContext = isRefEntry(entry) ? entry.context : undefined;
-            const extracted = extractInlinesAtPath(resource, fieldPath, parentName, parentModule, invocationContext);
+            const extracted = extractInlinesAtPath(resource, fieldPath, parentName, resource.kind, parentModule, invocationContext);
             for (const manifest of extracted) {
                 result.push(manifest);
                 queue.push(manifest);
@@ -75,11 +75,22 @@ export function normalizeInlineResources(resources, registry, aliases, aliasesBy
  * Walks `resource` following `fieldPath` (dot notation, `[]` = array traversal).
  * Mutates the resource in-place: replaces each inline value with `{kind, name}`.
  * Returns the extracted manifests.
+ *
+ * Each extracted manifest carries `metadata.xTeloOrigin` so downstream
+ * diagnostics can be rerouted back to the parent doc's YAML position:
+ *   - `parentKind` / `parentName` — the resource that owned the inline slot
+ *   - `pathFromParent` — concrete dotted path with `[N]` indices, matching
+ *     `buildPositionIndex` keys (e.g. `routes[0].handler`)
  */
-function extractInlinesAtPath(resource, fieldPath, parentName, parentModule, invocationContext) {
+function extractInlinesAtPath(resource, fieldPath, parentName, parentKind, parentModule, invocationContext) {
     const extracted = [];
     const parts = fieldPath.split(".");
-    function traverse(obj, partsLeft, nameParts) {
+    function emit(inline, nameSegments, concretePath) {
+        const name = sanitizeName([parentName, ...nameSegments].join("_"));
+        extracted.push(buildManifest(inline, name, parentKind, parentName, concretePath, parentModule, invocationContext));
+        return name;
+    }
+    function traverse(obj, partsLeft, nameParts, pathSoFar) {
         if (!obj || typeof obj !== "object" || partsLeft.length === 0)
             return;
         const [head, ...rest] = partsLeft;
@@ -92,15 +103,15 @@ function extractInlinesAtPath(resource, fieldPath, parentName, parentModule, inv
                 if (!elem || typeof elem !== "object")
                     continue;
                 const sanitizedKey = sanitizeName(mapKey);
+                const childPath = pathSoFar ? `${pathSoFar}.${mapKey}` : mapKey;
                 if (rest.length === 0) {
                     if (isInlineResource(elem)) {
-                        const name = sanitizeName([parentName, ...nameParts, sanitizedKey].join("_"));
-                        extracted.push(buildManifest(elem, name, parentModule, invocationContext));
+                        const name = emit(elem, [...nameParts, sanitizedKey], childPath);
                         container[mapKey] = { kind: elem.kind, name };
                     }
                 }
                 else {
-                    traverse(elem, rest, [...nameParts, sanitizedKey]);
+                    traverse(elem, rest, [...nameParts, sanitizedKey], childPath);
                 }
             }
             return;
@@ -111,6 +122,7 @@ function extractInlinesAtPath(resource, fieldPath, parentName, parentModule, inv
         const val = container[key];
         if (val == null)
             return;
+        const keyPath = pathSoFar ? `${pathSoFar}.${key}` : key;
         if (isArr) {
             if (!Array.isArray(val))
                 return;
@@ -121,16 +133,16 @@ function extractInlinesAtPath(resource, fieldPath, parentName, parentModule, inv
                 const elemId = typeof elem.name === "string"
                     ? elem.name
                     : String(idx);
+                const childPath = `${keyPath}[${idx}]`;
                 if (rest.length === 0) {
                     // Array element itself is the ref slot
                     if (isInlineResource(elem)) {
-                        const name = sanitizeName([parentName, ...nameParts, key, elemId].join("_"));
-                        extracted.push(buildManifest(elem, name, parentModule, invocationContext));
+                        const name = emit(elem, [...nameParts, key, elemId], childPath);
                         val[idx] = { kind: elem.kind, name };
                     }
                 }
                 else {
-                    traverse(elem, rest, [...nameParts, key, elemId]);
+                    traverse(elem, rest, [...nameParts, key, elemId], childPath);
                 }
             }
         }
@@ -138,20 +150,19 @@ function extractInlinesAtPath(resource, fieldPath, parentName, parentModule, inv
             if (rest.length === 0) {
                 // val is the ref slot
                 if (val && typeof val === "object" && !Array.isArray(val) && isInlineResource(val)) {
-                    const name = sanitizeName([parentName, ...nameParts, key].join("_"));
-                    extracted.push(buildManifest(val, name, parentModule, invocationContext));
+                    const name = emit(val, [...nameParts, key], keyPath);
                     container[key] = { kind: val.kind, name };
                 }
             }
             else {
-                traverse(val, rest, [...nameParts, key]);
+                traverse(val, rest, [...nameParts, key], keyPath);
             }
         }
     }
-    traverse(resource, parts, []);
+    traverse(resource, parts, [], "");
     return extracted;
 }
-function buildManifest(inline, name, parentModule, invocationContext) {
+function buildManifest(inline, name, parentKind, parentName, pathFromParent, parentModule, invocationContext) {
     const existingMeta = inline.metadata && typeof inline.metadata === "object"
         ? inline.metadata
         : {};
@@ -163,6 +174,7 @@ function buildManifest(inline, name, parentModule, invocationContext) {
             // Inherit parent module only if the inline doesn't already declare one
             ...(parentModule && !existingMeta.module ? { module: parentModule } : {}),
             ...(invocationContext ? { xTeloInvocationContext: invocationContext } : {}),
+            xTeloOrigin: { parentKind, parentName, pathFromParent },
         },
     };
 }

package/dist/position-metadata.d.ts

@@ -22,6 +22,10 @@ export declare function documentLineOffsets(text: string): number[];
  *  yaml-AST node range into Range coordinates. */
 export declare function buildLineOffsets(text: string): number[];
 /** Walks the YAML AST and records source ranges for every field value, keyed
- *  by dotted path (e.g. "kind", "config.handler", "config.routes[0].path"). */
+ *  by dotted path (e.g. "kind", "config.handler", "config.routes[0].path").
+ *  Map keys are also recorded under the `@key:<path>` namespace so diagnostic
+ *  resolvers can squiggle just the key identifier instead of the full value
+ *  block — used when a diagnostic targets a missing child property and the
+ *  resolver has to fall back to the parent. */
 export declare function buildPositionIndex(doc: Document, lineOffsets: number[]): PositionIndex;
 //# sourceMappingURL=position-metadata.d.ts.map