@telorun/analyzer 0.11.0 → 1.2.0

package/src/normalize-inline-resources.ts

@@ -82,7 +82,14 @@ export function normalizeInlineResources(
       );
 
       const invocationContext = isRefEntry(entry) ? entry.context : undefined;
-      const extracted = extractInlinesAtPath(resource, fieldPath, parentName, parentModule, invocationContext);
+      const extracted = extractInlinesAtPath(
+        resource,
+        fieldPath,
+        parentName,
+        resource.kind,
+        parentModule,
+        invocationContext,
+      );
       for (const manifest of extracted) {
         result.push(manifest);
         queue.push(manifest as ResourceManifest & { metadata: { name: string } });
@@ -99,18 +106,42 @@ export function normalizeInlineResources(
  * Walks `resource` following `fieldPath` (dot notation, `[]` = array traversal).
  * Mutates the resource in-place: replaces each inline value with `{kind, name}`.
  * Returns the extracted manifests.
+ *
+ * Each extracted manifest carries `metadata.xTeloOrigin` so downstream
+ * diagnostics can be rerouted back to the parent doc's YAML position:
+ *   - `parentKind` / `parentName` — the resource that owned the inline slot
+ *   - `pathFromParent` — concrete dotted path with `[N]` indices, matching
+ *     `buildPositionIndex` keys (e.g. `routes[0].handler`)
  */
 function extractInlinesAtPath(
   resource: ResourceManifest,
   fieldPath: string,
   parentName: string,
+  parentKind: string,
   parentModule: string | undefined,
   invocationContext?: Record<string, any>,
 ): ResourceManifest[] {
   const extracted: ResourceManifest[] = [];
   const parts = fieldPath.split(".");
 
-  function traverse(obj: unknown, partsLeft: string[], nameParts: string[]): void {
+  function emit(
+    inline: Record<string, unknown>,
+    nameSegments: string[],
+    concretePath: string,
+  ): string {
+    const name = sanitizeName([parentName, ...nameSegments].join("_"));
+    extracted.push(
+      buildManifest(inline, name, parentKind, parentName, concretePath, parentModule, invocationContext),
+    );
+    return name;
+  }
+
+  function traverse(
+    obj: unknown,
+    partsLeft: string[],
+    nameParts: string[],
+    pathSoFar: string,
+  ): void {
     if (!obj || typeof obj !== "object" || partsLeft.length === 0) return;
 
     const [head, ...rest] = partsLeft;
@@ -123,15 +154,15 @@ function extractInlinesAtPath(
         const elem = container[mapKey];
         if (!elem || typeof elem !== "object") continue;
         const sanitizedKey = sanitizeName(mapKey);
+        const childPath = pathSoFar ? `${pathSoFar}.${mapKey}` : mapKey;
 
         if (rest.length === 0) {
           if (isInlineResource(elem as Record<string, unknown>)) {
-            const name = sanitizeName([parentName, ...nameParts, sanitizedKey].join("_"));
-            extracted.push(buildManifest(elem as Record<string, unknown>, name, parentModule, invocationContext));
+            const name = emit(elem as Record<string, unknown>, [...nameParts, sanitizedKey], childPath);
             container[mapKey] = { kind: (elem as Record<string, unknown>).kind, name };
           }
         } else {
-          traverse(elem, rest, [...nameParts, sanitizedKey]);
+          traverse(elem, rest, [...nameParts, sanitizedKey], childPath);
         }
       }
       return;
@@ -142,6 +173,7 @@ function extractInlinesAtPath(
     const container = obj as Record<string, unknown>;
     const val = container[key];
     if (val == null) return;
+    const keyPath = pathSoFar ? `${pathSoFar}.${key}` : key;
 
     if (isArr) {
       if (!Array.isArray(val)) return;
@@ -152,39 +184,41 @@ function extractInlinesAtPath(
           typeof (elem as Record<string, unknown>).name === "string"
             ? ((elem as Record<string, unknown>).name as string)
             : String(idx);
+        const childPath = `${keyPath}[${idx}]`;
 
         if (rest.length === 0) {
           // Array element itself is the ref slot
           if (isInlineResource(elem as Record<string, unknown>)) {
-            const name = sanitizeName([parentName, ...nameParts, key, elemId].join("_"));
-            extracted.push(buildManifest(elem as Record<string, unknown>, name, parentModule, invocationContext));
+            const name = emit(elem as Record<string, unknown>, [...nameParts, key, elemId], childPath);
             val[idx] = { kind: (elem as Record<string, unknown>).kind, name };
           }
         } else {
-          traverse(elem, rest, [...nameParts, key, elemId]);
+          traverse(elem, rest, [...nameParts, key, elemId], childPath);
         }
       }
     } else {
       if (rest.length === 0) {
         // val is the ref slot
         if (val && typeof val === "object" && !Array.isArray(val) && isInlineResource(val as Record<string, unknown>)) {
-          const name = sanitizeName([parentName, ...nameParts, key].join("_"));
-          extracted.push(buildManifest(val as Record<string, unknown>, name, parentModule, invocationContext));
+          const name = emit(val as Record<string, unknown>, [...nameParts, key], keyPath);
           container[key] = { kind: (val as Record<string, unknown>).kind, name };
         }
       } else {
-        traverse(val, rest, [...nameParts, key]);
+        traverse(val, rest, [...nameParts, key], keyPath);
       }
     }
   }
 
-  traverse(resource, parts, []);
+  traverse(resource, parts, [], "");
   return extracted;
 }
 
 function buildManifest(
   inline: Record<string, unknown>,
   name: string,
+  parentKind: string,
+  parentName: string,
+  pathFromParent: string,
   parentModule: string | undefined,
   invocationContext?: Record<string, any>,
 ): ResourceManifest {
@@ -200,6 +234,7 @@ function buildManifest(
       // Inherit parent module only if the inline doesn't already declare one
       ...(parentModule && !existingMeta.module ? { module: parentModule } : {}),
       ...(invocationContext ? { xTeloInvocationContext: invocationContext } : {}),
+      xTeloOrigin: { parentKind, parentName, pathFromParent },
     },
-  } as ResourceManifest;
+  } as unknown as ResourceManifest;
 }

package/src/position-metadata.ts

@@ -63,7 +63,11 @@ function offsetToPosition(offset: number, lineOffsets: number[]): Position {
 }
 
 /** Walks the YAML AST and records source ranges for every field value, keyed
- *  by dotted path (e.g. "kind", "config.handler", "config.routes[0].path"). */
+ *  by dotted path (e.g. "kind", "config.handler", "config.routes[0].path").
+ *  Map keys are also recorded under the `@key:<path>` namespace so diagnostic
+ *  resolvers can squiggle just the key identifier instead of the full value
+ *  block — used when a diagnostic targets a missing child property and the
+ *  resolver has to fall back to the parent. */
 export function buildPositionIndex(doc: Document, lineOffsets: number[]): PositionIndex {
   const index: PositionIndex = new Map();
 
@@ -83,6 +87,9 @@ export function buildPositionIndex(doc: Document, lineOffsets: number[]): Positi
         const key = isScalar(pair.key) ? String(pair.key.value) : null;
         if (key == null) continue;
         const childPath = path ? `${path}.${key}` : key;
+        if (pair.key && (pair.key as any).range) {
+          recordNode(pair.key, `@key:${childPath}`);
+        }
         if (pair.value != null) {
           recordNode(pair.value, childPath);
           walk(pair.value, childPath);

package/src/reference-field-map.ts

@@ -63,23 +63,39 @@ export function isInlineResource(val: Record<string, unknown>): boolean {
   return true;
 }
 
-/** Resolves all values at a field map path in a resource config.
- *  Path-segment markers:
- *   - `[]`  iterate array values at this key
+/** A value found at a field-map path, paired with the concrete path that
+ *  produced it. `path` has every `[]` substituted with `[N]` and every `{}`
+ *  substituted with the actual map key, matching the format produced by
+ *  `buildPositionIndex`. Used so diagnostics emitted against a specific
+ *  array element / map entry can be resolved back to a YAML range. */
+export interface ResolvedFieldEntry {
+  value: unknown;
+  path: string;
+}
+
+/** Resolves all `{value, path}` entries at a field map path in a resource
+ *  config. The returned `path` is the concrete dotted path produced by the
+ *  substitutions below, matching the format `buildPositionIndex` keys on.
+ *  Path-segment markers accepted in the input `path`:
+ *   - `[]`  iterate array values at this key, substituting `[N]` per item
+ *           (e.g. `routes[]` → `routes[0]`, `routes[1]`, …).
  *   - `{}`  iterate map values (every value in an `additionalProperties`-typed
  *           object — used for fields like `content[mime]` whose schema declares
- *           a key-as-MIME map). The path is `<key>.{}.<rest>`. */
-export function resolveFieldValues(obj: unknown, path: string): unknown[] {
+ *           a key-as-MIME map). Substituted with the literal map key joined by
+ *           a dot, so the input `content.{}.encoder` yields concrete paths
+ *           like `content.application/json.encoder`. */
+export function resolveFieldEntries(obj: unknown, path: string): ResolvedFieldEntry[] {
   const parts = path.split(".");
-  let current: unknown[] = [obj];
+  let current: ResolvedFieldEntry[] = [{ value: obj, path: "" }];
   for (const part of parts) {
     if (part === "{}") {
-      // Iterate the values of every map currently in `current`.
-      const next: unknown[] = [];
-      for (const item of current) {
-        if (!item || typeof item !== "object") continue;
-        for (const v of Object.values(item as Record<string, unknown>)) {
-          if (v != null) next.push(v);
+      const next: ResolvedFieldEntry[] = [];
+      for (const entry of current) {
+        if (!entry.value || typeof entry.value !== "object") continue;
+        for (const [k, v] of Object.entries(entry.value as Record<string, unknown>)) {
+          if (v != null) {
+            next.push({ value: v, path: entry.path ? `${entry.path}.${k}` : k });
+          }
         }
       }
       current = next;
@@ -87,19 +103,31 @@ export function resolveFieldValues(obj: unknown, path: string): unknown[] {
     }
     const isArray = part.endsWith("[]");
     const key = isArray ? part.slice(0, -2) : part;
-    const next: unknown[] = [];
-    for (const item of current) {
-      if (!item || typeof item !== "object") continue;
-      const val = (item as Record<string, unknown>)[key];
+    const next: ResolvedFieldEntry[] = [];
+    for (const entry of current) {
+      if (!entry.value || typeof entry.value !== "object") continue;
+      const val = (entry.value as Record<string, unknown>)[key];
       if (val == null) continue;
-      if (isArray && Array.isArray(val)) next.push(...val);
-      else if (!isArray) next.push(val);
+      const basePath = entry.path ? `${entry.path}.${key}` : key;
+      if (isArray && Array.isArray(val)) {
+        for (let i = 0; i < val.length; i++) {
+          if (val[i] != null) next.push({ value: val[i], path: `${basePath}[${i}]` });
+        }
+      } else if (!isArray) {
+        next.push({ value: val, path: basePath });
+      }
     }
     current = next;
   }
   return current;
 }
 
+/** Backwards-compat wrapper that drops the concrete path. Prefer
+ *  `resolveFieldEntries` for new code that wants positions. */
+export function resolveFieldValues(obj: unknown, path: string): unknown[] {
+  return resolveFieldEntries(obj, path).map((e) => e.value);
+}
+
 /**
  * Traverses a definition's JSON Schema once and returns a field map recording every
  * x-telo-ref slot and every x-telo-scope slot.

package/src/residual-schema.ts

@@ -0,0 +1,49 @@
+/**
+ * Build the residual JSON Schema for a `variables` / `secrets` entry.
+ *
+ * For Telo.Application env-binding entries (those with an `env:` key), strips
+ * the kernel-specific wrapper keys `env` and `default` — `default` here is
+ * the *fallback host value* the kernel coerces when the env var is unset, not
+ * a JSON Schema annotation, so it must not leak into the validator.
+ *
+ * For Telo.Library entries (no `env:`), passes the entry through unchanged.
+ * Library `default:` is a standard JSON Schema annotation and stays.
+ *
+ * Single source of truth for "residual schema" referenced by both the
+ * analyzer's CEL globals normalization and the kernel's runtime env-var
+ * resolver — keeping them aligned prevents the two surfaces from drifting.
+ */
+export function residualEntrySchema(
+  entry: Record<string, unknown> | null | undefined,
+): Record<string, unknown> {
+  if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+    return { type: "object", additionalProperties: true };
+  }
+  const isAppEnvBinding = "env" in entry;
+  const out: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(entry)) {
+    if (isAppEnvBinding && (key === "env" || key === "default")) continue;
+    out[key] = value;
+  }
+  return out;
+}
+
+/**
+ * Apply `residualEntrySchema` to every entry in a `variables` / `secrets` map.
+ * Returns a property-map suitable for use as the inner schema of CEL's
+ * `variables` / `secrets` namespaces.
+ */
+export function residualEntrySchemaMap(
+  entries: Record<string, unknown> | null | undefined,
+): Record<string, Record<string, unknown>> {
+  const out: Record<string, Record<string, unknown>> = {};
+  if (!entries || typeof entries !== "object" || Array.isArray(entries)) {
+    return out;
+  }
+  for (const [name, value] of Object.entries(entries)) {
+    if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+      out[name] = residualEntrySchema(value as Record<string, unknown>);
+    }
+  }
+  return out;
+}

package/src/rewrite-synthetic-origins.ts

@@ -0,0 +1,75 @@
+import type { ResourceManifest } from "@telorun/sdk";
+import type { AnalysisDiagnostic } from "./types.js";
+
+interface XTeloOrigin {
+  parentKind: string;
+  parentName: string;
+  pathFromParent: string;
+}
+
+function readOrigin(manifest: ResourceManifest | undefined): XTeloOrigin | undefined {
+  if (!manifest) return undefined;
+  const origin = (manifest.metadata as { xTeloOrigin?: XTeloOrigin } | undefined)?.xTeloOrigin;
+  if (
+    !origin ||
+    typeof origin.parentKind !== "string" ||
+    typeof origin.parentName !== "string" ||
+    typeof origin.pathFromParent !== "string"
+  ) {
+    return undefined;
+  }
+  return origin;
+}
+
+/** Diagnostics emitted on synthetic manifests (resources extracted by
+ *  `normalizeInlineResources`) carry the synthetic's identity in
+ *  `data.resource`, which has no YAML source. Rewrite each such diagnostic
+ *  back to the chain root: walk up `metadata.xTeloOrigin` until a manifest
+ *  with no origin is reached, and prepend each hop's `pathFromParent` to
+ *  `data.path` so position-index lookups against the root doc resolve. */
+export function rewriteSyntheticOrigins(
+  diagnostics: AnalysisDiagnostic[],
+  manifests: ResourceManifest[],
+): AnalysisDiagnostic[] {
+  const byName = new Map<string, ResourceManifest>();
+  for (const m of manifests) {
+    const name = m.metadata?.name;
+    if (typeof name === "string") byName.set(name, m);
+  }
+
+  return diagnostics.map((d) => {
+    const data = d.data as
+      | { resource?: { kind?: string; name?: string }; path?: string; filePath?: string }
+      | undefined;
+    if (!data?.resource?.name) return d;
+
+    let current = byName.get(data.resource.name);
+    let origin = readOrigin(current);
+    if (!origin) return d;
+
+    let accumPath = typeof data.path === "string" ? data.path : "";
+    let rootKind: string = origin.parentKind;
+    let rootName: string = origin.parentName;
+
+    while (origin) {
+      accumPath = accumPath ? `${origin.pathFromParent}.${accumPath}` : origin.pathFromParent;
+      rootKind = origin.parentKind;
+      rootName = origin.parentName;
+      current = byName.get(origin.parentName);
+      origin = readOrigin(current);
+    }
+
+    const rootFilePath =
+      (current?.metadata as { source?: string } | undefined)?.source ?? data.filePath;
+
+    return {
+      ...d,
+      data: {
+        ...data,
+        resource: { kind: rootKind, name: rootName },
+        filePath: rootFilePath,
+        path: accumPath,
+      },
+    };
+  });
+}

package/src/types.ts

@@ -81,6 +81,18 @@ export interface LoaderInitOptions {
 
 export interface AnalysisOptions {
   strictContexts?: boolean;
+  /** When true, `analyze()` runs the state-mutating setup (module identity /
+   *  alias / definition registration plus `normalizeInlineResources`) but
+   *  skips every diagnostic-producing pass — per-resource validation, the
+   *  Library `env:` check, `validateExtends`, `validateProviderCoherence`,
+   *  and `validateThrowsCoverage`. Used by the kernel when a previous load
+   *  has already stamped the manifest set as valid (by content hash), so
+   *  the registry still gets populated without paying the validation walk
+   *  on every cold start. The caller takes responsibility for the
+   *  correctness guarantee — pass this only when something durable
+   *  (on-disk stamp) attests that the manifests passed a real analyze
+   *  pass at the same analyzer / kernel version. */
+  skipValidation?: boolean;
 }
 
 /** Pre-seeded state for incremental analysis. Passed to StaticAnalyzer.analyze() so it does

package/src/validate-cel-context.ts

@@ -119,6 +119,11 @@ export function pathMatchesScope(exprPath: string, scope: string): boolean {
  *   `manifestRoot.provide.kind` as a kind name, looks up the kind's Telo.Definition,
  *   and returns the `outputType` schema.
  *
+ *   Accepts either a single string or an array of strings. With an array, paths
+ *   are tried in order and the first one that resolves to a usable schema wins —
+ *   used by `result:` to find its dispatch target under whichever entry-point
+ *   field (`provide:` or `invoke:`) the definition declares.
+ *
  * - `x-telo-context-ref-from`: existing form — reads `{kind, name}` object from
  *   `manifestItem.<path>`, looks up the named manifest, returns its `<subpath>` field.
  *
@@ -153,8 +158,16 @@ export function resolveContextAnnotations(
   }
 
   const fromRoot = schema["x-telo-context-from-root"] as string | undefined;
-  const fromRefKind = schema["x-telo-context-from-ref-kind"] as string | undefined;
-  if (fromRoot || fromRefKind) {
+  const fromRefKindRaw = schema["x-telo-context-from-ref-kind"] as
+    | string
+    | string[]
+    | undefined;
+  const fromRefKinds = fromRefKindRaw == null
+    ? []
+    : Array.isArray(fromRefKindRaw)
+      ? fromRefKindRaw
+      : [fromRefKindRaw];
+  if (fromRoot || fromRefKinds.length > 0) {
     if (fromRoot) {
       const resolved = navigatePath(manifestRoot, fromRoot.split("/")) as
         | Record<string, any>
@@ -163,22 +176,22 @@ export function resolveContextAnnotations(
         return resolved;
       }
     }
-    if (fromRefKind && defs) {
-      const hashIdx = fromRefKind.indexOf("#");
-      if (hashIdx > 0) {
+    if (defs) {
+      for (const fromRefKind of fromRefKinds) {
+        const hashIdx = fromRefKind.indexOf("#");
+        if (hashIdx <= 0) continue;
         const refPath = fromRefKind.slice(0, hashIdx);
         const field = fromRefKind.slice(hashIdx + 1);
         const kindValue = navigatePath(manifestRoot, refPath.split("/"));
-        if (typeof kindValue === "string" && kindValue.length > 0) {
-          const canonical = aliases?.resolveKind(kindValue) ?? kindValue;
-          const def = defs.resolve(canonical);
-          const typeField = def
-            ? (def as Record<string, unknown>)[field]
-            : undefined;
-          const resolved = resolveTypeFieldToSchema(typeField, allManifests ?? []);
-          if (resolved && typeof resolved === "object") {
-            return resolved;
-          }
+        if (typeof kindValue !== "string" || kindValue.length === 0) continue;
+        const canonical = aliases?.resolveKind(kindValue) ?? kindValue;
+        const def = defs.resolve(canonical);
+        const typeField = def
+          ? (def as Record<string, unknown>)[field]
+          : undefined;
+        const resolved = resolveTypeFieldToSchema(typeField, allManifests ?? []);
+        if (resolved && typeof resolved === "object") {
+          return resolved;
         }
       }
     }

package/src/validate-provider-coherence.ts

@@ -0,0 +1,166 @@
+import type { ResourceManifest } from "@telorun/sdk";
+import type { AliasResolver } from "./alias-resolver.js";
+import type { DefinitionRegistry } from "./definition-registry.js";
+import { DiagnosticSeverity, type AnalysisDiagnostic } from "./types.js";
+
+const SOURCE = "telo-analyzer";
+
+/**
+ * Validates coherence rules for `Telo.Definition` documents that use the `provide:`
+ * template target, plus the implementation-presence rule on `Telo.Provider`
+ * definitions.
+ *
+ * Diagnostics:
+ *  - PROVIDE_ON_NON_PROVIDER: `provide:` declared on a definition whose
+ *    `capability` is not `Telo.Provider`.
+ *  - PROVIDE_DISPATCHER_CONFLICT: `provide:` co-exists with `invoke:` or `run:`
+ *    on the same definition.
+ *  - PROVIDE_TARGET_UNKNOWN: `provide.name` does not resolve to an entry in
+ *    `resources:`.
+ *  - PROVIDE_TARGET_NOT_INVOCABLE: `provide.name` resolves to a resource whose
+ *    kind is registered but not a `Telo.Invocable`.
+ *  - PROVIDER_MISSING_IMPLEMENTATION: definition with `capability: Telo.Provider`
+ *    declares neither `controllers:` (TS-backed) nor `provide:` (template-backed).
+ */
+export function validateProviderCoherence(
+  manifests: ResourceManifest[],
+  registry: DefinitionRegistry,
+  aliases: AliasResolver,
+): AnalysisDiagnostic[] {
+  const diagnostics: AnalysisDiagnostic[] = [];
+
+  const importedModules = new Set<string>();
+  for (const m of manifests) {
+    if (m.kind !== "Telo.Import") continue;
+    const resolved = (m.metadata as { resolvedModuleName?: string } | undefined)
+      ?.resolvedModuleName;
+    if (resolved) importedModules.add(resolved);
+  }
+
+  for (const m of manifests) {
+    if (m.kind !== "Telo.Definition") continue;
+    const name = m.metadata?.name as string | undefined;
+    if (!name) continue;
+    const ownModule = (m.metadata as { module?: string } | undefined)?.module;
+    if (ownModule && importedModules.has(ownModule)) continue;
+    const filePath = (m.metadata as { source?: string } | undefined)?.source;
+    const resource = { kind: m.kind, name };
+    const label = `${m.kind}/${name}`;
+
+    const md = m as Record<string, unknown>;
+    const capability = typeof md.capability === "string" ? md.capability : undefined;
+    const provide = md.provide;
+    const invoke = md.invoke;
+    const run = md.run;
+    const controllers = md.controllers;
+    const resources = md.resources;
+
+    const hasProvide = provide !== undefined && provide !== null;
+    const hasInvoke = invoke !== undefined && invoke !== null;
+    const hasRun = run !== undefined && run !== null;
+    const hasControllers = Array.isArray(controllers) && controllers.length > 0;
+
+    if (hasProvide && capability !== "Telo.Provider") {
+      diagnostics.push({
+        severity: DiagnosticSeverity.Error,
+        code: "PROVIDE_ON_NON_PROVIDER",
+        source: SOURCE,
+        message:
+          `${label}: 'provide:' is only valid on definitions with 'capability: Telo.Provider' ` +
+          `(found '${capability ?? "<unset>"}'). Use 'invoke:' or 'run:' for other capabilities.`,
+        data: { resource, filePath, path: "provide" },
+      });
+    }
+
+    if (hasProvide && (hasInvoke || hasRun)) {
+      const conflict = hasInvoke ? "invoke" : "run";
+      diagnostics.push({
+        severity: DiagnosticSeverity.Error,
+        code: "PROVIDE_DISPATCHER_CONFLICT",
+        source: SOURCE,
+        message:
+          `${label}: 'provide:' cannot co-exist with '${conflict}:'. ` +
+          `A definition declares exactly one dispatch entry-point.`,
+        data: { resource, filePath, path: "provide" },
+      });
+    }
+
+    if (hasProvide && typeof provide === "object" && !Array.isArray(provide)) {
+      const provideObj = provide as { kind?: unknown; name?: unknown };
+      const providedName = typeof provideObj.name === "string" ? provideObj.name : undefined;
+      const providedKind = typeof provideObj.kind === "string" ? provideObj.kind : undefined;
+      if (providedName && Array.isArray(resources)) {
+        const match = resources.find((r) => {
+          const meta = (r as { metadata?: { name?: unknown } })?.metadata;
+          return typeof meta?.name === "string" && meta.name === providedName;
+        }) as { kind?: unknown } | undefined;
+        if (!match) {
+          diagnostics.push({
+            severity: DiagnosticSeverity.Error,
+            code: "PROVIDE_TARGET_UNKNOWN",
+            source: SOURCE,
+            message:
+              `${label}: 'provide.name: ${providedName}' does not match any entry's ` +
+              `metadata.name in 'resources:'.`,
+            data: { resource, filePath, path: "provide.name" },
+          });
+        } else if (typeof match.kind === "string") {
+          // `provide.kind` is the type contract the analyzer uses to type
+          // `result` CEL against the target's `outputType`. The runtime
+          // dispatches on `provide.name` and ignores `provide.kind`, so a
+          // mismatch silently degrades `result` typing to an open schema
+          // (and at runtime quietly invokes the actually-matched resource).
+          // Flag the divergence so result-typing never lies.
+          if (providedKind) {
+            const providedCanonical = aliases.resolveKind(providedKind) ?? providedKind;
+            const matchCanonical = aliases.resolveKind(match.kind) ?? match.kind;
+            if (providedCanonical !== matchCanonical) {
+              diagnostics.push({
+                severity: DiagnosticSeverity.Error,
+                code: "PROVIDE_KIND_MISMATCH",
+                source: SOURCE,
+                message:
+                  `${label}: 'provide.kind: ${providedKind}' disagrees with the matched ` +
+                  `'resources:' entry's kind '${match.kind}' (matched by metadata.name ` +
+                  `'${providedName}'). The runtime dispatches by name, so 'provide.kind' ` +
+                  `is decorative — but the analyzer types 'result:' against it, and a ` +
+                  `mismatch silently turns off that typing.`,
+                data: { resource, filePath, path: "provide.kind" },
+              });
+            }
+          }
+          const resolvedKind = aliases.resolveKind(match.kind) ?? match.kind;
+          const targetDef = registry.resolve(resolvedKind) ?? registry.resolve(match.kind);
+          if (targetDef && targetDef.kind === "Telo.Definition") {
+            const targetCap = (targetDef as { capability?: unknown }).capability;
+            if (typeof targetCap === "string" && targetCap !== "Telo.Invocable") {
+              diagnostics.push({
+                severity: DiagnosticSeverity.Error,
+                code: "PROVIDE_TARGET_NOT_INVOCABLE",
+                source: SOURCE,
+                message:
+                  `${label}: 'provide.name: ${providedName}' resolves to a ${match.kind} ` +
+                  `(capability '${targetCap}'); 'provide:' requires a Telo.Invocable target.`,
+                data: { resource, filePath, path: "provide.name" },
+              });
+            }
+          }
+        }
+      }
+    }
+
+    if (capability === "Telo.Provider" && !hasControllers && !hasProvide) {
+      diagnostics.push({
+        severity: DiagnosticSeverity.Error,
+        code: "PROVIDER_MISSING_IMPLEMENTATION",
+        source: SOURCE,
+        message:
+          `${label}: 'capability: Telo.Provider' requires either 'controllers:' ` +
+          `(TS-backed) or 'provide:' (template-backed) to declare an implementation.`,
+        data: { resource, filePath, path: "capability" },
+      });
+    }
+  }
+
+  return diagnostics;
+}