@telorun/analyzer 0.27.0 → 0.28.1

package/README.md

@@ -44,146 +44,7 @@ $ telo ./examples/hello-api
 
 ## Example manifest
 
-Here is an example Telo application that defines a simple HTTP API:
-
-```yaml
-kind: Telo.Application
-metadata:
-  name: feedback
-  version: 1.0.0
-  description: |
-    A complete feedback collection REST API — no code, pure YAML.
-    Persists entries to SQLite and serves them over HTTP.
-imports:
-  Http: std/http-server@0.12.0
-  Sql: std/sql@0.9.2
-targets:
-  - !ref Migrations
-  - !ref Server
----
-# SQLite database — swap driver/host/database for PostgreSQL with zero YAML changes
-kind: Sql.Connection
-metadata:
-  name: Db
-driver: sqlite
-file: ./tmp/feedback.db
----
-# Migrations: applied automatically before the server starts
-kind: Sql.Migrations
-metadata:
-  name: Migrations
-connection: !ref Db
----
-kind: Sql.Migration
-metadata:
-  name: Migration_20260413_182154_CreateFeedback
-version: 20260413_182154_CreateFeedback
-sql: |
-  CREATE TABLE IF NOT EXISTS feedback (
-    id        INTEGER PRIMARY KEY AUTOINCREMENT,
-    text      TEXT    NOT NULL,
-    source    TEXT,
-    score     INTEGER NOT NULL DEFAULT 0,
-    created_at DATETIME DEFAULT CURRENT_TIMESTAMP
-  )
----
-kind: Http.Server
-metadata:
-  name: Server
-baseUrl: http://localhost:8844
-port: 8844
-logger: true
-openapi:
-  info:
-    title: Feedback API
-    version: 1.0.0
-mounts:
-  - path: /v1
-    mount: !ref FeedbackRoutes
----
-kind: Http.Api
-metadata:
-  name: FeedbackRoutes
-routes:
-  # POST /v1/feedback — insert a new entry, score derived from body length heuristic
-  - request:
-      path: /feedback
-      method: POST
-      schema:
-        body:
-          type: object
-          properties:
-            text:
-              type: string
-              minLength: 1
-            source:
-              type: string
-          required: [ text ]
-    handler:
-      kind: Sql.Exec
-      connection: !ref Db
-    inputs:
-      sql: "INSERT INTO feedback (text, source, score) VALUES (?, ?, ?)"
-      bindings:
-        - "${{ request.body.text }}"
-        - "${{ request.body.source }}"
-        - "${{ size(request.body.text) }}"
-    response:
-      - status: 201
-        headers:
-          Content-Type: application/json
-        body:
-          ok: true
-          message: Feedback received
-
-  # GET /v1/feedback — list all entries, newest first
-  - request:
-      path: /feedback
-      method: GET
-    handler:
-      kind: Sql.Select
-      connection: !ref Db
-      from: feedback
-      columns: [ id, text, source, score, created_at ]
-      orderBy:
-        - { column: created_at, direction: desc }
-    response:
-      - status: 200
-        headers:
-          Content-Type: application/json
-        body: "${{ result.rows }}"
-
-  # GET /v1/feedback/{id} — fetch a single entry
-  - request:
-      path: /feedback/{id}
-      method: GET
-      schema:
-        params:
-          type: object
-          properties:
-            id:
-              type: integer
-          required: [ id ]
-    handler:
-      kind: Sql.Select
-      connection: !ref Db
-      from: feedback
-      columns: [ id, text, source, score, created_at ]
-      where:
-        - { column: id, op: "=", value: "${{ request.params.id }}" }
-    response:
-      - status: 200
-        when: "size(result.rows) > 0"
-        headers:
-          Content-Type: application/json
-        body: "${{ result.rows[0] }}"
-      - status: 404
-        headers:
-          Content-Type: application/json
-        body:
-          ok: false
-          message: Not found
-```
+See [examples/](./examples/) for a list of working applications.
 
 ## Status
 

package/dist/index.d.ts

@@ -12,11 +12,14 @@ export { parseLoadedFile } from "./parse-loaded-file.js";
 export type { ParseOptions } from "./parse-loaded-file.js";
 export { desugarLoadedFile, inlineImportManifests } from "./inline-imports.js";
 export type { SyntheticImport } from "./inline-imports.js";
+export { reconcileModuleVersions } from "./reconcile-module-versions.js";
+export type { VersionReconciliation } from "./reconcile-module-versions.js";
 export { residualEntrySchema, residualEntrySchemaMap } from "./residual-schema.js";
 export { buildDocumentPositions, buildLineOffsets, buildPositionIndex, documentLineOffsets, } from "./position-metadata.js";
 export type { DocumentPosition } from "./position-metadata.js";
 export { HttpSource } from "./sources/http-source.js";
 export { RegistrySource } from "./sources/registry-source.js";
+export { defaultSources } from "./sources/default-sources.js";
 export { withSyntheticPositions } from "./with-synthetic-positions.js";
 export { DEFAULT_MANIFEST_FILENAME, DiagnosticSeverity } from "./types.js";
 export type { AnalysisDiagnostic, AnalysisOptions, LoaderInitOptions, LoadOptions, ManifestSource, Position, PositionIndex, Range } from "./types.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -6,9 +6,11 @@ export { Loader } from "./manifest-loader.js";
 export { isModuleKind, MODULE_KINDS } from "./module-kinds.js";
 export { parseLoadedFile } from "./parse-loaded-file.js";
 export { desugarLoadedFile, inlineImportManifests } from "./inline-imports.js";
+export { reconcileModuleVersions } from "./reconcile-module-versions.js";
 export { residualEntrySchema, residualEntrySchemaMap } from "./residual-schema.js";
 export { buildDocumentPositions, buildLineOffsets, buildPositionIndex, documentLineOffsets, } from "./position-metadata.js";
 export { HttpSource } from "./sources/http-source.js";
 export { RegistrySource } from "./sources/registry-source.js";
+export { defaultSources } from "./sources/default-sources.js";
 export { withSyntheticPositions } from "./with-synthetic-positions.js";
 export { DEFAULT_MANIFEST_FILENAME, DiagnosticSeverity } from "./types.js";

package/dist/loaded-types.d.ts

@@ -1,7 +1,7 @@
 import type { ResourceManifest } from "@telorun/sdk";
 import type { Document } from "yaml";
 import type { DocumentPosition } from "./position-metadata.js";
-import type { Range } from "./types.js";
+import type { AnalysisDiagnostic, Range } from "./types.js";
 /** One physical file's parsed result. Returned for the owner manifest, for
  *  each `include:` partial, and for each external import target.
  *
@@ -65,8 +65,21 @@ export interface LoadedGraph {
      *  its partials. */
     modules: Map<string, LoadedModule>;
     /** Per-Telo.Import resolution. Keyed by the resolved URL of the file the
-     *  Telo.Import was declared in, then by the import's PascalCase alias. */
+     *  Telo.Import was declared in, then by the import's PascalCase alias.
+     *  Version reconciliation repoints losing edges at their winner here, so a
+     *  consumer walking these edges (`flattenForAnalyzer`) sees one version per
+     *  module identity. */
     importEdges: Map<string, Map<string, ImportEdge>>;
+    /** Version-reconciliation redirects: a losing module's canonical source URL →
+     *  the winning version's canonical source URL. The runtime consults this when
+     *  it independently re-resolves an import (the analyzer already sees repointed
+     *  `importEdges`). Empty when no module identity appeared at two sources. */
+    overrides: Map<string, string>;
+    /** Diagnostics produced while reconciling module versions — one per import
+     *  edge redirected to a different version (warning for a same-major hoist,
+     *  error for a major mismatch). Surfaced alongside `analyze()` diagnostics by
+     *  every consumer (CLI, editor, VS Code). */
+    versionDiagnostics: AnalysisDiagnostic[];
     /** Surface-level errors that did not abort the graph load (e.g. an import
      *  whose target failed to fetch). */
     errors: GraphLoadError[];

package/dist/loaded-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loaded-types.d.ts","sourceRoot":"","sources":["../src/loaded-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAExC;;;;4EAI4E;AAC5E,MAAM,WAAW,UAAU;IACzB;+DAC2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf;gEAC4D;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,6EAA6E;IAC7E,SAAS,EAAE,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC1C,0EAA0E;IAC1E,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,0EAA0E;IAC1E,WAAW,EAAE,UAAU,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED;mCACmC;AACnC,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,UAAU,CAAC;IAClB;oEACgE;IAChE,QAAQ,EAAE,UAAU,EAAE,CAAC;CACxB;AAED;;;;;2EAK2E;AAC3E,MAAM,WAAW,UAAU;IACzB,mEAAmE;IACnE,YAAY,EAAE,MAAM,CAAC;IACrB;6EACyE;IACzE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,oEAAoE;IACpE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;0BAC0B;AAC1B,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,YAAY,CAAC;IACpB;;wBAEoB;IACpB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACnC;8EAC0E;IAC1E,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IAClD;yCACqC;IACrC,MAAM,EAAE,cAAc,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,2EAA2E;IAC3E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,KAAK,CAAC;CACd"}
+{"version":3,"file":"loaded-types.d.ts","sourceRoot":"","sources":["../src/loaded-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAE5D;;;;4EAI4E;AAC5E,MAAM,WAAW,UAAU;IACzB;+DAC2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf;gEAC4D;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,6EAA6E;IAC7E,SAAS,EAAE,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC1C,0EAA0E;IAC1E,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,0EAA0E;IAC1E,WAAW,EAAE,UAAU,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED;mCACmC;AACnC,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,UAAU,CAAC;IAClB;oEACgE;IAChE,QAAQ,EAAE,UAAU,EAAE,CAAC;CACxB;AAED;;;;;2EAK2E;AAC3E,MAAM,WAAW,UAAU;IACzB,mEAAmE;IACnE,YAAY,EAAE,MAAM,CAAC;IACrB;6EACyE;IACzE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,oEAAoE;IACpE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;0BAC0B;AAC1B,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,YAAY,CAAC;IACpB;;wBAEoB;IACpB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACnC;;;;2BAIuB;IACvB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IAClD;;;iFAG6E;IAC7E,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;;;iDAG6C;IAC7C,kBAAkB,EAAE,kBAAkB,EAAE,CAAC;IACzC;yCACqC;IACrC,MAAM,EAAE,cAAc,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,2EAA2E;IAC3E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,KAAK,CAAC;CACd"}

package/dist/manifest-loader.d.ts

@@ -15,7 +15,12 @@ export declare class Loader {
     private readonly urlToSource;
     protected sources: ManifestSource[];
     private readonly celEnv;
-    constructor(extraSourcesOrOptions?: ManifestSource[] | LoaderInitOptions);
+    /** Sources are resolved in order — the first whose `supports(url)` matches
+     *  wins. The caller (composition root) decides which concrete sources exist
+     *  and supplies them; `defaultSources()` bundles the browser-safe built-ins
+     *  (HTTP + registry) for the common case. `register()` prepends a source at
+     *  runtime. */
+    constructor(sources?: ManifestSource[], options?: LoaderInitOptions);
     register(source: ManifestSource): this;
     private pick;
     resolveEntryPoint(url: string): Promise<string>;

package/dist/manifest-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest-loader.d.ts","sourceRoot":"","sources":["../src/manifest-loader.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAGV,UAAU,EACV,WAAW,EACX,YAAY,EACb,MAAM,mBAAmB,CAAC;AAI3B,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACpB,MAAM,YAAY,CAAC;AAiBpB,qBAAa,MAAM;IACjB;;;yEAGqE;IACrE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiC;IAE3D;;;;;8BAK0B;IAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IAEzD,SAAS,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,qBAAqB,GAAE,cAAc,EAAE,GAAG,iBAAsB;IAmB5E,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;IAKtC,OAAO,CAAC,IAAI;IAMN,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUrD;;;;2CAIuC;IACvC,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAM7C;;;+BAG2B;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAyCvE;;;;gEAI4D;IAC5D,OAAO,CAAC,oBAAoB;IAa5B;gFAC4E;IAC5E,OAAO,CAAC,cAAc;IAQtB;;wEAEoE;IAC9D,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;IAsB3E;;;qCAGiC;IAC3B,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAwG9E;;;;;;;;sBAQkB;IAClB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAOlE,OAAO,CAAC,6BAA6B;IAarC,OAAO,CAAC,mCAAmC;IAc3C,OAAO,CAAC,2BAA2B;YAkCrB,eAAe;IAmB7B;;;0CAGsC;IAChC,gBAAgB,CACpB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC;QAAE,KAAK,EAAE,WAAW,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CA0B5D"}
+{"version":3,"file":"manifest-loader.d.ts","sourceRoot":"","sources":["../src/manifest-loader.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAGV,UAAU,EACV,WAAW,EACX,YAAY,EACb,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACpB,MAAM,YAAY,CAAC;AAiBpB,qBAAa,MAAM;IACjB;;;yEAGqE;IACrE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiC;IAE3D;;;;;8BAK0B;IAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IAEzD,SAAS,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IAErC;;;;mBAIe;gBACH,OAAO,GAAE,cAAc,EAAO,EAAE,OAAO,GAAE,iBAAsB;IAK3E,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;IAKtC,OAAO,CAAC,IAAI;IAMN,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUrD;;;;2CAIuC;IACvC,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAM7C;;;+BAG2B;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAyCvE;;;;gEAI4D;IAC5D,OAAO,CAAC,oBAAoB;IAa5B;gFAC4E;IAC5E,OAAO,CAAC,cAAc;IAQtB;;wEAEoE;IAC9D,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;IAsB3E;;;qCAGiC;IAC3B,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAqH9E;;;;;;;;sBAQkB;IAClB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAOlE,OAAO,CAAC,6BAA6B;IAarC,OAAO,CAAC,mCAAmC;IAc3C,OAAO,CAAC,2BAA2B;YAkCrB,eAAe;IAmB7B;;;0CAGsC;IAChC,gBAAgB,CACpB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC;QAAE,KAAK,EAAE,WAAW,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CA0B5D"}

package/dist/manifest-loader.js

@@ -1,9 +1,8 @@
-import { HttpSource } from "./sources/http-source.js";
-import { RegistrySource } from "./sources/registry-source.js";
 import { buildCelEnvironment } from "./cel-environment.js";
 import { desugarLoadedFile } from "./inline-imports.js";
 import { isModuleKind } from "./module-kinds.js";
 import { parseLoadedFile } from "./parse-loaded-file.js";
+import { reconcileModuleVersions } from "./reconcile-module-versions.js";
 import { DEFAULT_MANIFEST_FILENAME, } from "./types.js";
 const SYSTEM_KINDS = new Set([
     "Telo.Application",
@@ -33,20 +32,13 @@ export class Loader {
     urlToSource = new Map();
     sources;
     celEnv;
-    constructor(extraSourcesOrOptions = []) {
-        const options = Array.isArray(extraSourcesOrOptions)
-            ? { extraSources: extraSourcesOrOptions }
-            : extraSourcesOrOptions;
-        const includeHttpSource = options.includeHttpSource ?? true;
-        const includeRegistrySource = options.includeRegistrySource ?? true;
-        this.sources = [];
-        if (includeHttpSource)
-            this.sources.push(new HttpSource());
-        if (includeRegistrySource)
-            this.sources.push(new RegistrySource(options.registryUrl));
-        if (options.extraSources?.length) {
-            this.sources.unshift(...options.extraSources);
-        }
+    /** Sources are resolved in order — the first whose `supports(url)` matches
+     *  wins. The caller (composition root) decides which concrete sources exist
+     *  and supplies them; `defaultSources()` bundles the browser-safe built-ins
+     *  (HTTP + registry) for the common case. `register()` prepends a source at
+     *  runtime. */
+    constructor(sources = [], options = {}) {
+        this.sources = [...sources];
         this.celEnv = buildCelEnvironment(options.celHandlers);
     }
     register(source) {
@@ -265,7 +257,19 @@ export class Loader {
                     importEdges.set(file.source, aliases);
             }
         }
-        return { rootSource, entry, modules, importEdges, errors };
+        // Collapse multiple versions of the same module identity onto one version
+        // before any consumer walks the edges: repoints losing `importEdges` in
+        // place and yields the runtime override map + hoist/conflict diagnostics.
+        const { overrides, diagnostics } = reconcileModuleVersions(modules, importEdges);
+        return {
+            rootSource,
+            entry,
+            modules,
+            importEdges,
+            overrides,
+            versionDiagnostics: diagnostics,
+            errors,
+        };
     }
     /** Resolve an `import` URL against the file it appears in. Relative /
      *  absolute-path forms run through the owning `ManifestSource`'s

package/dist/reconcile-module-versions.d.ts

@@ -0,0 +1,25 @@
+import type { ImportEdge, LoadedModule } from "./loaded-types.js";
+import { type AnalysisDiagnostic } from "./types.js";
+/** Outcome of reconciling a module name that appears at more than one resolved
+ *  source in a single import graph. The `overrides` map redirects each losing
+ *  canonical URL to the winner's canonical URL — consulted by the runtime when
+ *  it independently re-resolves an import (the analyzer side is handled by
+ *  repointing `importEdges` in place). */
+export interface VersionReconciliation {
+    /** Loser canonical source URL → winner canonical source URL. */
+    overrides: Map<string, string>;
+    /** One diagnostic per import edge that pointed at a non-winner: a warning for
+     *  a same-major hoist, an error for an incompatible major mismatch. */
+    diagnostics: AnalysisDiagnostic[];
+}
+/**
+ * Reconcile a loaded import graph so each module identity (`namespace/name`)
+ * resolves to a single version. Within a shared major the highest version wins
+ * (a non-lossy hoist, given Telo's additive-only pre-1.0 policy); a major
+ * mismatch is a hard conflict. Mutates `importEdges` in place — every edge that
+ * pointed at a losing source is repointed at the winner — so `flattenForAnalyzer`
+ * walks a deduplicated graph and the runtime collision (two definitions of the
+ * same kind) cannot occur. Pure and browser-safe: no I/O, no Node built-ins.
+ */
+export declare function reconcileModuleVersions(modules: Map<string, LoadedModule>, importEdges: Map<string, Map<string, ImportEdge>>): VersionReconciliation;
+//# sourceMappingURL=reconcile-module-versions.d.ts.map

package/dist/reconcile-module-versions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile-module-versions.d.ts","sourceRoot":"","sources":["../src/reconcile-module-versions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAElE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;0CAI0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,gEAAgE;IAChE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;2EACuE;IACvE,WAAW,EAAE,kBAAkB,EAAE,CAAC;CACnC;AA8KD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,EAClC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,GAChD,qBAAqB,CAiDvB"}

package/dist/reconcile-module-versions.js

@@ -0,0 +1,215 @@
+import { isModuleKind } from "./module-kinds.js";
+import { DiagnosticSeverity } from "./types.js";
+const SOURCE = "telo-analyzer";
+/** Parse `X.Y.Z`, `vX.Y.Z`, or `X.Y.Z-pre.1`. Returns `null` for anything that
+ *  isn't a plain three-part numeric core — an unparseable version forces the
+ *  group onto the conflict path (we never silently hoist across a version we
+ *  can't reason about). Pure: no dependency on the `semver` package, so the
+ *  analyzer stays browser-safe and dependency-free. */
+function parseVersion(raw) {
+    if (typeof raw !== "string")
+        return null;
+    const v = raw.startsWith("v") ? raw.slice(1) : raw;
+    const [core, ...preParts] = v.split("-");
+    const pre = preParts.length > 0 ? preParts.join("-") : null;
+    const segments = core.split(".");
+    if (segments.length !== 3)
+        return null;
+    const [major, minor, patch] = segments.map((s) => {
+        if (!/^\d+$/.test(s))
+            return NaN;
+        return Number(s);
+    });
+    if ([major, minor, patch].some((n) => Number.isNaN(n)))
+        return null;
+    return { major, minor, patch, pre: pre === null ? null : pre.split(".") };
+}
+/** SemVer precedence: numeric core, then a release outranks a prerelease, then
+ *  prerelease identifiers compared field-by-field (numeric < non-numeric per
+ *  spec, shorter set loses when all shared fields are equal). */
+function compareVersions(a, b) {
+    if (a.major !== b.major)
+        return a.major - b.major;
+    if (a.minor !== b.minor)
+        return a.minor - b.minor;
+    if (a.patch !== b.patch)
+        return a.patch - b.patch;
+    if (a.pre === null && b.pre === null)
+        return 0;
+    if (a.pre === null)
+        return 1;
+    if (b.pre === null)
+        return -1;
+    const len = Math.max(a.pre.length, b.pre.length);
+    for (let i = 0; i < len; i++) {
+        const ai = a.pre[i];
+        const bi = b.pre[i];
+        if (ai === undefined)
+            return -1;
+        if (bi === undefined)
+            return 1;
+        const an = /^\d+$/.test(ai);
+        const bn = /^\d+$/.test(bi);
+        if (an && bn) {
+            const d = Number(ai) - Number(bi);
+            if (d !== 0)
+                return d;
+        }
+        else if (an !== bn) {
+            return an ? -1 : 1;
+        }
+        else if (ai !== bi) {
+            return ai < bi ? -1 : 1;
+        }
+    }
+    return 0;
+}
+/** Read a loaded module's `namespace/name` identity, version, and raw owner
+ *  text. Returns `null` for modules without a namespace: only a registry
+ *  identity (`<namespace>/<name>`) is a stable cross-import key. Two namespace-
+ *  less local libraries that merely share a `metadata.name` are distinct modules
+ *  reached via distinct source URLs — reconciling them would drop one and break
+ *  its kinds; the same local file reached via two paths is already collapsed by
+ *  canonical-source dedup, so there is nothing left to reconcile here. */
+function moduleIdentityOf(mod) {
+    const doc = mod.owner.manifests.find((m) => m && isModuleKind(m.kind));
+    if (!doc)
+        return null;
+    const meta = doc.metadata;
+    const name = meta?.name;
+    if (typeof name !== "string" || name.length === 0)
+        return null;
+    if (typeof meta.namespace !== "string" || meta.namespace.length === 0)
+        return null;
+    const version = typeof meta.version === "string" ? meta.version : "";
+    return {
+        source: mod.owner.source,
+        identity: `${meta.namespace}/${name}`,
+        version,
+        parsed: parseVersion(version),
+        text: mod.owner.text,
+    };
+}
+/** Pick the winning member of a same-identity group and classify it. The winner
+ *  is the highest version (deterministic tiebreak on source URL for equal
+ *  versions / same-version-different-source). A major disagreement — or any
+ *  unparseable version — marks the group a conflict; we still pick a winner so
+ *  the rest of analysis proceeds against a single version instead of cascading
+ *  duplicate-kind errors. */
+function resolveGroup(members) {
+    const majors = new Set();
+    for (const m of members)
+        majors.add(m.parsed ? m.parsed.major : null);
+    const conflict = majors.has(null) || majors.size > 1;
+    const winner = members.reduce((best, cur) => {
+        if (!cur.parsed)
+            return best;
+        if (!best.parsed)
+            return cur;
+        const cmp = compareVersions(cur.parsed, best.parsed);
+        if (cmp > 0)
+            return cur;
+        if (cmp === 0 && cur.source < best.source)
+            return cur;
+        return best;
+    }, members[0]);
+    return { winner, conflict };
+}
+/** The diagnostic for a redirected edge, or `null` when the redirect is a
+ *  silent dedupe (the same version resolved from two sources with identical
+ *  content — no decision was made, so nothing to report). */
+function hoistDiagnostic(identity, importerSource, alias, loser, winner, conflict) {
+    const data = { filePath: importerSource, path: `imports.${alias}` };
+    if (conflict) {
+        return {
+            severity: DiagnosticSeverity.Error,
+            code: "MODULE_VERSION_CONFLICT",
+            source: SOURCE,
+            message: `Module '${identity}' is imported at incompatible major versions: ` +
+                `${loser.version || "<unknown>"} here and ${winner.version} elsewhere in the same graph. ` +
+                `Major versions can carry breaking changes and cannot be reconciled automatically — ` +
+                `align every importer on one major.`,
+            data,
+        };
+    }
+    if (loser.version === winner.version) {
+        // Same version, two sources. Identical content is a no-op dedupe; differing
+        // content means one is masquerading as the other (e.g. a local checkout vs
+        // the published version) — worth surfacing.
+        if (loser.text === winner.text)
+            return null;
+        return {
+            severity: DiagnosticSeverity.Warning,
+            code: "MODULE_VERSION_HOISTED",
+            source: SOURCE,
+            message: `Module '${identity}@${winner.version}' is imported from two sources whose contents ` +
+                `differ ('${loser.source}' and '${winner.source}'). Using '${winner.source}' for every ` +
+                `importer — pin a single source to remove the ambiguity.`,
+            data,
+        };
+    }
+    return {
+        severity: DiagnosticSeverity.Warning,
+        code: "MODULE_VERSION_HOISTED",
+        source: SOURCE,
+        message: `Module '${identity}@${loser.version || "<unknown>"}' was hoisted to '${winner.version}' ` +
+            `because the same module is imported at the higher version elsewhere in the graph. ` +
+            `Pre-1.0 versions are additive, so the higher version is used for every importer.`,
+        data,
+    };
+}
+/**
+ * Reconcile a loaded import graph so each module identity (`namespace/name`)
+ * resolves to a single version. Within a shared major the highest version wins
+ * (a non-lossy hoist, given Telo's additive-only pre-1.0 policy); a major
+ * mismatch is a hard conflict. Mutates `importEdges` in place — every edge that
+ * pointed at a losing source is repointed at the winner — so `flattenForAnalyzer`
+ * walks a deduplicated graph and the runtime collision (two definitions of the
+ * same kind) cannot occur. Pure and browser-safe: no I/O, no Node built-ins.
+ */
+export function reconcileModuleVersions(modules, importEdges) {
+    const overrides = new Map();
+    const diagnostics = [];
+    const groups = new Map();
+    const infoBySource = new Map();
+    for (const mod of modules.values()) {
+        const info = moduleIdentityOf(mod);
+        if (!info)
+            continue;
+        infoBySource.set(info.source, info);
+        const list = groups.get(info.identity);
+        if (list)
+            list.push(info);
+        else
+            groups.set(info.identity, [info]);
+    }
+    const conflictByIdentity = new Map();
+    for (const [identity, members] of groups) {
+        if (members.length < 2)
+            continue;
+        const { winner, conflict } = resolveGroup(members);
+        conflictByIdentity.set(identity, conflict);
+        for (const member of members) {
+            if (member.source !== winner.source)
+                overrides.set(member.source, winner.source);
+        }
+    }
+    if (overrides.size === 0)
+        return { overrides, diagnostics };
+    for (const [importerSource, aliasMap] of importEdges) {
+        for (const [alias, edge] of aliasMap) {
+            const winnerSource = overrides.get(edge.targetSource);
+            if (!winnerSource)
+                continue;
+            const loser = infoBySource.get(edge.targetSource);
+            const winner = infoBySource.get(winnerSource);
+            if (loser && winner) {
+                const diag = hoistDiagnostic(loser.identity, importerSource, alias, loser, winner, conflictByIdentity.get(loser.identity) ?? false);
+                if (diag)
+                    diagnostics.push(diag);
+            }
+            edge.targetSource = winnerSource;
+        }
+    }
+    return { overrides, diagnostics };
+}

package/dist/sources/default-sources.d.ts

@@ -0,0 +1,8 @@
+import type { ManifestSource } from "../types.js";
+/** The browser-safe built-in sources, in resolution order: HTTP fetch then
+ *  registry. Node-specific sources (local filesystem) are supplied by the
+ *  consuming package and passed alongside these into the `Loader` constructor.
+ *  Callers that only want a subset (e.g. the editor, which brings its own
+ *  registry adapters) construct the individual sources directly. */
+export declare function defaultSources(registryUrl?: string): ManifestSource[];
+//# sourceMappingURL=default-sources.d.ts.map

package/dist/sources/default-sources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-sources.d.ts","sourceRoot":"","sources":["../../src/sources/default-sources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAIlD;;;;oEAIoE;AACpE,wBAAgB,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,cAAc,EAAE,CAErE"}

package/dist/sources/default-sources.js

@@ -0,0 +1,10 @@
+import { HttpSource } from "./http-source.js";
+import { RegistrySource } from "./registry-source.js";
+/** The browser-safe built-in sources, in resolution order: HTTP fetch then
+ *  registry. Node-specific sources (local filesystem) are supplied by the
+ *  consuming package and passed alongside these into the `Loader` constructor.
+ *  Callers that only want a subset (e.g. the editor, which brings its own
+ *  registry adapters) construct the individual sources directly. */
+export function defaultSources(registryUrl) {
+    return [new HttpSource(), new RegistrySource(registryUrl)];
+}

package/dist/types.d.ts

@@ -68,14 +68,6 @@ export interface LoadOptions {
     desugarImports?: boolean;
 }
 export interface LoaderInitOptions {
-    /** Sources inserted with highest priority before built-ins. */
-    extraSources?: ManifestSource[];
-    /** Include built-in HttpSource. Defaults to true. */
-    includeHttpSource?: boolean;
-    /** Include built-in RegistrySource. Defaults to true. */
-    includeRegistrySource?: boolean;
-    /** Base URL used by built-in RegistrySource when enabled. */
-    registryUrl?: string;
     /** Handlers for CEL stdlib functions (e.g. `sha256`). Analyzer-only callers may
      *  omit this and get throwing stubs; runtime callers (kernel) must supply real impls. */
     celHandlers?: import("./cel-environment.js").CelHandlers;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;qHACqH;AACrH,eAAO,MAAM,kBAAkB;;;;;CAKrB,CAAC;AACX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAC;AAE9F,gFAAgF;AAChF,eAAO,MAAM,yBAAyB,cAAc,CAAC;AAErD,MAAM,WAAW,QAAQ;IACvB,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,KAAK;IACpB,KAAK,EAAE,QAAQ,CAAC;IAChB,GAAG,EAAE,QAAQ,CAAC;CACf;AAED;;oDAEoD;AACpD,MAAM,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAE/C;6EAC6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,2BAA2B;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAExD;;qEAEiE;IACjE,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEjE;;qEAEiE;IACjE,cAAc,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,WAAW;IAC1B;;;+EAG2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;mEAO+D;IAC/D,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,YAAY,CAAC,EAAE,cAAc,EAAE,CAAC;IAChC,qDAAqD;IACrD,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,yDAAyD;IACzD,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,6DAA6D;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;6FACyF;IACzF,WAAW,CAAC,EAAE,OAAO,sBAAsB,EAAE,WAAW,CAAC;CAC1D;AAED,MAAM,WAAW,eAAe;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;;;;;sDAUkD;IAClD,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;gEAKgE;AAChE,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,OAAO,qBAAqB,EAAE,aAAa,CAAC;IACtD,WAAW,CAAC,EAAE,OAAO,0BAA0B,EAAE,kBAAkB,CAAC;IACpE;;;;+EAI2E;IAC3E,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,qBAAqB,EAAE,aAAa,CAAC,CAAC;CAC5E"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;qHACqH;AACrH,eAAO,MAAM,kBAAkB;;;;;CAKrB,CAAC;AACX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAC;AAE9F,gFAAgF;AAChF,eAAO,MAAM,yBAAyB,cAAc,CAAC;AAErD,MAAM,WAAW,QAAQ;IACvB,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,KAAK;IACpB,KAAK,EAAE,QAAQ,CAAC;IAChB,GAAG,EAAE,QAAQ,CAAC;CACf;AAED;;oDAEoD;AACpD,MAAM,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAE/C;6EAC6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,2BAA2B;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAExD;;qEAEiE;IACjE,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEjE;;qEAEiE;IACjE,cAAc,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,WAAW;IAC1B;;;+EAG2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;mEAO+D;IAC/D,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC;6FACyF;IACzF,WAAW,CAAC,EAAE,OAAO,sBAAsB,EAAE,WAAW,CAAC;CAC1D;AAED,MAAM,WAAW,eAAe;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;;;;;sDAUkD;IAClD,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;gEAKgE;AAChE,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,OAAO,qBAAqB,EAAE,aAAa,CAAC;IACtD,WAAW,CAAC,EAAE,OAAO,0BAA0B,EAAE,kBAAkB,CAAC;IACpE;;;;+EAI2E;IAC3E,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,qBAAqB,EAAE,aAAa,CAAC,CAAC;CAC5E"}

package/dist/validate-cel-context.d.ts

@@ -20,7 +20,7 @@ export interface ContextResolveOpts {
  * - Object with `kind` + `schema`: inline type definition → return the `schema`
  * - Object with `type` or `properties`: raw JSON Schema, return as-is
  */
-export declare function resolveTypeFieldToSchema(value: unknown, allManifests: Record<string, any>[]): Record<string, any> | undefined;
+export declare function resolveTypeFieldToSchema(value: unknown, allManifests: Record<string, any>[], ancestry?: ReadonlySet<string>): Record<string, any> | undefined;
 /**
  * Returns true when a CEL expression path (from walkCelExpressions, e.g. "routes[0].inputs.q")
  * falls within the scope of a context (e.g. "$.routes[*].inputs").

package/dist/validate-cel-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAEtF,MAAM,WAAW,kBAAkB;IACjC;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC;;kDAE8C;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;KACxD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAkCjC;AA6DD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAChD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAgHrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB;AAWD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,SAAM,GACT,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAC,CAGvD"}
+{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAGtF,MAAM,WAAW,kBAAkB;IACjC;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC;;kDAE8C;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;KACxD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CA0CjC;AAuFD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAChD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAgHrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB;AAWD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,SAAM,GACT,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAC,CAGvD"}

package/dist/validate-cel-context.js

@@ -1,27 +1,33 @@
 export { extractAccessChains, validateChainAgainstSchema } from "@telorun/templating";
+import { mergeTypeSchemas } from "@telorun/sdk";
 /**
  * Resolve a type field value (string name, inline type, or raw schema) to a JSON Schema.
  * - String: look up the named type in allManifests (Type.JsonSchema resources)
  * - Object with `kind` + `schema`: inline type definition → return the `schema`
  * - Object with `type` or `properties`: raw JSON Schema, return as-is
  */
-export function resolveTypeFieldToSchema(value, allManifests) {
+export function resolveTypeFieldToSchema(value, allManifests, ancestry = new Set()) {
     if (!value)
         return undefined;
     if (typeof value === "string") {
+        // Cycle guard: a type already on the resolution path can't extend back into it.
+        if (ancestry.has(value))
+            return undefined;
         // Named type reference — find a Telo.Type resource by name
         const typeManifest = allManifests.find((m) => m.metadata?.name === value &&
             typeof m.kind === "string" &&
             /\bType\b/.test(m.kind) &&
             typeof m.schema === "object" &&
             m.schema !== null);
-        return typeManifest?.schema;
+        if (!typeManifest)
+            return undefined;
+        return applyExtends(typeManifest.schema, typeManifest.extends, allManifests, new Set(ancestry).add(value));
     }
     if (typeof value === "object" && value !== null) {
         const obj = value;
         // Inline type resource: { kind: "Type.JsonSchema", schema: {...} }
         if (obj.schema && typeof obj.schema === "object") {
-            return obj.schema;
+            return applyExtends(obj.schema, obj.extends, allManifests, ancestry);
         }
         // Raw JSON Schema (has type or properties)
         if (obj.type || obj.properties) {
@@ -30,11 +36,34 @@ export function resolveTypeFieldToSchema(value, allManifests) {
         // Named type reference resolved from a `!ref` → { kind, name } — resolve the
         // named Telo.Type the same way as the bare-string form.
         if (typeof obj.name === "string") {
-            return resolveTypeFieldToSchema(obj.name, allManifests);
+            return resolveTypeFieldToSchema(obj.name, allManifests, ancestry);
         }
     }
     return undefined;
 }
+/**
+ * Fold a `Type.JsonSchema`'s `extends` parents into its own schema, matching the
+ * runtime `type` controller exactly — both call the shared `mergeTypeSchemas`, so
+ * static analysis and runtime validation can never disagree on a type's effective
+ * shape. Without this the analyzer would see only a child type's own properties
+ * and reject valid access to an inherited field with a false `CEL_UNKNOWN_FIELD`.
+ * `ancestry` carries the resolution path for cycle detection (siblings share it
+ * unmutated, so diamond inheritance still re-includes a shared grandparent).
+ */
+function applyExtends(ownSchema, extendsField, allManifests, ancestry) {
+    if (!extendsField)
+        return ownSchema;
+    const parents = Array.isArray(extendsField) ? extendsField : [extendsField];
+    const resolved = [];
+    for (const parent of parents) {
+        const parentSchema = resolveTypeFieldToSchema(parent, allManifests, ancestry);
+        if (parentSchema)
+            resolved.push(parentSchema);
+    }
+    if (resolved.length === 0)
+        return ownSchema;
+    return mergeTypeSchemas([...resolved, ownSchema]);
+}
 /** Pull the raw expression source from a CEL field value — a compiled value
  *  (`{ source }`), or a string (`!cel "x"` or `"${{ x }}"`). Strips a lone
  *  `${{ }}` wrapper. Returns null when no source is recoverable. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.27.0",
+  "version": "0.28.1",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",
@@ -48,7 +48,7 @@
     "@types/node": "^20.0.0",
     "typescript": "^5.0.0",
     "vitest": "^2.1.8",
-    "@telorun/sdk": "0.36.0"
+    "@telorun/sdk": "0.38.0"
   },
   "peerDependencies": {
     "@telorun/sdk": "*"

package/src/index.ts

@@ -39,6 +39,8 @@ export { parseLoadedFile } from "./parse-loaded-file.js";
 export type { ParseOptions } from "./parse-loaded-file.js";
 export { desugarLoadedFile, inlineImportManifests } from "./inline-imports.js";
 export type { SyntheticImport } from "./inline-imports.js";
+export { reconcileModuleVersions } from "./reconcile-module-versions.js";
+export type { VersionReconciliation } from "./reconcile-module-versions.js";
 export { residualEntrySchema, residualEntrySchemaMap } from "./residual-schema.js";
 export {
     buildDocumentPositions,
@@ -49,6 +51,7 @@ export {
 export type { DocumentPosition } from "./position-metadata.js";
 export { HttpSource } from "./sources/http-source.js";
 export { RegistrySource } from "./sources/registry-source.js";
+export { defaultSources } from "./sources/default-sources.js";
 export { withSyntheticPositions } from "./with-synthetic-positions.js";
 export { DEFAULT_MANIFEST_FILENAME, DiagnosticSeverity } from "./types.js";
 export type {

package/src/loaded-types.ts

@@ -1,7 +1,7 @@
 import type { ResourceManifest } from "@telorun/sdk";
 import type { Document } from "yaml";
 import type { DocumentPosition } from "./position-metadata.js";
-import type { Range } from "./types.js";
+import type { AnalysisDiagnostic, Range } from "./types.js";
 
 /** One physical file's parsed result. Returned for the owner manifest, for
  *  each `include:` partial, and for each external import target.
@@ -70,8 +70,21 @@ export interface LoadedGraph {
    *  its partials. */
   modules: Map<string, LoadedModule>;
   /** Per-Telo.Import resolution. Keyed by the resolved URL of the file the
-   *  Telo.Import was declared in, then by the import's PascalCase alias. */
+   *  Telo.Import was declared in, then by the import's PascalCase alias.
+   *  Version reconciliation repoints losing edges at their winner here, so a
+   *  consumer walking these edges (`flattenForAnalyzer`) sees one version per
+   *  module identity. */
   importEdges: Map<string, Map<string, ImportEdge>>;
+  /** Version-reconciliation redirects: a losing module's canonical source URL →
+   *  the winning version's canonical source URL. The runtime consults this when
+   *  it independently re-resolves an import (the analyzer already sees repointed
+   *  `importEdges`). Empty when no module identity appeared at two sources. */
+  overrides: Map<string, string>;
+  /** Diagnostics produced while reconciling module versions — one per import
+   *  edge redirected to a different version (warning for a same-major hoist,
+   *  error for a major mismatch). Surfaced alongside `analyze()` diagnostics by
+   *  every consumer (CLI, editor, VS Code). */
+  versionDiagnostics: AnalysisDiagnostic[];
   /** Surface-level errors that did not abort the graph load (e.g. an import
    *  whose target failed to fetch). */
   errors: GraphLoadError[];

package/src/manifest-loader.ts

@@ -1,7 +1,5 @@
 import type { Environment } from "@marcbachmann/cel-js";
 import type { ResourceManifest } from "@telorun/sdk";
-import { HttpSource } from "./sources/http-source.js";
-import { RegistrySource } from "./sources/registry-source.js";
 import { buildCelEnvironment } from "./cel-environment.js";
 import type {
   GraphLoadError,
@@ -13,6 +11,7 @@ import type {
 import { desugarLoadedFile } from "./inline-imports.js";
 import { isModuleKind } from "./module-kinds.js";
 import { parseLoadedFile } from "./parse-loaded-file.js";
+import { reconcileModuleVersions } from "./reconcile-module-versions.js";
 import {
   DEFAULT_MANIFEST_FILENAME,
   type LoadOptions,
@@ -53,22 +52,13 @@ export class Loader {
   protected sources: ManifestSource[];
   private readonly celEnv: Environment;
 
-  constructor(extraSourcesOrOptions: ManifestSource[] | LoaderInitOptions = []) {
-    const options: LoaderInitOptions = Array.isArray(extraSourcesOrOptions)
-      ? { extraSources: extraSourcesOrOptions }
-      : extraSourcesOrOptions;
-
-    const includeHttpSource = options.includeHttpSource ?? true;
-    const includeRegistrySource = options.includeRegistrySource ?? true;
-
-    this.sources = [];
-    if (includeHttpSource) this.sources.push(new HttpSource());
-    if (includeRegistrySource) this.sources.push(new RegistrySource(options.registryUrl));
-
-    if (options.extraSources?.length) {
-      this.sources.unshift(...options.extraSources);
-    }
-
+  /** Sources are resolved in order — the first whose `supports(url)` matches
+   *  wins. The caller (composition root) decides which concrete sources exist
+   *  and supplies them; `defaultSources()` bundles the browser-safe built-ins
+   *  (HTTP + registry) for the common case. `register()` prepends a source at
+   *  runtime. */
+  constructor(sources: ManifestSource[] = [], options: LoaderInitOptions = {}) {
+    this.sources = [...sources];
     this.celEnv = buildCelEnvironment(options.celHandlers);
   }
 
@@ -307,7 +297,20 @@ export class Loader {
       }
     }
 
-    return { rootSource, entry, modules, importEdges, errors };
+    // Collapse multiple versions of the same module identity onto one version
+    // before any consumer walks the edges: repoints losing `importEdges` in
+    // place and yields the runtime override map + hoist/conflict diagnostics.
+    const { overrides, diagnostics } = reconcileModuleVersions(modules, importEdges);
+
+    return {
+      rootSource,
+      entry,
+      modules,
+      importEdges,
+      overrides,
+      versionDiagnostics: diagnostics,
+      errors,
+    };
   }
 
   /** Resolve an `import` URL against the file it appears in. Relative /

package/src/reconcile-module-versions.ts

@@ -0,0 +1,253 @@
+import type { ImportEdge, LoadedModule } from "./loaded-types.js";
+import { isModuleKind } from "./module-kinds.js";
+import { DiagnosticSeverity, type AnalysisDiagnostic } from "./types.js";
+
+const SOURCE = "telo-analyzer";
+
+/** Outcome of reconciling a module name that appears at more than one resolved
+ *  source in a single import graph. The `overrides` map redirects each losing
+ *  canonical URL to the winner's canonical URL — consulted by the runtime when
+ *  it independently re-resolves an import (the analyzer side is handled by
+ *  repointing `importEdges` in place). */
+export interface VersionReconciliation {
+  /** Loser canonical source URL → winner canonical source URL. */
+  overrides: Map<string, string>;
+  /** One diagnostic per import edge that pointed at a non-winner: a warning for
+   *  a same-major hoist, an error for an incompatible major mismatch. */
+  diagnostics: AnalysisDiagnostic[];
+}
+
+interface ParsedVersion {
+  major: number;
+  minor: number;
+  patch: number;
+  /** Dot-separated prerelease identifiers, or `null` for a release version. */
+  pre: string[] | null;
+}
+
+interface ModuleIdentity {
+  source: string;
+  identity: string;
+  version: string;
+  parsed: ParsedVersion | null;
+  text: string;
+}
+
+/** Parse `X.Y.Z`, `vX.Y.Z`, or `X.Y.Z-pre.1`. Returns `null` for anything that
+ *  isn't a plain three-part numeric core — an unparseable version forces the
+ *  group onto the conflict path (we never silently hoist across a version we
+ *  can't reason about). Pure: no dependency on the `semver` package, so the
+ *  analyzer stays browser-safe and dependency-free. */
+function parseVersion(raw: string | undefined): ParsedVersion | null {
+  if (typeof raw !== "string") return null;
+  const v = raw.startsWith("v") ? raw.slice(1) : raw;
+  const [core, ...preParts] = v.split("-");
+  const pre = preParts.length > 0 ? preParts.join("-") : null;
+  const segments = core.split(".");
+  if (segments.length !== 3) return null;
+  const [major, minor, patch] = segments.map((s) => {
+    if (!/^\d+$/.test(s)) return NaN;
+    return Number(s);
+  });
+  if ([major, minor, patch].some((n) => Number.isNaN(n))) return null;
+  return { major, minor, patch, pre: pre === null ? null : pre.split(".") };
+}
+
+/** SemVer precedence: numeric core, then a release outranks a prerelease, then
+ *  prerelease identifiers compared field-by-field (numeric < non-numeric per
+ *  spec, shorter set loses when all shared fields are equal). */
+function compareVersions(a: ParsedVersion, b: ParsedVersion): number {
+  if (a.major !== b.major) return a.major - b.major;
+  if (a.minor !== b.minor) return a.minor - b.minor;
+  if (a.patch !== b.patch) return a.patch - b.patch;
+  if (a.pre === null && b.pre === null) return 0;
+  if (a.pre === null) return 1;
+  if (b.pre === null) return -1;
+  const len = Math.max(a.pre.length, b.pre.length);
+  for (let i = 0; i < len; i++) {
+    const ai = a.pre[i];
+    const bi = b.pre[i];
+    if (ai === undefined) return -1;
+    if (bi === undefined) return 1;
+    const an = /^\d+$/.test(ai);
+    const bn = /^\d+$/.test(bi);
+    if (an && bn) {
+      const d = Number(ai) - Number(bi);
+      if (d !== 0) return d;
+    } else if (an !== bn) {
+      return an ? -1 : 1;
+    } else if (ai !== bi) {
+      return ai < bi ? -1 : 1;
+    }
+  }
+  return 0;
+}
+
+/** Read a loaded module's `namespace/name` identity, version, and raw owner
+ *  text. Returns `null` for modules without a namespace: only a registry
+ *  identity (`<namespace>/<name>`) is a stable cross-import key. Two namespace-
+ *  less local libraries that merely share a `metadata.name` are distinct modules
+ *  reached via distinct source URLs — reconciling them would drop one and break
+ *  its kinds; the same local file reached via two paths is already collapsed by
+ *  canonical-source dedup, so there is nothing left to reconcile here. */
+function moduleIdentityOf(mod: LoadedModule): ModuleIdentity | null {
+  const doc = mod.owner.manifests.find((m) => m && isModuleKind(m.kind));
+  if (!doc) return null;
+  const meta = doc.metadata as { name?: string; namespace?: string | null; version?: string };
+  const name = meta?.name;
+  if (typeof name !== "string" || name.length === 0) return null;
+  if (typeof meta.namespace !== "string" || meta.namespace.length === 0) return null;
+  const version = typeof meta.version === "string" ? meta.version : "";
+  return {
+    source: mod.owner.source,
+    identity: `${meta.namespace}/${name}`,
+    version,
+    parsed: parseVersion(version),
+    text: mod.owner.text,
+  };
+}
+
+interface GroupResolution {
+  winner: ModuleIdentity;
+  /** True when members disagree on major version (or a version is unparseable). */
+  conflict: boolean;
+}
+
+/** Pick the winning member of a same-identity group and classify it. The winner
+ *  is the highest version (deterministic tiebreak on source URL for equal
+ *  versions / same-version-different-source). A major disagreement — or any
+ *  unparseable version — marks the group a conflict; we still pick a winner so
+ *  the rest of analysis proceeds against a single version instead of cascading
+ *  duplicate-kind errors. */
+function resolveGroup(members: ModuleIdentity[]): GroupResolution {
+  const majors = new Set<number | null>();
+  for (const m of members) majors.add(m.parsed ? m.parsed.major : null);
+  const conflict = majors.has(null) || majors.size > 1;
+
+  const winner = members.reduce((best, cur) => {
+    if (!cur.parsed) return best;
+    if (!best.parsed) return cur;
+    const cmp = compareVersions(cur.parsed, best.parsed);
+    if (cmp > 0) return cur;
+    if (cmp === 0 && cur.source < best.source) return cur;
+    return best;
+  }, members[0]);
+
+  return { winner, conflict };
+}
+
+/** The diagnostic for a redirected edge, or `null` when the redirect is a
+ *  silent dedupe (the same version resolved from two sources with identical
+ *  content — no decision was made, so nothing to report). */
+function hoistDiagnostic(
+  identity: string,
+  importerSource: string,
+  alias: string,
+  loser: ModuleIdentity,
+  winner: ModuleIdentity,
+  conflict: boolean,
+): AnalysisDiagnostic | null {
+  const data = { filePath: importerSource, path: `imports.${alias}` };
+  if (conflict) {
+    return {
+      severity: DiagnosticSeverity.Error,
+      code: "MODULE_VERSION_CONFLICT",
+      source: SOURCE,
+      message:
+        `Module '${identity}' is imported at incompatible major versions: ` +
+        `${loser.version || "<unknown>"} here and ${winner.version} elsewhere in the same graph. ` +
+        `Major versions can carry breaking changes and cannot be reconciled automatically — ` +
+        `align every importer on one major.`,
+      data,
+    };
+  }
+  if (loser.version === winner.version) {
+    // Same version, two sources. Identical content is a no-op dedupe; differing
+    // content means one is masquerading as the other (e.g. a local checkout vs
+    // the published version) — worth surfacing.
+    if (loser.text === winner.text) return null;
+    return {
+      severity: DiagnosticSeverity.Warning,
+      code: "MODULE_VERSION_HOISTED",
+      source: SOURCE,
+      message:
+        `Module '${identity}@${winner.version}' is imported from two sources whose contents ` +
+        `differ ('${loser.source}' and '${winner.source}'). Using '${winner.source}' for every ` +
+        `importer — pin a single source to remove the ambiguity.`,
+      data,
+    };
+  }
+  return {
+    severity: DiagnosticSeverity.Warning,
+    code: "MODULE_VERSION_HOISTED",
+    source: SOURCE,
+    message:
+      `Module '${identity}@${loser.version || "<unknown>"}' was hoisted to '${winner.version}' ` +
+      `because the same module is imported at the higher version elsewhere in the graph. ` +
+      `Pre-1.0 versions are additive, so the higher version is used for every importer.`,
+    data,
+  };
+}
+
+/**
+ * Reconcile a loaded import graph so each module identity (`namespace/name`)
+ * resolves to a single version. Within a shared major the highest version wins
+ * (a non-lossy hoist, given Telo's additive-only pre-1.0 policy); a major
+ * mismatch is a hard conflict. Mutates `importEdges` in place — every edge that
+ * pointed at a losing source is repointed at the winner — so `flattenForAnalyzer`
+ * walks a deduplicated graph and the runtime collision (two definitions of the
+ * same kind) cannot occur. Pure and browser-safe: no I/O, no Node built-ins.
+ */
+export function reconcileModuleVersions(
+  modules: Map<string, LoadedModule>,
+  importEdges: Map<string, Map<string, ImportEdge>>,
+): VersionReconciliation {
+  const overrides = new Map<string, string>();
+  const diagnostics: AnalysisDiagnostic[] = [];
+
+  const groups = new Map<string, ModuleIdentity[]>();
+  const infoBySource = new Map<string, ModuleIdentity>();
+  for (const mod of modules.values()) {
+    const info = moduleIdentityOf(mod);
+    if (!info) continue;
+    infoBySource.set(info.source, info);
+    const list = groups.get(info.identity);
+    if (list) list.push(info);
+    else groups.set(info.identity, [info]);
+  }
+
+  const conflictByIdentity = new Map<string, boolean>();
+  for (const [identity, members] of groups) {
+    if (members.length < 2) continue;
+    const { winner, conflict } = resolveGroup(members);
+    conflictByIdentity.set(identity, conflict);
+    for (const member of members) {
+      if (member.source !== winner.source) overrides.set(member.source, winner.source);
+    }
+  }
+
+  if (overrides.size === 0) return { overrides, diagnostics };
+
+  for (const [importerSource, aliasMap] of importEdges) {
+    for (const [alias, edge] of aliasMap) {
+      const winnerSource = overrides.get(edge.targetSource);
+      if (!winnerSource) continue;
+      const loser = infoBySource.get(edge.targetSource);
+      const winner = infoBySource.get(winnerSource);
+      if (loser && winner) {
+        const diag = hoistDiagnostic(
+          loser.identity,
+          importerSource,
+          alias,
+          loser,
+          winner,
+          conflictByIdentity.get(loser.identity) ?? false,
+        );
+        if (diag) diagnostics.push(diag);
+      }
+      edge.targetSource = winnerSource;
+    }
+  }
+
+  return { overrides, diagnostics };
+}

package/src/sources/default-sources.ts

@@ -0,0 +1,12 @@
+import type { ManifestSource } from "../types.js";
+import { HttpSource } from "./http-source.js";
+import { RegistrySource } from "./registry-source.js";
+
+/** The browser-safe built-in sources, in resolution order: HTTP fetch then
+ *  registry. Node-specific sources (local filesystem) are supplied by the
+ *  consuming package and passed alongside these into the `Loader` constructor.
+ *  Callers that only want a subset (e.g. the editor, which brings its own
+ *  registry adapters) construct the individual sources directly. */
+export function defaultSources(registryUrl?: string): ManifestSource[] {
+  return [new HttpSource(), new RegistrySource(registryUrl)];
+}

package/src/types.ts

@@ -75,14 +75,6 @@ export interface LoadOptions {
 }
 
 export interface LoaderInitOptions {
-  /** Sources inserted with highest priority before built-ins. */
-  extraSources?: ManifestSource[];
-  /** Include built-in HttpSource. Defaults to true. */
-  includeHttpSource?: boolean;
-  /** Include built-in RegistrySource. Defaults to true. */
-  includeRegistrySource?: boolean;
-  /** Base URL used by built-in RegistrySource when enabled. */
-  registryUrl?: string;
   /** Handlers for CEL stdlib functions (e.g. `sha256`). Analyzer-only callers may
    *  omit this and get throwing stubs; runtime callers (kernel) must supply real impls. */
   celHandlers?: import("./cel-environment.js").CelHandlers;

package/src/validate-cel-context.ts

@@ -1,4 +1,5 @@
 export { extractAccessChains, validateChainAgainstSchema } from "@telorun/templating";
+import { mergeTypeSchemas } from "@telorun/sdk";
 
 export interface ContextResolveOpts {
   /** When provided, used to resolve `x-telo-context-from-root` annotations against the
@@ -25,10 +26,13 @@ export interface ContextResolveOpts {
 export function resolveTypeFieldToSchema(
   value: unknown,
   allManifests: Record<string, any>[],
+  ancestry: ReadonlySet<string> = new Set(),
 ): Record<string, any> | undefined {
   if (!value) return undefined;
 
   if (typeof value === "string") {
+    // Cycle guard: a type already on the resolution path can't extend back into it.
+    if (ancestry.has(value)) return undefined;
     // Named type reference — find a Telo.Type resource by name
     const typeManifest = allManifests.find(
       (m) =>
@@ -38,14 +42,20 @@ export function resolveTypeFieldToSchema(
         typeof m.schema === "object" &&
         m.schema !== null,
     );
-    return typeManifest?.schema as Record<string, any> | undefined;
+    if (!typeManifest) return undefined;
+    return applyExtends(
+      typeManifest.schema as Record<string, any>,
+      typeManifest.extends,
+      allManifests,
+      new Set(ancestry).add(value),
+    );
   }
 
   if (typeof value === "object" && value !== null) {
     const obj = value as Record<string, any>;
     // Inline type resource: { kind: "Type.JsonSchema", schema: {...} }
     if (obj.schema && typeof obj.schema === "object") {
-      return obj.schema as Record<string, any>;
+      return applyExtends(obj.schema as Record<string, any>, obj.extends, allManifests, ancestry);
     }
     // Raw JSON Schema (has type or properties)
     if (obj.type || obj.properties) {
@@ -54,13 +64,39 @@ export function resolveTypeFieldToSchema(
     // Named type reference resolved from a `!ref` → { kind, name } — resolve the
     // named Telo.Type the same way as the bare-string form.
     if (typeof obj.name === "string") {
-      return resolveTypeFieldToSchema(obj.name, allManifests);
+      return resolveTypeFieldToSchema(obj.name, allManifests, ancestry);
     }
   }
 
   return undefined;
 }
 
+/**
+ * Fold a `Type.JsonSchema`'s `extends` parents into its own schema, matching the
+ * runtime `type` controller exactly — both call the shared `mergeTypeSchemas`, so
+ * static analysis and runtime validation can never disagree on a type's effective
+ * shape. Without this the analyzer would see only a child type's own properties
+ * and reject valid access to an inherited field with a false `CEL_UNKNOWN_FIELD`.
+ * `ancestry` carries the resolution path for cycle detection (siblings share it
+ * unmutated, so diamond inheritance still re-includes a shared grandparent).
+ */
+function applyExtends(
+  ownSchema: Record<string, any>,
+  extendsField: unknown,
+  allManifests: Record<string, any>[],
+  ancestry: ReadonlySet<string>,
+): Record<string, any> {
+  if (!extendsField) return ownSchema;
+  const parents = Array.isArray(extendsField) ? extendsField : [extendsField];
+  const resolved: Record<string, any>[] = [];
+  for (const parent of parents) {
+    const parentSchema = resolveTypeFieldToSchema(parent, allManifests, ancestry);
+    if (parentSchema) resolved.push(parentSchema);
+  }
+  if (resolved.length === 0) return ownSchema;
+  return mergeTypeSchemas([...resolved, ownSchema]) as Record<string, any>;
+}
+
 /** Pull the raw expression source from a CEL field value — a compiled value
  *  (`{ source }`), or a string (`!cel "x"` or `"${{ x }}"`). Strips a lone
  *  `${{ }}` wrapper. Returns null when no source is recoverable. */