@telorun/analyzer 0.28.1 → 0.30.0

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAmB9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA4hB/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAgvBvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAmBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAmB9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAwjB/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAkyBvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAmBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -16,7 +16,8 @@ import { validateSchemaTypeRefs } from "./validate-schema-type-refs.js";
 import { rewriteSyntheticOrigins } from "./rewrite-synthetic-origins.js";
 import { celTypeSatisfiesJsonSchema, substituteCelFields, validateAgainstSchema, } from "./schema-compat.js";
 import { DiagnosticSeverity } from "./types.js";
-import { extractContextsFromSchema, getManifestItem, pathMatchesScope, resolveContextAnnotations, resolveTypeFieldToSchema, } from "./validate-cel-context.js";
+import { extractCelRegionScopes, extractContextsFromSchema, getManifestItem, pathMatchesScope, resolveContextAnnotations, resolveTypeFieldToSchema, } from "./validate-cel-context.js";
+import { buildEvalPaths, evalPathsCover } from "./eval-paths.js";
 import { validateExtends } from "./validate-extends.js";
 import { validateNestedInlineResources } from "./validate-nested-inline.js";
 import { validateProviderCoherence } from "./validate-provider-coherence.js";
@@ -320,6 +321,29 @@ function buildStepContextSchema(manifest, defSchema, allManifests, defs, aliases
  * specific field name (or `Run.Sequence`) is hardcoded; any composer that tags
  * its error-bearing branch fields opts in the same way.
  */
+/**
+ * True when a `walkCelExpressions` path (`with[0].handler.inputs.x`) crosses an
+ * inline nested resource — an `{ kind: … }` object below the host root — before
+ * reaching the leaf. Such CEL belongs to the nested resource's kind (validated
+ * when that resource is analyzed), not the host's schema, so the
+ * non-eval-field check must not attribute it to the host.
+ */
+function pathCrossesNestedResource(root, path) {
+    const segments = path.match(/[^.[\]]+/g) ?? [];
+    let node = root;
+    for (let i = 0; i < segments.length - 1; i++) {
+        node = Array.isArray(node)
+            ? node[Number(segments[i])]
+            : node?.[segments[i]];
+        if (node !== null &&
+            typeof node === "object" &&
+            !Array.isArray(node) &&
+            typeof node.kind === "string") {
+            return true;
+        }
+    }
+    return false;
+}
 function collectErrorContextScopes(defSchema) {
     const out = new Map();
     if (!defSchema || typeof defSchema !== "object")
@@ -995,6 +1019,13 @@ export class StaticAnalyzer {
         let celStepContextSchema;
         let celInvocationContext;
         let celErrorScopes = new Map();
+        // Region coverage for the "CEL in a non-eval field" check: the union of
+        // `x-telo-eval` paths (own + capability) and `x-telo-context` /
+        // `x-telo-step-context` / `x-telo-error-context` scopes. A `!cel` outside
+        // every region is read as a literal — the runtime never evaluates it.
+        let celEvalPaths = [];
+        let celRegionScopes = [];
+        let celRuleApplies = false;
         visitManifest(allManifests, defs, {
             onResourceEnter: (e) => {
                 const m = e.source;
@@ -1003,12 +1034,52 @@ export class StaticAnalyzer {
                     ? buildStepContextSchema(m, e.definition.schema, allManifests, defs, aliases)
                     : undefined;
                 celErrorScopes = collectErrorContextScopes(e.definition?.schema);
+                // The non-eval-field check only applies to runtime resource instances:
+                // structural / templating kinds (capability `Telo.Template`, or no
+                // definition) carry CEL the kernel evaluates by other rules.
+                const capability = e.definition?.capability;
+                celRuleApplies =
+                    !!e.definition?.schema && capability !== undefined && capability !== "Telo.Template";
+                if (celRuleApplies) {
+                    const ownSchema = e.definition.schema;
+                    const own = buildEvalPaths(ownSchema);
+                    const capabilityDef = capability ? defs.resolve(capability) : undefined;
+                    const parent = capabilityDef?.schema
+                        ? buildEvalPaths(capabilityDef.schema)
+                        : { compile: [], runtime: [] };
+                    celEvalPaths = [...own.compile, ...own.runtime, ...parent.compile, ...parent.runtime];
+                    celRegionScopes = extractCelRegionScopes(ownSchema);
+                }
+                else {
+                    celEvalPaths = [];
+                    celRegionScopes = [];
+                }
             },
             onCel: (e) => {
                 const m = e.source;
                 const resource = { kind: m.kind, name: m.metadata?.name };
                 const filePath = m.metadata?.source;
                 const { expr, path, engineName, matchedScope } = e;
+                // A `!cel` (or `${{ }}`) in a field with no `x-telo-eval` / `x-telo-context`
+                // is never evaluated — the runtime reads it as a literal (e.g. a
+                // `concurrency` `!cel` that silently degraded to a sparse `[null, …]`).
+                // Flag it rather than letting it pass as valid CEL. Inline resources
+                // (resource-wide invocation context) carry CEL the kernel evaluates.
+                if (celRuleApplies &&
+                    engineName === "cel" &&
+                    celInvocationContext === undefined &&
+                    !evalPathsCover(celEvalPaths, path) &&
+                    !celRegionScopes.some((scope) => pathMatchesScope(path, scope)) &&
+                    !pathCrossesNestedResource(m, path)) {
+                    diagnostics.push({
+                        severity: DiagnosticSeverity.Error,
+                        code: "CEL_IN_NON_EVAL_FIELD",
+                        source: SOURCE,
+                        message: `${m.kind}/${resource.name}: CEL at '${path}' is never evaluated — the field has no x-telo-eval / x-telo-context annotation, so its value is read as a literal. Annotate the field as a CEL slot or remove the !cel tag.`,
+                        data: { resource, filePath, path },
+                    });
+                    return;
+                }
                 let matchedContext = e.contextSchema ?? celInvocationContext;
                 if (celStepContextSchema) {
                     const base = matchedContext ?? { type: "object", properties: {}, additionalProperties: true };

package/dist/cel-environment.d.ts

@@ -7,7 +7,7 @@ export type { CelHandlers } from "@telorun/templating";
  *
  *  - `variables`: typed from the manifest's `variables` field if it is a schema map
  *    (only module-identity docs — `Telo.Application` / `Telo.Library` — carry this); otherwise registered as `map` (dyn).
- *  - `secrets`, `resources`, `env`: always `map` (dyn — output schemas unknown).
+ *  - `secrets`, `resources`: always `map` (dyn — output schemas unknown).
  *  - `extraContextSchema`: additional variables from an `x-telo-context` annotation.
  *
  *  NOTE: The set of kernel globals registered here must match `KERNEL_GLOBAL_NAMES`
@@ -17,7 +17,7 @@ export declare function buildTypedCelEnvironment(baseEnv: Environment, manifest:
  *
  *  Import inputs are a config-only contract: their expressions are evaluated
  *  against the IMPORTING module's `variables`/`secrets`, never the import's own
- *  values map (the bug) nor the imported child's. `resources`, `env`, and `ports`
+ *  values map (the bug) nor the imported child's. `resources` and `ports`
  *  are registered as empty typed objects, so referencing them is a "No such key"
  *  error that steers authors to a typed `variables` entry. */
 export declare function buildImportInputCelEnvironment(baseEnv: Environment, moduleManifest: ResourceManifest | undefined): Environment;

package/dist/cel-environment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cel-environment.d.ts","sourceRoot":"","sources":["../src/cel-environment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAUrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;;;uEASuE;AACvE,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,gBAAgB,EAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,EAI/C,kBAAkB,CAAC,EAAE,gBAAgB,GACpC,WAAW,CAuEb;AAuBD;;;;;;8DAM8D;AAC9D,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,WAAW,EACpB,cAAc,EAAE,gBAAgB,GAAG,SAAS,GAC3C,WAAW,CAwBb"}
+{"version":3,"file":"cel-environment.d.ts","sourceRoot":"","sources":["../src/cel-environment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAUrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;;;uEASuE;AACvE,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,gBAAgB,EAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,EAI/C,kBAAkB,CAAC,EAAE,gBAAgB,GACpC,WAAW,CAsEb;AAuBD;;;;;;8DAM8D;AAC9D,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,WAAW,EACpB,cAAc,EAAE,gBAAgB,GAAG,SAAS,GAC3C,WAAW,CAwBb"}

package/dist/cel-environment.js

@@ -11,7 +11,7 @@ export { buildCelEnvironment } from "@telorun/templating";
  *
  *  - `variables`: typed from the manifest's `variables` field if it is a schema map
  *    (only module-identity docs — `Telo.Application` / `Telo.Library` — carry this); otherwise registered as `map` (dyn).
- *  - `secrets`, `resources`, `env`: always `map` (dyn — output schemas unknown).
+ *  - `secrets`, `resources`: always `map` (dyn — output schemas unknown).
  *  - `extraContextSchema`: additional variables from an `x-telo-context` annotation.
  *
  *  NOTE: The set of kernel globals registered here must match `KERNEL_GLOBAL_NAMES`
@@ -71,7 +71,6 @@ rootModuleManifest) {
         }
         env.registerVariable("secrets", "map");
         env.registerVariable("resources", "map");
-        env.registerVariable("env", "map");
         if (extraContextSchema?.properties) {
             for (const [name, propSchema] of Object.entries(extraContextSchema.properties)) {
                 if (!env.hasVariable(name)) {
@@ -104,7 +103,7 @@ function registerConfigNamespace(env, block, name) {
  *
  *  Import inputs are a config-only contract: their expressions are evaluated
  *  against the IMPORTING module's `variables`/`secrets`, never the import's own
- *  values map (the bug) nor the imported child's. `resources`, `env`, and `ports`
+ *  values map (the bug) nor the imported child's. `resources` and `ports`
  *  are registered as empty typed objects, so referencing them is a "No such key"
  *  error that steers authors to a typed `variables` entry. */
 export function buildImportInputCelEnvironment(baseEnv, moduleManifest) {
@@ -125,10 +124,10 @@ export function buildImportInputCelEnvironment(baseEnv, moduleManifest) {
         env.registerVariable("variables", "map");
         env.registerVariable("secrets", "map");
     }
-    // Override the base env's dyn `resources`/`env`/`ports` with empty typed objects
-    // so any access (`resources.X`, `env.X`) is a "No such key" error — these
+    // Override the base env's dyn `resources`/`ports` with empty typed objects
+    // so any access (`resources.X`, `ports.X`) is a "No such key" error — these
     // surfaces are not part of the config-only import contract.
-    for (const name of ["resources", "env", "ports"]) {
+    for (const name of ["resources", "ports"]) {
         env.registerVariable({ name, schema: {} });
     }
     return env;

package/dist/eval-paths.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The single containment rule for `x-telo-eval` paths, shared by every matcher so
+ * the analyzer's coverage decision and the kernel's expansion/exclusion can't
+ * drift. True when `target` lies in the subtree rooted at `evalPath`: `"**"`
+ * covers everything; a dotted path covers itself and any descendant — `"handler"`
+ * covers `handler`, `handler.body`, `handler[0]`. Targets use `walkCelExpressions`
+ * form (`a.b[0].c`); eval paths are property-only (no array segments —
+ * `buildEvalPaths` does not descend into `items`), so `.`/`[` boundary prefixing
+ * is exact. Consumers: the analyzer's `evalPathsCover`, the kernel's `isExcluded`
+ * (applied in both directions), and — structurally — `expandPaths`' navigation.
+ */
+export declare function evalPathCovers(evalPath: string, target: string): boolean;
+/** True when any `x-telo-eval` path in the set covers `exprPath` (see
+ *  {@link evalPathCovers}). */
+export declare function evalPathsCover(evalPaths: readonly string[], exprPath: string): boolean;
+/**
+ * Traverses a definition schema and collects all paths annotated with `x-telo-eval`.
+ * Root-level `x-telo-eval` produces the `"**"` wildcard (expand all fields).
+ * Property-level annotations produce the dot-notation path to that property.
+ */
+export declare function buildEvalPaths(schema: Record<string, any>): {
+    compile: string[];
+    runtime: string[];
+};
+//# sourceMappingURL=eval-paths.d.ts.map

package/dist/eval-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eval-paths.d.ts","sourceRoot":"","sources":["../src/eval-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAKxE;AAED;+BAC+B;AAC/B,wBAAgB,cAAc,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEtF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG;IAC3D,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAcA"}

package/dist/eval-paths.js

@@ -0,0 +1,55 @@
+/**
+ * The single containment rule for `x-telo-eval` paths, shared by every matcher so
+ * the analyzer's coverage decision and the kernel's expansion/exclusion can't
+ * drift. True when `target` lies in the subtree rooted at `evalPath`: `"**"`
+ * covers everything; a dotted path covers itself and any descendant — `"handler"`
+ * covers `handler`, `handler.body`, `handler[0]`. Targets use `walkCelExpressions`
+ * form (`a.b[0].c`); eval paths are property-only (no array segments —
+ * `buildEvalPaths` does not descend into `items`), so `.`/`[` boundary prefixing
+ * is exact. Consumers: the analyzer's `evalPathsCover`, the kernel's `isExcluded`
+ * (applied in both directions), and — structurally — `expandPaths`' navigation.
+ */
+export function evalPathCovers(evalPath, target) {
+    if (evalPath === "**")
+        return true;
+    return (target === evalPath || target.startsWith(`${evalPath}.`) || target.startsWith(`${evalPath}[`));
+}
+/** True when any `x-telo-eval` path in the set covers `exprPath` (see
+ *  {@link evalPathCovers}). */
+export function evalPathsCover(evalPaths, exprPath) {
+    return evalPaths.some((p) => evalPathCovers(p, exprPath));
+}
+/**
+ * Traverses a definition schema and collects all paths annotated with `x-telo-eval`.
+ * Root-level `x-telo-eval` produces the `"**"` wildcard (expand all fields).
+ * Property-level annotations produce the dot-notation path to that property.
+ */
+export function buildEvalPaths(schema) {
+    const compile = [];
+    const runtime = [];
+    if (schema["x-telo-eval"] === "compile")
+        compile.push("**");
+    else if (schema["x-telo-eval"] === "runtime")
+        runtime.push("**");
+    if (schema.properties) {
+        for (const [key, propSchema] of Object.entries(schema.properties)) {
+            collectEvalPathsNode(propSchema, key, compile, runtime);
+        }
+    }
+    return { compile, runtime };
+}
+function collectEvalPathsNode(node, path, compile, runtime) {
+    if (node["x-telo-eval"] === "compile") {
+        compile.push(path);
+        return;
+    }
+    if (node["x-telo-eval"] === "runtime") {
+        runtime.push(path);
+        return;
+    }
+    if (node.properties) {
+        for (const [key, propSchema] of Object.entries(node.properties)) {
+            collectEvalPathsNode(propSchema, `${path}.${key}`, compile, runtime);
+        }
+    }
+}

package/dist/index.d.ts

@@ -3,6 +3,7 @@ export type { RefFieldInfo } from "./analysis-registry.js";
 export { StaticAnalyzer } from "./analyzer.js";
 export type { GraphLoadError, ImportEdge, LoadedFile, LoadedGraph, LoadedModule, ParseError, } from "./loaded-types.js";
 export { flattenForAnalyzer, flattenLoadedModule, forwardReExportManifests, parseExportEntry, reExportSpecsFromExports, resolveExportedKinds, selectModuleManifestsForAnalysis, stampReExportedKinds, type ParsedExportEntry, type ReExportSpec, } from "./flatten-for-analyzer.js";
+export { buildEvalPaths, evalPathCovers } from "./eval-paths.js";
 export { visitManifest } from "./manifest-visitor.js";
 export type { CelSiteEvent, ManifestVisitor, RefSiteEvent, ResourceEnterEvent, ResourceExitEvent, ScopeBoundaryEvent, SchemaFromSiteEvent, VisitOptions, } from "./manifest-visitor.js";
 export { Loader } from "./manifest-loader.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,6 +1,7 @@
 export { AnalysisRegistry } from "./analysis-registry.js";
 export { StaticAnalyzer } from "./analyzer.js";
 export { flattenForAnalyzer, flattenLoadedModule, forwardReExportManifests, parseExportEntry, reExportSpecsFromExports, resolveExportedKinds, selectModuleManifestsForAnalysis, stampReExportedKinds, } from "./flatten-for-analyzer.js";
+export { buildEvalPaths, evalPathCovers } from "./eval-paths.js";
 export { visitManifest } from "./manifest-visitor.js";
 export { Loader } from "./manifest-loader.js";
 export { isModuleKind, MODULE_KINDS } from "./module-kinds.js";

package/dist/kernel-globals.d.ts

@@ -5,12 +5,12 @@ import type { ResourceManifest } from "@telorun/sdk";
  * `buildTypedCelEnvironment` in cel-environment.ts (CEL type-checking)
  * must stay in sync with this list.
  *
- * Note: `env` is only available in the root module context. Child modules
- * loaded via Telo.Import do not receive host environment variables.
- * There is no `imports` namespace at runtime — import snapshots are stored
- * under `resources.<alias>`.
+ * Note: there is no `imports` namespace at runtime — import snapshots are
+ * stored under `resources.<alias>`. Host environment variables are reached
+ * by declaring a typed `variables:`/`secrets:` entry with an `env:` binding
+ * and referencing `variables.X` / `secrets.X`.
  */
-export declare const KERNEL_GLOBAL_NAMES: readonly ["variables", "secrets", "resources", "ports", "env"];
+export declare const KERNEL_GLOBAL_NAMES: readonly ["variables", "secrets", "resources", "ports"];
 /**
  * Build a typed JSON Schema describing the kernel globals available in the
  * given manifest set. Used to merge into `x-telo-context` schemas so that
@@ -23,12 +23,11 @@ export declare const KERNEL_GLOBAL_NAMES: readonly ["variables", "secrets", "res
  *   in the outer module; Libraries are only relevant when the caller scoped
  *   the manifest list to a single library's file.
  * - `resources`: enumerates all non-system resource names
- * - `env`: dynamic (runtime env vars, root module only)
  */
 export declare function buildKernelGlobalsSchema(manifests: ResourceManifest[]): Record<string, any>;
 /**
  * Merge kernel globals into an `x-telo-context` schema so chain-access
- * validation recognises `variables`, `secrets`, `resources`, `env`
+ * validation recognises `variables`, `secrets`, `resources`, `ports`
  * without module authors having to re-declare them.
  *
  * Context-specific properties take precedence over globals (spread order).

package/dist/kernel-globals.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kernel-globals.d.ts","sourceRoot":"","sources":["../src/kernel-globals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,gEAAiE,CAAC;AASlG;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,gBAAgB,EAAE,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAkCrB;AA4CD;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAClC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACjC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CASrB"}
+{"version":3,"file":"kernel-globals.d.ts","sourceRoot":"","sources":["../src/kernel-globals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,yDAA0D,CAAC;AAS3F;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,gBAAgB,EAAE,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAiCrB;AA4CD;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAClC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACjC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CASrB"}

package/dist/kernel-globals.js

@@ -5,12 +5,12 @@ import { residualEntrySchemaMap } from "./residual-schema.js";
  * `buildTypedCelEnvironment` in cel-environment.ts (CEL type-checking)
  * must stay in sync with this list.
  *
- * Note: `env` is only available in the root module context. Child modules
- * loaded via Telo.Import do not receive host environment variables.
- * There is no `imports` namespace at runtime — import snapshots are stored
- * under `resources.<alias>`.
+ * Note: there is no `imports` namespace at runtime — import snapshots are
+ * stored under `resources.<alias>`. Host environment variables are reached
+ * by declaring a typed `variables:`/`secrets:` entry with an `env:` binding
+ * and referencing `variables.X` / `secrets.X`.
  */
-export const KERNEL_GLOBAL_NAMES = ["variables", "secrets", "resources", "ports", "env"];
+export const KERNEL_GLOBAL_NAMES = ["variables", "secrets", "resources", "ports"];
 const SYSTEM_KINDS = new Set([
     "Telo.Definition",
     "Telo.Application",
@@ -29,7 +29,6 @@ const SYSTEM_KINDS = new Set([
  *   in the outer module; Libraries are only relevant when the caller scoped
  *   the manifest list to a single library's file.
  * - `resources`: enumerates all non-system resource names
- * - `env`: dynamic (runtime env vars, root module only)
  */
 export function buildKernelGlobalsSchema(manifests) {
     const moduleManifest = manifests.find((m) => m.kind === "Telo.Application") ??
@@ -56,7 +55,6 @@ export function buildKernelGlobalsSchema(manifests) {
                 additionalProperties: false,
             },
             ports: buildPortsSchema(moduleManifest?.ports),
-            env: { type: "object", additionalProperties: true },
         },
     };
 }
@@ -98,7 +96,7 @@ function buildSchemaMapSchema(schemaMap) {
 }
 /**
  * Merge kernel globals into an `x-telo-context` schema so chain-access
- * validation recognises `variables`, `secrets`, `resources`, `env`
+ * validation recognises `variables`, `secrets`, `resources`, `ports`
  * without module authors having to re-declare them.
  *
  * Context-specific properties take precedence over globals (spread order).

package/dist/reconcile-module-versions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reconcile-module-versions.d.ts","sourceRoot":"","sources":["../src/reconcile-module-versions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAElE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;0CAI0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,gEAAgE;IAChE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;2EACuE;IACvE,WAAW,EAAE,kBAAkB,EAAE,CAAC;CACnC;AA8KD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,EAClC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,GAChD,qBAAqB,CAiDvB"}
+{"version":3,"file":"reconcile-module-versions.d.ts","sourceRoot":"","sources":["../src/reconcile-module-versions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAElE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;0CAI0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,gEAAgE;IAChE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;2EACuE;IACvE,WAAW,EAAE,kBAAkB,EAAE,CAAC;CACnC;AAwKD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,EAClC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,GAChD,qBAAqB,CAiDvB"}

package/dist/reconcile-module-versions.js

@@ -148,15 +148,10 @@ function hoistDiagnostic(identity, importerSource, alias, loser, winner, conflic
             data,
         };
     }
-    return {
-        severity: DiagnosticSeverity.Warning,
-        code: "MODULE_VERSION_HOISTED",
-        source: SOURCE,
-        message: `Module '${identity}@${loser.version || "<unknown>"}' was hoisted to '${winner.version}' ` +
-            `because the same module is imported at the higher version elsewhere in the graph. ` +
-            `Pre-1.0 versions are additive, so the higher version is used for every importer.`,
-        data,
-    };
+    // Same-major hoist to a higher version: additive pre-1.0, so the redirect is
+    // non-lossy and by design — resolve to the winner silently, like a package
+    // manager picking the highest compatible version of a transitive dep.
+    return null;
 }
 /**
  * Reconcile a loaded import graph so each module identity (`namespace/name`)

package/dist/validate-cel-context.d.ts

@@ -97,4 +97,13 @@ export declare function extractContextsFromSchema(schema: Record<string, any>, p
     scope: string;
     schema: Record<string, any>;
 }>;
+/**
+ * Walk a JSON Schema tree and collect the JSONPath scopes of every field that
+ * declares a CEL-bearing region (`x-telo-context` / `x-telo-step-context` /
+ * `x-telo-error-context`). Used — alongside `x-telo-eval` paths — to decide
+ * whether a `!cel` expression sits in a slot the runtime actually evaluates.
+ * Scopes use the same `$.a.b[*]` form as `extractContextsFromSchema`, matched
+ * against expression paths with `pathMatchesScope`.
+ */
+export declare function extractCelRegionScopes(schema: Record<string, any>, path?: string): string[];
 //# sourceMappingURL=validate-cel-context.d.ts.map

package/dist/validate-cel-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAGtF,MAAM,WAAW,kBAAkB;IACjC;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC;;kDAE8C;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;KACxD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CA0CjC;AAuFD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAChD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAgHrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB;AAWD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,SAAM,GACT,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAC,CAGvD"}
+{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAGtF,MAAM,WAAW,kBAAkB;IACjC;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC;;kDAE8C;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;KACxD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CA0CjC;AAuFD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAChD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAgHrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB;AAWD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,SAAM,GACT,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAC,CAGvD;AAUD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,SAAM,GAAG,MAAM,EAAE,CAqBxF"}

package/dist/validate-cel-context.js

@@ -334,6 +334,43 @@ export function extractContextsFromSchema(schema, path = "$") {
     const all = collectContexts(schema, path);
     return all.sort((a, b) => b.scope.length - a.scope.length);
 }
+/** Schema keys that declare a CEL-bearing region: a field carrying any of these
+ *  is evaluated at runtime, so a `!cel` inside it (or a descendant) is live. */
+const CEL_REGION_KEYS = [
+    "x-telo-context",
+    "x-telo-step-context",
+    "x-telo-error-context",
+];
+/**
+ * Walk a JSON Schema tree and collect the JSONPath scopes of every field that
+ * declares a CEL-bearing region (`x-telo-context` / `x-telo-step-context` /
+ * `x-telo-error-context`). Used — alongside `x-telo-eval` paths — to decide
+ * whether a `!cel` expression sits in a slot the runtime actually evaluates.
+ * Scopes use the same `$.a.b[*]` form as `extractContextsFromSchema`, matched
+ * against expression paths with `pathMatchesScope`.
+ */
+export function extractCelRegionScopes(schema, path = "$") {
+    if (!schema || typeof schema !== "object")
+        return [];
+    const out = [];
+    if (CEL_REGION_KEYS.some((k) => schema[k]))
+        out.push(path);
+    if (schema.properties) {
+        for (const [key, value] of Object.entries(schema.properties)) {
+            out.push(...extractCelRegionScopes(value, `${path}.${key}`));
+        }
+    }
+    if (schema.items && typeof schema.items === "object") {
+        out.push(...extractCelRegionScopes(schema.items, `${path}[*]`));
+    }
+    for (const key of ["oneOf", "anyOf", "allOf"]) {
+        if (Array.isArray(schema[key])) {
+            for (const subschema of schema[key])
+                out.push(...extractCelRegionScopes(subschema, path));
+        }
+    }
+    return out;
+}
 function collectContexts(schema, path) {
     if (!schema || typeof schema !== "object")
         return [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.28.1",
+  "version": "0.30.0",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",

package/src/analyzer.ts

@@ -30,12 +30,14 @@ import {
 } from "./schema-compat.js";
 import { DiagnosticSeverity, type AnalysisDiagnostic, type AnalysisOptions } from "./types.js";
 import {
+  extractCelRegionScopes,
   extractContextsFromSchema,
   getManifestItem,
   pathMatchesScope,
   resolveContextAnnotations,
   resolveTypeFieldToSchema,
 } from "./validate-cel-context.js";
+import { buildEvalPaths, evalPathsCover } from "./eval-paths.js";
 import { validateExtends } from "./validate-extends.js";
 import { validateNestedInlineResources } from "./validate-nested-inline.js";
 import { validateProviderCoherence } from "./validate-provider-coherence.js";
@@ -393,6 +395,32 @@ function buildStepContextSchema(
  * specific field name (or `Run.Sequence`) is hardcoded; any composer that tags
  * its error-bearing branch fields opts in the same way.
  */
+/**
+ * True when a `walkCelExpressions` path (`with[0].handler.inputs.x`) crosses an
+ * inline nested resource — an `{ kind: … }` object below the host root — before
+ * reaching the leaf. Such CEL belongs to the nested resource's kind (validated
+ * when that resource is analyzed), not the host's schema, so the
+ * non-eval-field check must not attribute it to the host.
+ */
+function pathCrossesNestedResource(root: unknown, path: string): boolean {
+  const segments = path.match(/[^.[\]]+/g) ?? [];
+  let node: unknown = root;
+  for (let i = 0; i < segments.length - 1; i++) {
+    node = Array.isArray(node)
+      ? node[Number(segments[i])]
+      : (node as Record<string, unknown> | undefined)?.[segments[i]!];
+    if (
+      node !== null &&
+      typeof node === "object" &&
+      !Array.isArray(node) &&
+      typeof (node as { kind?: unknown }).kind === "string"
+    ) {
+      return true;
+    }
+  }
+  return false;
+}
+
 function collectErrorContextScopes(
   defSchema: Record<string, any> | undefined,
 ): Map<string, Record<string, any>> {
@@ -1189,6 +1217,13 @@ export class StaticAnalyzer {
     let celStepContextSchema: Record<string, any> | undefined;
     let celInvocationContext: Record<string, any> | undefined;
     let celErrorScopes: Map<string, Record<string, any>> = new Map();
+    // Region coverage for the "CEL in a non-eval field" check: the union of
+    // `x-telo-eval` paths (own + capability) and `x-telo-context` /
+    // `x-telo-step-context` / `x-telo-error-context` scopes. A `!cel` outside
+    // every region is read as a literal — the runtime never evaluates it.
+    let celEvalPaths: string[] = [];
+    let celRegionScopes: string[] = [];
+    let celRuleApplies = false;
 
     visitManifest(
       allManifests,
@@ -1211,6 +1246,26 @@ export class StaticAnalyzer {
           celErrorScopes = collectErrorContextScopes(
             e.definition?.schema as Record<string, any> | undefined,
           );
+
+          // The non-eval-field check only applies to runtime resource instances:
+          // structural / templating kinds (capability `Telo.Template`, or no
+          // definition) carry CEL the kernel evaluates by other rules.
+          const capability = e.definition?.capability;
+          celRuleApplies =
+            !!e.definition?.schema && capability !== undefined && capability !== "Telo.Template";
+          if (celRuleApplies) {
+            const ownSchema = e.definition!.schema as Record<string, any>;
+            const own = buildEvalPaths(ownSchema);
+            const capabilityDef = capability ? defs.resolve(capability) : undefined;
+            const parent = capabilityDef?.schema
+              ? buildEvalPaths(capabilityDef.schema as Record<string, any>)
+              : { compile: [], runtime: [] };
+            celEvalPaths = [...own.compile, ...own.runtime, ...parent.compile, ...parent.runtime];
+            celRegionScopes = extractCelRegionScopes(ownSchema);
+          } else {
+            celEvalPaths = [];
+            celRegionScopes = [];
+          }
         },
         onCel: (e) => {
           const m = e.source;
@@ -1218,6 +1273,29 @@ export class StaticAnalyzer {
           const filePath = (m.metadata as { source?: string } | undefined)?.source;
           const { expr, path, engineName, matchedScope } = e;
 
+          // A `!cel` (or `${{ }}`) in a field with no `x-telo-eval` / `x-telo-context`
+          // is never evaluated — the runtime reads it as a literal (e.g. a
+          // `concurrency` `!cel` that silently degraded to a sparse `[null, …]`).
+          // Flag it rather than letting it pass as valid CEL. Inline resources
+          // (resource-wide invocation context) carry CEL the kernel evaluates.
+          if (
+            celRuleApplies &&
+            engineName === "cel" &&
+            celInvocationContext === undefined &&
+            !evalPathsCover(celEvalPaths, path) &&
+            !celRegionScopes.some((scope) => pathMatchesScope(path, scope)) &&
+            !pathCrossesNestedResource(m, path)
+          ) {
+            diagnostics.push({
+              severity: DiagnosticSeverity.Error,
+              code: "CEL_IN_NON_EVAL_FIELD",
+              source: SOURCE,
+              message: `${m.kind}/${resource.name}: CEL at '${path}' is never evaluated — the field has no x-telo-eval / x-telo-context annotation, so its value is read as a literal. Annotate the field as a CEL slot or remove the !cel tag.`,
+              data: { resource, filePath, path },
+            });
+            return;
+          }
+
           let matchedContext: Record<string, any> | undefined =
             e.contextSchema ?? celInvocationContext;
 

package/src/cel-environment.ts

@@ -17,7 +17,7 @@ export type { CelHandlers } from "@telorun/templating";
  *
  *  - `variables`: typed from the manifest's `variables` field if it is a schema map
  *    (only module-identity docs — `Telo.Application` / `Telo.Library` — carry this); otherwise registered as `map` (dyn).
- *  - `secrets`, `resources`, `env`: always `map` (dyn — output schemas unknown).
+ *  - `secrets`, `resources`: always `map` (dyn — output schemas unknown).
  *  - `extraContextSchema`: additional variables from an `x-telo-context` annotation.
  *
  *  NOTE: The set of kernel globals registered here must match `KERNEL_GLOBAL_NAMES`
@@ -85,7 +85,6 @@ export function buildTypedCelEnvironment(
 
     env.registerVariable("secrets", "map");
     env.registerVariable("resources", "map");
-    env.registerVariable("env", "map");
 
     if (extraContextSchema?.properties) {
       for (const [name, propSchema] of Object.entries(
@@ -128,7 +127,7 @@ function registerConfigNamespace(
  *
  *  Import inputs are a config-only contract: their expressions are evaluated
  *  against the IMPORTING module's `variables`/`secrets`, never the import's own
- *  values map (the bug) nor the imported child's. `resources`, `env`, and `ports`
+ *  values map (the bug) nor the imported child's. `resources` and `ports`
  *  are registered as empty typed objects, so referencing them is a "No such key"
  *  error that steers authors to a typed `variables` entry. */
 export function buildImportInputCelEnvironment(
@@ -151,10 +150,10 @@ export function buildImportInputCelEnvironment(
     env.registerVariable("variables", "map");
     env.registerVariable("secrets", "map");
   }
-  // Override the base env's dyn `resources`/`env`/`ports` with empty typed objects
-  // so any access (`resources.X`, `env.X`) is a "No such key" error — these
+  // Override the base env's dyn `resources`/`ports` with empty typed objects
+  // so any access (`resources.X`, `ports.X`) is a "No such key" error — these
   // surfaces are not part of the config-only import contract.
-  for (const name of ["resources", "env", "ports"]) {
+  for (const name of ["resources", "ports"]) {
     (env as any).registerVariable({ name, schema: {} });
   }
   return env;

package/src/eval-paths.ts

@@ -0,0 +1,68 @@
+/**
+ * The single containment rule for `x-telo-eval` paths, shared by every matcher so
+ * the analyzer's coverage decision and the kernel's expansion/exclusion can't
+ * drift. True when `target` lies in the subtree rooted at `evalPath`: `"**"`
+ * covers everything; a dotted path covers itself and any descendant — `"handler"`
+ * covers `handler`, `handler.body`, `handler[0]`. Targets use `walkCelExpressions`
+ * form (`a.b[0].c`); eval paths are property-only (no array segments —
+ * `buildEvalPaths` does not descend into `items`), so `.`/`[` boundary prefixing
+ * is exact. Consumers: the analyzer's `evalPathsCover`, the kernel's `isExcluded`
+ * (applied in both directions), and — structurally — `expandPaths`' navigation.
+ */
+export function evalPathCovers(evalPath: string, target: string): boolean {
+  if (evalPath === "**") return true;
+  return (
+    target === evalPath || target.startsWith(`${evalPath}.`) || target.startsWith(`${evalPath}[`)
+  );
+}
+
+/** True when any `x-telo-eval` path in the set covers `exprPath` (see
+ *  {@link evalPathCovers}). */
+export function evalPathsCover(evalPaths: readonly string[], exprPath: string): boolean {
+  return evalPaths.some((p) => evalPathCovers(p, exprPath));
+}
+
+/**
+ * Traverses a definition schema and collects all paths annotated with `x-telo-eval`.
+ * Root-level `x-telo-eval` produces the `"**"` wildcard (expand all fields).
+ * Property-level annotations produce the dot-notation path to that property.
+ */
+export function buildEvalPaths(schema: Record<string, any>): {
+  compile: string[];
+  runtime: string[];
+} {
+  const compile: string[] = [];
+  const runtime: string[] = [];
+
+  if (schema["x-telo-eval"] === "compile") compile.push("**");
+  else if (schema["x-telo-eval"] === "runtime") runtime.push("**");
+
+  if (schema.properties) {
+    for (const [key, propSchema] of Object.entries(schema.properties as Record<string, any>)) {
+      collectEvalPathsNode(propSchema, key, compile, runtime);
+    }
+  }
+
+  return { compile, runtime };
+}
+
+function collectEvalPathsNode(
+  node: Record<string, any>,
+  path: string,
+  compile: string[],
+  runtime: string[],
+): void {
+  if (node["x-telo-eval"] === "compile") {
+    compile.push(path);
+    return;
+  }
+  if (node["x-telo-eval"] === "runtime") {
+    runtime.push(path);
+    return;
+  }
+  if (node.properties) {
+    for (const [key, propSchema] of Object.entries(node.properties as Record<string, any>)) {
+      collectEvalPathsNode(propSchema, `${path}.${key}`, compile, runtime);
+    }
+  }
+}

package/src/index.ts

@@ -21,6 +21,7 @@ export {
     type ParsedExportEntry,
     type ReExportSpec,
 } from "./flatten-for-analyzer.js";
+export { buildEvalPaths, evalPathCovers } from "./eval-paths.js";
 export { visitManifest } from "./manifest-visitor.js";
 export type {
     CelSiteEvent,

package/src/kernel-globals.ts

@@ -7,12 +7,12 @@ import { residualEntrySchemaMap } from "./residual-schema.js";
  * `buildTypedCelEnvironment` in cel-environment.ts (CEL type-checking)
  * must stay in sync with this list.
  *
- * Note: `env` is only available in the root module context. Child modules
- * loaded via Telo.Import do not receive host environment variables.
- * There is no `imports` namespace at runtime — import snapshots are stored
- * under `resources.<alias>`.
+ * Note: there is no `imports` namespace at runtime — import snapshots are
+ * stored under `resources.<alias>`. Host environment variables are reached
+ * by declaring a typed `variables:`/`secrets:` entry with an `env:` binding
+ * and referencing `variables.X` / `secrets.X`.
  */
-export const KERNEL_GLOBAL_NAMES = ["variables", "secrets", "resources", "ports", "env"] as const;
+export const KERNEL_GLOBAL_NAMES = ["variables", "secrets", "resources", "ports"] as const;
 
 const SYSTEM_KINDS = new Set([
   "Telo.Definition",
@@ -33,7 +33,6 @@ const SYSTEM_KINDS = new Set([
  *   in the outer module; Libraries are only relevant when the caller scoped
  *   the manifest list to a single library's file.
  * - `resources`: enumerates all non-system resource names
- * - `env`: dynamic (runtime env vars, root module only)
  */
 export function buildKernelGlobalsSchema(
   manifests: ResourceManifest[],
@@ -68,7 +67,6 @@ export function buildKernelGlobalsSchema(
         additionalProperties: false,
       },
       ports: buildPortsSchema(moduleManifest?.ports),
-      env: { type: "object", additionalProperties: true },
     },
   };
 }
@@ -117,7 +115,7 @@ function buildSchemaMapSchema(
 
 /**
  * Merge kernel globals into an `x-telo-context` schema so chain-access
- * validation recognises `variables`, `secrets`, `resources`, `env`
+ * validation recognises `variables`, `secrets`, `resources`, `ports`
  * without module authors having to re-declare them.
  *
  * Context-specific properties take precedence over globals (spread order).

package/src/reconcile-module-versions.ts

@@ -177,16 +177,10 @@ function hoistDiagnostic(
       data,
     };
   }
-  return {
-    severity: DiagnosticSeverity.Warning,
-    code: "MODULE_VERSION_HOISTED",
-    source: SOURCE,
-    message:
-      `Module '${identity}@${loser.version || "<unknown>"}' was hoisted to '${winner.version}' ` +
-      `because the same module is imported at the higher version elsewhere in the graph. ` +
-      `Pre-1.0 versions are additive, so the higher version is used for every importer.`,
-    data,
-  };
+  // Same-major hoist to a higher version: additive pre-1.0, so the redirect is
+  // non-lossy and by design — resolve to the winner silently, like a package
+  // manager picking the highest compatible version of a transitive dep.
+  return null;
 }
 
 /**

package/src/validate-cel-context.ts

@@ -396,6 +396,45 @@ export function extractContextsFromSchema(
   return all.sort((a, b) => b.scope.length - a.scope.length);
 }
 
+/** Schema keys that declare a CEL-bearing region: a field carrying any of these
+ *  is evaluated at runtime, so a `!cel` inside it (or a descendant) is live. */
+const CEL_REGION_KEYS = [
+  "x-telo-context",
+  "x-telo-step-context",
+  "x-telo-error-context",
+] as const;
+
+/**
+ * Walk a JSON Schema tree and collect the JSONPath scopes of every field that
+ * declares a CEL-bearing region (`x-telo-context` / `x-telo-step-context` /
+ * `x-telo-error-context`). Used — alongside `x-telo-eval` paths — to decide
+ * whether a `!cel` expression sits in a slot the runtime actually evaluates.
+ * Scopes use the same `$.a.b[*]` form as `extractContextsFromSchema`, matched
+ * against expression paths with `pathMatchesScope`.
+ */
+export function extractCelRegionScopes(schema: Record<string, any>, path = "$"): string[] {
+  if (!schema || typeof schema !== "object") return [];
+  const out: string[] = [];
+
+  if (CEL_REGION_KEYS.some((k) => schema[k])) out.push(path);
+
+  if (schema.properties) {
+    for (const [key, value] of Object.entries(schema.properties as Record<string, any>)) {
+      out.push(...extractCelRegionScopes(value, `${path}.${key}`));
+    }
+  }
+  if (schema.items && typeof schema.items === "object") {
+    out.push(...extractCelRegionScopes(schema.items, `${path}[*]`));
+  }
+  for (const key of ["oneOf", "anyOf", "allOf"] as const) {
+    if (Array.isArray(schema[key])) {
+      for (const subschema of schema[key]) out.push(...extractCelRegionScopes(subschema, path));
+    }
+  }
+
+  return out;
+}
+
 function collectContexts(
   schema: Record<string, any>,
   path: string,