@telorun/analyzer 0.32.0 → 0.34.0

package/dist/extends-resolution.js

@@ -0,0 +1,82 @@
+import { mergeTypeSchemas } from "@telorun/sdk";
+const body = (def) => (def ?? {});
+/** The definition a given definition directly `extends`, or undefined when it
+ *  extends nothing / the target can't be resolved. */
+export function resolveParent(def, resolve) {
+    const ext = body(def).extends;
+    if (typeof ext !== "string" || ext.length === 0)
+        return undefined;
+    return resolve(ext);
+}
+/** The `extends` ancestor chain, nearest-first, excluding `def` itself.
+ *  Cycle-guarded so a malformed self/mutual `extends` can't loop forever. */
+export function ancestorChain(def, resolve) {
+    const chain = [];
+    const seen = new Set();
+    let cur = resolveParent(def, resolve);
+    while (cur && !seen.has(cur)) {
+        seen.add(cur);
+        chain.push(cur);
+        cur = resolveParent(cur, resolve);
+    }
+    return chain;
+}
+/** True when a definition carries its own controller (`controllers:`) or a
+ *  template body (`invoke:` / `run:` / `provide:` / `mount:` / `resources:`). */
+export function hasOwnControllerOrTemplate(def) {
+    const d = body(def);
+    return !!((d.controllers && d.controllers.length) ||
+        d.invoke ||
+        d.run ||
+        d.provide ||
+        d.mount ||
+        d.resources);
+}
+/** The nearest concrete ancestor that provides a controller (own `controllers:`
+ *  or a template body) — the definition whose controller an inherited child
+ *  delegates to. Undefined when no controller-bearing concrete ancestor exists. */
+export function controllerBearingAncestor(def, resolve) {
+    for (const a of ancestorChain(def, resolve)) {
+        if (a.kind === "Telo.Abstract")
+            continue;
+        if (hasOwnControllerOrTemplate(a))
+            return a;
+    }
+    return undefined;
+}
+/** True when this definition inherits its controller by delegation: it declares
+ *  `extends`, has no own controller/template body, and its nearest concrete
+ *  ancestor is controller-bearing. */
+export function isInheritedDelegation(def, resolve) {
+    if (!body(def).extends || hasOwnControllerOrTemplate(def))
+        return false;
+    return controllerBearingAncestor(def, resolve) !== undefined;
+}
+/** The effective (possibly inherited) capability: the nearest self-or-ancestor
+ *  that declares a `capability`. Undefined when none in the chain does. */
+export function inheritedCapability(def, resolve) {
+    if (body(def).capability)
+        return body(def).capability;
+    for (const a of ancestorChain(def, resolve)) {
+        if (body(a).capability)
+            return body(a).capability;
+    }
+    return undefined;
+}
+/** The author-facing schema for a definition:
+ *  - with `base:` present → the definition's **own** schema (the parent's config
+ *    fields are internal, set solely through `base:`).
+ *  - without `base:` but with `extends` → `merge(parent-effective, own)` (a pure
+ *    additive extension; child overrides on key conflicts), reusing the same
+ *    `mergeTypeSchemas` that `Type.JsonSchema.extends` uses.
+ *  - no `extends` → the own schema unchanged. */
+export function effectiveAuthorSchema(def, resolve) {
+    const own = (body(def).schema ?? {});
+    const parent = resolveParent(def, resolve);
+    if (!parent)
+        return own;
+    if (body(def).base)
+        return own;
+    const parentSchema = effectiveAuthorSchema(parent, resolve);
+    return mergeTypeSchemas([parentSchema, own]);
+}

package/dist/index.d.ts

@@ -4,6 +4,10 @@ export { StaticAnalyzer } from "./analyzer.js";
 export type { GraphLoadError, ImportEdge, LoadedFile, LoadedGraph, LoadedModule, ParseError, } from "./loaded-types.js";
 export { flattenForAnalyzer, flattenLoadedModule, forwardReExportManifests, parseExportEntry, reExportSpecsFromExports, resolveExportedKinds, selectModuleManifestsForAnalysis, stampReExportedKinds, type ParsedExportEntry, type ReExportSpec, } from "./flatten-for-analyzer.js";
 export { buildEvalPaths, evalPathCovers } from "./eval-paths.js";
+export { ancestorChain, controllerBearingAncestor, effectiveAuthorSchema, hasOwnControllerOrTemplate, inheritedCapability, isInheritedDelegation, resolveParent, } from "./extends-resolution.js";
+export type { DefResolver } from "./extends-resolution.js";
+export { buildReferenceFieldMap, isRefEntry, isScopeEntry } from "./reference-field-map.js";
+export type { ReferenceFieldMap, RefFieldEntry } from "./reference-field-map.js";
 export { visitManifest } from "./manifest-visitor.js";
 export type { CelSiteEvent, ManifestVisitor, RefSiteEvent, ResourceEnterEvent, ResourceExitEvent, ScopeBoundaryEvent, SchemaFromSiteEvent, VisitOptions, } from "./manifest-visitor.js";
 export { Loader } from "./manifest-loader.js";
@@ -21,7 +25,7 @@ export type { DocumentPosition } from "./position-metadata.js";
 export { HttpSource } from "./sources/http-source.js";
 export { RegistrySource } from "./sources/registry-source.js";
 export { defaultSources } from "./sources/default-sources.js";
-export { splitIntegrity, foldIntegrity, verifyIntegrity, verifiedFetch, sha256Base64Url, } from "./sources/integrity.js";
+export { splitIntegrity, foldIntegrity, verifyIntegrity, verifiedFetch, sha256Base64Url, IntegrityError, } from "./sources/integrity.js";
 export { parseModuleRef, isRegistryRef } from "./sources/module-ref.js";
 export type { ParsedModuleRef } from "./sources/module-ref.js";
 export { withSyntheticPositions } from "./with-synthetic-positions.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,aAAa,EACb,eAAe,EACf,aAAa,EACb,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,qBAAqB,EACrB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC5F,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,aAAa,EACb,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -2,6 +2,8 @@ export { AnalysisRegistry } from "./analysis-registry.js";
 export { StaticAnalyzer } from "./analyzer.js";
 export { flattenForAnalyzer, flattenLoadedModule, forwardReExportManifests, parseExportEntry, reExportSpecsFromExports, resolveExportedKinds, selectModuleManifestsForAnalysis, stampReExportedKinds, } from "./flatten-for-analyzer.js";
 export { buildEvalPaths, evalPathCovers } from "./eval-paths.js";
+export { ancestorChain, controllerBearingAncestor, effectiveAuthorSchema, hasOwnControllerOrTemplate, inheritedCapability, isInheritedDelegation, resolveParent, } from "./extends-resolution.js";
+export { buildReferenceFieldMap, isRefEntry, isScopeEntry } from "./reference-field-map.js";
 export { visitManifest } from "./manifest-visitor.js";
 export { Loader } from "./manifest-loader.js";
 export { isModuleKind, MODULE_KINDS } from "./module-kinds.js";
@@ -13,7 +15,7 @@ export { buildDocumentPositions, buildLineOffsets, buildPositionIndex, documentL
 export { HttpSource } from "./sources/http-source.js";
 export { RegistrySource } from "./sources/registry-source.js";
 export { defaultSources } from "./sources/default-sources.js";
-export { splitIntegrity, foldIntegrity, verifyIntegrity, verifiedFetch, sha256Base64Url, } from "./sources/integrity.js";
+export { splitIntegrity, foldIntegrity, verifyIntegrity, verifiedFetch, sha256Base64Url, IntegrityError, } from "./sources/integrity.js";
 export { parseModuleRef, isRegistryRef } from "./sources/module-ref.js";
 export { withSyntheticPositions } from "./with-synthetic-positions.js";
 export { DEFAULT_MANIFEST_FILENAME, DiagnosticSeverity } from "./types.js";

package/dist/sources/integrity.d.ts

@@ -5,6 +5,13 @@
  *  The fragment is authoritative across every transport: a source's `read()`
  *  hashes the fetched bytes and compares against it before the manifest is
  *  parsed or cached. A mismatch is a terminal error — never a cache miss. */
+/** A failed integrity/tamper check — always terminal, never best-effort. A
+ *  distinct type so a caller doing best-effort network handling (e.g. the
+ *  bundle extractor warning-and-skipping on a fetch blip) can still let a
+ *  tamper error propagate rather than swallow it. */
+export declare class IntegrityError extends Error {
+    constructor(message: string);
+}
 /** Split a trailing integrity fragment off a ref/URL. Returns the bare ref in
  *  `base` (safe to build fetch URLs and cache paths from) and the fragment in
  *  `integrity` (e.g. `sha256-<base64url>`), or `undefined` when absent. */

package/dist/sources/integrity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integrity.d.ts","sourceRoot":"","sources":["../../src/sources/integrity.ts"],"names":[],"mappings":"AAAA;;;;;;6EAM6E;AAO7E;;2EAE2E;AAC3E,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAIhF;AAED;;;kFAGkF;AAClF,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,CAIxE;AAcD,iFAAiF;AACjF,wBAAsB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAOxE;AAED;;gFAEgF;AAChF,wBAAsB,eAAe,CACnC,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAkBf;AAED;;;;sCAIsC;AACtC,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAU9C"}
+{"version":3,"file":"integrity.d.ts","sourceRoot":"","sources":["../../src/sources/integrity.ts"],"names":[],"mappings":"AAAA;;;;;;6EAM6E;AAO7E;;;qDAGqD;AACrD,qBAAa,cAAe,SAAQ,KAAK;gBAC3B,OAAO,EAAE,MAAM;CAI5B;AAED;;2EAE2E;AAC3E,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAIhF;AAED;;;kFAGkF;AAClF,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,CAIxE;AAcD,iFAAiF;AACjF,wBAAsB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAOxE;AAED;;gFAEgF;AAChF,wBAAsB,eAAe,CACnC,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAkBf;AAED;;;;sCAIsC;AACtC,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAU9C"}

package/dist/sources/integrity.js

@@ -9,6 +9,16 @@
  *  fragments (rare in module refs) pass through untouched. `sha256` is the
  *  only algorithm accepted today; the prefix leaves room to migrate. */
 const INTEGRITY_FRAGMENT = /#(sha256-[A-Za-z0-9_+/=-]+)$/;
+/** A failed integrity/tamper check — always terminal, never best-effort. A
+ *  distinct type so a caller doing best-effort network handling (e.g. the
+ *  bundle extractor warning-and-skipping on a fetch blip) can still let a
+ *  tamper error propagate rather than swallow it. */
+export class IntegrityError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "IntegrityError";
+    }
+}
 /** Split a trailing integrity fragment off a ref/URL. Returns the bare ref in
  *  `base` (safe to build fetch URLs and cache paths from) and the fragment in
  *  `integrity` (e.g. `sha256-<base64url>`), or `undefined` when absent. */
@@ -55,12 +65,12 @@ export async function verifyIntegrity(bytes, integrity, describe) {
     const algorithm = dash > 0 ? integrity.slice(0, dash) : "";
     const expected = dash > 0 ? integrity.slice(dash + 1) : "";
     if (algorithm !== "sha256") {
-        throw new Error(`Unsupported integrity algorithm '${algorithm || integrity}' for ${describe}. ` +
+        throw new IntegrityError(`Unsupported integrity algorithm '${algorithm || integrity}' for ${describe}. ` +
             `Only sha256 is supported (sha256-<base64url>).`);
     }
     const actual = await sha256Base64Url(bytes);
     if (actual !== normalizeDigest(expected)) {
-        throw new Error(`Integrity check failed for ${describe}: expected sha256-${normalizeDigest(expected)}, ` +
+        throw new IntegrityError(`Integrity check failed for ${describe}: expected sha256-${normalizeDigest(expected)}, ` +
             `got sha256-${actual}. The fetched bytes do not match the recorded hash — ` +
             `the module may have been tampered with or republished.`);
     }

package/dist/sources/module-ref.d.ts

@@ -7,8 +7,12 @@ export interface ParsedModuleRef {
     integrity?: string;
 }
 /** True when `url` has the bare registry-ref shape `namespace/name@version`
- *  (no scheme, no leading `/` or `.`, contains both `@` and `/`). The integrity
- *  fragment, if any, does not affect the classification. */
+ *  (no scheme of any kind, no leading `/` or `.`, contains both `@` and `/`).
+ *  The integrity fragment, if any, does not affect the classification.
+ *
+ *  A registry ref never carries a `scheme://` — that guard is what keeps an
+ *  `oci://…@ver` (or future `s3://…`) ref from being misrouted here, so a
+ *  scheme-owning transport claims it instead. */
 export declare function isRegistryRef(url: string): boolean;
 /** Canonical parser for `namespace/name@version[#sha256-...]` refs. The single
  *  source of truth shared by the registry source, the kernel manifest cache,

package/dist/sources/module-ref.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module-ref.d.ts","sourceRoot":"","sources":["../../src/sources/module-ref.ts"],"names":[],"mappings":"AAEA;;yDAEyD;AACzD,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;4DAE4D;AAC5D,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAYlD;AAED;;2EAE2E;AAC3E,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAgB3D"}
+{"version":3,"file":"module-ref.d.ts","sourceRoot":"","sources":["../../src/sources/module-ref.ts"],"names":[],"mappings":"AAEA;;yDAEyD;AACzD,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;iDAMiD;AACjD,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CASlD;AAED;;2EAE2E;AAC3E,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAgB3D"}

package/dist/sources/module-ref.js

@@ -1,15 +1,16 @@
 import { splitIntegrity } from "./integrity.js";
 /** True when `url` has the bare registry-ref shape `namespace/name@version`
- *  (no scheme, no leading `/` or `.`, contains both `@` and `/`). The integrity
- *  fragment, if any, does not affect the classification. */
+ *  (no scheme of any kind, no leading `/` or `.`, contains both `@` and `/`).
+ *  The integrity fragment, if any, does not affect the classification.
+ *
+ *  A registry ref never carries a `scheme://` — that guard is what keeps an
+ *  `oci://…@ver` (or future `s3://…`) ref from being misrouted here, so a
+ *  scheme-owning transport claims it instead. */
 export function isRegistryRef(url) {
     const { base } = splitIntegrity(url);
-    return (!base.startsWith("http://") &&
-        !base.startsWith("https://") &&
+    return (!base.includes("://") &&
         !base.startsWith("/") &&
         !base.startsWith(".") &&
-        !base.startsWith("file://") &&
-        !base.startsWith("memory://") &&
         base.includes("@") &&
         base.includes("/"));
 }

package/dist/validate-base-mapping.d.ts

@@ -0,0 +1,21 @@
+import type { ResourceManifest } from "@telorun/sdk";
+import type { AliasResolver } from "./alias-resolver.js";
+import type { DefinitionRegistry } from "./definition-registry.js";
+import { type AnalysisDiagnostic } from "./types.js";
+/**
+ * Phase 3c — Static validation of a definition's `base:` construction mapping
+ * against the parent kind's config schema. The kernel evaluates `base:` and
+ * passes the result to the inherited controller's `create()`, which validates it
+ * at boot; this mirrors that check statically so an omitted required field or a
+ * wrong literal type surfaces at `telo check`, not first boot.
+ *
+ * Diagnostics:
+ *  - BASE_MISSING_REQUIRED: `base:` omits a field the parent schema requires.
+ *  - BASE_UNKNOWN_FIELD: `base:` sets a field the parent schema (with
+ *    `additionalProperties: false`) does not declare.
+ *  - BASE_SCHEMA_MISMATCH: a CEL-free `base:` value violates the parent field's
+ *    schema (wrong type / constraint). CEL-bearing values are skipped — their
+ *    runtime value is unknown — but still count as present for required checks.
+ */
+export declare function validateBaseMapping(manifests: ResourceManifest[], registry: DefinitionRegistry, aliases: AliasResolver): AnalysisDiagnostic[];
+//# sourceMappingURL=validate-base-mapping.d.ts.map

package/dist/validate-base-mapping.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-base-mapping.d.ts","sourceRoot":"","sources":["../src/validate-base-mapping.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAezE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,GACrB,kBAAkB,EAAE,CAwCtB"}

package/dist/validate-base-mapping.js

@@ -0,0 +1,130 @@
+import { isCompiledValue } from "@telorun/sdk";
+import { effectiveAuthorSchema, resolveParent } from "./extends-resolution.js";
+import { DiagnosticSeverity } from "./types.js";
+const SOURCE = "telo-analyzer";
+/** True when a value subtree contains a compiled CEL leaf — such a value can
+ *  produce anything at runtime, so its type is not statically checkable. */
+function containsCel(value) {
+    if (isCompiledValue(value))
+        return true;
+    if (Array.isArray(value))
+        return value.some(containsCel);
+    if (value && typeof value === "object") {
+        return Object.values(value).some(containsCel);
+    }
+    return false;
+}
+/**
+ * Phase 3c — Static validation of a definition's `base:` construction mapping
+ * against the parent kind's config schema. The kernel evaluates `base:` and
+ * passes the result to the inherited controller's `create()`, which validates it
+ * at boot; this mirrors that check statically so an omitted required field or a
+ * wrong literal type surfaces at `telo check`, not first boot.
+ *
+ * Diagnostics:
+ *  - BASE_MISSING_REQUIRED: `base:` omits a field the parent schema requires.
+ *  - BASE_UNKNOWN_FIELD: `base:` sets a field the parent schema (with
+ *    `additionalProperties: false`) does not declare.
+ *  - BASE_SCHEMA_MISMATCH: a CEL-free `base:` value violates the parent field's
+ *    schema (wrong type / constraint). CEL-bearing values are skipped — their
+ *    runtime value is unknown — but still count as present for required checks.
+ */
+export function validateBaseMapping(manifests, registry, aliases) {
+    const diagnostics = [];
+    const resolveDef = (k) => registry.resolve(aliases.resolveKind(k) ?? k) ?? registry.resolve(k);
+    const importedModules = new Set();
+    for (const m of manifests) {
+        if (m.kind !== "Telo.Import")
+            continue;
+        const resolved = m.metadata?.resolvedModuleName;
+        if (resolved)
+            importedModules.add(resolved);
+    }
+    for (const m of manifests) {
+        if (m.kind !== "Telo.Definition")
+            continue;
+        const base = m.base;
+        if (!base || typeof base !== "object" || Array.isArray(base))
+            continue;
+        const name = m.metadata?.name;
+        if (!name)
+            continue;
+        const ownModule = m.metadata?.module;
+        if (ownModule && importedModules.has(ownModule))
+            continue;
+        const parent = resolveParent(m, resolveDef);
+        // Missing / unresolved `extends` is already reported by validateExtends.
+        if (!parent)
+            continue;
+        const parentSchema = effectiveAuthorSchema(parent, resolveDef);
+        if (!parentSchema || typeof parentSchema !== "object")
+            continue;
+        const filePath = m.metadata?.source;
+        const resource = { kind: m.kind, name };
+        const label = `${m.kind}/${name}`;
+        checkObject(base, parentSchema, "base", {
+            diagnostics,
+            registry,
+            label,
+            resource,
+            filePath,
+        });
+    }
+    return diagnostics;
+}
+function checkObject(value, schema, path, ctx) {
+    const properties = (schema.properties ?? {});
+    const required = Array.isArray(schema.required) ? schema.required : [];
+    const additionalFalse = schema.additionalProperties === false;
+    for (const req of required) {
+        if (!(req in value)) {
+            ctx.diagnostics.push({
+                severity: DiagnosticSeverity.Error,
+                code: "BASE_MISSING_REQUIRED",
+                source: SOURCE,
+                message: `${ctx.label}: '${path}' does not set required parent field '${req}'.`,
+                data: { resource: ctx.resource, filePath: ctx.filePath, path },
+            });
+        }
+    }
+    for (const [key, fieldValue] of Object.entries(value)) {
+        const fieldPath = `${path}.${key}`;
+        const propSchema = properties[key];
+        if (!propSchema) {
+            if (additionalFalse) {
+                ctx.diagnostics.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: "BASE_UNKNOWN_FIELD",
+                    source: SOURCE,
+                    message: `${ctx.label}: '${fieldPath}' is not a field of the parent kind's schema.`,
+                    data: { resource: ctx.resource, filePath: ctx.filePath, path: fieldPath },
+                });
+            }
+            continue;
+        }
+        // A CEL-bearing value produces its shape at runtime — not statically
+        // checkable. Recurse into a partially-CEL nested object so its literal
+        // sub-fields still get validated; fully-literal values validate directly.
+        if (containsCel(fieldValue)) {
+            if (fieldValue &&
+                typeof fieldValue === "object" &&
+                !Array.isArray(fieldValue) &&
+                !isCompiledValue(fieldValue) &&
+                propSchema.type === "object" &&
+                propSchema.properties) {
+                checkObject(fieldValue, propSchema, fieldPath, ctx);
+            }
+            continue;
+        }
+        const issues = ctx.registry.validateWithRefs(fieldValue, propSchema);
+        for (const issue of issues) {
+            ctx.diagnostics.push({
+                severity: DiagnosticSeverity.Error,
+                code: "BASE_SCHEMA_MISMATCH",
+                source: SOURCE,
+                message: `${ctx.label}: '${fieldPath}' does not match the parent field's schema: ${issue}`,
+                data: { resource: ctx.resource, filePath: ctx.filePath, path: fieldPath },
+            });
+        }
+    }
+}

package/dist/validate-extends.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-extends.d.ts","sourceRoot":"","sources":["../src/validate-extends.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAOzE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,GACrB,kBAAkB,EAAE,CA4ItB"}
+{"version":3,"file":"validate-extends.d.ts","sourceRoot":"","sources":["../src/validate-extends.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAOzE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,GACrB,kBAAkB,EAAE,CAwJtB"}

package/dist/validate-extends.js

@@ -1,3 +1,4 @@
+import { inheritedCapability } from "./extends-resolution.js";
 import { DiagnosticSeverity } from "./types.js";
 const SOURCE = "telo-analyzer";
 /** Alias-form pattern for `extends`: "<Alias>.<AbstractName>", two PascalCase segments. */
@@ -114,15 +115,25 @@ export function validateExtends(manifests, registry, aliases) {
                                 data: { resource, filePath, path: "extends" },
                             });
                         }
-                        else if (targetDef.kind !== "Telo.Abstract") {
-                            diagnostics.push({
-                                severity: DiagnosticSeverity.Error,
-                                code: "EXTENDS_NON_ABSTRACT",
-                                source: SOURCE,
-                                message: `${label}: 'extends' target '${extendsValue}' (resolved: '${canonical}') is a ${targetDef.kind}, not a Telo.Abstract. ` +
-                                    `Only Telo.Abstract declarations may be extended.`,
-                                data: { resource, filePath, path: "extends" },
-                            });
+                        else {
+                            // General single inheritance: any concrete or abstract kind may be
+                            // extended. What inheritance must NOT do is change the lifecycle
+                            // role — a child that restates `capability` differently from an
+                            // ancestor is a hard error (no silent capability change).
+                            const resolveDef = (k) => registry.resolve(aliases.resolveKind(k) ?? k) ?? registry.resolve(k);
+                            const ownCap = m.capability;
+                            const ownCapResolved = typeof ownCap === "string" ? aliases.resolveKind(ownCap) ?? ownCap : undefined;
+                            const ancestorCap = inheritedCapability(targetDef, resolveDef);
+                            if (ownCapResolved && ancestorCap && ownCapResolved !== ancestorCap) {
+                                diagnostics.push({
+                                    severity: DiagnosticSeverity.Error,
+                                    code: "EXTENDS_CAPABILITY_MISMATCH",
+                                    source: SOURCE,
+                                    message: `${label}: declares 'capability: ${ownCap}' but extends '${extendsValue}' whose inherited capability is '${ancestorCap}'. ` +
+                                        `Capability is inherited and immutable — omit 'capability' or restate it identically.`,
+                                    data: { resource, filePath, path: "capability" },
+                                });
+                            }
                         }
                     }
                 }

package/dist/validate-kind-descriptions.d.ts

@@ -0,0 +1,20 @@
+import type { ResourceManifest } from "@telorun/sdk";
+import { type AnalysisDiagnostic } from "./types.js";
+/**
+ * Warns when a library exports a kind (via `exports.kinds`) whose local
+ * `Telo.Definition` carries no `metadata.description`.
+ *
+ * The description is the primary human text the federated-discovery hub embeds
+ * for semantic search (`search_resources`), so an exported kind without one is
+ * undiscoverable by meaning. A warning (not an error) so the stdlib backfill is
+ * incremental and CI isn't blocked mid-migration.
+ *
+ * Scope: only kinds a library *exports* and *defines locally* are checked.
+ * Re-exported kinds (`exports.kinds: [Alias.Kind]`) belong to their owning
+ * module and are skipped; an exported name that isn't a local Telo.Definition
+ * (e.g. a Telo.Abstract) is skipped too. The check keys off the root library's
+ * own module doc, which is only present when that library is analyzed directly
+ * — so importing an under-described library never leaks warnings to its consumer.
+ */
+export declare function validateKindDescriptions(manifests: ResourceManifest[]): AnalysisDiagnostic[];
+//# sourceMappingURL=validate-kind-descriptions.d.ts.map

package/dist/validate-kind-descriptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-kind-descriptions.d.ts","sourceRoot":"","sources":["../src/validate-kind-descriptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,gBAAgB,EAAE,GAAG,kBAAkB,EAAE,CA2C5F"}

package/dist/validate-kind-descriptions.js

@@ -0,0 +1,65 @@
+import { DiagnosticSeverity } from "./types.js";
+const SOURCE = "telo-analyzer";
+/**
+ * Warns when a library exports a kind (via `exports.kinds`) whose local
+ * `Telo.Definition` carries no `metadata.description`.
+ *
+ * The description is the primary human text the federated-discovery hub embeds
+ * for semantic search (`search_resources`), so an exported kind without one is
+ * undiscoverable by meaning. A warning (not an error) so the stdlib backfill is
+ * incremental and CI isn't blocked mid-migration.
+ *
+ * Scope: only kinds a library *exports* and *defines locally* are checked.
+ * Re-exported kinds (`exports.kinds: [Alias.Kind]`) belong to their owning
+ * module and are skipped; an exported name that isn't a local Telo.Definition
+ * (e.g. a Telo.Abstract) is skipped too. The check keys off the root library's
+ * own module doc, which is only present when that library is analyzed directly
+ * — so importing an under-described library never leaks warnings to its consumer.
+ */
+export function validateKindDescriptions(manifests) {
+    const diagnostics = [];
+    // Local Telo.Definition docs keyed by `<module>/<name>`.
+    const definitions = new Map();
+    for (const m of manifests) {
+        if (m.kind !== "Telo.Definition")
+            continue;
+        const name = m.metadata?.name;
+        const mod = m.metadata?.module;
+        if (name && mod)
+            definitions.set(`${mod}/${name}`, m);
+    }
+    for (const m of manifests) {
+        if (m.kind !== "Telo.Library")
+            continue;
+        const moduleName = m.metadata?.name;
+        if (!moduleName)
+            continue;
+        const exportedKinds = m.exports?.kinds;
+        if (!Array.isArray(exportedKinds))
+            continue;
+        for (const entry of exportedKinds) {
+            // Re-export (`Alias.Kind`) — the owning module owns its description.
+            if (typeof entry !== "string" || entry.includes("."))
+                continue;
+            const def = definitions.get(`${moduleName}/${entry}`);
+            if (!def)
+                continue; // not a local Telo.Definition (e.g. an abstract)
+            const description = def.metadata?.description;
+            if (typeof description === "string" && description.trim() !== "")
+                continue;
+            diagnostics.push({
+                severity: DiagnosticSeverity.Warning,
+                code: "KIND_MISSING_DESCRIPTION",
+                source: SOURCE,
+                message: `${moduleName}.${entry}: exported kind has no 'metadata.description'. Add a one-line ` +
+                    `description — it is the primary text indexed for semantic discovery (search_resources).`,
+                data: {
+                    resource: { kind: "Telo.Definition", name: entry },
+                    filePath: def.metadata?.source,
+                    path: "metadata.description",
+                },
+            });
+        }
+    }
+    return diagnostics;
+}

package/dist/validate-provider-coherence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-provider-coherence.d.ts","sourceRoot":"","sources":["../src/validate-provider-coherence.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,GACrB,kBAAkB,EAAE,CAsNtB"}
+{"version":3,"file":"validate-provider-coherence.d.ts","sourceRoot":"","sources":["../src/validate-provider-coherence.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,GACrB,kBAAkB,EAAE,CA+NtB"}

package/dist/validate-provider-coherence.js

@@ -1,3 +1,4 @@
+import { controllerBearingAncestor } from "./extends-resolution.js";
 import { DiagnosticSeverity } from "./types.js";
 const SOURCE = "telo-analyzer";
 /**
@@ -214,7 +215,13 @@ export function validateProviderCoherence(manifests, registry, aliases) {
                 }
             }
         }
-        if (capability === "Telo.Provider" && !hasControllers && !hasProvide) {
+        // A definition that inherits a controller by delegation (concrete `extends`,
+        // no own controller/template) satisfies the implementation requirement
+        // through its parent — `base:` supplies the parent's config.
+        const resolveDef = (k) => registry.resolve(aliases.resolveKind(k) ?? k) ?? registry.resolve(k);
+        const inheritsController = typeof md.extends === "string" &&
+            controllerBearingAncestor(m, resolveDef) !== undefined;
+        if (capability === "Telo.Provider" && !hasControllers && !hasProvide && !inheritsController) {
             diagnostics.push({
                 severity: DiagnosticSeverity.Error,
                 code: "PROVIDER_MISSING_IMPLEMENTATION",

package/dist/validate-references.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-references.d.ts","sourceRoot":"","sources":["../src/validate-references.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAMrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA4C/F;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,GACvB,kBAAkB,EAAE,CA6ctB"}
+{"version":3,"file":"validate-references.d.ts","sourceRoot":"","sources":["../src/validate-references.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAMrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAgD/F;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,GACvB,kBAAkB,EAAE,CA6ctB"}

package/dist/validate-references.js

@@ -21,20 +21,26 @@ function checkKind(kind, entry, registry, aliases) {
         const targetDef = registry.resolve(targetKind);
         if (!targetDef)
             return [];
+        // Liskov substitutability: a value satisfies the slot when it transitively
+        // extends the target kind, or — for a CONCRETE target — IS that kind.
+        // `getByExtends` is the same transitive subtype index for abstract and
+        // concrete targets alike; an abstract is satisfied only by an implementer,
+        // never by the abstract kind itself (which is non-instantiable).
+        if (targetDef.kind !== "Telo.Abstract" && resolved === targetKind)
+            return [];
+        const subtypes = registry.getByExtends(targetKind);
+        const subtypeKinds = new Set(subtypes.map((d) => `${d.metadata.module}.${d.metadata.name}`));
+        if (subtypeKinds.has(resolved))
+            return [];
         if (targetDef.kind === "Telo.Abstract") {
-            const implementing = registry.getByExtends(targetKind);
-            if (implementing.length === 0)
+            if (subtypes.length === 0)
                 return []; // partial context — no implementations loaded yet
-            const implementingKinds = new Set(implementing.map((d) => `${d.metadata.module}.${d.metadata.name}`));
-            if (implementingKinds.has(resolved))
-                return [];
-            const options = [...implementingKinds].join(", ");
+            const options = [...subtypeKinds].join(", ");
             errors.push(`'${kind}' does not implement '${targetKind}' (known implementations: ${options})`);
         }
         else {
-            if (resolved === targetKind)
-                return [];
-            errors.push(`'${kind}' (resolved: '${resolved}') does not match required '${targetKind}'`);
+            const options = subtypeKinds.size > 0 ? ` or a subtype (${[...subtypeKinds].join(", ")})` : "";
+            errors.push(`'${kind}' (resolved: '${resolved}') does not match required '${targetKind}'${options}`);
         }
     }
     return errors;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.32.0",
+  "version": "0.34.0",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",
@@ -42,13 +42,13 @@
     "ajv-formats": "^3.0.1",
     "jsonpath-plus": "^10.3.0",
     "yaml": "^2.8.3",
-    "@telorun/templating": "0.10.0"
+    "@telorun/templating": "0.10.1"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",
     "typescript": "^5.0.0",
     "vitest": "^2.1.8",
-    "@telorun/sdk": "0.41.0"
+    "@telorun/sdk": "0.44.0"
   },
   "peerDependencies": {
     "@telorun/sdk": "*"