@telorun/analyzer 0.34.0 → 0.35.0

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAoB9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAwxB/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAmzBvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAmBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAoB9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAuxB/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAgzBvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAmBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -22,7 +22,6 @@ import { buildEvalPaths, evalPathsCover } from "./eval-paths.js";
 import { validateExtends } from "./validate-extends.js";
 import { validateBaseMapping } from "./validate-base-mapping.js";
 import { validateNestedInlineResources } from "./validate-nested-inline.js";
-import { validateKindDescriptions } from "./validate-kind-descriptions.js";
 import { validateProviderCoherence } from "./validate-provider-coherence.js";
 import { validateReferences } from "./validate-references.js";
 import { validateReferenceForms } from "./validate-reference-forms.js";
@@ -1383,8 +1382,6 @@ export class StaticAnalyzer {
         diagnostics.push(...validateBaseMapping(allManifests, defs, aliases));
         // Validate provider coherence rules for `provide:` template-target definitions.
         diagnostics.push(...validateProviderCoherence(allManifests, defs, aliases));
-        // Warn about exported kinds lacking a metadata.description (semantic-search input).
-        diagnostics.push(...validateKindDescriptions(allManifests));
         // Validate throws: declarations and catches: coverage (rules 1, 2, 4, 7)
         diagnostics.push(...validateThrowsCoverage(allManifests, defs, aliases, this.celEnv, aliasesByModule, rootModules));
         // Warn about declared variables / secrets / ports that no CEL references.

package/dist/index.d.ts

@@ -28,6 +28,10 @@ export { defaultSources } from "./sources/default-sources.js";
 export { splitIntegrity, foldIntegrity, verifyIntegrity, verifiedFetch, sha256Base64Url, IntegrityError, } from "./sources/integrity.js";
 export { parseModuleRef, isRegistryRef } from "./sources/module-ref.js";
 export type { ParsedModuleRef } from "./sources/module-ref.js";
+export { OCI_SCHEME, isOciRef, parseOciRef } from "./sources/oci-ref.js";
+export type { ParsedOciRef } from "./sources/oci-ref.js";
+export { MANIFEST_CACHE_BASE_URL, ManifestCacheSource, manifestCacheKey, manifestCacheUrl, ociManifestCacheCoords, } from "./sources/manifest-cache.js";
+export type { ManifestCacheCoords } from "./sources/manifest-cache.js";
 export { withSyntheticPositions } from "./with-synthetic-positions.js";
 export { DEFAULT_MANIFEST_FILENAME, DiagnosticSeverity } from "./types.js";
 export type { AnalysisDiagnostic, AnalysisOptions, LoaderInitOptions, LoadOptions, ManifestSource, Position, PositionIndex, Range } from "./types.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,qBAAqB,EACrB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC5F,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,aAAa,EACb,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,qBAAqB,EACrB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC5F,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,aAAa,EACb,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -17,5 +17,7 @@ export { RegistrySource } from "./sources/registry-source.js";
 export { defaultSources } from "./sources/default-sources.js";
 export { splitIntegrity, foldIntegrity, verifyIntegrity, verifiedFetch, sha256Base64Url, IntegrityError, } from "./sources/integrity.js";
 export { parseModuleRef, isRegistryRef } from "./sources/module-ref.js";
+export { OCI_SCHEME, isOciRef, parseOciRef } from "./sources/oci-ref.js";
+export { MANIFEST_CACHE_BASE_URL, ManifestCacheSource, manifestCacheKey, manifestCacheUrl, ociManifestCacheCoords, } from "./sources/manifest-cache.js";
 export { withSyntheticPositions } from "./with-synthetic-positions.js";
 export { DEFAULT_MANIFEST_FILENAME, DiagnosticSeverity } from "./types.js";

package/dist/sources/manifest-cache.d.ts

@@ -0,0 +1,48 @@
+import type { ManifestSource } from "../types.js";
+/** The hub's static manifest cache: an R2 bucket bound directly to the domain,
+ *  serving each tracked module version's `telo.yaml` at a deterministic key.
+ *  Read plane only — never artifact payloads; install/run stay origin-direct. */
+export declare const MANIFEST_CACHE_BASE_URL = "https://manifests.telo.sh";
+/** The location identity of one cached module version. Mirrors what the hub
+ *  stores per version — `{ transport, host, path, version }` — so the tracker's
+ *  write key and the editor's read key come from the same function and never
+ *  drift. `path` is the slash-separated repo/module path (multi-segment OCI
+ *  repos nest as prefixes). */
+export interface ManifestCacheCoords {
+    transport: string;
+    host: string;
+    path: string;
+    version: string;
+}
+/** Deterministic cache key for one module version:
+ *  `<transport>/<host>/<path…>/<version>/telo.yaml`. Returns `null` when any
+ *  coordinate is empty or would traverse out of the key space. */
+export declare function manifestCacheKey(coords: ManifestCacheCoords): string | null;
+/** Cache coordinates for an `oci://host/repo@tag` ref. Returns `null` when the
+ *  ref carries no explicit tag (a defaulted `latest` or a `sha256:` digest is
+ *  not addressable — the cache is keyed by the human version tag the tracker
+ *  enumerated). The inline `#sha256-…` fragment is tolerated and ignored. */
+export declare function ociManifestCacheCoords(ref: string): ManifestCacheCoords | null;
+/** Full cache URL for a ref or coordinates, or `null` when not addressable. */
+export declare function manifestCacheUrl(refOrCoords: string | ManifestCacheCoords, baseUrl?: string): string | null;
+/** Resolves `oci://` module refs against the hub's static manifest cache with a
+ *  plain CORS GET — a browser can't speak the OCI protocol, so this is the
+ *  browser-safe read path for OCI imports. A pinned ref (`#sha256-…`) is
+ *  verified against the fetched bytes, so a compromised cache can't mislead
+ *  analysis; an unpinned ref is analyzed on trust — the security boundary is
+ *  install/run (origin-direct, re-verified), not edit time. */
+export declare class ManifestCacheSource implements ManifestSource {
+    private readonly baseUrl;
+    constructor(baseUrl?: string);
+    supports(url: string): boolean;
+    read(ref: string): Promise<{
+        text: string;
+        source: string;
+    }>;
+    /** Mirror of the kernel OCI transport's resolution: normalize the repo to a
+     *  directory base so `../lib` under `oci://ghcr.io/aws/my-app` →
+     *  `oci://ghcr.io/aws/lib`. The tag is dropped — the caller re-pins from the
+     *  sibling's own version. Non-relative refs pass through. */
+    resolveRelative(base: string, relative: string): string;
+}
+//# sourceMappingURL=manifest-cache.d.ts.map

package/dist/sources/manifest-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-cache.d.ts","sourceRoot":"","sources":["../../src/sources/manifest-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAKlD;;iFAEiF;AACjF,eAAO,MAAM,uBAAuB,8BAA8B,CAAC;AAEnE;;;;+BAI+B;AAC/B,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAOD;;kEAEkE;AAClE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI,CAO3E;AAED;;;6EAG6E;AAC7E,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAY9E;AAID,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,GAAG,mBAAmB,EACzC,OAAO,GAAE,MAAgC,GACxC,MAAM,GAAG,IAAI,CAKf;AAED;;;;;+DAK+D;AAC/D,qBAAa,mBAAoB,YAAW,cAAc;IAC5C,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,GAAE,MAAgC;IAEtE,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAQxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAalE;;;iEAG6D;IAC7D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;CAOxD"}

package/dist/sources/manifest-cache.js

@@ -0,0 +1,91 @@
+import { DEFAULT_MANIFEST_FILENAME } from "../types.js";
+import { splitIntegrity, verifiedFetch } from "./integrity.js";
+import { OCI_SCHEME, isOciRef, parseOciRef } from "./oci-ref.js";
+/** The hub's static manifest cache: an R2 bucket bound directly to the domain,
+ *  serving each tracked module version's `telo.yaml` at a deterministic key.
+ *  Read plane only — never artifact payloads; install/run stay origin-direct. */
+export const MANIFEST_CACHE_BASE_URL = "https://manifests.telo.sh";
+/** True for a segment that would corrupt or escape the cache key space. */
+function invalidSegment(segment) {
+    return segment === "" || segment === "." || segment === ".." || segment.includes("\\");
+}
+/** Deterministic cache key for one module version:
+ *  `<transport>/<host>/<path…>/<version>/telo.yaml`. Returns `null` when any
+ *  coordinate is empty or would traverse out of the key space. */
+export function manifestCacheKey(coords) {
+    const { transport, host, path, version } = coords;
+    const segments = [transport, host, ...path.split("/"), version];
+    if (segments.some(invalidSegment) || transport.includes("/") || host.includes("/") || version.includes("/")) {
+        return null;
+    }
+    return `${segments.join("/")}/${DEFAULT_MANIFEST_FILENAME}`;
+}
+/** Cache coordinates for an `oci://host/repo@tag` ref. Returns `null` when the
+ *  ref carries no explicit tag (a defaulted `latest` or a `sha256:` digest is
+ *  not addressable — the cache is keyed by the human version tag the tracker
+ *  enumerated). The inline `#sha256-…` fragment is tolerated and ignored. */
+export function ociManifestCacheCoords(ref) {
+    if (!isOciRef(ref))
+        return null;
+    let parsed;
+    try {
+        parsed = parseOciRef(ref);
+    }
+    catch {
+        return null;
+    }
+    const { base } = splitIntegrity(ref);
+    const explicitTag = base.endsWith(`@${parsed.reference}`) && !parsed.reference.includes(":");
+    if (!explicitTag)
+        return null;
+    return { transport: "oci", host: parsed.host, path: parsed.repo, version: parsed.reference };
+}
+/** Full cache URL for a ref or coordinates, or `null` when not addressable. */
+export function manifestCacheUrl(refOrCoords, baseUrl = MANIFEST_CACHE_BASE_URL) {
+    const coords = typeof refOrCoords === "string" ? ociManifestCacheCoords(refOrCoords) : refOrCoords;
+    if (!coords)
+        return null;
+    const key = manifestCacheKey(coords);
+    return key ? `${baseUrl.replace(/\/+$/, "")}/${key}` : null;
+}
+/** Resolves `oci://` module refs against the hub's static manifest cache with a
+ *  plain CORS GET — a browser can't speak the OCI protocol, so this is the
+ *  browser-safe read path for OCI imports. A pinned ref (`#sha256-…`) is
+ *  verified against the fetched bytes, so a compromised cache can't mislead
+ *  analysis; an unpinned ref is analyzed on trust — the security boundary is
+ *  install/run (origin-direct, re-verified), not edit time. */
+export class ManifestCacheSource {
+    baseUrl;
+    constructor(baseUrl = MANIFEST_CACHE_BASE_URL) {
+        this.baseUrl = baseUrl;
+    }
+    supports(url) {
+        // Claim every oci:// ref, addressable or not — nothing else browser-safe
+        // can ever resolve one, so an untagged/digest ref must reach `read()`'s
+        // actionable error instead of falling through to a file-not-found from a
+        // local/HTTP source.
+        return isOciRef(url);
+    }
+    async read(ref) {
+        const { integrity } = splitIntegrity(ref);
+        const coords = ociManifestCacheCoords(ref);
+        const fetchUrl = coords && manifestCacheUrl(coords, this.baseUrl);
+        if (!fetchUrl) {
+            throw new Error(`Cannot resolve '${ref}' from the manifest cache — an oci:// import needs an explicit version tag (oci://host/repo@version)`);
+        }
+        const { text } = await verifiedFetch(fetchUrl, integrity, ref);
+        return { text, source: `${OCI_SCHEME}${coords.host}/${coords.path}@${coords.version}` };
+    }
+    /** Mirror of the kernel OCI transport's resolution: normalize the repo to a
+     *  directory base so `../lib` under `oci://ghcr.io/aws/my-app` →
+     *  `oci://ghcr.io/aws/lib`. The tag is dropped — the caller re-pins from the
+     *  sibling's own version. Non-relative refs pass through. */
+    resolveRelative(base, relative) {
+        if (!relative.startsWith(".") && !relative.startsWith("/"))
+            return relative;
+        const { host, repo } = parseOciRef(base);
+        const resolved = new URL(relative, `https://${host}/${repo}/`);
+        const newRepo = resolved.pathname.replace(/^\/+/, "");
+        return `${OCI_SCHEME}${host}/${newRepo}`;
+    }
+}

package/dist/sources/oci-ref.d.ts

@@ -0,0 +1,21 @@
+export declare const OCI_SCHEME = "oci://";
+/** A parsed `oci://host/repo@reference` module ref.
+ *
+ *  - `host` — the registry host (`ghcr.io`, `123.dkr.ecr.us-east-1.amazonaws.com`).
+ *  - `repo` — the repository path (`aws/telo-s3`), possibly multi-segment.
+ *  - `reference` — a tag (`1.2.0`) or a digest (`sha256:...`); the OCI address.
+ *  - `integrity` — Telo's inline `sha256-<base64url>` hash when the ref is pinned
+ *    (authoritative across transports; the OCI digest is only corroborating). */
+export interface ParsedOciRef {
+    host: string;
+    repo: string;
+    reference: string;
+    integrity?: string;
+}
+/** True when `ref` uses the `oci://` scheme (integrity fragment tolerated). */
+export declare function isOciRef(ref: string): boolean;
+/** Parse `oci://host/repo@reference[#sha256-...]`. Throws on a malformed ref.
+ *  A `reference` may be a tag or a `sha256:` digest; when absent (`@` omitted)
+ *  it defaults to `latest`, matching OCI tooling. */
+export declare function parseOciRef(ref: string): ParsedOciRef;
+//# sourceMappingURL=oci-ref.d.ts.map

package/dist/sources/oci-ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oci-ref.d.ts","sourceRoot":"","sources":["../../src/sources/oci-ref.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,UAAU,WAAW,CAAC;AAEnC;;;;;;iFAMiF;AACjF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,+EAA+E;AAC/E,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE7C;AAED;;qDAEqD;AACrD,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CA0BrD"}

package/dist/sources/oci-ref.js

@@ -0,0 +1,35 @@
+import { splitIntegrity } from "./integrity.js";
+export const OCI_SCHEME = "oci://";
+/** True when `ref` uses the `oci://` scheme (integrity fragment tolerated). */
+export function isOciRef(ref) {
+    return splitIntegrity(ref).base.startsWith(OCI_SCHEME);
+}
+/** Parse `oci://host/repo@reference[#sha256-...]`. Throws on a malformed ref.
+ *  A `reference` may be a tag or a `sha256:` digest; when absent (`@` omitted)
+ *  it defaults to `latest`, matching OCI tooling. */
+export function parseOciRef(ref) {
+    const { base, integrity } = splitIntegrity(ref);
+    if (!base.startsWith(OCI_SCHEME)) {
+        throw new Error(`Invalid OCI reference '${ref}', expected oci://host/repo@reference`);
+    }
+    const rest = base.slice(OCI_SCHEME.length);
+    const slash = rest.indexOf("/");
+    if (slash <= 0) {
+        throw new Error(`Invalid OCI reference '${ref}', missing repository path after host`);
+    }
+    const host = rest.slice(0, slash);
+    let repoAndRef = rest.slice(slash + 1);
+    let reference = "latest";
+    const at = repoAndRef.lastIndexOf("@");
+    // A digest reference is `repo@sha256:...` — the `@` before `sha256:` is the
+    // separator, not part of the repo. A tag reference has no `@`.
+    if (at > 0) {
+        reference = repoAndRef.slice(at + 1);
+        repoAndRef = repoAndRef.slice(0, at);
+    }
+    const repo = repoAndRef;
+    if (!host || !repo || !reference) {
+        throw new Error(`Invalid OCI reference '${ref}', expected oci://host/repo@reference`);
+    }
+    return { host, repo, reference, integrity };
+}

package/dist/validate-base-mapping.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-base-mapping.d.ts","sourceRoot":"","sources":["../src/validate-base-mapping.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAezE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,GACrB,kBAAkB,EAAE,CAwCtB"}
+{"version":3,"file":"validate-base-mapping.d.ts","sourceRoot":"","sources":["../src/validate-base-mapping.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAmBzE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,GACrB,kBAAkB,EAAE,CAwCtB"}

package/dist/validate-base-mapping.js

@@ -1,12 +1,18 @@
 import { isCompiledValue } from "@telorun/sdk";
+import { isTaggedSentinel } from "@telorun/templating";
 import { effectiveAuthorSchema, resolveParent } from "./extends-resolution.js";
 import { DiagnosticSeverity } from "./types.js";
 const SOURCE = "telo-analyzer";
-/** True when a value subtree contains a compiled CEL leaf — such a value can
- *  produce anything at runtime, so its type is not statically checkable. */
+/** True when a value subtree contains a CEL leaf — either a compiled CEL value
+ *  (post-precompile) or the raw `!cel` tagged sentinel the analyzer sees at
+ *  `telo check` time (this validator runs on the un-precompiled tree). Such a
+ *  value can produce anything at runtime, so its type is not statically
+ *  checkable. */
 function containsCel(value) {
     if (isCompiledValue(value))
         return true;
+    if (isTaggedSentinel(value) && value.engine === "cel")
+        return true;
     if (Array.isArray(value))
         return value.some(containsCel);
     if (value && typeof value === "object") {

package/dist/validate-throws-coverage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-throws-coverage.d.ts","sourceRoot":"","sources":["../src/validate-throws-coverage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAA0B,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAOnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AA4dzE,oDAAoD;AACpD,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,WAAW,EAChB,eAAe,GAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAa,EACvD,WAAW,GAAE,GAAG,CAAC,MAAM,CAAa,GACnC,kBAAkB,EAAE,CAkDtB"}
+{"version":3,"file":"validate-throws-coverage.d.ts","sourceRoot":"","sources":["../src/validate-throws-coverage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAA0B,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAOnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAoezE,oDAAoD;AACpD,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,WAAW,EAChB,eAAe,GAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAa,EACvD,WAAW,GAAE,GAAG,CAAC,MAAM,CAAa,GACnC,kBAAkB,EAAE,CAkDtB"}

package/dist/validate-throws-coverage.js

@@ -1,3 +1,4 @@
+import { isTaggedSentinel } from "@telorun/templating";
 import { scopeResolverForModule } from "./alias-resolver.js";
 import { createResolveCtx, resolveThrowsUnion, } from "./resolve-throws-union.js";
 import { DiagnosticSeverity } from "./types.js";
@@ -87,12 +88,18 @@ function resolveHandlerRef(sibling) {
  *  Parenthesised nestings of `||` over equality/in are flattened.
  *  Any non-matching sub-expression forfeits coverage for the whole `when:`. */
 function extractCoveredCodes(whenExpr, env) {
-    const match = whenExpr.match(/\$\{\{\s*([^}]+?)\s*\}\}/);
-    if (!match)
+    // The `when:` value is either a `!cel` TaggedSentinel (carrying the raw CEL
+    // source) or an inline `"${{ … }}"` string — both forms are load-equivalent.
+    const source = isTaggedSentinel(whenExpr) && whenExpr.engine === "cel"
+        ? whenExpr.source
+        : typeof whenExpr === "string"
+            ? whenExpr.match(/\$\{\{\s*([^}]+?)\s*\}\}/)?.[1]
+            : undefined;
+    if (!source)
         return { proven: false, codes: new Set() };
     let ast;
     try {
-        ast = env.parse(match[1].trim()).ast;
+        ast = env.parse(source.trim()).ast;
     }
     catch {
         return { proven: false, codes: new Set() };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.34.0",
+  "version": "0.35.0",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",

package/src/analyzer.ts

@@ -42,7 +42,6 @@ import { buildEvalPaths, evalPathsCover } from "./eval-paths.js";
 import { validateExtends } from "./validate-extends.js";
 import { validateBaseMapping } from "./validate-base-mapping.js";
 import { validateNestedInlineResources } from "./validate-nested-inline.js";
-import { validateKindDescriptions } from "./validate-kind-descriptions.js";
 import { validateProviderCoherence } from "./validate-provider-coherence.js";
 import { validateReferences } from "./validate-references.js";
 import { validateReferenceForms } from "./validate-reference-forms.js";
@@ -1654,9 +1653,6 @@ export class StaticAnalyzer {
     // Validate provider coherence rules for `provide:` template-target definitions.
     diagnostics.push(...validateProviderCoherence(allManifests, defs, aliases));
 
-    // Warn about exported kinds lacking a metadata.description (semantic-search input).
-    diagnostics.push(...validateKindDescriptions(allManifests));
-
     // Validate throws: declarations and catches: coverage (rules 1, 2, 4, 7)
     diagnostics.push(
       ...validateThrowsCoverage(allManifests, defs, aliases, this.celEnv, aliasesByModule, rootModules),

package/src/index.ts

@@ -75,6 +75,16 @@ export {
 } from "./sources/integrity.js";
 export { parseModuleRef, isRegistryRef } from "./sources/module-ref.js";
 export type { ParsedModuleRef } from "./sources/module-ref.js";
+export { OCI_SCHEME, isOciRef, parseOciRef } from "./sources/oci-ref.js";
+export type { ParsedOciRef } from "./sources/oci-ref.js";
+export {
+  MANIFEST_CACHE_BASE_URL,
+  ManifestCacheSource,
+  manifestCacheKey,
+  manifestCacheUrl,
+  ociManifestCacheCoords,
+} from "./sources/manifest-cache.js";
+export type { ManifestCacheCoords } from "./sources/manifest-cache.js";
 export { withSyntheticPositions } from "./with-synthetic-positions.js";
 export { DEFAULT_MANIFEST_FILENAME, DiagnosticSeverity } from "./types.js";
 export type {

package/src/sources/manifest-cache.ts

@@ -0,0 +1,112 @@
+import type { ManifestSource } from "../types.js";
+import { DEFAULT_MANIFEST_FILENAME } from "../types.js";
+import { splitIntegrity, verifiedFetch } from "./integrity.js";
+import { OCI_SCHEME, isOciRef, parseOciRef } from "./oci-ref.js";
+
+/** The hub's static manifest cache: an R2 bucket bound directly to the domain,
+ *  serving each tracked module version's `telo.yaml` at a deterministic key.
+ *  Read plane only — never artifact payloads; install/run stay origin-direct. */
+export const MANIFEST_CACHE_BASE_URL = "https://manifests.telo.sh";
+
+/** The location identity of one cached module version. Mirrors what the hub
+ *  stores per version — `{ transport, host, path, version }` — so the tracker's
+ *  write key and the editor's read key come from the same function and never
+ *  drift. `path` is the slash-separated repo/module path (multi-segment OCI
+ *  repos nest as prefixes). */
+export interface ManifestCacheCoords {
+  transport: string;
+  host: string;
+  path: string;
+  version: string;
+}
+
+/** True for a segment that would corrupt or escape the cache key space. */
+function invalidSegment(segment: string): boolean {
+  return segment === "" || segment === "." || segment === ".." || segment.includes("\\");
+}
+
+/** Deterministic cache key for one module version:
+ *  `<transport>/<host>/<path…>/<version>/telo.yaml`. Returns `null` when any
+ *  coordinate is empty or would traverse out of the key space. */
+export function manifestCacheKey(coords: ManifestCacheCoords): string | null {
+  const { transport, host, path, version } = coords;
+  const segments = [transport, host, ...path.split("/"), version];
+  if (segments.some(invalidSegment) || transport.includes("/") || host.includes("/") || version.includes("/")) {
+    return null;
+  }
+  return `${segments.join("/")}/${DEFAULT_MANIFEST_FILENAME}`;
+}
+
+/** Cache coordinates for an `oci://host/repo@tag` ref. Returns `null` when the
+ *  ref carries no explicit tag (a defaulted `latest` or a `sha256:` digest is
+ *  not addressable — the cache is keyed by the human version tag the tracker
+ *  enumerated). The inline `#sha256-…` fragment is tolerated and ignored. */
+export function ociManifestCacheCoords(ref: string): ManifestCacheCoords | null {
+  if (!isOciRef(ref)) return null;
+  let parsed: ParsedOciRefShape;
+  try {
+    parsed = parseOciRef(ref);
+  } catch {
+    return null;
+  }
+  const { base } = splitIntegrity(ref);
+  const explicitTag = base.endsWith(`@${parsed.reference}`) && !parsed.reference.includes(":");
+  if (!explicitTag) return null;
+  return { transport: "oci", host: parsed.host, path: parsed.repo, version: parsed.reference };
+}
+
+type ParsedOciRefShape = ReturnType<typeof parseOciRef>;
+
+/** Full cache URL for a ref or coordinates, or `null` when not addressable. */
+export function manifestCacheUrl(
+  refOrCoords: string | ManifestCacheCoords,
+  baseUrl: string = MANIFEST_CACHE_BASE_URL,
+): string | null {
+  const coords = typeof refOrCoords === "string" ? ociManifestCacheCoords(refOrCoords) : refOrCoords;
+  if (!coords) return null;
+  const key = manifestCacheKey(coords);
+  return key ? `${baseUrl.replace(/\/+$/, "")}/${key}` : null;
+}
+
+/** Resolves `oci://` module refs against the hub's static manifest cache with a
+ *  plain CORS GET — a browser can't speak the OCI protocol, so this is the
+ *  browser-safe read path for OCI imports. A pinned ref (`#sha256-…`) is
+ *  verified against the fetched bytes, so a compromised cache can't mislead
+ *  analysis; an unpinned ref is analyzed on trust — the security boundary is
+ *  install/run (origin-direct, re-verified), not edit time. */
+export class ManifestCacheSource implements ManifestSource {
+  constructor(private readonly baseUrl: string = MANIFEST_CACHE_BASE_URL) {}
+
+  supports(url: string): boolean {
+    // Claim every oci:// ref, addressable or not — nothing else browser-safe
+    // can ever resolve one, so an untagged/digest ref must reach `read()`'s
+    // actionable error instead of falling through to a file-not-found from a
+    // local/HTTP source.
+    return isOciRef(url);
+  }
+
+  async read(ref: string): Promise<{ text: string; source: string }> {
+    const { integrity } = splitIntegrity(ref);
+    const coords = ociManifestCacheCoords(ref);
+    const fetchUrl = coords && manifestCacheUrl(coords, this.baseUrl);
+    if (!fetchUrl) {
+      throw new Error(
+        `Cannot resolve '${ref}' from the manifest cache — an oci:// import needs an explicit version tag (oci://host/repo@version)`,
+      );
+    }
+    const { text } = await verifiedFetch(fetchUrl, integrity, ref);
+    return { text, source: `${OCI_SCHEME}${coords.host}/${coords.path}@${coords.version}` };
+  }
+
+  /** Mirror of the kernel OCI transport's resolution: normalize the repo to a
+   *  directory base so `../lib` under `oci://ghcr.io/aws/my-app` →
+   *  `oci://ghcr.io/aws/lib`. The tag is dropped — the caller re-pins from the
+   *  sibling's own version. Non-relative refs pass through. */
+  resolveRelative(base: string, relative: string): string {
+    if (!relative.startsWith(".") && !relative.startsWith("/")) return relative;
+    const { host, repo } = parseOciRef(base);
+    const resolved = new URL(relative, `https://${host}/${repo}/`);
+    const newRepo = resolved.pathname.replace(/^\/+/, "");
+    return `${OCI_SCHEME}${host}/${newRepo}`;
+  }
+}

package/src/sources/oci-ref.ts

@@ -0,0 +1,53 @@
+import { splitIntegrity } from "./integrity.js";
+
+export const OCI_SCHEME = "oci://";
+
+/** A parsed `oci://host/repo@reference` module ref.
+ *
+ *  - `host` — the registry host (`ghcr.io`, `123.dkr.ecr.us-east-1.amazonaws.com`).
+ *  - `repo` — the repository path (`aws/telo-s3`), possibly multi-segment.
+ *  - `reference` — a tag (`1.2.0`) or a digest (`sha256:...`); the OCI address.
+ *  - `integrity` — Telo's inline `sha256-<base64url>` hash when the ref is pinned
+ *    (authoritative across transports; the OCI digest is only corroborating). */
+export interface ParsedOciRef {
+  host: string;
+  repo: string;
+  reference: string;
+  integrity?: string;
+}
+
+/** True when `ref` uses the `oci://` scheme (integrity fragment tolerated). */
+export function isOciRef(ref: string): boolean {
+  return splitIntegrity(ref).base.startsWith(OCI_SCHEME);
+}
+
+/** Parse `oci://host/repo@reference[#sha256-...]`. Throws on a malformed ref.
+ *  A `reference` may be a tag or a `sha256:` digest; when absent (`@` omitted)
+ *  it defaults to `latest`, matching OCI tooling. */
+export function parseOciRef(ref: string): ParsedOciRef {
+  const { base, integrity } = splitIntegrity(ref);
+  if (!base.startsWith(OCI_SCHEME)) {
+    throw new Error(`Invalid OCI reference '${ref}', expected oci://host/repo@reference`);
+  }
+  const rest = base.slice(OCI_SCHEME.length);
+  const slash = rest.indexOf("/");
+  if (slash <= 0) {
+    throw new Error(`Invalid OCI reference '${ref}', missing repository path after host`);
+  }
+  const host = rest.slice(0, slash);
+  let repoAndRef = rest.slice(slash + 1);
+
+  let reference = "latest";
+  const at = repoAndRef.lastIndexOf("@");
+  // A digest reference is `repo@sha256:...` — the `@` before `sha256:` is the
+  // separator, not part of the repo. A tag reference has no `@`.
+  if (at > 0) {
+    reference = repoAndRef.slice(at + 1);
+    repoAndRef = repoAndRef.slice(0, at);
+  }
+  const repo = repoAndRef;
+  if (!host || !repo || !reference) {
+    throw new Error(`Invalid OCI reference '${ref}', expected oci://host/repo@reference`);
+  }
+  return { host, repo, reference, integrity };
+}

package/src/validate-base-mapping.ts

@@ -1,5 +1,6 @@
 import type { ResourceDefinition, ResourceManifest } from "@telorun/sdk";
 import { isCompiledValue } from "@telorun/sdk";
+import { isTaggedSentinel } from "@telorun/templating";
 import type { AliasResolver } from "./alias-resolver.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
 import { effectiveAuthorSchema, resolveParent, type DefResolver } from "./extends-resolution.js";
@@ -7,10 +8,14 @@ import { DiagnosticSeverity, type AnalysisDiagnostic } from "./types.js";
 
 const SOURCE = "telo-analyzer";
 
-/** True when a value subtree contains a compiled CEL leaf — such a value can
- *  produce anything at runtime, so its type is not statically checkable. */
+/** True when a value subtree contains a CEL leaf — either a compiled CEL value
+ *  (post-precompile) or the raw `!cel` tagged sentinel the analyzer sees at
+ *  `telo check` time (this validator runs on the un-precompiled tree). Such a
+ *  value can produce anything at runtime, so its type is not statically
+ *  checkable. */
 function containsCel(value: unknown): boolean {
   if (isCompiledValue(value)) return true;
+  if (isTaggedSentinel(value) && value.engine === "cel") return true;
   if (Array.isArray(value)) return value.some(containsCel);
   if (value && typeof value === "object") {
     return Object.values(value as Record<string, unknown>).some(containsCel);

package/src/validate-throws-coverage.ts

@@ -1,4 +1,5 @@
 import type { ASTNode, Environment } from "@marcbachmann/cel-js";
+import { isTaggedSentinel } from "@telorun/templating";
 import type { ResourceManifest } from "@telorun/sdk";
 import { scopeResolverForModule, type AliasResolver } from "./alias-resolver.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
@@ -15,7 +16,8 @@ const SOURCE = "telo-analyzer";
 const TEMPLATE_REGEX = /\$\{\{\s*([^}]+?)\s*\}\}/g;
 
 interface OutcomeEntry {
-  when?: string;
+  /** Inline `"${{ … }}"` string or a `!cel` TaggedSentinel. */
+  when?: unknown;
   body?: unknown;
   headers?: Record<string, unknown>;
   status?: number;
@@ -137,14 +139,21 @@ function resolveHandlerRef(sibling: unknown): { kind: string; name?: string } |
  *  Parenthesised nestings of `||` over equality/in are flattened.
  *  Any non-matching sub-expression forfeits coverage for the whole `when:`. */
 function extractCoveredCodes(
-  whenExpr: string,
+  whenExpr: unknown,
   env: Environment,
 ): { proven: boolean; codes: Set<string> } {
-  const match = whenExpr.match(/\$\{\{\s*([^}]+?)\s*\}\}/);
-  if (!match) return { proven: false, codes: new Set() };
+  // The `when:` value is either a `!cel` TaggedSentinel (carrying the raw CEL
+  // source) or an inline `"${{ … }}"` string — both forms are load-equivalent.
+  const source =
+    isTaggedSentinel(whenExpr) && whenExpr.engine === "cel"
+      ? whenExpr.source
+      : typeof whenExpr === "string"
+        ? whenExpr.match(/\$\{\{\s*([^}]+?)\s*\}\}/)?.[1]
+        : undefined;
+  if (!source) return { proven: false, codes: new Set() };
   let ast: ASTNode;
   try {
-    ast = env.parse(match[1].trim()).ast;
+    ast = env.parse(source.trim()).ast;
   } catch {
     return { proven: false, codes: new Set() };
   }

package/dist/validate-kind-descriptions.d.ts

@@ -1,20 +0,0 @@
-import type { ResourceManifest } from "@telorun/sdk";
-import { type AnalysisDiagnostic } from "./types.js";
-/**
- * Warns when a library exports a kind (via `exports.kinds`) whose local
- * `Telo.Definition` carries no `metadata.description`.
- *
- * The description is the primary human text the federated-discovery hub embeds
- * for semantic search (`search_resources`), so an exported kind without one is
- * undiscoverable by meaning. A warning (not an error) so the stdlib backfill is
- * incremental and CI isn't blocked mid-migration.
- *
- * Scope: only kinds a library *exports* and *defines locally* are checked.
- * Re-exported kinds (`exports.kinds: [Alias.Kind]`) belong to their owning
- * module and are skipped; an exported name that isn't a local Telo.Definition
- * (e.g. a Telo.Abstract) is skipped too. The check keys off the root library's
- * own module doc, which is only present when that library is analyzed directly
- * — so importing an under-described library never leaks warnings to its consumer.
- */
-export declare function validateKindDescriptions(manifests: ResourceManifest[]): AnalysisDiagnostic[];
-//# sourceMappingURL=validate-kind-descriptions.d.ts.map

package/dist/validate-kind-descriptions.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"validate-kind-descriptions.d.ts","sourceRoot":"","sources":["../src/validate-kind-descriptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,gBAAgB,EAAE,GAAG,kBAAkB,EAAE,CA2C5F"}

package/dist/validate-kind-descriptions.js

@@ -1,65 +0,0 @@
-import { DiagnosticSeverity } from "./types.js";
-const SOURCE = "telo-analyzer";
-/**
- * Warns when a library exports a kind (via `exports.kinds`) whose local
- * `Telo.Definition` carries no `metadata.description`.
- *
- * The description is the primary human text the federated-discovery hub embeds
- * for semantic search (`search_resources`), so an exported kind without one is
- * undiscoverable by meaning. A warning (not an error) so the stdlib backfill is
- * incremental and CI isn't blocked mid-migration.
- *
- * Scope: only kinds a library *exports* and *defines locally* are checked.
- * Re-exported kinds (`exports.kinds: [Alias.Kind]`) belong to their owning
- * module and are skipped; an exported name that isn't a local Telo.Definition
- * (e.g. a Telo.Abstract) is skipped too. The check keys off the root library's
- * own module doc, which is only present when that library is analyzed directly
- * — so importing an under-described library never leaks warnings to its consumer.
- */
-export function validateKindDescriptions(manifests) {
-    const diagnostics = [];
-    // Local Telo.Definition docs keyed by `<module>/<name>`.
-    const definitions = new Map();
-    for (const m of manifests) {
-        if (m.kind !== "Telo.Definition")
-            continue;
-        const name = m.metadata?.name;
-        const mod = m.metadata?.module;
-        if (name && mod)
-            definitions.set(`${mod}/${name}`, m);
-    }
-    for (const m of manifests) {
-        if (m.kind !== "Telo.Library")
-            continue;
-        const moduleName = m.metadata?.name;
-        if (!moduleName)
-            continue;
-        const exportedKinds = m.exports?.kinds;
-        if (!Array.isArray(exportedKinds))
-            continue;
-        for (const entry of exportedKinds) {
-            // Re-export (`Alias.Kind`) — the owning module owns its description.
-            if (typeof entry !== "string" || entry.includes("."))
-                continue;
-            const def = definitions.get(`${moduleName}/${entry}`);
-            if (!def)
-                continue; // not a local Telo.Definition (e.g. an abstract)
-            const description = def.metadata?.description;
-            if (typeof description === "string" && description.trim() !== "")
-                continue;
-            diagnostics.push({
-                severity: DiagnosticSeverity.Warning,
-                code: "KIND_MISSING_DESCRIPTION",
-                source: SOURCE,
-                message: `${moduleName}.${entry}: exported kind has no 'metadata.description'. Add a one-line ` +
-                    `description — it is the primary text indexed for semantic discovery (search_resources).`,
-                data: {
-                    resource: { kind: "Telo.Definition", name: entry },
-                    filePath: def.metadata?.source,
-                    path: "metadata.description",
-                },
-            });
-        }
-    }
-    return diagnostics;
-}

package/src/validate-kind-descriptions.ts

@@ -1,65 +0,0 @@
-import type { ResourceManifest } from "@telorun/sdk";
-import { DiagnosticSeverity, type AnalysisDiagnostic } from "./types.js";
-
-const SOURCE = "telo-analyzer";
-
-/**
- * Warns when a library exports a kind (via `exports.kinds`) whose local
- * `Telo.Definition` carries no `metadata.description`.
- *
- * The description is the primary human text the federated-discovery hub embeds
- * for semantic search (`search_resources`), so an exported kind without one is
- * undiscoverable by meaning. A warning (not an error) so the stdlib backfill is
- * incremental and CI isn't blocked mid-migration.
- *
- * Scope: only kinds a library *exports* and *defines locally* are checked.
- * Re-exported kinds (`exports.kinds: [Alias.Kind]`) belong to their owning
- * module and are skipped; an exported name that isn't a local Telo.Definition
- * (e.g. a Telo.Abstract) is skipped too. The check keys off the root library's
- * own module doc, which is only present when that library is analyzed directly
- * — so importing an under-described library never leaks warnings to its consumer.
- */
-export function validateKindDescriptions(manifests: ResourceManifest[]): AnalysisDiagnostic[] {
-  const diagnostics: AnalysisDiagnostic[] = [];
-
-  // Local Telo.Definition docs keyed by `<module>/<name>`.
-  const definitions = new Map<string, ResourceManifest>();
-  for (const m of manifests) {
-    if (m.kind !== "Telo.Definition") continue;
-    const name = m.metadata?.name as string | undefined;
-    const mod = (m.metadata as { module?: string } | undefined)?.module;
-    if (name && mod) definitions.set(`${mod}/${name}`, m);
-  }
-
-  for (const m of manifests) {
-    if (m.kind !== "Telo.Library") continue;
-    const moduleName = m.metadata?.name as string | undefined;
-    if (!moduleName) continue;
-    const exportedKinds = (m as { exports?: { kinds?: unknown } }).exports?.kinds;
-    if (!Array.isArray(exportedKinds)) continue;
-
-    for (const entry of exportedKinds) {
-      // Re-export (`Alias.Kind`) — the owning module owns its description.
-      if (typeof entry !== "string" || entry.includes(".")) continue;
-      const def = definitions.get(`${moduleName}/${entry}`);
-      if (!def) continue; // not a local Telo.Definition (e.g. an abstract)
-      const description = (def.metadata as { description?: unknown } | undefined)?.description;
-      if (typeof description === "string" && description.trim() !== "") continue;
-      diagnostics.push({
-        severity: DiagnosticSeverity.Warning,
-        code: "KIND_MISSING_DESCRIPTION",
-        source: SOURCE,
-        message:
-          `${moduleName}.${entry}: exported kind has no 'metadata.description'. Add a one-line ` +
-          `description — it is the primary text indexed for semantic discovery (search_resources).`,
-        data: {
-          resource: { kind: "Telo.Definition", name: entry },
-          filePath: (def.metadata as { source?: string } | undefined)?.source,
-          path: "metadata.description",
-        },
-      });
-    }
-  }
-
-  return diagnostics;
-}