@telorun/analyzer 0.4.0 → 0.6.0

package/dist/validate-cel-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAEpD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CA6BjC;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,EAAE,EAAE,CAI7D;AAwED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,EAAE,EACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC1B,MAAM,GAAG,IAAI,CAmBf;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GACnC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAqDrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB"}
+{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAEpD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CA6BjC;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,EAAE,EAAE,CAI7D;AAsFD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,EAAE,EACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC1B,MAAM,GAAG,IAAI,CAiCf;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GACnC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAqDrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB"}

package/dist/validate-cel-context.js

@@ -90,7 +90,15 @@ function visitNode(node, chains, boundVars) {
 function isASTNode(v) {
     return v !== null && typeof v === "object" && "op" in v;
 }
-/** Returns the member-access chain for a node if it is purely an id or "." chain; else null. */
+// Sentinel used in extracted chains to represent an `[index]` access. The
+// validator treats it like any other deeper segment, so a chain that reaches
+// past an `x-telo-stream`-marked property via `[N]` is rejected the same way
+// `.field` access is. The actual index expression is opaque to the chain
+// validator (it only checks property names against the schema).
+const INDEX_SEGMENT = "[*]";
+/** Returns the member-access chain for a node if it is purely an id, ".", or
+ *  "[]" chain; else null. Bracket index access is captured as `INDEX_SEGMENT`
+ *  so it counts as a chain extension for the stream-property opacity rule. */
 function extractChain(node, boundVars) {
     if (node.op === "id") {
         const name = node.args;
@@ -104,12 +112,19 @@ function extractChain(node, boundVars) {
         if (parent !== null)
             return [...parent, field];
     }
+    if (node.op === "[]") {
+        const [obj] = node.args;
+        const parent = extractChain(obj, boundVars);
+        if (parent !== null)
+            return [...parent, INDEX_SEGMENT];
+    }
     return null;
 }
 /**
  * Check whether a member-access chain accesses only fields declared in a JSON Schema.
  * Returns an error string if a field is unknown in a schema that declares explicit
- * properties without `additionalProperties: true`.
+ * properties without `additionalProperties: true`, or if the chain attempts to
+ * reach inside an `x-telo-stream: true` property.
  * Returns null when the chain is valid or the schema is too open to judge.
  */
 export function validateChainAgainstSchema(chain, schema) {
@@ -122,8 +137,20 @@ export function validateChainAgainstSchema(chain, schema) {
         if (!props)
             return null;
         if (key in props) {
+            const propSchema = props[key];
+            // Stream-typed properties are opaque: pass through by reference, no
+            // member access inside. Reaching `result.output` is fine; reaching
+            // `result.output.text` is a wiring mistake — the consumer either iterates
+            // the stream in a JS.Script step or pipes it through an Encoder.
+            if (propSchema &&
+                typeof propSchema === "object" &&
+                propSchema["x-telo-stream"] === true &&
+                i < chain.length - 1) {
+                const path = chain.slice(0, i + 1).join(".");
+                return `'${path}' yields a stream — pipe it through an Encoder or iterate in a JS.Script step (no member access on stream-typed values)`;
+            }
             // Known property — drill into it even if additionalProperties is true
-            current = props[key];
+            current = propSchema;
             continue;
         }
         // Unknown property — only flag if schema is closed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",
@@ -41,7 +41,7 @@
     "ajv-formats": "^3.0.1",
     "jsonpath-plus": "^10.3.0",
     "yaml": "^2.8.3",
-    "@telorun/sdk": "0.5.0"
+    "@telorun/sdk": "0.7.0"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",

package/src/analyzer.ts

@@ -34,6 +34,41 @@ import { validateThrowsCoverage } from "./validate-throws-coverage.js";
 
 const TEMPLATE_REGEX = /\$\{\{\s*([^}]+?)\s*\}\}/g;
 
+const SELF_PREFIX = "Self.";
+
+/** Resolve an alias-prefixed kind value (e.g. `Self.Encoder` or `Ai.Model`)
+ *  to its canonical form. `Self.<Name>` resolves to `<ownModule>.<Name>` —
+ *  the magic alias for "this library's own module" — and other prefixes
+ *  resolve through the declaring file's Telo.Import aliases. */
+function resolveSelfOrAlias(
+  value: string,
+  ownModule: string | undefined,
+  scopeResolver: AliasResolver,
+): string | undefined {
+  if (value.startsWith(SELF_PREFIX) && ownModule) {
+    return `${ownModule}.${value.slice(SELF_PREFIX.length)}`;
+  }
+  return scopeResolver.resolveKind(value);
+}
+
+/** Look up a top-level field (`outputType`, `inputType`) on a kind's
+ *  `Telo.Definition`. Used as a fallback by `buildStepContextSchema` when the
+ *  invoked resource manifest doesn't carry the field inline — most kinds
+ *  declare result shape on the definition, not the resource. */
+function lookupDefinitionTypeField(
+  invokedKind: string,
+  fieldName: string,
+  defs: DefinitionRegistry,
+  aliases: AliasResolver,
+  allManifests: Record<string, any>[],
+): Record<string, any> | undefined {
+  const canonical = aliases.resolveKind(invokedKind) ?? invokedKind;
+  const def = defs.resolve(canonical);
+  if (!def) return undefined;
+  const value = (def as unknown as Record<string, unknown>)[fieldName];
+  return resolveTypeFieldToSchema(value, allManifests);
+}
+
 function walkCelExpressions(
   value: unknown,
   path: string,
@@ -95,11 +130,25 @@ function extractContextsFromSchema(
  * Build a `steps` context schema from `x-telo-step-context` annotation.
  * Walks each step in the manifest array, resolves the invoked resource's outputType,
  * and builds `steps.<name>.result` context entries.
+ *
+ * outputType resolution falls through three layers:
+ *   1. The invoked resource manifest's own `outputType` field (rare — most
+ *      resources don't declare outputType inline).
+ *   2. The kind's `Telo.Definition` outputType (the common case for kinds that
+ *      declare a stable result shape, e.g. `Ai.TextStream` ↦ `{output: stream}`).
+ *   3. Permissive `{type: object, additionalProperties: true}` if neither
+ *      yields a schema.
+ *
+ * Layer 2 is what makes `x-telo-stream` properties on definitions actually
+ * govern step-result chain validation — without it, the validator falls back
+ * to permissive and the stream-opacity rule never fires.
  */
 function buildStepContextSchema(
   manifest: Record<string, any>,
   defSchema: Record<string, any>,
   allManifests: Record<string, any>[],
+  defs: DefinitionRegistry,
+  aliases: AliasResolver,
 ): Record<string, any> | undefined {
   const props = defSchema.properties as Record<string, any> | undefined;
   if (!props) return undefined;
@@ -139,6 +188,17 @@ function buildStepContextSchema(
             } else {
               outputSchema = resolveTypeFieldToSchema(invoke[outputTypeField], allManifests);
             }
+            // Fallback: pull outputType from the kind's Telo.Definition. The
+            // resource manifest typically doesn't carry outputType; the def does.
+            if (!outputSchema && invokedKind) {
+              outputSchema = lookupDefinitionTypeField(
+                invokedKind,
+                outputTypeField,
+                defs,
+                aliases,
+                allManifests,
+              );
+            }
           }
           stepProperties[name] = {
             type: "object",
@@ -317,6 +377,25 @@ export class StaticAnalyzer {
         const namespace = ((m.metadata as any).namespace as string | undefined) ?? null;
         const moduleName = m.metadata.name as string;
         if (moduleName) defs.registerModuleIdentity(namespace, moduleName);
+        // Auto-register `Self` as an alias for this library's own module name.
+        // Lets same-library `extends:` work (e.g. `extends: Self.Encoder` for a
+        // concrete kind whose abstract lives in the same Telo.Library) without
+        // requiring a self-import (which would loop the loader). Resolves
+        // through the same alias machinery as user-declared Telo.Imports —
+        // honours the library's `exports.kinds` list, no special cases.
+        if (moduleName) {
+          const exportedKinds: string[] = ((m as any).exports?.kinds as string[] | undefined) ?? [];
+          if (rootModules.has(moduleName)) {
+            aliases.registerImport("Self", moduleName, exportedKinds);
+          } else {
+            let libResolver = aliasesByModule.get(moduleName);
+            if (!libResolver) {
+              libResolver = new AliasResolver();
+              aliasesByModule.set(moduleName, libResolver);
+            }
+            libResolver.registerImport("Self", moduleName, exportedKinds);
+          }
+        }
       }
       if (m.kind === "Telo.Import") {
         const alias = m.metadata.name as string;
@@ -486,6 +565,8 @@ export class StaticAnalyzer {
             m as Record<string, any>,
             mDefinition.schema as Record<string, any>,
             allManifests as Record<string, any>[],
+            defs,
+            aliases,
           )
         : undefined;
 

package/src/cel-environment.ts

@@ -1,5 +1,5 @@
 import { Environment } from "@marcbachmann/cel-js";
-import type { ResourceManifest } from "@telorun/sdk";
+import { Stream, type ResourceManifest } from "@telorun/sdk";
 import { jsonSchemaToCelType } from "./schema-compat.js";
 
 export interface CelHandlers {
@@ -20,7 +20,16 @@ const STUB_HANDLERS: CelHandlers = {
 /** Build a CEL `Environment` with Telo's stdlib of functions. Always registers the
  *  same function signatures (so `env.check()` succeeds for type-inference) — the
  *  handlers govern what the function does when called at runtime. Analyzer-only
- *  callers can omit handlers; runtime callers (kernel) must supply real ones. */
+ *  callers can omit handlers; runtime callers (kernel) must supply real ones.
+ *
+ *  Also registers the `Stream` object type, backed by the `Stream` class from
+ *  `@telorun/sdk`. CEL's type-checker rejects values whose constructor isn't
+ *  Object/Map/Array/Set/registered; producers that need to expose an
+ *  `AsyncIterable` through a stream-typed property must wrap the iterable in
+ *  `new Stream(...)` so its constructor is the registered class. The type has
+ *  no fields, so terminal access (passing the value through CEL) succeeds but
+ *  member access raises a CEL error at runtime — matching the analyzer's
+ *  static check on `x-telo-stream`-marked properties. */
 export function buildCelEnvironment(handlers: CelHandlers = STUB_HANDLERS): Environment {
   return new Environment({ unlistedVariablesAreDyn: true })
     .registerFunction("join(list, string): string", (list: unknown[], sep: string) =>
@@ -34,7 +43,8 @@ export function buildCelEnvironment(handlers: CelHandlers = STUB_HANDLERS): Envi
       if (map instanceof Map) return [...map.values()];
       return Object.values(map as Record<string, unknown>);
     })
-    .registerFunction("sha256(string): string", (s: string) => handlers.sha256(s));
+    .registerFunction("sha256(string): string", (s: string) => handlers.sha256(s))
+    .registerType("Stream", Stream as unknown as new (...args: unknown[]) => unknown);
 }
 
 /** Clone `baseEnv` and register typed variable declarations so that

package/src/index.ts

@@ -1,14 +1,17 @@
-export { HttpAdapter } from "./adapters/http-adapter.js";
-export { RegistryAdapter } from "./adapters/registry-adapter.js";
 export { AnalysisRegistry } from "./analysis-registry.js";
 export { StaticAnalyzer } from "./analyzer.js";
 export { Loader } from "./manifest-loader.js";
-export { MODULE_KINDS, isModuleKind } from "./module-kinds.js";
+export { isModuleKind, MODULE_KINDS } from "./module-kinds.js";
 export type { ModuleKind } from "./module-kinds.js";
+export { HttpSource } from "./sources/http-source.js";
+export { RegistrySource } from "./sources/registry-source.js";
 export { DEFAULT_MANIFEST_FILENAME, DiagnosticSeverity } from "./types.js";
 export type {
     AnalysisDiagnostic,
-    AnalysisOptions, LoaderInitOptions, LoadOptions, ManifestAdapter,
+    AnalysisOptions,
+    LoaderInitOptions,
+    LoadOptions,
+    ManifestSource,
     Position,
     PositionIndex,
     Range

package/src/manifest-loader.ts

@@ -1,8 +1,8 @@
 import type { Environment } from "@marcbachmann/cel-js";
 import { isCompiledValue, type ResourceManifest } from "@telorun/sdk";
 import { isMap, isPair, isScalar, isSeq, parseAllDocuments, type Document } from "yaml";
-import { HttpAdapter } from "./adapters/http-adapter.js";
-import { RegistryAdapter } from "./adapters/registry-adapter.js";
+import { HttpSource } from "./sources/http-source.js";
+import { RegistrySource } from "./sources/registry-source.js";
 import { buildCelEnvironment } from "./cel-environment.js";
 import { isModuleKind } from "./module-kinds.js";
 import { precompileDoc } from "./precompile.js";
@@ -10,7 +10,7 @@ import {
   DEFAULT_MANIFEST_FILENAME,
   type LoadOptions,
   type LoaderInitOptions,
-  type ManifestAdapter,
+  type ManifestSource,
   type Position,
   type PositionIndex,
 } from "./types.js";
@@ -23,42 +23,42 @@ const SYSTEM_KINDS = new Set([
 ]);
 
 export class Loader {
-  private static readonly moduleCache = new Map<
+  private readonly moduleCache = new Map<
     string,
     { text: string; manifests: ResourceManifest[] }
   >();
 
-  protected adapters: ManifestAdapter[];
+  protected sources: ManifestSource[];
   private readonly celEnv: Environment;
 
-  constructor(extraAdaptersOrOptions: ManifestAdapter[] | LoaderInitOptions = []) {
-    const options: LoaderInitOptions = Array.isArray(extraAdaptersOrOptions)
-      ? { extraAdapters: extraAdaptersOrOptions }
-      : extraAdaptersOrOptions;
+  constructor(extraSourcesOrOptions: ManifestSource[] | LoaderInitOptions = []) {
+    const options: LoaderInitOptions = Array.isArray(extraSourcesOrOptions)
+      ? { extraSources: extraSourcesOrOptions }
+      : extraSourcesOrOptions;
 
-    const includeHttpAdapter = options.includeHttpAdapter ?? true;
-    const includeRegistryAdapter = options.includeRegistryAdapter ?? true;
+    const includeHttpSource = options.includeHttpSource ?? true;
+    const includeRegistrySource = options.includeRegistrySource ?? true;
 
-    this.adapters = [];
-    if (includeHttpAdapter) this.adapters.push(new HttpAdapter());
-    if (includeRegistryAdapter) this.adapters.push(new RegistryAdapter(options.registryUrl));
+    this.sources = [];
+    if (includeHttpSource) this.sources.push(new HttpSource());
+    if (includeRegistrySource) this.sources.push(new RegistrySource(options.registryUrl));
 
-    if (options.extraAdapters?.length) {
-      this.adapters.unshift(...options.extraAdapters);
+    if (options.extraSources?.length) {
+      this.sources.unshift(...options.extraSources);
     }
 
     this.celEnv = buildCelEnvironment(options.celHandlers);
   }
 
-  register(adapter: ManifestAdapter): this {
-    this.adapters.unshift(adapter);
+  register(source: ManifestSource): this {
+    this.sources.unshift(source);
     return this;
   }
 
-  private pick(url: string): ManifestAdapter {
-    const a = this.adapters.find((a) => a.supports(url));
-    if (!a) throw new Error(`No adapter found for: ${url}`);
-    return a;
+  private pick(url: string): ManifestSource {
+    const s = this.sources.find((s) => s.supports(url));
+    if (!s) throw new Error(`No source found for: ${url}`);
+    return s;
   }
 
   async resolveEntryPoint(url: string): Promise<string> {
@@ -69,7 +69,7 @@ export class Loader {
   async loadModule(url: string, options?: LoadOptions): Promise<ResourceManifest[]> {
     const { text, source } = await this.pick(url).read(url);
     const cacheKey = `${options?.compile ? "compiled" : "raw"}:${source}`;
-    const cached = Loader.moduleCache.get(cacheKey);
+    const cached = this.moduleCache.get(cacheKey);
     if (cached && cached.text === text) {
       return cloneManifestArray(cached.manifests);
     }
@@ -152,8 +152,8 @@ export class Loader {
       const includePatterns = (moduleManifest as any).include as string[] | undefined;
       if (includePatterns?.length) {
         hasIncludes = true;
-        const adapter = this.pick(source);
-        const includedFiles = await this.resolveIncludes(source, includePatterns, adapter);
+        const picked = this.pick(source);
+        const includedFiles = await this.resolveIncludes(source, includePatterns, picked);
         for (const includedUrl of includedFiles) {
           const partialManifests = await this.loadPartialFile(includedUrl, moduleName, options);
           resolved.push(...partialManifests);
@@ -162,7 +162,7 @@ export class Loader {
     }
 
     if (!hasIncludes) {
-      Loader.moduleCache.set(cacheKey, { text, manifests: resolved });
+      this.moduleCache.set(cacheKey, { text, manifests: resolved });
     }
     return cloneManifestArray(resolved);
   }
@@ -170,21 +170,21 @@ export class Loader {
   private async resolveIncludes(
     ownerSource: string,
     patterns: string[],
-    adapter: ManifestAdapter,
+    source: ManifestSource,
   ): Promise<string[]> {
     const hasGlobs = patterns.some((p) => /[*?{}\[\]]/.test(p));
     if (hasGlobs) {
-      if (!adapter.expandGlob) {
+      if (!source.expandGlob) {
         throw new Error(
-          `Include patterns in '${ownerSource}' contain globs but the adapter for this source ` +
+          `Include patterns in '${ownerSource}' contain globs but the source for this URL ` +
             `does not support glob expansion. Use explicit file paths instead of patterns like: ` +
             patterns.filter((p) => /[*?{}\[\]]/.test(p)).join(", "),
         );
       }
-      return adapter.expandGlob(ownerSource, patterns);
+      return source.expandGlob(ownerSource, patterns);
     }
     // Literal relative paths — deduplicate in case the same file appears under multiple patterns.
-    return [...new Set(patterns.map((p) => adapter.resolveRelative(ownerSource, p)))];
+    return [...new Set(patterns.map((p) => source.resolveRelative(ownerSource, p)))];
   }
 
   private async loadPartialFile(
@@ -280,9 +280,9 @@ export class Loader {
     }
 
     // Find the owning telo.yaml via parent-directory traversal
-    const adapter = this.pick(fileUrl);
-    if (!adapter.resolveOwnerOf) return null;
-    const ownerUrl = await adapter.resolveOwnerOf(fileUrl);
+    const source = this.pick(fileUrl);
+    if (!source.resolveOwnerOf) return null;
+    const ownerUrl = await source.resolveOwnerOf(fileUrl);
     if (!ownerUrl) return null;
 
     // Load the owner module (which will load included files via include expansion)

package/src/normalize-inline-resources.ts

@@ -107,6 +107,29 @@ function extractInlinesAtPath(
     if (!obj || typeof obj !== "object" || partsLeft.length === 0) return;
 
     const [head, ...rest] = partsLeft;
+
+    // Map iteration: descend into every value of the current object (used for
+    // schema fields with `additionalProperties` like `content[mime]`).
+    if (head === "{}") {
+      const container = obj as Record<string, unknown>;
+      for (const mapKey of Object.keys(container)) {
+        const elem = container[mapKey];
+        if (!elem || typeof elem !== "object") continue;
+        const sanitizedKey = sanitizeName(mapKey);
+
+        if (rest.length === 0) {
+          if (isInlineResource(elem as Record<string, unknown>)) {
+            const name = sanitizeName([parentName, ...nameParts, sanitizedKey].join("_"));
+            extracted.push(buildManifest(elem as Record<string, unknown>, name, parentModule, invocationContext));
+            container[mapKey] = { kind: (elem as Record<string, unknown>).kind, name };
+          }
+        } else {
+          traverse(elem, rest, [...nameParts, sanitizedKey]);
+        }
+      }
+      return;
+    }
+
     const isArr = head.endsWith("[]");
     const key = isArr ? head.slice(0, -2) : head;
     const container = obj as Record<string, unknown>;

package/src/reference-field-map.ts

@@ -48,19 +48,43 @@ export function isSchemaFromEntry(entry: FieldMapEntry): entry is SchemaFromFiel
 export const REFERENCE_KEYS = new Set(["kind", "name", "metadata"]);
 
 /** True when `val` is an inline resource definition rather than a named reference.
- *  A named reference (has string `name`) may carry extra keys (e.g. `inputs`) that
- *  are runtime call parameters — those are never inline resources. */
+ *  Three shapes flow through here:
+ *   - `{kind, name}` (optionally with runtime call args) → named reference, NOT inline.
+ *   - `{kind, ...config}` with no name → inline definition with config; extract.
+ *   - `{kind}` alone (bare kind, no name) → inline singleton — extract a fresh
+ *     stateless resource. Lets simple stateless kinds be used inline without
+ *     boilerplate (e.g. `encoder: {kind: Ndjson.Encoder}`, `invoke: {kind: Run.Throw}`).
+ *
+ *  A named reference (has string `name`) may carry extra keys (e.g. `inputs`)
+ *  that are runtime call parameters — those are never inline resources. */
 export function isInlineResource(val: Record<string, unknown>): boolean {
   if (typeof val.name === "string") return false;
-  return Object.keys(val).some((k) => !REFERENCE_KEYS.has(k));
+  if (typeof val.kind !== "string") return false;
+  return true;
 }
 
 /** Resolves all values at a field map path in a resource config.
- *  `[]` in a path segment means "iterate array at this key". */
+ *  Path-segment markers:
+ *   - `[]`  iterate array values at this key
+ *   - `{}`  iterate map values (every value in an `additionalProperties`-typed
+ *           object — used for fields like `content[mime]` whose schema declares
+ *           a key-as-MIME map). The path is `<key>.{}.<rest>`. */
 export function resolveFieldValues(obj: unknown, path: string): unknown[] {
   const parts = path.split(".");
   let current: unknown[] = [obj];
   for (const part of parts) {
+    if (part === "{}") {
+      // Iterate the values of every map currently in `current`.
+      const next: unknown[] = [];
+      for (const item of current) {
+        if (!item || typeof item !== "object") continue;
+        for (const v of Object.values(item as Record<string, unknown>)) {
+          if (v != null) next.push(v);
+        }
+      }
+      current = next;
+      continue;
+    }
     const isArray = part.endsWith("[]");
     const key = isArray ? part.slice(0, -2) : part;
     const next: unknown[] = [];
@@ -144,4 +168,15 @@ function traverseNode(node: Record<string, any>, path: string, map: ReferenceFie
       traverseNode(propSchema as Record<string, any>, `${path}.${key}`, map);
     }
   }
+
+  // Map — `additionalProperties: { ... }` describes every value in an
+  // open-keyed object. Encoder refs nested inside `content[mime]` map
+  // entries reach Phase 5 through this branch.
+  if (
+    node.additionalProperties &&
+    typeof node.additionalProperties === "object" &&
+    !Array.isArray(node.additionalProperties)
+  ) {
+    traverseNode(node.additionalProperties as Record<string, any>, `${path}.{}`, map);
+  }
 }

package/src/{adapters/http-adapter.ts → sources/http-source.ts}

@@ -1,6 +1,6 @@
-import { DEFAULT_MANIFEST_FILENAME, type ManifestAdapter } from "../types.js";
+import { DEFAULT_MANIFEST_FILENAME, type ManifestSource } from "../types.js";
 
-export class HttpAdapter implements ManifestAdapter {
+export class HttpSource implements ManifestSource {
   supports(url: string): boolean {
     return url.startsWith("http://") || url.startsWith("https://");
   }

package/src/{adapters/registry-adapter.ts → sources/registry-source.ts}

@@ -1,8 +1,8 @@
-import { DEFAULT_MANIFEST_FILENAME, type ManifestAdapter } from "../types.js";
+import { DEFAULT_MANIFEST_FILENAME, type ManifestSource } from "../types.js";
 
 const DEFAULT_REGISTRY_URL = "https://registry.telo.run";
 
-export class RegistryAdapter implements ManifestAdapter {
+export class RegistrySource implements ManifestSource {
   constructor(private registryUrl = DEFAULT_REGISTRY_URL) {}
 
   supports(url: string): boolean {

package/src/types.ts

@@ -41,19 +41,19 @@ export interface AnalysisDiagnostic {
   data?: unknown;
 }
 
-export interface ManifestAdapter {
+export interface ManifestSource {
   supports(url: string): boolean;
   read(url: string): Promise<{ text: string; source: string }>;
   resolveRelative(base: string, relative: string): string;
 
   /** Expand glob patterns relative to a base source. Returns sources in the same
    *  format as read().source — suitable to pass back into read() / resolveRelative().
-   *  Optional — only filesystem-capable adapters implement this. */
+   *  Optional — only filesystem-capable sources implement this. */
   expandGlob?(base: string, patterns: string[]): Promise<string[]>;
 
   /** Walk parent directories from fileUrl looking for the nearest telo.yaml.
    *  Returns the source in the same format as read().source, or null if none found.
-   *  Optional — only filesystem-capable adapters implement this. */
+   *  Optional — only filesystem-capable sources implement this. */
   resolveOwnerOf?(fileUrl: string): Promise<string | null>;
 }
 
@@ -66,13 +66,13 @@ export interface LoadOptions {
 }
 
 export interface LoaderInitOptions {
-  /** Adapters inserted with highest priority before built-ins. */
-  extraAdapters?: ManifestAdapter[];
-  /** Include built-in HttpAdapter. Defaults to true. */
-  includeHttpAdapter?: boolean;
-  /** Include built-in RegistryAdapter. Defaults to true. */
-  includeRegistryAdapter?: boolean;
-  /** Base URL used by built-in RegistryAdapter when enabled. */
+  /** Sources inserted with highest priority before built-ins. */
+  extraSources?: ManifestSource[];
+  /** Include built-in HttpSource. Defaults to true. */
+  includeHttpSource?: boolean;
+  /** Include built-in RegistrySource. Defaults to true. */
+  includeRegistrySource?: boolean;
+  /** Base URL used by built-in RegistrySource when enabled. */
   registryUrl?: string;
   /** Handlers for CEL stdlib functions (e.g. `sha256`). Analyzer-only callers may
    *  omit this and get throwing stubs; runtime callers (kernel) must supply real impls. */

package/src/validate-cel-context.ts

@@ -107,7 +107,16 @@ function isASTNode(v: unknown): v is ASTNode {
   return v !== null && typeof v === "object" && "op" in (v as object);
 }
 
-/** Returns the member-access chain for a node if it is purely an id or "." chain; else null. */
+// Sentinel used in extracted chains to represent an `[index]` access. The
+// validator treats it like any other deeper segment, so a chain that reaches
+// past an `x-telo-stream`-marked property via `[N]` is rejected the same way
+// `.field` access is. The actual index expression is opaque to the chain
+// validator (it only checks property names against the schema).
+const INDEX_SEGMENT = "[*]";
+
+/** Returns the member-access chain for a node if it is purely an id, ".", or
+ *  "[]" chain; else null. Bracket index access is captured as `INDEX_SEGMENT`
+ *  so it counts as a chain extension for the stream-property opacity rule. */
 function extractChain(node: ASTNode, boundVars: Set<string>): string[] | null {
   if (node.op === "id") {
     const name = node.args as string;
@@ -119,13 +128,19 @@ function extractChain(node: ASTNode, boundVars: Set<string>): string[] | null {
     const parent = extractChain(obj, boundVars);
     if (parent !== null) return [...parent, field];
   }
+  if (node.op === "[]") {
+    const [obj] = node.args as [ASTNode, ASTNode];
+    const parent = extractChain(obj, boundVars);
+    if (parent !== null) return [...parent, INDEX_SEGMENT];
+  }
   return null;
 }
 
 /**
  * Check whether a member-access chain accesses only fields declared in a JSON Schema.
  * Returns an error string if a field is unknown in a schema that declares explicit
- * properties without `additionalProperties: true`.
+ * properties without `additionalProperties: true`, or if the chain attempts to
+ * reach inside an `x-telo-stream: true` property.
  * Returns null when the chain is valid or the schema is too open to judge.
  */
 export function validateChainAgainstSchema(
@@ -139,8 +154,22 @@ export function validateChainAgainstSchema(
     const props: Record<string, any> | undefined = current.properties;
     if (!props) return null;
     if (key in props) {
+      const propSchema = props[key];
+      // Stream-typed properties are opaque: pass through by reference, no
+      // member access inside. Reaching `result.output` is fine; reaching
+      // `result.output.text` is a wiring mistake — the consumer either iterates
+      // the stream in a JS.Script step or pipes it through an Encoder.
+      if (
+        propSchema &&
+        typeof propSchema === "object" &&
+        propSchema["x-telo-stream"] === true &&
+        i < chain.length - 1
+      ) {
+        const path = chain.slice(0, i + 1).join(".");
+        return `'${path}' yields a stream — pipe it through an Encoder or iterate in a JS.Script step (no member access on stream-typed values)`;
+      }
       // Known property — drill into it even if additionalProperties is true
-      current = props[key];
+      current = propSchema;
       continue;
     }
     // Unknown property — only flag if schema is closed

package/dist/adapters/http-adapter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"http-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/http-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9E,qBAAa,WAAY,YAAW,eAAe;IACjD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAIxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAWlE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;CAIxD"}

package/dist/adapters/registry-adapter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"registry-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/registry-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAI9E,qBAAa,eAAgB,YAAW,eAAe;IACzC,OAAO,CAAC,WAAW;gBAAX,WAAW,SAAuB;IAEtD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAWxB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAWxE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAMvD,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,cAAc;CAmBvB"}