@telorun/analyzer 0.5.0 → 0.6.1

package/README.md

@@ -1,6 +1,21 @@
-# ⚡ Telo
-
-Runtime for declarative backends.
+<p align="center">
+  <img src="./assets/telo.png" alt="Telo" width="200" />
+</p>
+
+<h1 align="center">Telo</h1>
+
+<p align="center">Runtime for declarative backends.</p>
+
+<p align="center">
+  <a href="https://github.com/telorun/telo/actions/workflows/test.yml"><img alt="Tests" src="https://github.com/telorun/telo/actions/workflows/test.yml/badge.svg" /></a>
+  <a href="https://www.npmjs.com/package/@telorun/cli"><img alt="node" src="https://img.shields.io/node/v/@telorun/cli" /></a>
+  <br />
+  <a href="https://github.com/telorun/telo/commits/main"><img alt="Last commit" src="https://img.shields.io/github/last-commit/telorun/telo" /></a>
+  <a href="https://github.com/telorun/telo/issues"><img alt="Issues" src="https://img.shields.io/github/issues/telorun/telo" /></a>
+  <a href="https://github.com/telorun/telo/pulls"><img alt="Pull requests" src="https://img.shields.io/github/issues-pr/telorun/telo" /></a>
+  <br />
+  <img alt="Changesets" src="https://img.shields.io/badge/maintained%20with-changesets-176de3" />
+</p>
 
 Telo is an execution engine (Micro-Kernel) that runs logic defined entirely in YAML manifests. Instead of writing imperative backend code, you define your routes, databases, schemas, and AI workflows as atomic, interconnected YAML documents. Telo takes those manifests and runs them.
 

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAa9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAuP/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAsSvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,GAAG,gBAAgB,EAAE;IAKxF,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAiB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAa9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAoY/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IA2TvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,GAAG,gBAAgB,EAAE;IAKxF,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAiB5F"}

package/dist/analyzer.js

@@ -13,6 +13,29 @@ import { validateExtends } from "./validate-extends.js";
 import { validateReferences } from "./validate-references.js";
 import { validateThrowsCoverage } from "./validate-throws-coverage.js";
 const TEMPLATE_REGEX = /\$\{\{\s*([^}]+?)\s*\}\}/g;
+const SELF_PREFIX = "Self.";
+/** Resolve an alias-prefixed kind value (e.g. `Self.Encoder` or `Ai.Model`)
+ *  to its canonical form. `Self.<Name>` resolves to `<ownModule>.<Name>` —
+ *  the magic alias for "this library's own module" — and other prefixes
+ *  resolve through the declaring file's Telo.Import aliases. */
+function resolveSelfOrAlias(value, ownModule, scopeResolver) {
+    if (value.startsWith(SELF_PREFIX) && ownModule) {
+        return `${ownModule}.${value.slice(SELF_PREFIX.length)}`;
+    }
+    return scopeResolver.resolveKind(value);
+}
+/** Look up a top-level field (`outputType`, `inputType`) on a kind's
+ *  `Telo.Definition`. Used as a fallback by `buildStepContextSchema` when the
+ *  invoked resource manifest doesn't carry the field inline — most kinds
+ *  declare result shape on the definition, not the resource. */
+function lookupDefinitionTypeField(invokedKind, fieldName, defs, aliases, allManifests) {
+    const canonical = aliases.resolveKind(invokedKind) ?? invokedKind;
+    const def = defs.resolve(canonical);
+    if (!def)
+        return undefined;
+    const value = def[fieldName];
+    return resolveTypeFieldToSchema(value, allManifests);
+}
 function walkCelExpressions(value, path, cb) {
     if (typeof value === "string") {
         for (const m of value.matchAll(TEMPLATE_REGEX)) {
@@ -58,12 +81,70 @@ function extractContextsFromSchema(schema, path = "$") {
     }
     return results;
 }
+/** Resolve a local `$ref` (only `#/$defs/<name>` form) against the root schema.
+ *  Non-refs and unresolved refs pass through unchanged. */
+function resolveLocalRef(schema, root) {
+    if (!schema)
+        return undefined;
+    const ref = schema.$ref;
+    if (typeof ref === "string" && ref.startsWith("#/$defs/")) {
+        const defName = ref.slice("#/$defs/".length);
+        const resolved = root.$defs?.[defName];
+        if (resolved && typeof resolved === "object")
+            return resolved;
+    }
+    return schema;
+}
+/** Gather property schemas from a (possibly variant-bearing) object schema:
+ *  top-level `properties` plus every `oneOf` / `anyOf` / `allOf` branch. */
+function gatherPropertySchemas(schema) {
+    const out = [];
+    if (schema.properties && typeof schema.properties === "object") {
+        for (const [k, v] of Object.entries(schema.properties)) {
+            out.push([k, v]);
+        }
+    }
+    for (const variantKey of ["oneOf", "anyOf", "allOf"]) {
+        const arr = schema[variantKey];
+        if (!Array.isArray(arr))
+            continue;
+        for (const variant of arr) {
+            if (variant && typeof variant === "object" && variant.properties) {
+                for (const [k, v] of Object.entries(variant.properties)) {
+                    out.push([k, v]);
+                }
+            }
+        }
+    }
+    return out;
+}
 /**
  * Build a `steps` context schema from `x-telo-step-context` annotation.
  * Walks each step in the manifest array, resolves the invoked resource's outputType,
  * and builds `steps.<name>.result` context entries.
+ *
+ * outputType resolution falls through three layers:
+ *   1. The invoked resource manifest's own `outputType` field (rare — most
+ *      resources don't declare outputType inline).
+ *   2. The kind's `Telo.Definition` outputType (the common case for kinds that
+ *      declare a stable result shape, e.g. `Ai.TextStream` ↦ `{output: stream}`).
+ *   3. Permissive `{type: object, additionalProperties: true}` if neither
+ *      yields a schema.
+ *
+ * Layer 2 is what makes `x-telo-stream` properties on definitions actually
+ * govern step-result chain validation — without it, the validator falls back
+ * to permissive and the stream-opacity rule never fires.
+ *
+ * Recursion into nested step arrays is annotation-driven via
+ * `x-telo-topology-role`. The analyzer recognises three role values:
+ *   - `branch`     — value is an array of steps (e.g. then / else / do / catch).
+ *   - `branch-list`— value is an array of objects each carrying further roled
+ *                    sub-properties (e.g. elseif: [{ if, then }]).
+ *   - `case-map`   — value is an object whose values are step arrays (e.g. cases).
+ * No specific Run.Sequence field name is hardcoded; any kind that uses
+ * `x-telo-step-context` and tags its branch fields with these roles works.
  */
-function buildStepContextSchema(manifest, defSchema, allManifests) {
+function buildStepContextSchema(manifest, defSchema, allManifests, defs, aliases) {
     const props = defSchema.properties;
     if (!props)
         return undefined;
@@ -78,8 +159,35 @@ function buildStepContextSchema(manifest, defSchema, allManifests) {
         const steps = manifest[fieldName];
         if (!Array.isArray(steps))
             continue;
+        const stepItemSchema = resolveLocalRef(fieldSchema.items, defSchema);
         const stepProperties = {};
-        const collectSteps = (items) => {
+        const dispatchRole = (data, role, itemsSchema) => {
+            if (role === "branch" && Array.isArray(data)) {
+                collectSteps(data);
+            }
+            else if (role === "case-map" && data && typeof data === "object" && !Array.isArray(data)) {
+                for (const arr of Object.values(data)) {
+                    if (Array.isArray(arr))
+                        collectSteps(arr);
+                }
+            }
+            else if (role === "branch-list" && Array.isArray(data)) {
+                const entrySchema = resolveLocalRef(itemsSchema, defSchema);
+                if (!entrySchema)
+                    return;
+                for (const entry of data) {
+                    if (!entry || typeof entry !== "object")
+                        continue;
+                    for (const [subKey, subSchema] of gatherPropertySchemas(entrySchema)) {
+                        const subRole = subSchema["x-telo-topology-role"];
+                        if (typeof subRole !== "string")
+                            continue;
+                        dispatchRole(entry[subKey], subRole, subSchema.items);
+                    }
+                }
+            }
+        };
+        function collectSteps(items) {
             for (const step of items) {
                 if (!step || typeof step !== "object")
                     continue;
@@ -101,6 +209,11 @@ function buildStepContextSchema(manifest, defSchema, allManifests) {
                         else {
                             outputSchema = resolveTypeFieldToSchema(invoke[outputTypeField], allManifests);
                         }
+                        // Fallback: pull outputType from the kind's Telo.Definition. The
+                        // resource manifest typically doesn't carry outputType; the def does.
+                        if (!outputSchema && invokedKind) {
+                            outputSchema = lookupDefinitionTypeField(invokedKind, outputTypeField, defs, aliases, allManifests);
+                        }
                     }
                     stepProperties[name] = {
                         type: "object",
@@ -109,20 +222,16 @@ function buildStepContextSchema(manifest, defSchema, allManifests) {
                         },
                     };
                 }
-                // Recurse into nested step arrays (then, else, do, catch, finally, try, default, cases)
-                for (const nested of ["then", "else", "do", "catch", "finally", "try", "default"]) {
-                    if (Array.isArray(s[nested]))
-                        collectSteps(s[nested]);
-                }
-                // cases is an object map of arrays
-                if (s.cases && typeof s.cases === "object") {
-                    for (const arr of Object.values(s.cases)) {
-                        if (Array.isArray(arr))
-                            collectSteps(arr);
+                if (stepItemSchema) {
+                    for (const [propKey, propSchema] of gatherPropertySchemas(stepItemSchema)) {
+                        const role = propSchema["x-telo-topology-role"];
+                        if (typeof role !== "string")
+                            continue;
+                        dispatchRole(s[propKey], role, propSchema.items);
                     }
                 }
             }
-        };
+        }
         collectSteps(steps);
         if (Object.keys(stepProperties).length > 0) {
             return {
@@ -235,6 +344,26 @@ export class StaticAnalyzer {
                 const moduleName = m.metadata.name;
                 if (moduleName)
                     defs.registerModuleIdentity(namespace, moduleName);
+                // Auto-register `Self` as an alias for this library's own module name.
+                // Lets same-library `extends:` work (e.g. `extends: Self.Encoder` for a
+                // concrete kind whose abstract lives in the same Telo.Library) without
+                // requiring a self-import (which would loop the loader). Resolves
+                // through the same alias machinery as user-declared Telo.Imports —
+                // honours the library's `exports.kinds` list, no special cases.
+                if (moduleName) {
+                    const exportedKinds = m.exports?.kinds ?? [];
+                    if (rootModules.has(moduleName)) {
+                        aliases.registerImport("Self", moduleName, exportedKinds);
+                    }
+                    else {
+                        let libResolver = aliasesByModule.get(moduleName);
+                        if (!libResolver) {
+                            libResolver = new AliasResolver();
+                            aliasesByModule.set(moduleName, libResolver);
+                        }
+                        libResolver.registerImport("Self", moduleName, exportedKinds);
+                    }
+                }
             }
             if (m.kind === "Telo.Import") {
                 const alias = m.metadata.name;
@@ -381,7 +510,7 @@ export class StaticAnalyzer {
             const mDefinition = defs.resolve(m.kind) ?? (resolvedKind ? defs.resolve(resolvedKind) : undefined);
             // Pre-compute step context for manifests with x-telo-step-context
             const stepContextSchema = mDefinition?.schema
-                ? buildStepContextSchema(m, mDefinition.schema, allManifests)
+                ? buildStepContextSchema(m, mDefinition.schema, allManifests, defs, aliases)
                 : undefined;
             walkCelExpressions(m, "", (expr, path) => {
                 let parsed;

package/dist/cel-environment.d.ts

@@ -1,12 +1,21 @@
 import { Environment } from "@marcbachmann/cel-js";
-import type { ResourceManifest } from "@telorun/sdk";
+import { type ResourceManifest } from "@telorun/sdk";
 export interface CelHandlers {
     sha256: (s: string) => string;
 }
 /** Build a CEL `Environment` with Telo's stdlib of functions. Always registers the
  *  same function signatures (so `env.check()` succeeds for type-inference) — the
  *  handlers govern what the function does when called at runtime. Analyzer-only
- *  callers can omit handlers; runtime callers (kernel) must supply real ones. */
+ *  callers can omit handlers; runtime callers (kernel) must supply real ones.
+ *
+ *  Also registers the `Stream` object type, backed by the `Stream` class from
+ *  `@telorun/sdk`. CEL's type-checker rejects values whose constructor isn't
+ *  Object/Map/Array/Set/registered; producers that need to expose an
+ *  `AsyncIterable` through a stream-typed property must wrap the iterable in
+ *  `new Stream(...)` so its constructor is the registered class. The type has
+ *  no fields, so terminal access (passing the value through CEL) succeeds but
+ *  member access raises a CEL error at runtime — matching the analyzer's
+ *  static check on `x-telo-stream`-marked properties. */
 export declare function buildCelEnvironment(handlers?: CelHandlers): Environment;
 /** Clone `baseEnv` and register typed variable declarations so that
  *  `env.check(expr)` can infer return types for expressions referencing known variables.

package/dist/cel-environment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cel-environment.d.ts","sourceRoot":"","sources":["../src/cel-environment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrD,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;CAC/B;AAaD;;;iFAGiF;AACjF,wBAAgB,mBAAmB,CAAC,QAAQ,GAAE,WAA2B,GAAG,WAAW,CActF;AAED;;;;;;;;;uEASuE;AACvE,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,gBAAgB,EAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,GAC9C,WAAW,CAyCb"}
+{"version":3,"file":"cel-environment.d.ts","sourceRoot":"","sources":["../src/cel-environment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAU,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAG7D,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;CAC/B;AAaD;;;;;;;;;;;;yDAYyD;AACzD,wBAAgB,mBAAmB,CAAC,QAAQ,GAAE,WAA2B,GAAG,WAAW,CAetF;AAED;;;;;;;;;uEASuE;AACvE,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,gBAAgB,EAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,GAC9C,WAAW,CAyCb"}

package/dist/cel-environment.js

@@ -1,4 +1,5 @@
 import { Environment } from "@marcbachmann/cel-js";
+import { Stream } from "@telorun/sdk";
 import { jsonSchemaToCelType } from "./schema-compat.js";
 const stub = (name) => () => {
     throw new Error(`${name}() is not available in this environment. ` +
@@ -10,7 +11,16 @@ const STUB_HANDLERS = {
 /** Build a CEL `Environment` with Telo's stdlib of functions. Always registers the
  *  same function signatures (so `env.check()` succeeds for type-inference) — the
  *  handlers govern what the function does when called at runtime. Analyzer-only
- *  callers can omit handlers; runtime callers (kernel) must supply real ones. */
+ *  callers can omit handlers; runtime callers (kernel) must supply real ones.
+ *
+ *  Also registers the `Stream` object type, backed by the `Stream` class from
+ *  `@telorun/sdk`. CEL's type-checker rejects values whose constructor isn't
+ *  Object/Map/Array/Set/registered; producers that need to expose an
+ *  `AsyncIterable` through a stream-typed property must wrap the iterable in
+ *  `new Stream(...)` so its constructor is the registered class. The type has
+ *  no fields, so terminal access (passing the value through CEL) succeeds but
+ *  member access raises a CEL error at runtime — matching the analyzer's
+ *  static check on `x-telo-stream`-marked properties. */
 export function buildCelEnvironment(handlers = STUB_HANDLERS) {
     return new Environment({ unlistedVariablesAreDyn: true })
         .registerFunction("join(list, string): string", (list, sep) => list.map(String).join(sep))
@@ -24,7 +34,8 @@ export function buildCelEnvironment(handlers = STUB_HANDLERS) {
             return [...map.values()];
         return Object.values(map);
     })
-        .registerFunction("sha256(string): string", (s) => handlers.sha256(s));
+        .registerFunction("sha256(string): string", (s) => handlers.sha256(s))
+        .registerType("Stream", Stream);
 }
 /** Clone `baseEnv` and register typed variable declarations so that
  *  `env.check(expr)` can infer return types for expressions referencing known variables.

package/dist/manifest-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest-loader.d.ts","sourceRoot":"","sources":["../src/manifest-loader.ts"],"names":[],"mappings":"AACA,OAAO,EAAmB,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAOtE,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EAGpB,MAAM,YAAY,CAAC;AASpB,qBAAa,MAAM;IACjB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAGxB;IAEJ,SAAS,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,qBAAqB,GAAE,cAAc,EAAE,GAAG,iBAAsB;IAmB5E,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;IAKtC,OAAO,CAAC,IAAI;IAMN,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK/C,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAqGnE,eAAe;YAoBf,eAAe;IAgEvB,iBAAiB,CACrB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;QACT,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,gBAAgB,EAAE,CAAC;QAC9B,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;KAClD,GAAG,IAAI,CAAC;IAiCH,eAAe,CACnB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,KAAK,IAAI,GAC5C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAsCrC,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;CA2GnE"}
+{"version":3,"file":"manifest-loader.d.ts","sourceRoot":"","sources":["../src/manifest-loader.ts"],"names":[],"mappings":"AACA,OAAO,EAAmB,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAOtE,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EAGpB,MAAM,YAAY,CAAC;AASpB,qBAAa,MAAM;IACjB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAGxB;IAEJ,SAAS,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,qBAAqB,GAAE,cAAc,EAAE,GAAG,iBAAsB;IAmB5E,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;IAKtC,OAAO,CAAC,IAAI;IAMN,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK/C,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAqGnE,eAAe;YAoBf,eAAe;IAgEvB,iBAAiB,CACrB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;QACT,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,gBAAgB,EAAE,CAAC;QAC9B,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;KAClD,GAAG,IAAI,CAAC;IAiCH,eAAe,CACnB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,KAAK,IAAI,GAC5C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAsCrC,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;CA+HnE"}

package/dist/manifest-loader.js

@@ -336,6 +336,23 @@ export class Loader {
                     e.sourceLine = m.metadata?.sourceLine ?? 0;
                     throw e;
                 }
+                if (!importedLibrary) {
+                    const kinds = imported
+                        .map((im) => im.kind)
+                        .filter((k) => typeof k === "string");
+                    // Prefer the URL the source layer actually fetched (stamped onto every
+                    // loaded manifest's metadata.source) over the raw input — for registry
+                    // refs the input is e.g. "std/foo@1.0.0", not a URL.
+                    const fetchedFrom = (imported[0]?.metadata?.source) ?? importUrl;
+                    const detail = kinds.length
+                        ? `Fetched ${imported.length} document(s) with kinds [${kinds.join(", ")}].`
+                        : `Fetched manifest contained no recognizable Telo documents — check that the source ` +
+                            `serves a Telo.Library manifest and not an upstream error page.`;
+                    const e = new Error(`Telo.Import target '${importSource}' did not resolve to a Telo.Library. ` +
+                        `Fetched from: ${fetchedFrom}. ${detail}`);
+                    e.sourceLine = m.metadata?.sourceLine ?? 0;
+                    throw e;
+                }
                 if (importedLibrary?.metadata?.name) {
                     libraryIdentityByUrl.set(importUrl, {
                         name: importedLibrary.metadata.name,

package/dist/normalize-inline-resources.js

@@ -78,6 +78,28 @@ function extractInlinesAtPath(resource, fieldPath, parentName, parentModule, inv
         if (!obj || typeof obj !== "object" || partsLeft.length === 0)
             return;
         const [head, ...rest] = partsLeft;
+        // Map iteration: descend into every value of the current object (used for
+        // schema fields with `additionalProperties` like `content[mime]`).
+        if (head === "{}") {
+            const container = obj;
+            for (const mapKey of Object.keys(container)) {
+                const elem = container[mapKey];
+                if (!elem || typeof elem !== "object")
+                    continue;
+                const sanitizedKey = sanitizeName(mapKey);
+                if (rest.length === 0) {
+                    if (isInlineResource(elem)) {
+                        const name = sanitizeName([parentName, ...nameParts, sanitizedKey].join("_"));
+                        extracted.push(buildManifest(elem, name, parentModule, invocationContext));
+                        container[mapKey] = { kind: elem.kind, name };
+                    }
+                }
+                else {
+                    traverse(elem, rest, [...nameParts, sanitizedKey]);
+                }
+            }
+            return;
+        }
         const isArr = head.endsWith("[]");
         const key = isArr ? head.slice(0, -2) : head;
         const container = obj;

package/dist/reference-field-map.d.ts

@@ -33,11 +33,22 @@ export declare function isSchemaFromEntry(entry: FieldMapEntry): entry is Schema
 /** Keys that a named reference object may have. Values beyond these indicate an inline resource. */
 export declare const REFERENCE_KEYS: Set<string>;
 /** True when `val` is an inline resource definition rather than a named reference.
- *  A named reference (has string `name`) may carry extra keys (e.g. `inputs`) that
- *  are runtime call parameters — those are never inline resources. */
+ *  Three shapes flow through here:
+ *   - `{kind, name}` (optionally with runtime call args) → named reference, NOT inline.
+ *   - `{kind, ...config}` with no name → inline definition with config; extract.
+ *   - `{kind}` alone (bare kind, no name) → inline singleton — extract a fresh
+ *     stateless resource. Lets simple stateless kinds be used inline without
+ *     boilerplate (e.g. `encoder: {kind: Ndjson.Encoder}`, `invoke: {kind: Run.Throw}`).
+ *
+ *  A named reference (has string `name`) may carry extra keys (e.g. `inputs`)
+ *  that are runtime call parameters — those are never inline resources. */
 export declare function isInlineResource(val: Record<string, unknown>): boolean;
 /** Resolves all values at a field map path in a resource config.
- *  `[]` in a path segment means "iterate array at this key". */
+ *  Path-segment markers:
+ *   - `[]`  iterate array values at this key
+ *   - `{}`  iterate map values (every value in an `additionalProperties`-typed
+ *           object — used for fields like `content[mime]` whose schema declares
+ *           a key-as-MIME map). The path is `<key>.{}.<rest>`. */
 export declare function resolveFieldValues(obj: unknown, path: string): unknown[];
 /**
  * Traverses a definition's JSON Schema once and returns a field map recording every

package/dist/reference-field-map.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reference-field-map.d.ts","sourceRoot":"","sources":["../src/reference-field-map.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,MAAM,WAAW,aAAa;IAC5B;sDACkD;IAClD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,0FAA0F;IAC1F,OAAO,EAAE,OAAO,CAAC;IACjB;8DAC0D;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC/B;AAED,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAC9B;2CACuC;IACvC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC1B;AAED;8CAC8C;AAC9C,MAAM,WAAW,oBAAoB;IACnC;;qFAEiF;IACjF,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,eAAe,GAAG,oBAAoB,CAAC;AAEnF;0FAC0F;AAC1F,MAAM,MAAM,iBAAiB,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAE3D,wBAAgB,UAAU,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,IAAI,aAAa,CAEvE;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,IAAI,eAAe,CAE3E;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,IAAI,oBAAoB,CAErF;AAED,oGAAoG;AACpG,eAAO,MAAM,cAAc,aAAwC,CAAC;AAEpE;;sEAEsE;AACtE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAGtE;AAED;gEACgE;AAChE,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,EAAE,CAiBxE;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,iBAAiB,CAQrF"}
+{"version":3,"file":"reference-field-map.d.ts","sourceRoot":"","sources":["../src/reference-field-map.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,MAAM,WAAW,aAAa;IAC5B;sDACkD;IAClD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,0FAA0F;IAC1F,OAAO,EAAE,OAAO,CAAC;IACjB;8DAC0D;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC/B;AAED,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAC9B;2CACuC;IACvC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC1B;AAED;8CAC8C;AAC9C,MAAM,WAAW,oBAAoB;IACnC;;qFAEiF;IACjF,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,eAAe,GAAG,oBAAoB,CAAC;AAEnF;0FAC0F;AAC1F,MAAM,MAAM,iBAAiB,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAE3D,wBAAgB,UAAU,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,IAAI,aAAa,CAEvE;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,IAAI,eAAe,CAE3E;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,IAAI,oBAAoB,CAErF;AAED,oGAAoG;AACpG,eAAO,MAAM,cAAc,aAAwC,CAAC;AAEpE;;;;;;;;;2EAS2E;AAC3E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAItE;AAED;;;;;kEAKkE;AAClE,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,EAAE,CA6BxE;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,iBAAiB,CAQrF"}

package/dist/reference-field-map.js

@@ -10,19 +10,46 @@ export function isSchemaFromEntry(entry) {
 /** Keys that a named reference object may have. Values beyond these indicate an inline resource. */
 export const REFERENCE_KEYS = new Set(["kind", "name", "metadata"]);
 /** True when `val` is an inline resource definition rather than a named reference.
- *  A named reference (has string `name`) may carry extra keys (e.g. `inputs`) that
- *  are runtime call parameters — those are never inline resources. */
+ *  Three shapes flow through here:
+ *   - `{kind, name}` (optionally with runtime call args) → named reference, NOT inline.
+ *   - `{kind, ...config}` with no name → inline definition with config; extract.
+ *   - `{kind}` alone (bare kind, no name) → inline singleton — extract a fresh
+ *     stateless resource. Lets simple stateless kinds be used inline without
+ *     boilerplate (e.g. `encoder: {kind: Ndjson.Encoder}`, `invoke: {kind: Run.Throw}`).
+ *
+ *  A named reference (has string `name`) may carry extra keys (e.g. `inputs`)
+ *  that are runtime call parameters — those are never inline resources. */
 export function isInlineResource(val) {
     if (typeof val.name === "string")
         return false;
-    return Object.keys(val).some((k) => !REFERENCE_KEYS.has(k));
+    if (typeof val.kind !== "string")
+        return false;
+    return true;
 }
 /** Resolves all values at a field map path in a resource config.
- *  `[]` in a path segment means "iterate array at this key". */
+ *  Path-segment markers:
+ *   - `[]`  iterate array values at this key
+ *   - `{}`  iterate map values (every value in an `additionalProperties`-typed
+ *           object — used for fields like `content[mime]` whose schema declares
+ *           a key-as-MIME map). The path is `<key>.{}.<rest>`. */
 export function resolveFieldValues(obj, path) {
     const parts = path.split(".");
     let current = [obj];
     for (const part of parts) {
+        if (part === "{}") {
+            // Iterate the values of every map currently in `current`.
+            const next = [];
+            for (const item of current) {
+                if (!item || typeof item !== "object")
+                    continue;
+                for (const v of Object.values(item)) {
+                    if (v != null)
+                        next.push(v);
+                }
+            }
+            current = next;
+            continue;
+        }
         const isArray = part.endsWith("[]");
         const key = isArray ? part.slice(0, -2) : part;
         const next = [];
@@ -104,4 +131,12 @@ function traverseNode(node, path, map) {
             traverseNode(propSchema, `${path}.${key}`, map);
         }
     }
+    // Map — `additionalProperties: { ... }` describes every value in an
+    // open-keyed object. Encoder refs nested inside `content[mime]` map
+    // entries reach Phase 5 through this branch.
+    if (node.additionalProperties &&
+        typeof node.additionalProperties === "object" &&
+        !Array.isArray(node.additionalProperties)) {
+        traverseNode(node.additionalProperties, `${path}.{}`, map);
+    }
 }

package/dist/sources/registry-source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry-source.d.ts","sourceRoot":"","sources":["../../src/sources/registry-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAI7E,qBAAa,cAAe,YAAW,cAAc;IACvC,OAAO,CAAC,WAAW;gBAAX,WAAW,SAAuB;IAEtD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAWxB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAWxE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAMvD,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,cAAc;CAmBvB"}
+{"version":3,"file":"registry-source.d.ts","sourceRoot":"","sources":["../../src/sources/registry-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAI7E,qBAAa,cAAe,YAAW,cAAc;IACvC,OAAO,CAAC,WAAW;gBAAX,WAAW,SAAuB;IAEtD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAWxB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IA4BxE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAMvD,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,cAAc;CAmBvB"}

package/dist/sources/registry-source.js

@@ -19,7 +19,21 @@ export class RegistrySource {
         if (!response.ok) {
             throw new Error(`Failed to fetch manifest ${moduleRef}: ${response.status} ${response.statusText}`);
         }
-        return { text: await response.text(), source: fetchUrl };
+        const text = await response.text();
+        // Some object-storage backends (e.g. Cloudflare R2 / S3) surface auth or
+        // permission failures by returning a 200 status with an XML error body.
+        // Catch this here so the loader produces a precise error rather than
+        // silently parsing the XML as YAML and reporting a downstream UNDEFINED_KIND.
+        if (text.trimStart().startsWith("<?xml") || text.trimStart().startsWith("<Error")) {
+            const codeMatch = text.match(/<Code>([^<]+)<\/Code>/);
+            const messageMatch = text.match(/<Message>([^<]+)<\/Message>/);
+            const detail = codeMatch && messageMatch
+                ? `${codeMatch[1]}: ${messageMatch[1]}`
+                : text.slice(0, 200);
+            throw new Error(`Registry returned a non-manifest response for ${moduleRef} ` +
+                `(URL: ${fetchUrl}): ${detail}`);
+        }
+        return { text, source: fetchUrl };
     }
     resolveRelative(base, relative) {
         const baseUrl = this.supports(base) ? this.toRegistryModuleBase(base) : base;

package/dist/validate-cel-context.d.ts

@@ -16,7 +16,8 @@ export declare function extractAccessChains(node: ASTNode): string[][];
 /**
  * Check whether a member-access chain accesses only fields declared in a JSON Schema.
  * Returns an error string if a field is unknown in a schema that declares explicit
- * properties without `additionalProperties: true`.
+ * properties without `additionalProperties: true`, or if the chain attempts to
+ * reach inside an `x-telo-stream: true` property.
  * Returns null when the chain is valid or the schema is too open to judge.
  */
 export declare function validateChainAgainstSchema(chain: string[], schema: Record<string, any>): string | null;

package/dist/validate-cel-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAEpD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CA6BjC;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,EAAE,EAAE,CAI7D;AAwED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,EAAE,EACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC1B,MAAM,GAAG,IAAI,CAmBf;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GACnC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAqDrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB"}
+{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAEpD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CA6BjC;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,EAAE,EAAE,CAI7D;AAsFD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,EAAE,EACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC1B,MAAM,GAAG,IAAI,CAiCf;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GACnC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAqDrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB"}

package/dist/validate-cel-context.js

@@ -90,7 +90,15 @@ function visitNode(node, chains, boundVars) {
 function isASTNode(v) {
     return v !== null && typeof v === "object" && "op" in v;
 }
-/** Returns the member-access chain for a node if it is purely an id or "." chain; else null. */
+// Sentinel used in extracted chains to represent an `[index]` access. The
+// validator treats it like any other deeper segment, so a chain that reaches
+// past an `x-telo-stream`-marked property via `[N]` is rejected the same way
+// `.field` access is. The actual index expression is opaque to the chain
+// validator (it only checks property names against the schema).
+const INDEX_SEGMENT = "[*]";
+/** Returns the member-access chain for a node if it is purely an id, ".", or
+ *  "[]" chain; else null. Bracket index access is captured as `INDEX_SEGMENT`
+ *  so it counts as a chain extension for the stream-property opacity rule. */
 function extractChain(node, boundVars) {
     if (node.op === "id") {
         const name = node.args;
@@ -104,12 +112,19 @@ function extractChain(node, boundVars) {
         if (parent !== null)
             return [...parent, field];
     }
+    if (node.op === "[]") {
+        const [obj] = node.args;
+        const parent = extractChain(obj, boundVars);
+        if (parent !== null)
+            return [...parent, INDEX_SEGMENT];
+    }
     return null;
 }
 /**
  * Check whether a member-access chain accesses only fields declared in a JSON Schema.
  * Returns an error string if a field is unknown in a schema that declares explicit
- * properties without `additionalProperties: true`.
+ * properties without `additionalProperties: true`, or if the chain attempts to
+ * reach inside an `x-telo-stream: true` property.
  * Returns null when the chain is valid or the schema is too open to judge.
  */
 export function validateChainAgainstSchema(chain, schema) {
@@ -122,8 +137,20 @@ export function validateChainAgainstSchema(chain, schema) {
         if (!props)
             return null;
         if (key in props) {
+            const propSchema = props[key];
+            // Stream-typed properties are opaque: pass through by reference, no
+            // member access inside. Reaching `result.output` is fine; reaching
+            // `result.output.text` is a wiring mistake — the consumer either iterates
+            // the stream in a JS.Script step or pipes it through an Encoder.
+            if (propSchema &&
+                typeof propSchema === "object" &&
+                propSchema["x-telo-stream"] === true &&
+                i < chain.length - 1) {
+                const path = chain.slice(0, i + 1).join(".");
+                return `'${path}' yields a stream — pipe it through an Encoder or iterate in a JS.Script step (no member access on stream-typed values)`;
+            }
             // Known property — drill into it even if additionalProperties is true
-            current = props[key];
+            current = propSchema;
             continue;
         }
         // Unknown property — only flag if schema is closed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.5.0",
+  "version": "0.6.1",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",
@@ -41,7 +41,7 @@
     "ajv-formats": "^3.0.1",
     "jsonpath-plus": "^10.3.0",
     "yaml": "^2.8.3",
-    "@telorun/sdk": "0.6.0"
+    "@telorun/sdk": "0.7.0"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",

package/src/analyzer.ts

@@ -34,6 +34,41 @@ import { validateThrowsCoverage } from "./validate-throws-coverage.js";
 
 const TEMPLATE_REGEX = /\$\{\{\s*([^}]+?)\s*\}\}/g;
 
+const SELF_PREFIX = "Self.";
+
+/** Resolve an alias-prefixed kind value (e.g. `Self.Encoder` or `Ai.Model`)
+ *  to its canonical form. `Self.<Name>` resolves to `<ownModule>.<Name>` —
+ *  the magic alias for "this library's own module" — and other prefixes
+ *  resolve through the declaring file's Telo.Import aliases. */
+function resolveSelfOrAlias(
+  value: string,
+  ownModule: string | undefined,
+  scopeResolver: AliasResolver,
+): string | undefined {
+  if (value.startsWith(SELF_PREFIX) && ownModule) {
+    return `${ownModule}.${value.slice(SELF_PREFIX.length)}`;
+  }
+  return scopeResolver.resolveKind(value);
+}
+
+/** Look up a top-level field (`outputType`, `inputType`) on a kind's
+ *  `Telo.Definition`. Used as a fallback by `buildStepContextSchema` when the
+ *  invoked resource manifest doesn't carry the field inline — most kinds
+ *  declare result shape on the definition, not the resource. */
+function lookupDefinitionTypeField(
+  invokedKind: string,
+  fieldName: string,
+  defs: DefinitionRegistry,
+  aliases: AliasResolver,
+  allManifests: Record<string, any>[],
+): Record<string, any> | undefined {
+  const canonical = aliases.resolveKind(invokedKind) ?? invokedKind;
+  const def = defs.resolve(canonical);
+  if (!def) return undefined;
+  const value = (def as unknown as Record<string, unknown>)[fieldName];
+  return resolveTypeFieldToSchema(value, allManifests);
+}
+
 function walkCelExpressions(
   value: unknown,
   path: string,
@@ -91,15 +126,77 @@ function extractContextsFromSchema(
   return results;
 }
 
+/** Resolve a local `$ref` (only `#/$defs/<name>` form) against the root schema.
+ *  Non-refs and unresolved refs pass through unchanged. */
+function resolveLocalRef(
+  schema: Record<string, any> | undefined,
+  root: Record<string, any>,
+): Record<string, any> | undefined {
+  if (!schema) return undefined;
+  const ref = schema.$ref;
+  if (typeof ref === "string" && ref.startsWith("#/$defs/")) {
+    const defName = ref.slice("#/$defs/".length);
+    const resolved = root.$defs?.[defName];
+    if (resolved && typeof resolved === "object") return resolved as Record<string, any>;
+  }
+  return schema;
+}
+
+/** Gather property schemas from a (possibly variant-bearing) object schema:
+ *  top-level `properties` plus every `oneOf` / `anyOf` / `allOf` branch. */
+function gatherPropertySchemas(schema: Record<string, any>): Array<[string, Record<string, any>]> {
+  const out: Array<[string, Record<string, any>]> = [];
+  if (schema.properties && typeof schema.properties === "object") {
+    for (const [k, v] of Object.entries(schema.properties as Record<string, any>)) {
+      out.push([k, v as Record<string, any>]);
+    }
+  }
+  for (const variantKey of ["oneOf", "anyOf", "allOf"] as const) {
+    const arr = schema[variantKey];
+    if (!Array.isArray(arr)) continue;
+    for (const variant of arr) {
+      if (variant && typeof variant === "object" && variant.properties) {
+        for (const [k, v] of Object.entries(variant.properties as Record<string, any>)) {
+          out.push([k, v as Record<string, any>]);
+        }
+      }
+    }
+  }
+  return out;
+}
+
 /**
  * Build a `steps` context schema from `x-telo-step-context` annotation.
  * Walks each step in the manifest array, resolves the invoked resource's outputType,
  * and builds `steps.<name>.result` context entries.
+ *
+ * outputType resolution falls through three layers:
+ *   1. The invoked resource manifest's own `outputType` field (rare — most
+ *      resources don't declare outputType inline).
+ *   2. The kind's `Telo.Definition` outputType (the common case for kinds that
+ *      declare a stable result shape, e.g. `Ai.TextStream` ↦ `{output: stream}`).
+ *   3. Permissive `{type: object, additionalProperties: true}` if neither
+ *      yields a schema.
+ *
+ * Layer 2 is what makes `x-telo-stream` properties on definitions actually
+ * govern step-result chain validation — without it, the validator falls back
+ * to permissive and the stream-opacity rule never fires.
+ *
+ * Recursion into nested step arrays is annotation-driven via
+ * `x-telo-topology-role`. The analyzer recognises three role values:
+ *   - `branch`     — value is an array of steps (e.g. then / else / do / catch).
+ *   - `branch-list`— value is an array of objects each carrying further roled
+ *                    sub-properties (e.g. elseif: [{ if, then }]).
+ *   - `case-map`   — value is an object whose values are step arrays (e.g. cases).
+ * No specific Run.Sequence field name is hardcoded; any kind that uses
+ * `x-telo-step-context` and tags its branch fields with these roles works.
  */
 function buildStepContextSchema(
   manifest: Record<string, any>,
   defSchema: Record<string, any>,
   allManifests: Record<string, any>[],
+  defs: DefinitionRegistry,
+  aliases: AliasResolver,
 ): Record<string, any> | undefined {
   const props = defSchema.properties as Record<string, any> | undefined;
   if (!props) return undefined;
@@ -115,8 +212,43 @@ function buildStepContextSchema(
     const steps = manifest[fieldName];
     if (!Array.isArray(steps)) continue;
 
+    const stepItemSchema = resolveLocalRef(
+      fieldSchema.items as Record<string, any> | undefined,
+      defSchema,
+    );
+
     const stepProperties: Record<string, any> = {};
-    const collectSteps = (items: unknown[]) => {
+
+    const dispatchRole = (
+      data: unknown,
+      role: string,
+      itemsSchema: Record<string, any> | undefined,
+    ): void => {
+      if (role === "branch" && Array.isArray(data)) {
+        collectSteps(data);
+      } else if (role === "case-map" && data && typeof data === "object" && !Array.isArray(data)) {
+        for (const arr of Object.values(data as Record<string, unknown>)) {
+          if (Array.isArray(arr)) collectSteps(arr);
+        }
+      } else if (role === "branch-list" && Array.isArray(data)) {
+        const entrySchema = resolveLocalRef(itemsSchema, defSchema);
+        if (!entrySchema) return;
+        for (const entry of data) {
+          if (!entry || typeof entry !== "object") continue;
+          for (const [subKey, subSchema] of gatherPropertySchemas(entrySchema)) {
+            const subRole = subSchema["x-telo-topology-role"];
+            if (typeof subRole !== "string") continue;
+            dispatchRole(
+              (entry as Record<string, any>)[subKey],
+              subRole,
+              subSchema.items as Record<string, any> | undefined,
+            );
+          }
+        }
+      }
+    };
+
+    function collectSteps(items: unknown[]): void {
       for (const step of items) {
         if (!step || typeof step !== "object") continue;
         const s = step as Record<string, any>;
@@ -139,6 +271,17 @@ function buildStepContextSchema(
             } else {
               outputSchema = resolveTypeFieldToSchema(invoke[outputTypeField], allManifests);
             }
+            // Fallback: pull outputType from the kind's Telo.Definition. The
+            // resource manifest typically doesn't carry outputType; the def does.
+            if (!outputSchema && invokedKind) {
+              outputSchema = lookupDefinitionTypeField(
+                invokedKind,
+                outputTypeField,
+                defs,
+                aliases,
+                allManifests,
+              );
+            }
           }
           stepProperties[name] = {
             type: "object",
@@ -147,18 +290,16 @@ function buildStepContextSchema(
             },
           };
         }
-        // Recurse into nested step arrays (then, else, do, catch, finally, try, default, cases)
-        for (const nested of ["then", "else", "do", "catch", "finally", "try", "default"]) {
-          if (Array.isArray(s[nested])) collectSteps(s[nested]);
-        }
-        // cases is an object map of arrays
-        if (s.cases && typeof s.cases === "object") {
-          for (const arr of Object.values(s.cases)) {
-            if (Array.isArray(arr)) collectSteps(arr);
+        if (stepItemSchema) {
+          for (const [propKey, propSchema] of gatherPropertySchemas(stepItemSchema)) {
+            const role = propSchema["x-telo-topology-role"];
+            if (typeof role !== "string") continue;
+            dispatchRole(s[propKey], role, propSchema.items as Record<string, any> | undefined);
           }
         }
       }
-    };
+    }
+
     collectSteps(steps);
 
     if (Object.keys(stepProperties).length > 0) {
@@ -317,6 +458,25 @@ export class StaticAnalyzer {
         const namespace = ((m.metadata as any).namespace as string | undefined) ?? null;
         const moduleName = m.metadata.name as string;
         if (moduleName) defs.registerModuleIdentity(namespace, moduleName);
+        // Auto-register `Self` as an alias for this library's own module name.
+        // Lets same-library `extends:` work (e.g. `extends: Self.Encoder` for a
+        // concrete kind whose abstract lives in the same Telo.Library) without
+        // requiring a self-import (which would loop the loader). Resolves
+        // through the same alias machinery as user-declared Telo.Imports —
+        // honours the library's `exports.kinds` list, no special cases.
+        if (moduleName) {
+          const exportedKinds: string[] = ((m as any).exports?.kinds as string[] | undefined) ?? [];
+          if (rootModules.has(moduleName)) {
+            aliases.registerImport("Self", moduleName, exportedKinds);
+          } else {
+            let libResolver = aliasesByModule.get(moduleName);
+            if (!libResolver) {
+              libResolver = new AliasResolver();
+              aliasesByModule.set(moduleName, libResolver);
+            }
+            libResolver.registerImport("Self", moduleName, exportedKinds);
+          }
+        }
       }
       if (m.kind === "Telo.Import") {
         const alias = m.metadata.name as string;
@@ -486,6 +646,8 @@ export class StaticAnalyzer {
             m as Record<string, any>,
             mDefinition.schema as Record<string, any>,
             allManifests as Record<string, any>[],
+            defs,
+            aliases,
           )
         : undefined;
 

package/src/cel-environment.ts

@@ -1,5 +1,5 @@
 import { Environment } from "@marcbachmann/cel-js";
-import type { ResourceManifest } from "@telorun/sdk";
+import { Stream, type ResourceManifest } from "@telorun/sdk";
 import { jsonSchemaToCelType } from "./schema-compat.js";
 
 export interface CelHandlers {
@@ -20,7 +20,16 @@ const STUB_HANDLERS: CelHandlers = {
 /** Build a CEL `Environment` with Telo's stdlib of functions. Always registers the
  *  same function signatures (so `env.check()` succeeds for type-inference) — the
  *  handlers govern what the function does when called at runtime. Analyzer-only
- *  callers can omit handlers; runtime callers (kernel) must supply real ones. */
+ *  callers can omit handlers; runtime callers (kernel) must supply real ones.
+ *
+ *  Also registers the `Stream` object type, backed by the `Stream` class from
+ *  `@telorun/sdk`. CEL's type-checker rejects values whose constructor isn't
+ *  Object/Map/Array/Set/registered; producers that need to expose an
+ *  `AsyncIterable` through a stream-typed property must wrap the iterable in
+ *  `new Stream(...)` so its constructor is the registered class. The type has
+ *  no fields, so terminal access (passing the value through CEL) succeeds but
+ *  member access raises a CEL error at runtime — matching the analyzer's
+ *  static check on `x-telo-stream`-marked properties. */
 export function buildCelEnvironment(handlers: CelHandlers = STUB_HANDLERS): Environment {
   return new Environment({ unlistedVariablesAreDyn: true })
     .registerFunction("join(list, string): string", (list: unknown[], sep: string) =>
@@ -34,7 +43,8 @@ export function buildCelEnvironment(handlers: CelHandlers = STUB_HANDLERS): Envi
       if (map instanceof Map) return [...map.values()];
       return Object.values(map as Record<string, unknown>);
     })
-    .registerFunction("sha256(string): string", (s: string) => handlers.sha256(s));
+    .registerFunction("sha256(string): string", (s: string) => handlers.sha256(s))
+    .registerType("Stream", Stream as unknown as new (...args: unknown[]) => unknown);
 }
 
 /** Clone `baseEnv` and register typed variable declarations so that

package/src/manifest-loader.ts

@@ -398,6 +398,26 @@ export class Loader {
           (e as any).sourceLine = (m.metadata as any)?.sourceLine ?? 0;
           throw e;
         }
+        if (!importedLibrary) {
+          const kinds = imported
+            .map((im) => im.kind)
+            .filter((k): k is string => typeof k === "string");
+          // Prefer the URL the source layer actually fetched (stamped onto every
+          // loaded manifest's metadata.source) over the raw input — for registry
+          // refs the input is e.g. "std/foo@1.0.0", not a URL.
+          const fetchedFrom =
+            ((imported[0]?.metadata as { source?: string } | undefined)?.source) ?? importUrl;
+          const detail = kinds.length
+            ? `Fetched ${imported.length} document(s) with kinds [${kinds.join(", ")}].`
+            : `Fetched manifest contained no recognizable Telo documents — check that the source ` +
+              `serves a Telo.Library manifest and not an upstream error page.`;
+          const e = new Error(
+            `Telo.Import target '${importSource}' did not resolve to a Telo.Library. ` +
+              `Fetched from: ${fetchedFrom}. ${detail}`,
+          );
+          (e as any).sourceLine = (m.metadata as any)?.sourceLine ?? 0;
+          throw e;
+        }
         if (importedLibrary?.metadata?.name) {
           libraryIdentityByUrl.set(importUrl, {
             name: importedLibrary.metadata.name as string,

package/src/normalize-inline-resources.ts

@@ -107,6 +107,29 @@ function extractInlinesAtPath(
     if (!obj || typeof obj !== "object" || partsLeft.length === 0) return;
 
     const [head, ...rest] = partsLeft;
+
+    // Map iteration: descend into every value of the current object (used for
+    // schema fields with `additionalProperties` like `content[mime]`).
+    if (head === "{}") {
+      const container = obj as Record<string, unknown>;
+      for (const mapKey of Object.keys(container)) {
+        const elem = container[mapKey];
+        if (!elem || typeof elem !== "object") continue;
+        const sanitizedKey = sanitizeName(mapKey);
+
+        if (rest.length === 0) {
+          if (isInlineResource(elem as Record<string, unknown>)) {
+            const name = sanitizeName([parentName, ...nameParts, sanitizedKey].join("_"));
+            extracted.push(buildManifest(elem as Record<string, unknown>, name, parentModule, invocationContext));
+            container[mapKey] = { kind: (elem as Record<string, unknown>).kind, name };
+          }
+        } else {
+          traverse(elem, rest, [...nameParts, sanitizedKey]);
+        }
+      }
+      return;
+    }
+
     const isArr = head.endsWith("[]");
     const key = isArr ? head.slice(0, -2) : head;
     const container = obj as Record<string, unknown>;

package/src/reference-field-map.ts

@@ -48,19 +48,43 @@ export function isSchemaFromEntry(entry: FieldMapEntry): entry is SchemaFromFiel
 export const REFERENCE_KEYS = new Set(["kind", "name", "metadata"]);
 
 /** True when `val` is an inline resource definition rather than a named reference.
- *  A named reference (has string `name`) may carry extra keys (e.g. `inputs`) that
- *  are runtime call parameters — those are never inline resources. */
+ *  Three shapes flow through here:
+ *   - `{kind, name}` (optionally with runtime call args) → named reference, NOT inline.
+ *   - `{kind, ...config}` with no name → inline definition with config; extract.
+ *   - `{kind}` alone (bare kind, no name) → inline singleton — extract a fresh
+ *     stateless resource. Lets simple stateless kinds be used inline without
+ *     boilerplate (e.g. `encoder: {kind: Ndjson.Encoder}`, `invoke: {kind: Run.Throw}`).
+ *
+ *  A named reference (has string `name`) may carry extra keys (e.g. `inputs`)
+ *  that are runtime call parameters — those are never inline resources. */
 export function isInlineResource(val: Record<string, unknown>): boolean {
   if (typeof val.name === "string") return false;
-  return Object.keys(val).some((k) => !REFERENCE_KEYS.has(k));
+  if (typeof val.kind !== "string") return false;
+  return true;
 }
 
 /** Resolves all values at a field map path in a resource config.
- *  `[]` in a path segment means "iterate array at this key". */
+ *  Path-segment markers:
+ *   - `[]`  iterate array values at this key
+ *   - `{}`  iterate map values (every value in an `additionalProperties`-typed
+ *           object — used for fields like `content[mime]` whose schema declares
+ *           a key-as-MIME map). The path is `<key>.{}.<rest>`. */
 export function resolveFieldValues(obj: unknown, path: string): unknown[] {
   const parts = path.split(".");
   let current: unknown[] = [obj];
   for (const part of parts) {
+    if (part === "{}") {
+      // Iterate the values of every map currently in `current`.
+      const next: unknown[] = [];
+      for (const item of current) {
+        if (!item || typeof item !== "object") continue;
+        for (const v of Object.values(item as Record<string, unknown>)) {
+          if (v != null) next.push(v);
+        }
+      }
+      current = next;
+      continue;
+    }
     const isArray = part.endsWith("[]");
     const key = isArray ? part.slice(0, -2) : part;
     const next: unknown[] = [];
@@ -144,4 +168,15 @@ function traverseNode(node: Record<string, any>, path: string, map: ReferenceFie
       traverseNode(propSchema as Record<string, any>, `${path}.${key}`, map);
     }
   }
+
+  // Map — `additionalProperties: { ... }` describes every value in an
+  // open-keyed object. Encoder refs nested inside `content[mime]` map
+  // entries reach Phase 5 through this branch.
+  if (
+    node.additionalProperties &&
+    typeof node.additionalProperties === "object" &&
+    !Array.isArray(node.additionalProperties)
+  ) {
+    traverseNode(node.additionalProperties as Record<string, any>, `${path}.{}`, map);
+  }
 }

package/src/sources/registry-source.ts

@@ -24,7 +24,24 @@ export class RegistrySource implements ManifestSource {
         `Failed to fetch manifest ${moduleRef}: ${response.status} ${response.statusText}`,
       );
     }
-    return { text: await response.text(), source: fetchUrl };
+    const text = await response.text();
+    // Some object-storage backends (e.g. Cloudflare R2 / S3) surface auth or
+    // permission failures by returning a 200 status with an XML error body.
+    // Catch this here so the loader produces a precise error rather than
+    // silently parsing the XML as YAML and reporting a downstream UNDEFINED_KIND.
+    if (text.trimStart().startsWith("<?xml") || text.trimStart().startsWith("<Error")) {
+      const codeMatch = text.match(/<Code>([^<]+)<\/Code>/);
+      const messageMatch = text.match(/<Message>([^<]+)<\/Message>/);
+      const detail =
+        codeMatch && messageMatch
+          ? `${codeMatch[1]}: ${messageMatch[1]}`
+          : text.slice(0, 200);
+      throw new Error(
+        `Registry returned a non-manifest response for ${moduleRef} ` +
+          `(URL: ${fetchUrl}): ${detail}`,
+      );
+    }
+    return { text, source: fetchUrl };
   }
 
   resolveRelative(base: string, relative: string): string {

package/src/validate-cel-context.ts

@@ -107,7 +107,16 @@ function isASTNode(v: unknown): v is ASTNode {
   return v !== null && typeof v === "object" && "op" in (v as object);
 }
 
-/** Returns the member-access chain for a node if it is purely an id or "." chain; else null. */
+// Sentinel used in extracted chains to represent an `[index]` access. The
+// validator treats it like any other deeper segment, so a chain that reaches
+// past an `x-telo-stream`-marked property via `[N]` is rejected the same way
+// `.field` access is. The actual index expression is opaque to the chain
+// validator (it only checks property names against the schema).
+const INDEX_SEGMENT = "[*]";
+
+/** Returns the member-access chain for a node if it is purely an id, ".", or
+ *  "[]" chain; else null. Bracket index access is captured as `INDEX_SEGMENT`
+ *  so it counts as a chain extension for the stream-property opacity rule. */
 function extractChain(node: ASTNode, boundVars: Set<string>): string[] | null {
   if (node.op === "id") {
     const name = node.args as string;
@@ -119,13 +128,19 @@ function extractChain(node: ASTNode, boundVars: Set<string>): string[] | null {
     const parent = extractChain(obj, boundVars);
     if (parent !== null) return [...parent, field];
   }
+  if (node.op === "[]") {
+    const [obj] = node.args as [ASTNode, ASTNode];
+    const parent = extractChain(obj, boundVars);
+    if (parent !== null) return [...parent, INDEX_SEGMENT];
+  }
   return null;
 }
 
 /**
  * Check whether a member-access chain accesses only fields declared in a JSON Schema.
  * Returns an error string if a field is unknown in a schema that declares explicit
- * properties without `additionalProperties: true`.
+ * properties without `additionalProperties: true`, or if the chain attempts to
+ * reach inside an `x-telo-stream: true` property.
  * Returns null when the chain is valid or the schema is too open to judge.
  */
 export function validateChainAgainstSchema(
@@ -139,8 +154,22 @@ export function validateChainAgainstSchema(
     const props: Record<string, any> | undefined = current.properties;
     if (!props) return null;
     if (key in props) {
+      const propSchema = props[key];
+      // Stream-typed properties are opaque: pass through by reference, no
+      // member access inside. Reaching `result.output` is fine; reaching
+      // `result.output.text` is a wiring mistake — the consumer either iterates
+      // the stream in a JS.Script step or pipes it through an Encoder.
+      if (
+        propSchema &&
+        typeof propSchema === "object" &&
+        propSchema["x-telo-stream"] === true &&
+        i < chain.length - 1
+      ) {
+        const path = chain.slice(0, i + 1).join(".");
+        return `'${path}' yields a stream — pipe it through an Encoder or iterate in a JS.Script step (no member access on stream-typed values)`;
+      }
       // Known property — drill into it even if additionalProperties is true
-      current = props[key];
+      current = propSchema;
       continue;
     }
     // Unknown property — only flag if schema is closed