@telorun/analyzer 0.56.0 → 0.57.0

package/README.md

@@ -23,9 +23,9 @@ Built to be language-agnostic and infinitely extensible.
 
 ```bash
 # Reconcile your manifest into a running backend
-$ telo ./examples/hello-api
+$ telo ./examples/todo-app
 
-{"level":30,"time":1771610393008,"pid":1310178,"hostname":"dev","msg":"Server listening at http://127.0.0.1:8844"}
+{"level":30,"time":1771610393008,"pid":1310178,"hostname":"dev","msg":"Server listening at http://127.0.0.1:8077"}
 ```
 
 ## Why use Telo?

package/dist/analyzer.d.ts

@@ -40,6 +40,11 @@ export declare function gatherPropertySchemas(schema: Record<string, any>): Arra
  * hardcoded; recursion is driven entirely by the schema annotations.
  */
 export declare function walkStepArray(steps: unknown[], stepItemSchema: Record<string, any> | undefined, rootSchema: Record<string, any>, basePath: string, visit: (step: Record<string, any>, stepPath: string) => void): void;
+/** A pure-CEL leaf and the schema of the field it sits in. */
+export interface CelValueSlot {
+    readonly path: string;
+    readonly schema: Record<string, any>;
+}
 export interface StaticAnalyzerOptions {
     celHandlers?: CelHandlers;
 }

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIzE,OAAO,EACL,aAAa,EAEb,KAAK,YAAY,EAElB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EACL,KAAK,aAAa,EAGnB,MAAM,0BAA0B,CAAC;AAsBlC,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAiBvF,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAqF/F;;;;;uDAKuD;AACvD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,aAAa,GAAG;IAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAA;CAAE,CAO9F;AA6FD;0CAC0C;AAC1C,eAAO,MAAM,eAAe,GAAI,OAAO;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OACT,CAAC;AAErD;8EAC8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhD;AAuBD;2DAC2D;AAC3D,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACvC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CASjC;AAED;4EAC4E;AAC5E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAmBvG;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,OAAO,EAAE,EAChB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EAC/C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,GAC3D,IAAI,CAiDN;AA8mBD,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAywCvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAyBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAUzE,OAAO,EACL,aAAa,EAEb,KAAK,YAAY,EAElB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EACL,KAAK,aAAa,EAGnB,MAAM,0BAA0B,CAAC;AAsBlC,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAiBvF,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAsF/F;;;;;uDAKuD;AACvD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,aAAa,GAAG;IAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAA;CAAE,CAO9F;AA6FD;0CAC0C;AAC1C,eAAO,MAAM,eAAe,GAAI,OAAO;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OACT,CAAC;AAErD;8EAC8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhD;AAuBD;2DAC2D;AAC3D,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACvC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CASjC;AAED;4EAC4E;AAC5E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAmBvG;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,OAAO,EAAE,EAChB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EAC/C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,GAC3D,IAAI,CAiDN;AA6gBD,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACtC;AA6DD,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IA41CvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAyBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -1,5 +1,5 @@
 import { canonicalTypeSchemaId, OBSERVED_STATE_KEY } from "@telorun/sdk";
-import { defaultRegistry, isRefSentinel, isTaggedSentinel } from "@telorun/templating";
+import { defaultRegistry, isRefSentinel, isTaggedSentinel, } from "@telorun/templating";
 import { AliasResolver, moduleScopedDefResolver, scopeResolverForModule, } from "./alias-resolver.js";
 import { buildCelEnvironment, buildImportInputCelEnvironment, buildTypedCelEnvironment, } from "./cel-environment.js";
 import { DefinitionRegistry } from "./definition-registry.js";
@@ -7,7 +7,7 @@ import { effectiveAuthorSchema } from "./extends-resolution.js";
 import { PERMISSIVE_CONTRACT, resolveContract, } from "./invocation-contract.js";
 import { buildCallGraph } from "./call-graph.js";
 import { buildDependencyGraph, formatCycle } from "./dependency-graph.js";
-import { buildKernelGlobalsSchema, KERNEL_GLOBAL_NAMES, mergeKernelGlobalsIntoContext, } from "./kernel-globals.js";
+import { buildKernelGlobalsIndex, KERNEL_GLOBAL_NAMES, mergeKernelGlobalsIntoContext, } from "./kernel-globals.js";
 import { buildObservedStateIndex, buildObservedStateResourcesSchema, collectRunReachableNames, observedStateRead, validateObservedStateDeclarations, } from "./validate-observed-state.js";
 import { computeSuggestKind } from "./kind-suggest.js";
 import { visitManifest } from "./manifest-visitor.js";
@@ -25,12 +25,13 @@ import { rewriteSyntheticOrigins } from "./rewrite-synthetic-origins.js";
 import { celTypeSatisfiesJsonSchema, substituteCelFields, validateAgainstSchema, } from "./schema-compat.js";
 import { collectValueSchemaIssues } from "./validate-value-schema.js";
 import { DiagnosticSeverity } from "./types.js";
-import { extractAccessChains, extractCelRegionScopes, extractContextsFromSchema, getManifestItem, pathMatchesScope, resolveContextAnnotations, resolveTypeFieldToSchema, } from "./validate-cel-context.js";
+import { extractAccessChains, extractCelRegionScopes, getManifestItem, pathMatchesScope, resolveContextAnnotations, resolveTypeFieldToSchema, } from "./validate-cel-context.js";
 import { buildEvalPaths, evalPathsCover } from "./eval-paths.js";
 import { BINDINGS_ANNOTATION, bindingContextProperties, bindingPathChain, CEL_RESERVED_WORDS, findBindingSites, resolveBindingOrder, schemaAtChain, } from "./cel-bindings.js";
 import { validateExtends } from "./validate-extends.js";
 import { validateLogging } from "./validate-logging.js";
 import { validateModuleArtifact } from "./validate-module-artifact.js";
+import { validateIncludePlacement } from "./validate-include-placement.js";
 import { validateModuleMetadata } from "./validate-module-metadata.js";
 import { validateBaseMapping } from "./validate-base-mapping.js";
 import { validateInvocationContract } from "./validate-invocation-contract.js";
@@ -735,68 +736,49 @@ function celAccessChains(env, expr) {
 }
 const CEL_PURE_RE = /^\s*\$\{\{[^}]*\}\}\s*$/;
 const CEL_EXPR_RE = /\$\{\{\s*([^}]+?)\s*\}\}/;
-/** Recursively walk `data`+`schema` together, type-checking every pure CEL template
- *  string via `env.check()`. Returns `SchemaIssue[]` for any type mismatches found. */
-function collectCelTypeIssues(data, schema, path, definition, manifest, baseTypedEnv, rootEnv, rootModuleManifest) {
-    const issues = [];
-    // A pure CEL value type-checks the same regardless of surface form: a
-    // `${{ … }}` string and a `!cel`-tagged sentinel must behave identically.
+/** Restore the delimiters an engine's fix was computed without, so the
+ *  replacement is the whole scalar rather than a bare expression that would be
+ *  read back as literal text. A tagged scalar carries no wrapper and passes
+ *  through untouched. */
+function rewrapFix(fix, wrapper) {
+    if (!fix || !wrapper)
+        return fix;
+    return { replacement: wrapper.prefix + fix.replacement + wrapper.suffix };
+}
+/** Recursively walk `data`+`schema` together, collecting every pure CEL leaf
+ *  with the schema of the field holding it.
+ *
+ *  Type *checking* is deliberately not done here. It belongs to the templating
+ *  engine, which owns the expression's syntax and now runs it once against the
+ *  environment typed for that path; checking again here would mean two verdicts
+ *  from two environments about one expression — which is exactly how an opaque
+ *  "no matching overload" used to survive next to the diagnostic that explained
+ *  it. What this walk supplies is the half the engine cannot know: the declared
+ *  type of the slot the value flows into. The comparison happens once both are
+ *  in hand (`reportCelReturnMismatches`). */
+function collectCelValueSlots(data, schema, path) {
+    const slots = [];
+    // A pure CEL value behaves the same regardless of surface form: a
+    // `${{ … }}` string and a `!cel`-tagged sentinel are the same expression.
     let celExpr;
     if (isTaggedSentinel(data)) {
         // Non-CEL engines (e.g. `!literal`) are analyzed by their own engine pass.
         if (data.engine !== "cel")
-            return issues;
+            return slots;
         celExpr = data.source;
     }
     else if (typeof data === "string" && CEL_PURE_RE.test(data)) {
         celExpr = data.match(CEL_EXPR_RE)?.[1]?.trim();
     }
     if (celExpr !== undefined) {
-        {
-            const expr = celExpr;
-            // Merge x-telo-context variables for this path if applicable
-            let typedEnv = baseTypedEnv;
-            if (definition.schema) {
-                for (const ctx of extractContextsFromSchema(definition.schema)) {
-                    if (!pathMatchesScope(path, ctx.scope))
-                        continue;
-                    typedEnv = buildTypedCelEnvironment(rootEnv, manifest, ctx.schema, rootModuleManifest);
-                    break;
-                }
-            }
-            let checkResult;
-            try {
-                checkResult = typedEnv.check(expr);
-            }
-            catch {
-                /* degrade gracefully */
-            }
-            if (checkResult?.valid === false && checkResult.error) {
-                // env.check() rejected the expression itself — e.g. wrong method, wrong
-                // argument types, wrong operator overload. Surface the first line of the
-                // error message; the tail is a source-code caret diagram we don't need.
-                const message = String(checkResult.error.message ?? checkResult.error)
-                    .split("\n")[0]
-                    .trim();
-                issues.push({ message: `CEL type error: ${message}`, path });
-            }
-            else if (checkResult?.valid && checkResult.type && schema) {
-                const celType = checkResult.type.split("<")[0];
-                if (!celTypeSatisfiesJsonSchema(celType, schema)) {
-                    const expected = schema["x-telo-type"] ?? schema.type ?? "unknown";
-                    issues.push({
-                        message: `CEL returns '${checkResult.type}' but field expects '${expected}'`,
-                        path,
-                    });
-                }
-            }
-        }
-        return issues;
+        if (schema)
+            slots.push({ path, schema });
+        return slots;
     }
     if (Array.isArray(data)) {
         const itemSchema = (schema.items ?? {});
         for (let i = 0; i < data.length; i++) {
-            issues.push(...collectCelTypeIssues(data[i], itemSchema, `${path}[${i}]`, definition, manifest, baseTypedEnv, rootEnv, rootModuleManifest));
+            slots.push(...collectCelValueSlots(data[i], itemSchema, `${path}[${i}]`));
         }
     }
     else if (data !== null && typeof data === "object") {
@@ -805,10 +787,10 @@ function collectCelTypeIssues(data, schema, path, definition, manifest, baseType
             ? schema.additionalProperties
             : {};
         for (const [k, v] of Object.entries(data)) {
-            issues.push(...collectCelTypeIssues(v, (props[k] ?? mapValueSchema), path ? `${path}.${k}` : k, definition, manifest, baseTypedEnv, rootEnv, rootModuleManifest));
+            slots.push(...collectCelValueSlots(v, (props[k] ?? mapValueSchema), path ? `${path}.${k}` : k));
         }
     }
-    return issues;
+    return slots;
 }
 export class StaticAnalyzer {
     celEnv;
@@ -1251,6 +1233,9 @@ export class StaticAnalyzer {
             // these fields, which is precisely why they need a check: a mistyped one
             // has no runtime failure mode that would ever surface it.
             diagnostics.push(...validateModuleMetadata(allManifests, defs, aliases));
+            // A file embed resolves at resource creation, so one written on a doc that
+            // is never instantiated is read by nothing and would ship silently.
+            diagnostics.push(...validateIncludePlacement(allManifests));
         }
         resolveSchemaTypeRefs(allManifests, aliases, aliasesByModule);
         // Trusted-input fast path: when the caller has already attested that
@@ -1361,7 +1346,7 @@ export class StaticAnalyzer {
             : new Set();
         // Build typed kernel globals schema so x-telo-context chain validation
         // recognises variables, secrets, resources, env automatically
-        const kernelGlobals = buildKernelGlobalsSchema(allManifests, observedState);
+        const kernelGlobals = buildKernelGlobalsIndex(allManifests, observedState);
         // Fallback context for CEL in a slot with no `x-telo-context` annotation:
         // everything stays open except the typed `.status` nodes, so unknown-field
         // checking reaches observed state everywhere without newly rejecting any
@@ -1377,9 +1362,18 @@ export class StaticAnalyzer {
             : null;
         // The module doc (Application/Library) carries the Application-only `ports`
         // namespace; threaded into per-resource CEL typing so `${{ ports.X }}`
-        // resolves its nominal brand cross-doc.
+        // resolves its nominal brand cross-doc. A flattened set holds exactly one —
+        // the entry's; see `buildKernelGlobalsSchema`.
         const moduleManifest = allManifests.find((mm) => mm.kind === "Telo.Application") ??
             allManifests.find((mm) => mm.kind === "Telo.Library");
+        // Every pure-CEL leaf, with the slot it flows into. Compared against the
+        // type the engine walk resolves, once both halves exist — see
+        // `collectCelValueSlots`.
+        const celReturnSlots = [];
+        const celTypeByPath = new Map();
+        // Context-free typed environments, one per manifest. Reused across every
+        // expression in it — see the build site for why a matched context opts out.
+        const typedEnvByManifest = new Map();
         // Validate each non-definition, non-system resource
         for (const m of allManifests) {
             const filePath = m.metadata?.source;
@@ -1457,7 +1451,15 @@ export class StaticAnalyzer {
                     code: "UNDEFINED_KIND",
                     source: SOURCE,
                     message: `No Telo.Definition found for kind '${m.kind}'.${hint}`,
-                    data: { resource, filePath, path: "kind", suggestedKind },
+                    // `suggestedKind` is kept beside the generic `fix` because it names
+                    // what the replacement IS; the fix is how to apply it.
+                    data: {
+                        resource,
+                        filePath,
+                        path: "kind",
+                        suggestedKind,
+                        ...(suggestedKind ? { fix: { replacement: suggestedKind } } : {}),
+                    },
                 });
                 continue;
             }
@@ -1480,23 +1482,12 @@ export class StaticAnalyzer {
                         },
                     }
                     : authorSchema;
-                // Phase 1: CEL type checking — walk data+schema together, check env.check() return types.
-                // A Telo.Import's variables/secrets are a config-only contract evaluated against the
-                // IMPORTING module's scope, so type them from the owning module doc (matched by
-                // `metadata.module`) and drop `resources`/`env` so referencing them is an error. A
-                // library's own internal import is validated against that library in the library's
-                // standalone analysis; in this flattened app pass the library doc is absent, so the
-                // importer is undefined here and variables/secrets fall back to a permissive `map`
-                // (no false positives) while resources/env stay rejected.
-                const importerModule = m.kind === "Telo.Import"
-                    ? allManifests.find((mm) => (mm.kind === "Telo.Application" || mm.kind === "Telo.Library") &&
-                        mm.metadata?.name ===
-                            m.metadata?.module)
-                    : undefined;
-                const baseTypedEnv = m.kind === "Telo.Import"
-                    ? buildImportInputCelEnvironment(this.celEnv, importerModule)
-                    : buildTypedCelEnvironment(this.celEnv, m, undefined, moduleManifest);
-                const celIssues = collectCelTypeIssues(m, schema, "", definition, m, baseTypedEnv, this.celEnv, moduleManifest);
+                // Phase 1: collect the pure-CEL leaves and the schema of the slot each
+                // flows into. The expression's own type is resolved later, by the
+                // engine walk that owns type-checking; this half only knows the target.
+                for (const slot of collectCelValueSlots(m, schema, "")) {
+                    celReturnSlots.push({ manifest: m, resource, filePath, ...slot });
+                }
                 // Phase 2+3: AJV on substituted data — CEL fields replaced with typed placeholders
                 const ajvIssues = validateAgainstSchema(substituteCelFields(m, schema), schema);
                 // Phase 4: value slots that must satisfy a type declared elsewhere on
@@ -1504,7 +1495,7 @@ export class StaticAnalyzer {
                 // decision table against its declared `outputType`, so a mistyped branch
                 // is caught here rather than on the one input that selects it.
                 const valueSchemaIssues = collectValueSchemaIssues(m, schema, allManifests);
-                const issues = [...celIssues, ...ajvIssues, ...valueSchemaIssues];
+                const issues = [...ajvIssues, ...valueSchemaIssues];
                 for (const issue of issues) {
                     diagnostics.push({
                         severity: DiagnosticSeverity.Error,
@@ -1849,7 +1840,11 @@ export class StaticAnalyzer {
                         aliases,
                         allManifests: allManifests,
                     });
-                    effectiveContext = mergeKernelGlobalsIntoContext(withBindingNames(resolvedContext, m), kernelGlobals);
+                    effectiveContext = mergeKernelGlobalsIntoContext(withBindingNames(resolvedContext, m), 
+                    // Typed in the module that DECLARED this resource — for a manifest
+                    // forwarded from an imported library, that is its `moduleGlobals`
+                    // stamp, not the consuming application's block.
+                    kernelGlobals.forResource(m));
                 }
                 else if (observedStateContext) {
                     // No `x-telo-context` matched, so nothing was chain-validated here
@@ -1871,50 +1866,116 @@ export class StaticAnalyzer {
                     });
                     return;
                 }
-                const findings = engine.analyze(expr, { celEnv: this.celEnv, contextSchema: effectiveContext });
-                for (const f of findings) {
-                    if (f.code === "CEL_SYNTAX_ERROR") {
+                // The engine type-checks, so it gets the environment typed for THIS
+                // path — not the bare base one. A `Telo.Import`'s variables/secrets
+                // are a config-only contract evaluated in the IMPORTING module's
+                // scope, so they type from the owning module doc and drop
+                // `resources`/`env`, making a reference to either an error.
+                //
+                // Cached per manifest when no `x-telo-context` applied, which is most
+                // expressions: the environment then depends only on the manifest, so
+                // rebuilding it per expression is pure waste — a clone plus a
+                // re-registration of every variable, on every keystroke in the IDE.
+                // A matched context makes the environment path-specific (its schema is
+                // resolved against the enclosing array item), so those still build
+                // fresh rather than risk one item's types leaking into another's.
+                const cached = effectiveContext === null ? typedEnvByManifest.get(m) : undefined;
+                const typedEnv = cached ??
+                    (m.kind === "Telo.Import"
+                        ? buildImportInputCelEnvironment(this.celEnv, allManifests.find((mm) => (mm.kind === "Telo.Application" || mm.kind === "Telo.Library") &&
+                            mm.metadata?.name ===
+                                m.metadata?.module))
+                        : buildTypedCelEnvironment(this.celEnv, m, effectiveContext ?? undefined, moduleManifest));
+                if (effectiveContext === null && !cached)
+                    typedEnvByManifest.set(m, typedEnv);
+                const result = engine.analyze(expr, { celEnv: typedEnv, contextSchema: effectiveContext });
+                if (result.type !== undefined) {
+                    let byPath = celTypeByPath.get(m);
+                    if (!byPath)
+                        celTypeByPath.set(m, (byPath = new Map()));
+                    byPath.set(path, result.type);
+                }
+                // A non-deterministic call in a compile-eval field is baked once at
+                // load: `nowIso()` there freezes at boot. Sometimes that is the
+                // intent (a boot timestamp, a run id), so it warns rather than
+                // blocking. The engine reports which calls re-evaluate; the eval mode
+                // is manifest policy and stays here.
+                if (celRuleApplies && evalPathsCover(celCompilePaths, path)) {
+                    const volatile = [
+                        ...new Set(result.calls.filter((c) => c.deterministic === false).map((c) => c.name)),
+                    ].sort();
+                    if (volatile.length > 0) {
                         diagnostics.push({
-                            severity: DiagnosticSeverity.Error,
-                            code: "CEL_SYNTAX_ERROR",
+                            severity: DiagnosticSeverity.Warning,
+                            code: "CEL_NONDETERMINISTIC_IN_COMPILE_FIELD",
                             source: SOURCE,
-                            message: `CEL syntax error at ${path}: ${f.message}`,
+                            message: `${m.kind}/${resource.name}: '${path}' is evaluated once at startup, so ${volatile.map((n) => `\`${n}()\``).join(", ")} ${volatile.length === 1 ? "is" : "are"} baked in at load and never re-evaluated. Move the expression to a field evaluated per call (x-telo-eval: runtime) if it should change over time.`,
                             data: { resource, filePath, path },
                         });
                     }
-                    else if (f.code === "CEL_UNKNOWN_FIELD") {
+                }
+                for (const f of result.diagnostics) {
+                    // A repair is applicable only when the analyzed expression covers
+                    // the whole scalar. For one `${{ }}` among literal text, replacing
+                    // the node would drop the text around it, so the correction stays
+                    // in the message and no fix is stamped.
+                    const fix = e.surface.whole ? rewrapFix(f.fix, e.surface.wrapper) : undefined;
+                    const data = { resource, filePath, path, ...(fix ? { fix } : {}) };
+                    if (f.code === "CEL_SYNTAX_ERROR") {
                         diagnostics.push({
                             severity: DiagnosticSeverity.Error,
-                            code: "CEL_UNKNOWN_FIELD",
+                            code: "CEL_SYNTAX_ERROR",
                             source: SOURCE,
-                            message: `${m.kind}/${resource.name}: CEL at '${path}': ${f.message}`,
-                            data: { resource, filePath, path },
+                            message: `CEL syntax error at ${path}: ${f.message}`,
+                            data,
                         });
                     }
-                    else if (f.code === "CEL_NULLABLE_ACCESS") {
+                    else if (f.code === undefined) {
+                        // No code from a future engine — pass the message through, tagged
+                        // with a generic ENGINE_DIAGNOSTIC code so downstream filters can
+                        // still bucket it.
                         diagnostics.push({
                             severity: DiagnosticSeverity.Error,
-                            code: "CEL_NULLABLE_ACCESS",
+                            code: "ENGINE_DIAGNOSTIC",
                             source: SOURCE,
-                            message: `${m.kind}/${resource.name}: CEL at '${path}': ${f.message}`,
-                            data: { resource, filePath, path },
+                            message: `${m.kind}/${resource.name}: !${engineName} at '${path}': ${f.message}`,
+                            data,
                         });
                     }
                     else {
-                        // Unknown code from a future engine — pass the message through,
-                        // tagged with a generic ENGINE_DIAGNOSTIC code so downstream
-                        // filters can still bucket it.
+                        // Named by ENGINE, not hardcoded to CEL: the seam exists so a
+                        // second engine can produce coded findings, and labelling them
+                        // `CEL` would misattribute the first one that does.
                         diagnostics.push({
                             severity: DiagnosticSeverity.Error,
-                            code: f.code ?? "ENGINE_DIAGNOSTIC",
+                            code: f.code,
                             source: SOURCE,
                             message: `${m.kind}/${resource.name}: !${engineName} at '${path}': ${f.message}`,
-                            data: { resource, filePath, path },
+                            data,
                         });
                     }
                 }
             },
         }, { aliases });
+        // The two halves of "does this expression fit the slot it flows into" meet
+        // here: the engine resolved the expression's type during the walk above,
+        // and the schema walk recorded the slot. An expression that failed to check
+        // recorded no type and is already reported by its own diagnostic.
+        for (const slot of celReturnSlots) {
+            const type = celTypeByPath.get(slot.manifest)?.get(slot.path);
+            if (type === undefined)
+                continue;
+            if (celTypeSatisfiesJsonSchema(type.split("<")[0], slot.schema))
+                continue;
+            const expected = slot.schema["x-telo-type"] ?? slot.schema.type ?? "unknown";
+            diagnostics.push({
+                severity: DiagnosticSeverity.Error,
+                code: "CEL_TYPE_ERROR",
+                source: SOURCE,
+                message: `${slot.resource.kind}/${slot.resource.name}: CEL at '${slot.path}' returns '${type}' but the field expects '${expected}'.`,
+                data: { resource: slot.resource, filePath: slot.filePath, path: slot.path },
+            });
+        }
         // Validate resource references (Phase 3)
         diagnostics.push(...validateReferences(allManifests, { aliases, definitions: defs, aliasesByModule }));
         // Validate step `invoke` references — the slots the reference field map

package/dist/flatten-for-analyzer.d.ts

@@ -33,8 +33,27 @@ export declare function parseExportEntry(entry: string): ParsedExportEntry;
  *  `byModuleName` and `!ref Alias.name` resolves, while `validate-references` /
  *  the per-resource validation loop never re-walk or re-validate it against the
  *  consumer's scope. A consumer that instead emits every module doc as a peer
- *  local manifest silently breaks both. */
+ *  local manifest silently breaks both.
+ *
+ *  Dropping the module doc costs the consumer's analysis the one thing a
+ *  forwarded manifest's CEL still needs: the `variables` / `secrets` / `ports`
+ *  contract its expressions are evaluated against. That contract is carried
+ *  across as {@link ModuleGlobals} on each forwarded manifest instead, so the
+ *  consumer can check those reads in the DECLARING module's scope rather than
+ *  either skipping them (a diagnostic performed nowhere) or judging them by its
+ *  own block (a hard error the library author cannot act on). Stamped here
+ *  because this is the only point where a manifest and its module doc are both
+ *  in hand — by the time `analyze()` sees the flat list, the doc is gone. */
 export declare function selectModuleManifestsForAnalysis(moduleManifests: ResourceManifest[], isRoot: boolean): ResourceManifest[];
+/** The declaring module's config contract, carried on a forwarded manifest so
+ *  the consumer's analysis can type its CEL globals in the right scope. Only the
+ *  namespaces whose typing is scope-dependent: `resources` is deliberately
+ *  absent, see {@link readModuleGlobals}. */
+export interface ModuleGlobals {
+    variables?: Record<string, unknown>;
+    secrets?: Record<string, unknown>;
+    ports?: Record<string, unknown>;
+}
 /** Produce the flat manifest list `analyze()` consumes today.
  *
  *  Combines the entry module's manifests with `Telo.Definition`,

package/dist/flatten-for-analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flatten-for-analyzer.d.ts","sourceRoot":"","sources":["../src/flatten-for-analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEtE;;yEAEyE;AACzE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;4CAI4C;AAC5C,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAGjE;AAED;;;;;;;;;;;;;;;;;;;2CAmB2C;AAC3C,wBAAgB,gCAAgC,CAC9C,eAAe,EAAE,gBAAgB,EAAE,EACnC,MAAM,EAAE,OAAO,GACd,gBAAgB,EAAE,CA6BpB;AAED;;;;;;;;;;;;;;;;;;;6EAmB6E;AAC7E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,gBAAgB,EAAE,CAiDzE;AAED;;uBAEuB;AACvB,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;qEAEqE;AACrE,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,GAC/C,YAAY,EAAE,CAShB;AAED;;;;;;uFAMuF;AACvF,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,gBAAgB,EAAE,EAC1B,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACnE,IAAI,CAgDN;AAED;;;;0EAI0E;AAC1E,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;CAAE,CAAC,EACvF,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACnE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA2ClC;AAED;;;;;4DAK4D;AAC5D,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,CAAC;IAAE,QAAQ,EAAE,gBAAgB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,EAC5E,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC9C,IAAI,CAWN;AAED;;;;;;;;;;;;;;iGAciG;AACjG,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,aAAa,CAAC;IAAE,QAAQ,EAAE,gBAAgB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,EAC5E,aAAa,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,GACpD,IAAI,CAMN;AAgDD;;;;;oEAKoE;AACpE,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,WAAW,GAAG,mBAAmB,EAAE,CAuBpF;AAED;;;;;6BAK6B;AAC7B,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,YAAY,GAAG,gBAAgB,EAAE,CAEzE"}
+{"version":3,"file":"flatten-for-analyzer.d.ts","sourceRoot":"","sources":["../src/flatten-for-analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEtE;;yEAEyE;AACzE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;4CAI4C;AAC5C,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAGjE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6EA6B6E;AAC7E,wBAAgB,gCAAgC,CAC9C,eAAe,EAAE,gBAAgB,EAAE,EACnC,MAAM,EAAE,OAAO,GACd,gBAAgB,EAAE,CAmCpB;AAED;;;6CAG6C;AAC7C,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAkCD;;;;;;;;;;;;;;;;;;;6EAmB6E;AAC7E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,gBAAgB,EAAE,CAiDzE;AAED;;uBAEuB;AACvB,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;qEAEqE;AACrE,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,GAC/C,YAAY,EAAE,CAShB;AAED;;;;;;uFAMuF;AACvF,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,gBAAgB,EAAE,EAC1B,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACnE,IAAI,CAgDN;AAED;;;;0EAI0E;AAC1E,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;CAAE,CAAC,EACvF,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACnE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA2ClC;AAED;;;;;4DAK4D;AAC5D,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,CAAC;IAAE,QAAQ,EAAE,gBAAgB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,EAC5E,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC9C,IAAI,CAWN;AAED;;;;;;;;;;;;;;iGAciG;AACjG,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,aAAa,CAAC;IAAE,QAAQ,EAAE,gBAAgB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,EAC5E,aAAa,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,GACpD,IAAI,CAMN;AAgDD;;;;;oEAKoE;AACpE,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,WAAW,GAAG,mBAAmB,EAAE,CAuBpF;AAED;;;;;6BAK6B;AAC7B,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,YAAY,GAAG,gBAAgB,EAAE,CAEzE"}

package/dist/flatten-for-analyzer.js

@@ -27,7 +27,17 @@ export function parseExportEntry(entry) {
  *  `byModuleName` and `!ref Alias.name` resolves, while `validate-references` /
  *  the per-resource validation loop never re-walk or re-validate it against the
  *  consumer's scope. A consumer that instead emits every module doc as a peer
- *  local manifest silently breaks both. */
+ *  local manifest silently breaks both.
+ *
+ *  Dropping the module doc costs the consumer's analysis the one thing a
+ *  forwarded manifest's CEL still needs: the `variables` / `secrets` / `ports`
+ *  contract its expressions are evaluated against. That contract is carried
+ *  across as {@link ModuleGlobals} on each forwarded manifest instead, so the
+ *  consumer can check those reads in the DECLARING module's scope rather than
+ *  either skipping them (a diagnostic performed nowhere) or judging them by its
+ *  own block (a hard error the library author cannot act on). Stamped here
+ *  because this is the only point where a manifest and its module doc are both
+ *  in hand — by the time `analyze()` sees the flat list, the doc is gone. */
 export function selectModuleManifestsForAnalysis(moduleManifests, isRoot) {
     if (isRoot)
         return moduleManifests;
@@ -41,22 +51,57 @@ export function selectModuleManifestsForAnalysis(moduleManifests, isRoot) {
             continue;
         exportedResources.add(parseExportEntry(entry).name);
     }
+    const moduleGlobals = readModuleGlobals(libDoc);
     const out = [];
     for (const m of moduleManifests) {
         if (m.kind === "Telo.Definition" || m.kind === "Telo.Abstract" || m.kind === "Telo.Import") {
-            out.push(m);
+            out.push(withModuleGlobals(m, moduleGlobals));
         }
         else if (!isModuleKind(m.kind) &&
             typeof m.metadata?.name === "string" &&
             exportedResources.has(m.metadata.name)) {
             out.push({
                 ...m,
-                metadata: { ...m.metadata, forwardedExport: true },
+                metadata: {
+                    ...m.metadata,
+                    forwardedExport: true,
+                    ...(moduleGlobals ? { moduleGlobals } : {}),
+                },
             });
         }
     }
     return out;
 }
+/** Read the schema-map blocks off a module doc, or `undefined` when it declares
+ *  none (the globals then stay permissive, exactly as an absent doc does).
+ *
+ *  `resources` is NOT carried. The flat list holds only this module's EXPORTED
+ *  instances, so a name list built from it would omit every internal one — and a
+ *  `with:`-scoped resource is declared inline rather than as a doc, so it would
+ *  be missing too. Both would read as "no such resource" in a consumer's pass:
+ *  a false positive worse than the unchecked read it replaced. The consumer
+ *  leaves a forwarded manifest's `resources` node open and the library's own
+ *  analysis, which sees every name, does that check. */
+function readModuleGlobals(libDoc) {
+    const doc = libDoc;
+    if (!doc)
+        return undefined;
+    const globals = {};
+    for (const key of ["variables", "secrets", "ports"]) {
+        const block = doc[key];
+        if (block && typeof block === "object" && !Array.isArray(block))
+            globals[key] = block;
+    }
+    return Object.keys(globals).length > 0 ? globals : undefined;
+}
+function withModuleGlobals(m, moduleGlobals) {
+    if (!moduleGlobals)
+        return m;
+    return {
+        ...m,
+        metadata: { ...m.metadata, moduleGlobals },
+    };
+}
 /** Produce the flat manifest list `analyze()` consumes today.
  *
  *  Combines the entry module's manifests with `Telo.Definition`,

package/dist/index.d.ts

@@ -64,6 +64,8 @@ export { MANIFEST_CACHE_BASE_URL, ManifestCacheSource, isHttpsModuleRef, manifes
 export type { ManifestCacheCoords } from "./sources/manifest-cache.js";
 export { LAYER_ROLES, PLATFORM_AXES, ArtifactSelectorError, describeSelector, isLayerRole, normalizeSelector, selectorFromQualifiers, selectorKey, selectorMatches, } from "./artifact-selector.js";
 export type { ArtifactSelector, LayerRole, PlatformAxis, PlatformTarget, } from "./artifact-selector.js";
+export { collectModuleFileClaims } from "./module-file-claims.js";
+export type { ModuleFileClaim } from "./module-file-claims.js";
 export { LayerIndexError, matchControllerLayers, parseLayerIndex, singletonLayer, } from "./artifact-layer-index.js";
 export type { ArtifactLayer } from "./artifact-layer-index.js";
 export { validateModuleArtifact } from "./validate-module-artifact.js";
@@ -73,6 +75,6 @@ export { documentToAst, parseToAst } from "./yaml-ast.js";
 export type { AstDocument, AstMap, AstNode, AstPair, AstScalar, AstSeq } from "./yaml-ast.js";
 export { CelParseError, buildCelSegments, wrapCelAst } from "./cel-ast.js";
 export type { CelNode, CelSegment } from "./cel-ast.js";
-export { DEFAULT_MANIFEST_FILENAME, DiagnosticSeverity } from "./types.js";
-export type { AnalysisDiagnostic, AnalysisOptions, LoaderInitOptions, LoadOptions, ManifestSource, Position, PositionIndex, Range } from "./types.js";
+export { DEFAULT_MANIFEST_FILENAME, DiagnosticSeverity, diagnosticFix } from "./types.js";
+export type { AnalysisDiagnostic, AnalysisOptions, DiagnosticData, DiagnosticFix, LoaderInitOptions, LoadOptions, ManifestSource, Position, PositionIndex, Range } from "./types.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACjF,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,0BAA0B,EAC1B,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,iCAAiC,EACjC,wBAAwB,EACxB,iBAAiB,EACjB,iCAAiC,EACjC,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACxF,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACtF,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,oBAAoB,EACpB,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAChG,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7E,YAAY,EACV,qBAAqB,EACrB,SAAS,EACT,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC5F,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EACL,cAAc,EACd,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EACL,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,EACvB,eAAe,EACf,sBAAsB,GACvB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAChG,YAAY,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACnB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC/E,YAAY,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EACL,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,sBAAsB,EACtB,WAAW,EACX,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,SAAS,EACT,YAAY,EACZ,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,eAAe,EACf,cAAc,GACf,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAIvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC3E,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACjF,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,0BAA0B,EAC1B,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,iCAAiC,EACjC,wBAAwB,EACxB,iBAAiB,EACjB,iCAAiC,EACjC,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACxF,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACtF,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,oBAAoB,EACpB,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAChG,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7E,YAAY,EACV,qBAAqB,EACrB,SAAS,EACT,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC5F,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EACL,cAAc,EACd,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EACL,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,EACvB,eAAe,EACf,sBAAsB,GACvB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAChG,YAAY,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACnB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC/E,YAAY,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EACL,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,sBAAsB,EACtB,WAAW,EACX,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,SAAS,EACT,YAAY,EACZ,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,eAAe,EACf,cAAc,GACf,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAIvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC3E,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC1F,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -36,6 +36,7 @@ export { parseVersionedRef, withRefVersion } from "./sources/versioned-ref.js";
 export { isLocalPathSource } from "./sources/local-path-ref.js";
 export { MANIFEST_CACHE_BASE_URL, ManifestCacheSource, isHttpsModuleRef, manifestCacheKey, manifestCacheUrl, ociManifestCacheCoords, urlManifestCacheCoords, } from "./sources/manifest-cache.js";
 export { LAYER_ROLES, PLATFORM_AXES, ArtifactSelectorError, describeSelector, isLayerRole, normalizeSelector, selectorFromQualifiers, selectorKey, selectorMatches, } from "./artifact-selector.js";
+export { collectModuleFileClaims } from "./module-file-claims.js";
 export { LayerIndexError, matchControllerLayers, parseLayerIndex, singletonLayer, } from "./artifact-layer-index.js";
 export { validateModuleArtifact } from "./validate-module-artifact.js";
 // Warnings everywhere, fatal at `telo publish` — descriptive metadata has no
@@ -45,4 +46,4 @@ export { PUBLISH_BLOCKING_CODES } from "./validate-module-metadata.js";
 export { withSyntheticPositions } from "./with-synthetic-positions.js";
 export { documentToAst, parseToAst } from "./yaml-ast.js";
 export { CelParseError, buildCelSegments, wrapCelAst } from "./cel-ast.js";
-export { DEFAULT_MANIFEST_FILENAME, DiagnosticSeverity } from "./types.js";
+export { DEFAULT_MANIFEST_FILENAME, DiagnosticSeverity, diagnosticFix } from "./types.js";