@dtmd/temper 0.0.7 → 0.0.9

package/dist/src/claude-code.d.ts

@@ -7,7 +7,7 @@
  * specifier like any other. The built-in default contracts join the kinds here
  * too: adoption is `import { skill, skillDefaultContract } from "@dtmd/temper/claude-code"`.
  */
-export type { Agent, Hook, McpServer, Memory, Rule, Skill } from "./builtins.js";
-export { agent, agentDefaultContract, command, commandDefaultContract, hook, hookDefaultContract, mcpServer, mcpServerDefaultContract, memory, memoryAgentsMdDefaultContract, memoryAnthropicDefaultContract, rule, ruleDefaultContract, skill, skillDefaultContract, } from "./builtins.js";
+export type { Agent, Hook, InstalledPlugin, KnownMarketplace, Marketplace, MarketplacePlugin, MarketplaceSource, McpServer, Memory, PluginManifest, Rule, SettingsLocal, Skill, SupportingDoc, } from "./builtins.js";
+export { agent, agentDefaultContract, command, commandDefaultContract, hook, hookDefaultContract, installedPlugin, installedPluginDefaultContract, knownMarketplace, knownMarketplaceDefaultContract, marketplace, marketplaceDefaultContract, mcpServer, mcpServerDefaultContract, memory, memoryAnthropicDefaultContract, pluginManifest, pluginManifestDefaultContract, rule, ruleDefaultContract, settingsLocal, settingsLocalDefaultContract, skill, skillDefaultContract, supportingDoc, supportingDocDefaultContract, } from "./builtins.js";
 export type { Blocks, File, Prose, Text } from "./prose.js";
 export { blocks, file, text } from "./prose.js";

package/dist/src/claude-code.js

@@ -7,5 +7,5 @@
  * specifier like any other. The built-in default contracts join the kinds here
  * too: adoption is `import { skill, skillDefaultContract } from "@dtmd/temper/claude-code"`.
  */
-export { agent, agentDefaultContract, command, commandDefaultContract, hook, hookDefaultContract, mcpServer, mcpServerDefaultContract, memory, memoryAgentsMdDefaultContract, memoryAnthropicDefaultContract, rule, ruleDefaultContract, skill, skillDefaultContract, } from "./builtins.js";
+export { agent, agentDefaultContract, command, commandDefaultContract, hook, hookDefaultContract, installedPlugin, installedPluginDefaultContract, knownMarketplace, knownMarketplaceDefaultContract, marketplace, marketplaceDefaultContract, mcpServer, mcpServerDefaultContract, memory, memoryAnthropicDefaultContract, pluginManifest, pluginManifestDefaultContract, rule, ruleDefaultContract, settingsLocal, settingsLocalDefaultContract, skill, skillDefaultContract, supportingDoc, supportingDocDefaultContract, } from "./builtins.js";
 export { blocks, file, text } from "./prose.js";

package/dist/src/contract.d.ts

@@ -1,26 +1,40 @@
 /**
  * Contracts — clauses and requirements as typed values.
  * A clause is `predicate · severity · guidance · cite`; a requirement is
- * `prose · kind · required · clauses? · verifiedBy?`. Both erase to compiled data
+ * `prose · kind · required · clauses? · verifier?`. Both erase to compiled data
  * at the seam: the author composes typed objects, the engine
  * consumes their rows. The predicate vocabulary is the closed algebra — a clause
  * outside it is a squiggle, not a runtime rejection.
  */
+import type { Shape, ValueType } from "./generated/index.js";
 import type { KindDefinition } from "./kind.js";
 /** A clause's delivery posture: `required` gate-blocks, `advisory` reports. */
 export type Severity = "required" | "advisory";
 /**
- * A member of the closed predicate algebra. Both a kind's
- * own `expect` clauses and a requirement's `clauses` compile to the row's full
- * `key`/`field`/`severity`/argument shape (`declarations.ts` `clauseRow`): a
- * floor clause's own `bound`/`charset`/`keys`/`values` ride the row alongside
- * a requirement's `count`/`target`/`degree`, so the lock encodes the floor
- * losslessly rather than identity+severity alone.
+ * A member of the closed predicate algebra. Both a kind's own `expect` clauses and a
+ * requirement's `clauses` compile to the row's full `key`/`field`/`severity`/argument
+ * shape (`declarations.ts` `clauseRow`) — one spelling, whichever selection the clause
+ * binds to: `bound`/`charset`/`keys`/`values` ride the row alongside
+ * `count`/`target`/`degree`, so the lock encodes the clause losslessly rather than
+ * identity+severity alone.
  */
 export interface Predicate {
-    /** The predicate's clause key (`required`, `max_len`, `max_lines`, …). */
+    /** The predicate's clause key (`required`, `max_len`, `extent`, …). */
     readonly key: string;
-    /** The field (or marker) the predicate constrains, when it names one. */
+    /**
+     * The field (or marker) the predicate constrains, when it names one.
+     *
+     * A value predicate's `field` is an **addressing path**: name segments walk into an
+     * object (`owner.name`), and `[*]` is the each-grain over an array's elements, so
+     * `plugins[*].source` decides once per entry and indicts each offending one by its own
+     * address. Nothing else is spellable — an index, a slice, a filter, and a recursive
+     * descent are all refused when the contract is checked, not silently evaluated. The
+     * subset is the whole surface on purpose: a clause names *where* a value lives, never
+     * a pattern that matches it.
+     *
+     * `forbidden_keys` and `must_define` name a top-level **key**, not a path, and
+     * `closed-keys` names neither — it reads the key set its sibling clauses declare.
+     */
     readonly field?: string;
     /** The predicate's scalar bounds, keyed per predicate (`min`/`max`,
      * `incoming_min`/`incoming_max`/`outgoing_min`/`outgoing_max`). */
@@ -30,6 +44,23 @@ export interface Predicate {
      * checked field) since `membership` names both.
      */
     readonly target?: string;
+    /**
+     * `mention-reachable`'s **target-side gate field** — a separate slot from `field`
+     * (which carries the source-side scope field) since it is the one predicate naming a
+     * field on *both* ends. Spelled to match the lock's own `gate` column.
+     */
+    readonly gate?: string;
+    /**
+     * `type`'s declared source kinds over the closed scalar/container lattice — the set
+     * the field may carry any one of. Spelled to match the lock's own `value_type`
+     * column.
+     */
+    readonly value_type?: readonly ValueType[];
+    /**
+     * `shape`'s declared shape — one member of the closed set, spelled to match the lock's
+     * own `shape` column.
+     */
+    readonly shape?: Shape;
     /** `allowed_chars`'s declared character class. */
     readonly charset?: Charset;
     /** `forbidden_keys`'s forbidden key list. */
@@ -46,7 +77,15 @@ export interface Predicate {
         readonly heading: string;
         readonly marker: string;
     };
+    /** `require_sections`'s required heading list. */
+    readonly sections?: readonly string[];
+    /** `extent`'s declared unit — the render-side size proxy the bound is measured in. */
+    readonly unit?: ExtentUnit;
 }
+/** The unit an `extent` bound is measured in — the closed set of stable render-side size
+ * proxies. Token count is deliberately absent: a verdict that moves when a tokenizer
+ * updates is a gate that changes its mind with no diff. */
+export type ExtentUnit = "lines" | "characters";
 /**
  * The character class `allowed_chars` admits — inclusive ranges plus individual
  * characters, e.g. `[a-z0-9-]`. Each range is a `"<lo>-<hi>"` two-character
@@ -56,24 +95,60 @@ export interface Charset {
     readonly ranges?: readonly string[];
     readonly chars?: string;
 }
-/** A field or marker is present. */
+/**
+ * A field or marker is present. Presence is asked of the path's trailing name segment,
+ * so `required("plugins[*].source")` fires once per entry that omits it — and a path
+ * ending in `[*]` names elements rather than a key, which is refused.
+ */
 export declare const required: (field: string) => Predicate;
-/** The field's parsed scalar type is as declared. */
-export declare const type: (field: string) => Predicate;
+/**
+ * The field's parsed source kind is one of the declared ones. `kinds` is a set: a
+ * format that documents a field as `string|array` is gated by `["string", "list"]`,
+ * and a one-element `["list"]` is the plain single-kind check.
+ */
+export declare const type: (field: string, kinds: readonly ValueType[]) => Predicate;
 /** The field's value is at least `n` characters. */
 export declare const minLen: (field: string, n: number) => Predicate;
 /** The field's value is at most `n` characters. */
 export declare const maxLen: (field: string, n: number) => Predicate;
 /** The field's characters are drawn from a declared class (`allowed_chars`). */
 export declare const allowedChars: (field: string, charset: Charset) => Predicate;
-/** The member's body is at most `n` lines. */
-export declare const maxLines: (n: number) => Predicate;
+/**
+ * The field's value holds one named `Shape` from the closed set the engine generates
+ * across the seam — the union *is* the vocabulary, so an author picks a member and can
+ * spell nothing else. There is no escape to a hand-written pattern, which is the point.
+ *
+ * - `hyphen-placement` — a hyphen neither leads, trails, nor doubles (`pdf-processing`,
+ *   never `-pdf`, `pdf-`, or `pdf--processing`). Says nothing about the alphabet; pair it
+ *   with `allowedChars` where the character set matters.
+ * - `no-xml-tags` — the value carries no XML tag (`<br/>`, `</note>`, `<a href="x">`).
+ *   Prose spelling a comparison (`use when x < y`) is not a tag and does not fire.
+ */
+export declare const shape: (field: string, shape: Shape) => Predicate;
+/**
+ * The selected item's **rendered** extent is at most `bound`, in the declared `unit`
+ * (`lines` or `characters`). Node-scope and render-side: the measure is the bytes the
+ * item contributes to its projection, not the source body a count reads before a
+ * reference resolves or a render hook runs.
+ */
+export declare const extent: (unit: ExtentUnit, bound: number) => Predicate;
 /** The forbidden keys (e.g. the Cursor `globs`/`alwaysApply` keys) are absent. */
 export declare const forbiddenKeys: (keys: readonly string[]) => Predicate;
+/**
+ * The kind's declared key set is exhaustive — a member carrying any other top-level key
+ * is a finding. `forbiddenKeys`' complement: a deny-list names a finite set over an open
+ * key space, this closes the space.
+ *
+ * It takes no arguments, and that is the point: the allow-list is the contract's own
+ * `required`/`optional` clauses, so the key set is declared once. Adding `optional("x")`
+ * admits `x` with no second edit here — and a contract declaring no key at all fails
+ * admissibility rather than indicting every key of every member.
+ */
+export declare const closedKeys: () => Predicate;
 /** The field's value is none of `values` (forbidden values). */
 export declare const deny: (field: string, values: readonly string[]) => Predicate;
 /** The named headings are present. */
-export declare const requireSections: () => Predicate;
+export declare const requireSections: (sections: readonly string[]) => Predicate;
 /** The member's name matches its directory. */
 export declare const nameMatchesDir: () => Predicate;
 /** Names are unique within the artifact kind (a scope-wide identity collision). */
@@ -93,16 +168,41 @@ export declare const enumOf: (field: string, values: readonly string[]) => Predi
 export declare const mustDefine: (marker: string) => Predicate;
 /** Every body section whose heading *starts with* `heading` carries `marker` in its body. */
 export declare const sectionContains: (heading: string, marker: string) => Predicate;
-/** The satisfier set's size lies in the inclusive `[min, max]` bound. */
+/** Every glob the field carries parses under globset (brace-expansion aware). */
+export declare const globValid: (field: string) => Predicate;
+/**
+ * Every mention a selected member authors can fire where its target can be invoked. A
+ * target whose `gateField` carries globs is gated — removed from every invocation
+ * channel until the agent reads a matching file — so a mention of it is actionable only
+ * inside that gate. Fires on a scoped source whose `scopeField` globs are not contained
+ * in the target's gate, and on an unscoped source mentioning a gated target.
+ *
+ * Generic over both ends, hard-coding no kind: the trigger is the target's gate field
+ * carrying a value, never its registration set. Containment is *literal* — every source
+ * glob must appear verbatim in the gate — since true glob-set containment is
+ * undecidable, so it false-fires on a semantically contained narrower glob
+ * (`src/**\/*.ts` inside `src/**`). Declare it at advisory severity: a check that can be
+ * wrong must not block.
+ */
+export declare const mentionReachable: (scopeField: string, gateField: string) => Predicate;
+/**
+ * Every edge the member's kind declares is placed by the format that renders the member
+ * — a format that omits one renders a contract the prose does not represent. Names no
+ * field: the selection is the member's whole incident edge set, at the `each` grain.
+ * Decided over the placement `emit` observes while rendering and lowers into the
+ * member's `nested_member` row, since the engine never sees a format.
+ */
+export declare const formatPlacesEdges: () => Predicate;
+/** The selection's size lies in the inclusive `[min, max]` bound. */
 export declare const count: (bounds: {
     min?: number;
     max?: number;
 }) => Predicate;
-/** The field's extracted value does not repeat across the satisfier set. */
+/** The field's extracted value does not repeat across the selection. */
 export declare const unique: (field: string) => Predicate;
-/** Every satisfier's `field` value is drawn from a feature over `target`'s own satisfier set. */
+/** Every selected member's `field` value is drawn from a feature over the selection `target` declares. */
 export declare const membership: (field: string, target: string) => Predicate;
-/** The in/out edge-count bound every satisfier must land in. At least one direction must be given. */
+/** The in/out edge-count bound every selected member must land in. At least one direction must be given. */
 export declare const degree: (bounds: {
     incoming?: {
         min?: number;
@@ -113,16 +213,38 @@ export declare const degree: (bounds: {
         max?: number;
     };
 }) => Predicate;
+/**
+ * A guarded clause — a predicate (restricted to `type` or `enum`) that acts as a
+ * guard, with a body of ordinary clauses that fire only where the guard holds.
+ * The guard and body share the guard's address binding: the body's field paths
+ * evaluate at the concrete element address the guard locates.
+ *
+ * The guard must be a `type` or `enumOf` predicate, named for the decidable
+ * field it addresses. Neither is enforced here; emit validates admissibility.
+ *
+ * Options for `severity`, `guidance`, and `cite` are supported and follow the
+ * same pattern as `clause()`. Default severity is `required`.
+ */
+export declare function when(guard: Predicate, body: readonly Clause[], opts?: {
+    severity?: Severity;
+    guidance?: string;
+    cite?: string;
+}): Clause;
 /**
  * A clause — a predicate the author marks with a severity, the just-in-time
  * guidance the predicate cannot encode, and the external-fact `cite` that makes
- * a maintained floor auditable.
+ * a maintained floor auditable. A `when` clause carries an additional guard
+ * predicate and a body of nested clauses that fire only where the guard holds.
  */
 export interface Clause {
     readonly predicate: Predicate;
     readonly severity: Severity;
     readonly guidance?: string;
     readonly cite?: string;
+    /** The guard predicate for a `when` clause; absent for all others. */
+    readonly when_guard?: Predicate;
+    /** The nested body clauses for a `when` clause; absent for all others. */
+    readonly when_body?: readonly Clause[];
 }
 /** Compose a clause value — a predicate under a declared severity, with optional guidance/cite. */
 export declare function clause(predicate: Predicate, opts: {
@@ -130,22 +252,51 @@ export declare function clause(predicate: Predicate, opts: {
     guidance?: string;
     cite?: string;
 }): Clause;
+/**
+ * A requirement's **typed verifier** — the declared delegate that judges the
+ * behavioral remainder, a species-tagged union the gate resolves at admissibility
+ * and never runs. Two species this slice: a `script` (path-resolved) and a
+ * `telemetry` declaration (named documented harness events). A probe stays a
+ * documented pattern until a consumer types it — no `probe()` constructor is minted.
+ */
+export type Verifier = {
+    readonly species: "script";
+    readonly path: string;
+} | {
+    readonly species: "telemetry";
+    readonly events: readonly string[];
+};
+/**
+ * A script verifier — a path-resolved reference to the test or CI job that executes
+ * the behavioral judgment. The gate checks the `path` resolves, never runs it.
+ */
+export declare const script: (path: string) => Verifier;
+/**
+ * A telemetry verifier — the named documented harness events the emitted tap records
+ * to a local-locus log, judged by reading the field record. Each name must be a
+ * documented harness lifecycle event (`InstructionsLoaded`, `Skill`,
+ * `UserPromptExpansion`, `PostToolUse`; code.claude.com/docs/en/hooks, retrieved
+ * 2026-07-17) — the gate checks each resolves, never records into it.
+ */
+export declare const telemetry: (events: readonly string[]) => Verifier;
 /**
  * A requirement — a named obligation on the harness. `prose` is the authored
- * intent, carried never interpreted; `kind` constrains what may fill it **by
- * import** (a value, never a string); `required` is the posture declaration;
- * `clauses` are the requirement's own set-/edge-scope demands — ordinary
- * [`Clause`] values whose predicates range over the satisfier set
- * (`count`/`unique`/`membership`) or its graph neighborhood (`degree`), the
- * same four-channel clause as everywhere; `verifiedBy` wires the behavioral
- * remainder.
+ * intent, carried never interpreted; `kind` constrains what may fill it —
+ * either a bare kind-name string or the kind's `KindDefinition`, since the slot
+ * carries only the kind's *identity* for coverage resolution, never its field
+ * type: a kind whose fields carry required members (skill, hook) assigns here,
+ * where `KindDefinition<never>` would have rejected it. `required` is the
+ * posture declaration; `clauses` bind to the requirement's **opt-in selection** —
+ * ordinary [`Clause`] values, the same four-channel clause as everywhere, judged
+ * over that selection by the same algebra a kind's own clauses are judged over its
+ * population; `verifier` wires the behavioral remainder as a typed species union.
  */
 export interface Requirement {
     readonly prose: string;
-    readonly kind?: KindDefinition<never>;
+    readonly kind?: string | KindDefinition<any>;
     readonly required?: boolean;
     readonly clauses?: readonly Clause[];
-    readonly verifiedBy?: string;
+    readonly verifier?: Verifier;
 }
 /** An identity helper — types a requirement literal at the keystroke. */
 export declare function requirement(init: Requirement): Requirement;

package/dist/src/contract.js

@@ -1,16 +1,30 @@
 /**
  * Contracts — clauses and requirements as typed values.
  * A clause is `predicate · severity · guidance · cite`; a requirement is
- * `prose · kind · required · clauses? · verifiedBy?`. Both erase to compiled data
+ * `prose · kind · required · clauses? · verifier?`. Both erase to compiled data
  * at the seam: the author composes typed objects, the engine
  * consumes their rows. The predicate vocabulary is the closed algebra — a clause
  * outside it is a squiggle, not a runtime rejection.
  */
-// Node-scope predicates.
-/** A field or marker is present. */
+// Node-scope predicates. A value predicate takes an addressing path as its `field` — see
+// `Predicate.field` for the subset an author may spell, and for the key-naming and
+// fieldless exceptions that sit here too.
+/**
+ * A field or marker is present. Presence is asked of the path's trailing name segment,
+ * so `required("plugins[*].source")` fires once per entry that omits it — and a path
+ * ending in `[*]` names elements rather than a key, which is refused.
+ */
 export const required = (field) => ({ key: "required", field });
-/** The field's parsed scalar type is as declared. */
-export const type = (field) => ({ key: "type", field });
+/**
+ * The field's parsed source kind is one of the declared ones. `kinds` is a set: a
+ * format that documents a field as `string|array` is gated by `["string", "list"]`,
+ * and a one-element `["list"]` is the plain single-kind check.
+ */
+export const type = (field, kinds) => ({
+    key: "type",
+    field,
+    value_type: kinds,
+});
 /** The field's value is at least `n` characters. */
 export const minLen = (field, n) => ({ key: "min_len", field, args: { min: n } });
 /** The field's value is at most `n` characters. */
@@ -21,10 +35,42 @@ export const allowedChars = (field, charset) => ({
     field,
     charset,
 });
-/** The member's body is at most `n` lines. */
-export const maxLines = (n) => ({ key: "max_lines", args: { max: n } });
+/**
+ * The field's value holds one named `Shape` from the closed set the engine generates
+ * across the seam — the union *is* the vocabulary, so an author picks a member and can
+ * spell nothing else. There is no escape to a hand-written pattern, which is the point.
+ *
+ * - `hyphen-placement` — a hyphen neither leads, trails, nor doubles (`pdf-processing`,
+ *   never `-pdf`, `pdf-`, or `pdf--processing`). Says nothing about the alphabet; pair it
+ *   with `allowedChars` where the character set matters.
+ * - `no-xml-tags` — the value carries no XML tag (`<br/>`, `</note>`, `<a href="x">`).
+ *   Prose spelling a comparison (`use when x < y`) is not a tag and does not fire.
+ */
+export const shape = (field, shape) => ({ key: "shape", field, shape });
+/**
+ * The selected item's **rendered** extent is at most `bound`, in the declared `unit`
+ * (`lines` or `characters`). Node-scope and render-side: the measure is the bytes the
+ * item contributes to its projection, not the source body a count reads before a
+ * reference resolves or a render hook runs.
+ */
+export const extent = (unit, bound) => ({
+    key: "extent",
+    unit,
+    args: { max: bound },
+});
 /** The forbidden keys (e.g. the Cursor `globs`/`alwaysApply` keys) are absent. */
 export const forbiddenKeys = (keys) => ({ key: "forbidden_keys", keys });
+/**
+ * The kind's declared key set is exhaustive — a member carrying any other top-level key
+ * is a finding. `forbiddenKeys`' complement: a deny-list names a finite set over an open
+ * key space, this closes the space.
+ *
+ * It takes no arguments, and that is the point: the allow-list is the contract's own
+ * `required`/`optional` clauses, so the key set is declared once. Adding `optional("x")`
+ * admits `x` with no second edit here — and a contract declaring no key at all fails
+ * admissibility rather than indicting every key of every member.
+ */
+export const closedKeys = () => ({ key: "closed-keys" });
 /** The field's value is none of `values` (forbidden values). */
 export const deny = (field, values) => ({
     key: "deny",
@@ -32,7 +78,7 @@ export const deny = (field, values) => ({
     values,
 });
 /** The named headings are present. */
-export const requireSections = () => ({ key: "require_sections" });
+export const requireSections = (sections) => ({ key: "require_sections", sections });
 /** The member's name matches its directory. */
 export const nameMatchesDir = () => ({ key: "name-matches-dir" });
 /** Names are unique within the artifact kind (a scope-wide identity collision). */
@@ -63,10 +109,42 @@ export const sectionContains = (heading, marker) => ({
     key: "section_contains",
     section: { heading, marker },
 });
-// Node-set/edge-scope predicates — a requirement's set-scope demands ride
-// these as ordinary clause values, the same four-channel `clause()` shape as
-// the node-scope predicates above.
-/** The satisfier set's size lies in the inclusive `[min, max]` bound. */
+/** Every glob the field carries parses under globset (brace-expansion aware). */
+export const globValid = (field) => ({ key: "glob-valid", field });
+/**
+ * Every mention a selected member authors can fire where its target can be invoked. A
+ * target whose `gateField` carries globs is gated — removed from every invocation
+ * channel until the agent reads a matching file — so a mention of it is actionable only
+ * inside that gate. Fires on a scoped source whose `scopeField` globs are not contained
+ * in the target's gate, and on an unscoped source mentioning a gated target.
+ *
+ * Generic over both ends, hard-coding no kind: the trigger is the target's gate field
+ * carrying a value, never its registration set. Containment is *literal* — every source
+ * glob must appear verbatim in the gate — since true glob-set containment is
+ * undecidable, so it false-fires on a semantically contained narrower glob
+ * (`src/**\/*.ts` inside `src/**`). Declare it at advisory severity: a check that can be
+ * wrong must not block.
+ */
+export const mentionReachable = (scopeField, gateField) => ({
+    key: "mention-reachable",
+    field: scopeField,
+    gate: gateField,
+});
+/**
+ * Every edge the member's kind declares is placed by the format that renders the member
+ * — a format that omits one renders a contract the prose does not represent. Names no
+ * field: the selection is the member's whole incident edge set, at the `each` grain.
+ * Decided over the placement `emit` observes while rendering and lowers into the
+ * member's `nested_member` row, since the engine never sees a format.
+ */
+export const formatPlacesEdges = () => ({ key: "format-places-edges" });
+// Set predicates — they range over the **selection** their clause binds to, not one
+// member's own fields: a kind's `expect` binds them to that kind's whole population
+// (the universal binding), a requirement's `clauses` to its opt-in satisfiers (the
+// existential one). The quantifier is the clause's grain, so the same value says the
+// same thing in either place, riding the same four-channel `clause()` shape as the
+// member-scope predicates above.
+/** The selection's size lies in the inclusive `[min, max]` bound. */
 export const count = (bounds) => {
     const args = {};
     if (bounds.min !== undefined)
@@ -75,15 +153,15 @@ export const count = (bounds) => {
         args.max = bounds.max;
     return { key: "count", args };
 };
-/** The field's extracted value does not repeat across the satisfier set. */
+/** The field's extracted value does not repeat across the selection. */
 export const unique = (field) => ({ key: "unique", field });
-/** Every satisfier's `field` value is drawn from a feature over `target`'s own satisfier set. */
+/** Every selected member's `field` value is drawn from a feature over the selection `target` declares. */
 export const membership = (field, target) => ({
     key: "membership",
     field,
     target,
 });
-/** The in/out edge-count bound every satisfier must land in. At least one direction must be given. */
+/** The in/out edge-count bound every selected member must land in. At least one direction must be given. */
 export const degree = (bounds) => {
     const args = {};
     if (bounds.incoming?.min !== undefined)
@@ -96,10 +174,45 @@ export const degree = (bounds) => {
         args.outgoing_max = bounds.outgoing.max;
     return { key: "degree", args };
 };
+/**
+ * A guarded clause — a predicate (restricted to `type` or `enum`) that acts as a
+ * guard, with a body of ordinary clauses that fire only where the guard holds.
+ * The guard and body share the guard's address binding: the body's field paths
+ * evaluate at the concrete element address the guard locates.
+ *
+ * The guard must be a `type` or `enumOf` predicate, named for the decidable
+ * field it addresses. Neither is enforced here; emit validates admissibility.
+ *
+ * Options for `severity`, `guidance`, and `cite` are supported and follow the
+ * same pattern as `clause()`. Default severity is `required`.
+ */
+export function when(guard, body, opts) {
+    return {
+        predicate: { key: "when" },
+        severity: opts?.severity ?? "required",
+        guidance: opts?.guidance,
+        cite: opts?.cite,
+        when_guard: guard,
+        when_body: body,
+    };
+}
 /** Compose a clause value — a predicate under a declared severity, with optional guidance/cite. */
 export function clause(predicate, opts) {
     return { predicate, severity: opts.severity, guidance: opts.guidance, cite: opts.cite };
 }
+/**
+ * A script verifier — a path-resolved reference to the test or CI job that executes
+ * the behavioral judgment. The gate checks the `path` resolves, never runs it.
+ */
+export const script = (path) => ({ species: "script", path });
+/**
+ * A telemetry verifier — the named documented harness events the emitted tap records
+ * to a local-locus log, judged by reading the field record. Each name must be a
+ * documented harness lifecycle event (`InstructionsLoaded`, `Skill`,
+ * `UserPromptExpansion`, `PostToolUse`; code.claude.com/docs/en/hooks, retrieved
+ * 2026-07-17) — the gate checks each resolves, never records into it.
+ */
+export const telemetry = (events) => ({ species: "telemetry", events });
 /** An identity helper — types a requirement literal at the keystroke. */
 export function requirement(init) {
     return init;

package/dist/src/declarations.d.ts

@@ -9,10 +9,40 @@
  * in lockstep.
  */
 import type { Harness } from "./assembly.js";
+import type { MentionScope } from "./prose.js";
 import type { Declarations, Payload, RegistrationRow, SettingsRow } from "./generated/index.js";
 export type { AssemblyFactRow, ClauseRow, Declarations, KindFactRow, RequirementRow, SatisfiesRow, } from "./generated/index.js";
 /** The stable-sort ordering every declaration row family shares. */
 export declare function compareStrings(a: string, b: string): number;
+/**
+ * One composed embedded value's key in an {@link EdgePlacements} table — its host's
+ * `kind:name` address plus the value's own kind and key, the same triple the
+ * `nested_member` row it feeds is identified by.
+ */
+export declare function placementKey(host: string, kind: string, key: string): string;
+/**
+ * Each composed embedded value's placed edge fields, by {@link placementKey} — `emit`'s
+ * record of which declared edges each value's format actually rendered (`emit.ts`'s
+ * `edgePlacements`). A value with no entry had no format observe it, which is distinct
+ * from a format that placed nothing: the row omits the column entirely and the
+ * `format-places-edges` clause stays undecided rather than indict a format that never ran.
+ */
+export type EdgePlacements = ReadonlyMap<string, readonly string[]>;
+/** One composed embedded value's rendered extent — the line and character count of the
+ * block `emit` projected for it ({@link RenderedExtents}), the span an `extent` clause
+ * budgets. */
+export interface RenderedExtent {
+    readonly lines: number;
+    readonly chars: number;
+}
+/**
+ * Each composed embedded value's rendered extent, by {@link placementKey} — `emit`'s
+ * record of the span it projected for each value (`emit.ts`'s `renderedExtents`). A value
+ * with no entry had no format rendered it (a member read off a layout host's source),
+ * which the row spells by omitting both span columns rather than a captured zero: an
+ * unmeasured member's `extent` stays undecidable, never a zero read as a pass.
+ */
+export type RenderedExtents = ReadonlyMap<string, RenderedExtent>;
 /**
  * The `registration` rows — every fields-only registration member (a hook, an MCP server)
  * erased for the manifest write face, kind-then-key sorted so double emit is byte-stable.
@@ -26,6 +56,19 @@ export declare function compareStrings(a: string, b: string): number;
  * If a fields-only member declares no collection address — it surfaces in no host manifest.
  */
 export declare function registrationRows(harness: Harness): RegistrationRow[];
+/**
+ * The synthesized tap-hook `registration` rows — one deduped `hooks.<Event>`
+ * registration per (lifecycle event, matcher) any telemetry verifier names. Scans the
+ * same requirement sources {@link requirementRows} reads (assembly `require` ∪ each
+ * member's `requires`), keeps the telemetry-species verifiers ({@link Verifier}), and
+ * unions the lifecycle events they name into one dumb registration apiece: the tap
+ * records every fire and read time joins raw events to members, so however many
+ * verifiers name an event it takes exactly one hook — the derived-aggregate precedent
+ * the permission union sets ({@link permissionUnion}). Each row runs {@link TAP_COMMAND}
+ * under the event's documented matcher ({@link TELEMETRY_EVENT_HOOKS}); an event-name
+ * outside that table is the roster's inadmissibility finding, never a row.
+ */
+export declare function tapHookRows(harness: Harness): RegistrationRow[];
 /**
  * The `settings` rows — the assembly's harness-level residual settings keys, each folded
  * into the settings.json manifest's opaque residue at emit. Key-sorted so double emit is
@@ -36,13 +79,37 @@ export declare function settingsRows(harness: Harness): SettingsRow[];
 export declare function declaredRequirements(harness: Harness): Set<string>;
 /**
  * Every address a mention may name — declared requirement names ∪ each member's
- * `kind:name`. Shared by `emit.ts` (a member-level `Text` body's mentions) and
- * this module (an embedded member's `Text` leaves) — the one resolution-check
- * set, so a leaf mention and a member mention are held to the identical bar.
+ * `kind:name` ∪ each `blocks()`-declared embedded member's host-scoped
+ * `<host-kind>:<host-name>/<kind>/<key>` address. Shared by `emit.ts` (a
+ * member-level `Text` body's mentions) and this module (an embedded member's
+ * `Text` leaves) — the one resolution-check set, so a leaf mention and a member
+ * mention are held to the identical bar. The embedded address is host-scoped,
+ * never a flat `<kind>:<key>` — flat would force corpus-wide key uniqueness on
+ * embedded kinds.
  */
 export declare function declaredAddresses(harness: Harness): Set<string>;
-/** Compile a harness into its seven declaration families — the erased program. */
-export declare function compileDeclarations(harness: Harness): Declarations;
+/**
+ * Every discoverable (`at`-locus) kind the program declares — the deferral signal a
+ * dangling mention is measured against (`prose.ts`'s `defersToGate`): a mention naming
+ * one of these whose member is not a composed value defers to `check`, while a mention
+ * naming no declared kind refuses at emit. Member kinds ∪ `expect` kinds; an embedded
+ * kind is excluded — its members are composed within a host, never discovered, so a
+ * flat `kind:name` mention of one has no discovery locus to defer to.
+ */
+export declare function declaredAtLocusKinds(harness: Harness): Set<string>;
+/** The full {@link MentionScope} the program resolves a mention against — its addresses and its deferral kinds. */
+export declare function mentionScope(harness: Harness): MentionScope;
+/**
+ * Compile a harness into its seven declaration families — the erased program.
+ *
+ * `placements` and `extents` are `emit`'s record of what each embedded value's format
+ * rendered (`emit.ts`'s `edgePlacements`) and the span it spanned (`renderedExtents`); this
+ * pass compiles declarations and never renders, so it observes neither itself. Omitted,
+ * every `nested_member` row omits its `placed_edges`/`rendered_lines`/`rendered_chars`
+ * columns — honest (nothing observed a render) but undecidable for a `format-places-edges`
+ * or `extent` clause, so a whole compile goes through `emit`, never this alone.
+ */
+export declare function compileDeclarations(harness: Harness, placements?: EdgePlacements, extents?: RenderedExtents): Declarations;
 /** The SDK's pinned engine/interchange version — the JSON pipe rides it in lockstep. */
 export declare const SEAM_VERSION = 2;
 /**