@primmel/primmel 1.9.1 → 1.10.0

package/dist-cli/primmel.mjs

@@ -14581,8 +14581,36 @@ function composePackage(rootDir, options, rootManifest, withProvenance = false)
       provenance.get(field).set(key, order[0]);
     }
   }
+  const ownedScopes = /* @__PURE__ */ new Map();
+  const harvestScopes = (id, ctx) => {
+    for (const key of Object.keys(ctx.requirementClasses)) {
+      if (!ownedScopes.has(key)) {
+        ownedScopes.set(key, id);
+      }
+    }
+  };
+  const pinGuard = (id, next) => {
+    if (ownedScopes.size === 0) {
+      return;
+    }
+    for (const field of ["requirementClasses", "requirements"]) {
+      const label = field === "requirementClasses" ? "requirement class" : "requirement";
+      for (const key of Object.keys(next[field])) {
+        for (const [scope, owner] of ownedScopes) {
+          if (key.startsWith(scope + "/")) {
+            throw new CompositionError(
+              "namespace-pin-violation",
+              `package "${id}" declares ${label} "${key}" under the requirement namespace "${scope}" owned by package "${owner}" \u2014 a layer-owned namespace is single-sourced: a downstream package may reference its provisions, never declare scopes or requirements at or under it (namespace-pin-violation)`
+            );
+          }
+        }
+      }
+    }
+  };
+  harvestScopes(order[0], acc);
   for (const id of order.slice(1)) {
     const next = ctxs.get(id);
+    pinGuard(id, next);
     for (const field of MERGE_FIELDS) {
       const target = acc[field];
       const pm = provenance.get(field);
@@ -14607,6 +14635,7 @@ function composePackage(rootDir, options, rootManifest, withProvenance = false)
     if (!acc.metadata && next.metadata) {
       acc.metadata = next.metadata;
     }
+    harvestScopes(id, next);
   }
   for (const id of order) {
     const m = manifests.get(id);
@@ -16398,6 +16427,19 @@ var CHECK_RULES = [
     "normal",
     "TODO.roadmap/05"
   ),
+  // C119 (the smart AGENTS.d/07 pin doctrine, TODO.editor/05 Q3): a
+  // requirement scope a composed package declares is OWNED by that
+  // package — a downstream package may reference its provisions, never
+  // declare a requirement class or requirement at or under the owned
+  // namespace (the strict-descendant leg; the exact-id leg is C28).
+  R(
+    "C119",
+    "namespace-pin-violation",
+    "composition",
+    "error",
+    "normal",
+    "smart AGENTS.d/07 (TODO.editor/05 Q3)"
+  ),
   // ── quantities / time / duality (TODO.roadmap/06) ─────────────────
   R(
     "C32",
@@ -18179,7 +18221,8 @@ function checkPackage(dir, options = {}) {
     "uses-resolves": "C27",
     "uses-no-redefine": "C28",
     "uses-cycle": "C29",
-    "requires-satisfied": "C31"
+    "requires-satisfied": "C31",
+    "namespace-pin-violation": "C119"
   };
   let standard;
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@primmel/primmel",
-  "version": "1.9.1",
+  "version": "1.10.0",
   "description": "Primmel — parser, types, and serializer for the Primmel modelling language (successor to MMEL)",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",