@telorun/analyzer 0.52.0 → 0.53.0

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIzE,OAAO,EACL,aAAa,EAEb,KAAK,YAAY,EAElB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EACL,KAAK,aAAa,EAGnB,MAAM,0BAA0B,CAAC;AA+BlC,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAoF/F;;;;;uDAKuD;AACvD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,aAAa,GAAG;IAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAA;CAAE,CAO9F;AA6FD;0CAC0C;AAC1C,eAAO,MAAM,eAAe,GAAI,OAAO;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OACT,CAAC;AAErD;8EAC8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhD;AAuBD;2DAC2D;AAC3D,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACvC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CASjC;AAED;4EAC4E;AAC5E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAmBvG;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,OAAO,EAAE,EAChB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EAC/C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,GAC3D,IAAI,CAiDN;AA2jBD,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IA4oCvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAyBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIzE,OAAO,EACL,aAAa,EAEb,KAAK,YAAY,EAElB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EACL,KAAK,aAAa,EAGnB,MAAM,0BAA0B,CAAC;AA+BlC,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAqF/F;;;;;uDAKuD;AACvD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,aAAa,GAAG;IAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAA;CAAE,CAO9F;AA6FD;0CAC0C;AAC1C,eAAO,MAAM,eAAe,GAAI,OAAO;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OACT,CAAC;AAErD;8EAC8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhD;AAuBD;2DAC2D;AAC3D,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACvC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CASjC;AAED;4EAC4E;AAC5E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAmBvG;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,OAAO,EAAE,EAChB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EAC/C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,GAC3D,IAAI,CAiDN;AA2jBD,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAgpCvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAyBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -27,6 +27,7 @@ import { BINDINGS_ANNOTATION, bindingContextProperties, bindingPathChain, CEL_RE
 import { validateExtends } from "./validate-extends.js";
 import { validateLogging } from "./validate-logging.js";
 import { validateModuleArtifact } from "./validate-module-artifact.js";
+import { validateModuleMetadata } from "./validate-module-metadata.js";
 import { validateBaseMapping } from "./validate-base-mapping.js";
 import { validateInvocationContract } from "./validate-invocation-contract.js";
 import { collectStepInputIssues } from "./validate-step-inputs.js";
@@ -1084,6 +1085,10 @@ export class StaticAnalyzer {
             // would otherwise fail on a consumer's machine — or, for a mistyped platform
             // axis, silently offer one platform's binary to every host.
             diagnostics.push(...validateModuleArtifact(allManifests));
+            // The descriptive `metadata:` surface. Nothing in the kernel branches on
+            // these fields, which is precisely why they need a check: a mistyped one
+            // has no runtime failure mode that would ever surface it.
+            diagnostics.push(...validateModuleMetadata(allManifests, defs, aliases));
         }
         resolveSchemaTypeRefs(allManifests, aliases, aliasesByModule);
         // Trusted-input fast path: when the caller has already attested that

package/dist/index.d.ts

@@ -53,6 +53,7 @@ export type { ArtifactSelector, LayerRole, PlatformAxis, PlatformTarget, } from
 export { LayerIndexError, matchControllerLayers, parseLayerIndex, singletonLayer, } from "./artifact-layer-index.js";
 export type { ArtifactLayer } from "./artifact-layer-index.js";
 export { validateModuleArtifact } from "./validate-module-artifact.js";
+export { PUBLISH_BLOCKING_CODES } from "./validate-module-metadata.js";
 export { withSyntheticPositions } from "./with-synthetic-positions.js";
 export { documentToAst, parseToAst } from "./yaml-ast.js";
 export type { AstDocument, AstMap, AstNode, AstPair, AstScalar, AstSeq } from "./yaml-ast.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACjF,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,iCAAiC,EACjC,wBAAwB,EACxB,iBAAiB,EACjB,iCAAiC,EACjC,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACxF,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACtF,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,oBAAoB,EACpB,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAChG,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC5F,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACnB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC/E,YAAY,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EACL,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,sBAAsB,EACtB,WAAW,EACX,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,SAAS,EACT,YAAY,EACZ,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,eAAe,EACf,cAAc,GACf,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC3E,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACjF,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,iCAAiC,EACjC,wBAAwB,EACxB,iBAAiB,EACjB,iCAAiC,EACjC,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACxF,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACtF,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,oBAAoB,EACpB,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAChG,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC5F,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACnB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC/E,YAAY,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EACL,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,sBAAsB,EACtB,WAAW,EACX,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,SAAS,EACT,YAAY,EACZ,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,eAAe,EACf,cAAc,GACf,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAIvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC3E,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -31,6 +31,10 @@ export { MANIFEST_CACHE_BASE_URL, ManifestCacheSource, isHttpsModuleRef, manifes
 export { LAYER_ROLES, PLATFORM_AXES, ArtifactSelectorError, describeSelector, isLayerRole, normalizeSelector, selectorFromQualifiers, selectorKey, selectorMatches, } from "./artifact-selector.js";
 export { LayerIndexError, matchControllerLayers, parseLayerIndex, singletonLayer, } from "./artifact-layer-index.js";
 export { validateModuleArtifact } from "./validate-module-artifact.js";
+// Warnings everywhere, fatal at `telo publish` — descriptive metadata has no
+// runtime failure mode, so it must not stop a manifest running, but it is the
+// module's public face the moment it is published.
+export { PUBLISH_BLOCKING_CODES } from "./validate-module-metadata.js";
 export { withSyntheticPositions } from "./with-synthetic-positions.js";
 export { documentToAst, parseToAst } from "./yaml-ast.js";
 export { CelParseError, buildCelSegments, wrapCelAst } from "./cel-ast.js";

package/dist/validate-module-metadata.d.ts

@@ -0,0 +1,38 @@
+import type { ResourceManifest } from "@telorun/sdk";
+import type { AliasResolver } from "./alias-resolver.js";
+import type { DefinitionRegistry } from "./definition-registry.js";
+import { type AnalysisDiagnostic } from "./types.js";
+/**
+ * Static validation of the `metadata:` block on module docs (`Telo.Application` /
+ * `Telo.Library`) and of `metadata.deprecated` wherever it appears.
+ *
+ * These fields are descriptive — nothing in the kernel branches on them — but they
+ * are the module's public face: a hub indexes them, and a consumer reads them
+ * before deciding to import. That is exactly why they need checking. A field the
+ * runtime ignores has no failure mode that would ever surface it, so a mistyped
+ * `licence:` or `deprecatd:` is invisible forever, and the module ships claiming
+ * nothing while its author believes otherwise.
+ *
+ * The vocabulary stays **open** — `metadata` accepts any key, because a publisher
+ * may carry their own — so an unknown key is only reported when it is a near-miss
+ * of a known one. That catches the typo without closing the set.
+ *
+ * **Everything here is a WARNING, and fatal only at `telo publish`** (see
+ * {@link PUBLISH_BLOCKING_CODES}). Refusing to *run* a manifest over a field no
+ * runtime reads gets the cost backwards: `version: 1.0` is a YAML float rather
+ * than a string, which is a real mistake worth reporting, but stopping the app
+ * from starting over it is worse than the mistake. Publication is the moment
+ * these fields become consequential — they are projected onto the artifact's
+ * annotations and indexed by the hub — so that is where they block.
+ */
+/**
+ * Codes that must not block running a manifest but MUST block publishing one.
+ *
+ * Kept as a set rather than a severity because the two audiences differ: a
+ * developer running a manifest wants to know, a publisher must be stopped. If a
+ * later check earns the same treatment, add its code here rather than inventing
+ * a third severity level.
+ */
+export declare const PUBLISH_BLOCKING_CODES: ReadonlySet<string>;
+export declare function validateModuleMetadata(manifests: ResourceManifest[], registry: DefinitionRegistry, aliases: AliasResolver): AnalysisDiagnostic[];
+//# sourceMappingURL=validate-module-metadata.d.ts.map

package/dist/validate-module-metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-module-metadata.d.ts","sourceRoot":"","sources":["../src/validate-module-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAKrD,CAAC;AAiDH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,GACrB,kBAAkB,EAAE,CA8CtB"}

package/dist/validate-module-metadata.js

@@ -0,0 +1,256 @@
+import { distance } from "./levenshtein.js";
+import { DiagnosticSeverity } from "./types.js";
+const SOURCE = "telo-analyzer";
+/**
+ * Static validation of the `metadata:` block on module docs (`Telo.Application` /
+ * `Telo.Library`) and of `metadata.deprecated` wherever it appears.
+ *
+ * These fields are descriptive — nothing in the kernel branches on them — but they
+ * are the module's public face: a hub indexes them, and a consumer reads them
+ * before deciding to import. That is exactly why they need checking. A field the
+ * runtime ignores has no failure mode that would ever surface it, so a mistyped
+ * `licence:` or `deprecatd:` is invisible forever, and the module ships claiming
+ * nothing while its author believes otherwise.
+ *
+ * The vocabulary stays **open** — `metadata` accepts any key, because a publisher
+ * may carry their own — so an unknown key is only reported when it is a near-miss
+ * of a known one. That catches the typo without closing the set.
+ *
+ * **Everything here is a WARNING, and fatal only at `telo publish`** (see
+ * {@link PUBLISH_BLOCKING_CODES}). Refusing to *run* a manifest over a field no
+ * runtime reads gets the cost backwards: `version: 1.0` is a YAML float rather
+ * than a string, which is a real mistake worth reporting, but stopping the app
+ * from starting over it is worse than the mistake. Publication is the moment
+ * these fields become consequential — they are projected onto the artifact's
+ * annotations and indexed by the hub — so that is where they block.
+ */
+/**
+ * Codes that must not block running a manifest but MUST block publishing one.
+ *
+ * Kept as a set rather than a severity because the two audiences differ: a
+ * developer running a manifest wants to know, a publisher must be stopped. If a
+ * later check earns the same treatment, add its code here rather than inventing
+ * a third severity level.
+ */
+export const PUBLISH_BLOCKING_CODES = new Set([
+    "METADATA_INVALID_TYPE",
+    "METADATA_UNKNOWN_FIELD",
+    "INVALID_DEPRECATION",
+    "DEPRECATION_REPLACEMENT_UNRESOLVED",
+]);
+/** Conventional module-doc metadata, and the type each carries. Descriptive only;
+ *  `name` is the sole field anything resolves against. */
+const MODULE_METADATA_TYPES = {
+    name: "string",
+    module: "string",
+    version: "string",
+    description: "string",
+    repository: "string",
+    homepage: "string",
+    documentation: "string",
+    license: "string",
+    namespace: "string",
+    categories: "string[]",
+    deprecated: "object",
+};
+/** What a kind doc's `metadata:` may carry.
+ *
+ *  Deliberately narrower than a module's: `version`, `license` and the rest
+ *  belong to the module, and a kind restating them means nothing. `categories`
+ *  is legal and *replaces* the module's for that kind; `description` is hub
+ *  search text. Both have exactly the failure mode this file exists for — a
+ *  `descriptoin:` on a kind doc is read by nothing and reported by nothing, so
+ *  it ships silently — which is why kind docs are checked rather than exempt. */
+const KIND_METADATA_TYPES = {
+    name: "string",
+    module: "string",
+    description: "string",
+    categories: "string[]",
+    deprecated: "object",
+};
+/** Alias-qualified kind — `Self.Migrations`, `Cache.Store`, `Telo.JsonSchema`. */
+const ALIAS_KIND_RE = /^[A-Z][A-Za-z0-9_]*\.[A-Z][A-Za-z0-9_]*$/;
+/** The built-in namespace, resolvable without an import — mirrors `validate-extends`. */
+const TELO_BUILTIN_ALIAS = "Telo";
+function typeOf(value) {
+    if (typeof value === "string")
+        return "string";
+    if (Array.isArray(value))
+        return value.every((v) => typeof v === "string") ? "string[]" : "other";
+    if (value !== null && typeof value === "object")
+        return "object";
+    return "other";
+}
+export function validateModuleMetadata(manifests, registry, aliases) {
+    const out = [];
+    // Docs forwarded from imported libraries carry `metadata.module` set to that
+    // library's name. Their `replacedBy` aliases — `Self`, or any alias private to
+    // that library — belong to the library's OWN scope, which the consumer's
+    // resolver knows nothing about, so re-checking them here reports a false
+    // DEPRECATION_REPLACEMENT_UNRESOLVED against a manifest the consumer does not
+    // own. They are validated when that library is analyzed as a root, which is
+    // its author's concern. Same rule, and the same reason, as `validate-extends`.
+    const importedModules = new Set();
+    for (const m of manifests) {
+        if (m.kind !== "Telo.Import")
+            continue;
+        const resolved = m.metadata
+            ?.resolvedModuleName;
+        if (resolved)
+            importedModules.add(resolved);
+    }
+    for (const manifest of manifests) {
+        const isModuleDoc = manifest.kind === "Telo.Application" || manifest.kind === "Telo.Library";
+        const isKindDoc = manifest.kind === "Telo.Definition" || manifest.kind === "Telo.Abstract";
+        if (!isModuleDoc && !isKindDoc)
+            continue;
+        const metadata = manifest.metadata;
+        if (!metadata)
+            continue;
+        const ownModule = metadata.module;
+        if (ownModule && importedModules.has(ownModule))
+            continue;
+        const name = typeof metadata.name === "string" ? metadata.name : undefined;
+        const filePath = typeof metadata.source === "string" ? metadata.source : undefined;
+        const ctx = {
+            label: `${manifest.kind}/${name ?? "(unnamed)"}`,
+            resource: { kind: manifest.kind, name },
+            filePath,
+        };
+        validateFieldTypes(metadata, isModuleDoc ? MODULE_METADATA_TYPES : KIND_METADATA_TYPES, ctx, out);
+        validateDeprecation(metadata, isModuleDoc, ctx, registry, aliases, out);
+    }
+    return out;
+}
+/** How far a key may be from a known one and still be called a typo.
+ *
+ *  Scaled, not absolute: at a flat 2, `date:` (a perfectly ordinary key an
+ *  author might carry) is two edits from `name` and gets told it is a
+ *  misspelling of it. The vocabulary is open, so a false accusation on a short
+ *  key is worse than missing a typo on one. */
+function typoThreshold(key, known) {
+    return Math.max(1, Math.floor(Math.min(key.length, known.length) / 3));
+}
+function validateFieldTypes(metadata, allowed, ctx, out) {
+    const known = Object.keys(allowed);
+    for (const [key, value] of Object.entries(metadata)) {
+        // Stamped by the loader, not authored — never a typo to report on.
+        if (key === "source")
+            continue;
+        // Listed as known so a typo still gets suggested against it, but its shape
+        // belongs to `validateDeprecation`, which can say what is actually wrong.
+        // Type-checking it here too would report one mistake twice.
+        if (key === "deprecated")
+            continue;
+        const expected = allowed[key];
+        if (expected === undefined) {
+            const near = known.find((k) => distance(key, k) <= typoThreshold(key, k));
+            if (near) {
+                out.push({
+                    severity: DiagnosticSeverity.Warning,
+                    code: "METADATA_UNKNOWN_FIELD",
+                    source: SOURCE,
+                    message: `${ctx.label}: 'metadata.${key}' is not a known field — did you mean '${near}'? ` +
+                        `Nothing reads an unrecognized key, so this declares nothing.`,
+                    data: { resource: ctx.resource, filePath: ctx.filePath, path: `metadata.${key}` },
+                });
+            }
+            continue;
+        }
+        if (typeOf(value) !== expected) {
+            out.push({
+                severity: DiagnosticSeverity.Warning,
+                code: "METADATA_INVALID_TYPE",
+                source: SOURCE,
+                message: `${ctx.label}: 'metadata.${key}' must be ${describeType(expected)}.`,
+                data: { resource: ctx.resource, filePath: ctx.filePath, path: `metadata.${key}` },
+            });
+        }
+    }
+}
+function describeType(t) {
+    if (t === "string[]")
+        return "an array of strings";
+    if (t === "object")
+        return "an object";
+    return "a string";
+}
+/**
+ * `metadata.deprecated: { reason, replacedBy? }`.
+ *
+ * `replacedBy` is deliberately resolvable rather than free text, and its form
+ * follows the level: a module doc names another **module ref** (the `imports:`
+ * source grammar), a kind doc names an **alias-qualified kind** resolved through
+ * this file's own imports — the same grammar `kind:` / `extends:` use, so the
+ * replacement is a link a consumer can follow rather than a sentence they have to
+ * interpret.
+ *
+ * A kind whose replacement lives in a module this one does not import cannot be
+ * named; that case deprecates at module level with a module ref instead. Accepted
+ * over inventing a second grammar for it.
+ */
+function validateDeprecation(metadata, isModuleDoc, ctx, registry, aliases, out) {
+    const deprecated = metadata.deprecated;
+    if (deprecated === undefined)
+        return;
+    const at = "metadata.deprecated";
+    const push = (code, message, path = at, severity = DiagnosticSeverity.Warning) => {
+        out.push({
+            severity,
+            code,
+            source: SOURCE,
+            message: `${ctx.label}: ${message}`,
+            data: { resource: ctx.resource, filePath: ctx.filePath, path },
+        });
+    };
+    if (typeOf(deprecated) !== "object") {
+        push("INVALID_DEPRECATION", `'${at}' must be an object with a 'reason' (and an optional 'replacedBy'). ` +
+            `A bare 'true' says a thing is deprecated without saying what to do instead.`);
+        return;
+    }
+    const block = deprecated;
+    const allowed = new Set(["reason", "replacedBy"]);
+    for (const key of Object.keys(block)) {
+        if (!allowed.has(key)) {
+            push("INVALID_DEPRECATION", `'${at}.${key}' is not a recognized key (reason, replacedBy).`, `${at}.${key}`);
+        }
+    }
+    if (typeof block.reason !== "string" || block.reason.trim() === "") {
+        push("INVALID_DEPRECATION", `'${at}.reason' is required and must be a non-empty string — it is what a consumer reads to know what to do instead.`, `${at}.reason`);
+    }
+    const replacedBy = block.replacedBy;
+    if (replacedBy === undefined)
+        return;
+    const path = `${at}.replacedBy`;
+    if (typeof replacedBy !== "string" || replacedBy.trim() === "") {
+        push("INVALID_DEPRECATION", `'${path}' must be a non-empty string.`, path);
+        return;
+    }
+    if (isModuleDoc) {
+        // A module is replaced by another module, addressed the way an import is.
+        // Catching alias form here is worth a dedicated message: it is the natural
+        // mistake, and it would otherwise be stored as an unresolvable ref.
+        if (ALIAS_KIND_RE.test(replacedBy)) {
+            push("INVALID_DEPRECATION", `'${path}: ${replacedBy}' looks like a kind reference, but a module doc's replacement is a ` +
+                `module ref (e.g. 'oci://ghcr.io/acme/thing'). Deprecate the kind itself to point at another kind.`, path);
+        }
+        return;
+    }
+    // Kind level: resolve through this file's imports, exactly as `extends` does.
+    if (!ALIAS_KIND_RE.test(replacedBy)) {
+        push("INVALID_DEPRECATION", `'${path}: ${replacedBy}' must be an alias-qualified kind ("<Alias>.<Kind>", ` +
+            `e.g. 'Self.Migrations'), resolved via this file's imports.`, path);
+        return;
+    }
+    const prefix = replacedBy.slice(0, replacedBy.indexOf("."));
+    if (prefix !== TELO_BUILTIN_ALIAS && !aliases.hasAlias(prefix)) {
+        push("DEPRECATION_REPLACEMENT_UNRESOLVED", `'${path}: ${replacedBy}' — alias '${prefix}' is not an import in this file's scope. ` +
+            `Declare the import or correct the alias.`, path);
+        return;
+    }
+    const canonical = aliases.resolveKind(replacedBy);
+    if (!canonical || !registry.resolve(canonical)) {
+        push("DEPRECATION_REPLACEMENT_UNRESOLVED", `'${path}: ${replacedBy}' does not resolve to a known kind. A replacement a consumer ` +
+            `cannot follow is no better than none.`, path);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.52.0",
+  "version": "0.53.0",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",

package/src/analyzer.ts

@@ -76,6 +76,7 @@ import {
 import { validateExtends } from "./validate-extends.js";
 import { validateLogging } from "./validate-logging.js";
 import { validateModuleArtifact } from "./validate-module-artifact.js";
+import { validateModuleMetadata } from "./validate-module-metadata.js";
 import { validateBaseMapping } from "./validate-base-mapping.js";
 import { validateInvocationContract } from "./validate-invocation-contract.js";
 import { collectStepInputIssues } from "./validate-step-inputs.js";
@@ -1315,6 +1316,10 @@ export class StaticAnalyzer {
       // would otherwise fail on a consumer's machine — or, for a mistyped platform
       // axis, silently offer one platform's binary to every host.
       diagnostics.push(...validateModuleArtifact(allManifests));
+      // The descriptive `metadata:` surface. Nothing in the kernel branches on
+      // these fields, which is precisely why they need a check: a mistyped one
+      // has no runtime failure mode that would ever surface it.
+      diagnostics.push(...validateModuleMetadata(allManifests, defs, aliases));
     }
     resolveSchemaTypeRefs(allManifests, aliases, aliasesByModule);
 

package/src/index.ts

@@ -167,6 +167,10 @@ export {
 } from "./artifact-layer-index.js";
 export type { ArtifactLayer } from "./artifact-layer-index.js";
 export { validateModuleArtifact } from "./validate-module-artifact.js";
+// Warnings everywhere, fatal at `telo publish` — descriptive metadata has no
+// runtime failure mode, so it must not stop a manifest running, but it is the
+// module's public face the moment it is published.
+export { PUBLISH_BLOCKING_CODES } from "./validate-module-metadata.js";
 export { withSyntheticPositions } from "./with-synthetic-positions.js";
 export { documentToAst, parseToAst } from "./yaml-ast.js";
 export type { AstDocument, AstMap, AstNode, AstPair, AstScalar, AstSeq } from "./yaml-ast.js";

package/src/validate-module-metadata.ts

@@ -0,0 +1,335 @@
+import type { ResourceManifest } from "@telorun/sdk";
+
+import type { AliasResolver } from "./alias-resolver.js";
+import type { DefinitionRegistry } from "./definition-registry.js";
+import { distance } from "./levenshtein.js";
+import { DiagnosticSeverity, type AnalysisDiagnostic } from "./types.js";
+
+const SOURCE = "telo-analyzer";
+
+/**
+ * Static validation of the `metadata:` block on module docs (`Telo.Application` /
+ * `Telo.Library`) and of `metadata.deprecated` wherever it appears.
+ *
+ * These fields are descriptive — nothing in the kernel branches on them — but they
+ * are the module's public face: a hub indexes them, and a consumer reads them
+ * before deciding to import. That is exactly why they need checking. A field the
+ * runtime ignores has no failure mode that would ever surface it, so a mistyped
+ * `licence:` or `deprecatd:` is invisible forever, and the module ships claiming
+ * nothing while its author believes otherwise.
+ *
+ * The vocabulary stays **open** — `metadata` accepts any key, because a publisher
+ * may carry their own — so an unknown key is only reported when it is a near-miss
+ * of a known one. That catches the typo without closing the set.
+ *
+ * **Everything here is a WARNING, and fatal only at `telo publish`** (see
+ * {@link PUBLISH_BLOCKING_CODES}). Refusing to *run* a manifest over a field no
+ * runtime reads gets the cost backwards: `version: 1.0` is a YAML float rather
+ * than a string, which is a real mistake worth reporting, but stopping the app
+ * from starting over it is worse than the mistake. Publication is the moment
+ * these fields become consequential — they are projected onto the artifact's
+ * annotations and indexed by the hub — so that is where they block.
+ */
+
+/**
+ * Codes that must not block running a manifest but MUST block publishing one.
+ *
+ * Kept as a set rather than a severity because the two audiences differ: a
+ * developer running a manifest wants to know, a publisher must be stopped. If a
+ * later check earns the same treatment, add its code here rather than inventing
+ * a third severity level.
+ */
+export const PUBLISH_BLOCKING_CODES: ReadonlySet<string> = new Set([
+  "METADATA_INVALID_TYPE",
+  "METADATA_UNKNOWN_FIELD",
+  "INVALID_DEPRECATION",
+  "DEPRECATION_REPLACEMENT_UNRESOLVED",
+]);
+
+type FieldType = "string" | "string[]" | "object";
+
+/** Conventional module-doc metadata, and the type each carries. Descriptive only;
+ *  `name` is the sole field anything resolves against. */
+const MODULE_METADATA_TYPES: Record<string, FieldType> = {
+  name: "string",
+  module: "string",
+  version: "string",
+  description: "string",
+  repository: "string",
+  homepage: "string",
+  documentation: "string",
+  license: "string",
+  namespace: "string",
+  categories: "string[]",
+  deprecated: "object",
+};
+
+/** What a kind doc's `metadata:` may carry.
+ *
+ *  Deliberately narrower than a module's: `version`, `license` and the rest
+ *  belong to the module, and a kind restating them means nothing. `categories`
+ *  is legal and *replaces* the module's for that kind; `description` is hub
+ *  search text. Both have exactly the failure mode this file exists for — a
+ *  `descriptoin:` on a kind doc is read by nothing and reported by nothing, so
+ *  it ships silently — which is why kind docs are checked rather than exempt. */
+const KIND_METADATA_TYPES: Record<string, FieldType> = {
+  name: "string",
+  module: "string",
+  description: "string",
+  categories: "string[]",
+  deprecated: "object",
+};
+
+/** Alias-qualified kind — `Self.Migrations`, `Cache.Store`, `Telo.JsonSchema`. */
+const ALIAS_KIND_RE = /^[A-Z][A-Za-z0-9_]*\.[A-Z][A-Za-z0-9_]*$/;
+
+/** The built-in namespace, resolvable without an import — mirrors `validate-extends`. */
+const TELO_BUILTIN_ALIAS = "Telo";
+
+function typeOf(value: unknown): "string" | "string[]" | "object" | "other" {
+  if (typeof value === "string") return "string";
+  if (Array.isArray(value)) return value.every((v) => typeof v === "string") ? "string[]" : "other";
+  if (value !== null && typeof value === "object") return "object";
+  return "other";
+}
+
+export function validateModuleMetadata(
+  manifests: ResourceManifest[],
+  registry: DefinitionRegistry,
+  aliases: AliasResolver,
+): AnalysisDiagnostic[] {
+  const out: AnalysisDiagnostic[] = [];
+
+  // Docs forwarded from imported libraries carry `metadata.module` set to that
+  // library's name. Their `replacedBy` aliases — `Self`, or any alias private to
+  // that library — belong to the library's OWN scope, which the consumer's
+  // resolver knows nothing about, so re-checking them here reports a false
+  // DEPRECATION_REPLACEMENT_UNRESOLVED against a manifest the consumer does not
+  // own. They are validated when that library is analyzed as a root, which is
+  // its author's concern. Same rule, and the same reason, as `validate-extends`.
+  const importedModules = new Set<string>();
+  for (const m of manifests) {
+    if (m.kind !== "Telo.Import") continue;
+    const resolved = (m.metadata as { resolvedModuleName?: string } | undefined)
+      ?.resolvedModuleName;
+    if (resolved) importedModules.add(resolved);
+  }
+
+  for (const manifest of manifests) {
+    const isModuleDoc = manifest.kind === "Telo.Application" || manifest.kind === "Telo.Library";
+    const isKindDoc = manifest.kind === "Telo.Definition" || manifest.kind === "Telo.Abstract";
+    if (!isModuleDoc && !isKindDoc) continue;
+
+    const metadata = manifest.metadata as Record<string, unknown> | undefined;
+    if (!metadata) continue;
+
+    const ownModule = (metadata as { module?: string }).module;
+    if (ownModule && importedModules.has(ownModule)) continue;
+
+    const name = typeof metadata.name === "string" ? metadata.name : undefined;
+    const filePath = typeof metadata.source === "string" ? metadata.source : undefined;
+    const ctx = {
+      label: `${manifest.kind}/${name ?? "(unnamed)"}`,
+      resource: { kind: manifest.kind, name },
+      filePath,
+    };
+
+    validateFieldTypes(
+      metadata,
+      isModuleDoc ? MODULE_METADATA_TYPES : KIND_METADATA_TYPES,
+      ctx,
+      out,
+    );
+    validateDeprecation(metadata, isModuleDoc, ctx, registry, aliases, out);
+  }
+  return out;
+}
+
+interface DocContext {
+  label: string;
+  resource: { kind: string; name: string | undefined };
+  filePath: string | undefined;
+}
+
+/** How far a key may be from a known one and still be called a typo.
+ *
+ *  Scaled, not absolute: at a flat 2, `date:` (a perfectly ordinary key an
+ *  author might carry) is two edits from `name` and gets told it is a
+ *  misspelling of it. The vocabulary is open, so a false accusation on a short
+ *  key is worse than missing a typo on one. */
+function typoThreshold(key: string, known: string): number {
+  return Math.max(1, Math.floor(Math.min(key.length, known.length) / 3));
+}
+
+function validateFieldTypes(
+  metadata: Record<string, unknown>,
+  allowed: Record<string, FieldType>,
+  ctx: DocContext,
+  out: AnalysisDiagnostic[],
+): void {
+  const known = Object.keys(allowed);
+  for (const [key, value] of Object.entries(metadata)) {
+    // Stamped by the loader, not authored — never a typo to report on.
+    if (key === "source") continue;
+
+    // Listed as known so a typo still gets suggested against it, but its shape
+    // belongs to `validateDeprecation`, which can say what is actually wrong.
+    // Type-checking it here too would report one mistake twice.
+    if (key === "deprecated") continue;
+
+    const expected = allowed[key];
+    if (expected === undefined) {
+      const near = known.find((k) => distance(key, k) <= typoThreshold(key, k));
+      if (near) {
+        out.push({
+          severity: DiagnosticSeverity.Warning,
+          code: "METADATA_UNKNOWN_FIELD",
+          source: SOURCE,
+          message:
+            `${ctx.label}: 'metadata.${key}' is not a known field — did you mean '${near}'? ` +
+            `Nothing reads an unrecognized key, so this declares nothing.`,
+          data: { resource: ctx.resource, filePath: ctx.filePath, path: `metadata.${key}` },
+        });
+      }
+      continue;
+    }
+
+    if (typeOf(value) !== expected) {
+      out.push({
+        severity: DiagnosticSeverity.Warning,
+        code: "METADATA_INVALID_TYPE",
+        source: SOURCE,
+        message: `${ctx.label}: 'metadata.${key}' must be ${describeType(expected)}.`,
+        data: { resource: ctx.resource, filePath: ctx.filePath, path: `metadata.${key}` },
+      });
+    }
+  }
+}
+
+function describeType(t: "string" | "string[]" | "object"): string {
+  if (t === "string[]") return "an array of strings";
+  if (t === "object") return "an object";
+  return "a string";
+}
+
+/**
+ * `metadata.deprecated: { reason, replacedBy? }`.
+ *
+ * `replacedBy` is deliberately resolvable rather than free text, and its form
+ * follows the level: a module doc names another **module ref** (the `imports:`
+ * source grammar), a kind doc names an **alias-qualified kind** resolved through
+ * this file's own imports — the same grammar `kind:` / `extends:` use, so the
+ * replacement is a link a consumer can follow rather than a sentence they have to
+ * interpret.
+ *
+ * A kind whose replacement lives in a module this one does not import cannot be
+ * named; that case deprecates at module level with a module ref instead. Accepted
+ * over inventing a second grammar for it.
+ */
+function validateDeprecation(
+  metadata: Record<string, unknown>,
+  isModuleDoc: boolean,
+  ctx: DocContext,
+  registry: DefinitionRegistry,
+  aliases: AliasResolver,
+  out: AnalysisDiagnostic[],
+): void {
+  const deprecated = metadata.deprecated;
+  if (deprecated === undefined) return;
+
+  const at = "metadata.deprecated";
+  const push = (
+    code: string,
+    message: string,
+    path = at,
+    severity = DiagnosticSeverity.Warning,
+  ): void => {
+    out.push({
+      severity,
+      code,
+      source: SOURCE,
+      message: `${ctx.label}: ${message}`,
+      data: { resource: ctx.resource, filePath: ctx.filePath, path },
+    });
+  };
+
+  if (typeOf(deprecated) !== "object") {
+    push(
+      "INVALID_DEPRECATION",
+      `'${at}' must be an object with a 'reason' (and an optional 'replacedBy'). ` +
+        `A bare 'true' says a thing is deprecated without saying what to do instead.`,
+    );
+    return;
+  }
+
+  const block = deprecated as Record<string, unknown>;
+  const allowed = new Set(["reason", "replacedBy"]);
+  for (const key of Object.keys(block)) {
+    if (!allowed.has(key)) {
+      push("INVALID_DEPRECATION", `'${at}.${key}' is not a recognized key (reason, replacedBy).`, `${at}.${key}`);
+    }
+  }
+
+  if (typeof block.reason !== "string" || block.reason.trim() === "") {
+    push(
+      "INVALID_DEPRECATION",
+      `'${at}.reason' is required and must be a non-empty string — it is what a consumer reads to know what to do instead.`,
+      `${at}.reason`,
+    );
+  }
+
+  const replacedBy = block.replacedBy;
+  if (replacedBy === undefined) return;
+  const path = `${at}.replacedBy`;
+  if (typeof replacedBy !== "string" || replacedBy.trim() === "") {
+    push("INVALID_DEPRECATION", `'${path}' must be a non-empty string.`, path);
+    return;
+  }
+
+  if (isModuleDoc) {
+    // A module is replaced by another module, addressed the way an import is.
+    // Catching alias form here is worth a dedicated message: it is the natural
+    // mistake, and it would otherwise be stored as an unresolvable ref.
+    if (ALIAS_KIND_RE.test(replacedBy)) {
+      push(
+        "INVALID_DEPRECATION",
+        `'${path}: ${replacedBy}' looks like a kind reference, but a module doc's replacement is a ` +
+          `module ref (e.g. 'oci://ghcr.io/acme/thing'). Deprecate the kind itself to point at another kind.`,
+        path,
+      );
+    }
+    return;
+  }
+
+  // Kind level: resolve through this file's imports, exactly as `extends` does.
+  if (!ALIAS_KIND_RE.test(replacedBy)) {
+    push(
+      "INVALID_DEPRECATION",
+      `'${path}: ${replacedBy}' must be an alias-qualified kind ("<Alias>.<Kind>", ` +
+        `e.g. 'Self.Migrations'), resolved via this file's imports.`,
+      path,
+    );
+    return;
+  }
+
+  const prefix = replacedBy.slice(0, replacedBy.indexOf("."));
+  if (prefix !== TELO_BUILTIN_ALIAS && !aliases.hasAlias(prefix)) {
+    push(
+      "DEPRECATION_REPLACEMENT_UNRESOLVED",
+      `'${path}: ${replacedBy}' — alias '${prefix}' is not an import in this file's scope. ` +
+        `Declare the import or correct the alias.`,
+      path,
+    );
+    return;
+  }
+
+  const canonical = aliases.resolveKind(replacedBy);
+  if (!canonical || !registry.resolve(canonical)) {
+    push(
+      "DEPRECATION_REPLACEMENT_UNRESOLVED",
+      `'${path}: ${replacedBy}' does not resolve to a known kind. A replacement a consumer ` +
+        `cannot follow is no better than none.`,
+      path,
+    );
+  }
+}