@telorun/analyzer 0.60.0 → 0.62.0

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAWzE,OAAO,EACL,aAAa,EAEb,KAAK,YAAY,EAElB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EACL,KAAK,aAAa,EAGnB,MAAM,0BAA0B,CAAC;AAsBlC,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAwBvF,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAsF/F;;;;;uDAKuD;AACvD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,aAAa,GAAG;IAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAA;CAAE,CAO9F;AA6FD;0CAC0C;AAC1C,eAAO,MAAM,eAAe,GAAI,OAAO;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OACT,CAAC;AAErD;8EAC8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhD;AAuBD;2DAC2D;AAC3D,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACvC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAqBjC;AAID;;;;;;;;iDAQiD;AACjD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACzB,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAsBtC;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,OAAO,EAAE,EAChB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EAC/C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,GAC3D,IAAI,CAiDN;AA6gBD,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACtC;AA6DD,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAq7CvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAyBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAWzE,OAAO,EACL,aAAa,EAEb,KAAK,YAAY,EAElB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EACL,KAAK,aAAa,EAGnB,MAAM,0BAA0B,CAAC;AAsBlC,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAwBvF,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAwF/F;;;;;uDAKuD;AACvD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,aAAa,GAAG;IAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAA;CAAE,CAO9F;AA6FD;0CAC0C;AAC1C,eAAO,MAAM,eAAe,GAAI,OAAO;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OACT,CAAC;AAErD;8EAC8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhD;AAuBD;2DAC2D;AAC3D,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACvC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAqBjC;AAID;;;;;;;;iDAQiD;AACjD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACzB,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAsBtC;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,OAAO,EAAE,EAChB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EAC/C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,GAC3D,IAAI,CAiDN;AA6gBD,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACtC;AA6DD,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAkFD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IA2+CvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAyBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -29,12 +29,15 @@ import { collectValueSchemaIssues } from "./validate-value-schema.js";
 import { DiagnosticSeverity } from "./types.js";
 import { extractAccessChains, extractCelRegionScopes, getManifestItem, pathMatchesScope, resolveContextAnnotations, resolveTypeFieldToSchema, } from "./validate-cel-context.js";
 import { buildEvalPaths, evalPathsCover } from "./eval-paths.js";
-import { BINDINGS_ANNOTATION, bindingContextProperties, bindingPathChain, CEL_RESERVED_WORDS, findBindingSites, resolveBindingOrder, schemaAtChain, } from "./cel-bindings.js";
+import { BINDINGS_ANNOTATION, bindingContextProperties, bindingPathChain, findBindingSites, resolveBindingOrder, schemaAtChain, } from "./cel-bindings.js";
+import { CEL_RESERVED_WORDS, checkName } from "./identifier-name.js";
+import { validateIdentifierNames } from "./validate-identifier-names.js";
 import { validateExtends } from "./validate-extends.js";
 import { validateLogging } from "./validate-logging.js";
 import { validateModuleArtifact } from "./validate-module-artifact.js";
 import { validateIncludePlacement } from "./validate-include-placement.js";
 import { validateModuleMetadata } from "./validate-module-metadata.js";
+import { validateRequires } from "./validate-requires.js";
 import { validateBaseMapping } from "./validate-base-mapping.js";
 import { validateInvocationContract } from "./validate-invocation-contract.js";
 import { collectStepInputIssues } from "./validate-step-inputs.js";
@@ -819,6 +822,85 @@ function collectCelValueSlots(data, schema, path) {
     }
     return slots;
 }
+/**
+ * Files belonging to a module this runtime declared itself unable to read.
+ *
+ * Attribution is by FILE rather than by resource identity, the same choice
+ * `remapMigratedPaths` makes and for the same reason: a diagnostic carries at
+ * most two routing facts and routinely only one, so indexing by resource would
+ * leave every diagnostic without `data.resource` unreachable.
+ *
+ * **A module NAME is not a graph-unique key.** Names are module-scoped, so two
+ * libraries may both be called `Store` — CLAUDE.md names this exact hazard for
+ * migration provenance ("two libraries declaring a Store would share one
+ * bucket"), where the answer is to narrow or not remap at all. Same answer here:
+ * the gated doc's own `metadata.source` is always suppressed, and a name is used
+ * to reach its `include:` partials only when that name identifies exactly ONE
+ * module doc in the set. Where it does not, the partials keep their diagnostics
+ * rather than risk silencing an unrelated library's — a stray extra diagnostic is
+ * a far cheaper failure than a hidden one.
+ *
+ * A module doc with no `source` contributes nothing — suppressing on a guess
+ * would hide diagnostics belonging to files nobody named.
+ */
+function filesOfUnreadableModules(manifests, requiresDiagnostics) {
+    const files = new Set();
+    const gatedNames = new Set();
+    for (const d of requiresDiagnostics) {
+        if (d.code !== "MODULE_REQUIRES_NEWER_RUNTIME")
+            continue;
+        const data = d.data;
+        // The gated document itself, addressed by the file it was declared in.
+        if (typeof data?.filePath === "string" && data.filePath)
+            files.add(data.filePath);
+        const name = data?.resource?.name;
+        if (typeof name === "string")
+            gatedNames.add(name);
+    }
+    if (files.size === 0 && gatedNames.size === 0)
+        return files;
+    // How many module docs answer to each gated name — the ambiguity test.
+    const docsPerName = new Map();
+    for (const m of manifests) {
+        if (m.kind !== "Telo.Application" && m.kind !== "Telo.Library")
+            continue;
+        const name = m.metadata?.name;
+        if (typeof name === "string" && gatedNames.has(name)) {
+            docsPerName.set(name, (docsPerName.get(name) ?? 0) + 1);
+        }
+    }
+    for (const m of manifests) {
+        const metadata = (m.metadata ?? {});
+        const owner = metadata.module;
+        if (typeof owner !== "string" || !gatedNames.has(owner))
+            continue;
+        if (docsPerName.get(owner) !== 1)
+            continue; // ambiguous — do not guess
+        if (typeof metadata.source === "string" && metadata.source)
+            files.add(metadata.source);
+    }
+    return files;
+}
+/**
+ * Drop every diagnostic anchored in a file whose module this runtime cannot
+ * read, except the gate diagnostic itself.
+ *
+ * A filter rather than a guard on each validator: threading "skip this module"
+ * through thirty validators would make each one responsible for a rule none of
+ * them owns, and a validator added later would silently opt out of it. A
+ * diagnostic with no `filePath` is KEPT — suppression must never be the default
+ * for something it cannot attribute.
+ */
+function suppressUnreadableModuleDiagnostics(diagnostics, unreadableFiles) {
+    if (unreadableFiles.size === 0)
+        return diagnostics;
+    return diagnostics.filter((d) => {
+        if (d.code === "MODULE_REQUIRES_NEWER_RUNTIME")
+            return true;
+        const filePath = d.data?.filePath;
+        return typeof filePath !== "string" || !unreadableFiles.has(filePath);
+    });
+}
 export class StaticAnalyzer {
     celEnv;
     constructor(options = {}) {
@@ -1278,6 +1360,21 @@ export class StaticAnalyzer {
                 });
             }
         }
+        // Declared runtime requirements, FIRST among the validators and suppressing
+        // the rest for any module this runtime cannot read. A module that adopted
+        // newer syntax also produces the vocabulary errors that syntax causes here —
+        // an unknown `use` token, an object where a zone annotation expects a
+        // pointer, an `additionalProperties` violation against a kernel-owned
+        // schema — every one of which is true and blames the module's author for a
+        // version skew. Reporting them beside the gate would bury the one message
+        // that names the actual cause and the actual fix.
+        const requiresDiagnostics = validateRequires(allManifests, {
+            teloVersion: options?.teloVersion,
+            hostVersions: options?.hostVersions,
+            entryModules: rootModules,
+        });
+        const unreadableFiles = filesOfUnreadableModules(allManifests, requiresDiagnostics);
+        diagnostics.push(...requiresDiagnostics);
         if (!options?.skipValidation) {
             diagnostics.push(...validateSchemaTypeRefs(allManifests, defs, aliases, aliasesByModule, rootModules));
             // §14.1 / §10.3: redaction paths and `on_full: block` are statically
@@ -1292,6 +1389,11 @@ export class StaticAnalyzer {
             // these fields, which is precisely why they need a check: a mistyped one
             // has no runtime failure mode that would ever surface it.
             diagnostics.push(...validateModuleMetadata(allManifests, defs, aliases));
+            // Every author-written name. Telo has no lexer, so a name's shape is
+            // unchecked where it is declared and its consequences land at whichever
+            // CEL site reads it — for a hyphen, sometimes as silent arithmetic. Takes
+            // the call graph for step names rather than re-walking the step arrays.
+            diagnostics.push(...validateIdentifierNames(allManifests, defs, aliases, rootModules, getCallGraph()));
             // A file embed resolves at resource creation, so one written on a doc that
             // is never instantiated is read by nothing and would ship silently.
             diagnostics.push(...validateIncludePlacement(allManifests));
@@ -1304,7 +1406,7 @@ export class StaticAnalyzer {
         // normalisation have already run above; that's all downstream
         // consumers (prepare, init loop) require.
         if (options?.skipValidation) {
-            return diagnostics;
+            return suppressUnreadableModuleDiagnostics(diagnostics, unreadableFiles);
         }
         // Build a name→manifest map for looking up referenced resources
         const byName = new Map();
@@ -1769,15 +1871,34 @@ export class StaticAnalyzer {
                         const keywords = new Set(CEL_RESERVED_WORDS);
                         for (const name of Object.keys(declared)) {
                             const shadows = inScope.has(name);
-                            if (!shadows && !keywords.has(name))
+                            if (shadows || keywords.has(name)) {
+                                diagnostics.push({
+                                    severity: DiagnosticSeverity.Error,
+                                    code: "BINDING_NAME_RESERVED",
+                                    source: SOURCE,
+                                    message: shadows
+                                        ? `${m.kind}/${bindingsName}: binding '${name}' shadows a variable already in scope here (${[...inScope].sort().join(", ")}). Rename the binding — a scope variable always wins, so this one would never be read.`
+                                        : `${m.kind}/${bindingsName}: binding '${name}' is a CEL keyword, so no expression can read it as a reference. Rename the binding.`,
+                                    data: {
+                                        resource: resourceRef,
+                                        filePath: bindingsFile,
+                                        path: `${celBindingSites.field}.${name}`,
+                                    },
+                                });
+                                continue;
+                            }
+                            // A binding is read by bare name, so it lives in the same
+                            // identifier space as a resource or step name and breaks the
+                            // same way. The keyword tier is unreachable here — the check
+                            // above owns it, and can also say what is being shadowed.
+                            const violation = checkName(name, "value", "binding name");
+                            if (!violation)
                                 continue;
                             diagnostics.push({
-                                severity: DiagnosticSeverity.Error,
-                                code: "BINDING_NAME_RESERVED",
+                                severity: violation.severity,
+                                code: violation.code,
                                 source: SOURCE,
-                                message: shadows
-                                    ? `${m.kind}/${bindingsName}: binding '${name}' shadows a variable already in scope here (${[...inScope].sort().join(", ")}). Rename the binding — a scope variable always wins, so this one would never be read.`
-                                    : `${m.kind}/${bindingsName}: binding '${name}' is a CEL keyword, so no expression can read it as a reference. Rename the binding.`,
+                                message: `${m.kind}/${bindingsName}: ${violation.message}`,
                                 data: {
                                     resource: resourceRef,
                                     filePath: bindingsFile,
@@ -2120,7 +2241,7 @@ export class StaticAnalyzer {
         diagnostics.push(...validateUnusedDeclarations(allManifests, this.celEnv));
         // Reroute diagnostics on synthetic (inline-extracted) resources back to
         // the chain root so position-index lookups land on the parent doc.
-        return rewriteSyntheticOrigins(diagnostics, allManifests);
+        return rewriteSyntheticOrigins(suppressUnreadableModuleDiagnostics(diagnostics, unreadableFiles), allManifests);
     }
     analyzeErrors(manifests, options, registry, zoneExportCache) {
         return this.analyze(manifests, options, registry, zoneExportCache).filter((d) => d.severity === DiagnosticSeverity.Error);

package/dist/artifact-layer-index.d.ts

@@ -30,7 +30,7 @@
 import { type ArtifactSelector, type LayerRole, type PlatformTarget } from "./artifact-selector.js";
 export interface ArtifactLayer {
     role: LayerRole;
-    /** Present on `controller` layers only. */
+    /** Present on the code-bearing roles (`controller`, `library`) only. */
     selector?: ArtifactSelector;
     /** OCI blob digest — addresses the layer and verifies the transfer. */
     blob: string;
@@ -48,8 +48,16 @@ export declare class LayerIndexError extends Error {
  */
 export declare function parseLayerIndex(value: unknown, describe?: string): ArtifactLayer[];
 /** The singleton layer for a role, or undefined when the artifact has none. */
-export declare function singletonLayer(layers: readonly ArtifactLayer[], role: Exclude<LayerRole, "controller">): ArtifactLayer | undefined;
-/** Every controller layer matching `target`, in declaration order. Used by
- *  `telo install` to warm a cache for one platform. */
-export declare function matchControllerLayers(layers: readonly ArtifactLayer[], target: PlatformTarget): ArtifactLayer[];
+export declare function singletonLayer(layers: readonly ArtifactLayer[], role: Exclude<LayerRole, "controller" | "library">): ArtifactLayer | undefined;
+/** The layer of one code role carrying exactly `selector`, or undefined.
+ *
+ *  By exact key rather than by re-matching a host: the candidate being resolved
+ *  already *is* one selector, and it is by construction the key of the layer
+ *  that carries it. */
+export declare function codeLayerFor(layers: readonly ArtifactLayer[], role: Extract<LayerRole, "controller" | "library">, selector: ArtifactSelector): ArtifactLayer | undefined;
+/** Every code layer — controller and library alike — matching `target`, in
+ *  declaration order. Used by `telo install` to warm a cache for one platform:
+ *  a library layer is as much a prerequisite of an offline run as the controller
+ *  layer that imports it. */
+export declare function matchCodeLayers(layers: readonly ArtifactLayer[], target: PlatformTarget): ArtifactLayer[];
 //# sourceMappingURL=artifact-layer-index.d.ts.map

package/dist/artifact-layer-index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"artifact-layer-index.d.ts","sourceRoot":"","sources":["../src/artifact-layer-index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAKL,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,cAAc,EACpB,MAAM,wBAAwB,CAAC;AAQhC,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,SAAS,CAAC;IAChB,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,yBAAyB;gBAE1B,MAAM,EAAE,MAAM;CAI3B;AAiBD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,SAAW,GAAG,aAAa,EAAE,CAyDpF;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAC5B,MAAM,EAAE,SAAS,aAAa,EAAE,EAChC,IAAI,EAAE,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC,GACrC,aAAa,GAAG,SAAS,CAE3B;AAED;uDACuD;AACvD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,SAAS,aAAa,EAAE,EAChC,MAAM,EAAE,cAAc,GACrB,aAAa,EAAE,CAIjB"}
+{"version":3,"file":"artifact-layer-index.d.ts","sourceRoot":"","sources":["../src/artifact-layer-index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAOL,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,cAAc,EACpB,MAAM,wBAAwB,CAAC;AAQhC,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,SAAS,CAAC;IAChB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,yBAAyB;gBAE1B,MAAM,EAAE,MAAM;CAI3B;AAiBD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,SAAW,GAAG,aAAa,EAAE,CAmEpF;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAC5B,MAAM,EAAE,SAAS,aAAa,EAAE,EAChC,IAAI,EAAE,OAAO,CAAC,SAAS,EAAE,YAAY,GAAG,SAAS,CAAC,GACjD,aAAa,GAAG,SAAS,CAE3B;AAED;;;;uBAIuB;AACvB,wBAAgB,YAAY,CAC1B,MAAM,EAAE,SAAS,aAAa,EAAE,EAChC,IAAI,EAAE,OAAO,CAAC,SAAS,EAAE,YAAY,GAAG,SAAS,CAAC,EAClD,QAAQ,EAAE,gBAAgB,GACzB,aAAa,GAAG,SAAS,CAK3B;AAED;;;6BAG6B;AAC7B,wBAAgB,eAAe,CAC7B,MAAM,EAAE,SAAS,aAAa,EAAE,EAChC,MAAM,EAAE,cAAc,GACrB,aAAa,EAAE,CAOjB"}

package/dist/artifact-layer-index.js

@@ -27,7 +27,7 @@
  * Browser-safe: `telo check`, the editor and the hub validate an index through
  * this module; only the kernel fetches and extracts.
  */
-import { isLayerRole, normalizeSelector, selectorKey, selectorMatches, } from "./artifact-selector.js";
+import { LAYER_ROLES, isLayerRole, normalizeSelector, roleCarriesSelector, selectorKey, selectorMatches, } from "./artifact-selector.js";
 /** OCI content digest: `sha256:` + 64 lowercase hex. */
 const BLOB_DIGEST = /^sha256:[0-9a-f]{64}$/;
 /** Telo content digest: `sha256-` + unpadded base64url of 32 bytes. */
@@ -69,21 +69,32 @@ export function parseLayerIndex(value, describe = "layers") {
             throw new LayerIndexError(`${where}: expected an object.`);
         }
         const entry = raw;
-        if (!isLayerRole(entry.role)) {
-            throw new LayerIndexError(`${where}: role must be one of 'controller', 'assets', 'common'; got ` +
-                `${entry.role === undefined ? "nothing" : `'${String(entry.role)}'`}.`);
+        if (typeof entry.role !== "string" || entry.role === "") {
+            throw new LayerIndexError(`${where}: role is required and must be one of ${LAYER_ROLES.map((r) => `'${r}'`).join(", ")}; ` +
+                `got ${entry.role === undefined ? "nothing" : `'${String(entry.role)}'`}.`);
         }
+        // A role this runtime does not know is SKIPPED, never rejected. Roles are
+        // added over time, and a runtime that cannot name one cannot need it — while
+        // throwing would make the whole manifest unreadable, so a module gaining a
+        // layer for a newer runtime would stop loading on an older one entirely
+        // rather than merely lacking that layer. The error stays for a structurally
+        // invalid entry, which is a malformed index rather than a newer one.
+        if (!isLayerRole(entry.role))
+            return;
         const role = entry.role;
         let selector;
-        if (role === "controller") {
+        if (roleCarriesSelector(role)) {
             if (entry.selector === undefined) {
-                throw new LayerIndexError(`${where}: a controller layer must declare a selector.`);
+                throw new LayerIndexError(`${where}: a ${role} layer must declare a selector.`);
             }
             selector = normalizeSelector(entry.selector, where);
-            const key = selectorKey(selector);
+            // Scoped by role: a module's `js` controller layer and its `js` library
+            // layer are different layers with the same selector, and only a collision
+            // *within* one role means two layers claim one address.
+            const key = `${role}\0${selectorKey(selector)}`;
             if (seenSelectors.has(key)) {
-                throw new LayerIndexError(`${where}: a second controller layer claims the selector ${key}. ` +
-                    `Each selector addresses exactly one layer.`);
+                throw new LayerIndexError(`${where}: a second ${role} layer claims the selector ${selectorKey(selector)}. ` +
+                    `Each selector addresses exactly one layer of a role.`);
             }
             seenSelectors.add(key);
         }
@@ -109,8 +120,21 @@ export function parseLayerIndex(value, describe = "layers") {
 export function singletonLayer(layers, role) {
     return layers.find((l) => l.role === role);
 }
-/** Every controller layer matching `target`, in declaration order. Used by
- *  `telo install` to warm a cache for one platform. */
-export function matchControllerLayers(layers, target) {
-    return layers.filter((l) => l.role === "controller" && l.selector !== undefined && selectorMatches(l.selector, target));
+/** The layer of one code role carrying exactly `selector`, or undefined.
+ *
+ *  By exact key rather than by re-matching a host: the candidate being resolved
+ *  already *is* one selector, and it is by construction the key of the layer
+ *  that carries it. */
+export function codeLayerFor(layers, role, selector) {
+    const key = selectorKey(selector);
+    return layers.find((l) => l.role === role && l.selector !== undefined && selectorKey(l.selector) === key);
+}
+/** Every code layer — controller and library alike — matching `target`, in
+ *  declaration order. Used by `telo install` to warm a cache for one platform:
+ *  a library layer is as much a prerequisite of an offline run as the controller
+ *  layer that imports it. */
+export function matchCodeLayers(layers, target) {
+    return layers.filter((l) => (l.role === "controller" || l.role === "library") &&
+        l.selector !== undefined &&
+        selectorMatches(l.selector, target));
 }

package/dist/artifact-selector.d.ts

@@ -24,11 +24,18 @@
  * canonical OCI/GOOS names at the kernel boundary, since these values are
  * published into OCI descriptors.
  */
-/** The role a layer plays in a module artifact. `controller` layers carry a
- *  selector; `assets` and `common` are singletons and carry none. */
-export type LayerRole = "controller" | "assets" | "common";
+/** The role a layer plays in a module artifact. `controller` and `library` layers
+ *  carry a selector; `assets` and `common` are singletons and carry none. */
+export type LayerRole = "controller" | "library" | "assets" | "common";
 export declare const LAYER_ROLES: readonly LayerRole[];
 export declare function isLayerRole(value: unknown): value is LayerRole;
+/** The roles that hold executable code, and are therefore per format rather than
+ *  singletons. A `library` layer is per selector for the same reason a
+ *  `controller` layer is: a module's JS entry point and its future Rust one are
+ *  different files, and a consumer resolves the one its own runtime can import.
+ *  A singleton would be wrong the moment a second runtime ships. */
+export declare const CODE_LAYER_ROLES: readonly LayerRole[];
+export declare function roleCarriesSelector(role: LayerRole): boolean;
 /** The platform axes, in canonical order. Not a closed vocabulary of *values* —
  *  new architectures appear without a Telo release — only of axis names. */
 export declare const PLATFORM_AXES: readonly ["os", "arch", "libc"];

package/dist/artifact-selector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"artifact-selector.d.ts","sourceRoot":"","sources":["../src/artifact-selector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;qEACqE;AACrE,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE3D,eAAO,MAAM,WAAW,EAAE,SAAS,SAAS,EAAuC,CAAC;AAEpF,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,SAAS,CAE9D;AAED;4EAC4E;AAC5E,eAAO,MAAM,aAAa,iCAAkC,CAAC;AAE7D,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D,MAAM,WAAW,gBAAgB;IAC/B,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;kFAGkF;AAClF,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,IAAI,+BAA+B;gBAEhC,MAAM,EAAE,MAAM;CAI3B;AAsBD;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,OAAO,EACf,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,EACzD,QAAQ,SAAwB,GAC/B,gBAAgB,CAUlB;AAED,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,OAAO,EACd,QAAQ,SAAmB,GAC1B,gBAAgB,CAelB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,CAO9D;AAED,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,CAKnE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAQ3F"}
+{"version":3,"file":"artifact-selector.d.ts","sourceRoot":"","sources":["../src/artifact-selector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;6EAC6E;AAC7E,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEvE,eAAO,MAAM,WAAW,EAAE,SAAS,SAAS,EAAkD,CAAC;AAE/F,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,SAAS,CAE9D;AAED;;;;oEAIoE;AACpE,eAAO,MAAM,gBAAgB,EAAE,SAAS,SAAS,EAA8B,CAAC;AAEhF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAE5D;AAED;4EAC4E;AAC5E,eAAO,MAAM,aAAa,iCAAkC,CAAC;AAE7D,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D,MAAM,WAAW,gBAAgB;IAC/B,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;kFAGkF;AAClF,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,IAAI,+BAA+B;gBAEhC,MAAM,EAAE,MAAM;CAI3B;AAsBD;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,OAAO,EACf,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,EACzD,QAAQ,SAAwB,GAC/B,gBAAgB,CAUlB;AAED,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,OAAO,EACd,QAAQ,SAAmB,GAC1B,gBAAgB,CAelB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,CAO9D;AAED,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,CAKnE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAQ3F"}

package/dist/artifact-selector.js

@@ -24,10 +24,19 @@
  * canonical OCI/GOOS names at the kernel boundary, since these values are
  * published into OCI descriptors.
  */
-export const LAYER_ROLES = ["controller", "assets", "common"];
+export const LAYER_ROLES = ["controller", "library", "assets", "common"];
 export function isLayerRole(value) {
     return typeof value === "string" && LAYER_ROLES.includes(value);
 }
+/** The roles that hold executable code, and are therefore per format rather than
+ *  singletons. A `library` layer is per selector for the same reason a
+ *  `controller` layer is: a module's JS entry point and its future Rust one are
+ *  different files, and a consumer resolves the one its own runtime can import.
+ *  A singleton would be wrong the moment a second runtime ships. */
+export const CODE_LAYER_ROLES = ["controller", "library"];
+export function roleCarriesSelector(role) {
+    return CODE_LAYER_ROLES.includes(role);
+}
 /** The platform axes, in canonical order. Not a closed vocabulary of *values* —
  *  new architectures appear without a Telo release — only of axis names. */
 export const PLATFORM_AXES = ["os", "arch", "libc"];

package/dist/builtins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AA6JvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EA0rB/C,CAAC"}
+{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAiNvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EAusB/C,CAAC"}

package/dist/builtins.js

@@ -1,5 +1,25 @@
-import { manifestFragment } from "./manifest-schemas.js";
-import { OBSERVED_STATE_SCHEMA } from "./validate-observed-state.js";
+import { manifestFragment, manifestFragmentRef, withSchemaFragments } from "./manifest-schemas.js";
+/** A slot holding author-written JSON Schema. Localized and hoisted by
+ *  {@link withSchemaFragments} on the enclosing schema, which is what makes the
+ *  `#/$defs` pointer resolve inside whatever AJV compiles.
+ *
+ *  `KindSchema` and `JsonSchema7` share a body; the name is the discriminator
+ *  the IDE reads off the `x-telo-fragment` stamp to decide whether the
+ *  `x-telo-*` vocabulary belongs here. A kind's own `schema:` is where it does;
+ *  a `status:` block or an `inputType:` describes plain data, where it does not. */
+const kindSchemaSlot = {
+    title: "Schema",
+    description: "Configuration this kind accepts, as JSON Schema plus `x-telo-*` annotations.",
+    $ref: manifestFragmentRef("KindSchema"),
+};
+/** Observed state a kind reports while running, as a data schema. `required:` is
+ *  rejected separately by `validateObservedStateDeclarations`, which can say why
+ *  and what to write instead. */
+const observedStateSlot = {
+    title: "Observed state",
+    description: "What a resource of this kind reports while running, published at `resources.<name>.status.<field>`.",
+    $ref: manifestFragmentRef("JsonSchema7"),
+};
 /** Descriptive provenance a module declares about itself, shared by
  *  `Telo.Application` and `Telo.Library`.
  *
@@ -21,6 +41,31 @@ const PROVENANCE_METADATA = {
     license: { type: "string" },
     documentation: { type: "string" },
 };
+/** The declared runtime requirements block, shared by `Telo.Application` and
+ *  `Telo.Library` — the two module kinds, whose schemas are otherwise
+ *  independent and would drift.
+ *
+ *  **Deliberately says only "these are objects", and nothing about the values.**
+ *  The grammar belongs to `requires-block.ts`, which is the single reader, and
+ *  every rule that matters — `^` and `~` refused, a bare version refused, bounds
+ *  that must not exclude each other, an upper bound that must name a version that
+ *  exists — needs a parse and a comparison, not a schema. Adding `type: "string"`
+ *  here bought nothing and cost a duplicate: `telo: 80` then produced BOTH a
+ *  `SCHEMA_VIOLATION` and a `REQUIRES_INVALID` for one node, one of them phrased
+ *  by a layer that does not know what the value is for.
+ *
+ *  Left open at both tiers for the same reason. An unrecognized axis is reported
+ *  by the reader with the vocabulary it knows — a far better message than AJV's —
+ *  and, critically, is SUPPRESSED while the `telo` requirement is itself unmet,
+ *  since an older runtime not knowing a newer axis is a consequence of the
+ *  version skew rather than a second defect. AJV cannot express that ordering. */
+const REQUIRES_SCHEMA = {
+    type: "object",
+    properties: {
+        host: { type: "object" },
+    },
+    additionalProperties: true,
+};
 /** Author-declared subset of `files:` that ships in the artifact's lazily
  *  materialized `assets` layer. Optional: an unclaimed file joins the `common`
  *  layer, which is pulled alongside any controller layer, so omitting this costs
@@ -29,6 +74,32 @@ const ASSETS_FILES_SCHEMA = {
     type: "array",
     items: { type: "string" },
 };
+/** `exports.code` — the entry point a sibling module's controller bundle resolves
+ *  this library's bare specifier to, one per format.
+ *
+ *  Data rather than a package URL: `controllers:` needs a PURL because it can name
+ *  an ecosystem fetch (`pkg:npm`, `pkg:cargo`), while this always names a file the
+ *  module already ships, so the type/namespace segments would be constant noise —
+ *  and a query string is one opaque box to the visual editor. `format` plus the
+ *  platform axes build the same `ArtifactSelector` a controller candidate does.
+ *  Semantics and diagnostics live in `analyzer/nodejs/src/module-library.ts`. */
+const LIBRARY_CANDIDATES_SCHEMA = {
+    type: "array",
+    items: {
+        type: "object",
+        required: ["specifier", "format", "path"],
+        properties: {
+            specifier: { type: "string" },
+            format: { type: "string" },
+            path: { type: "string" },
+            source: { type: "string" },
+            os: { type: "string" },
+            arch: { type: "string" },
+            libc: { type: "string" },
+        },
+        additionalProperties: false,
+    },
+};
 /** The published layer index, written by `telo publish` (never hand-authored).
  *  One entry per layer except the manifest layer, which cannot list its own hash
  *  inside itself and is pinned by the importer's `#sha256-...` instead. Shape and
@@ -40,7 +111,7 @@ const LAYER_INDEX_SCHEMA = {
         type: "object",
         required: ["role", "blob", "integrity"],
         properties: {
-            role: { type: "string", enum: ["controller", "assets", "common"] },
+            role: { type: "string", enum: ["controller", "library", "assets", "common"] },
             selector: {
                 type: "object",
                 required: ["format"],
@@ -239,13 +310,13 @@ export const KERNEL_BUILTINS = [
         // kernel registers this controller directly at boot, before any lazy
         // resolution — it states truthfully who provides it.
         controllers: [{ runtime: "kernel", entry: "Telo.JsonSchema" }],
-        schema: {
+        schema: withSchemaFragments({
             type: "object",
             properties: {
                 schema: {
                     title: "Schema",
                     description: "JSON Schema definition for the declared data type.",
-                    type: "object",
+                    $ref: manifestFragmentRef("JsonSchema7"),
                 },
                 extends: {
                     title: "Extends",
@@ -278,13 +349,13 @@ export const KERNEL_BUILTINS = [
             },
             required: ["schema"],
             additionalProperties: false,
-        },
+        }),
     },
     {
         kind: "Telo.Definition",
         metadata: { name: "Abstract", module: "Telo" },
         capability: "Telo.Template",
-        schema: {
+        schema: withSchemaFragments({
             type: "object",
             properties: {
                 kind: { type: "string" },
@@ -295,15 +366,15 @@ export const KERNEL_BUILTINS = [
                     additionalProperties: true,
                 },
                 capability: { type: "string" },
-                schema: { type: "object", additionalProperties: true },
-                status: OBSERVED_STATE_SCHEMA,
+                schema: kindSchemaSlot,
+                status: observedStateSlot,
             },
             required: ["metadata"],
             // Telo.Abstract is an extension point by design — it must accept forward-compatible
             // fields (e.g. inputType/outputType from the typed-abstracts plan) without requiring
             // the analyzer to enumerate them here.
             additionalProperties: true,
-        },
+        }),
     },
     {
         kind: "Telo.Definition",
@@ -321,11 +392,17 @@ export const KERNEL_BUILTINS = [
         // matching how Run.Sequence steps factor dispatch from data. The dispatch
         // entry-point (`invoke` / `provide` / `run`) determines how `inputs`/`result`
         // are interpreted at runtime. See analyzer/nodejs/plans/template-internal-cel-validation.md.
-        schema: {
+        schema: withSchemaFragments({
             type: "object",
             additionalProperties: true,
             properties: {
-                status: OBSERVED_STATE_SCHEMA,
+                // The kind's own configuration contract. Declared as a slot for the
+                // first time here: it was reachable only as an unnamed extra property,
+                // so nothing could say what belonged in it — no completion inside a
+                // `schema:` block, and a misspelled keyword surviving to a runtime
+                // failure that named a different field.
+                schema: kindSchemaSlot,
+                status: observedStateSlot,
                 resources: {
                     type: "array",
                     items: {
@@ -495,7 +572,7 @@ export const KERNEL_BUILTINS = [
                     },
                 },
             },
-        },
+        }),
     },
     {
         kind: "Telo.Definition",
@@ -746,6 +823,9 @@ export const KERNEL_BUILTINS = [
                 // CLI flag — so a level derived from the host environment goes through a
                 // `variables:` entry read with `!cel`. See kernel/specs/logging.md §12.
                 logging: ROOT_LOGGING_SCHEMA,
+                // The runtime range this module is verified against. See
+                // `analyzer/nodejs/src/requires-block.ts`.
+                requires: REQUIRES_SCHEMA,
             },
             required: ["metadata"],
             additionalProperties: false,
@@ -832,9 +912,13 @@ export const KERNEL_BUILTINS = [
                             type: "array",
                             items: { type: "string", not: { enum: ["variables", "secrets"] } },
                         },
+                        code: LIBRARY_CANDIDATES_SCHEMA,
                     },
                     additionalProperties: true,
                 },
+                // The runtime range this module is verified against. See
+                // `analyzer/nodejs/src/requires-block.ts`.
+                requires: REQUIRES_SCHEMA,
             },
             required: ["metadata"],
             additionalProperties: false,

package/dist/cel-bindings.d.ts

@@ -14,12 +14,6 @@ export interface BindingSites {
     /** Variable names the annotated contexts declare — a binding may not shadow one. */
     scopeNames: Set<string>;
 }
-/**
- * CEL keywords. A binding named after one is unreachable — `true` lexes as a
- * literal, `in` as an operator — so it is reserved alongside the scope names,
- * which turns silence into a diagnostic.
- */
-export declare const CEL_RESERVED_WORDS: readonly string[];
 /** Locate a kind's bindings field and the scope names its annotated contexts
  *  declare. Returns undefined for a kind that declares no bindings region. */
 export declare function findBindingSites(definitionSchema: Record<string, any> | undefined): BindingSites | undefined;

package/dist/cel-bindings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cel-bindings.d.ts","sourceRoot":"","sources":["../src/cel-bindings.ts"],"names":[],"mappings":"AAIA;;;;gCAIgC;AAChC,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAE1D,MAAM,WAAW,YAAY;IAC3B,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd;;gCAE4B;IAC5B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,oFAAoF;IACpF,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACzB;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAsB/C,CAAC;AAEF;8EAC8E;AAC9E,wBAAgB,gBAAgB,CAC9B,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAChD,YAAY,GAAG,SAAS,CAW1B;AAuDD;uEACuE;AACvE,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAW1B;AAED;;mFAEmF;AACnF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,GAAG,IAAI,CAQhE;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACjC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAMrB;AAED;oEACoE;AACpE,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EACtB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CASjC;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IACtE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;CACpB,CAwBA"}
+{"version":3,"file":"cel-bindings.d.ts","sourceRoot":"","sources":["../src/cel-bindings.ts"],"names":[],"mappings":"AAIA;;;;gCAIgC;AAChC,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAE1D,MAAM,WAAW,YAAY;IAC3B,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd;;gCAE4B;IAC5B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,oFAAoF;IACpF,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACzB;AAMD;8EAC8E;AAC9E,wBAAgB,gBAAgB,CAC9B,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAChD,YAAY,GAAG,SAAS,CAW1B;AAuDD;uEACuE;AACvE,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAW1B;AAED;;mFAEmF;AACnF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,GAAG,IAAI,CAQhE;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACjC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAMrB;AAED;oEACoE;AACpE,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EACtB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CASjC;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IACtE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;CACpB,CAwBA"}