@telorun/analyzer 0.60.0 → 0.62.0

package/dist/cel-bindings.js

@@ -7,34 +7,9 @@ import { extractContextsFromSchema } from "./validate-cel-context.js";
  *  contexts that see it may be anchored anywhere (a decision table annotates both
  *  `choices` and `default`). */
 export const BINDINGS_ANNOTATION = "x-telo-bindings-from";
-/**
- * CEL keywords. A binding named after one is unreachable — `true` lexes as a
- * literal, `in` as an operator — so it is reserved alongside the scope names,
- * which turns silence into a diagnostic.
- */
-export const CEL_RESERVED_WORDS = [
-    "as",
-    "break",
-    "const",
-    "continue",
-    "else",
-    "false",
-    "for",
-    "function",
-    "if",
-    "import",
-    "in",
-    "let",
-    "loop",
-    "namespace",
-    "null",
-    "package",
-    "return",
-    "true",
-    "var",
-    "void",
-    "while",
-];
+// CEL keywords live in `identifier-name.ts` — a binding named after one is
+// unreachable for exactly the reason a resource or step named after one is, so
+// the list belongs to the identifier vocabulary rather than to this file.
 /** Locate a kind's bindings field and the scope names its annotated contexts
  *  declare. Returns undefined for a kind that declares no bindings region. */
 export function findBindingSites(definitionSchema) {

package/dist/definition-registry.d.ts

@@ -52,6 +52,23 @@ export declare class DefinitionRegistry {
      *  `$ref: "telo://<module>/<Name>"` would then silently validate against the
      *  kind's schema instead. The caller reports it; nothing is overwritten. */
     registerNamedTypeSchema(id: string, schema: Record<string, any>): boolean;
+    /**
+     * Register a schema, surviving one AJV refuses.
+     *
+     * `addSchema` META-VALIDATES and THROWS, and a throw here escapes the whole
+     * analyze pass: one author schema with `minimum: "3"` in it aborted the run
+     * with AJV's own unanchored text and took every other diagnostic in the file
+     * down with it — including the anchored one that says exactly which keyword is
+     * wrong. Registration is a lookup table for `$ref` resolution, so failing to
+     * fill one entry costs a reference that could not have resolved anyway.
+     *
+     * Nothing is swallowed: an unregisterable schema is invalid, and the two
+     * checks that report it both run afterwards and both anchor on the offending
+     * line — `SCHEMA_VIOLATION` from the `KindSchema` / `JsonSchema7` fragment the
+     * slot points at, and `SCHEMA_COMPILE_ERROR` from {@link schemaCompileError},
+     * which wraps `compile` for this same reason.
+     */
+    private tryAddSchema;
     /** True when a schema is registered under `id` (a canonical `telo://` type id
      *  or a definition `$id`). Used to flag schema `$ref`s that resolve to nothing. */
     hasSchemaId(id: string): boolean;

package/dist/definition-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"definition-registry.d.ts","sourceRoot":"","sources":["../src/definition-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAIlC,+EAA+E;AAC/E,qBAAa,kBAAkB;;IAK7B;;sFAEkF;IAClF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IACzD;;mFAE+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IAEzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyC;IAC9D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D;;;;wEAIoE;IACpE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IAEzD,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI;IAoC9C,OAAO,CAAC,aAAa;IASrB;;;;;;;;;;;;;2FAauF;IACvF,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAK1E;;;;;;;;;;gFAU4E;IAC5E,uBAAuB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO;IAQzE;uFACmF;IACnF,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAIhC;;;gEAG4D;IAC5D,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS;IAMxD;;;;oFAIgF;IAChF,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE;IAWtE;;;;;;iCAM6B;IAC7B,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,GAAG,SAAS;IASnE;;;;4EAIwE;IACxE,OAAO,CAAC,iBAAiB;IAkBzB;;;;;;;;;;;;;;4BAcwB;IACxB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAShD,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAIrD;;;uCAGmC;IACnC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAWxD,gGAAgG;IAChG,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,GACvD,iBAAiB,GAAG,SAAS;IAOhC;;;;;;;;qFAQiF;IACjF,2BAA2B,CACzB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC1C,iBAAiB,GAAG,SAAS;IAkChC,OAAO,CAAC,uBAAuB;IA+B/B;;qEAEiE;IACjE,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAgBxD,KAAK,IAAI,MAAM,EAAE;CAGlB"}
+{"version":3,"file":"definition-registry.d.ts","sourceRoot":"","sources":["../src/definition-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAIlC,+EAA+E;AAC/E,qBAAa,kBAAkB;;IAK7B;;sFAEkF;IAClF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IACzD;;mFAE+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IAEzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyC;IAC9D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D;;;;wEAIoE;IACpE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IAEzD,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI;IAoC9C,OAAO,CAAC,aAAa;IASrB;;;;;;;;;;;;;2FAauF;IACvF,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAK1E;;;;;;;;;;gFAU4E;IAC5E,uBAAuB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO;IAQzE;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,YAAY;IASpB;uFACmF;IACnF,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAIhC;;;gEAG4D;IAC5D,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS;IAMxD;;;;oFAIgF;IAChF,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE;IAWtE;;;;;;iCAM6B;IAC7B,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,GAAG,SAAS;IASnE;;;;4EAIwE;IACxE,OAAO,CAAC,iBAAiB;IAqBzB;;;;;;;;;;;;;;4BAcwB;IACxB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAShD,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAIrD;;;uCAGmC;IACnC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAWxD,gGAAgG;IAChG,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,GACvD,iBAAiB,GAAG,SAAS;IAOhC;;;;;;;;qFAQiF;IACjF,2BAA2B,CACzB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC1C,iBAAiB,GAAG,SAAS;IAkChC,OAAO,CAAC,uBAAuB;IA+B/B;;qEAEiE;IACjE,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAgBxD,KAAK,IAAI,MAAM,EAAE;CAGlB"}

package/dist/definition-registry.js

@@ -108,10 +108,36 @@ export class DefinitionRegistry {
             return false;
         if (this.registeredSchemaIds.has(id) || this.ajv.getSchema(id))
             return true;
-        this.ajv.addSchema(schema, id);
+        if (!this.tryAddSchema(schema, id))
+            return true;
         this.registeredSchemaIds.add(id);
         return true;
     }
+    /**
+     * Register a schema, surviving one AJV refuses.
+     *
+     * `addSchema` META-VALIDATES and THROWS, and a throw here escapes the whole
+     * analyze pass: one author schema with `minimum: "3"` in it aborted the run
+     * with AJV's own unanchored text and took every other diagnostic in the file
+     * down with it — including the anchored one that says exactly which keyword is
+     * wrong. Registration is a lookup table for `$ref` resolution, so failing to
+     * fill one entry costs a reference that could not have resolved anyway.
+     *
+     * Nothing is swallowed: an unregisterable schema is invalid, and the two
+     * checks that report it both run afterwards and both anchor on the offending
+     * line — `SCHEMA_VIOLATION` from the `KindSchema` / `JsonSchema7` fragment the
+     * slot points at, and `SCHEMA_COMPILE_ERROR` from {@link schemaCompileError},
+     * which wraps `compile` for this same reason.
+     */
+    tryAddSchema(schema, id) {
+        try {
+            this.ajv.addSchema(schema, id);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
     /** True when a schema is registered under `id` (a canonical `telo://` type id
      *  or a definition `$id`). Used to flag schema `$ref`s that resolve to nothing. */
     hasSchemaId(id) {
@@ -173,7 +199,10 @@ export class DefinitionRegistry {
         if (this.ajv.getSchema(id)) {
             throw new Error(`Duplicate definition schema $id: "${id}" is already registered`);
         }
-        this.ajv.addSchema(schema, id);
+        // A schema AJV refuses is left unregistered rather than aborting the pass —
+        // see {@link tryAddSchema}. The id stays claimed either way, so a later
+        // named type cannot quietly take a kind's place.
+        this.tryAddSchema(schema, id);
         this.registeredSchemaIds.add(id);
         this.definitionSchemaIds.add(id);
     }

package/dist/identifier-name.d.ts

@@ -0,0 +1,114 @@
+/**
+ * Naming rules for every author-written Telo identifier — resource instances,
+ * kinds, modules, import aliases, step names, config declarations and CEL
+ * bindings. The single reader, so no surface re-derives the vocabulary; the
+ * `ref-slot.ts` / `zone-slot.ts` precedent.
+ *
+ * **The rules exist because Telo has no lexer.** A name is a YAML scalar, so
+ * nothing rejects its shape where it is declared, and every consequence
+ * surfaces later at a CEL site that references it — or not at all. Probed
+ * against the engine the runtime actually uses (`@marcbachmann/cel-js`):
+ *
+ *     resources.my-server.url  →  EVALUATES, as `resources.my - server.url`
+ *     resources.in             →  ParseError: Expected IDENTIFIER, got IN
+ *     resources.2fa            →  ParseError
+ *     resources.for            →  parses fine
+ *
+ * The first line is the one that decides the design. When a bare name is in
+ * scope — which `x-telo-bindings-from` deliberately makes possible — a
+ * hyphenated resource name yields a wrong number with no diagnostic anywhere.
+ * That is a swallowed error in the reference grammar, not a style preference.
+ * The last line is why the reserved set here is the whole keyword list rather
+ * than the subset today's parser happens to reject in field position: which
+ * keywords tokenize there is a property of a dependency, and a name that
+ * breaks on a parser upgrade was never safe.
+ *
+ * **Three tiers, because they fail in three different ways.**
+ *
+ * 1. `INVALID_NAME` (error, every surface) — not a CEL-safe identifier, or a
+ *    CEL keyword. Below this line the name is unreferenceable or silently
+ *    mis-referenced. This subsumes the old dot-only rule, which was the
+ *    strictest special case of it: `!ref` splits on the first dot.
+ *
+ * 2. `INVALID_TYPE_NAME` (error) — a type-level name not starting uppercase.
+ *    An error rather than a warning because half the reference grammar already
+ *    rejects the alternative: `EXTENDS_ALIAS_PATTERN` in the kernel's manifest
+ *    schema hard-rejects `extends: foo.Bar`, while nothing rejects the
+ *    `metadata.name: foo` that produced it. A lowercase kind is a kind nobody
+ *    can extend, so this only moves an existing failure to where it is
+ *    fixable.
+ *
+ * 3. `NAME_CASE_CONVENTION` (warning) — a value-level name not starting
+ *    lowercase. Warn-only, Rust's `non_snake_case` posture: a name is
+ *    occasionally dictated from outside, and Telo has no `#[allow]`, so a hard
+ *    error would leave no escape.
+ *
+ * **The convention: case encodes what the name denotes.** PascalCase names a
+ * *type* — something writable in `kind:` / `extends:` / an `x-telo-ref` or type
+ * slot. camelCase names a *value* — something holding data at runtime, read
+ * through `resources.` / `steps.` / `variables.` in CEL. That is what
+ * distinguishes `kind: Console.WriteLine` from `!ref Console.writeLine`, two
+ * character-identical grammars otherwise, and the collision is not
+ * hypothetical: it is the sanctioned singleton pattern (declare
+ * `kind: Self.WriteLine`, export the instance, withhold the kind).
+ *
+ * **Only the first character is checked.** A full camelCase pattern would
+ * relitigate `httpApi` vs `httpAPI` and `OAuthClient` vs `OauthClient` with no
+ * benefit — the first character is what carries the type/value signal, and a
+ * stricter rule would fight legitimate names containing acronyms or digits
+ * while owning a judgement nobody asked this pass to make. An
+ * entirely-acronym type name (`SQL`, `AI`) passes unchanged.
+ *
+ * **No `DiagnosticFix`.** A fix is a whole-value replacement for ONE node,
+ * and a rename is only correct when every reference moves with it — offering
+ * one here would rewrite `metadata.name` and break every `!ref` and CEL read
+ * of it. Renaming belongs to a refactor that owns the reference graph.
+ *
+ * Browser-safe: pure string predicates, no I/O, no Node built-ins.
+ */
+import { DiagnosticSeverity } from "./types.js";
+/**
+ * CEL keywords. A name matching one is unreachable — `true` lexes as a
+ * literal, `in` as an operator — so it is reserved everywhere a name becomes a
+ * CEL identifier, which is every surface this file governs.
+ */
+export declare const CEL_RESERVED_WORDS: readonly string[];
+/**
+ * Which half of the convention a name falls under.
+ *
+ * `type` — a name writable in a `kind:` / `extends:` / type slot: a module, a
+ * kind, an import alias, or a resource whose capability is `Telo.Type` (a
+ * named shape has no runtime instance, so its name denotes a type even though
+ * it is declared as a resource).
+ *
+ * `value` — a name read through a CEL scope: a resource instance, a step, a
+ * `variables` / `secrets` / `ports` declaration, a CEL binding.
+ */
+export type NameLevel = "type" | "value";
+/** Document kinds whose `metadata.name` is type-level. Everything else
+ *  declaring a name is a resource instance, whose level is decided by its
+ *  kind's capability (see {@link NameLevel}). */
+export declare const TYPE_LEVEL_DOC_KINDS: ReadonlySet<string>;
+export interface NameViolation {
+    /** Which tier failed. Callers use it to suppress a tier another check
+     *  already reports better at that surface (the bindings site owns
+     *  `reserved`, where it can also say what is being shadowed). */
+    tier: "grammar" | "reserved" | "case";
+    code: "INVALID_NAME" | "INVALID_TYPE_NAME" | "NAME_CASE_CONVENTION";
+    severity: DiagnosticSeverity;
+    /** Complete sentence(s), subject included — so every surface words the same
+     *  rule the same way. */
+    message: string;
+}
+/**
+ * Check one author-written name.
+ *
+ * `surface` is the noun phrase naming what was declared ("resource name",
+ * "step name", "import alias"), used as the message's subject.
+ *
+ * Returns the first violation only: the tiers are ordered by how badly the
+ * name is broken, and telling an author their unparseable name is also
+ * miscased buries the part that matters.
+ */
+export declare function checkName(name: string, level: NameLevel, surface: string): NameViolation | undefined;
+//# sourceMappingURL=identifier-name.d.ts.map

package/dist/identifier-name.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identifier-name.d.ts","sourceRoot":"","sources":["../src/identifier-name.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAsB/C,CAAC;AAQF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAEzC;;iDAEiD;AACjD,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAMnD,CAAC;AAEH,MAAM,WAAW,aAAa;IAC5B;;qEAEiE;IACjE,IAAI,EAAE,SAAS,GAAG,UAAU,GAAG,MAAM,CAAC;IACtC,IAAI,EAAE,cAAc,GAAG,mBAAmB,GAAG,sBAAsB,CAAC;IACpE,QAAQ,EAAE,kBAAkB,CAAC;IAC7B;6BACyB;IACzB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CACvB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,MAAM,GACd,aAAa,GAAG,SAAS,CA6C3B"}

package/dist/identifier-name.js

@@ -0,0 +1,183 @@
+/**
+ * Naming rules for every author-written Telo identifier — resource instances,
+ * kinds, modules, import aliases, step names, config declarations and CEL
+ * bindings. The single reader, so no surface re-derives the vocabulary; the
+ * `ref-slot.ts` / `zone-slot.ts` precedent.
+ *
+ * **The rules exist because Telo has no lexer.** A name is a YAML scalar, so
+ * nothing rejects its shape where it is declared, and every consequence
+ * surfaces later at a CEL site that references it — or not at all. Probed
+ * against the engine the runtime actually uses (`@marcbachmann/cel-js`):
+ *
+ *     resources.my-server.url  →  EVALUATES, as `resources.my - server.url`
+ *     resources.in             →  ParseError: Expected IDENTIFIER, got IN
+ *     resources.2fa            →  ParseError
+ *     resources.for            →  parses fine
+ *
+ * The first line is the one that decides the design. When a bare name is in
+ * scope — which `x-telo-bindings-from` deliberately makes possible — a
+ * hyphenated resource name yields a wrong number with no diagnostic anywhere.
+ * That is a swallowed error in the reference grammar, not a style preference.
+ * The last line is why the reserved set here is the whole keyword list rather
+ * than the subset today's parser happens to reject in field position: which
+ * keywords tokenize there is a property of a dependency, and a name that
+ * breaks on a parser upgrade was never safe.
+ *
+ * **Three tiers, because they fail in three different ways.**
+ *
+ * 1. `INVALID_NAME` (error, every surface) — not a CEL-safe identifier, or a
+ *    CEL keyword. Below this line the name is unreferenceable or silently
+ *    mis-referenced. This subsumes the old dot-only rule, which was the
+ *    strictest special case of it: `!ref` splits on the first dot.
+ *
+ * 2. `INVALID_TYPE_NAME` (error) — a type-level name not starting uppercase.
+ *    An error rather than a warning because half the reference grammar already
+ *    rejects the alternative: `EXTENDS_ALIAS_PATTERN` in the kernel's manifest
+ *    schema hard-rejects `extends: foo.Bar`, while nothing rejects the
+ *    `metadata.name: foo` that produced it. A lowercase kind is a kind nobody
+ *    can extend, so this only moves an existing failure to where it is
+ *    fixable.
+ *
+ * 3. `NAME_CASE_CONVENTION` (warning) — a value-level name not starting
+ *    lowercase. Warn-only, Rust's `non_snake_case` posture: a name is
+ *    occasionally dictated from outside, and Telo has no `#[allow]`, so a hard
+ *    error would leave no escape.
+ *
+ * **The convention: case encodes what the name denotes.** PascalCase names a
+ * *type* — something writable in `kind:` / `extends:` / an `x-telo-ref` or type
+ * slot. camelCase names a *value* — something holding data at runtime, read
+ * through `resources.` / `steps.` / `variables.` in CEL. That is what
+ * distinguishes `kind: Console.WriteLine` from `!ref Console.writeLine`, two
+ * character-identical grammars otherwise, and the collision is not
+ * hypothetical: it is the sanctioned singleton pattern (declare
+ * `kind: Self.WriteLine`, export the instance, withhold the kind).
+ *
+ * **Only the first character is checked.** A full camelCase pattern would
+ * relitigate `httpApi` vs `httpAPI` and `OAuthClient` vs `OauthClient` with no
+ * benefit — the first character is what carries the type/value signal, and a
+ * stricter rule would fight legitimate names containing acronyms or digits
+ * while owning a judgement nobody asked this pass to make. An
+ * entirely-acronym type name (`SQL`, `AI`) passes unchanged.
+ *
+ * **No `DiagnosticFix`.** A fix is a whole-value replacement for ONE node,
+ * and a rename is only correct when every reference moves with it — offering
+ * one here would rewrite `metadata.name` and break every `!ref` and CEL read
+ * of it. Renaming belongs to a refactor that owns the reference graph.
+ *
+ * Browser-safe: pure string predicates, no I/O, no Node built-ins.
+ */
+import { DiagnosticSeverity } from "./types.js";
+/**
+ * CEL keywords. A name matching one is unreachable — `true` lexes as a
+ * literal, `in` as an operator — so it is reserved everywhere a name becomes a
+ * CEL identifier, which is every surface this file governs.
+ */
+export const CEL_RESERVED_WORDS = [
+    "as",
+    "break",
+    "const",
+    "continue",
+    "else",
+    "false",
+    "for",
+    "function",
+    "if",
+    "import",
+    "in",
+    "let",
+    "loop",
+    "namespace",
+    "null",
+    "package",
+    "return",
+    "true",
+    "var",
+    "void",
+    "while",
+];
+const RESERVED = new Set(CEL_RESERVED_WORDS);
+/** What a CEL identifier may be — and therefore what a name that will be read
+ *  through `resources.` / `steps.` / `variables.` must be. */
+const CEL_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Document kinds whose `metadata.name` is type-level. Everything else
+ *  declaring a name is a resource instance, whose level is decided by its
+ *  kind's capability (see {@link NameLevel}). */
+export const TYPE_LEVEL_DOC_KINDS = new Set([
+    "Telo.Application",
+    "Telo.Library",
+    "Telo.Definition",
+    "Telo.Abstract",
+    "Telo.Import",
+]);
+/**
+ * Check one author-written name.
+ *
+ * `surface` is the noun phrase naming what was declared ("resource name",
+ * "step name", "import alias"), used as the message's subject.
+ *
+ * Returns the first violation only: the tiers are ordered by how badly the
+ * name is broken, and telling an author their unparseable name is also
+ * miscased buries the part that matters.
+ */
+export function checkName(name, level, surface) {
+    const subject = `${surface} '${name}'`;
+    if (!CEL_IDENTIFIER_RE.test(name)) {
+        return {
+            tier: "grammar",
+            code: "INVALID_NAME",
+            severity: DiagnosticSeverity.Error,
+            message: `${subject} must match /^[A-Za-z_][A-Za-z0-9_]*$/ — ${grammarReason(name, level)}`,
+        };
+    }
+    if (RESERVED.has(name)) {
+        return {
+            tier: "reserved",
+            code: "INVALID_NAME",
+            severity: DiagnosticSeverity.Error,
+            message: `${subject} is a CEL keyword, so no expression can reference it. Rename it.`,
+        };
+    }
+    const first = name[0];
+    if (level === "type" && !(first >= "A" && first <= "Z")) {
+        return {
+            tier: "case",
+            code: "INVALID_TYPE_NAME",
+            severity: DiagnosticSeverity.Error,
+            message: `${subject} must start with an uppercase letter — it names a type, and the ` +
+                `alias-qualified grammar of 'kind:' / 'extends:' accepts only PascalCase.`,
+        };
+    }
+    if (level === "value" && !(first >= "a" && first <= "z")) {
+        return {
+            tier: "case",
+            code: "NAME_CASE_CONVENTION",
+            severity: DiagnosticSeverity.Warning,
+            message: `${subject} should start with a lowercase letter — camelCase names a value (read ` +
+                `through a CEL scope), PascalCase names a type.`,
+        };
+    }
+    return undefined;
+}
+/**
+ * Why the character set is what it is — which differs by level, and saying so
+ * accurately matters more than one shared sentence. A value-level name becomes
+ * a CEL identifier. A type-level name never does: it is a kind prefix or
+ * suffix, so what constrains it is the alias-qualified `<Alias>.<Kind>` grammar
+ * (`EXTENDS_ALIAS_PATTERN` in the kernel's manifest schema), which accepts the
+ * same characters for its own reasons.
+ */
+function grammarReason(name, level) {
+    if (level === "type") {
+        return name.includes(".")
+            ? `a '.' separates the two halves of every '<Alias>.<Kind>' reference, so a dotted name cannot appear in either.`
+            : `that is the character set the alias-qualified '<Alias>.<Kind>' grammar accepts on both sides.`;
+    }
+    if (name.includes("-")) {
+        return (`it becomes a CEL identifier and CEL reads '-' as subtraction, so where a bare name is in ` +
+            `scope this evaluates as arithmetic instead of failing.`);
+    }
+    if (name.includes(".")) {
+        return `in a '!ref' the first '.' separates the import alias from the name.`;
+    }
+    return `it becomes a CEL identifier, so as written it cannot be referenced.`;
+}

package/dist/index.d.ts

@@ -7,6 +7,8 @@ export { collectZoneModuleDocuments, flattenForAnalyzer, flattenLoadedModule, fo
 export { buildEvalPaths, evalPathCovers } from "./eval-paths.js";
 export { BINDINGS_ANNOTATION, bindingContextProperties, bindingDependencies, findBindingSites, resolveBindingOrder, } from "./cel-bindings.js";
 export type { BindingSites } from "./cel-bindings.js";
+export { CEL_RESERVED_WORDS, TYPE_LEVEL_DOC_KINDS, checkName, } from "./identifier-name.js";
+export type { NameLevel, NameViolation } from "./identifier-name.js";
 export { applyObservedStateNode, buildObservedStateIndex, buildObservedStateResourcesSchema, collectRunReachableNames, observedStateRead, validateObservedStateDeclarations, OBSERVED_STATE_SCHEMA, } from "./validate-observed-state.js";
 export type { AnalyzedResource, ObservedStateRead } from "./validate-observed-state.js";
 export { moduleScopedDefResolver, scopeResolverForModule } from "./alias-resolver.js";
@@ -26,6 +28,13 @@ export type { RefSlot, RefUse, RefUseCases } from "./ref-slot.js";
 export { ANNOTATION_KEYWORDS, registerTeloKeywords, valueTypeKeyword, } from "./value-type-keyword.js";
 export { applyTextEdits, isPlainSafe, quoteStyleOf, renderFixReplacement, } from "./yaml-source-edit.js";
 export type { QuoteStyle, TextEdit } from "./yaml-source-edit.js";
+export { KNOWN_HOST_AXES, evaluateRequires, readRequires } from "./requires-block.js";
+export type { HostAxis, HostVersions, ReadRequiresResult, RequiresBlock, RequiresIssue, RequiresVerdict, } from "./requires-block.js";
+export { TELO_SURFACE_VERSION } from "./telo-version.js";
+export { validateRequires } from "./validate-requires.js";
+export type { ValidateRequiresOptions } from "./validate-requires.js";
+export { isUnsatisfiable, lowerBound, parseVersionRange, rangeAccepts, upperBound, } from "./version-range.js";
+export type { ComparatorOperator, VersionComparator, VersionRange, VersionRangeResult, } from "./version-range.js";
 export { hasProvidesZone, hasRequiresZone, readProvidesZone, readRequiresZone, rewriteRequiresZoneKind, } from "./zone-slot.js";
 export type { ProvidesZoneSlot, RequiresZoneSlot } from "./zone-slot.js";
 export { deriveLibraryExportRequirements, projectZoneRequirements, runZoneAnalysis, zoneDocumentsSignature, } from "./resolve-zone-requirements.js";
@@ -70,11 +79,13 @@ export type { ParsedVersionedRef } from "./sources/versioned-ref.js";
 export { isLocalPathSource } from "./sources/local-path-ref.js";
 export { MANIFEST_CACHE_BASE_URL, ManifestCacheSource, isHttpsModuleRef, manifestCacheKey, manifestCacheUrl, ociManifestCacheCoords, urlManifestCacheCoords, } from "./sources/manifest-cache.js";
 export type { ManifestCacheCoords } from "./sources/manifest-cache.js";
-export { LAYER_ROLES, PLATFORM_AXES, ArtifactSelectorError, describeSelector, isLayerRole, normalizeSelector, selectorFromQualifiers, selectorKey, selectorMatches, } from "./artifact-selector.js";
+export { CODE_LAYER_ROLES, LAYER_ROLES, PLATFORM_AXES, ArtifactSelectorError, describeSelector, isLayerRole, normalizeSelector, roleCarriesSelector, selectorFromQualifiers, selectorKey, selectorMatches, } from "./artifact-selector.js";
 export type { ArtifactSelector, LayerRole, PlatformAxis, PlatformTarget, } from "./artifact-selector.js";
 export { collectModuleFileClaims } from "./module-file-claims.js";
 export type { ModuleFileClaim } from "./module-file-claims.js";
-export { LayerIndexError, matchControllerLayers, parseLayerIndex, singletonLayer, } from "./artifact-layer-index.js";
+export { readLibraryCandidates } from "./module-library.js";
+export type { LibraryCandidate, LibraryCandidateProblem, LibraryCandidates, } from "./module-library.js";
+export { LayerIndexError, codeLayerFor, matchCodeLayers, parseLayerIndex, singletonLayer, } from "./artifact-layer-index.js";
 export type { ArtifactLayer } from "./artifact-layer-index.js";
 export { validateModuleArtifact } from "./validate-module-artifact.js";
 export { PUBLISH_BLOCKING_CODES } from "./validate-module-metadata.js";
@@ -86,6 +97,7 @@ export type { CelNode, CelSegment } from "./cel-ast.js";
 export { DEFAULT_MANIFEST_FILENAME, DiagnosticSeverity, diagnosticFix } from "./types.js";
 export type { AnalysisDiagnostic, AnalysisOptions, DiagnosticData, DiagnosticFix, LoaderInitOptions, LoadOptions, ManifestSource, Position, PositionIndex, Range } from "./types.js";
 export * from "./manifest-schemas.js";
+export * from "./schema-keywords.js";
 export { DERIVED_METADATA_FIELDS, authoredModuleMetadata, } from "./module-metadata-scope.js";
 export * from "./release/index.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACjF,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,0BAA0B,EAC1B,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,iCAAiC,EACjC,wBAAwB,EACxB,iBAAiB,EACjB,iCAAiC,EACjC,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACxF,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACtF,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,oBAAoB,EACpB,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7E,YAAY,EACV,qBAAqB,EACrB,SAAS,EACT,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC5F,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EACL,cAAc,EACd,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,cAAc,EACd,WAAW,EACX,YAAY,EACZ,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EACL,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,EACvB,eAAe,EACf,sBAAsB,GACvB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAChG,YAAY,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,YAAY,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACjF,YAAY,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EACL,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACnB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC/E,YAAY,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EACL,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,sBAAsB,EACtB,WAAW,EACX,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,SAAS,EACT,YAAY,EACZ,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,eAAe,EACf,cAAc,GACf,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAIvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC3E,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC1F,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC;AACpB,cAAc,uBAAuB,CAAC;AAItC,OAAO,EACL,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AACpC,cAAc,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACjF,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,0BAA0B,EAC1B,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,SAAS,GACV,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,iCAAiC,EACjC,wBAAwB,EACxB,iBAAiB,EACjB,iCAAiC,EACjC,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACxF,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACtF,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,oBAAoB,EACpB,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7E,YAAY,EACV,qBAAqB,EACrB,SAAS,EACT,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC5F,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EACL,cAAc,EACd,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,cAAc,EACd,WAAW,EACX,YAAY,EACZ,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACtF,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,aAAa,EACb,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EACL,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,YAAY,EACZ,UAAU,GACX,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,EACvB,eAAe,EACf,sBAAsB,GACvB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAChG,YAAY,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,YAAY,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACjF,YAAY,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EACL,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACnB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC/E,YAAY,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,WAAW,EACX,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,SAAS,EACT,YAAY,EACZ,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,YAAY,EACV,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,eAAe,EACf,YAAY,EACZ,eAAe,EACf,eAAe,EACf,cAAc,GACf,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAIvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC3E,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC1F,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC;AACpB,cAAc,uBAAuB,CAAC;AAGtC,cAAc,sBAAsB,CAAC;AAIrC,OAAO,EACL,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AACpC,cAAc,oBAAoB,CAAC"}

package/dist/index.js

@@ -4,6 +4,7 @@ export { importResolutionDiagnostics } from "./import-resolution-diagnostics.js"
 export { collectZoneModuleDocuments, flattenForAnalyzer, flattenLoadedModule, forwardReExportManifests, parseExportEntry, reExportSpecsFromExports, resolveExportedKinds, selectModuleManifestsForAnalysis, stampExportedKinds, stampReExportedKinds, } from "./flatten-for-analyzer.js";
 export { buildEvalPaths, evalPathCovers } from "./eval-paths.js";
 export { BINDINGS_ANNOTATION, bindingContextProperties, bindingDependencies, findBindingSites, resolveBindingOrder, } from "./cel-bindings.js";
+export { CEL_RESERVED_WORDS, TYPE_LEVEL_DOC_KINDS, checkName, } from "./identifier-name.js";
 export { applyObservedStateNode, buildObservedStateIndex, buildObservedStateResourcesSchema, collectRunReachableNames, observedStateRead, validateObservedStateDeclarations, OBSERVED_STATE_SCHEMA, } from "./validate-observed-state.js";
 export { moduleScopedDefResolver, scopeResolverForModule } from "./alias-resolver.js";
 export { ancestorChain, contractDeclarer, controllerBearingAncestor, effectiveAuthorSchema, effectiveContractField, effectiveStatusSchema, hasOwnControllerOrTemplate, inheritedCapability, isInheritedDelegation, mappingFieldFor, needsContractMapping, resolveParent, } from "./extends-resolution.js";
@@ -14,6 +15,10 @@ export { buildReferenceFieldMap, isRefEntry, isScopeEntry } from "./reference-fi
 export { hasDeclaredUse, isRefSlot, isRefUse, possibleUses, readRefSlot, REF_USES, refSlotAnnotation, rewriteRefSlotKinds, transfersControl, } from "./ref-slot.js";
 export { ANNOTATION_KEYWORDS, registerTeloKeywords, valueTypeKeyword, } from "./value-type-keyword.js";
 export { applyTextEdits, isPlainSafe, quoteStyleOf, renderFixReplacement, } from "./yaml-source-edit.js";
+export { KNOWN_HOST_AXES, evaluateRequires, readRequires } from "./requires-block.js";
+export { TELO_SURFACE_VERSION } from "./telo-version.js";
+export { validateRequires } from "./validate-requires.js";
+export { isUnsatisfiable, lowerBound, parseVersionRange, rangeAccepts, upperBound, } from "./version-range.js";
 export { hasProvidesZone, hasRequiresZone, readProvidesZone, readRequiresZone, rewriteRequiresZoneKind, } from "./zone-slot.js";
 export { deriveLibraryExportRequirements, projectZoneRequirements, runZoneAnalysis, zoneDocumentsSignature, } from "./resolve-zone-requirements.js";
 export { validateZoneSlotDeclarations } from "./validate-zone-slots.js";
@@ -39,9 +44,10 @@ export { OCI_SCHEME, isOciRef, parseOciRef } from "./sources/oci-ref.js";
 export { parseVersionedRef, withRefVersion } from "./sources/versioned-ref.js";
 export { isLocalPathSource } from "./sources/local-path-ref.js";
 export { MANIFEST_CACHE_BASE_URL, ManifestCacheSource, isHttpsModuleRef, manifestCacheKey, manifestCacheUrl, ociManifestCacheCoords, urlManifestCacheCoords, } from "./sources/manifest-cache.js";
-export { LAYER_ROLES, PLATFORM_AXES, ArtifactSelectorError, describeSelector, isLayerRole, normalizeSelector, selectorFromQualifiers, selectorKey, selectorMatches, } from "./artifact-selector.js";
+export { CODE_LAYER_ROLES, LAYER_ROLES, PLATFORM_AXES, ArtifactSelectorError, describeSelector, isLayerRole, normalizeSelector, roleCarriesSelector, selectorFromQualifiers, selectorKey, selectorMatches, } from "./artifact-selector.js";
 export { collectModuleFileClaims } from "./module-file-claims.js";
-export { LayerIndexError, matchControllerLayers, parseLayerIndex, singletonLayer, } from "./artifact-layer-index.js";
+export { readLibraryCandidates } from "./module-library.js";
+export { LayerIndexError, codeLayerFor, matchCodeLayers, parseLayerIndex, singletonLayer, } from "./artifact-layer-index.js";
 export { validateModuleArtifact } from "./validate-module-artifact.js";
 // Warnings everywhere, fatal at `telo publish` — descriptive metadata has no
 // runtime failure mode, so it must not stop a manifest running, but it is the
@@ -52,6 +58,9 @@ export { documentToAst, parseToAst } from "./yaml-ast.js";
 export { CelParseError, buildCelSegments, wrapCelAst } from "./cel-ast.js";
 export { DEFAULT_MANIFEST_FILENAME, DiagnosticSeverity, diagnosticFix } from "./types.js";
 export * from "./manifest-schemas.js";
+// The JSON Schema vocabulary a manifest may write, as data — the source both the
+// validating fragments and the IDE's completion are built from.
+export * from "./schema-keywords.js";
 // The release model — module identity, fragments, the ledger, the edge graph and
 // version planning. Pure data in, plan out, so the editor and the CLI release
 // from one model.