@telorun/analyzer 0.61.0 → 0.62.1

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAWzE,OAAO,EACL,aAAa,EAEb,KAAK,YAAY,EAElB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EACL,KAAK,aAAa,EAGnB,MAAM,0BAA0B,CAAC;AAsBlC,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAwBvF,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAsF/F;;;;;uDAKuD;AACvD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,aAAa,GAAG;IAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAA;CAAE,CAO9F;AA6FD;0CAC0C;AAC1C,eAAO,MAAM,eAAe,GAAI,OAAO;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OACT,CAAC;AAErD;8EAC8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhD;AAuBD;2DAC2D;AAC3D,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACvC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAqBjC;AAID;;;;;;;;iDAQiD;AACjD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACzB,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAsBtC;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,OAAO,EAAE,EAChB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EAC/C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,GAC3D,IAAI,CAiDN;AA6gBD,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACtC;AA6DD,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAq7CvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAyBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAWzE,OAAO,EACL,aAAa,EAEb,KAAK,YAAY,EAElB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EACL,KAAK,aAAa,EAGnB,MAAM,0BAA0B,CAAC;AAsBlC,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAwBvF,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAwF/F;;;;;uDAKuD;AACvD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,aAAa,GAAG;IAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAA;CAAE,CAO9F;AA6FD;0CAC0C;AAC1C,eAAO,MAAM,eAAe,GAAI,OAAO;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OACT,CAAC;AAErD;8EAC8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhD;AAuBD;2DAC2D;AAC3D,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACvC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAqBjC;AAID;;;;;;;;iDAQiD;AACjD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACzB,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAsBtC;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,OAAO,EAAE,EAChB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EAC/C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,GAC3D,IAAI,CAiDN;AA6gBD,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACtC;AA6DD,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAkFD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IA2+CvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAyBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -29,12 +29,15 @@ import { collectValueSchemaIssues } from "./validate-value-schema.js";
 import { DiagnosticSeverity } from "./types.js";
 import { extractAccessChains, extractCelRegionScopes, getManifestItem, pathMatchesScope, resolveContextAnnotations, resolveTypeFieldToSchema, } from "./validate-cel-context.js";
 import { buildEvalPaths, evalPathsCover } from "./eval-paths.js";
-import { BINDINGS_ANNOTATION, bindingContextProperties, bindingPathChain, CEL_RESERVED_WORDS, findBindingSites, resolveBindingOrder, schemaAtChain, } from "./cel-bindings.js";
+import { BINDINGS_ANNOTATION, bindingContextProperties, bindingPathChain, findBindingSites, resolveBindingOrder, schemaAtChain, } from "./cel-bindings.js";
+import { CEL_RESERVED_WORDS, checkName } from "./identifier-name.js";
+import { validateIdentifierNames } from "./validate-identifier-names.js";
 import { validateExtends } from "./validate-extends.js";
 import { validateLogging } from "./validate-logging.js";
 import { validateModuleArtifact } from "./validate-module-artifact.js";
 import { validateIncludePlacement } from "./validate-include-placement.js";
 import { validateModuleMetadata } from "./validate-module-metadata.js";
+import { validateRequires } from "./validate-requires.js";
 import { validateBaseMapping } from "./validate-base-mapping.js";
 import { validateInvocationContract } from "./validate-invocation-contract.js";
 import { collectStepInputIssues } from "./validate-step-inputs.js";
@@ -819,6 +822,85 @@ function collectCelValueSlots(data, schema, path) {
     }
     return slots;
 }
+/**
+ * Files belonging to a module this runtime declared itself unable to read.
+ *
+ * Attribution is by FILE rather than by resource identity, the same choice
+ * `remapMigratedPaths` makes and for the same reason: a diagnostic carries at
+ * most two routing facts and routinely only one, so indexing by resource would
+ * leave every diagnostic without `data.resource` unreachable.
+ *
+ * **A module NAME is not a graph-unique key.** Names are module-scoped, so two
+ * libraries may both be called `Store` — CLAUDE.md names this exact hazard for
+ * migration provenance ("two libraries declaring a Store would share one
+ * bucket"), where the answer is to narrow or not remap at all. Same answer here:
+ * the gated doc's own `metadata.source` is always suppressed, and a name is used
+ * to reach its `include:` partials only when that name identifies exactly ONE
+ * module doc in the set. Where it does not, the partials keep their diagnostics
+ * rather than risk silencing an unrelated library's — a stray extra diagnostic is
+ * a far cheaper failure than a hidden one.
+ *
+ * A module doc with no `source` contributes nothing — suppressing on a guess
+ * would hide diagnostics belonging to files nobody named.
+ */
+function filesOfUnreadableModules(manifests, requiresDiagnostics) {
+    const files = new Set();
+    const gatedNames = new Set();
+    for (const d of requiresDiagnostics) {
+        if (d.code !== "MODULE_REQUIRES_NEWER_RUNTIME")
+            continue;
+        const data = d.data;
+        // The gated document itself, addressed by the file it was declared in.
+        if (typeof data?.filePath === "string" && data.filePath)
+            files.add(data.filePath);
+        const name = data?.resource?.name;
+        if (typeof name === "string")
+            gatedNames.add(name);
+    }
+    if (files.size === 0 && gatedNames.size === 0)
+        return files;
+    // How many module docs answer to each gated name — the ambiguity test.
+    const docsPerName = new Map();
+    for (const m of manifests) {
+        if (m.kind !== "Telo.Application" && m.kind !== "Telo.Library")
+            continue;
+        const name = m.metadata?.name;
+        if (typeof name === "string" && gatedNames.has(name)) {
+            docsPerName.set(name, (docsPerName.get(name) ?? 0) + 1);
+        }
+    }
+    for (const m of manifests) {
+        const metadata = (m.metadata ?? {});
+        const owner = metadata.module;
+        if (typeof owner !== "string" || !gatedNames.has(owner))
+            continue;
+        if (docsPerName.get(owner) !== 1)
+            continue; // ambiguous — do not guess
+        if (typeof metadata.source === "string" && metadata.source)
+            files.add(metadata.source);
+    }
+    return files;
+}
+/**
+ * Drop every diagnostic anchored in a file whose module this runtime cannot
+ * read, except the gate diagnostic itself.
+ *
+ * A filter rather than a guard on each validator: threading "skip this module"
+ * through thirty validators would make each one responsible for a rule none of
+ * them owns, and a validator added later would silently opt out of it. A
+ * diagnostic with no `filePath` is KEPT — suppression must never be the default
+ * for something it cannot attribute.
+ */
+function suppressUnreadableModuleDiagnostics(diagnostics, unreadableFiles) {
+    if (unreadableFiles.size === 0)
+        return diagnostics;
+    return diagnostics.filter((d) => {
+        if (d.code === "MODULE_REQUIRES_NEWER_RUNTIME")
+            return true;
+        const filePath = d.data?.filePath;
+        return typeof filePath !== "string" || !unreadableFiles.has(filePath);
+    });
+}
 export class StaticAnalyzer {
     celEnv;
     constructor(options = {}) {
@@ -1278,6 +1360,21 @@ export class StaticAnalyzer {
                 });
             }
         }
+        // Declared runtime requirements, FIRST among the validators and suppressing
+        // the rest for any module this runtime cannot read. A module that adopted
+        // newer syntax also produces the vocabulary errors that syntax causes here —
+        // an unknown `use` token, an object where a zone annotation expects a
+        // pointer, an `additionalProperties` violation against a kernel-owned
+        // schema — every one of which is true and blames the module's author for a
+        // version skew. Reporting them beside the gate would bury the one message
+        // that names the actual cause and the actual fix.
+        const requiresDiagnostics = validateRequires(allManifests, {
+            teloVersion: options?.teloVersion,
+            hostVersions: options?.hostVersions,
+            entryModules: rootModules,
+        });
+        const unreadableFiles = filesOfUnreadableModules(allManifests, requiresDiagnostics);
+        diagnostics.push(...requiresDiagnostics);
         if (!options?.skipValidation) {
             diagnostics.push(...validateSchemaTypeRefs(allManifests, defs, aliases, aliasesByModule, rootModules));
             // §14.1 / §10.3: redaction paths and `on_full: block` are statically
@@ -1292,6 +1389,11 @@ export class StaticAnalyzer {
             // these fields, which is precisely why they need a check: a mistyped one
             // has no runtime failure mode that would ever surface it.
             diagnostics.push(...validateModuleMetadata(allManifests, defs, aliases));
+            // Every author-written name. Telo has no lexer, so a name's shape is
+            // unchecked where it is declared and its consequences land at whichever
+            // CEL site reads it — for a hyphen, sometimes as silent arithmetic. Takes
+            // the call graph for step names rather than re-walking the step arrays.
+            diagnostics.push(...validateIdentifierNames(allManifests, defs, aliases, rootModules, getCallGraph()));
             // A file embed resolves at resource creation, so one written on a doc that
             // is never instantiated is read by nothing and would ship silently.
             diagnostics.push(...validateIncludePlacement(allManifests));
@@ -1304,7 +1406,7 @@ export class StaticAnalyzer {
         // normalisation have already run above; that's all downstream
         // consumers (prepare, init loop) require.
         if (options?.skipValidation) {
-            return diagnostics;
+            return suppressUnreadableModuleDiagnostics(diagnostics, unreadableFiles);
         }
         // Build a name→manifest map for looking up referenced resources
         const byName = new Map();
@@ -1769,15 +1871,34 @@ export class StaticAnalyzer {
                         const keywords = new Set(CEL_RESERVED_WORDS);
                         for (const name of Object.keys(declared)) {
                             const shadows = inScope.has(name);
-                            if (!shadows && !keywords.has(name))
+                            if (shadows || keywords.has(name)) {
+                                diagnostics.push({
+                                    severity: DiagnosticSeverity.Error,
+                                    code: "BINDING_NAME_RESERVED",
+                                    source: SOURCE,
+                                    message: shadows
+                                        ? `${m.kind}/${bindingsName}: binding '${name}' shadows a variable already in scope here (${[...inScope].sort().join(", ")}). Rename the binding — a scope variable always wins, so this one would never be read.`
+                                        : `${m.kind}/${bindingsName}: binding '${name}' is a CEL keyword, so no expression can read it as a reference. Rename the binding.`,
+                                    data: {
+                                        resource: resourceRef,
+                                        filePath: bindingsFile,
+                                        path: `${celBindingSites.field}.${name}`,
+                                    },
+                                });
+                                continue;
+                            }
+                            // A binding is read by bare name, so it lives in the same
+                            // identifier space as a resource or step name and breaks the
+                            // same way. The keyword tier is unreachable here — the check
+                            // above owns it, and can also say what is being shadowed.
+                            const violation = checkName(name, "value", "binding name");
+                            if (!violation)
                                 continue;
                             diagnostics.push({
-                                severity: DiagnosticSeverity.Error,
-                                code: "BINDING_NAME_RESERVED",
+                                severity: violation.severity,
+                                code: violation.code,
                                 source: SOURCE,
-                                message: shadows
-                                    ? `${m.kind}/${bindingsName}: binding '${name}' shadows a variable already in scope here (${[...inScope].sort().join(", ")}). Rename the binding — a scope variable always wins, so this one would never be read.`
-                                    : `${m.kind}/${bindingsName}: binding '${name}' is a CEL keyword, so no expression can read it as a reference. Rename the binding.`,
+                                message: `${m.kind}/${bindingsName}: ${violation.message}`,
                                 data: {
                                     resource: resourceRef,
                                     filePath: bindingsFile,
@@ -2120,7 +2241,7 @@ export class StaticAnalyzer {
         diagnostics.push(...validateUnusedDeclarations(allManifests, this.celEnv));
         // Reroute diagnostics on synthetic (inline-extracted) resources back to
         // the chain root so position-index lookups land on the parent doc.
-        return rewriteSyntheticOrigins(diagnostics, allManifests);
+        return rewriteSyntheticOrigins(suppressUnreadableModuleDiagnostics(diagnostics, unreadableFiles), allManifests);
     }
     analyzeErrors(manifests, options, registry, zoneExportCache) {
         return this.analyze(manifests, options, registry, zoneExportCache).filter((d) => d.severity === DiagnosticSeverity.Error);

package/dist/builtins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAwLvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EA2rB/C,CAAC"}
+{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAiNvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EAusB/C,CAAC"}

package/dist/builtins.js

@@ -1,5 +1,25 @@
-import { manifestFragment } from "./manifest-schemas.js";
-import { OBSERVED_STATE_SCHEMA } from "./validate-observed-state.js";
+import { manifestFragment, manifestFragmentRef, withSchemaFragments } from "./manifest-schemas.js";
+/** A slot holding author-written JSON Schema. Localized and hoisted by
+ *  {@link withSchemaFragments} on the enclosing schema, which is what makes the
+ *  `#/$defs` pointer resolve inside whatever AJV compiles.
+ *
+ *  `KindSchema` and `JsonSchema7` share a body; the name is the discriminator
+ *  the IDE reads off the `x-telo-fragment` stamp to decide whether the
+ *  `x-telo-*` vocabulary belongs here. A kind's own `schema:` is where it does;
+ *  a `status:` block or an `inputType:` describes plain data, where it does not. */
+const kindSchemaSlot = {
+    title: "Schema",
+    description: "Configuration this kind accepts, as JSON Schema plus `x-telo-*` annotations.",
+    $ref: manifestFragmentRef("KindSchema"),
+};
+/** Observed state a kind reports while running, as a data schema. `required:` is
+ *  rejected separately by `validateObservedStateDeclarations`, which can say why
+ *  and what to write instead. */
+const observedStateSlot = {
+    title: "Observed state",
+    description: "What a resource of this kind reports while running, published at `resources.<name>.status.<field>`.",
+    $ref: manifestFragmentRef("JsonSchema7"),
+};
 /** Descriptive provenance a module declares about itself, shared by
  *  `Telo.Application` and `Telo.Library`.
  *
@@ -21,6 +41,31 @@ const PROVENANCE_METADATA = {
     license: { type: "string" },
     documentation: { type: "string" },
 };
+/** The declared runtime requirements block, shared by `Telo.Application` and
+ *  `Telo.Library` — the two module kinds, whose schemas are otherwise
+ *  independent and would drift.
+ *
+ *  **Deliberately says only "these are objects", and nothing about the values.**
+ *  The grammar belongs to `requires-block.ts`, which is the single reader, and
+ *  every rule that matters — `^` and `~` refused, a bare version refused, bounds
+ *  that must not exclude each other, an upper bound that must name a version that
+ *  exists — needs a parse and a comparison, not a schema. Adding `type: "string"`
+ *  here bought nothing and cost a duplicate: `telo: 80` then produced BOTH a
+ *  `SCHEMA_VIOLATION` and a `REQUIRES_INVALID` for one node, one of them phrased
+ *  by a layer that does not know what the value is for.
+ *
+ *  Left open at both tiers for the same reason. An unrecognized axis is reported
+ *  by the reader with the vocabulary it knows — a far better message than AJV's —
+ *  and, critically, is SUPPRESSED while the `telo` requirement is itself unmet,
+ *  since an older runtime not knowing a newer axis is a consequence of the
+ *  version skew rather than a second defect. AJV cannot express that ordering. */
+const REQUIRES_SCHEMA = {
+    type: "object",
+    properties: {
+        host: { type: "object" },
+    },
+    additionalProperties: true,
+};
 /** Author-declared subset of `files:` that ships in the artifact's lazily
  *  materialized `assets` layer. Optional: an unclaimed file joins the `common`
  *  layer, which is pulled alongside any controller layer, so omitting this costs
@@ -265,13 +310,13 @@ export const KERNEL_BUILTINS = [
         // kernel registers this controller directly at boot, before any lazy
         // resolution — it states truthfully who provides it.
         controllers: [{ runtime: "kernel", entry: "Telo.JsonSchema" }],
-        schema: {
+        schema: withSchemaFragments({
             type: "object",
             properties: {
                 schema: {
                     title: "Schema",
                     description: "JSON Schema definition for the declared data type.",
-                    type: "object",
+                    $ref: manifestFragmentRef("JsonSchema7"),
                 },
                 extends: {
                     title: "Extends",
@@ -304,13 +349,13 @@ export const KERNEL_BUILTINS = [
             },
             required: ["schema"],
             additionalProperties: false,
-        },
+        }),
     },
     {
         kind: "Telo.Definition",
         metadata: { name: "Abstract", module: "Telo" },
         capability: "Telo.Template",
-        schema: {
+        schema: withSchemaFragments({
             type: "object",
             properties: {
                 kind: { type: "string" },
@@ -321,15 +366,15 @@ export const KERNEL_BUILTINS = [
                     additionalProperties: true,
                 },
                 capability: { type: "string" },
-                schema: { type: "object", additionalProperties: true },
-                status: OBSERVED_STATE_SCHEMA,
+                schema: kindSchemaSlot,
+                status: observedStateSlot,
             },
             required: ["metadata"],
             // Telo.Abstract is an extension point by design — it must accept forward-compatible
             // fields (e.g. inputType/outputType from the typed-abstracts plan) without requiring
             // the analyzer to enumerate them here.
             additionalProperties: true,
-        },
+        }),
     },
     {
         kind: "Telo.Definition",
@@ -347,11 +392,17 @@ export const KERNEL_BUILTINS = [
         // matching how Run.Sequence steps factor dispatch from data. The dispatch
         // entry-point (`invoke` / `provide` / `run`) determines how `inputs`/`result`
         // are interpreted at runtime. See analyzer/nodejs/plans/template-internal-cel-validation.md.
-        schema: {
+        schema: withSchemaFragments({
             type: "object",
             additionalProperties: true,
             properties: {
-                status: OBSERVED_STATE_SCHEMA,
+                // The kind's own configuration contract. Declared as a slot for the
+                // first time here: it was reachable only as an unnamed extra property,
+                // so nothing could say what belonged in it — no completion inside a
+                // `schema:` block, and a misspelled keyword surviving to a runtime
+                // failure that named a different field.
+                schema: kindSchemaSlot,
+                status: observedStateSlot,
                 resources: {
                     type: "array",
                     items: {
@@ -521,7 +572,7 @@ export const KERNEL_BUILTINS = [
                     },
                 },
             },
-        },
+        }),
     },
     {
         kind: "Telo.Definition",
@@ -772,6 +823,9 @@ export const KERNEL_BUILTINS = [
                 // CLI flag — so a level derived from the host environment goes through a
                 // `variables:` entry read with `!cel`. See kernel/specs/logging.md §12.
                 logging: ROOT_LOGGING_SCHEMA,
+                // The runtime range this module is verified against. See
+                // `analyzer/nodejs/src/requires-block.ts`.
+                requires: REQUIRES_SCHEMA,
             },
             required: ["metadata"],
             additionalProperties: false,
@@ -862,6 +916,9 @@ export const KERNEL_BUILTINS = [
                     },
                     additionalProperties: true,
                 },
+                // The runtime range this module is verified against. See
+                // `analyzer/nodejs/src/requires-block.ts`.
+                requires: REQUIRES_SCHEMA,
             },
             required: ["metadata"],
             additionalProperties: false,

package/dist/cel-bindings.d.ts

@@ -14,12 +14,6 @@ export interface BindingSites {
     /** Variable names the annotated contexts declare — a binding may not shadow one. */
     scopeNames: Set<string>;
 }
-/**
- * CEL keywords. A binding named after one is unreachable — `true` lexes as a
- * literal, `in` as an operator — so it is reserved alongside the scope names,
- * which turns silence into a diagnostic.
- */
-export declare const CEL_RESERVED_WORDS: readonly string[];
 /** Locate a kind's bindings field and the scope names its annotated contexts
  *  declare. Returns undefined for a kind that declares no bindings region. */
 export declare function findBindingSites(definitionSchema: Record<string, any> | undefined): BindingSites | undefined;

package/dist/cel-bindings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cel-bindings.d.ts","sourceRoot":"","sources":["../src/cel-bindings.ts"],"names":[],"mappings":"AAIA;;;;gCAIgC;AAChC,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAE1D,MAAM,WAAW,YAAY;IAC3B,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd;;gCAE4B;IAC5B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,oFAAoF;IACpF,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACzB;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAsB/C,CAAC;AAEF;8EAC8E;AAC9E,wBAAgB,gBAAgB,CAC9B,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAChD,YAAY,GAAG,SAAS,CAW1B;AAuDD;uEACuE;AACvE,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAW1B;AAED;;mFAEmF;AACnF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,GAAG,IAAI,CAQhE;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACjC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAMrB;AAED;oEACoE;AACpE,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EACtB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CASjC;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IACtE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;CACpB,CAwBA"}
+{"version":3,"file":"cel-bindings.d.ts","sourceRoot":"","sources":["../src/cel-bindings.ts"],"names":[],"mappings":"AAIA;;;;gCAIgC;AAChC,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAE1D,MAAM,WAAW,YAAY;IAC3B,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd;;gCAE4B;IAC5B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,oFAAoF;IACpF,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACzB;AAMD;8EAC8E;AAC9E,wBAAgB,gBAAgB,CAC9B,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAChD,YAAY,GAAG,SAAS,CAW1B;AAuDD;uEACuE;AACvE,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAW1B;AAED;;mFAEmF;AACnF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,GAAG,IAAI,CAQhE;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACjC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAMrB;AAED;oEACoE;AACpE,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EACtB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CASjC;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IACtE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;CACpB,CAwBA"}

package/dist/cel-bindings.js

@@ -7,34 +7,9 @@ import { extractContextsFromSchema } from "./validate-cel-context.js";
  *  contexts that see it may be anchored anywhere (a decision table annotates both
  *  `choices` and `default`). */
 export const BINDINGS_ANNOTATION = "x-telo-bindings-from";
-/**
- * CEL keywords. A binding named after one is unreachable — `true` lexes as a
- * literal, `in` as an operator — so it is reserved alongside the scope names,
- * which turns silence into a diagnostic.
- */
-export const CEL_RESERVED_WORDS = [
-    "as",
-    "break",
-    "const",
-    "continue",
-    "else",
-    "false",
-    "for",
-    "function",
-    "if",
-    "import",
-    "in",
-    "let",
-    "loop",
-    "namespace",
-    "null",
-    "package",
-    "return",
-    "true",
-    "var",
-    "void",
-    "while",
-];
+// CEL keywords live in `identifier-name.ts` — a binding named after one is
+// unreachable for exactly the reason a resource or step named after one is, so
+// the list belongs to the identifier vocabulary rather than to this file.
 /** Locate a kind's bindings field and the scope names its annotated contexts
  *  declare. Returns undefined for a kind that declares no bindings region. */
 export function findBindingSites(definitionSchema) {

package/dist/definition-registry.d.ts

@@ -52,6 +52,23 @@ export declare class DefinitionRegistry {
      *  `$ref: "telo://<module>/<Name>"` would then silently validate against the
      *  kind's schema instead. The caller reports it; nothing is overwritten. */
     registerNamedTypeSchema(id: string, schema: Record<string, any>): boolean;
+    /**
+     * Register a schema, surviving one AJV refuses.
+     *
+     * `addSchema` META-VALIDATES and THROWS, and a throw here escapes the whole
+     * analyze pass: one author schema with `minimum: "3"` in it aborted the run
+     * with AJV's own unanchored text and took every other diagnostic in the file
+     * down with it — including the anchored one that says exactly which keyword is
+     * wrong. Registration is a lookup table for `$ref` resolution, so failing to
+     * fill one entry costs a reference that could not have resolved anyway.
+     *
+     * Nothing is swallowed: an unregisterable schema is invalid, and the two
+     * checks that report it both run afterwards and both anchor on the offending
+     * line — `SCHEMA_VIOLATION` from the `KindSchema` / `JsonSchema7` fragment the
+     * slot points at, and `SCHEMA_COMPILE_ERROR` from {@link schemaCompileError},
+     * which wraps `compile` for this same reason.
+     */
+    private tryAddSchema;
     /** True when a schema is registered under `id` (a canonical `telo://` type id
      *  or a definition `$id`). Used to flag schema `$ref`s that resolve to nothing. */
     hasSchemaId(id: string): boolean;

package/dist/definition-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"definition-registry.d.ts","sourceRoot":"","sources":["../src/definition-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAIlC,+EAA+E;AAC/E,qBAAa,kBAAkB;;IAK7B;;sFAEkF;IAClF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IACzD;;mFAE+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IAEzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyC;IAC9D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D;;;;wEAIoE;IACpE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IAEzD,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI;IAoC9C,OAAO,CAAC,aAAa;IASrB;;;;;;;;;;;;;2FAauF;IACvF,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAK1E;;;;;;;;;;gFAU4E;IAC5E,uBAAuB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO;IAQzE;uFACmF;IACnF,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAIhC;;;gEAG4D;IAC5D,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS;IAMxD;;;;oFAIgF;IAChF,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE;IAWtE;;;;;;iCAM6B;IAC7B,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,GAAG,SAAS;IASnE;;;;4EAIwE;IACxE,OAAO,CAAC,iBAAiB;IAkBzB;;;;;;;;;;;;;;4BAcwB;IACxB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAShD,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAIrD;;;uCAGmC;IACnC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAWxD,gGAAgG;IAChG,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,GACvD,iBAAiB,GAAG,SAAS;IAOhC;;;;;;;;qFAQiF;IACjF,2BAA2B,CACzB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC1C,iBAAiB,GAAG,SAAS;IAkChC,OAAO,CAAC,uBAAuB;IA+B/B;;qEAEiE;IACjE,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAgBxD,KAAK,IAAI,MAAM,EAAE;CAGlB"}
+{"version":3,"file":"definition-registry.d.ts","sourceRoot":"","sources":["../src/definition-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAIlC,+EAA+E;AAC/E,qBAAa,kBAAkB;;IAK7B;;sFAEkF;IAClF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IACzD;;mFAE+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IAEzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyC;IAC9D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D;;;;wEAIoE;IACpE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IAEzD,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI;IAoC9C,OAAO,CAAC,aAAa;IASrB;;;;;;;;;;;;;2FAauF;IACvF,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAK1E;;;;;;;;;;gFAU4E;IAC5E,uBAAuB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO;IAQzE;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,YAAY;IASpB;uFACmF;IACnF,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAIhC;;;gEAG4D;IAC5D,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS;IAMxD;;;;oFAIgF;IAChF,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE;IAWtE;;;;;;iCAM6B;IAC7B,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,GAAG,SAAS;IASnE;;;;4EAIwE;IACxE,OAAO,CAAC,iBAAiB;IAqBzB;;;;;;;;;;;;;;4BAcwB;IACxB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAShD,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAIrD;;;uCAGmC;IACnC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAWxD,gGAAgG;IAChG,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,GACvD,iBAAiB,GAAG,SAAS;IAOhC;;;;;;;;qFAQiF;IACjF,2BAA2B,CACzB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC1C,iBAAiB,GAAG,SAAS;IAkChC,OAAO,CAAC,uBAAuB;IA+B/B;;qEAEiE;IACjE,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAgBxD,KAAK,IAAI,MAAM,EAAE;CAGlB"}

package/dist/definition-registry.js

@@ -108,10 +108,36 @@ export class DefinitionRegistry {
             return false;
         if (this.registeredSchemaIds.has(id) || this.ajv.getSchema(id))
             return true;
-        this.ajv.addSchema(schema, id);
+        if (!this.tryAddSchema(schema, id))
+            return true;
         this.registeredSchemaIds.add(id);
         return true;
     }
+    /**
+     * Register a schema, surviving one AJV refuses.
+     *
+     * `addSchema` META-VALIDATES and THROWS, and a throw here escapes the whole
+     * analyze pass: one author schema with `minimum: "3"` in it aborted the run
+     * with AJV's own unanchored text and took every other diagnostic in the file
+     * down with it — including the anchored one that says exactly which keyword is
+     * wrong. Registration is a lookup table for `$ref` resolution, so failing to
+     * fill one entry costs a reference that could not have resolved anyway.
+     *
+     * Nothing is swallowed: an unregisterable schema is invalid, and the two
+     * checks that report it both run afterwards and both anchor on the offending
+     * line — `SCHEMA_VIOLATION` from the `KindSchema` / `JsonSchema7` fragment the
+     * slot points at, and `SCHEMA_COMPILE_ERROR` from {@link schemaCompileError},
+     * which wraps `compile` for this same reason.
+     */
+    tryAddSchema(schema, id) {
+        try {
+            this.ajv.addSchema(schema, id);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
     /** True when a schema is registered under `id` (a canonical `telo://` type id
      *  or a definition `$id`). Used to flag schema `$ref`s that resolve to nothing. */
     hasSchemaId(id) {
@@ -173,7 +199,10 @@ export class DefinitionRegistry {
         if (this.ajv.getSchema(id)) {
             throw new Error(`Duplicate definition schema $id: "${id}" is already registered`);
         }
-        this.ajv.addSchema(schema, id);
+        // A schema AJV refuses is left unregistered rather than aborting the pass —
+        // see {@link tryAddSchema}. The id stays claimed either way, so a later
+        // named type cannot quietly take a kind's place.
+        this.tryAddSchema(schema, id);
         this.registeredSchemaIds.add(id);
         this.definitionSchemaIds.add(id);
     }

package/dist/identifier-name.d.ts

@@ -0,0 +1,114 @@
+/**
+ * Naming rules for every author-written Telo identifier — resource instances,
+ * kinds, modules, import aliases, step names, config declarations and CEL
+ * bindings. The single reader, so no surface re-derives the vocabulary; the
+ * `ref-slot.ts` / `zone-slot.ts` precedent.
+ *
+ * **The rules exist because Telo has no lexer.** A name is a YAML scalar, so
+ * nothing rejects its shape where it is declared, and every consequence
+ * surfaces later at a CEL site that references it — or not at all. Probed
+ * against the engine the runtime actually uses (`@marcbachmann/cel-js`):
+ *
+ *     resources.my-server.url  →  EVALUATES, as `resources.my - server.url`
+ *     resources.in             →  ParseError: Expected IDENTIFIER, got IN
+ *     resources.2fa            →  ParseError
+ *     resources.for            →  parses fine
+ *
+ * The first line is the one that decides the design. When a bare name is in
+ * scope — which `x-telo-bindings-from` deliberately makes possible — a
+ * hyphenated resource name yields a wrong number with no diagnostic anywhere.
+ * That is a swallowed error in the reference grammar, not a style preference.
+ * The last line is why the reserved set here is the whole keyword list rather
+ * than the subset today's parser happens to reject in field position: which
+ * keywords tokenize there is a property of a dependency, and a name that
+ * breaks on a parser upgrade was never safe.
+ *
+ * **Three tiers, because they fail in three different ways.**
+ *
+ * 1. `INVALID_NAME` (error, every surface) — not a CEL-safe identifier, or a
+ *    CEL keyword. Below this line the name is unreferenceable or silently
+ *    mis-referenced. This subsumes the old dot-only rule, which was the
+ *    strictest special case of it: `!ref` splits on the first dot.
+ *
+ * 2. `INVALID_TYPE_NAME` (error) — a type-level name not starting uppercase.
+ *    An error rather than a warning because half the reference grammar already
+ *    rejects the alternative: `EXTENDS_ALIAS_PATTERN` in the kernel's manifest
+ *    schema hard-rejects `extends: foo.Bar`, while nothing rejects the
+ *    `metadata.name: foo` that produced it. A lowercase kind is a kind nobody
+ *    can extend, so this only moves an existing failure to where it is
+ *    fixable.
+ *
+ * 3. `NAME_CASE_CONVENTION` (warning) — a value-level name not starting
+ *    lowercase. Warn-only, Rust's `non_snake_case` posture: a name is
+ *    occasionally dictated from outside, and Telo has no `#[allow]`, so a hard
+ *    error would leave no escape.
+ *
+ * **The convention: case encodes what the name denotes.** PascalCase names a
+ * *type* — something writable in `kind:` / `extends:` / an `x-telo-ref` or type
+ * slot. camelCase names a *value* — something holding data at runtime, read
+ * through `resources.` / `steps.` / `variables.` in CEL. That is what
+ * distinguishes `kind: Console.WriteLine` from `!ref Console.writeLine`, two
+ * character-identical grammars otherwise, and the collision is not
+ * hypothetical: it is the sanctioned singleton pattern (declare
+ * `kind: Self.WriteLine`, export the instance, withhold the kind).
+ *
+ * **Only the first character is checked.** A full camelCase pattern would
+ * relitigate `httpApi` vs `httpAPI` and `OAuthClient` vs `OauthClient` with no
+ * benefit — the first character is what carries the type/value signal, and a
+ * stricter rule would fight legitimate names containing acronyms or digits
+ * while owning a judgement nobody asked this pass to make. An
+ * entirely-acronym type name (`SQL`, `AI`) passes unchanged.
+ *
+ * **No `DiagnosticFix`.** A fix is a whole-value replacement for ONE node,
+ * and a rename is only correct when every reference moves with it — offering
+ * one here would rewrite `metadata.name` and break every `!ref` and CEL read
+ * of it. Renaming belongs to a refactor that owns the reference graph.
+ *
+ * Browser-safe: pure string predicates, no I/O, no Node built-ins.
+ */
+import { DiagnosticSeverity } from "./types.js";
+/**
+ * CEL keywords. A name matching one is unreachable — `true` lexes as a
+ * literal, `in` as an operator — so it is reserved everywhere a name becomes a
+ * CEL identifier, which is every surface this file governs.
+ */
+export declare const CEL_RESERVED_WORDS: readonly string[];
+/**
+ * Which half of the convention a name falls under.
+ *
+ * `type` — a name writable in a `kind:` / `extends:` / type slot: a module, a
+ * kind, an import alias, or a resource whose capability is `Telo.Type` (a
+ * named shape has no runtime instance, so its name denotes a type even though
+ * it is declared as a resource).
+ *
+ * `value` — a name read through a CEL scope: a resource instance, a step, a
+ * `variables` / `secrets` / `ports` declaration, a CEL binding.
+ */
+export type NameLevel = "type" | "value";
+/** Document kinds whose `metadata.name` is type-level. Everything else
+ *  declaring a name is a resource instance, whose level is decided by its
+ *  kind's capability (see {@link NameLevel}). */
+export declare const TYPE_LEVEL_DOC_KINDS: ReadonlySet<string>;
+export interface NameViolation {
+    /** Which tier failed. Callers use it to suppress a tier another check
+     *  already reports better at that surface (the bindings site owns
+     *  `reserved`, where it can also say what is being shadowed). */
+    tier: "grammar" | "reserved" | "case";
+    code: "INVALID_NAME" | "INVALID_TYPE_NAME" | "NAME_CASE_CONVENTION";
+    severity: DiagnosticSeverity;
+    /** Complete sentence(s), subject included — so every surface words the same
+     *  rule the same way. */
+    message: string;
+}
+/**
+ * Check one author-written name.
+ *
+ * `surface` is the noun phrase naming what was declared ("resource name",
+ * "step name", "import alias"), used as the message's subject.
+ *
+ * Returns the first violation only: the tiers are ordered by how badly the
+ * name is broken, and telling an author their unparseable name is also
+ * miscased buries the part that matters.
+ */
+export declare function checkName(name: string, level: NameLevel, surface: string): NameViolation | undefined;
+//# sourceMappingURL=identifier-name.d.ts.map

package/dist/identifier-name.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identifier-name.d.ts","sourceRoot":"","sources":["../src/identifier-name.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAsB/C,CAAC;AAQF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAEzC;;iDAEiD;AACjD,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAMnD,CAAC;AAEH,MAAM,WAAW,aAAa;IAC5B;;qEAEiE;IACjE,IAAI,EAAE,SAAS,GAAG,UAAU,GAAG,MAAM,CAAC;IACtC,IAAI,EAAE,cAAc,GAAG,mBAAmB,GAAG,sBAAsB,CAAC;IACpE,QAAQ,EAAE,kBAAkB,CAAC;IAC7B;6BACyB;IACzB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CACvB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,MAAM,GACd,aAAa,GAAG,SAAS,CA6C3B"}