@telorun/analyzer 0.72.0 → 0.74.0

package/dist/validate-cel-context.js

@@ -1,7 +1,9 @@
 export { extractAccessChains, validateChainAgainstSchema } from "@telorun/templating";
 import { elementSchemaOf, isLiveSlot, mergeTypeSchemas, parseCanonicalTypeSchemaId, } from "@telorun/sdk";
 import { KERNEL_BUILTINS } from "./builtins.js";
+import { moduleAliasScope } from "./module-alias-scope.js";
 import { withRefSlotsAsReadings } from "./ref-slot-reading.js";
+import { dispatchTargetOf } from "./template-body.js";
 // Where CEL is evaluated is one reader (`eval-paths.ts`), and the region half of
 // it moved there so the scope walk and the `x-telo-eval` walk answer the same
 // question in one place. Re-exported: this module is where every existing
@@ -279,18 +281,20 @@ function collectionBindingWithheld(schema, manifestRoot, allManifests) {
  *   Example: `properties.self.x-telo-context-from-root: "schema"` reads
  *   `manifestRoot.schema` and uses it as the schema of the `self` CEL variable.
  *
- * - `x-telo-context-from-ref-kind`: reads a kind name from `manifestRoot.<refPath>`,
- *   resolves it via the definition registry, and returns that kind's `<field>` schema
- *   (e.g. `outputType`/`inputType`). Used to type `result` against the dispatch
- *   target's declared output shape.
+ * - `x-telo-context-from-ref-kind`: reads a KIND from `manifestRoot.<refPath>` —
+ *   a field holding a kind name, or a definition's dispatch slot holding a
+ *   `!ref` to a `resources:` entry (whose kind it is) — and returns the
+ *   `<field>` schema (e.g. `outputType`/`inputType`) the entry itself declares,
+ *   else the one the kind's definition declares. Used to type `result` against
+ *   the dispatch target's declared output shape.
  *
  *   Syntax: `<refPath>#<field>` — slashes traverse the manifest tree.
  *
- *   Example: `x-telo-context-from-ref-kind: "provide/kind#outputType"` reads
- *   `manifestRoot.provide.kind` as a kind name, looks up the kind's Telo.Definition,
- *   and returns the `outputType` schema.
+ *   Example: `x-telo-context-from-ref-kind: "provide#outputType"` resolves
+ *   `manifestRoot.provide` (`!ref source`) to the entry named `source`, and
+ *   returns its `outputType` schema, or its kind's.
  *
- *   Accepts either a single string or an array of strings. With an array, paths
+ *   Accepts either a single string or an array of strings. With an array, slots
  *   are tried in order and the first one that resolves to a usable schema wins —
  *   used by `result:` to find its dispatch target under whichever entry-point
  *   field (`provide:` or `invoke:`) the definition declares.
@@ -311,7 +315,7 @@ export function resolveContextAnnotations(schema, manifestItem, opts) {
     const normalizedOpts = Array.isArray(opts)
         ? { allManifests: opts }
         : (opts ?? {});
-    const { manifestRoot = manifestItem, defs, aliases, allManifests } = normalizedOpts;
+    const { manifestRoot = manifestItem, defs, aliases, aliasesByModule, allManifests } = normalizedOpts;
     const from = schema["x-telo-context-from"];
     if (from) {
         const navigated = navigatePath(manifestItem, from.split("/"));
@@ -391,28 +395,37 @@ export function resolveContextAnnotations(schema, manifestItem, opts) {
             }
         }
         if (defs) {
+            // The kind is read off THIS document, so it is spelled in the alias scope
+            // of the module that declared it — a library's dispatch target is written
+            // through an import the consumer has no reason to have.
+            const scope = moduleAliasScope(manifestRoot.metadata, aliases, aliasesByModule);
             for (const fromRefKind of fromRefKinds) {
                 const hashIdx = fromRefKind.indexOf("#");
                 if (hashIdx <= 0)
                     continue;
                 const refPath = fromRefKind.slice(0, hashIdx);
                 const field = fromRefKind.slice(hashIdx + 1);
-                const kindValue = navigatePath(manifestRoot, refPath.split("/"));
-                if (typeof kindValue !== "string" || kindValue.length === 0)
+                const target = kindAtPath(manifestRoot, refPath);
+                if (!target)
                     continue;
-                const canonical = aliases?.resolveKind(kindValue) ?? kindValue;
-                const def = defs.resolve(canonical);
-                const typeField = def
-                    ? def[field]
-                    : undefined;
+                // The entry's own field first — a per-instance narrowing (`outputType:`
+                // on the entry) is what the kernel binds — then the kind's.
+                const own = target.entry?.[field];
+                const ownResolved = own !== undefined ? resolveTypeFieldToSchema(own, allManifests ?? []) : undefined;
+                if (ownResolved && typeof ownResolved === "object")
+                    return ownResolved;
+                const canonical = scope?.resolveKind(target.kind) ?? target.kind;
+                const def = defs.resolve(canonical) ?? defs.resolve(target.kind);
+                const typeField = def ? def[field] : undefined;
                 const resolved = resolveTypeFieldToSchema(typeField, allManifests ?? []);
                 if (resolved && typeof resolved === "object") {
                     return resolved;
                 }
             }
         }
-        // Open fallback so unresolved types never produce false-positive CEL diagnostics.
-        return { type: "object", additionalProperties: true };
+        // Untyped (`dyn`) so an unresolved type never produces a false-positive CEL
+        // diagnostic; an open object would still type as `map` and refuse `acc + x`.
+        return {};
     }
     const refFrom = schema["x-telo-context-ref-from"];
     if (refFrom && allManifests) {
@@ -516,6 +529,26 @@ function navigatePath(obj, segments) {
     }
     return cur;
 }
+/** The kind an `x-telo-context-from-ref-kind` path names: a field holding a
+ *  kind NAME (`targetKind`), or a definition's dispatch slot holding a `!ref`
+ *  to a `resources:` entry, which carries the kind — and, where it narrows
+ *  one, the contract field itself. */
+export function kindAtPath(manifestRoot, refPath) {
+    const segments = refPath.split("/");
+    const value = navigatePath(manifestRoot, segments);
+    if (typeof value === "string")
+        return value.length > 0 ? { kind: value } : undefined;
+    // The dispatch-slot reading is a fact about ONE built-in document, not about
+    // the annotation: `resources:` is a `Telo.Definition`'s entry list. The
+    // annotation itself is generic vocabulary any kind may declare, and without
+    // this gate a third-party kind whose own `resources:` array means something
+    // else would have a slot silently resolved against it — a wrong answer with
+    // nothing reporting it, which is worse than no answer.
+    if (segments.length !== 1 || manifestRoot.kind !== "Telo.Definition")
+        return undefined;
+    const dispatch = dispatchTargetOf(manifestRoot, segments[0]);
+    return dispatch ? { kind: dispatch.kind, entry: dispatch.entry } : undefined;
+}
 /**
  * Walk a JSON Schema tree and collect all `x-telo-context` annotations,
  * returning them as `{ scope, schema }` pairs using JSONPath-style scopes —

package/dist/validate-exports.d.ts

@@ -0,0 +1,28 @@
+import type { ResourceManifest } from "@telorun/sdk";
+import type { AliasResolver } from "./alias-resolver.js";
+import type { DefinitionRegistry } from "./definition-registry.js";
+import { type AnalysisDiagnostic } from "./types.js";
+/**
+ * A LIBRARY'S EXPORT LIST IS CHECKED WHERE IT IS WRITTEN.
+ *
+ * `exports.kinds` and `exports.resources` are a library's public contract, and
+ * they were read as a GATE only: a listed name resolved when a consumer asked
+ * for it, and one that named nothing failed in the consumer's file
+ * (`UNDEFINED_KIND` on `kind: L.Client`, with nothing wrong in that file) while
+ * the author who could fix it saw a clean check. Both entries are resolved here,
+ * against what the library declares:
+ *
+ *  - a bare kind names a `Telo.Definition` / `Telo.Abstract` of this module, and
+ *    `Alias.Kind` re-exports through an import declared in this file
+ *    (`EXPORT_KIND_UNKNOWN`). The one mistake that reads as intended — a bare
+ *    name that IS a kind, of an imported module — gets the re-export spelling
+ *    in its message, because a clean check was read as confirmation it worked;
+ *  - a bare instance names a resource declared in this module, and
+ *    `Alias.name` an instance the aliased import exports
+ *    (`EXPORT_RESOURCE_UNKNOWN`).
+ *
+ * Runs on the library as an ENTRY — a consumer's flattened analysis drops the
+ * library doc, and the list is not the consumer's to fix. Browser-safe.
+ */
+export declare function validateExports(manifests: ResourceManifest[], registry: DefinitionRegistry, aliases: AliasResolver, rootModules: ReadonlySet<string>): AnalysisDiagnostic[];
+//# sourceMappingURL=validate-exports.d.ts.map

package/dist/validate-exports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-exports.d.ts","sourceRoot":"","sources":["../src/validate-exports.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,EACtB,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,GAC/B,kBAAkB,EAAE,CAoJtB"}

package/dist/validate-exports.js

@@ -0,0 +1,146 @@
+import { nearestName } from "./nearest-name.js";
+import { parseExportEntry } from "./flatten-for-analyzer.js";
+import { DiagnosticSeverity } from "./types.js";
+const SOURCE = "telo-analyzer";
+/**
+ * A LIBRARY'S EXPORT LIST IS CHECKED WHERE IT IS WRITTEN.
+ *
+ * `exports.kinds` and `exports.resources` are a library's public contract, and
+ * they were read as a GATE only: a listed name resolved when a consumer asked
+ * for it, and one that named nothing failed in the consumer's file
+ * (`UNDEFINED_KIND` on `kind: L.Client`, with nothing wrong in that file) while
+ * the author who could fix it saw a clean check. Both entries are resolved here,
+ * against what the library declares:
+ *
+ *  - a bare kind names a `Telo.Definition` / `Telo.Abstract` of this module, and
+ *    `Alias.Kind` re-exports through an import declared in this file
+ *    (`EXPORT_KIND_UNKNOWN`). The one mistake that reads as intended — a bare
+ *    name that IS a kind, of an imported module — gets the re-export spelling
+ *    in its message, because a clean check was read as confirmation it worked;
+ *  - a bare instance names a resource declared in this module, and
+ *    `Alias.name` an instance the aliased import exports
+ *    (`EXPORT_RESOURCE_UNKNOWN`).
+ *
+ * Runs on the library as an ENTRY — a consumer's flattened analysis drops the
+ * library doc, and the list is not the consumer's to fix. Browser-safe.
+ */
+export function validateExports(manifests, registry, aliases, rootModules) {
+    const out = [];
+    for (const lib of manifests) {
+        if (lib.kind !== "Telo.Library")
+            continue;
+        const moduleName = lib.metadata?.name;
+        if (!moduleName || !rootModules.has(moduleName))
+            continue;
+        const exports = lib.exports;
+        if (!exports || typeof exports !== "object")
+            continue;
+        const filePath = lib.metadata?.source;
+        const resource = { kind: lib.kind, name: moduleName };
+        const own = (m) => {
+            const mod = m.metadata?.module;
+            return mod === undefined || mod === moduleName;
+        };
+        const declaredKinds = new Set();
+        const instances = new Set();
+        const importAliases = new Map();
+        const forwardedByModule = new Map();
+        for (const m of manifests) {
+            const name = m.metadata?.name;
+            if (typeof name !== "string")
+                continue;
+            const meta = m.metadata;
+            if (meta.forwardedExport && meta.module) {
+                let set = forwardedByModule.get(meta.module);
+                if (!set)
+                    forwardedByModule.set(meta.module, (set = new Set()));
+                set.add(name);
+                continue;
+            }
+            if (!own(m))
+                continue;
+            if (m.kind === "Telo.Definition" || m.kind === "Telo.Abstract")
+                declaredKinds.add(name);
+            else if (m.kind === "Telo.Import")
+                importAliases.set(name, meta.resolvedModuleName);
+            else if (m.kind !== "Telo.Library" && m.kind !== "Telo.Application")
+                instances.add(name);
+        }
+        const report = (code, path, message, fix) => out.push({
+            severity: DiagnosticSeverity.Error,
+            code,
+            source: SOURCE,
+            message: `Telo.Library/${moduleName}: ${message}`,
+            data: { resource, filePath, path, ...(fix ? { fix: { replacement: fix } } : {}) },
+        });
+        const kinds = exports.kinds;
+        if (Array.isArray(kinds)) {
+            kinds.forEach((entry, i) => {
+                if (typeof entry !== "string")
+                    return;
+                const path = `exports.kinds[${i}]`;
+                const { alias, name } = parseExportEntry(entry);
+                if (alias) {
+                    if (!importAliases.has(alias)) {
+                        report("EXPORT_KIND_UNKNOWN", path, `'exports.kinds: ${entry}' re-exports through '${alias}', which is not an import ` +
+                            `of this library. Imports: ${[...importAliases.keys()].join(", ") || "(none)"}.`);
+                        return;
+                    }
+                    const canonical = aliases.resolveKind(entry);
+                    if (canonical && !registry.resolve(canonical)) {
+                        report("EXPORT_KIND_UNKNOWN", path, `'exports.kinds: ${entry}' names no kind '${name}' exported by '${alias}'.`);
+                    }
+                    return;
+                }
+                if (declaredKinds.has(name))
+                    return;
+                // The natural first attempt at a re-export: the imported kind's bare
+                // suffix. It resolves as a kind — just not as one this library owns.
+                const viaImport = [...importAliases.keys()].find((a) => {
+                    const canonical = aliases.resolveKind(`${a}.${name}`);
+                    return canonical !== undefined && registry.resolve(canonical) !== undefined;
+                });
+                if (viaImport) {
+                    report("EXPORT_KIND_UNKNOWN", path, `'exports.kinds: ${name}' is not a kind this library declares — it is ` +
+                        `'${viaImport}.${name}', an imported kind. Re-export it as '${viaImport}.${name}', ` +
+                        `or declare a local kind that extends it.`, `${viaImport}.${name}`);
+                    return;
+                }
+                const suggestion = nearestName(name, [...declaredKinds]);
+                report("EXPORT_KIND_UNKNOWN", path, `'exports.kinds: ${name}' names no Telo.Definition or Telo.Abstract of this library. ` +
+                    `Declared: ${[...declaredKinds].join(", ") || "(none)"}.` +
+                    (suggestion ? ` Did you mean '${suggestion}'?` : ""), suggestion);
+            });
+        }
+        const resources = exports.resources;
+        if (Array.isArray(resources)) {
+            resources.forEach((entry, i) => {
+                if (typeof entry !== "string")
+                    return;
+                const path = `exports.resources[${i}]`;
+                const { alias, name } = parseExportEntry(entry);
+                if (alias) {
+                    if (!importAliases.has(alias)) {
+                        report("EXPORT_RESOURCE_UNKNOWN", path, `'exports.resources: ${entry}' re-exports through '${alias}', which is not an ` +
+                            `import of this library. Imports: ${[...importAliases.keys()].join(", ") || "(none)"}.`);
+                        return;
+                    }
+                    const targetModule = importAliases.get(alias);
+                    const exported = targetModule ? forwardedByModule.get(targetModule) : undefined;
+                    if (exported && !exported.has(name)) {
+                        report("EXPORT_RESOURCE_UNKNOWN", path, `'exports.resources: ${entry}' names no instance '${name}' exported by '${alias}'. ` +
+                            `Exported: ${[...exported].join(", ") || "(none)"}.`);
+                    }
+                    return;
+                }
+                if (instances.has(name))
+                    return;
+                const suggestion = nearestName(name, [...instances]);
+                report("EXPORT_RESOURCE_UNKNOWN", path, `'exports.resources: ${name}' names no resource declared in this library. ` +
+                    `Declared: ${[...instances].join(", ") || "(none)"}.` +
+                    (suggestion ? ` Did you mean '${suggestion}'?` : ""), suggestion);
+            });
+        }
+    }
+    return out;
+}

package/dist/validate-extends.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-extends.d.ts","sourceRoot":"","sources":["../src/validate-extends.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAQnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAiCzE,wBAAgB,eAAe,CAC7B,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,GACrB,kBAAkB,EAAE,CAqMtB"}
+{"version":3,"file":"validate-extends.d.ts","sourceRoot":"","sources":["../src/validate-extends.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AASnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAiCzE,wBAAgB,eAAe,CAC7B,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,GACrB,kBAAkB,EAAE,CA2OtB"}

package/dist/validate-extends.js

@@ -1,4 +1,4 @@
-import { controllerBearingAncestor, effectiveAuthorSchema, inheritedCapability, isInheritedDelegation, } from "./extends-resolution.js";
+import { controllerBearingAncestor, effectiveAuthorSchema, hasOwnControllerOrTemplate, inheritedCapability, isInheritedDelegation, } from "./extends-resolution.js";
 import { DiagnosticSeverity } from "./types.js";
 const SOURCE = "telo-analyzer";
 /** Alias-form pattern for `extends`: "<Alias>.<AbstractName>", two PascalCase segments. */
@@ -59,6 +59,39 @@ export function validateExtends(manifests, registry, aliases) {
         const filePath = m.metadata?.source;
         const resource = { kind: m.kind, name };
         const label = `${m.kind}/${name}`;
+        // `base:` is read on exactly one path — the inherited-controller one, which
+        // the kernel takes only when the definition has NO body of its own. A
+        // `resources:` block or a dispatch slot selects the template path, and
+        // `base:` is then never evaluated: the kind silently became an empty
+        // template, and the failure landed in the CONSUMER's resource as a `{}`
+        // where a parent instance should have been. Refused here, where the two
+        // blocks sit side by side, and at registration in the kernel.
+        //
+        // WHETHER there is a body is `hasOwnControllerOrTemplate` — the same
+        // predicate the kernel branches on, so the two halves cannot disagree about
+        // what a body is. Deciding it here with a key scan did disagree: an empty
+        // `resources: []` is falsy to a length test and truthy to the kernel's, so
+        // it passed `telo check` and threw `ERR_BASE_WITH_TEMPLATE_BODY` at boot —
+        // a brand-new guard shipping with the very gap it was written to close. The
+        // scan survives for one job only: naming the offending key in the message.
+        if (m.base != null) {
+            const hasBody = hasOwnControllerOrTemplate(m);
+            const bodyKey = ["resources", "controllers", "invoke", "run", "provide", "mount"].find((key) => m[key] !== undefined) ?? "resources";
+            if (hasBody) {
+                diagnostics.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: "BASE_WITH_TEMPLATE_BODY",
+                    source: SOURCE,
+                    message: `${label}: 'base:' maps this kind's config onto the inherited controller of ` +
+                        `'${typeof extendsOf(m) === "string" ? extendsOf(m) : "<no extends>"}', so the ` +
+                        `definition may not also declare '${bodyKey}:'. With '${bodyKey}:' the kind is a ` +
+                        `template and 'base:' is never evaluated. Either drop 'base:' and dispatch to a ` +
+                        `'resources:' entry with '!ref', or drop '${bodyKey}:' and build the parent's config ` +
+                        `in 'base:' alone.`,
+                    data: { resource, filePath, path: bodyKey },
+                });
+            }
+        }
         // --- extends validation ---
         // At this point `m.extends` is whatever the manifest declared (alias form, e.g.
         // "Ai.Model"). Resolve through the AliasResolver to the canonical form before
@@ -219,3 +252,6 @@ export function validateExtends(manifests, registry, aliases) {
     }
     return diagnostics;
 }
+function extendsOf(m) {
+    return m.extends;
+}

package/dist/validate-module-artifact.d.ts

@@ -14,10 +14,12 @@ import { type AnalysisDiagnostic } from "./types.js";
  * selector (spec §1), which is what every module with two `js` controllers relies
  * on.
  *
- * 1. **Controller selector qualifiers.** `os` / `arch` / `libc` / `siblings` are
+ * 1. **Controller selector qualifiers.** The platform axes and `siblings` are
  *    authored surface. An unknown qualifier is reported rather than ignored, since
  *    ignoring is what makes a typo invisible; an invalid value is reported here
- *    instead of throwing from the loader later.
+ *    instead of throwing from the loader later, and so is a combination no host
+ *    can match (`selectorContradictions`, shared with `native:` and
+ *    `exports.code:`).
  * 2. **The published layer index.** The owner doc's JSON Schema covers shape; the
  *    semantic rules — controller-requires-selector, singletons carry none, no
  *    duplicate selector, the token grammar (`os: Linux` passes the schema and

package/dist/validate-module-artifact.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-module-artifact.d.ts","sourceRoot":"","sources":["../src/validate-module-artifact.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAUrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,gBAAgB,EAAE,GAAG,kBAAkB,EAAE,CAQ1F"}
+{"version":3,"file":"validate-module-artifact.d.ts","sourceRoot":"","sources":["../src/validate-module-artifact.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAWrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,gBAAgB,EAAE,GAAG,kBAAkB,EAAE,CAQ1F"}

package/dist/validate-module-artifact.js

@@ -1,5 +1,5 @@
 import { parseLayerIndex, LayerIndexError } from "./artifact-layer-index.js";
-import { ArtifactSelectorError, PLATFORM_AXES, selectorFromQualifiers, selectorKey, } from "./artifact-selector.js";
+import { ArtifactSelectorError, PLATFORM_AXES, selectorContradictions, selectorFromQualifiers, selectorKey, } from "./artifact-selector.js";
 import { readLibraryCandidates } from "./module-library.js";
 import { DiagnosticSeverity } from "./types.js";
 const SOURCE = "telo-analyzer";
@@ -17,10 +17,12 @@ const SOURCE = "telo-analyzer";
  * selector (spec §1), which is what every module with two `js` controllers relies
  * on.
  *
- * 1. **Controller selector qualifiers.** `os` / `arch` / `libc` / `siblings` are
+ * 1. **Controller selector qualifiers.** The platform axes and `siblings` are
  *    authored surface. An unknown qualifier is reported rather than ignored, since
  *    ignoring is what makes a typo invisible; an invalid value is reported here
- *    instead of throwing from the loader later.
+ *    instead of throwing from the loader later, and so is a combination no host
+ *    can match (`selectorContradictions`, shared with `native:` and
+ *    `exports.code:`).
  * 2. **The published layer index.** The owner doc's JSON Schema covers shape; the
  *    semantic rules — controller-requires-selector, singletons carry none, no
  *    duplicate selector, the token grammar (`os: Linux` passes the schema and
@@ -68,6 +70,15 @@ function validateLibraryCandidates(manifest, out) {
     // mean a consumer's import resolves by whichever candidate is read first.
     const seen = new Map();
     for (const candidate of candidates) {
+        for (const contradiction of selectorContradictions(candidate.selector)) {
+            out.push({
+                severity: DiagnosticSeverity.Error,
+                code: `LIBRARY_${contradiction.rule}`,
+                source: SOURCE,
+                message: `Telo.Library/${metadata?.name ?? "(unnamed)"}: ${candidate.origin}: ${contradiction.detail}`,
+                data: { resource, filePath: metadata?.source, path: "exports/code" },
+            });
+        }
         const key = selectorKey(candidate.selector);
         const first = seen.get(key);
         if (first) {
@@ -143,7 +154,35 @@ function validateControllerSelectors(manifest, out) {
         // Validate the selector; the value is not otherwise needed here, since
         // candidates sharing a selector legitimately share a layer.
         try {
-            selectorFromQualifiers(parsed.format, parsed.qualifiers, candidate);
+            const selector = selectorFromQualifiers(parsed.format, parsed.qualifiers, candidate);
+            for (const contradiction of selectorContradictions(selector)) {
+                out.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: `CONTROLLER_${contradiction.rule}`,
+                    source: SOURCE,
+                    message: `${manifest.kind}/${name ?? "(unnamed)"}: controller candidate "${candidate}": ` +
+                        contradiction.detail,
+                    data: { resource, filePath, path: `${at}?${contradiction.axis}` },
+                });
+            }
+            // A `dylib` opens over the Rust controller ABI, and a library built
+            // against another version of it must never match — so the candidate states
+            // which, in the `telo` family.
+            if (parsed.format === "dylib" && !selector.abi?.startsWith("telo-")) {
+                out.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: "CONTROLLER_DYLIB_ABI_MISSING",
+                    source: SOURCE,
+                    message: `${manifest.kind}/${name ?? "(unnamed)"}: dylib candidate "${candidate}" ` +
+                        (selector.abi === undefined
+                            ? `states no abi. `
+                            : `states abi=${selector.abi}, which is not a Rust controller ABI. `) +
+                        `A dylib is built against one version of the Rust controller ABI and must say which — ` +
+                        `add abi=telo-<version>, e.g. abi=telo-2. Without it the Rust kernel downloads the ` +
+                        `library on every host and refuses it only when it opens it.`,
+                    data: { resource, filePath, path: at },
+                });
+            }
         }
         catch (err) {
             if (!(err instanceof ArtifactSelectorError))

package/dist/validate-native-entries.d.ts

@@ -0,0 +1,15 @@
+import type { ResourceManifest } from "@telorun/sdk";
+import { type AnalysisDiagnostic } from "./types.js";
+/**
+ * The strict half of `native-entries.ts`: what `telo check` reports about a
+ * module doc's `native:` block.
+ *
+ * Every rule is decidable from the manifest and would otherwise surface only on
+ * a consumer's host, as a native file that never matches or a layer that
+ * overwrites another's file. Shape errors (a missing key, an unknown one) are
+ * left to the owner doc's JSON Schema, which reports them in the same pass.
+ *
+ * Entry-module-scoped: a dependency's block is not the consumer's to fix.
+ */
+export declare function validateNativeEntries(manifests: ResourceManifest[], entryModules?: ReadonlySet<string>): AnalysisDiagnostic[];
+//# sourceMappingURL=validate-native-entries.d.ts.map

package/dist/validate-native-entries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-native-entries.d.ts","sourceRoot":"","sources":["../src/validate-native-entries.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAMrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GACjC,kBAAkB,EAAE,CA0HtB"}

package/dist/validate-native-entries.js

@@ -0,0 +1,103 @@
+import { describeSelector, selectorContradictions, selectorKey } from "./artifact-selector.js";
+import { moduleDocumentClaims } from "./module-file-claims.js";
+import { describeClaim, nativeClaimConflicts } from "./module-named-files.js";
+import { readNativeEntries } from "./native-entries.js";
+import { DiagnosticSeverity } from "./types.js";
+const SOURCE = "telo-analyzer";
+/**
+ * The strict half of `native-entries.ts`: what `telo check` reports about a
+ * module doc's `native:` block.
+ *
+ * Every rule is decidable from the manifest and would otherwise surface only on
+ * a consumer's host, as a native file that never matches or a layer that
+ * overwrites another's file. Shape errors (a missing key, an unknown one) are
+ * left to the owner doc's JSON Schema, which reports them in the same pass.
+ *
+ * Entry-module-scoped: a dependency's block is not the consumer's to fix.
+ */
+export function validateNativeEntries(manifests, entryModules) {
+    const out = [];
+    for (const manifest of manifests) {
+        if (manifest.kind !== "Telo.Application" && manifest.kind !== "Telo.Library")
+            continue;
+        const metadata = (manifest.metadata ?? {});
+        const name = typeof metadata.name === "string" ? metadata.name : undefined;
+        const owned = entryModules === undefined ||
+            (typeof metadata.module === "string"
+                ? entryModules.has(metadata.module)
+                : name === undefined || entryModules.has(name));
+        if (!owned)
+            continue;
+        const label = `${manifest.kind}/${name ?? "(unnamed)"}`;
+        const report = (code, path, message) => out.push({
+            severity: DiagnosticSeverity.Error,
+            code,
+            source: SOURCE,
+            message: `${label}: ${message}`,
+            data: {
+                resource: { kind: manifest.kind, name },
+                filePath: typeof metadata.source === "string" ? metadata.source : undefined,
+                path,
+            },
+        });
+        const { entries, problems } = readNativeEntries(manifest);
+        for (const problem of problems) {
+            if (problem.kind === "shape")
+                continue;
+            report(problem.kind === "escape" ? "NATIVE_PATH_ESCAPES_MODULE" : "NATIVE_ENTRY_INVALID", problem.path, problem.message);
+        }
+        if (entries.length === 0)
+            continue;
+        const moduleName = typeof metadata.module === "string" ? metadata.module : name;
+        for (const { entry, claim } of nativeClaimConflicts(entries, moduleDocumentClaims(manifests, moduleName))) {
+            report("NATIVE_PATH_CLAIMED", `native[${entry.index}].path`, `${entry.origin}: path '${entry.path}' is also named by ${describeClaim(claim)}. A native ` +
+                `file ships only in its platform's native layer and a file extracts from exactly one ` +
+                `layer, so publish refuses it — give the native entry its own file, or drop the other ` +
+                `declaration.`);
+        }
+        const bySelector = new Map();
+        const byPath = new Map();
+        for (const entry of entries) {
+            const at = `native[${entry.index}]`;
+            if (entry.selector.format === "node" && entry.selector.abi === undefined) {
+                report("NATIVE_NODE_ABI_MISSING", at, `${entry.origin}: a 'node' addon is built against one Node ABI and must state it — ` +
+                    `add abi: node-<NODE_MODULE_VERSION>, e.g. 'node-137'. Without it the file matches ` +
+                    `every Node release and fails to load on all but one.`);
+            }
+            for (const contradiction of selectorContradictions(entry.selector)) {
+                report(`NATIVE_${contradiction.rule}`, `${at}.${contradiction.axis}`, `${entry.origin}: ${contradiction.detail}`);
+            }
+            const key = `${entry.name}\0${selectorKey(entry.selector)}`;
+            const twin = bySelector.get(key);
+            if (twin) {
+                report("NATIVE_ENTRY_DUPLICATE", at, `${entry.origin}: ${twin.origin} already declares '${entry.name}' for ` +
+                    `${describeSelector(entry.selector)}. A name has one entry per platform tuple, or ` +
+                    `a lookup by name could resolve to either file.`);
+            }
+            else {
+                bySelector.set(key, entry);
+            }
+            const sharer = byPath.get(entry.path);
+            if (sharer && selectorKey(sharer.selector) !== selectorKey(entry.selector)) {
+                report("NATIVE_PATH_SHARED", `${at}.path`, `${entry.origin}: path '${entry.path}' is also declared by ${sharer.origin} for ` +
+                    `${describeSelector(sharer.selector)}. Every layer of a module extracts into one ` +
+                    `directory, so each platform tuple needs its own path — e.g. ` +
+                    `'native/<os>-<arch>/…'.`);
+            }
+            else if (!sharer) {
+                byPath.set(entry.path, entry);
+            }
+            const through = [...byPath.values()].find((other) => other !== entry &&
+                (entry.path.startsWith(`${other.path}/`) || other.path.startsWith(`${entry.path}/`)));
+            if (through) {
+                const relation = entry.path.startsWith(`${through.path}/`)
+                    ? `runs through '${through.path}' as a directory`
+                    : `is a directory that '${through.path}' runs through`;
+                report("NATIVE_PATH_NESTED", `${at}.path`, `${entry.origin}: path '${entry.path}' ${relation}, and ${through.origin} declares ` +
+                    `'${through.path}'. Every layer of a module extracts into one directory, so a path ` +
+                    `cannot be both a file and a directory — give each entry its own path.`);
+            }
+        }
+    }
+    return out;
+}

package/dist/validate-observed-state.d.ts

@@ -70,12 +70,18 @@ export declare function observedStateRead(chain: readonly string[]): ObservedSta
 export declare function collectRunReachableNames(graph: CallGraph): Set<string>;
 /** What a resource name resolves to for CEL purposes. `status` is present only
  *  when the kind declares one; `scoped` marks a resource declared inside an
- *  `x-telo-scope` slot, which resolves only within that scope's regions. */
+ *  `x-telo-scope` slot, which resolves only within that scope's regions.
+ *  `forwardedFrom` marks a dependency's declaration, keyed by
+ *  `forwardedResourceKey`: it is in no consumer's `resources`, but a read inside
+ *  that dependency's own manifests still resolves to it. */
 export interface AnalyzedResource {
     kind: string;
     status?: Record<string, any>;
     scoped?: boolean;
+    forwardedFrom?: string;
 }
+/** The index key of a name a dependency declares, as read from inside it. */
+export declare function forwardedResourceKey(module: string, name: string): string;
 /**
  * Index every resource a CEL `resources.…` read can name: the module's own
  * top-level resources, the ones declared inside `x-telo-scope` slots (a

package/dist/validate-observed-state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-observed-state.d.ts","sourceRoot":"","sources":["../src/validate-observed-state.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIzE,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAgBjD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,qBAAqB;;;CAGjC,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAC/C,SAAS,EAAE,SAAS,gBAAgB,EAAE,GACrC,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAmB3E;AAED,6DAA6D;AAC7D,MAAM,WAAW,iBAAiB;IAChC;+CAC2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,iBAAiB,GAAG,SAAS,CAOzF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,CAQtE;AAGD;;4EAE4E;AAC5E,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,SAAS,gBAAgB,EAAE,EACtC,IAAI,EAAE;IAAE,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAA;CAAE,EAC/D,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAAC,cAAc,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;CAAE,EAC/G,MAAM,CAAC,EAAE,YAAY,GACpB,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAsC/B;AAyDD;;;gDAGgD;AAChD,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC5C,IAAI,EAAE,OAAO,GACZ,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CASrB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC1B,IAAI,CAmBN"}
+{"version":3,"file":"validate-observed-state.d.ts","sourceRoot":"","sources":["../src/validate-observed-state.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAgBjD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,qBAAqB;;;CAGjC,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAC/C,SAAS,EAAE,SAAS,gBAAgB,EAAE,GACrC,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAmB3E;AAED,6DAA6D;AAC7D,MAAM,WAAW,iBAAiB;IAChC;+CAC2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,iBAAiB,GAAG,SAAS,CAOzF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,CAQtE;AAGD;;;;;4DAK4D;AAC5D,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,SAAS,gBAAgB,EAAE,EACtC,IAAI,EAAE;IAAE,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAA;CAAE,EAC/D,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAAC,cAAc,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;CAAE,EAC/G,MAAM,CAAC,EAAE,YAAY,GACpB,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAyD/B;AAyDD;;;gDAGgD;AAChD,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC5C,IAAI,EAAE,OAAO,GACZ,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CASrB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC1B,IAAI,CAmBN"}