@telorun/analyzer 0.72.0 → 0.74.0

package/dist/validate-throws-coverage.js

@@ -1,11 +1,11 @@
 import { isTaggedSentinel } from "@telorun/templating";
 import { AMBIENT_CONTRACT_ERROR_CODES, isAmbientContractErrorCode, } from "@telorun/sdk";
 import { scopeResolverForModule } from "./alias-resolver.js";
-import { createResolveCtx, resolveScopeUnion, resolveThrowsUnion, } from "./resolve-throws-union.js";
+import { createResolveCtx, handsFailureBack, resolveScopeUnion, resolveThrowsUnion, throwsUses, } from "./resolve-throws-union.js";
+import { forEachDeclaredSlot } from "./schema-walk.js";
 import { buildEnclosers, collectScopedManifests, enclosingCoverage, } from "./catch-scope.js";
 import { DiagnosticSeverity } from "./types.js";
 import { extractAccessChains, validateChainAgainstSchema } from "./validate-cel-context.js";
-import { isStepSlot } from "./step-slot.js";
 const SOURCE = "telo-analyzer";
 const TEMPLATE_REGEX = /\$\{\{\s*([^}]+?)\s*\}\}/g;
 /** Walk `definition.schema` and `data` in tandem, invoking `onOutcome` each
@@ -401,12 +401,6 @@ function checkCelChainAgainstDataSchema(entry, dataSchema, resource, filePath, e
     }
     return diagnostics;
 }
-/** Rule 8 extension: `inherit: true` only makes sense on a definition whose
- *  schema declares at least one STEP BODY — an array whose items point at the
- *  shared grammar, or, for a module published before that fragment existed, one
- *  carrying the legacy `x-telo-step-context` annotation. That is what drives the
- *  resolver's generic step traversal; a definition with `inherit: true` and no
- *  such array has no invocables to inherit from. */
 /** The capabilities whose lifecycle includes a dispatch a caller can catch. On
  *  every other one a thrown error is a boot-time failure, not a structured
  *  runtime error for a downstream caller — a provider resolves configuration, a
@@ -466,10 +460,14 @@ function validateThrowsDeclarations(manifests) {
                     severity: DiagnosticSeverity.Error,
                     code: "INHERIT_WITHOUT_STEP_CONTEXT",
                     source: SOURCE,
-                    message: `Telo.Definition '${name}' declares throws.inherit: true but its schema declares no step ` +
-                        `body. inherit is only meaningful on a definition that drives invocables through steps — ` +
-                        `give an array field 'items: { $ref: "telo://manifest#/$defs/Step" }' (the legacy ` +
-                        `x-telo-step-context annotation is also recognised).`,
+                    message: `Telo.Definition '${name}' declares throws.inherit: true but its schema dispatches nothing ` +
+                        `a failure can come back through. inherit makes the kind's union the union of what it ` +
+                        `dispatches, so the schema needs a step body (an array field with ` +
+                        `'items: { $ref: "telo://manifest#/$defs/Step" }', or the legacy x-telo-step-context ` +
+                        `annotation) or a reference slot whose use includes 'call' or 'trigger.consumer' ` +
+                        `(for a use case map, in any case; a slot declaring no use counts as 'call'). ` +
+                        `'detached' and 'trigger.inbound' run where no caller awaits them, and ` +
+                        `'dependency' / 'schema' dispatch nothing.`,
                     data: { resource: { kind: m.kind, name }, filePath, path: "throws.inherit" },
                 });
             }
@@ -477,35 +475,19 @@ function validateThrowsDeclarations(manifests) {
     }
     return diagnostics;
 }
+/** Rule 8 extension: `inherit: true` needs something to inherit from — a step
+ *  body, or a reference slot whose use (any case of a case map) hands a failure
+ *  back. The schema-only mode of the walk the resolver runs per instance, so the
+ *  check and the union reach the same slots. */
 function schemaDrivesInvocables(schema) {
-    if (!schema || typeof schema !== "object")
-        return false;
-    if (isStepSlot(schema))
-        return true;
-    const props = schema.properties;
-    if (props && typeof props === "object") {
-        for (const v of Object.values(props)) {
-            if (schemaDrivesInvocables(v))
-                return true;
-        }
-    }
-    if (schema.items && schemaDrivesInvocables(schema.items))
-        return true;
-    for (const key of ["oneOf", "anyOf", "allOf"]) {
-        const arr = schema[key];
-        if (Array.isArray(arr)) {
-            for (const sub of arr)
-                if (schemaDrivesInvocables(sub))
-                    return true;
+    let drives = false;
+    forEachDeclaredSlot(schema, (declared) => {
+        if (declared.kind === "step" ||
+            declared.slots.some((slot) => throwsUses(slot).some(handsFailureBack))) {
+            drives = true;
         }
-    }
-    if (schema.$defs && typeof schema.$defs === "object") {
-        for (const v of Object.values(schema.$defs)) {
-            if (schemaDrivesInvocables(v))
-                return true;
-        }
-    }
-    return false;
+    });
+    return drives;
 }
 /** Entry point — invoked once per analyze() run. */
 export function validateThrowsCoverage(manifests, defs, aliases, env, aliasesByModule = new Map(), rootModules = new Set(), 

package/dist/value-type-keyword.d.ts

@@ -29,6 +29,20 @@ import type { KeywordDefinition } from "ajv";
  * `x-telo-type` is deliberately absent — it is the one that emits code.
  */
 export declare const ANNOTATION_KEYWORDS: readonly ["x-telo-bindings-from", "x-telo-catches-for", "x-telo-context", "x-telo-context-collection-from", "x-telo-context-element-from", "x-telo-context-from", "x-telo-context-from-ref-kind", "x-telo-context-from-root", "x-telo-context-ref-from", "x-telo-error-context", "x-telo-eval", "x-telo-inline", "x-telo-outcome-list", "x-telo-provides-zone", "x-telo-ref", "x-telo-requires-zone", "x-telo-resource-rules", "x-telo-schema-from", "x-telo-schema-map", "x-telo-schema-projection", "x-telo-schema-projection-from", "x-telo-scope", "x-telo-sensitive", "x-telo-step-context", "x-telo-topology-role", "x-telo-value-schema-from", "x-telo-widget"];
+/** How an AJV instance treats a `live` value type. */
+export interface TeloKeywordOptions {
+    /**
+     * Assert a `live` type as an instance too, so a literal at such a slot is
+     * refused — a value written in a manifest can never be a live instance.
+     *
+     * STATIC analysis only, where a CEL leaf's stand-in is an instance
+     * (`celPlaceholderForSchema`). The kernel's instances leave it off: at
+     * dispatch a live value is exempt from validation, and the stage that pulls
+     * from it refuses a non-stream itself — so the static half refuses a strict
+     * subset of what the runtime refuses, and the two cannot disagree.
+     */
+    readonly assertLive?: boolean;
+}
 /**
  * The `x-telo-type` keyword.
  *
@@ -37,8 +51,10 @@ export declare const ANNOTATION_KEYWORDS: readonly ["x-telo-bindings-from", "x-t
  *  - a `json` representation validates through its own declared schema, so the
  *    keyword emits nothing — the name carries nominal identity for static wiring
  *    and has no runtime existence at all;
- *  - a `live` instance is EXEMPT: its value is never traversed, because iterating
- *    a stream to check it is precisely what the exemption is for;
+ *  - a `live` instance is EXEMPT at dispatch: its value is never traversed,
+ *    because iterating a stream to check it is precisely what the exemption is
+ *    for. Statically ({@link TeloKeywordOptions.assertLive}) it is asserted like
+ *    any other instance, which checks what the value IS and never iterates it;
  *  - every other instance is ASSERTED against the constructor its binding names.
  *
  * An unknown name emits nothing here. It is a hard diagnostic in the analyzer
@@ -46,15 +62,16 @@ export declare const ANNOTATION_KEYWORDS: readonly ["x-telo-bindings-from", "x-t
  * manifest that wrote it; failing compilation instead would take out every
  * validator in a module for one typo in one slot.
  */
-export declare function valueTypeKeyword(): KeywordDefinition;
+export declare function valueTypeKeyword(options?: TeloKeywordOptions): KeywordDefinition;
 /**
  * Register every Telo keyword on an AJV instance: the annotations as no-ops and
  * `x-telo-type` as the one that checks.
  *
  * Every AJV instance in the runtime and the analyzer goes through this, so a
- * schema means the same thing wherever it is validated.
+ * schema means the same thing wherever it is validated — apart from the one
+ * posture {@link TeloKeywordOptions} names, which only static analysis takes.
  */
 export declare function registerTeloKeywords(ajv: {
     addKeyword: (keyword: any, definition?: any) => unknown;
-}): void;
+}, options?: TeloKeywordOptions): void;
 //# sourceMappingURL=value-type-keyword.d.ts.map

package/dist/value-type-keyword.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"value-type-keyword.d.ts","sourceRoot":"","sources":["../src/value-type-keyword.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;+EAqB+E;AAG/E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,KAAK,CAAC;AAiB7C;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,woBA4BtB,CAAC;AAEX;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,IAAI,iBAAiB,CA+BpD;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE;IACxC,UAAU,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC;CACzD,GAAG,IAAI,CAGP"}
+{"version":3,"file":"value-type-keyword.d.ts","sourceRoot":"","sources":["../src/value-type-keyword.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;+EAqB+E;AAG/E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,KAAK,CAAC;AAiB7C;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,woBA4BtB,CAAC;AAEX,sDAAsD;AACtD,MAAM,WAAW,kBAAkB;IACjC;;;;;;;;;OASG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,kBAAuB,GAAG,iBAAiB,CAsCpF;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE;IAAE,UAAU,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,GAAG,KAAK,OAAO,CAAA;CAAE,EAChE,OAAO,GAAE,kBAAuB,GAC/B,IAAI,CAGN"}

package/dist/value-type-keyword.js

@@ -68,8 +68,10 @@ export const ANNOTATION_KEYWORDS = [
  *  - a `json` representation validates through its own declared schema, so the
  *    keyword emits nothing — the name carries nominal identity for static wiring
  *    and has no runtime existence at all;
- *  - a `live` instance is EXEMPT: its value is never traversed, because iterating
- *    a stream to check it is precisely what the exemption is for;
+ *  - a `live` instance is EXEMPT at dispatch: its value is never traversed,
+ *    because iterating a stream to check it is precisely what the exemption is
+ *    for. Statically ({@link TeloKeywordOptions.assertLive}) it is asserted like
+ *    any other instance, which checks what the value IS and never iterates it;
  *  - every other instance is ASSERTED against the constructor its binding names.
  *
  * An unknown name emits nothing here. It is a hard diagnostic in the analyzer
@@ -77,7 +79,7 @@ export const ANNOTATION_KEYWORDS = [
  * manifest that wrote it; failing compilation instead would take out every
  * validator in a module for one typo in one slot.
  */
-export function valueTypeKeyword() {
+export function valueTypeKeyword(options = {}) {
     return {
         keyword: X_TELO_TYPE,
         // Both spellings: a bare name, or the object form carrying type arguments.
@@ -86,7 +88,9 @@ export function valueTypeKeyword() {
             const entry = readValueTypeSlot({
                 [X_TELO_TYPE]: cxt.schema,
             })?.entry;
-            if (!entry || entry.representation !== "instance" || entry.live)
+            if (!entry || entry.representation !== "instance")
+                return;
+            if (entry.live && !options.assertLive)
                 return;
             const binding = VALUE_TYPE_BINDINGS[entry.binding];
             if (!binding)
@@ -104,6 +108,10 @@ export function valueTypeKeyword() {
         error: {
             message: (cxt) => {
                 const entry = readValueTypeSlot({ [X_TELO_TYPE]: cxt.schema })?.entry;
+                if (entry?.live) {
+                    return (`must be a live ${entry.name} — a value written in the manifest can never be one; ` +
+                        "pass the result of a step that produces it, with a !cel expression");
+                }
                 return entry?.binding === "bytes"
                     ? "must be raw bytes (a Uint8Array) — bytes cannot be written inline in a manifest"
                     : `must be a ${entry?.name ?? "declared value type"} — this value is not writable inline in a manifest`;
@@ -116,10 +124,11 @@ export function valueTypeKeyword() {
  * `x-telo-type` as the one that checks.
  *
  * Every AJV instance in the runtime and the analyzer goes through this, so a
- * schema means the same thing wherever it is validated.
+ * schema means the same thing wherever it is validated — apart from the one
+ * posture {@link TeloKeywordOptions} names, which only static analysis takes.
  */
-export function registerTeloKeywords(ajv) {
+export function registerTeloKeywords(ajv, options = {}) {
     for (const keyword of ANNOTATION_KEYWORDS)
         ajv.addKeyword(keyword);
-    ajv.addKeyword(valueTypeKeyword());
+    ajv.addKeyword(valueTypeKeyword(options));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.72.0",
+  "version": "0.74.0",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",
@@ -43,13 +43,14 @@
     "jsonpath-plus": "^10.3.0",
     "packageurl-js": "^2.0.1",
     "yaml": "^2.8.3",
-    "@telorun/templating": "0.19.0"
+    "@telorun/templating": "0.20.1"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",
     "typescript": "^5.0.0",
     "vitest": "^2.1.8",
-    "@telorun/sdk": "0.87.0"
+    "@telorun/glob": "0.3.0",
+    "@telorun/sdk": "0.90.0"
   },
   "peerDependencies": {
     "@telorun/sdk": "*"

package/src/analyzer.ts

@@ -25,7 +25,13 @@ import {
 } from "./cel-environment.js";
 import { DefinitionRegistry } from "./definition-registry.js";
 import { readDeprecation } from "./deprecation.js";
-import { type ContractDirection, effectiveAuthorSchema } from "./extends-resolution.js";
+import {
+  type ContractDirection,
+  type DefResolver,
+  effectiveAuthorSchema,
+  inheritedCapability,
+  inheritedRequiredFields,
+} from "./extends-resolution.js";
 import {
   analyzerContractScope,
   type ContractScope,
@@ -43,6 +49,7 @@ import {
   buildObservedStateIndex,
   buildObservedStateResourcesSchema,
   collectRunReachableNames,
+  forwardedResourceKey,
   observedStateRead,
   validateObservedStateDeclarations,
 } from "./validate-observed-state.js";
@@ -142,6 +149,7 @@ import {
 import {
   celEvalModeAt,
   celEvalSites,
+  implicitEvalSites,
   mergeCelEvalSites,
   NO_CEL_EVAL_SITES,
   type CelEvalSites,
@@ -160,6 +168,8 @@ import { validateIdentifierNames } from "./validate-identifier-names.js";
 import { validateExtends } from "./validate-extends.js";
 import { validateLogging } from "./validate-logging.js";
 import { validateModuleArtifact } from "./validate-module-artifact.js";
+import { validateNativeEntries } from "./validate-native-entries.js";
+import { validateSourceEntries } from "./validate-source-entries.js";
 import { validateIncludePlacement } from "./validate-include-placement.js";
 import { validateModuleMetadata } from "./validate-module-metadata.js";
 import { validateRequires } from "./validate-requires.js";
@@ -172,8 +182,11 @@ import { kindSatisfies, validateReferences } from "./validate-references.js";
 import { validateReferenceForms } from "./validate-reference-forms.js";
 import { isInjectedDeclaration } from "./resource-input.js";
 import { validateResourceInputs } from "./validate-resource-inputs.js";
-import { validateTemplateDispatch } from "./validate-template-dispatch.js";
+import { validateExports } from "./validate-exports.js";
+import { validateTemplateBody } from "./validate-template-body.js";
 import { validateUnusedDeclarations } from "./validate-unused-declarations.js";
+import { validateScopedNameReach } from "./validate-scope-reach.js";
+import { isForwardedDeclaration } from "./forwarded-declaration.js";
 import { validateThrowsCoverage } from "./validate-throws-coverage.js";
 import { readStepSlot } from "./step-slot.js";
 
@@ -398,9 +411,9 @@ function validateStepInvokeReferences(
       if (typeof m === "string") loadedModules.add(m);
       continue;
     }
-    const meta = r.metadata as { name?: unknown; module?: unknown; forwardedExport?: unknown };
+    const meta = r.metadata as { name?: unknown; module?: unknown };
     if (typeof meta?.name !== "string" || REF_VALIDATION_SKIP_KINDS.has(r.kind)) continue;
-    if (meta.forwardedExport === true) {
+    if (isForwardedDeclaration(r)) {
       if (typeof meta.module === "string") loadedModules.add(meta.module);
       continue;
     }
@@ -468,11 +481,11 @@ function validateStepInvokeReferences(
   };
 
   for (const m of allManifests) {
-    const meta = m.metadata as { name?: unknown; source?: unknown; forwardedExport?: unknown };
+    const meta = m.metadata as { name?: unknown; source?: unknown };
     if (
       typeof meta?.name !== "string" ||
       REF_VALIDATION_SKIP_KINDS.has(m.kind) ||
-      meta.forwardedExport === true
+      isForwardedDeclaration(m)
     )
       continue;
     const def = defs.resolve(aliases.resolveKind(m.kind) ?? m.kind);
@@ -1526,6 +1539,11 @@ export class StaticAnalyzer {
       // would otherwise fail on a consumer's machine — or, for a mistyped platform
       // axis, silently offer one platform's binary to every host.
       diagnostics.push(...validateModuleArtifact(allManifests));
+      // The module doc's `native:` block: each rule decides whether a platform's
+      // file can ever match a host, or whether two layers would write one path.
+      diagnostics.push(...validateNativeEntries(allManifests, rootModules));
+      // The module doc's `sources:` block: where each staged file comes from.
+      diagnostics.push(...validateSourceEntries(allManifests, rootModules));
       // The descriptive `metadata:` surface. Nothing in the kernel branches on
       // these fields, which is precisely why they need a check: a mistyped one
       // has no runtime failure mode that would ever surface it.
@@ -1807,9 +1825,7 @@ export class StaticAnalyzer {
       // `kind`/CEL are authored in that module's scope (e.g. `Self.X` → that module, not the
       // consumer). Re-validating against the consumer's scope yields false UNDEFINED_KIND /
       // scope-mismatch errors, so skip — they participate here only as resolution targets.
-      if ((m.metadata as { forwardedExport?: boolean } | undefined)?.forwardedExport === true) {
-        continue;
-      }
+      if (isForwardedDeclaration(m)) continue;
 
       // A kind-only stand-in for a `resources:` entry is a DECLARATION, not an
       // instantiation: its kind is routinely an abstract and its configuration
@@ -2029,12 +2045,41 @@ export class StaticAnalyzer {
           allManifests as Record<string, any>[],
         );
         const issues = [...ajvIssues, ...valueSchemaIssues];
+        // WHY A FIELD THIS KIND EXISTS TO SUPPLY IS STILL REQUIRED OF ITS
+        // CONSUMER. A child that `extends` and declares no `base:` is authored
+        // against merge(parent, own), so the parent's `required` stays on the
+        // CHILD's surface — and a kind written to wire that field internally
+        // then demands it from the consumer anyway. The `base:` mapping is what
+        // narrows (with it the surface is the child's own schema alone), and
+        // nothing in "is missing required property" points there, which is what
+        // turns one mistake into a three-step dead end.
+        //
+        // Matched against names DERIVED from the parent, never by parsing the
+        // message: which fields are inherited is a fact about the definition,
+        // and a check that reads a validator's prose breaks when the prose does.
+        const inheritedRequired = inheritedRequiredFields(definition, (k) =>
+          defs.resolve(aliases.resolveKind(k) ?? k) ?? defs.resolve(k),
+        );
+        const parentKind = (definition as { extends?: string } | undefined)?.extends;
         for (const issue of issues) {
+          // Keyed on the STRUCTURED failure, never on the sentence: the field
+          // names are derived from the parent, and matching them against the
+          // validator's prose would break when the prose changes and mis-fire on
+          // any other issue quoting the same name (an `additionalProperties`
+          // rejection, an `enum` listing).
+          const inherited =
+            issue.keyword === "required" && issue.missingProperty !== undefined
+              ? inheritedRequired.filter((f) => f === issue.missingProperty)
+              : [];
+          const hint =
+            inherited.length > 0 && parentKind
+              ? ` — ${inherited.map((f) => `'${f}'`).join(", ")} ${inherited.length > 1 ? "come" : "comes"} from '${parentKind}', which this kind extends without a 'base:' mapping, so the parent's required fields stay on this kind's author surface. Add 'base:' to set them internally; that also narrows the surface to this kind's own schema.`
+              : "";
           diagnostics.push({
             severity: DiagnosticSeverity.Error,
             code: "SCHEMA_VIOLATION",
             source: SOURCE,
-            message: `${m.kind}/${resource.name}: ${issue.message}`,
+            message: `${m.kind}/${resource.name}: ${issue.message}${hint}`,
             data: { resource, filePath, path: issue.path },
           });
         }
@@ -2472,8 +2517,15 @@ export class StaticAnalyzer {
 
           // The non-eval-field check only applies to runtime resource instances:
           // structural / templating kinds (capability `Telo.Template`, or no
-          // definition) carry CEL the kernel evaluates by other rules.
-          const capability = e.definition?.capability;
+          // definition) carry CEL the kernel evaluates by other rules. The
+          // capability is INHERITED along `extends` — an inheritance kind
+          // writes none of its own — and reading the declared one left the
+          // rule off for every such kind, and its expressions untyped.
+          const resolveDef: DefResolver = (k) =>
+            defs.resolve(aliases.resolveKind(k) ?? k) ?? defs.resolve(k);
+          const capability = e.definition
+            ? inheritedCapability(e.definition as unknown as ResourceDefinition, resolveDef)
+            : undefined;
           celRuleApplies =
             !!e.definition?.schema && capability !== undefined && capability !== "Telo.Template";
           if (celRuleApplies) {
@@ -2487,15 +2539,18 @@ export class StaticAnalyzer {
             // disagreeing about what the manifest means.
             const ownSchema = effectiveAuthorSchema(
               e.definition as unknown as ResourceDefinition,
-              (k) => defs.resolve(aliases.resolveKind(k) ?? k) ?? defs.resolve(k),
+              resolveDef,
             ) as Record<string, any>;
             const capabilityDef = capability ? defs.resolve(capability) : undefined;
             // A `Telo.Provider`'s fields are implicitly compile-eval — the
             // capability abstract carries the root annotation — so its reads are
-            // covered here without the provider restating anything.
+            // covered here without the provider restating anything. A base-form
+            // child's own fields are too (`implicitEvalSites`): `base:` reads
+            // them once at create().
             celSites = mergeCelEvalSites(
               celEvalSites(ownSchema),
               celEvalSites(capabilityDef?.schema as Record<string, any> | undefined),
+              implicitEvalSites(e.definition as { base?: unknown }),
             );
           } else {
             celSites = NO_CEL_EVAL_SITES;
@@ -2539,9 +2594,17 @@ export class StaticAnalyzer {
               if (!read) continue;
               // An import's exported instance is indexed under `<Alias>.<name>`,
               // the two-level shape it publishes under, so a cross-module read
-              // is checked exactly like a local one.
+              // is checked exactly like a local one. A bare name read inside a
+              // dependency's own manifest names that dependency's resource.
+              const readerModule = isForwardedDeclaration(m)
+                ? (m.metadata?.module as string | undefined)
+                : undefined;
               const reported = observedState.get(
-                read.alias ? `${read.alias}.${read.name}` : read.name,
+                read.alias
+                  ? `${read.alias}.${read.name}`
+                  : readerModule !== undefined
+                    ? forwardedResourceKey(readerModule, read.name)
+                    : read.name,
               );
 
               if (celRuleApplies && celEvalModeAt(celSites, path) === "compile") {
@@ -2801,10 +2864,16 @@ export class StaticAnalyzer {
     // Warn about declared variables / secrets / ports that no CEL references.
     diagnostics.push(...validateUnusedDeclarations(allManifests, this.celEnv));
 
-    // A `!ref` at a definition's dispatch slot must name a sibling `resources:`
-    // entry — the slot no reference pass reaches, so the tag would otherwise
-    // advertise a resolution nothing performs.
-    diagnostics.push(...validateTemplateDispatch(allManifests, rootModules));
+    // A template body's reference surface — its entry names, its dispatch slots
+    // and the ref slots inside each entry — which no reference pass reaches,
+    // since a `Telo.Definition` is in both skip sets.
+    diagnostics.push(
+      ...validateTemplateBody(allManifests, defs, aliases, aliasesByModule, rootModules),
+    );
+
+    // A library's export list, resolved against what it declares — otherwise a
+    // listed name that exists nowhere fails in the consumer's file.
+    diagnostics.push(...validateExports(allManifests, defs, aliases, rootModules));
 
     // A library's declared resource inputs, and every import that supplies them.
     diagnostics.push(
@@ -2818,6 +2887,14 @@ export class StaticAnalyzer {
       ),
     );
 
+    // An inline declaration referencing a name declared by a scope it was
+    // written inside but is created outside of.
+    diagnostics.push(
+      ...validateScopedNameReach(allManifests, defs, aliases, aliasesByModule, rootModules, (expr) =>
+        celAccessChains(this.celEnv, expr),
+      ),
+    );
+
     // Reroute diagnostics on synthetic (inline-extracted) resources back to
     // the chain root so position-index lookups land on the parent doc.
     return rewriteSyntheticOrigins(

package/src/artifact-axes.ts

@@ -0,0 +1,24 @@
+// GENERATED by scripts/generate-artifact-axes.mjs from analyzer/artifact-axes/axes.json — do not edit.
+
+/** The selector platform axes, in canonical order. Closed as a set of axis
+ *  names; the set of values stays open. */
+export const PLATFORM_AXES = ["os", "arch", "libc", "abi"] as const;
+
+export type PlatformAxis = (typeof PLATFORM_AXES)[number];
+
+/** A form an axis value must take beyond the shared token grammar. */
+export interface AxisValueForm {
+  readonly pattern: RegExp;
+  /** The form as a reader writes it, e.g. `<family>-<version>`. */
+  readonly form: string;
+  readonly examples: readonly string[];
+}
+
+/** The axes whose values carry a form of their own. */
+export const AXIS_VALUE_FORMS: Readonly<Partial<Record<PlatformAxis, AxisValueForm>>> = {
+  abi: {
+    pattern: new RegExp("^[a-z][a-z0-9_]*-[0-9]+(\\.[0-9]+)*$"),
+    form: "<family>-<version>",
+    examples: ["node-137", "telo-2"],
+  },
+};

package/src/artifact-layer-index.ts

@@ -29,7 +29,6 @@
  */
 
 import {
-  LAYER_ROLES,
   isLayerRole,
   normalizeSelector,
   roleCarriesSelector,
@@ -48,7 +47,7 @@ const CONTENT_DIGEST = /^sha256-[A-Za-z0-9_-]{43}$/;
 
 export interface ArtifactLayer {
   role: LayerRole;
-  /** Present on the code-bearing roles (`controller`, `library`) only. */
+  /** Present on the selector-keyed roles (`controller`, `library`, `native`) only. */
   selector?: ArtifactSelector;
   /** OCI blob digest — addresses the layer and verifies the transfer. */
   blob: string;
@@ -101,10 +100,12 @@ export function parseLayerIndex(value: unknown, describe = "layers"): ArtifactLa
     const entry = raw as Record<string, unknown>;
     if (typeof entry.role !== "string" || entry.role === "") {
       throw new LayerIndexError(
-        `${where}: role is required and must be one of ${LAYER_ROLES.map((r) => `'${r}'`).join(", ")}; ` +
+        `${where}: role is required and must be a non-empty string; ` +
           `got ${entry.role === undefined ? "nothing" : `'${String(entry.role)}'`}.`,
       );
     }
+    const blob = digest("blob", entry.blob, where);
+    const integrity = digest("integrity", entry.integrity, where);
     // A role this runtime does not know is SKIPPED, never rejected. Roles are
     // added over time, and a runtime that cannot name one cannot need it — while
     // throwing would make the whole manifest unreadable, so a module gaining a
@@ -120,6 +121,8 @@ export function parseLayerIndex(value: unknown, describe = "layers"): ArtifactLa
         throw new LayerIndexError(`${where}: a ${role} layer must declare a selector.`);
       }
       selector = normalizeSelector(entry.selector, where);
+      // An unknown axis skips the entry as an unknown role does (spec §3.1).
+      if (selector === undefined) return;
       // Scoped by role: a module's `js` controller layer and its `js` library
       // layer are different layers with the same selector, and only a collision
       // *within* one role means two layers claim one address.
@@ -146,8 +149,8 @@ export function parseLayerIndex(value: unknown, describe = "layers"): ArtifactLa
     layers.push({
       role,
       ...(selector ? { selector } : {}),
-      blob: digest("blob", entry.blob, where),
-      integrity: digest("integrity", entry.integrity, where),
+      blob,
+      integrity,
     });
   });
 
@@ -157,7 +160,7 @@ export function parseLayerIndex(value: unknown, describe = "layers"): ArtifactLa
 /** The singleton layer for a role, or undefined when the artifact has none. */
 export function singletonLayer(
   layers: readonly ArtifactLayer[],
-  role: Exclude<LayerRole, "controller" | "library">,
+  role: Exclude<LayerRole, "controller" | "library" | "native">,
 ): ArtifactLayer | undefined {
   return layers.find((l) => l.role === role);
 }