@telorun/analyzer 0.73.0 → 0.74.0

package/dist/validate-module-artifact.js

@@ -1,5 +1,5 @@
 import { parseLayerIndex, LayerIndexError } from "./artifact-layer-index.js";
-import { ArtifactSelectorError, PLATFORM_AXES, selectorFromQualifiers, selectorKey, } from "./artifact-selector.js";
+import { ArtifactSelectorError, PLATFORM_AXES, selectorContradictions, selectorFromQualifiers, selectorKey, } from "./artifact-selector.js";
 import { readLibraryCandidates } from "./module-library.js";
 import { DiagnosticSeverity } from "./types.js";
 const SOURCE = "telo-analyzer";
@@ -17,10 +17,12 @@ const SOURCE = "telo-analyzer";
  * selector (spec §1), which is what every module with two `js` controllers relies
  * on.
  *
- * 1. **Controller selector qualifiers.** `os` / `arch` / `libc` / `siblings` are
+ * 1. **Controller selector qualifiers.** The platform axes and `siblings` are
  *    authored surface. An unknown qualifier is reported rather than ignored, since
  *    ignoring is what makes a typo invisible; an invalid value is reported here
- *    instead of throwing from the loader later.
+ *    instead of throwing from the loader later, and so is a combination no host
+ *    can match (`selectorContradictions`, shared with `native:` and
+ *    `exports.code:`).
  * 2. **The published layer index.** The owner doc's JSON Schema covers shape; the
  *    semantic rules — controller-requires-selector, singletons carry none, no
  *    duplicate selector, the token grammar (`os: Linux` passes the schema and
@@ -68,6 +70,15 @@ function validateLibraryCandidates(manifest, out) {
     // mean a consumer's import resolves by whichever candidate is read first.
     const seen = new Map();
     for (const candidate of candidates) {
+        for (const contradiction of selectorContradictions(candidate.selector)) {
+            out.push({
+                severity: DiagnosticSeverity.Error,
+                code: `LIBRARY_${contradiction.rule}`,
+                source: SOURCE,
+                message: `Telo.Library/${metadata?.name ?? "(unnamed)"}: ${candidate.origin}: ${contradiction.detail}`,
+                data: { resource, filePath: metadata?.source, path: "exports/code" },
+            });
+        }
         const key = selectorKey(candidate.selector);
         const first = seen.get(key);
         if (first) {
@@ -143,7 +154,35 @@ function validateControllerSelectors(manifest, out) {
         // Validate the selector; the value is not otherwise needed here, since
         // candidates sharing a selector legitimately share a layer.
         try {
-            selectorFromQualifiers(parsed.format, parsed.qualifiers, candidate);
+            const selector = selectorFromQualifiers(parsed.format, parsed.qualifiers, candidate);
+            for (const contradiction of selectorContradictions(selector)) {
+                out.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: `CONTROLLER_${contradiction.rule}`,
+                    source: SOURCE,
+                    message: `${manifest.kind}/${name ?? "(unnamed)"}: controller candidate "${candidate}": ` +
+                        contradiction.detail,
+                    data: { resource, filePath, path: `${at}?${contradiction.axis}` },
+                });
+            }
+            // A `dylib` opens over the Rust controller ABI, and a library built
+            // against another version of it must never match — so the candidate states
+            // which, in the `telo` family.
+            if (parsed.format === "dylib" && !selector.abi?.startsWith("telo-")) {
+                out.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: "CONTROLLER_DYLIB_ABI_MISSING",
+                    source: SOURCE,
+                    message: `${manifest.kind}/${name ?? "(unnamed)"}: dylib candidate "${candidate}" ` +
+                        (selector.abi === undefined
+                            ? `states no abi. `
+                            : `states abi=${selector.abi}, which is not a Rust controller ABI. `) +
+                        `A dylib is built against one version of the Rust controller ABI and must say which — ` +
+                        `add abi=telo-<version>, e.g. abi=telo-2. Without it the Rust kernel downloads the ` +
+                        `library on every host and refuses it only when it opens it.`,
+                    data: { resource, filePath, path: at },
+                });
+            }
         }
         catch (err) {
             if (!(err instanceof ArtifactSelectorError))

package/dist/validate-native-entries.d.ts

@@ -0,0 +1,15 @@
+import type { ResourceManifest } from "@telorun/sdk";
+import { type AnalysisDiagnostic } from "./types.js";
+/**
+ * The strict half of `native-entries.ts`: what `telo check` reports about a
+ * module doc's `native:` block.
+ *
+ * Every rule is decidable from the manifest and would otherwise surface only on
+ * a consumer's host, as a native file that never matches or a layer that
+ * overwrites another's file. Shape errors (a missing key, an unknown one) are
+ * left to the owner doc's JSON Schema, which reports them in the same pass.
+ *
+ * Entry-module-scoped: a dependency's block is not the consumer's to fix.
+ */
+export declare function validateNativeEntries(manifests: ResourceManifest[], entryModules?: ReadonlySet<string>): AnalysisDiagnostic[];
+//# sourceMappingURL=validate-native-entries.d.ts.map

package/dist/validate-native-entries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-native-entries.d.ts","sourceRoot":"","sources":["../src/validate-native-entries.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAMrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GACjC,kBAAkB,EAAE,CA0HtB"}

package/dist/validate-native-entries.js

@@ -0,0 +1,103 @@
+import { describeSelector, selectorContradictions, selectorKey } from "./artifact-selector.js";
+import { moduleDocumentClaims } from "./module-file-claims.js";
+import { describeClaim, nativeClaimConflicts } from "./module-named-files.js";
+import { readNativeEntries } from "./native-entries.js";
+import { DiagnosticSeverity } from "./types.js";
+const SOURCE = "telo-analyzer";
+/**
+ * The strict half of `native-entries.ts`: what `telo check` reports about a
+ * module doc's `native:` block.
+ *
+ * Every rule is decidable from the manifest and would otherwise surface only on
+ * a consumer's host, as a native file that never matches or a layer that
+ * overwrites another's file. Shape errors (a missing key, an unknown one) are
+ * left to the owner doc's JSON Schema, which reports them in the same pass.
+ *
+ * Entry-module-scoped: a dependency's block is not the consumer's to fix.
+ */
+export function validateNativeEntries(manifests, entryModules) {
+    const out = [];
+    for (const manifest of manifests) {
+        if (manifest.kind !== "Telo.Application" && manifest.kind !== "Telo.Library")
+            continue;
+        const metadata = (manifest.metadata ?? {});
+        const name = typeof metadata.name === "string" ? metadata.name : undefined;
+        const owned = entryModules === undefined ||
+            (typeof metadata.module === "string"
+                ? entryModules.has(metadata.module)
+                : name === undefined || entryModules.has(name));
+        if (!owned)
+            continue;
+        const label = `${manifest.kind}/${name ?? "(unnamed)"}`;
+        const report = (code, path, message) => out.push({
+            severity: DiagnosticSeverity.Error,
+            code,
+            source: SOURCE,
+            message: `${label}: ${message}`,
+            data: {
+                resource: { kind: manifest.kind, name },
+                filePath: typeof metadata.source === "string" ? metadata.source : undefined,
+                path,
+            },
+        });
+        const { entries, problems } = readNativeEntries(manifest);
+        for (const problem of problems) {
+            if (problem.kind === "shape")
+                continue;
+            report(problem.kind === "escape" ? "NATIVE_PATH_ESCAPES_MODULE" : "NATIVE_ENTRY_INVALID", problem.path, problem.message);
+        }
+        if (entries.length === 0)
+            continue;
+        const moduleName = typeof metadata.module === "string" ? metadata.module : name;
+        for (const { entry, claim } of nativeClaimConflicts(entries, moduleDocumentClaims(manifests, moduleName))) {
+            report("NATIVE_PATH_CLAIMED", `native[${entry.index}].path`, `${entry.origin}: path '${entry.path}' is also named by ${describeClaim(claim)}. A native ` +
+                `file ships only in its platform's native layer and a file extracts from exactly one ` +
+                `layer, so publish refuses it — give the native entry its own file, or drop the other ` +
+                `declaration.`);
+        }
+        const bySelector = new Map();
+        const byPath = new Map();
+        for (const entry of entries) {
+            const at = `native[${entry.index}]`;
+            if (entry.selector.format === "node" && entry.selector.abi === undefined) {
+                report("NATIVE_NODE_ABI_MISSING", at, `${entry.origin}: a 'node' addon is built against one Node ABI and must state it — ` +
+                    `add abi: node-<NODE_MODULE_VERSION>, e.g. 'node-137'. Without it the file matches ` +
+                    `every Node release and fails to load on all but one.`);
+            }
+            for (const contradiction of selectorContradictions(entry.selector)) {
+                report(`NATIVE_${contradiction.rule}`, `${at}.${contradiction.axis}`, `${entry.origin}: ${contradiction.detail}`);
+            }
+            const key = `${entry.name}\0${selectorKey(entry.selector)}`;
+            const twin = bySelector.get(key);
+            if (twin) {
+                report("NATIVE_ENTRY_DUPLICATE", at, `${entry.origin}: ${twin.origin} already declares '${entry.name}' for ` +
+                    `${describeSelector(entry.selector)}. A name has one entry per platform tuple, or ` +
+                    `a lookup by name could resolve to either file.`);
+            }
+            else {
+                bySelector.set(key, entry);
+            }
+            const sharer = byPath.get(entry.path);
+            if (sharer && selectorKey(sharer.selector) !== selectorKey(entry.selector)) {
+                report("NATIVE_PATH_SHARED", `${at}.path`, `${entry.origin}: path '${entry.path}' is also declared by ${sharer.origin} for ` +
+                    `${describeSelector(sharer.selector)}. Every layer of a module extracts into one ` +
+                    `directory, so each platform tuple needs its own path — e.g. ` +
+                    `'native/<os>-<arch>/…'.`);
+            }
+            else if (!sharer) {
+                byPath.set(entry.path, entry);
+            }
+            const through = [...byPath.values()].find((other) => other !== entry &&
+                (entry.path.startsWith(`${other.path}/`) || other.path.startsWith(`${entry.path}/`)));
+            if (through) {
+                const relation = entry.path.startsWith(`${through.path}/`)
+                    ? `runs through '${through.path}' as a directory`
+                    : `is a directory that '${through.path}' runs through`;
+                report("NATIVE_PATH_NESTED", `${at}.path`, `${entry.origin}: path '${entry.path}' ${relation}, and ${through.origin} declares ` +
+                    `'${through.path}'. Every layer of a module extracts into one directory, so a path ` +
+                    `cannot be both a file and a directory — give each entry its own path.`);
+            }
+        }
+    }
+    return out;
+}

package/dist/validate-observed-state.d.ts

@@ -70,12 +70,18 @@ export declare function observedStateRead(chain: readonly string[]): ObservedSta
 export declare function collectRunReachableNames(graph: CallGraph): Set<string>;
 /** What a resource name resolves to for CEL purposes. `status` is present only
  *  when the kind declares one; `scoped` marks a resource declared inside an
- *  `x-telo-scope` slot, which resolves only within that scope's regions. */
+ *  `x-telo-scope` slot, which resolves only within that scope's regions.
+ *  `forwardedFrom` marks a dependency's declaration, keyed by
+ *  `forwardedResourceKey`: it is in no consumer's `resources`, but a read inside
+ *  that dependency's own manifests still resolves to it. */
 export interface AnalyzedResource {
     kind: string;
     status?: Record<string, any>;
     scoped?: boolean;
+    forwardedFrom?: string;
 }
+/** The index key of a name a dependency declares, as read from inside it. */
+export declare function forwardedResourceKey(module: string, name: string): string;
 /**
  * Index every resource a CEL `resources.…` read can name: the module's own
  * top-level resources, the ones declared inside `x-telo-scope` slots (a

package/dist/validate-observed-state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-observed-state.d.ts","sourceRoot":"","sources":["../src/validate-observed-state.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIzE,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAgBjD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,qBAAqB;;;CAGjC,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAC/C,SAAS,EAAE,SAAS,gBAAgB,EAAE,GACrC,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAmB3E;AAED,6DAA6D;AAC7D,MAAM,WAAW,iBAAiB;IAChC;+CAC2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,iBAAiB,GAAG,SAAS,CAOzF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,CAQtE;AAGD;;4EAE4E;AAC5E,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,SAAS,gBAAgB,EAAE,EACtC,IAAI,EAAE;IAAE,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAA;CAAE,EAC/D,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAAC,cAAc,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;CAAE,EAC/G,MAAM,CAAC,EAAE,YAAY,GACpB,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAsC/B;AAyDD;;;gDAGgD;AAChD,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC5C,IAAI,EAAE,OAAO,GACZ,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CASrB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC1B,IAAI,CAmBN"}
+{"version":3,"file":"validate-observed-state.d.ts","sourceRoot":"","sources":["../src/validate-observed-state.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAgBjD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,qBAAqB;;;CAGjC,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAC/C,SAAS,EAAE,SAAS,gBAAgB,EAAE,GACrC,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAmB3E;AAED,6DAA6D;AAC7D,MAAM,WAAW,iBAAiB;IAChC;+CAC2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,iBAAiB,GAAG,SAAS,CAOzF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,CAQtE;AAGD;;;;;4DAK4D;AAC5D,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,SAAS,gBAAgB,EAAE,EACtC,IAAI,EAAE;IAAE,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAA;CAAE,EAC/D,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAAC,cAAc,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;CAAE,EAC/G,MAAM,CAAC,EAAE,YAAY,GACpB,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAyD/B;AAyDD;;;gDAGgD;AAChD,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC5C,IAAI,EAAE,OAAO,GACZ,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CASrB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC1B,IAAI,CAmBN"}

package/dist/validate-observed-state.js

@@ -1,5 +1,6 @@
 import { OBSERVED_STATE_KEY } from "@telorun/sdk";
 import { effectiveStatusSchema } from "./extends-resolution.js";
+import { isForwardedDeclaration } from "./forwarded-declaration.js";
 import { parseExportEntry } from "./flatten-for-analyzer.js";
 import { moduleScopedDefResolver, } from "./alias-resolver.js";
 import { buildReferenceFieldMap, isScopeEntry, resolveFieldValues, } from "./reference-field-map.js";
@@ -100,6 +101,10 @@ export function collectRunReachableNames(graph) {
         names.add(edge.toName);
     return names;
 }
+/** The index key of a name a dependency declares, as read from inside it. */
+export function forwardedResourceKey(module, name) {
+    return `${module}\0${name}`;
+}
 /**
  * Index every resource a CEL `resources.…` read can name: the module's own
  * top-level resources, the ones declared inside `x-telo-scope` slots (a
@@ -115,17 +120,30 @@ export function buildObservedStateIndex(manifests, defs, aliases, scopes) {
     /** `module` is the resource's DECLARING module: an exported instance is
      *  written with that library's aliases (`kind: Self.Listener`), which the
      *  consumer's table cannot resolve. */
-    const record = (kind, key, scoped, module) => {
+    const record = (kind, key, scoped, module, forwardedFrom) => {
         const status = effectiveStatusSchema(resolve.in(kind, module), resolve);
-        out.set(key, { kind, ...(status ? { status } : {}), ...(scoped ? { scoped } : {}) });
+        out.set(key, {
+            kind,
+            ...(status ? { status } : {}),
+            ...(scoped ? { scoped } : {}),
+            ...(forwardedFrom !== undefined ? { forwardedFrom } : {}),
+        });
     };
     for (const manifest of manifests) {
         const kind = manifest.kind;
         const name = manifest.metadata?.name;
         if (!kind || SYSTEM_KINDS.has(kind))
             continue;
+        const module = manifest.metadata?.module;
+        // A dependency's declarations publish into ITS module's `resources`, not this
+        // one's: they are keyed by that module, and an export is also indexed under
+        // `<Alias>.<name>` below.
+        const forwardedFrom = isForwardedDeclaration(manifest) ? module : undefined;
+        if (forwardedFrom === undefined && isForwardedDeclaration(manifest))
+            continue;
+        const keyOf = (n) => forwardedFrom === undefined ? n : forwardedResourceKey(forwardedFrom, n);
         if (name)
-            record(kind, name, false, manifest.metadata?.module);
+            record(kind, keyOf(name), false, module, forwardedFrom);
         const schema = resolve(kind)?.schema;
         if (!schema)
             continue;
@@ -137,7 +155,7 @@ export function buildObservedStateIndex(manifests, defs, aliases, scopes) {
                     const scopedKind = scopedEntry?.kind;
                     const scopedName = scopedEntry?.metadata?.name;
                     if (typeof scopedKind === "string" && typeof scopedName === "string") {
-                        record(scopedKind, scopedName, true);
+                        record(scopedKind, keyOf(scopedName), true, forwardedFrom, forwardedFrom);
                     }
                 }
             }
@@ -207,8 +225,8 @@ function* importedExports(manifests, aliases) {
  *  flat field pass exactly as they do today. */
 export function buildObservedStateResourcesSchema(index, open) {
     const properties = {};
-    for (const [key, { status }] of index) {
-        if (!status)
+    for (const [key, { status, forwardedFrom }] of index) {
+        if (!status || forwardedFrom !== undefined)
             continue;
         applyObservedStateNode(properties, key, status);
     }

package/dist/validate-reference-forms.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-reference-forms.d.ts","sourceRoot":"","sources":["../src/validate-reference-forms.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAInE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE,aAAa,EACvB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC3C,kBAAkB,EAAE,CA0EtB"}
+{"version":3,"file":"validate-reference-forms.d.ts","sourceRoot":"","sources":["../src/validate-reference-forms.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAKnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE,aAAa,EACvB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC3C,kBAAkB,EAAE,CAwEtB"}

package/dist/validate-reference-forms.js

@@ -1,4 +1,5 @@
 import { isTaggedSentinel } from "@telorun/templating";
+import { isForwardedDeclaration } from "./forwarded-declaration.js";
 import { visitManifest } from "./manifest-visitor.js";
 import { satisfiesValueBranch } from "./reference-field-map.js";
 import { REF_VALIDATION_SKIP_KINDS as SYSTEM_KINDS } from "./system-kinds.js";
@@ -40,8 +41,7 @@ export function validateReferenceForms(resources, registry, aliases, aliasesByMo
     if (!aliases)
         return [];
     const diagnostics = [];
-    const isForeign = (r) => r.metadata?.forwardedExport === true;
-    const localResources = resources.filter((r) => !isForeign(r));
+    const localResources = resources.filter((r) => !isForwardedDeclaration(r));
     visitManifest(localResources, registry, {
         onRef: (e) => {
             const value = e.value;

package/dist/validate-references.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-references.d.ts","sourceRoot":"","sources":["../src/validate-references.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAarD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAE/F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAyInE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,kBAAkB;AAC5B;8EAC8E;AAC9E,aAAa,UAAQ,GACpB,OAAO,CAwBT;AAgED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,GACvB,kBAAkB,EAAE,CAsgBtB"}
+{"version":3,"file":"validate-references.d.ts","sourceRoot":"","sources":["../src/validate-references.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAarD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAE/F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AA2InE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,kBAAkB;AAC5B;8EAC8E;AAC9E,aAAa,UAAQ,GACpB,OAAO,CAwBT;AAgED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,GACvB,kBAAkB,EAAE,CAwgBtB"}

package/dist/validate-references.js

@@ -8,6 +8,8 @@ import { DiagnosticSeverity } from "./types.js";
 import { moduleAliasScope } from "./module-alias-scope.js";
 import { isModuleKind } from "./module-kinds.js";
 import { isInjectedDeclaration } from "./resource-input.js";
+import { outsideScopesOf } from "./scope-declarations.js";
+import { isForwardedDeclaration, isForwardedExport } from "./forwarded-declaration.js";
 const SOURCE = "telo-analyzer";
 /** What a name IS on one side of a collision. The three shapes share the
  *  kernel's one namespace but read as different things to an author — an alias
@@ -287,10 +289,10 @@ export function validateReferences(resources, context) {
     // metadata.module that isn't a root module) are resolution TARGETS only: excluded from
     // duplicate detection and local name resolution, and never walked as ref sources.
     const moduleOf = (r) => r.metadata?.module;
-    // Forwarded exports are flagged by flattenForAnalyzer (`metadata.forwardedExport`); they're
-    // cross-module resolution targets only — excluded from duplicate detection and local name
-    // resolution, and never walked as ref sources.
-    const isForeign = (r) => r.metadata?.forwardedExport === true;
+    // A dependency's code — a forwarded export, or what extraction pulled out of one — is
+    // excluded from duplicate detection and local name resolution, and never walked as a
+    // ref source. Only an EXPORT is a cross-module resolution target.
+    const isForeign = isForwardedDeclaration;
     // Forwarded exported instances keyed `${module}\0${name}` — the lookup that resolves
     // whether a cross-module `!ref Alias.name` names a real exported instance.
     const byModuleName = new Map();
@@ -308,7 +310,7 @@ export function validateReferences(resources, context) {
                 loadedModules.add(m);
             continue;
         }
-        if (!r.metadata?.name || SYSTEM_KINDS.has(r.kind) || !isForeign(r))
+        if (!r.metadata?.name || SYSTEM_KINDS.has(r.kind) || !isForwardedExport(r))
             continue;
         const m = moduleOf(r);
         if (!m)
@@ -398,6 +400,10 @@ export function validateReferences(resources, context) {
                 const target = visibleScopeManifests.find((m) => m.metadata?.name === localName) ??
                     byName.get(localName);
                 if (!target) {
+                    // A scoped name out of this declaration's reach has its own
+                    // diagnostic, which says why; this one would say only "not found".
+                    if (outsideScopesOf(r).some((scope) => scope.names.includes(localName)))
+                        return;
                     diagnostics.push({
                         severity: DiagnosticSeverity.Error,
                         code: "UNRESOLVED_REFERENCE",

package/dist/validate-scope-reach.d.ts

@@ -0,0 +1,31 @@
+import type { ResourceManifest } from "@telorun/sdk";
+import type { AliasResolver } from "./alias-resolver.js";
+import type { DefinitionRegistry } from "./definition-registry.js";
+import { type AnalysisDiagnostic } from "./types.js";
+/**
+ * `SCOPED_NAME_OUT_OF_REACH` — a declaration written inside a scope's region but
+ * created outside the scope (see {@link OutsideScope}) naming one of the scope's
+ * resources.
+ *
+ * Written there, the name reads as reachable — the scope's names shadow the
+ * module's in its regions — while at run time it resolves to nothing, or to a
+ * module-level resource that merely shares it. Reported at the reference, in
+ * each spelling a name can be read in:
+ *
+ *  - a `!ref` sentinel, anywhere — the tag is unambiguous;
+ *  - a resolved `{kind, name}`, but ONLY where the declaring kind says a
+ *    reference is: a reference slot of its field map, or a step's dispatch slot.
+ *    An object that merely has those keys is data;
+ *  - `resources.<name>` in a CEL expression.
+ *
+ * Lexical: a scope declared on the way from the out-of-reach declaration down to
+ * the reference — found through the kinds' own scope slots — shadows the name
+ * again, since that one IS created around it. Entry-module-scoped: a
+ * dependency's code is its own analysis's to report.
+ *
+ * Browser-safe.
+ */
+export declare function validateScopedNameReach(manifests: ResourceManifest[], registry: DefinitionRegistry, aliases: AliasResolver, aliasesByModule: Map<string, AliasResolver>, rootModules: ReadonlySet<string>, 
+/** Member-access chains of a CEL expression — the analyzer's own parse. */
+accessChains: (expression: string) => string[][]): AnalysisDiagnostic[];
+//# sourceMappingURL=validate-scope-reach.d.ts.map

package/dist/validate-scope-reach.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-scope-reach.d.ts","sourceRoot":"","sources":["../src/validate-scope-reach.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAanE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAYzE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAC3C,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC;AAChC,2EAA2E;AAC3E,YAAY,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,EAAE,EAAE,GAC/C,kBAAkB,EAAE,CAyItB"}

package/dist/validate-scope-reach.js

@@ -0,0 +1,180 @@
+import { walkCelExpressions } from "@telorun/templating";
+import { isForwardedDeclaration } from "./forwarded-declaration.js";
+import { definitionInScope } from "./module-alias-scope.js";
+import { isRefEntry, resolveFieldEntries } from "./reference-field-map.js";
+import { declaredScopes, isScopeMember, outsideScopesOf, scopeEncloses, } from "./scope-declarations.js";
+import { forEachStep, stepBodiesOf } from "./step-bodies.js";
+import { DiagnosticSeverity } from "./types.js";
+const SOURCE = "telo-analyzer";
+const DECLARATION_KINDS = new Set([
+    "Telo.Definition",
+    "Telo.Abstract",
+    "Telo.Application",
+    "Telo.Library",
+    "Telo.Import",
+]);
+/**
+ * `SCOPED_NAME_OUT_OF_REACH` — a declaration written inside a scope's region but
+ * created outside the scope (see {@link OutsideScope}) naming one of the scope's
+ * resources.
+ *
+ * Written there, the name reads as reachable — the scope's names shadow the
+ * module's in its regions — while at run time it resolves to nothing, or to a
+ * module-level resource that merely shares it. Reported at the reference, in
+ * each spelling a name can be read in:
+ *
+ *  - a `!ref` sentinel, anywhere — the tag is unambiguous;
+ *  - a resolved `{kind, name}`, but ONLY where the declaring kind says a
+ *    reference is: a reference slot of its field map, or a step's dispatch slot.
+ *    An object that merely has those keys is data;
+ *  - `resources.<name>` in a CEL expression.
+ *
+ * Lexical: a scope declared on the way from the out-of-reach declaration down to
+ * the reference — found through the kinds' own scope slots — shadows the name
+ * again, since that one IS created around it. Entry-module-scoped: a
+ * dependency's code is its own analysis's to report.
+ *
+ * Browser-safe.
+ */
+export function validateScopedNameReach(manifests, registry, aliases, aliasesByModule, rootModules, 
+/** Member-access chains of a CEL expression — the analyzer's own parse. */
+accessChains) {
+    const out = [];
+    for (const root of manifests) {
+        if (!root.kind || DECLARATION_KINDS.has(root.kind) || isForwardedDeclaration(root))
+            continue;
+        const meta = root.metadata;
+        if (typeof meta?.name !== "string")
+            continue;
+        const module = typeof meta.module === "string" ? meta.module : undefined;
+        if (module && !rootModules.has(module))
+            continue;
+        const resource = { kind: root.kind, name: meta.name };
+        const filePath = typeof meta.source === "string" ? meta.source : undefined;
+        const report = (path, name, scope) => out.push({
+            severity: DiagnosticSeverity.Error,
+            code: "SCOPED_NAME_OUT_OF_REACH",
+            source: SOURCE,
+            message: `${scope.ownerKind}/${scope.ownerName}: '${name}' is declared in '${scope.field}:', but ` +
+                `the inline declaration referencing it is created where '${scope.ownerName}' is ` +
+                `declared, outside that scope, so the reference cannot reach it. Declare the ` +
+                `referencing resource under '${scope.field}:' with a name of its own and point at it ` +
+                `with '!ref'.`,
+            data: { resource, filePath, path },
+        });
+        /** A declaration's kind, field map and scopes, read in its module's aliases. */
+        const shape = (declaration) => {
+            const view = module !== undefined && typeof declaration.metadata?.module !== "string"
+                ? { ...declaration, metadata: { ...declaration.metadata, module } }
+                : declaration;
+            const fieldMap = registry.expandedFieldMapForResource(view, aliases, aliasesByModule);
+            const definition = definitionInScope(registry, view.kind, view.metadata, aliases, aliasesByModule);
+            return {
+                fieldMap,
+                scopes: declaredScopes(declaration, fieldMap),
+                schema: registry.effectiveSchemaOf(definition),
+            };
+        };
+        const check = (declaration, prefix, reach, shadowed) => {
+            const stamped = outsideScopesOf(declaration);
+            const nextReach = new Map(reach);
+            const nextShadowed = new Set(shadowed);
+            for (const scope of stamped) {
+                for (const name of scope.names) {
+                    nextReach.set(name, scope);
+                    nextShadowed.delete(name);
+                }
+            }
+            const { fieldMap, scopes, schema } = shape(declaration);
+            for (const scope of scopes) {
+                for (const member of scope.declarations) {
+                    if (isScopeMember(member))
+                        nextShadowed.add(member.metadata.name);
+                }
+            }
+            const at = (path) => (prefix ? (path ? `${prefix}.${path}` : prefix) : path);
+            const test = (name, path) => {
+                if (name === undefined || nextShadowed.has(name))
+                    return;
+                const scope = nextReach.get(name);
+                if (scope)
+                    report(at(path), name, scope);
+            };
+            const inScopeArray = (path) => scopes.some((scope) => scopeEncloses({ ...scope, regions: [scope.path] }, path));
+            // Tagged `!ref`s and CEL, anywhere but the declaration's own metadata and
+            // scope arrays (their members are checked below, with their own shadowing).
+            walkCelExpressions(declaration, "", (source, path, engine) => {
+                if (path === "metadata" || path.startsWith("metadata.") || inScopeArray(path))
+                    return;
+                if (engine === "ref") {
+                    test(localName(source), path);
+                }
+                else if (engine === "cel") {
+                    for (const chain of accessChains(source)) {
+                        if (chain[0] === "resources" && chain.length > 1)
+                            test(chain[1], path);
+                    }
+                }
+            });
+            // A resolved reference, where the kind declares one.
+            if (fieldMap) {
+                for (const [fieldPath, entry] of fieldMap) {
+                    if (!isRefEntry(entry))
+                        continue;
+                    for (const { value, path } of resolveFieldEntries(declaration, fieldPath)) {
+                        if (inScopeArray(path))
+                            continue;
+                        test(resolvedLocalName(value), path);
+                    }
+                }
+            }
+            if (schema) {
+                for (const body of stepBodiesOf(declaration, schema)) {
+                    forEachStep(body, schema, (step, stepPath) => test(resolvedLocalName(step[body.invokeField]), `${stepPath}.${body.invokeField}`));
+                }
+            }
+            for (const scope of scopes) {
+                scope.declarations.forEach((member, i) => {
+                    if (isScopeMember(member)) {
+                        check(member, at(`${scope.path}[${i}]`), nextReach, nextShadowed);
+                    }
+                });
+            }
+        };
+        /** Only a stamped declaration can hold an out-of-reach reference; the rest
+         *  is searched through the scope arrays that can hold one. */
+        const visit = (declaration, prefix) => {
+            if (outsideScopesOf(declaration).length > 0) {
+                check(declaration, prefix, new Map(), new Set());
+                return;
+            }
+            for (const scope of shape(declaration).scopes) {
+                scope.declarations.forEach((member, i) => {
+                    if (!isScopeMember(member))
+                        return;
+                    visit(member, `${prefix ? `${prefix}.` : ""}${scope.path}[${i}]`);
+                });
+            }
+        };
+        visit(root, "");
+    }
+    return out;
+}
+/** The local name a `!ref` source names, or undefined for a cross-module one. */
+function localName(source) {
+    const dot = source.indexOf(".");
+    if (dot === -1)
+        return source;
+    return source.slice(0, dot) === "Self" ? source.slice(dot + 1) : undefined;
+}
+/** The local name a resolved `{kind, name, alias?}` reference names. */
+function resolvedLocalName(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const ref = value;
+    if (typeof ref.kind !== "string" || typeof ref.name !== "string")
+        return undefined;
+    if (typeof ref.alias === "string" && ref.alias !== "Self")
+        return undefined;
+    return ref.name;
+}

package/dist/validate-source-entries.d.ts

@@ -0,0 +1,16 @@
+import type { ResourceManifest } from "@telorun/sdk";
+import { type AnalysisDiagnostic } from "./types.js";
+/**
+ * The strict half of `source-entries.ts`: what `telo check` reports about a
+ * module doc's `sources:` block.
+ *
+ * Every rule the block alone decides is a reader problem, reported here under
+ * its own code. This adds the rules that need the rest of the module or that
+ * only publish enforces: an entry must stage a file the manifest names, a link
+ * ships in its target's layer, and every file entry and every build carries its
+ * pin. Shape errors are left to the owner doc's JSON Schema.
+ *
+ * Entry-module-scoped: a dependency's block is not the consumer's to fix.
+ */
+export declare function validateSourceEntries(manifests: ResourceManifest[], entryModules?: ReadonlySet<string>): AnalysisDiagnostic[];
+//# sourceMappingURL=validate-source-entries.d.ts.map

package/dist/validate-source-entries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-source-entries.d.ts","sourceRoot":"","sources":["../src/validate-source-entries.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAUrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GACjC,kBAAkB,EAAE,CA0FtB"}