@telorun/analyzer 0.73.0 → 0.74.0

package/dist/validate-source-entries.js

@@ -0,0 +1,90 @@
+import { moduleDocumentClaims } from "./module-file-claims.js";
+import { crossLayerSourceLinks, stageableFiles, unclaimedSourceEntries, } from "./module-named-files.js";
+import { normalizeNativePath, readNativeEntries } from "./native-entries.js";
+import { readModuleSources } from "./source-entries.js";
+import { DiagnosticSeverity } from "./types.js";
+const SOURCE = "telo-analyzer";
+/**
+ * The strict half of `source-entries.ts`: what `telo check` reports about a
+ * module doc's `sources:` block.
+ *
+ * Every rule the block alone decides is a reader problem, reported here under
+ * its own code. This adds the rules that need the rest of the module or that
+ * only publish enforces: an entry must stage a file the manifest names, a link
+ * ships in its target's layer, and every file entry and every build carries its
+ * pin. Shape errors are left to the owner doc's JSON Schema.
+ *
+ * Entry-module-scoped: a dependency's block is not the consumer's to fix.
+ */
+export function validateSourceEntries(manifests, entryModules) {
+    const out = [];
+    for (const manifest of manifests) {
+        if (manifest.kind !== "Telo.Application" && manifest.kind !== "Telo.Library")
+            continue;
+        const metadata = (manifest.metadata ?? {});
+        const name = typeof metadata.name === "string" ? metadata.name : undefined;
+        const owned = entryModules === undefined ||
+            (typeof metadata.module === "string"
+                ? entryModules.has(metadata.module)
+                : name === undefined || entryModules.has(name));
+        if (!owned)
+            continue;
+        const label = `${manifest.kind}/${name ?? "(unnamed)"}`;
+        const report = (code, path, message) => out.push({
+            severity: DiagnosticSeverity.Error,
+            code,
+            source: SOURCE,
+            message: `${label}: ${message}`,
+            data: {
+                resource: { kind: manifest.kind, name },
+                filePath: typeof metadata.source === "string" ? metadata.source : undefined,
+                path,
+            },
+        });
+        const { sources, problems } = readModuleSources(manifest);
+        for (const problem of problems) {
+            if (problem.code === "SHAPE")
+                continue;
+            report(problem.code, problem.path, problem.message);
+        }
+        if (sources.length === 0)
+            continue;
+        for (const source of sources) {
+            if (source.build && source.build.inputs === undefined) {
+                report("SOURCE_BUILD_UNPINNED", `sources.${source.name}.build`, `source '${source.name}' names the crate its files are built from but records no build ` +
+                    `inputs, so a later edit to that crate cannot be caught — run \`telo release stage ` +
+                    `--pin\` after building its files. \`telo release check\` and publish refuse it.`);
+            }
+            for (const entry of source.entries) {
+                if (entry.kind !== "file" || entry.pin)
+                    continue;
+                report("SOURCE_ENTRY_UNPINNED", `sources.${source.name}.entries.${entry.key}`, `source '${source.name}' entry '${entry.key}' carries no pin (sha256 and executable), so ` +
+                    `nothing can verify the file it stages: a kernel refuses to read it and publish refuses ` +
+                    `to ship it — run \`telo release stage --pin\`.`);
+            }
+        }
+        const moduleName = typeof metadata.module === "string" ? metadata.module : name;
+        const stageable = stageableFiles(readNativeEntries(manifest).entries, moduleDocumentClaims(manifests, moduleName));
+        for (const { source, entry, layer, targetLayer } of crossLayerSourceLinks(sources, stageable)) {
+            report("SOURCE_LINK_TARGET_UNRESOLVED", `sources.${source.name}.entries.${entry.key}.target`, `source '${source.name}' entry '${entry.key}': the link ships in the ${layer} layer, but ` +
+                `its target '${entry.resolved}' ships in the ${targetLayer} layer. A runtime extracts ` +
+                `only the layers it needs, so the link would dangle — point it at a file of its own layer.`);
+        }
+        // A `native:` entry with an unrelated problem still names its path; reported
+        // once, as that problem, rather than again as an unclaimed source entry.
+        const unreadNative = new Set();
+        const native = manifest.native;
+        for (const entry of Array.isArray(native) ? native : []) {
+            const path = entry?.path;
+            const verdict = typeof path === "string" ? normalizeNativePath(path.trim()) : undefined;
+            if (verdict && "path" in verdict)
+                unreadNative.add(verdict.path);
+        }
+        for (const { source, entry } of unclaimedSourceEntries(sources, stageable, unreadNative)) {
+            report("SOURCE_ENTRY_UNCLAIMED", `sources.${source.name}.entries.${entry.key}`, `source '${source.name}' entry '${entry.key}': nothing in the module names '${entry.path}' ` +
+                `— no native: entry's path, no platform-qualified controller candidate's path=, and ` +
+                `none of the source's notices. Name the file where it is used, or remove the entry.`);
+        }
+    }
+    return out;
+}

package/dist/validate-throws-coverage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-throws-coverage.d.ts","sourceRoot":"","sources":["../src/validate-throws-coverage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEjE,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAA0B,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAenE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AA4kBzE,oDAAoD;AACpD,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,WAAW,EAChB,eAAe,GAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAa,EACvD,WAAW,GAAE,GAAG,CAAC,MAAM,CAAa;AACpC;;+BAE+B;AAC/B,eAAe,GAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAa,GAC3D,kBAAkB,EAAE,CAsLtB"}
+{"version":3,"file":"validate-throws-coverage.d.ts","sourceRoot":"","sources":["../src/validate-throws-coverage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEjE,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAA0B,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAkBnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAkkBzE,oDAAoD;AACpD,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,WAAW,EAChB,eAAe,GAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAa,EACvD,WAAW,GAAE,GAAG,CAAC,MAAM,CAAa;AACpC;;+BAE+B;AAC/B,eAAe,GAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAa,GAC3D,kBAAkB,EAAE,CAsLtB"}

package/dist/validate-throws-coverage.js

@@ -1,11 +1,11 @@
 import { isTaggedSentinel } from "@telorun/templating";
 import { AMBIENT_CONTRACT_ERROR_CODES, isAmbientContractErrorCode, } from "@telorun/sdk";
 import { scopeResolverForModule } from "./alias-resolver.js";
-import { createResolveCtx, resolveScopeUnion, resolveThrowsUnion, } from "./resolve-throws-union.js";
+import { createResolveCtx, handsFailureBack, resolveScopeUnion, resolveThrowsUnion, throwsUses, } from "./resolve-throws-union.js";
+import { forEachDeclaredSlot } from "./schema-walk.js";
 import { buildEnclosers, collectScopedManifests, enclosingCoverage, } from "./catch-scope.js";
 import { DiagnosticSeverity } from "./types.js";
 import { extractAccessChains, validateChainAgainstSchema } from "./validate-cel-context.js";
-import { isStepSlot } from "./step-slot.js";
 const SOURCE = "telo-analyzer";
 const TEMPLATE_REGEX = /\$\{\{\s*([^}]+?)\s*\}\}/g;
 /** Walk `definition.schema` and `data` in tandem, invoking `onOutcome` each
@@ -401,12 +401,6 @@ function checkCelChainAgainstDataSchema(entry, dataSchema, resource, filePath, e
     }
     return diagnostics;
 }
-/** Rule 8 extension: `inherit: true` only makes sense on a definition whose
- *  schema declares at least one STEP BODY — an array whose items point at the
- *  shared grammar, or, for a module published before that fragment existed, one
- *  carrying the legacy `x-telo-step-context` annotation. That is what drives the
- *  resolver's generic step traversal; a definition with `inherit: true` and no
- *  such array has no invocables to inherit from. */
 /** The capabilities whose lifecycle includes a dispatch a caller can catch. On
  *  every other one a thrown error is a boot-time failure, not a structured
  *  runtime error for a downstream caller — a provider resolves configuration, a
@@ -466,10 +460,14 @@ function validateThrowsDeclarations(manifests) {
                     severity: DiagnosticSeverity.Error,
                     code: "INHERIT_WITHOUT_STEP_CONTEXT",
                     source: SOURCE,
-                    message: `Telo.Definition '${name}' declares throws.inherit: true but its schema declares no step ` +
-                        `body. inherit is only meaningful on a definition that drives invocables through steps — ` +
-                        `give an array field 'items: { $ref: "telo://manifest#/$defs/Step" }' (the legacy ` +
-                        `x-telo-step-context annotation is also recognised).`,
+                    message: `Telo.Definition '${name}' declares throws.inherit: true but its schema dispatches nothing ` +
+                        `a failure can come back through. inherit makes the kind's union the union of what it ` +
+                        `dispatches, so the schema needs a step body (an array field with ` +
+                        `'items: { $ref: "telo://manifest#/$defs/Step" }', or the legacy x-telo-step-context ` +
+                        `annotation) or a reference slot whose use includes 'call' or 'trigger.consumer' ` +
+                        `(for a use case map, in any case; a slot declaring no use counts as 'call'). ` +
+                        `'detached' and 'trigger.inbound' run where no caller awaits them, and ` +
+                        `'dependency' / 'schema' dispatch nothing.`,
                     data: { resource: { kind: m.kind, name }, filePath, path: "throws.inherit" },
                 });
             }
@@ -477,35 +475,19 @@ function validateThrowsDeclarations(manifests) {
     }
     return diagnostics;
 }
+/** Rule 8 extension: `inherit: true` needs something to inherit from — a step
+ *  body, or a reference slot whose use (any case of a case map) hands a failure
+ *  back. The schema-only mode of the walk the resolver runs per instance, so the
+ *  check and the union reach the same slots. */
 function schemaDrivesInvocables(schema) {
-    if (!schema || typeof schema !== "object")
-        return false;
-    if (isStepSlot(schema))
-        return true;
-    const props = schema.properties;
-    if (props && typeof props === "object") {
-        for (const v of Object.values(props)) {
-            if (schemaDrivesInvocables(v))
-                return true;
-        }
-    }
-    if (schema.items && schemaDrivesInvocables(schema.items))
-        return true;
-    for (const key of ["oneOf", "anyOf", "allOf"]) {
-        const arr = schema[key];
-        if (Array.isArray(arr)) {
-            for (const sub of arr)
-                if (schemaDrivesInvocables(sub))
-                    return true;
+    let drives = false;
+    forEachDeclaredSlot(schema, (declared) => {
+        if (declared.kind === "step" ||
+            declared.slots.some((slot) => throwsUses(slot).some(handsFailureBack))) {
+            drives = true;
         }
-    }
-    if (schema.$defs && typeof schema.$defs === "object") {
-        for (const v of Object.values(schema.$defs)) {
-            if (schemaDrivesInvocables(v))
-                return true;
-        }
-    }
-    return false;
+    });
+    return drives;
 }
 /** Entry point — invoked once per analyze() run. */
 export function validateThrowsCoverage(manifests, defs, aliases, env, aliasesByModule = new Map(), rootModules = new Set(), 

package/dist/value-type-keyword.d.ts

@@ -29,6 +29,20 @@ import type { KeywordDefinition } from "ajv";
  * `x-telo-type` is deliberately absent — it is the one that emits code.
  */
 export declare const ANNOTATION_KEYWORDS: readonly ["x-telo-bindings-from", "x-telo-catches-for", "x-telo-context", "x-telo-context-collection-from", "x-telo-context-element-from", "x-telo-context-from", "x-telo-context-from-ref-kind", "x-telo-context-from-root", "x-telo-context-ref-from", "x-telo-error-context", "x-telo-eval", "x-telo-inline", "x-telo-outcome-list", "x-telo-provides-zone", "x-telo-ref", "x-telo-requires-zone", "x-telo-resource-rules", "x-telo-schema-from", "x-telo-schema-map", "x-telo-schema-projection", "x-telo-schema-projection-from", "x-telo-scope", "x-telo-sensitive", "x-telo-step-context", "x-telo-topology-role", "x-telo-value-schema-from", "x-telo-widget"];
+/** How an AJV instance treats a `live` value type. */
+export interface TeloKeywordOptions {
+    /**
+     * Assert a `live` type as an instance too, so a literal at such a slot is
+     * refused — a value written in a manifest can never be a live instance.
+     *
+     * STATIC analysis only, where a CEL leaf's stand-in is an instance
+     * (`celPlaceholderForSchema`). The kernel's instances leave it off: at
+     * dispatch a live value is exempt from validation, and the stage that pulls
+     * from it refuses a non-stream itself — so the static half refuses a strict
+     * subset of what the runtime refuses, and the two cannot disagree.
+     */
+    readonly assertLive?: boolean;
+}
 /**
  * The `x-telo-type` keyword.
  *
@@ -37,8 +51,10 @@ export declare const ANNOTATION_KEYWORDS: readonly ["x-telo-bindings-from", "x-t
  *  - a `json` representation validates through its own declared schema, so the
  *    keyword emits nothing — the name carries nominal identity for static wiring
  *    and has no runtime existence at all;
- *  - a `live` instance is EXEMPT: its value is never traversed, because iterating
- *    a stream to check it is precisely what the exemption is for;
+ *  - a `live` instance is EXEMPT at dispatch: its value is never traversed,
+ *    because iterating a stream to check it is precisely what the exemption is
+ *    for. Statically ({@link TeloKeywordOptions.assertLive}) it is asserted like
+ *    any other instance, which checks what the value IS and never iterates it;
  *  - every other instance is ASSERTED against the constructor its binding names.
  *
  * An unknown name emits nothing here. It is a hard diagnostic in the analyzer
@@ -46,15 +62,16 @@ export declare const ANNOTATION_KEYWORDS: readonly ["x-telo-bindings-from", "x-t
  * manifest that wrote it; failing compilation instead would take out every
  * validator in a module for one typo in one slot.
  */
-export declare function valueTypeKeyword(): KeywordDefinition;
+export declare function valueTypeKeyword(options?: TeloKeywordOptions): KeywordDefinition;
 /**
  * Register every Telo keyword on an AJV instance: the annotations as no-ops and
  * `x-telo-type` as the one that checks.
  *
  * Every AJV instance in the runtime and the analyzer goes through this, so a
- * schema means the same thing wherever it is validated.
+ * schema means the same thing wherever it is validated — apart from the one
+ * posture {@link TeloKeywordOptions} names, which only static analysis takes.
  */
 export declare function registerTeloKeywords(ajv: {
     addKeyword: (keyword: any, definition?: any) => unknown;
-}): void;
+}, options?: TeloKeywordOptions): void;
 //# sourceMappingURL=value-type-keyword.d.ts.map

package/dist/value-type-keyword.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"value-type-keyword.d.ts","sourceRoot":"","sources":["../src/value-type-keyword.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;+EAqB+E;AAG/E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,KAAK,CAAC;AAiB7C;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,woBA4BtB,CAAC;AAEX;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,IAAI,iBAAiB,CA+BpD;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE;IACxC,UAAU,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC;CACzD,GAAG,IAAI,CAGP"}
+{"version":3,"file":"value-type-keyword.d.ts","sourceRoot":"","sources":["../src/value-type-keyword.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;+EAqB+E;AAG/E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,KAAK,CAAC;AAiB7C;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,woBA4BtB,CAAC;AAEX,sDAAsD;AACtD,MAAM,WAAW,kBAAkB;IACjC;;;;;;;;;OASG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,kBAAuB,GAAG,iBAAiB,CAsCpF;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE;IAAE,UAAU,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,GAAG,KAAK,OAAO,CAAA;CAAE,EAChE,OAAO,GAAE,kBAAuB,GAC/B,IAAI,CAGN"}

package/dist/value-type-keyword.js

@@ -68,8 +68,10 @@ export const ANNOTATION_KEYWORDS = [
  *  - a `json` representation validates through its own declared schema, so the
  *    keyword emits nothing — the name carries nominal identity for static wiring
  *    and has no runtime existence at all;
- *  - a `live` instance is EXEMPT: its value is never traversed, because iterating
- *    a stream to check it is precisely what the exemption is for;
+ *  - a `live` instance is EXEMPT at dispatch: its value is never traversed,
+ *    because iterating a stream to check it is precisely what the exemption is
+ *    for. Statically ({@link TeloKeywordOptions.assertLive}) it is asserted like
+ *    any other instance, which checks what the value IS and never iterates it;
  *  - every other instance is ASSERTED against the constructor its binding names.
  *
  * An unknown name emits nothing here. It is a hard diagnostic in the analyzer
@@ -77,7 +79,7 @@ export const ANNOTATION_KEYWORDS = [
  * manifest that wrote it; failing compilation instead would take out every
  * validator in a module for one typo in one slot.
  */
-export function valueTypeKeyword() {
+export function valueTypeKeyword(options = {}) {
     return {
         keyword: X_TELO_TYPE,
         // Both spellings: a bare name, or the object form carrying type arguments.
@@ -86,7 +88,9 @@ export function valueTypeKeyword() {
             const entry = readValueTypeSlot({
                 [X_TELO_TYPE]: cxt.schema,
             })?.entry;
-            if (!entry || entry.representation !== "instance" || entry.live)
+            if (!entry || entry.representation !== "instance")
+                return;
+            if (entry.live && !options.assertLive)
                 return;
             const binding = VALUE_TYPE_BINDINGS[entry.binding];
             if (!binding)
@@ -104,6 +108,10 @@ export function valueTypeKeyword() {
         error: {
             message: (cxt) => {
                 const entry = readValueTypeSlot({ [X_TELO_TYPE]: cxt.schema })?.entry;
+                if (entry?.live) {
+                    return (`must be a live ${entry.name} — a value written in the manifest can never be one; ` +
+                        "pass the result of a step that produces it, with a !cel expression");
+                }
                 return entry?.binding === "bytes"
                     ? "must be raw bytes (a Uint8Array) — bytes cannot be written inline in a manifest"
                     : `must be a ${entry?.name ?? "declared value type"} — this value is not writable inline in a manifest`;
@@ -116,10 +124,11 @@ export function valueTypeKeyword() {
  * `x-telo-type` as the one that checks.
  *
  * Every AJV instance in the runtime and the analyzer goes through this, so a
- * schema means the same thing wherever it is validated.
+ * schema means the same thing wherever it is validated — apart from the one
+ * posture {@link TeloKeywordOptions} names, which only static analysis takes.
  */
-export function registerTeloKeywords(ajv) {
+export function registerTeloKeywords(ajv, options = {}) {
     for (const keyword of ANNOTATION_KEYWORDS)
         ajv.addKeyword(keyword);
-    ajv.addKeyword(valueTypeKeyword());
+    ajv.addKeyword(valueTypeKeyword(options));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.73.0",
+  "version": "0.74.0",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",
@@ -43,14 +43,14 @@
     "jsonpath-plus": "^10.3.0",
     "packageurl-js": "^2.0.1",
     "yaml": "^2.8.3",
-    "@telorun/templating": "0.20.0"
+    "@telorun/templating": "0.20.1"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",
     "typescript": "^5.0.0",
     "vitest": "^2.1.8",
     "@telorun/glob": "0.3.0",
-    "@telorun/sdk": "0.87.0"
+    "@telorun/sdk": "0.90.0"
   },
   "peerDependencies": {
     "@telorun/sdk": "*"

package/src/analyzer.ts

@@ -49,6 +49,7 @@ import {
   buildObservedStateIndex,
   buildObservedStateResourcesSchema,
   collectRunReachableNames,
+  forwardedResourceKey,
   observedStateRead,
   validateObservedStateDeclarations,
 } from "./validate-observed-state.js";
@@ -167,6 +168,8 @@ import { validateIdentifierNames } from "./validate-identifier-names.js";
 import { validateExtends } from "./validate-extends.js";
 import { validateLogging } from "./validate-logging.js";
 import { validateModuleArtifact } from "./validate-module-artifact.js";
+import { validateNativeEntries } from "./validate-native-entries.js";
+import { validateSourceEntries } from "./validate-source-entries.js";
 import { validateIncludePlacement } from "./validate-include-placement.js";
 import { validateModuleMetadata } from "./validate-module-metadata.js";
 import { validateRequires } from "./validate-requires.js";
@@ -182,6 +185,8 @@ import { validateResourceInputs } from "./validate-resource-inputs.js";
 import { validateExports } from "./validate-exports.js";
 import { validateTemplateBody } from "./validate-template-body.js";
 import { validateUnusedDeclarations } from "./validate-unused-declarations.js";
+import { validateScopedNameReach } from "./validate-scope-reach.js";
+import { isForwardedDeclaration } from "./forwarded-declaration.js";
 import { validateThrowsCoverage } from "./validate-throws-coverage.js";
 import { readStepSlot } from "./step-slot.js";
 
@@ -406,9 +411,9 @@ function validateStepInvokeReferences(
       if (typeof m === "string") loadedModules.add(m);
       continue;
     }
-    const meta = r.metadata as { name?: unknown; module?: unknown; forwardedExport?: unknown };
+    const meta = r.metadata as { name?: unknown; module?: unknown };
     if (typeof meta?.name !== "string" || REF_VALIDATION_SKIP_KINDS.has(r.kind)) continue;
-    if (meta.forwardedExport === true) {
+    if (isForwardedDeclaration(r)) {
       if (typeof meta.module === "string") loadedModules.add(meta.module);
       continue;
     }
@@ -476,11 +481,11 @@ function validateStepInvokeReferences(
   };
 
   for (const m of allManifests) {
-    const meta = m.metadata as { name?: unknown; source?: unknown; forwardedExport?: unknown };
+    const meta = m.metadata as { name?: unknown; source?: unknown };
     if (
       typeof meta?.name !== "string" ||
       REF_VALIDATION_SKIP_KINDS.has(m.kind) ||
-      meta.forwardedExport === true
+      isForwardedDeclaration(m)
     )
       continue;
     const def = defs.resolve(aliases.resolveKind(m.kind) ?? m.kind);
@@ -1534,6 +1539,11 @@ export class StaticAnalyzer {
       // would otherwise fail on a consumer's machine — or, for a mistyped platform
       // axis, silently offer one platform's binary to every host.
       diagnostics.push(...validateModuleArtifact(allManifests));
+      // The module doc's `native:` block: each rule decides whether a platform's
+      // file can ever match a host, or whether two layers would write one path.
+      diagnostics.push(...validateNativeEntries(allManifests, rootModules));
+      // The module doc's `sources:` block: where each staged file comes from.
+      diagnostics.push(...validateSourceEntries(allManifests, rootModules));
       // The descriptive `metadata:` surface. Nothing in the kernel branches on
       // these fields, which is precisely why they need a check: a mistyped one
       // has no runtime failure mode that would ever surface it.
@@ -1815,9 +1825,7 @@ export class StaticAnalyzer {
       // `kind`/CEL are authored in that module's scope (e.g. `Self.X` → that module, not the
       // consumer). Re-validating against the consumer's scope yields false UNDEFINED_KIND /
       // scope-mismatch errors, so skip — they participate here only as resolution targets.
-      if ((m.metadata as { forwardedExport?: boolean } | undefined)?.forwardedExport === true) {
-        continue;
-      }
+      if (isForwardedDeclaration(m)) continue;
 
       // A kind-only stand-in for a `resources:` entry is a DECLARATION, not an
       // instantiation: its kind is routinely an abstract and its configuration
@@ -2586,9 +2594,17 @@ export class StaticAnalyzer {
               if (!read) continue;
               // An import's exported instance is indexed under `<Alias>.<name>`,
               // the two-level shape it publishes under, so a cross-module read
-              // is checked exactly like a local one.
+              // is checked exactly like a local one. A bare name read inside a
+              // dependency's own manifest names that dependency's resource.
+              const readerModule = isForwardedDeclaration(m)
+                ? (m.metadata?.module as string | undefined)
+                : undefined;
               const reported = observedState.get(
-                read.alias ? `${read.alias}.${read.name}` : read.name,
+                read.alias
+                  ? `${read.alias}.${read.name}`
+                  : readerModule !== undefined
+                    ? forwardedResourceKey(readerModule, read.name)
+                    : read.name,
               );
 
               if (celRuleApplies && celEvalModeAt(celSites, path) === "compile") {
@@ -2871,6 +2887,14 @@ export class StaticAnalyzer {
       ),
     );
 
+    // An inline declaration referencing a name declared by a scope it was
+    // written inside but is created outside of.
+    diagnostics.push(
+      ...validateScopedNameReach(allManifests, defs, aliases, aliasesByModule, rootModules, (expr) =>
+        celAccessChains(this.celEnv, expr),
+      ),
+    );
+
     // Reroute diagnostics on synthetic (inline-extracted) resources back to
     // the chain root so position-index lookups land on the parent doc.
     return rewriteSyntheticOrigins(

package/src/artifact-axes.ts

@@ -0,0 +1,24 @@
+// GENERATED by scripts/generate-artifact-axes.mjs from analyzer/artifact-axes/axes.json — do not edit.
+
+/** The selector platform axes, in canonical order. Closed as a set of axis
+ *  names; the set of values stays open. */
+export const PLATFORM_AXES = ["os", "arch", "libc", "abi"] as const;
+
+export type PlatformAxis = (typeof PLATFORM_AXES)[number];
+
+/** A form an axis value must take beyond the shared token grammar. */
+export interface AxisValueForm {
+  readonly pattern: RegExp;
+  /** The form as a reader writes it, e.g. `<family>-<version>`. */
+  readonly form: string;
+  readonly examples: readonly string[];
+}
+
+/** The axes whose values carry a form of their own. */
+export const AXIS_VALUE_FORMS: Readonly<Partial<Record<PlatformAxis, AxisValueForm>>> = {
+  abi: {
+    pattern: new RegExp("^[a-z][a-z0-9_]*-[0-9]+(\\.[0-9]+)*$"),
+    form: "<family>-<version>",
+    examples: ["node-137", "telo-2"],
+  },
+};

package/src/artifact-layer-index.ts

@@ -29,7 +29,6 @@
  */
 
 import {
-  LAYER_ROLES,
   isLayerRole,
   normalizeSelector,
   roleCarriesSelector,
@@ -48,7 +47,7 @@ const CONTENT_DIGEST = /^sha256-[A-Za-z0-9_-]{43}$/;
 
 export interface ArtifactLayer {
   role: LayerRole;
-  /** Present on the code-bearing roles (`controller`, `library`) only. */
+  /** Present on the selector-keyed roles (`controller`, `library`, `native`) only. */
   selector?: ArtifactSelector;
   /** OCI blob digest — addresses the layer and verifies the transfer. */
   blob: string;
@@ -101,10 +100,12 @@ export function parseLayerIndex(value: unknown, describe = "layers"): ArtifactLa
     const entry = raw as Record<string, unknown>;
     if (typeof entry.role !== "string" || entry.role === "") {
       throw new LayerIndexError(
-        `${where}: role is required and must be one of ${LAYER_ROLES.map((r) => `'${r}'`).join(", ")}; ` +
+        `${where}: role is required and must be a non-empty string; ` +
           `got ${entry.role === undefined ? "nothing" : `'${String(entry.role)}'`}.`,
       );
     }
+    const blob = digest("blob", entry.blob, where);
+    const integrity = digest("integrity", entry.integrity, where);
     // A role this runtime does not know is SKIPPED, never rejected. Roles are
     // added over time, and a runtime that cannot name one cannot need it — while
     // throwing would make the whole manifest unreadable, so a module gaining a
@@ -120,6 +121,8 @@ export function parseLayerIndex(value: unknown, describe = "layers"): ArtifactLa
         throw new LayerIndexError(`${where}: a ${role} layer must declare a selector.`);
       }
       selector = normalizeSelector(entry.selector, where);
+      // An unknown axis skips the entry as an unknown role does (spec §3.1).
+      if (selector === undefined) return;
       // Scoped by role: a module's `js` controller layer and its `js` library
       // layer are different layers with the same selector, and only a collision
       // *within* one role means two layers claim one address.
@@ -146,8 +149,8 @@ export function parseLayerIndex(value: unknown, describe = "layers"): ArtifactLa
     layers.push({
       role,
       ...(selector ? { selector } : {}),
-      blob: digest("blob", entry.blob, where),
-      integrity: digest("integrity", entry.integrity, where),
+      blob,
+      integrity,
     });
   });
 
@@ -157,7 +160,7 @@ export function parseLayerIndex(value: unknown, describe = "layers"): ArtifactLa
 /** The singleton layer for a role, or undefined when the artifact has none. */
 export function singletonLayer(
   layers: readonly ArtifactLayer[],
-  role: Exclude<LayerRole, "controller" | "library">,
+  role: Exclude<LayerRole, "controller" | "library" | "native">,
 ): ArtifactLayer | undefined {
   return layers.find((l) => l.role === role);
 }