@velarscript/cli 0.14.0 → 0.14.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@velarscript/cli",
-  "version": "0.14.0",
+  "version": "0.14.2",
   "description": "The VelarScript command-line compiler, dev server, test runner, and language server.",
   "license": "Apache-2.0",
   "type": "module",
@@ -30,13 +30,13 @@
     "velar": "./dist/cli.js"
   },
   "dependencies": {
-    "@velarscript/compiler": "0.14.0",
-    "@velarscript/core": "0.14.0",
-    "@velarscript/desktop": "0.14.0",
-    "@velarscript/node": "0.14.0",
-    "@velarscript/server": "0.14.0",
-    "@velarscript/web": "0.14.0",
-    "create-velar": "0.14.0",
+    "@velarscript/compiler": "0.14.2",
+    "@velarscript/core": "0.14.2",
+    "@velarscript/desktop": "0.14.2",
+    "@velarscript/node": "0.14.2",
+    "@velarscript/server": "0.14.2",
+    "@velarscript/web": "0.14.2",
+    "create-velar": "0.14.2",
     "esbuild": "^0.28.1",
     "playwright": "^1.58.2"
   }

package/skill/ai-skill-server.md

@@ -13,7 +13,7 @@ browser application activates `@velarscript/web`:
 ```json
 {
   "dependencies": {
-    "@velarscript/server": "0.14.0"
+    "@velarscript/server": "0.14.2"
   }
 }
 ```

package/skill/ai-skill.md

@@ -62,13 +62,16 @@ protects these names. Capabilities stay explicit imports. Durations use `ms` or
 Use checked binary, random, and task APIs. Project-specific codecs, storage,
 and algorithms come from project-owned modules or dependencies. A direct
 `for index in range(...):` is a native counter; range as a value is a List. Use `UInt16Buffer` for 16-bit numeric state,
-`UInt8Buffer` for compact data, and bounded `UInt32Builder`/`Float32Builder` values for variable-size numeric output.
+`UInt8Buffer` for compact data, and bounded `UInt32Builder`/`Float32Builder` values for variable-size numeric output. A fixed numeric buffer's `values()` returns one fresh `List<number>` snapshot; do not write an index loop just to copy it.
 
 ## Project setup
 
 A VelarScript project is a directory containing a `velar.json` manifest. Let
 the toolchain write it — `velar create my-lib --template library` scaffolds a
-Core source library; other templates select their own framework brief. Each writes
+Core library whose release keeps `.vel` source plus a frozen ABI-1 JavaScript
+artifact; `velar build-library` regenerates its JS, source map, portable type
+interface, and hash receipt. Later toolchains load that interface and JS before
+considering source fallback. Other templates select their own framework brief. Each writes
 `velar.json`, a `package.json` whose scripts are the gates, a `src/` tree, a
 passing test, and an `AGENTS.md`.
 
@@ -99,8 +102,11 @@ module; the body may `await` directly and needs no `export`. A file that declare
 
 Everything in this table was hit by real models writing Vel blind. Most rows
 produce a teaching diagnostic, so `velar check` will catch them; the rows
-marked **A1**, **A2**, **A3**, **A5**, and **A6** are answered by an advisory
-instead, which reports without failing the check. Two rows are still silent —
+marked **A1**, **A2**, **A3**, **A5**, **A6**, **A7**, **A8**, and **A9** are
+answered by an advisory instead, which reports without failing the check. A7
+through A9 are canonical-form checks rather than foreign-language traps: they
+fire only for a proven collection conversion, existential List query, or exact
+record projection. Two rows are still silent —
 nothing is reported at all and the program runs with the other meaning:
 `a // b` where the divisor is a name rather than arithmetic, and a collection
 `==` between two bindings, since only a collection literal written inside the
@@ -118,6 +124,9 @@ well, but it is a guarantee rather than a trap.
 | `interface X:`, `record X:`, `struct X:` | `type X:` — one keyword for record shapes and aliases. |
 | `items.length` | `items.size` (also on strings, Sets, Maps). |
 | `items.push(x)` | `items.append(x)`. There is no `splice`/`shift`/`unshift`/mutating `sort`; use `insert`, `pop`, `remove`, `extend`, and the copying `sorted()`/`reversed()`. |
+| Empty collection + identity-only copy loop (**A7**) | Initialize from the built-in conversion. A `Set<T>` becomes a fresh `List<T>` with `set.values()`; a List becomes a Set with `Set(list)`; List/Set/Map snapshots use `.copy()`, `.keys()`, or `.values()`; and a Record becomes a Map with `Map(record)`. The advisory requires the empty declaration immediately before a one-statement loop over a plain source name. It stays silent for transforms, filters, effects, non-empty destinations, computed sources, or any intervening statement. |
+| `for item in items: if test: return true` followed by `return false` (**A8**) | `return items.some(item => test)`. The advisory requires a synchronous single-slot loop over a plain List name, an exact one-`if` body, literal `true`/`false` returns, and a non-optional bool condition built only from data reads and operators. Calls, class getters, effects, `bool?`, wider bodies, computed sources, and non-adjacent returns stay silent. |
+| `return {worldId, position: sample.position, ...}` for a closed response type (**A9**) | `return Response.from(sample, {worldId})`. A concrete record Type projects only its declared fields from a statically typed record; the optional second argument is an explicit override literal. It is shallow construction, not validation: use `Type.parse` for `unknown`. A9 requires every target field, at least two same-name fields from one source, and only identifier/literal overrides; transforms, calls, spreads, partial targets, and mixed sources stay silent. `.from` emits target declaration order, so suppress A9 with a reason only when authored wire order is intentional. |
 | `{retry: 1, timeoutMs: 30}` where the type declares `timeout` | A record literal written at an annotated position is closed: an undeclared key is reported, and the nearest declared field named when one is near enough — `Type 'Options' has no field 'timeoutMs'; did you mean 'timeout'?`, against a bare `Type 'Options' has no field 'extra'` when no declared name is close. The annotation may sit on the binding, the parameter, the result, or the collection the literal is written into. A value that is not a literal stays structurally open, so passing a record that happens to carry more is unaffected. |
 | `const items = []`, `const tags = Set()` | An empty collection takes its type where it is written: `const items: List<string> = []`. A later `append`/`add`/`set` never types the declaration. A contextual position supplies it too, so `take(Set())` and `return Map()` need no annotation. |
 | `if value:` truthiness | Conditions accept only `bool`/`bool?`. Test presence explicitly: `if value != null:`. |
@@ -125,7 +134,7 @@ well, but it is a guarantee rather than a trap.
 | `switch`, or an `if`/`else if` ladder over an enum | `match` with `case _:` as the only fallback. |
 | Renaming a binding away from `type`, `json`, `from`, `match`, or `as` | Don't. Declaration words are contextual: each declares only in its own shape, so `const {type, from} = event` is ordinary code. `enum` and `case` are the exceptions — `enum` is a real VelarScript keyword and `case` is reserved by JavaScript — so neither can be a binding name; both stay fine as record fields, member names, and `match` branches. |
 | Treating `@` as a decorator, call, value, or user extension point | `@` has one meaning: `@name` qualifies the name into the closed compiler-owned namespace of the current context. Core or the active syntax-owning compiler extension owns the vocabulary; source cannot declare, import, alias, pass, or construct an `@name`. The class contracts `@dispose:` and `@iterate:` follow this one rule. |
-| Two statements on one line | One statement per line; there are no semicolons. A line starting with `.` or `?.` continues the previous line, so method chains format normally. |
+| Two statements on one line | One statement per line; there are no semicolons. As in Python, an ordinary executable suite may keep its one non-block statement after the colon, as in `def stop(): return`, `if condition: action()`, or `case pattern: action()`. Multiple statements, nested blocks, and structural member or branch lists use indentation. Formatting preserves the author's single-line or indented choice. A line starting with `.` or `?.` continues the previous line, so method chains format normally. |
 | `count++` | `count += 1` |
 | `call(name: value)` named argument | `call(name=value)` |
 | Importing `range` | `range(...)` is a Core prelude function and needs no import. |
@@ -208,6 +217,28 @@ def load(untrusted: unknown) -> User:
     return User.parse(untrusted)
 ```
 
+Build one closed record from another typed record with the target-owned exact
+projection. Overrides are explicit; surplus source fields never enter the
+result:
+
+```velar
+type SourceUser:
+    id: string
+    name: string
+    internalToken: string
+
+type PublicUser:
+    id: string
+    name: string
+    requestId: string
+
+def publicUser(source: SourceUser, requestId: string) -> PublicUser:
+    return PublicUser.from(source, {requestId})
+```
+
+`Type.from` is shallow and compile-time checked. It does not accept `unknown`;
+validate untrusted data with `Type.parse` first.
+
 `enum` declares finite string-backed states; a member may map an external
 wire spelling without losing its nominal identity: