@velarscript/cli 0.14.1 → 0.14.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@velarscript/cli",
-  "version": "0.14.1",
+  "version": "0.14.3",
   "description": "The VelarScript command-line compiler, dev server, test runner, and language server.",
   "license": "Apache-2.0",
   "type": "module",
@@ -30,13 +30,13 @@
     "velar": "./dist/cli.js"
   },
   "dependencies": {
-    "@velarscript/compiler": "0.14.1",
-    "@velarscript/core": "0.14.1",
-    "@velarscript/desktop": "0.14.1",
-    "@velarscript/node": "0.14.1",
-    "@velarscript/server": "0.14.1",
-    "@velarscript/web": "0.14.1",
-    "create-velar": "0.14.1",
+    "@velarscript/compiler": "0.14.3",
+    "@velarscript/core": "0.14.3",
+    "@velarscript/desktop": "0.14.3",
+    "@velarscript/node": "0.14.3",
+    "@velarscript/server": "0.14.3",
+    "@velarscript/web": "0.14.3",
+    "create-velar": "0.14.3",
     "esbuild": "^0.28.1",
     "playwright": "^1.58.2"
   }

package/skill/ai-skill-node.md

@@ -157,7 +157,11 @@ repeated fields for `List<scalar>` properties; duplicate scalar fields fail.
 `input.upload` returns an `Upload` whose bytes are valid only for the request
 lifetime; copy or persist them before retaining data. `security.apiKey`,
 `basic`, `bearer`, `oauth2`, and `openId` parse credentials and also
-feed OpenAPI security schemes.
+feed OpenAPI security schemes. They do not verify a password, token signature,
+issuer, audience, session, or user record. An application using the explicit
+Server extension composes a descriptor with its installed verifier through
+`authenticate`; low-level Node code may perform the same policy in an ordinary
+request Provider.
 
 `provide(inputs, resolve, scope="request", release=null, eager=false)` declares
 a dependency as data. A request-scoped provider resolves once per request even

package/skill/ai-skill-server.md

@@ -13,7 +13,7 @@ browser application activates `@velarscript/web`:
 ```json
 {
   "dependencies": {
-    "@velarscript/server": "0.14.1"
+    "@velarscript/server": "0.14.2"
   }
 }
 ```
@@ -103,6 +103,50 @@ types, and application validation still owns domain ranges and invariants.
 Environment variables may form an explicit deployment override layer, but
 secrets do not belong in application configuration.
 
+## Request authentication
+
+Node's `security` values own credential extraction, malformed-input rejection,
+401 challenges, and OpenAPI descriptions. Server's `authenticate` composes one
+of those descriptors with an application- or package-provided verifier:
+
+```velar
+import {authenticate} from "velar/server"
+import {input, security} from "velar/serve"
+
+type Principal:
+    subject: string
+
+const exampleTokens: Map<string, Principal> = Map([
+    ["example-test-token", {subject: "user-1"}],
+])
+
+async def verifyAccessToken(token: string) -> Principal?:
+    // A deployed application replaces this test map with an installed verifier.
+    return exampleTokens.get(token)
+
+const currentPrincipal = authenticate(security.bearer(), verifyAccessToken)
+
+export server accountRoutes:
+    @get(p"/me", principal=input.dependency(currentPrincipal)) => {
+        subject: principal.subject,
+    }
+```
+
+`authenticate(credential, verify)` accepts only a `security.apiKey`, `basic`,
+`bearer`, `oauth2`, or `openId` descriptor. `verify` must return
+`Promise<Identity?>`. It resolves once per request: `null` becomes the same
+opaque `not_authenticated` 401 response and `WWW-Authenticate` challenge as a
+missing credential, while a non-null value becomes the typed request Provider
+result. A thrown verifier failure remains an opaque 500 because a key-service,
+database, or network failure is not proof of an invalid credential.
+
+The verified identity shape belongs to the application. JWT/JWK and OIDC
+verification, password hashing, signed sessions, and vendor integrations are
+explicit installed packages; user storage, tenant membership, roles,
+permissions, revocation, and resource-level authorization remain application
+policy. Do not place secrets in `application.yml`, invent a universal `User`
+record, or turn authentication into new route syntax or `@` roles.
+
 ## Abstract database connection lifecycle
 
 `database(connect, disconnect)` creates an eager application-scoped

package/skill/ai-skill.md

@@ -62,13 +62,16 @@ protects these names. Capabilities stay explicit imports. Durations use `ms` or
 Use checked binary, random, and task APIs. Project-specific codecs, storage,
 and algorithms come from project-owned modules or dependencies. A direct
 `for index in range(...):` is a native counter; range as a value is a List. Use `UInt16Buffer` for 16-bit numeric state,
-`UInt8Buffer` for compact data, and bounded `UInt32Builder`/`Float32Builder` values for variable-size numeric output.
+`UInt8Buffer` for compact data, and bounded `UInt32Builder`/`Float32Builder` values for variable-size numeric output. A fixed numeric buffer's `values()` returns one fresh `List<number>` snapshot; do not write an index loop just to copy it.
 
 ## Project setup
 
 A VelarScript project is a directory containing a `velar.json` manifest. Let
 the toolchain write it — `velar create my-lib --template library` scaffolds a
-Core source library; other templates select their own framework brief. Each writes
+Core library whose release keeps `.vel` source plus a frozen ABI-1 JavaScript
+artifact; `velar build-library` regenerates its JS, source map, portable type
+interface, and hash receipt. Later toolchains load that interface and JS before
+considering source fallback. Other templates select their own framework brief. Each writes
 `velar.json`, a `package.json` whose scripts are the gates, a `src/` tree, a
 passing test, and an `AGENTS.md`.
 
@@ -99,8 +102,11 @@ module; the body may `await` directly and needs no `export`. A file that declare
 
 Everything in this table was hit by real models writing Vel blind. Most rows
 produce a teaching diagnostic, so `velar check` will catch them; the rows
-marked **A1**, **A2**, **A3**, **A5**, and **A6** are answered by an advisory
-instead, which reports without failing the check. Two rows are still silent —
+marked **A1**, **A2**, **A3**, **A5**, **A6**, **A7**, **A8**, and **A9** are
+answered by an advisory instead, which reports without failing the check. A7
+through A9 are canonical-form checks rather than foreign-language traps: they
+fire only for a proven collection conversion, existential List query, or exact
+record projection. Two rows are still silent —
 nothing is reported at all and the program runs with the other meaning:
 `a // b` where the divisor is a name rather than arithmetic, and a collection
 `==` between two bindings, since only a collection literal written inside the
@@ -118,6 +124,9 @@ well, but it is a guarantee rather than a trap.
 | `interface X:`, `record X:`, `struct X:` | `type X:` — one keyword for record shapes and aliases. |
 | `items.length` | `items.size` (also on strings, Sets, Maps). |
 | `items.push(x)` | `items.append(x)`. There is no `splice`/`shift`/`unshift`/mutating `sort`; use `insert`, `pop`, `remove`, `extend`, and the copying `sorted()`/`reversed()`. |
+| Empty collection + identity-only copy loop (**A7**) | Initialize from the built-in conversion. A `Set<T>` becomes a fresh `List<T>` with `set.values()`; a List becomes a Set with `Set(list)`; List/Set/Map snapshots use `.copy()`, `.keys()`, or `.values()`; and a Record becomes a Map with `Map(record)`. The advisory requires the empty declaration immediately before a one-statement loop over a plain source name. It stays silent for transforms, filters, effects, non-empty destinations, computed sources, or any intervening statement. |
+| `for item in items: if test: return true` followed by `return false` (**A8**) | `return items.some(item => test)`. The advisory requires a synchronous single-slot loop over a plain List name, an exact one-`if` body, literal `true`/`false` returns, and a non-optional bool condition built only from data reads and operators. Calls, class getters, effects, `bool?`, wider bodies, computed sources, and non-adjacent returns stay silent. |
+| `return {worldId, position: sample.position, ...}` for a closed response type (**A9**) | `return Response.from(sample, {worldId})`. A concrete record Type projects only its declared fields from a statically typed record; the optional second argument is an explicit override literal. It is shallow construction, not validation: use `Type.parse` for `unknown`. A9 requires every target field, at least two same-name fields from one source, and only identifier/literal overrides; transforms, calls, spreads, partial targets, and mixed sources stay silent. `.from` emits target declaration order, so suppress A9 with a reason only when authored wire order is intentional. |
 | `{retry: 1, timeoutMs: 30}` where the type declares `timeout` | A record literal written at an annotated position is closed: an undeclared key is reported, and the nearest declared field named when one is near enough — `Type 'Options' has no field 'timeoutMs'; did you mean 'timeout'?`, against a bare `Type 'Options' has no field 'extra'` when no declared name is close. The annotation may sit on the binding, the parameter, the result, or the collection the literal is written into. A value that is not a literal stays structurally open, so passing a record that happens to carry more is unaffected. |
 | `const items = []`, `const tags = Set()` | An empty collection takes its type where it is written: `const items: List<string> = []`. A later `append`/`add`/`set` never types the declaration. A contextual position supplies it too, so `take(Set())` and `return Map()` need no annotation. |
 | `if value:` truthiness | Conditions accept only `bool`/`bool?`. Test presence explicitly: `if value != null:`. |
@@ -125,7 +134,7 @@ well, but it is a guarantee rather than a trap.
 | `switch`, or an `if`/`else if` ladder over an enum | `match` with `case _:` as the only fallback. |
 | Renaming a binding away from `type`, `json`, `from`, `match`, or `as` | Don't. Declaration words are contextual: each declares only in its own shape, so `const {type, from} = event` is ordinary code. `enum` and `case` are the exceptions — `enum` is a real VelarScript keyword and `case` is reserved by JavaScript — so neither can be a binding name; both stay fine as record fields, member names, and `match` branches. |
 | Treating `@` as a decorator, call, value, or user extension point | `@` has one meaning: `@name` qualifies the name into the closed compiler-owned namespace of the current context. Core or the active syntax-owning compiler extension owns the vocabulary; source cannot declare, import, alias, pass, or construct an `@name`. The class contracts `@dispose:` and `@iterate:` follow this one rule. |
-| Two statements on one line | One statement per line; there are no semicolons. The compact exceptions are `if condition: action()` and `case pattern: action()` for a single non-block branch statement. A line starting with `.` or `?.` continues the previous line, so method chains format normally. |
+| Two statements on one line | One statement per line; there are no semicolons. As in Python, an ordinary executable suite may keep its one non-block statement after the colon, as in `def stop(): return`, `if condition: action()`, or `case pattern: action()`. Multiple statements, nested blocks, and structural member or branch lists use indentation. Formatting preserves the author's single-line or indented choice. A line starting with `.` or `?.` continues the previous line, so method chains format normally. |
 | `count++` | `count += 1` |
 | `call(name: value)` named argument | `call(name=value)` |
 | Importing `range` | `range(...)` is a Core prelude function and needs no import. |
@@ -208,6 +217,28 @@ def load(untrusted: unknown) -> User:
     return User.parse(untrusted)
 ```
 
+Build one closed record from another typed record with the target-owned exact
+projection. Overrides are explicit; surplus source fields never enter the
+result:
+
+```velar
+type SourceUser:
+    id: string
+    name: string
+    internalToken: string
+
+type PublicUser:
+    id: string
+    name: string
+    requestId: string
+
+def publicUser(source: SourceUser, requestId: string) -> PublicUser:
+    return PublicUser.from(source, {requestId})
+```
+
+`Type.from` is shallow and compile-time checked. It does not accept `unknown`;
+validate untrusted data with `Type.parse` first.
+
 `enum` declares finite string-backed states; a member may map an external
 wire spelling without losing its nominal identity: