aontu 0.57.0 → 0.58.0

package/dist/lang.js

@@ -72,6 +72,7 @@ const ReferFuncVal_1 = require("./val/ReferFuncVal");
 const GraphAtomVal_1 = require("./val/GraphAtomVal");
 const PackFuncVal_1 = require("./val/PackFuncVal");
 const EachFuncVal_1 = require("./val/EachFuncVal");
+const FormFuncVal_1 = require("./val/FormFuncVal");
 const FilterFuncVal_1 = require("./val/FilterFuncVal");
 const MatchFuncVal_1 = require("./val/MatchFuncVal");
 const EmitFuncVal_1 = require("./val/EmitFuncVal");
@@ -125,10 +126,109 @@ const CC_d = 100;
 const CC_D = 68;
 // THE ALIAS SIGIL. `%` is part of an alias's name, so the name is one
 // lexeme wherever it appears and its meaning is decided by position:
-// a BINDING in key position (`%uint8: …` declares), a USE in value
+// a BINDING in key position (`%uint8 = …` declares), a USE in value
 // position (`listen: %uint8` refers). docs/design/ALIASES.0.md §4.
 const CC_PCT = 37;
 const ALIAS_RE = /^%[A-Za-z_][A-Za-z0-9_]*/;
+// THE DECLARATION OPERATOR. `%name = value` declares; the `=` is the
+// pair's separator, lexed as the colon token so the declaration then
+// parses as a pair whose key is the alias name (ALIASES.0.md X-1, as
+// settled 2026-09-05). `=` is syntax ONLY there: anywhere else it is
+// punctuation outside its syntax, and the bare-text scan below refuses
+// it (`foo = 1`, `a: x=y`).
+const CC_EQ = 61;
+const CC_SP = 32;
+const CC_TAB = 9;
+// THE BARE-TEXT RULE. A bare string holds letters, digits, `-` and `_`,
+// and nothing else. Every other punctuation character is either SYNTAX,
+// where the grammar gives it a meaning, or an ERROR where it does not
+// -- never silently part of a string. `x=y`, `6/2`, `50%` and `>10`
+// were all bare strings once, each a well-formed wrong document, and
+// each is refused now, naming the character (bare_punct).
+//
+// scanBareRun classifies each character of a run three ways, in this
+// order: TEXT continues the run; an ENDER stops it; anything else is
+// BAD. The ender set is the lexer's own -- space, line, fixed tokens,
+// comment starters -- read from the config its text matcher was built
+// from, so it cannot drift from the grammar. A bad run is still scanned
+// to its ender, so the refusal claims the whole spelling and the lexer
+// never reads the tail of it as syntax.
+//
+// `-` is text wherever the scan sees it. A run never STARTS on one:
+// `-` is the sign of a number and the negation prefix, a fixed token
+// the fixed matcher claims before either scanning stage can run, so
+// `a:-1` is the negation of 1 and `a:6-2` the string. The `+` of an
+// exponent (`1e+2`) is admitted only by the NUMBER stage's scan, the
+// one stage that can make a number of it. Mirrors scanBareRun in
+// go/lang.go, decision for decision.
+const CC_9 = 57;
+const CC_A = 65;
+const CC_Z = 90;
+const CC_a = 97;
+const CC_z = 122;
+const CC_E = 69;
+const CC_e = 101;
+const CC_US = 95;
+const CC_MINUS = 45;
+const CC_PLUS = 43;
+// Beyond ASCII a letter, a digit or a combining mark is text (`café`);
+// a dash, a symbol or a space of any other kind is not.
+const UNICODE_TEXT_RE = /^[\p{L}\p{N}\p{M}]$/u;
+function textChar(c) {
+    return (CC_0 <= c && c <= CC_9) ||
+        (CC_a <= c && c <= CC_z) ||
+        (CC_A <= c && c <= CC_Z) ||
+        CC_US === c ||
+        CC_MINUS === c ||
+        (127 < c && UNICODE_TEXT_RE.test(String.fromCodePoint(c)));
+}
+// The lexer's text ender, at i. The regexp is the text matcher's own
+// ender alternation (cfg.rePart.ender) made sticky, built once per
+// config and cached on it.
+function enderAt(cfg, src, i) {
+    let re = cfg.aontu_ender_re;
+    if (null == re) {
+        re = cfg.aontu_ender_re = new RegExp(cfg.rePart.ender.join(''), 'y');
+    }
+    re.lastIndex = i;
+    return re.test(src);
+}
+function scanBareRun(cfg, src, start, expo) {
+    let i = start;
+    let bad = -1;
+    let ch = '';
+    while (i < src.length) {
+        const c = src.codePointAt(i);
+        const w = 0xffff < c ? 2 : 1;
+        if (textChar(c)) {
+            i += w;
+            continue;
+        }
+        if (expo && CC_PLUS === c && start < i) {
+            const p = src.charCodeAt(i - 1);
+            const n = src.charCodeAt(i + 1);
+            if ((CC_e === p || CC_E === p) && CC_0 <= n && n <= CC_9) {
+                i += 1;
+                continue;
+            }
+        }
+        if (enderAt(cfg, src, i)) {
+            break;
+        }
+        if (-1 === bad) {
+            bad = i;
+            ch = String.fromCodePoint(c);
+        }
+        i += w;
+    }
+    return { end: i, bad, ch };
+}
+// A run the number matcher may lex: its own number grammar, less the
+// fraction -- `.` is a fixed token, so a run never holds one, and the
+// matcher reads it past the run by itself (`1.5` is the run `1`).
+const NUMBER_RUN_RE = /^[-+]?(?:0(?:[xX][0-9a-fA-F_]+|[oO][0-7_]+|[bB][01_]+)|[0-9][0-9_]*(?:[eE][-+]?[0-9][0-9_]*)?)$/;
+// The number matcher's hook result where the run is not its to lex.
+const NOT_A_NUMBER = { done: true, token: undefined };
 let AontuJsonic = function AontuLang(jsonic) {
     jsonic.use(asPlugin(path_1.Path));
     // Only # line comments are valid Aontu syntax (see
@@ -203,6 +303,34 @@ let AontuJsonic = function AontuLang(jsonic) {
             // matched case-insensitively so the rule does not depend on which
             // prefix spellings the engine accepts.
             exclude: /__|^[-+]?0[xXoObB]_|_$/,
+            // THE NUMBER STAGE OF THE BARE-TEXT RULE. The matcher runs before
+            // the text matcher and reads a number up to the next ender -- and
+            // `-` is an ender, being the negation prefix's fixed token, so it
+            // would take the `2026` of `2026-09-05` and leave `-09-05` to the
+            // grammar. The hook scans the whole run first and declines for
+            // the matcher wherever the run is not its to lex: a run with a
+            // bad character (the text stage refuses it), a run that is not a
+            // number at all (`2026-09-05`, `6-2` are text). Twin of tsNumCheck
+            // in go/lang.go.
+            check: (lex) => {
+                const pnt = lex.pnt;
+                const src = lex.src;
+                // The hook makes the matcher a candidate at every position, so
+                // the common case -- a run no number can open -- declines for it
+                // in one char read. A DIGIT opens a number here and nothing
+                // else: the sign and the dot open the matcher's own grammar, but
+                // they are fixed tokens (the prefix operators and member
+                // access), claimed before this hook can run.
+                const c = src.charCodeAt(pnt.sI);
+                if (!(CC_0 <= c && c <= CC_9)) {
+                    return NOT_A_NUMBER;
+                }
+                const run = scanBareRun(lex.cfg, src, pnt.sI, true);
+                if (-1 !== run.bad || !NUMBER_RUN_RE.test(src.slice(pnt.sI, run.end))) {
+                    return NOT_A_NUMBER;
+                }
+                return undefined;
+            },
         },
     });
     // D3 -- the `0d` literal, the only route to the exact leaves
@@ -255,12 +383,25 @@ let AontuJsonic = function AontuLang(jsonic) {
                 // the token's source text (`0d1: 5` yields the key `0d1`), so a
                 // declaration reads as the key `%uint8`, while a value position
                 // calls the function below and gets the reference.
-                if (CC_PCT === src.charCodeAt(pnt.sI)) {
-                    const ares = ALIAS_RE.exec(lex.refwd());
-                    if (null == ares) {
-                        return undefined;
-                    }
+                // A `%` that opens no name (`%`, `%1`, `50%`) falls through to
+                // the bare-text scan below, which refuses it.
+                const ares = CC_PCT === src.charCodeAt(pnt.sI) ?
+                    ALIAS_RE.exec(lex.refwd()) : null;
+                if (null != ares) {
                     const asrc = ares[0];
+                    // A lone `=` after the name, across horizontal space only, is
+                    // the declaration operator. Decided HERE, where the name is
+                    // claimed, and only its position is kept: the very next text
+                    // position is that `=`, since nothing but space sits between,
+                    // so the mark cannot outlive its one use. `==` is not it.
+                    let j = pnt.sI + asrc.length;
+                    while (j < src.length &&
+                        (CC_SP === src.charCodeAt(j) || CC_TAB === src.charCodeAt(j))) {
+                        j++;
+                    }
+                    if (CC_EQ === src.charCodeAt(j) && CC_EQ !== src.charCodeAt(j + 1)) {
+                        lex.aontu_eq_at = j;
+                    }
                     const atkn = lex.token('#VL', 
                     // AN ALIAS REFERENCE IS A PATH REFERENCE. `%uint8` is
                     // `$.%uint8`: root-absolute, one segment, spelled with the
@@ -274,53 +415,129 @@ let AontuJsonic = function AontuLang(jsonic) {
                     pnt.cI += asrc.length;
                     return { done: true, token: atkn };
                 }
-                if (CC_0 !== src.charCodeAt(pnt.sI)) {
-                    return undefined;
+                // The `=` the alias arm above marked: the separator of a
+                // declaration, as a colon token whose source is `=`. The pair rule
+                // is then the pair rule, and the formatter writes the spelling it
+                // read. Marked in `use` so the pair rule can tell it from a colon,
+                // which no longer declares.
+                if (CC_EQ === src.charCodeAt(pnt.sI) && lex.aontu_eq_at === pnt.sI) {
+                    delete lex.aontu_eq_at;
+                    const eqtkn = lex.token('#CL', undefined, '=', pnt, { aontu_eq: true });
+                    pnt.sI += 1;
+                    pnt.cI += 1;
+                    return { done: true, token: eqtkn };
+                }
+                if (CC_0 === src.charCodeAt(pnt.sI)) {
+                    const c1 = src.charCodeAt(pnt.sI + 1);
+                    if (CC_d === c1 || CC_D === c1) {
+                        // BIG_LITERAL_RE is `^`-anchored and read against the
+                        // forward source (memoized per position by refwd), which is
+                        // what lets it claim the `.` of `0d1.5`. A `0d` run it does
+                        // not match falls through to the bare-text scan below.
+                        const res = Decimal_1.BIG_LITERAL_RE.exec(lex.refwd());
+                        if (null != res) {
+                            const msrc = res[0];
+                            // The token value is a FUNCTION so Val construction
+                            // happens at parse time, where the rule and context needed
+                            // for the site exist (jsonic calls a #VL token's function
+                            // value with them). A `0d` literal never spans a line, so
+                            // only the source and column positions advance.
+                            const tkn = lex.token('#VL', (r, ctx) => addsite(bigVal(res), r, ctx), msrc, pnt);
+                            pnt.sI += msrc.length;
+                            pnt.cI += msrc.length;
+                            return { done: true, token: tkn };
+                        }
+                    }
                 }
-                const c1 = src.charCodeAt(pnt.sI + 1);
-                if (CC_d !== c1 && CC_D !== c1) {
-                    return undefined;
+                // THE BARE-TEXT RULE (scanBareRun). Last, so that a name, a
+                // declaration operator and an exact literal are read before a
+                // run is judged as text.
+                // The run is never empty: every ender is a token an earlier
+                // matcher claims, so the text stage only opens on a character
+                // the scan classifies as text or as bad.
+                const run = scanBareRun(lex.cfg, src, pnt.sI, false);
+                const msrc = src.slice(pnt.sI, run.end);
+                if (-1 !== run.bad) {
+                    // BAD: the run is refused whole, sited at the character (the
+                    // mark in `use` is what tokenSite reads). As a VALUE the
+                    // token's function builds the refusal at the parse, where the
+                    // rule carries the position. As a KEY the token is read for
+                    // its source alone, so the mark is what the pair and elem
+                    // rules read to write the refusal where the map is built.
+                    const ch = run.ch;
+                    const tkn = lex.token('#VL', (r, ctx) => {
+                        const nv = addsite(new NilVal_1.NilVal({ why: 'bare_punct' }), r, ctx);
+                        nv.details = { char: ch, text: msrc };
+                        return nv;
+                    }, msrc, pnt, { aontu_bad: ch });
+                    pnt.sI += msrc.length;
+                    pnt.cI += msrc.length;
+                    return { done: true, token: tkn };
                 }
-                // BIG_LITERAL_RE is `^`-anchored and read against the forward
-                // source (memoized per position by refwd), which is what lets
-                // it claim the `.` of `0d1.5`.
-                const res = Decimal_1.BIG_LITERAL_RE.exec(lex.refwd());
-                if (null == res) {
-                    return undefined;
+                // CLEAN, with a `-` past its start (`team-payments`,
+                // `2026-09-05`): claimed here as one text token, because the
+                // default matcher's ender set would carve the run at the `-`.
+                // Any other clean run is the default matcher's, which also reads
+                // the value keywords and the `_` hole.
+                if (-1 !== msrc.indexOf('-')) {
+                    const tkn = lex.token('#TX', msrc, msrc, pnt);
+                    pnt.sI += msrc.length;
+                    pnt.cI += msrc.length;
+                    return { done: true, token: tkn };
                 }
-                const msrc = res[0];
-                // The token value is a FUNCTION so Val construction happens at
-                // parse time, where the rule and context needed for the site
-                // exist (jsonic calls a #VL token's function value with them).
-                // A `0d` literal never spans a line, so only the source and
-                // column positions advance.
-                const tkn = lex.token('#VL', (r, ctx) => addsite(bigVal(res), r, ctx), msrc, pnt);
-                pnt.sI += msrc.length;
-                pnt.cI += msrc.length;
-                return { done: true, token: tkn };
+                return undefined;
             },
         },
     });
-    // TODO: refactor Val constructor
-    // let addsite = (v: Val, p: string[]) => (v.path = [...(p || [])], v)
+    const NO_SITE = { row: -1, col: -1, src: '', len: -1 };
+    const tokenSite = (tkn) => {
+        const src = tkn.src;
+        const bad = tkn.use?.aontu_bad;
+        if (null != bad) {
+            const ch = '' + bad;
+            return { row: tkn.rI, col: tkn.cI + src.indexOf(ch), src: ch, len: ch.length };
+        }
+        return { row: tkn.rI, col: tkn.cI, src, len: '' === src ? -1 : src.length };
+    };
+    const siteAt = (v, ts) => {
+        v.site.row = ts.row;
+        v.site.col = ts.col;
+        v.site.src = ts.src;
+        v.site.len = ts.len;
+        return v;
+    };
     let addsite = (v, r, ctx) => {
-        v.site.row = null == r.o0 ? -1 : r.o0.rI;
-        v.site.col = null == r.o0 ? -1 : r.o0.cI;
-        v.site.url = ctx.meta.multisource ? ctx.meta.multisource.path : '';
-        // The source text, from the SAME token the row and column above
+        // The source text comes from the SAME token the row and column
         // come from. jsonic has carried it all along; not reading it is
         // what left a site uneditable (ts/src/site.ts).
-        //
-        // A TOKEN WITH NO TEXT IS NO SPAN, in both ports, and the extent is
-        // DERIVED from the text rather than read from the token's own `len`
-        // — so the Go twin, whose token has no len field, computes the
-        // identical number with utf16Len and nothing has to be kept in step.
-        v.site.src = null == r.o0 ? '' : r.o0.src;
-        v.site.len = '' === v.site.src ? -1 : v.site.src.length;
+        siteAt(v, null == r.o0 ? NO_SITE : tokenSite(r.o0));
+        v.site.url = ctx.meta.multisource ? ctx.meta.multisource.path : '';
         // A keyed rule always carries a path array; a keyless one has none.
         v.path = r.k ? [...r.k.path] : [];
         return v;
     };
+    // THE KEY REFUSALS a pair may carry, decided from its key TOKEN --
+    // never from the key text alone, since a quoted `"%a"` or `"x=y"` is
+    // an ordinary key: a declaration spelled with a colon (alias_colon),
+    // and a key the bare-text rule refuses (bare_punct). Undefined for an
+    // ordinary key, and for a declaration (`%a = 1`), which is a binding
+    // (isAliasDecl), not a refusal. Asked FIRST by the pair rule and by
+    // the elem rule, before the declaration is, so a pair in list
+    // position is held to the map's rules.
+    const isAliasDecl = (ktkn, sep) => null != ktkn && VL === ktkn.tin && ALIAS_RE.test('' + ktkn.src) &&
+        true === sep?.use?.aontu_eq;
+    const keyRefusalOf = (ktkn, sep) => {
+        if (null == ktkn || VL !== ktkn.tin) {
+            return undefined;
+        }
+        const kname = '' + ktkn.src;
+        if (ALIAS_RE.test(kname)) {
+            return isAliasDecl(ktkn, sep) ? undefined : { why: 'alias_colon' };
+        }
+        const bad = ktkn.use?.aontu_bad;
+        return null == bad ? undefined :
+            { why: 'bare_punct', details: { char: '' + bad, text: kname } };
+    };
     jsonic.options({
         hint: {
             unknown: `
@@ -481,6 +698,13 @@ help isolate the syntax error.`,
         // G8 phase 0).
         pack: PackFuncVal_1.PackFuncVal,
         each: EachFuncVal_1.EachFuncVal,
+        // RENDER P6: the order-preserving map. `form` makes one list
+        // element per child of its data, being the template with `_`
+        // bound to the source child -- a construction, where `each` is a
+        // bound (G9 §4). It exists because `pick(pack(...))` re-sorts to
+        // code-point order, and a struct's fields or a file's imports
+        // are the model's order or they are wrong.
+        form: FormFuncVal_1.FormFuncVal,
         // G8 phase 2: selection. `filter` keeps the children of a bag that
         // unify with a condition; `match` picks the first arm whose
         // pattern the scrutinee unifies with. Both select by
@@ -913,17 +1137,8 @@ help isolate the syntax error.`,
                 valnode = addsite(new NullVal_1.NullVal({ peg: r.node }), r, ctx);
             }
             if (null != valnode && 'object' === typeof valnode && valnode.site) {
-                let st = r.o0;
-                valnode.site.row = st.rI;
-                valnode.site.col = st.cI;
+                siteAt(valnode, tokenSite(r.o0));
                 valnode.site.url = ctx.meta.multisource && ctx.meta.multisource.path;
-                // No `?? ''` and no empty-text arm here: this branch runs only
-                // for a rule that HAS an open token, and a token that opens a
-                // value always carries text — the coverage gate refuses both
-                // guards as dead. The unset case is the one above, where r.o0
-                // itself can be absent.
-                valnode.site.src = st.src;
-                valnode.site.len = st.src.length;
             }
             // else { ERROR? }
             r.node = valnode;
@@ -993,6 +1208,20 @@ help isolate the syntax error.`,
                 r.node = addsite(new NilVal_1.NilVal({ why: 'elided_value' }), r, ctx);
                 return undefined;
             }
+            // A KEY REFUSAL (the pair rule records them: a declaration
+            // spelled with a colon, a key the bare-text rule refuses) becomes
+            // the refusal, in place of whatever followed the colon and sited
+            // at the KEY rather than at the map -- at the offending character
+            // of it, where there is one -- so the frame points at the
+            // spelling to change.
+            for (const { key, tkn, why, details } of (r.u.aontu_key_refusals ?? [])) {
+                const en = siteAt(addsite(new NilVal_1.NilVal({ why }), r, ctx), tokenSite(tkn));
+                if (null != details) {
+                    en.details = details;
+                }
+                en.path = [...(r.k?.path ?? []), key];
+                mo[key] = en;
+            }
             //  Handle defered conjuncts, e.g. `{x:1 @"foo"}`
             if (mo.___merge) {
                 let mop = { ...mo };
@@ -1142,9 +1371,21 @@ help isolate the syntax error.`,
             // Being a property of the map is also what carries it through a
             // meet, the way optional keys are carried.
             const ktkn = rule.o0;
-            if (null != ktkn && VL === ktkn.tin && ALIAS_RE.test('' + ktkn.src)) {
-                const holder = rule.parent;
-                const aname = '' + ktkn.src;
+            const holder = rule.parent;
+            const kr = keyRefusalOf(ktkn, rule.o1);
+            if (null != kr) {
+                // A KEY REFUSAL (keyRefusalOf) is written where the map is
+                // built, in the value's place and sited at the key, so the
+                // frame points at the spelling to change. A declaration
+                // spelled with a colon is refused rather than read as the
+                // ordinary key `%foo` the text would otherwise become -- a
+                // document written for the old form would then generate a
+                // "%foo" field and every `%foo` use would resolve to nothing,
+                // and neither says why.
+                holder.u.aontu_key_refusals = (holder.u.aontu_key_refusals || []);
+                holder.u.aontu_key_refusals.push({ key: '' + ktkn.src, tkn: ktkn, ...kr });
+            }
+            else if (isAliasDecl(ktkn, rule.o1)) {
                 // Always recorded here; whether the map is ALLOWED to carry
                 // declarations is decided on the VALUE (MapVal.unify), not at
                 // the parse. The parse cannot see it: an INCLUDED file's
@@ -1152,7 +1393,7 @@ help isolate the syntax error.`,
                 // once the loaded map is placed does it become apparent that
                 // root is not the document's.
                 holder.u.aontu_alias_keys = (holder.u.aontu_alias_keys || []);
-                holder.u.aontu_alias_keys.push(aname);
+                holder.u.aontu_alias_keys.push('' + ktkn.src);
             }
             if (rule.u.spread) {
                 rule.node[type_1.SPREAD] =
@@ -1303,19 +1544,47 @@ help isolate the syntax error.`,
             // mistake, not an empty value.
             if (true === rule.u.pair) {
                 const key = '' + rule.u.key;
+                // The key TOKEN: the optional spelling's sits on the elem rule
+                // before this one (`[x?: 1]` is two elem rules).
+                const ktkn = true === rule.u.aontu_optional_elem ?
+                    rule.prev.o0 : rule.o0;
                 let v = rule.child.node;
+                const kr = keyRefusalOf(ktkn, rule.o1);
                 if (null == v) {
                     v = addsite(new NilVal_1.NilVal({ why: 'elided_value' }), rule, ctx);
                     v.path = [...(rule.k?.path ?? []),
                         '' + rule.node.length, key];
                 }
+                // THE KEY IS HELD TO THE MAP'S RULES: a key the map rule would
+                // refuse (a colon declaration, a bare-text refusal) is refused
+                // here too, in the value's place and sited at the key, rather
+                // than generated as the element `[{"x=y": 1}]`.
+                else if (null != kr) {
+                    v = siteAt(addsite(new NilVal_1.NilVal({ why: kr.why }), rule, ctx), tokenSite(ktkn));
+                    if (null != kr.details) {
+                        v.details = kr.details;
+                    }
+                    v.path = [...(rule.k?.path ?? []),
+                        '' + rule.node.length, key];
+                }
                 const mv = addsite(new MapVal_1.MapVal({ peg: { [key]: v } }), rule, ctx);
+                // The element's path is the list's plus its index, as any
+                // element's is (and as the Go port paths it): the map rule's
+                // "is this the top level" test reads the path, so an element
+                // of a top-level list must not read as the root.
+                mv.path = [...(rule.k?.path ?? []), '' + rule.node.length];
                 // `[a?: 1]` is `[{a?: 1}]`: the key is optional IN the
                 // element, so the two spellings stay one rule apart rather
                 // than two behaviours apart.
                 if (true === rule.u.aontu_optional_elem) {
                     mv.optionalKeys = [key];
                 }
+                // ... and a declaration is a declaration IN the element, which
+                // is where MapVal.unify refuses it: a list element is not the
+                // top level.
+                if (isAliasDecl(ktkn, rule.o1)) {
+                    mv.aliasKeys = [key];
+                }
                 rule.node.push(mv);
             }
             return undefined;
@@ -1658,6 +1927,16 @@ function makeModelResolver(options) {
         err.code = 'include_extension';
         throw err;
     };
+    // A LANGUAGE-SUPPLIED MODEL THAT DOES NOT EXIST THROWS, as a denial
+    // does and for the same bare-member reason, with the not-found code
+    // the include machinery already uses and a message that names the
+    // set: a typo in an `aontu:` name must not go looking on disk.
+    const modelNotFound = (path) => {
+        const err = new Error('source not found: ' + path +
+            ' (the language-supplied models are ' + std_1.AONTU_MODELS.join(', ') + ')');
+        err.code = 'multisource_not_found';
+        throw err;
+    };
     // The gate every leg that RESOLVES A NAME passes through. The std and
     // module legs do not: both state `kind: 'aon'` because what they
     // serve is Aontu source by construction, not by its spelling.
@@ -1716,6 +1995,23 @@ function makeModelResolver(options) {
         if ('none' === capability) {
             deny(path);
         }
+        // THE LANGUAGE-SUPPLIED MODELS (docs/design/MODELS.0.md D1): an
+        // `aontu:` name resolves from the engine's own table and nowhere
+        // else -- the memory, module, file and package legs are never
+        // asked, so nothing on disk can shadow one and a typo is refused
+        // here, naming the set, rather than searched for. Available under
+        // every capability but `none`, checked just above, like the std
+        // names below. A path that is not a string (`a: @1`) is not a name
+        // at all: it falls through to the legs below and is not found there,
+        // as it always was.
+        if ('string' === typeof path && path.startsWith(std_1.AONTU_SCHEME)) {
+            const model = std_1.STD_SOURCES[path];
+            if (null == model) {
+                modelNotFound(path);
+            }
+            record(ctx, path, 'std');
+            return { found: true, path, full: path, kind: 'aon', src: model, search: [] };
+        }
         // THE BUNDLED VOCABULARY (G4 phase 4, ts/src/std.ts): served from
         // the engine itself, so it needs neither the filesystem nor package
         // resolution and is available under every capability but `none` —
@@ -1942,7 +2238,7 @@ function opCharHint(src) {
             q = c;
         }
         else if ('<' === c || '>' === c) {
-            return '\nThe > and < characters are not Aontu operators: write the ' +
+            return '\nThe > and < characters are not aontu operators: write the ' +
                 'bound functions min(x), max(x), above(x), below(x) instead.';
         }
     }
@@ -2068,9 +2364,10 @@ class Lang {
         }
         catch (e) {
             if ('include_denied' === e?.code || 'include_extension' === e?.code ||
-                mod_1.MODULE_REFUSAL_CODES.has(e?.code)) {
+                'multisource_not_found' === e?.code || mod_1.MODULE_REFUSAL_CODES.has(e?.code)) {
                 // A denied include (G5), an include whose extension is not read
-                // as Aontu source (ADR-012, INCLUDE_KINDS), and a module that is
+                // as Aontu source (ADR-012, INCLUDE_KINDS), an `aontu:` name the
+                // engine does not serve (MODELS.0.md D1), and a module that is
                 // missing, fails its pin, or names a path that escapes its store
                 // (G6 phase 2) are refused the same way, for the same reason: the
                 // resolver THROWS so a bare-member include cannot vanish in the