[dependabot]

Bumps @velarscript/cli from 0.18.0 to 0.34.0.

Changelog

Sourced from @​velarscript/cli's changelog.

0.34.0 — 2026-09-13

Surfaces: core@0.10 · web@0.14 · node@0.17 · server@0.15 · desktop@0.10

Language — core@0.10

• readonly protects the qualified layer's slots. readonly List<State> preserves mutable State elements; List<readonly State> protects each element’s field slots; readonly List<readonly State> protects both layers. Records, Map, Set and Record follow the same rule through reads, callbacks and copies.
• readonly type State protects every own and inherited field slot. State and its explicit readonly view have equivalent slot contracts. Readonly slots and containers may hold classes and capabilities with their own behavior.
• A20 simplifies all-readonly record declarations; A21 removes redundant readonly qualifiers. Editor quick fixes and velar fix apply both while preserving nested qualifiers and comments.
• Runtime shape narrowing preserves existing required fields and writable value domains, including nested containers and readonly aliases.
• Anonymous structural checks require own enumerable data properties without invoking getters, preserve required unknown fields, and reuse recursive check functions. Types carried by cross-module signatures retain their runtime validators even when the caller imports only a function. Lazy validator routing preserves dynamic loading and legal early calls in module cycles. Velar module namespaces expose live public bindings and support object spread without leaking compiler exports or host namespace symbols.
• Every match requires complete coverage of its actual static input type. Existing structural coverage proofs remain valid; an intentional remaining no-op is written as case _: pass.
• Number values expose isSafeInteger(). velar/validation.integer agrees with isInteger, and the new safeInteger rule agrees with isSafeInteger; explicit minimum and maximum constraints apply independently.
• Structural and semantic validation share readonly, structured paths through records, collections, aliases, inheritance, and generics. The public path kinds distinguish Map keys from values, and diagnostic budget truncation is explicit. ValidationError.path is a ValidationPath; use message for text.
• Upgrading code that relied on implicit deep protection requires explicit qualifiers on nested values or readonly record declarations. See D117.

Tooling

• velar skill core topics discovers ten offline reference topics derived from the canonical language and API documents. Build and prepack synchronize the installed guidance; CI rejects stale generated content. Packaged relative links and heading anchors are checked against the installed file layout.
• Library artifacts rebase canonical generic identities with their serialized type arguments. Consumers reject older artifacts whose public signatures lack the runtime validators they require, with an explicit rebuild diagnostic.
• Documentation examples provide complete isolated module and resource contexts; the default documentation gate rejects partially analyzed examples.

... (truncated)

Commits

• ff53a6b Complete Core 0.10 regression fixtures and release evidence
• ef01370 Implement Core 0.10 contracts and runtime validation
• d2b426c release: VelarScript 0.33.1
• 298c855 fix(runtime): apply stack ownership to detached test reports
• 39fce34 fix(cli): preserve private and npm imports in browser test sandboxes
• ad67749 fix(runtime): pass test owner regions to detached error channels
• 9142de8 fix(cli): preserve native import owners in browser test sandboxes
• 56a3e70 fix(runtime): unify program error stacks across run and test
• 793283e fix(runtime): unify program traces and support test stack mode
• 911779b chore(release): prepare the 0.33.0 toolchain and core 0.9 surface
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #12.