@telorun/analyzer 0.16.0 → 0.17.0

package/README.md

@@ -54,20 +54,13 @@ metadata:
   description: |
     A complete feedback collection REST API — no code, pure YAML.
     Persists entries to SQLite and serves them over HTTP.
+imports:
+  Http: std/http-server@0.6.1
+  Sql: std/sql@0.5.1
 targets:
   - Migrations
   - Server
 ---
-kind: Telo.Import
-metadata:
-  name: Http
-source: std/http-server@0.5.0
----
-kind: Telo.Import
-metadata:
-  name: Sql
-source: std/sql@0.3.0
----
 # SQLite database — swap driver/host/database for PostgreSQL with zero YAML changes
 kind: Sql.Connection
 metadata:
@@ -127,7 +120,7 @@ routes:
               minLength: 1
             source:
               type: string
-          required: [text]
+          required: [ text ]
     handler:
       kind: Sql.Exec
       connection:
@@ -157,7 +150,7 @@ routes:
         kind: Sql.Connection
         name: Db
       from: feedback
-      columns: [id, text, source, score, created_at]
+      columns: [ id, text, source, score, created_at ]
       orderBy:
         - { column: created_at, direction: desc }
     response:
@@ -176,14 +169,14 @@ routes:
           properties:
             id:
               type: integer
-          required: [id]
+          required: [ id ]
     handler:
       kind: Sql.Select
       connection:
         kind: Sql.Connection
         name: Db
       from: feedback
-      columns: [id, text, source, score, created_at]
+      columns: [ id, text, source, score, created_at ]
       where:
         - { column: id, op: "=", value: "${{ request.params.id }}" }
     response:

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAiB9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAuhB/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAmoBvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAqBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAiB9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAuhB/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAypBvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAqBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -590,6 +590,29 @@ export class StaticAnalyzer {
                 }
             }
         }
+        // Seed `Self` for every module that contributes definitions but whose own
+        // Telo.Library doc isn't in this manifest set. `flattenForAnalyzer` forwards an
+        // imported library's definitions/abstracts/imports but NOT its module doc, so the
+        // module-doc loop above can't register `Self` for imported modules. Without this, a
+        // definition's `extends: Self.X` (a kind defined in the same library as the abstract)
+        // can't resolve and its `extendedBy` edge mis-keys under the literal "Self.X" — which
+        // stays invisible until another module also implements that abstract and flips the
+        // reference check from lenient to strict. `Self` always maps a module to its own name.
+        for (const m of manifests) {
+            if (m.kind !== "Telo.Definition" && m.kind !== "Telo.Abstract")
+                continue;
+            const ownModule = m.metadata?.module;
+            if (!ownModule || rootModules.has(ownModule))
+                continue;
+            let libResolver = aliasesByModule.get(ownModule);
+            if (!libResolver) {
+                libResolver = new AliasResolver();
+                aliasesByModule.set(ownModule, libResolver);
+            }
+            if (!libResolver.hasAlias("Self")) {
+                libResolver.registerImport("Self", ownModule, []);
+            }
+        }
         // Register definitions from Telo.Definition AND Telo.Abstract resources.
         // Abstracts declare contracts that implementations target via `extends` (canonical)
         // or `capability: <AbstractKind>` (legacy). Until they're registered, validateReferences

package/dist/flatten-for-analyzer.d.ts

@@ -1,9 +1,31 @@
 import type { ResourceManifest } from "@telorun/sdk";
 import type { LoadedGraph, LoadedModule } from "./loaded-types.js";
+/** The import-boundary forwarding rule, shared by `flattenForAnalyzer` (the
+ *  CLI / kernel loader path) and the telo-editor's workspace projection so the
+ *  two cannot drift. Given one module's stamped manifests and whether that
+ *  module is the analysis entry (root), returns the manifests that cross into
+ *  the consumer's flat analysis list:
+ *
+ *  - **Root module** — every manifest is local; returned unchanged. The root's
+ *    internals (CEL / schema / refs) are validated in full.
+ *  - **Imported module** — only `Telo.Definition` / `Telo.Abstract` /
+ *    `Telo.Import` docs cross unconditionally, plus the instances named in the
+ *    module's `exports.resources` (stamped `metadata.forwardedExport: true`).
+ *    The module doc and internal (unexported) instances are dropped — they
+ *    belong to that module's own analysis pass.
+ *
+ *  `forwardedExport` marks an instance as a cross-module resolution TARGET only
+ *  (keyed by `metadata.module`), so `resolveRefSentinels` files it under
+ *  `byModuleName` and `!ref Alias.name` resolves, while `validate-references` /
+ *  the per-resource validation loop never re-walk or re-validate it against the
+ *  consumer's scope. A consumer that instead emits every module doc as a peer
+ *  local manifest silently breaks both. */
+export declare function selectModuleManifestsForAnalysis(moduleManifests: ResourceManifest[], isRoot: boolean): ResourceManifest[];
 /** Produce the flat manifest list `analyze()` consumes today.
  *
  *  Combines the entry module's manifests with `Telo.Definition`,
- *  `Telo.Abstract`, and `Telo.Import` docs forwarded from imported libraries.
+ *  `Telo.Abstract`, and `Telo.Import` docs forwarded from imported libraries
+ *  (plus their `exports.resources` instances) via `selectModuleManifestsForAnalysis`.
  *  Stamps three flavours of metadata along the way:
  *
  *  - `metadata.source` and `metadata.sourceLine` — already on each manifest

package/dist/flatten-for-analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flatten-for-analyzer.d.ts","sourceRoot":"","sources":["../src/flatten-for-analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAc,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAG/E;;;;;;;;;;;;;;;;;;6EAkB6E;AAC7E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,gBAAgB,EAAE,CA6EzE;AAED;;;;;6BAK6B;AAC7B,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,YAAY,GAAG,gBAAgB,EAAE,CAEzE"}
+{"version":3,"file":"flatten-for-analyzer.d.ts","sourceRoot":"","sources":["../src/flatten-for-analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAc,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAG/E;;;;;;;;;;;;;;;;;;;2CAmB2C;AAC3C,wBAAgB,gCAAgC,CAC9C,eAAe,EAAE,gBAAgB,EAAE,EACnC,MAAM,EAAE,OAAO,GACd,gBAAgB,EAAE,CAwBpB;AAED;;;;;;;;;;;;;;;;;;;6EAmB6E;AAC7E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,gBAAgB,EAAE,CA+CzE;AAED;;;;;6BAK6B;AAC7B,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,YAAY,GAAG,gBAAgB,EAAE,CAEzE"}

package/dist/flatten-for-analyzer.js

@@ -1,8 +1,50 @@
 import { isModuleKind } from "./module-kinds.js";
+/** The import-boundary forwarding rule, shared by `flattenForAnalyzer` (the
+ *  CLI / kernel loader path) and the telo-editor's workspace projection so the
+ *  two cannot drift. Given one module's stamped manifests and whether that
+ *  module is the analysis entry (root), returns the manifests that cross into
+ *  the consumer's flat analysis list:
+ *
+ *  - **Root module** — every manifest is local; returned unchanged. The root's
+ *    internals (CEL / schema / refs) are validated in full.
+ *  - **Imported module** — only `Telo.Definition` / `Telo.Abstract` /
+ *    `Telo.Import` docs cross unconditionally, plus the instances named in the
+ *    module's `exports.resources` (stamped `metadata.forwardedExport: true`).
+ *    The module doc and internal (unexported) instances are dropped — they
+ *    belong to that module's own analysis pass.
+ *
+ *  `forwardedExport` marks an instance as a cross-module resolution TARGET only
+ *  (keyed by `metadata.module`), so `resolveRefSentinels` files it under
+ *  `byModuleName` and `!ref Alias.name` resolves, while `validate-references` /
+ *  the per-resource validation loop never re-walk or re-validate it against the
+ *  consumer's scope. A consumer that instead emits every module doc as a peer
+ *  local manifest silently breaks both. */
+export function selectModuleManifestsForAnalysis(moduleManifests, isRoot) {
+    if (isRoot)
+        return moduleManifests;
+    const libDoc = moduleManifests.find((m) => isModuleKind(m.kind));
+    const exportedResources = new Set(libDoc?.exports?.resources ?? []);
+    const out = [];
+    for (const m of moduleManifests) {
+        if (m.kind === "Telo.Definition" || m.kind === "Telo.Abstract" || m.kind === "Telo.Import") {
+            out.push(m);
+        }
+        else if (!isModuleKind(m.kind) &&
+            typeof m.metadata?.name === "string" &&
+            exportedResources.has(m.metadata.name)) {
+            out.push({
+                ...m,
+                metadata: { ...m.metadata, forwardedExport: true },
+            });
+        }
+    }
+    return out;
+}
 /** Produce the flat manifest list `analyze()` consumes today.
  *
  *  Combines the entry module's manifests with `Telo.Definition`,
- *  `Telo.Abstract`, and `Telo.Import` docs forwarded from imported libraries.
+ *  `Telo.Abstract`, and `Telo.Import` docs forwarded from imported libraries
+ *  (plus their `exports.resources` instances) via `selectModuleManifestsForAnalysis`.
  *  Stamps three flavours of metadata along the way:
  *
  *  - `metadata.source` and `metadata.sourceLine` — already on each manifest
@@ -20,8 +62,7 @@ import { isModuleKind } from "./module-kinds.js";
  *  callers look it up via `findPositions(graph, ...)` on the LoadedGraph. */
 export function flattenForAnalyzer(graph) {
     const result = [];
-    const stampedEntry = collectModuleManifests(graph.entry);
-    result.push(...stampedEntry);
+    result.push(...selectModuleManifestsForAnalysis(collectModuleManifests(graph.entry), true));
     const seen = new Set([graph.rootSource]);
     const queue = [graph.rootSource];
     while (queue.length > 0) {
@@ -37,31 +78,7 @@ export function flattenForAnalyzer(graph) {
             const targetModule = graph.modules.get(edge.targetSource);
             if (!targetModule)
                 continue;
-            const stamped = collectModuleManifests(targetModule);
-            const libDoc = stamped.find((m) => isModuleKind(m.kind));
-            const exportedResources = new Set(libDoc?.exports?.resources ?? []);
-            for (const m of stamped) {
-                if (m.kind === "Telo.Definition" ||
-                    m.kind === "Telo.Abstract" ||
-                    m.kind === "Telo.Import") {
-                    result.push(m);
-                }
-                else if (!isModuleKind(m.kind) &&
-                    typeof m.metadata?.name === "string" &&
-                    exportedResources.has(m.metadata.name)) {
-                    // Forward instances listed in the library's `exports.resources` so the
-                    // consumer's analyzer can resolve, gate, kind-check, and draw topology edges
-                    // for cross-module `!ref Alias.name`. The gate IS this forwarding — only
-                    // exported names cross the boundary. `metadata.forwardedExport` marks them as
-                    // cross-module resolution targets only (keyed by `metadata.module`), so ref
-                    // resolution / validation treats them as targets, never as local sources to
-                    // re-validate or walk.
-                    result.push({
-                        ...m,
-                        metadata: { ...m.metadata, forwardedExport: true },
-                    });
-                }
-            }
+            result.push(...selectModuleManifestsForAnalysis(collectModuleManifests(targetModule), false));
         }
     }
     // Stamp resolved import identity on every Telo.Import in the result by

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { AnalysisRegistry } from "./analysis-registry.js";
 export { StaticAnalyzer } from "./analyzer.js";
 export type { GraphLoadError, ImportEdge, LoadedFile, LoadedGraph, LoadedModule, ParseError, } from "./loaded-types.js";
-export { flattenForAnalyzer, flattenLoadedModule } from "./flatten-for-analyzer.js";
+export { flattenForAnalyzer, flattenLoadedModule, selectModuleManifestsForAnalysis, } from "./flatten-for-analyzer.js";
 export { visitManifest } from "./manifest-visitor.js";
 export type { CelSiteEvent, ManifestVisitor, RefSiteEvent, ResourceEnterEvent, ResourceExitEvent, ScopeBoundaryEvent, SchemaFromSiteEvent, VisitOptions, } from "./manifest-visitor.js";
 export { Loader } from "./manifest-loader.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,gCAAgC,GACnC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,6 +1,6 @@
 export { AnalysisRegistry } from "./analysis-registry.js";
 export { StaticAnalyzer } from "./analyzer.js";
-export { flattenForAnalyzer, flattenLoadedModule } from "./flatten-for-analyzer.js";
+export { flattenForAnalyzer, flattenLoadedModule, selectModuleManifestsForAnalysis, } from "./flatten-for-analyzer.js";
 export { visitManifest } from "./manifest-visitor.js";
 export { Loader } from "./manifest-loader.js";
 export { isModuleKind, MODULE_KINDS } from "./module-kinds.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",

package/src/analyzer.ts

@@ -716,6 +716,28 @@ export class StaticAnalyzer {
       }
     }
 
+    // Seed `Self` for every module that contributes definitions but whose own
+    // Telo.Library doc isn't in this manifest set. `flattenForAnalyzer` forwards an
+    // imported library's definitions/abstracts/imports but NOT its module doc, so the
+    // module-doc loop above can't register `Self` for imported modules. Without this, a
+    // definition's `extends: Self.X` (a kind defined in the same library as the abstract)
+    // can't resolve and its `extendedBy` edge mis-keys under the literal "Self.X" — which
+    // stays invisible until another module also implements that abstract and flips the
+    // reference check from lenient to strict. `Self` always maps a module to its own name.
+    for (const m of manifests) {
+      if (m.kind !== "Telo.Definition" && m.kind !== "Telo.Abstract") continue;
+      const ownModule = (m.metadata as { module?: string } | undefined)?.module;
+      if (!ownModule || rootModules.has(ownModule)) continue;
+      let libResolver = aliasesByModule.get(ownModule);
+      if (!libResolver) {
+        libResolver = new AliasResolver();
+        aliasesByModule.set(ownModule, libResolver);
+      }
+      if (!libResolver.hasAlias("Self")) {
+        libResolver.registerImport("Self", ownModule, []);
+      }
+    }
+
     // Register definitions from Telo.Definition AND Telo.Abstract resources.
     // Abstracts declare contracts that implementations target via `extends` (canonical)
     // or `capability: <AbstractKind>` (legacy). Until they're registered, validateReferences

package/src/flatten-for-analyzer.ts

@@ -2,10 +2,60 @@ import type { ResourceManifest } from "@telorun/sdk";
 import type { LoadedFile, LoadedGraph, LoadedModule } from "./loaded-types.js";
 import { isModuleKind } from "./module-kinds.js";
 
+/** The import-boundary forwarding rule, shared by `flattenForAnalyzer` (the
+ *  CLI / kernel loader path) and the telo-editor's workspace projection so the
+ *  two cannot drift. Given one module's stamped manifests and whether that
+ *  module is the analysis entry (root), returns the manifests that cross into
+ *  the consumer's flat analysis list:
+ *
+ *  - **Root module** — every manifest is local; returned unchanged. The root's
+ *    internals (CEL / schema / refs) are validated in full.
+ *  - **Imported module** — only `Telo.Definition` / `Telo.Abstract` /
+ *    `Telo.Import` docs cross unconditionally, plus the instances named in the
+ *    module's `exports.resources` (stamped `metadata.forwardedExport: true`).
+ *    The module doc and internal (unexported) instances are dropped — they
+ *    belong to that module's own analysis pass.
+ *
+ *  `forwardedExport` marks an instance as a cross-module resolution TARGET only
+ *  (keyed by `metadata.module`), so `resolveRefSentinels` files it under
+ *  `byModuleName` and `!ref Alias.name` resolves, while `validate-references` /
+ *  the per-resource validation loop never re-walk or re-validate it against the
+ *  consumer's scope. A consumer that instead emits every module doc as a peer
+ *  local manifest silently breaks both. */
+export function selectModuleManifestsForAnalysis(
+  moduleManifests: ResourceManifest[],
+  isRoot: boolean,
+): ResourceManifest[] {
+  if (isRoot) return moduleManifests;
+
+  const libDoc = moduleManifests.find((m) => isModuleKind(m.kind));
+  const exportedResources = new Set<string>(
+    (libDoc as { exports?: { resources?: string[] } } | undefined)?.exports?.resources ?? [],
+  );
+
+  const out: ResourceManifest[] = [];
+  for (const m of moduleManifests) {
+    if (m.kind === "Telo.Definition" || m.kind === "Telo.Abstract" || m.kind === "Telo.Import") {
+      out.push(m);
+    } else if (
+      !isModuleKind(m.kind) &&
+      typeof m.metadata?.name === "string" &&
+      exportedResources.has(m.metadata.name as string)
+    ) {
+      out.push({
+        ...m,
+        metadata: { ...m.metadata, forwardedExport: true } as ResourceManifest["metadata"],
+      });
+    }
+  }
+  return out;
+}
+
 /** Produce the flat manifest list `analyze()` consumes today.
  *
  *  Combines the entry module's manifests with `Telo.Definition`,
- *  `Telo.Abstract`, and `Telo.Import` docs forwarded from imported libraries.
+ *  `Telo.Abstract`, and `Telo.Import` docs forwarded from imported libraries
+ *  (plus their `exports.resources` instances) via `selectModuleManifestsForAnalysis`.
  *  Stamps three flavours of metadata along the way:
  *
  *  - `metadata.source` and `metadata.sourceLine` — already on each manifest
@@ -24,8 +74,7 @@ import { isModuleKind } from "./module-kinds.js";
 export function flattenForAnalyzer(graph: LoadedGraph): ResourceManifest[] {
   const result: ResourceManifest[] = [];
 
-  const stampedEntry = collectModuleManifests(graph.entry);
-  result.push(...stampedEntry);
+  result.push(...selectModuleManifestsForAnalysis(collectModuleManifests(graph.entry), true));
 
   const seen = new Set<string>([graph.rootSource]);
   const queue: string[] = [graph.rootSource];
@@ -43,36 +92,7 @@ export function flattenForAnalyzer(graph: LoadedGraph): ResourceManifest[] {
       const targetModule = graph.modules.get(edge.targetSource);
       if (!targetModule) continue;
 
-      const stamped = collectModuleManifests(targetModule);
-      const libDoc = stamped.find((m) => isModuleKind(m.kind));
-      const exportedResources = new Set<string>(
-        (libDoc as { exports?: { resources?: string[] } } | undefined)?.exports?.resources ?? [],
-      );
-      for (const m of stamped) {
-        if (
-          m.kind === "Telo.Definition" ||
-          m.kind === "Telo.Abstract" ||
-          m.kind === "Telo.Import"
-        ) {
-          result.push(m);
-        } else if (
-          !isModuleKind(m.kind) &&
-          typeof m.metadata?.name === "string" &&
-          exportedResources.has(m.metadata.name as string)
-        ) {
-          // Forward instances listed in the library's `exports.resources` so the
-          // consumer's analyzer can resolve, gate, kind-check, and draw topology edges
-          // for cross-module `!ref Alias.name`. The gate IS this forwarding — only
-          // exported names cross the boundary. `metadata.forwardedExport` marks them as
-          // cross-module resolution targets only (keyed by `metadata.module`), so ref
-          // resolution / validation treats them as targets, never as local sources to
-          // re-validate or walk.
-          result.push({
-            ...m,
-            metadata: { ...m.metadata, forwardedExport: true } as ResourceManifest["metadata"],
-          });
-        }
-      }
+      result.push(...selectModuleManifestsForAnalysis(collectModuleManifests(targetModule), false));
     }
   }
 

package/src/index.ts

@@ -8,7 +8,11 @@ export type {
     LoadedModule,
     ParseError,
 } from "./loaded-types.js";
-export { flattenForAnalyzer, flattenLoadedModule } from "./flatten-for-analyzer.js";
+export {
+    flattenForAnalyzer,
+    flattenLoadedModule,
+    selectModuleManifestsForAnalysis,
+} from "./flatten-for-analyzer.js";
 export { visitManifest } from "./manifest-visitor.js";
 export type {
     CelSiteEvent,