@telorun/analyzer 0.21.0 → 0.23.0

package/README.md

@@ -55,11 +55,11 @@ metadata:
     A complete feedback collection REST API — no code, pure YAML.
     Persists entries to SQLite and serves them over HTTP.
 imports:
-  Http: std/http-server@0.9.0
-  Sql: std/sql@0.8.0
+  Http: std/http-server@0.11.0
+  Sql: std/sql@0.9.0
 targets:
-  - Migrations
-  - Server
+  - !ref Migrations
+  - !ref Server
 ---
 # SQLite database — swap driver/host/database for PostgreSQL with zero YAML changes
 kind: Sql.Connection
@@ -72,9 +72,7 @@ file: ./tmp/feedback.db
 kind: Sql.Migrations
 metadata:
   name: Migrations
-connection:
-  kind: Sql.Connection
-  name: Db
+connection: !ref Db
 ---
 kind: Sql.Migration
 metadata:
@@ -101,7 +99,7 @@ openapi:
     version: 1.0.0
 mounts:
   - path: /v1
-    type: Http.Api.FeedbackRoutes
+    mount: !ref FeedbackRoutes
 ---
 kind: Http.Api
 metadata:
@@ -123,9 +121,7 @@ routes:
           required: [ text ]
     handler:
       kind: Sql.Exec
-      connection:
-        kind: Sql.Connection
-        name: Db
+      connection: !ref Db
     inputs:
       sql: "INSERT INTO feedback (text, source, score) VALUES (?, ?, ?)"
       bindings:
@@ -146,9 +142,7 @@ routes:
       method: GET
     handler:
       kind: Sql.Select
-      connection:
-        kind: Sql.Connection
-        name: Db
+      connection: !ref Db
       from: feedback
       columns: [ id, text, source, score, created_at ]
       orderBy:
@@ -172,9 +166,7 @@ routes:
           required: [ id ]
     handler:
       kind: Sql.Select
-      connection:
-        kind: Sql.Connection
-        name: Db
+      connection: !ref Db
       from: feedback
       columns: [ id, text, source, score, created_at ]
       where:

package/dist/alias-resolver.d.ts

@@ -3,7 +3,14 @@
 export declare class AliasResolver {
     private readonly importAliases;
     private readonly importedKinds;
+    /** `${alias}.${suffix}` → canonical `<owningModule>.<Kind>` for kinds an import
+     *  transitively RE-EXPORTS (`exports.kinds: [Alias.Kind]`), which don't live in the
+     *  import's own module. Resolved before the normal `<module>.<suffix>` construction. */
+    private readonly reExportedKinds;
     registerImport(alias: string, targetModule: string, exportedKinds: string[]): void;
+    /** Register that `<alias>.<suffix>` re-exports the kind canonically named `canonicalKind`
+     *  (owned by a module the alias's target imports, possibly several hops away). */
+    registerKindReExport(alias: string, suffix: string, canonicalKind: string): void;
     /** Real module name an alias points at (e.g. "Console" → "console"), or undefined.
      *  Used to resolve an alias-qualified instance reference "Console.writeLine" to the
      *  forwarded resource declared in that module. The `exports.resources` gate is enforced

package/dist/alias-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"alias-resolver.d.ts","sourceRoot":"","sources":["../src/alias-resolver.ts"],"names":[],"mappings":"AAAA;gFACgF;AAChF,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6B;IAC3D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAkC;IAEhE,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI;IAOlF;;;;qDAIiD;IACjD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIjD,sFAAsF;IACtF,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAe7C,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIhC,YAAY,IAAI,MAAM,EAAE;IAIxB;;qEAEiE;IACjE,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE;CAO3C"}
+{"version":3,"file":"alias-resolver.d.ts","sourceRoot":"","sources":["../src/alias-resolver.ts"],"names":[],"mappings":"AAAA;gFACgF;AAChF,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6B;IAC3D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAkC;IAChE;;4FAEwF;IACxF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6B;IAE7D,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI;IAOlF;sFACkF;IAClF,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI;IAIhF;;;;qDAIiD;IACjD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIjD,sFAAsF;IACtF,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAmB7C,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIhC,YAAY,IAAI,MAAM,EAAE;IAIxB;;qEAEiE;IACjE,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE;CAO3C"}

package/dist/alias-resolver.js

@@ -3,12 +3,21 @@
 export class AliasResolver {
     importAliases = new Map();
     importedKinds = new Map();
+    /** `${alias}.${suffix}` → canonical `<owningModule>.<Kind>` for kinds an import
+     *  transitively RE-EXPORTS (`exports.kinds: [Alias.Kind]`), which don't live in the
+     *  import's own module. Resolved before the normal `<module>.<suffix>` construction. */
+    reExportedKinds = new Map();
     registerImport(alias, targetModule, exportedKinds) {
         this.importAliases.set(alias, targetModule);
         if (exportedKinds.length > 0) {
             this.importedKinds.set(alias, new Set(exportedKinds));
         }
     }
+    /** Register that `<alias>.<suffix>` re-exports the kind canonically named `canonicalKind`
+     *  (owned by a module the alias's target imports, possibly several hops away). */
+    registerKindReExport(alias, suffix, canonicalKind) {
+        this.reExportedKinds.set(`${alias}.${suffix}`, canonicalKind);
+    }
     /** Real module name an alias points at (e.g. "Console" → "console"), or undefined.
      *  Used to resolve an alias-qualified instance reference "Console.writeLine" to the
      *  forwarded resource declared in that module. The `exports.resources` gate is enforced
@@ -27,6 +36,11 @@ export class AliasResolver {
             return undefined;
         const prefix = kind.slice(0, dot);
         const suffix = kind.slice(dot + 1);
+        // Re-export takes precedence: a re-exported kind resolves to its true owning module,
+        // not `${prefix-target}.${suffix}` (and bypasses the gate — it's explicitly re-exported).
+        const reExported = this.reExportedKinds.get(`${prefix}.${suffix}`);
+        if (reExported)
+            return reExported;
         const realModule = this.importAliases.get(prefix);
         if (!realModule)
             return undefined;

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAiB9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA2hB/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAypBvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAqBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAiB9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA4hB/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IA+sBvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAerB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -1,6 +1,6 @@
 import { defaultRegistry, isTaggedSentinel } from "@telorun/templating";
 import { AliasResolver } from "./alias-resolver.js";
-import { buildCelEnvironment, buildTypedCelEnvironment, } from "./cel-environment.js";
+import { buildCelEnvironment, buildImportInputCelEnvironment, buildTypedCelEnvironment, } from "./cel-environment.js";
 import { DefinitionRegistry } from "./definition-registry.js";
 import { buildDependencyGraph, formatCycle } from "./dependency-graph.js";
 import { buildKernelGlobalsSchema, mergeKernelGlobalsIntoContext } from "./kernel-globals.js";
@@ -18,6 +18,7 @@ import { validateExtends } from "./validate-extends.js";
 import { validateNestedInlineResources } from "./validate-nested-inline.js";
 import { validateProviderCoherence } from "./validate-provider-coherence.js";
 import { validateReferences } from "./validate-references.js";
+import { validateReferenceForms } from "./validate-reference-forms.js";
 import { validateUnusedDeclarations } from "./validate-unused-declarations.js";
 import { validateThrowsCoverage } from "./validate-throws-coverage.js";
 const SELF_PREFIX = "Self.";
@@ -578,17 +579,18 @@ export class StaticAnalyzer {
                     if (resolvedModuleName) {
                         defs.registerModuleIdentity(resolvedNamespace ?? null, resolvedModuleName);
                     }
+                    // `metadata.reExportedKinds` (stamped by flattenForAnalyzer / the editor projection)
+                    // maps an exported suffix to the true owning module's canonical kind for kinds this
+                    // import transitively re-exports (`exports.kinds: [Alias.Kind]`).
+                    const reExportedKinds = (m.metadata?.reExportedKinds ?? {});
                     // Alias registration is scoped: consumer imports vs. imported-library imports.
-                    if (!ownModule || rootModules.has(ownModule)) {
-                        aliases.registerImport(alias, targetModule, exportedKinds);
-                    }
-                    else {
-                        let libResolver = aliasesByModule.get(ownModule);
-                        if (!libResolver) {
-                            libResolver = new AliasResolver();
-                            aliasesByModule.set(ownModule, libResolver);
-                        }
-                        libResolver.registerImport(alias, targetModule, exportedKinds);
+                    const resolver = !ownModule || rootModules.has(ownModule)
+                        ? aliases
+                        : (aliasesByModule.get(ownModule) ??
+                            aliasesByModule.set(ownModule, new AliasResolver()).get(ownModule));
+                    resolver.registerImport(alias, targetModule, exportedKinds);
+                    for (const [suffix, canonical] of Object.entries(reExportedKinds)) {
+                        resolver.registerKindReExport(alias, suffix, canonical);
                     }
                 }
             }
@@ -646,13 +648,21 @@ export class StaticAnalyzer {
                 : def;
             defs.register(normalized);
         }
+        // Reference-form validation — enforce `!ref` as the only reference shape.
+        // Runs on the RAW manifests, BEFORE inline extraction and sentinel
+        // resolution, while an author-written `{kind, name}` is still
+        // distinguishable from the resolver's own substitution (after Phase 2/2.5
+        // they are the same object).
+        if (!options?.skipValidation) {
+            diagnostics.push(...validateReferenceForms(manifests, defs, aliases, aliasesByModule));
+        }
         // Phase 2: extract inline resources from x-telo-ref slots into first-class manifests
         const allManifests = normalizeInlineResources(manifests, defs, aliases, aliasesByModule);
         // Phase 2.5: resolve `!ref <name>` sentinels at every ref slot to canonical
         // {kind, name} objects so downstream phases (validation, dependency graph,
         // kernel controllers) see a uniform shape. Runs after normalize so both
         // original and inline-extracted manifests have their sentinels resolved.
-        resolveRefSentinels(allManifests, defs, aliases, aliasesByModule);
+        resolveRefSentinels(allManifests, aliases, aliasesByModule);
         // Trusted-input fast path: when the caller has already attested that
         // this exact manifest set passes analysis (e.g. via the kernel's
         // hash-stamped `.validated.json` cache), skip the validation walk.
@@ -726,6 +736,26 @@ export class StaticAnalyzer {
                     }
                 }
             }
+            // `exports.resources` entries are plain names: `Db` (local) or `Alias.Name` (re-export),
+            // mirroring `exports.kinds`. The `!ref` tag is not accepted here — a `!ref` parses to a
+            // sentinel object that the schema's CEL/ref exemption would silently pass, so reject any
+            // non-string entry with an actionable message instead.
+            const exportsResources = m.exports?.resources;
+            if (Array.isArray(exportsResources)) {
+                for (let i = 0; i < exportsResources.length; i++) {
+                    if (typeof exportsResources[i] === "string")
+                        continue;
+                    diagnostics.push({
+                        severity: DiagnosticSeverity.Error,
+                        code: "INVALID_EXPORT",
+                        source: SOURCE,
+                        message: `Telo.Library exports.resources[${i}]: write the exported name as a plain string — ` +
+                            `'Name' to export a local instance, or 'Alias.Name' to re-export an imported one. ` +
+                            `The '!ref' tag is not allowed in exports.resources.`,
+                        data: { resource, filePath, path: `exports.resources.${i}` },
+                    });
+                }
+            }
         }
         // Build typed kernel globals schema so x-telo-context chain validation
         // recognises variables, secrets, resources, env automatically
@@ -795,8 +825,22 @@ export class StaticAnalyzer {
                         },
                     }
                     : definition.schema;
-                // Phase 1: CEL type checking — walk data+schema together, check env.check() return types
-                const baseTypedEnv = buildTypedCelEnvironment(this.celEnv, m, undefined, moduleManifest);
+                // Phase 1: CEL type checking — walk data+schema together, check env.check() return types.
+                // A Telo.Import's variables/secrets are a config-only contract evaluated against the
+                // IMPORTING module's scope, so type them from the owning module doc (matched by
+                // `metadata.module`) and drop `resources`/`env` so referencing them is an error. A
+                // library's own internal import is validated against that library in the library's
+                // standalone analysis; in this flattened app pass the library doc is absent, so the
+                // importer is undefined here and variables/secrets fall back to a permissive `map`
+                // (no false positives) while resources/env stay rejected.
+                const importerModule = m.kind === "Telo.Import"
+                    ? allManifests.find((mm) => (mm.kind === "Telo.Application" || mm.kind === "Telo.Library") &&
+                        mm.metadata?.name ===
+                            m.metadata?.module)
+                    : undefined;
+                const baseTypedEnv = m.kind === "Telo.Import"
+                    ? buildImportInputCelEnvironment(this.celEnv, importerModule)
+                    : buildTypedCelEnvironment(this.celEnv, m, undefined, moduleManifest);
                 const celIssues = collectCelTypeIssues(m, schema, "", definition, m, baseTypedEnv, this.celEnv, moduleManifest);
                 // Phase 2+3: AJV on substituted data — CEL fields replaced with typed placeholders
                 const ajvIssues = validateAgainstSchema(substituteCelFields(m, schema), schema);
@@ -1058,7 +1102,7 @@ export class StaticAnalyzer {
         // Resolve !ref sentinels after normalize so both the original and
         // inline-extracted manifests get their refs canonicalized to
         // {kind, name} for the kernel that consumes this output.
-        resolveRefSentinels(normalized, ctx.definitions, ctx.aliases, ctx.aliasesByModule, crossModuleTargets ?? []);
+        resolveRefSentinels(normalized, ctx.aliases, ctx.aliasesByModule, crossModuleTargets ?? []);
         return normalized;
     }
     prepare(manifests, registry) {

package/dist/builtins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EAsd/C,CAAC"}
+{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EAud/C,CAAC"}

package/dist/builtins.js

@@ -234,7 +234,7 @@ export const KERNEL_BUILTINS = [
                             },
                             // Gated reference: run() a Runnable/Service only when the
                             // `when` CEL guard holds. Discriminated by the `ref` key. `ref`
-                            // is a bare name or a resolved `!ref` (`{ kind, name }`).
+                            // is a `!ref` that resolves to the `{ kind, name }` shape below.
                             {
                                 type: "object",
                                 required: ["ref"],
@@ -262,12 +262,11 @@ export const KERNEL_BUILTINS = [
                             // with an optional `name` (for steps.<name>.result plumbing),
                             // `when` guard, and `inputs`. Discriminated by the `invoke` key.
                             // Control flow (if/while/switch/try) is not available here —
-                            // reach for Run.Sequence. `invoke` is ref-only and must resolve
-                            // to a `{ kind, name }` reference (a `!ref` / `{kind,name}`):
-                            // requiring `name` rejects an inline `{ kind }` definition (no
-                            // name) at analysis instead of failing at boot with an undefined
-                            // resource name. The Invocable/Runnable kind set mirrors
-                            // Run.Sequence invoke steps.
+                            // reach for Run.Sequence. `invoke` is ref-only: a `!ref` that
+                            // resolves to the `{ kind, name }` shape below. Requiring `name`
+                            // rejects an inline `{ kind }` definition (no name) at analysis
+                            // instead of failing at boot with an undefined resource name. The
+                            // Invocable/Runnable kind set mirrors Run.Sequence invoke steps.
                             {
                                 type: "object",
                                 required: ["invoke"],
@@ -454,8 +453,10 @@ export const KERNEL_BUILTINS = [
                     type: "object",
                     properties: {
                         kinds: { type: "array", items: { type: "string" } },
-                        // `variables` / `secrets` are reserved on the resources.<Alias> value-flow
-                        // surface, so a library may not export instances under those names.
+                        // An entry is a bare name (`Db`, a locally-owned export) or a dotted `Alias.Name`
+                        // (re-export of the instance reached via this library's import aliased `Alias`,
+                        // under the name `Name`) — mirroring `exports.kinds`. `variables` / `secrets` are
+                        // reserved on the resources.<Alias> value-flow surface, so they may not be exported.
                         resources: {
                             type: "array",
                             items: { type: "string", not: { enum: ["variables", "secrets"] } },

package/dist/cel-environment.d.ts

@@ -13,4 +13,12 @@ export type { CelHandlers } from "@telorun/templating";
  *  NOTE: The set of kernel globals registered here must match `KERNEL_GLOBAL_NAMES`
  *  in kernel-globals.ts, which is used for chain-access validation. */
 export declare function buildTypedCelEnvironment(baseEnv: Environment, manifest: ResourceManifest, extraContextSchema?: Record<string, any> | null, rootModuleManifest?: ResourceManifest): Environment;
+/** CEL environment for the `variables:`/`secrets:` expressions on a `Telo.Import`.
+ *
+ *  Import inputs are a config-only contract: their expressions are evaluated
+ *  against the IMPORTING module's `variables`/`secrets`, never the import's own
+ *  values map (the bug) nor the imported child's. `resources`, `env`, and `ports`
+ *  are registered as empty typed objects, so referencing them is a "No such key"
+ *  error that steers authors to a typed `variables` entry. */
+export declare function buildImportInputCelEnvironment(baseEnv: Environment, moduleManifest: ResourceManifest | undefined): Environment;
 //# sourceMappingURL=cel-environment.d.ts.map

package/dist/cel-environment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cel-environment.d.ts","sourceRoot":"","sources":["../src/cel-environment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAUrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;;;uEASuE;AACvE,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,gBAAgB,EAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,EAI/C,kBAAkB,CAAC,EAAE,gBAAgB,GACpC,WAAW,CAuEb"}
+{"version":3,"file":"cel-environment.d.ts","sourceRoot":"","sources":["../src/cel-environment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAUrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;;;uEASuE;AACvE,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,gBAAgB,EAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,EAI/C,kBAAkB,CAAC,EAAE,gBAAgB,GACpC,WAAW,CAuEb;AAuBD;;;;;;8DAM8D;AAC9D,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,WAAW,EACpB,cAAc,EAAE,gBAAgB,GAAG,SAAS,GAC3C,WAAW,CAwBb"}

package/dist/cel-environment.js

@@ -85,3 +85,51 @@ rootModuleManifest) {
         return baseEnv.clone();
     }
 }
+/** Register a `variables`/`secrets` namespace typed from a module doc's schema map
+ *  (`{ name: <schema>, … }`), falling back to dyn `map` when absent or untyped. */
+function registerConfigNamespace(env, block, name) {
+    if (block !== null && typeof block === "object" && !Array.isArray(block)) {
+        const entries = Object.entries(block).filter(([, v]) => v !== null && typeof v === "object" && !Array.isArray(v));
+        if (entries.length > 0) {
+            const schema = {};
+            for (const [k, v] of entries)
+                schema[k] = jsonSchemaToCelType(v);
+            env.registerVariable({ name, schema });
+            return;
+        }
+    }
+    env.registerVariable(name, "map");
+}
+/** CEL environment for the `variables:`/`secrets:` expressions on a `Telo.Import`.
+ *
+ *  Import inputs are a config-only contract: their expressions are evaluated
+ *  against the IMPORTING module's `variables`/`secrets`, never the import's own
+ *  values map (the bug) nor the imported child's. `resources`, `env`, and `ports`
+ *  are registered as empty typed objects, so referencing them is a "No such key"
+ *  error that steers authors to a typed `variables` entry. */
+export function buildImportInputCelEnvironment(baseEnv, moduleManifest) {
+    const env = baseEnv.clone();
+    for (const brand of Object.keys(VALUE_BRAND_BASE)) {
+        env.registerType(brand, { fields: {} });
+    }
+    const mod = moduleManifest;
+    // Typing variables/secrets from the importer's schema can fail on a malformed
+    // schema; degrade those to permissive `map` if so — but never lose the
+    // resources/env/ports rejection registered below (the catch is scoped so a
+    // typing failure can't silently re-open the config-only contract).
+    try {
+        registerConfigNamespace(env, mod?.variables, "variables");
+        registerConfigNamespace(env, mod?.secrets, "secrets");
+    }
+    catch {
+        env.registerVariable("variables", "map");
+        env.registerVariable("secrets", "map");
+    }
+    // Override the base env's dyn `resources`/`env`/`ports` with empty typed objects
+    // so any access (`resources.X`, `env.X`) is a "No such key" error — these
+    // surfaces are not part of the config-only import contract.
+    for (const name of ["resources", "env", "ports"]) {
+        env.registerVariable({ name, schema: {} });
+    }
+    return env;
+}

package/dist/flatten-for-analyzer.d.ts

@@ -1,5 +1,18 @@
 import type { ResourceManifest } from "@telorun/sdk";
 import type { LoadedGraph, LoadedModule } from "./loaded-types.js";
+/** One parsed `exports.resources` / `exports.kinds` entry. `name` is the exported
+ *  instance name or kind suffix (the part after the dot, or the whole entry); `alias`
+ *  (when set) is this library's own import the entry RE-EXPORTS from. */
+export interface ParsedExportEntry {
+    name: string;
+    alias?: string;
+}
+/** Parse a single dotted export entry: `Alias.Name` → `{name: "Name", alias: "Alias"}`,
+ *  bare `Name` → `{name: "Name"}`. The single grammar for `exports.resources` and
+ *  `exports.kinds`, shared by the kernel's import controller and the analyzer/editor so
+ *  the dotted-name split can't drift. A leading dot (`.Name`) has no alias by design —
+ *  the empty prefix isn't a valid alias. */
+export declare function parseExportEntry(entry: string): ParsedExportEntry;
 /** The import-boundary forwarding rule, shared by `flattenForAnalyzer` (the
  *  CLI / kernel loader path) and the telo-editor's workspace projection so the
  *  two cannot drift. Given one module's stamped manifests and whether that
@@ -42,6 +55,45 @@ export declare function selectModuleManifestsForAnalysis(moduleManifests: Resour
  *  Position metadata (`positionIndex`) is NOT stamped on manifests —
  *  callers look it up via `findPositions(graph, ...)` on the LoadedGraph. */
 export declare function flattenForAnalyzer(graph: LoadedGraph): ResourceManifest[];
+/** A re-export declared in a library's `exports.resources` as a dotted `Alias.Name`:
+ *  module `module` re-exports the instance `name` reached through its own import
+ *  aliased `alias`. */
+export interface ReExportSpec {
+    module: string;
+    alias: string;
+    name: string;
+}
+/** Extract re-export specs from a library doc's `exports.resources` — the dotted `Alias.Name`
+ *  entries (bare-name locals are forwarded by the BFS instead). Shared by the CLI graph path
+ *  and the editor's workspace projection so the two cannot drift. */
+export declare function reExportSpecsFromExports(moduleName: string, exportsResources: readonly unknown[] | undefined): ReExportSpec[];
+/** Forward re-exported instances (`exports.resources: [!ref Alias.name]`) transitively so a
+ *  consumer's `!ref Consumer.name` resolves in `resolveRefSentinels` (keyed by the RE-EXPORTING
+ *  module). The owning instance is already forwarded under its own module; here we emit an
+ *  additional copy stamped under each re-exporting module, with an already-canonical kind. A
+ *  fixpoint loop forwards chains of arbitrary depth (`app → api → domain → …`): each pass can
+ *  resolve a re-export whose source was emitted in a prior pass. Graph-agnostic: `aliasToModule`
+ *  maps `(module, alias)` to the imported module's name. Mutates `result` in place. */
+export declare function forwardReExportManifests(result: ResourceManifest[], specs: readonly ReExportSpec[], aliasToModule: (module: string, alias: string) => string | undefined): void;
+/** Resolve every library's `exports.kinds` to a per-module map `suffix → canonical
+ *  <owningModule>.<Kind>`, following re-exports (`Alias.Kind`) transitively via a fixpoint.
+ *  `modules` lists each library's name + its raw `exports.kinds`; `aliasToModule(module, alias)`
+ *  maps one of that module's import aliases to the imported module's name. Graph-agnostic —
+ *  shared by the CLI graph path and the editor's workspace projection. */
+export declare function resolveExportedKinds(modules: ReadonlyArray<{
+    module: string;
+    exportsKinds: readonly string[];
+}>, aliasToModule: (module: string, alias: string) => string | undefined): Map<string, Map<string, string>>;
+/** Stamp `metadata.reExportedKinds` (suffix → canonical kind) onto every `Telo.Import` whose
+ *  target re-exports kinds, so the analyzer can register the re-export mappings. Only entries
+ *  that point at a module OTHER than the import's own target are stamped (genuine re-exports;
+ *  a locally-defined kind resolves through the normal alias path). Stamped on `metadata` (which
+ *  permits additional properties, like `resolvedModuleName`) since the `Telo.Import` schema
+ *  forbids extra top-level fields. Shared by both paths. */
+export declare function stampReExportedKinds(imports: ReadonlyArray<{
+    manifest: ResourceManifest;
+    targetModule: string;
+}>, exportedKinds: Map<string, Map<string, string>>): void;
 /** Project a LoadedModule (owner + partials) to a flat ResourceManifest[]
  *  with `metadata.module` stamped on non-module docs. The kernel's runtime
  *  entry load uses this to convert a `Loader.loadModule` result into the

package/dist/flatten-for-analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flatten-for-analyzer.d.ts","sourceRoot":"","sources":["../src/flatten-for-analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAc,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAG/E;;;;;;;;;;;;;;;;;;;2CAmB2C;AAC3C,wBAAgB,gCAAgC,CAC9C,eAAe,EAAE,gBAAgB,EAAE,EACnC,MAAM,EAAE,OAAO,GACd,gBAAgB,EAAE,CAwBpB;AAED;;;;;;;;;;;;;;;;;;;6EAmB6E;AAC7E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,gBAAgB,EAAE,CA+CzE;AAED;;;;;6BAK6B;AAC7B,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,YAAY,GAAG,gBAAgB,EAAE,CAEzE"}
+{"version":3,"file":"flatten-for-analyzer.d.ts","sourceRoot":"","sources":["../src/flatten-for-analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAInE;;yEAEyE;AACzE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;4CAI4C;AAC5C,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAGjE;AAED;;;;;;;;;;;;;;;;;;;2CAmB2C;AAC3C,wBAAgB,gCAAgC,CAC9C,eAAe,EAAE,gBAAgB,EAAE,EACnC,MAAM,EAAE,OAAO,GACd,gBAAgB,EAAE,CA6BpB;AAED;;;;;;;;;;;;;;;;;;;6EAmB6E;AAC7E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,gBAAgB,EAAE,CAiDzE;AAED;;uBAEuB;AACvB,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;qEAEqE;AACrE,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,GAC/C,YAAY,EAAE,CAShB;AAED;;;;;;uFAMuF;AACvF,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,gBAAgB,EAAE,EAC1B,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACnE,IAAI,CAgDN;AAED;;;;0EAI0E;AAC1E,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,EAC3E,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACnE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA8BlC;AAED;;;;;4DAK4D;AAC5D,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,CAAC;IAAE,QAAQ,EAAE,gBAAgB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,EAC5E,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC9C,IAAI,CAWN;AAwCD;;;;;6BAK6B;AAC7B,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,YAAY,GAAG,gBAAgB,EAAE,CAEzE"}