@telorun/analyzer 0.22.0 → 0.23.0

package/README.md

@@ -55,8 +55,8 @@ metadata:
     A complete feedback collection REST API — no code, pure YAML.
     Persists entries to SQLite and serves them over HTTP.
 imports:
-  Http: std/http-server@0.9.0
-  Sql: std/sql@0.8.0
+  Http: std/http-server@0.11.0
+  Sql: std/sql@0.9.0
 targets:
   - !ref Migrations
   - !ref Server

package/dist/alias-resolver.d.ts

@@ -3,7 +3,14 @@
 export declare class AliasResolver {
     private readonly importAliases;
     private readonly importedKinds;
+    /** `${alias}.${suffix}` → canonical `<owningModule>.<Kind>` for kinds an import
+     *  transitively RE-EXPORTS (`exports.kinds: [Alias.Kind]`), which don't live in the
+     *  import's own module. Resolved before the normal `<module>.<suffix>` construction. */
+    private readonly reExportedKinds;
     registerImport(alias: string, targetModule: string, exportedKinds: string[]): void;
+    /** Register that `<alias>.<suffix>` re-exports the kind canonically named `canonicalKind`
+     *  (owned by a module the alias's target imports, possibly several hops away). */
+    registerKindReExport(alias: string, suffix: string, canonicalKind: string): void;
     /** Real module name an alias points at (e.g. "Console" → "console"), or undefined.
      *  Used to resolve an alias-qualified instance reference "Console.writeLine" to the
      *  forwarded resource declared in that module. The `exports.resources` gate is enforced

package/dist/alias-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"alias-resolver.d.ts","sourceRoot":"","sources":["../src/alias-resolver.ts"],"names":[],"mappings":"AAAA;gFACgF;AAChF,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6B;IAC3D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAkC;IAEhE,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI;IAOlF;;;;qDAIiD;IACjD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIjD,sFAAsF;IACtF,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAe7C,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIhC,YAAY,IAAI,MAAM,EAAE;IAIxB;;qEAEiE;IACjE,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE;CAO3C"}
+{"version":3,"file":"alias-resolver.d.ts","sourceRoot":"","sources":["../src/alias-resolver.ts"],"names":[],"mappings":"AAAA;gFACgF;AAChF,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6B;IAC3D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAkC;IAChE;;4FAEwF;IACxF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6B;IAE7D,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI;IAOlF;sFACkF;IAClF,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI;IAIhF;;;;qDAIiD;IACjD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIjD,sFAAsF;IACtF,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAmB7C,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIhC,YAAY,IAAI,MAAM,EAAE;IAIxB;;qEAEiE;IACjE,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE;CAO3C"}

package/dist/alias-resolver.js

@@ -3,12 +3,21 @@
 export class AliasResolver {
     importAliases = new Map();
     importedKinds = new Map();
+    /** `${alias}.${suffix}` → canonical `<owningModule>.<Kind>` for kinds an import
+     *  transitively RE-EXPORTS (`exports.kinds: [Alias.Kind]`), which don't live in the
+     *  import's own module. Resolved before the normal `<module>.<suffix>` construction. */
+    reExportedKinds = new Map();
     registerImport(alias, targetModule, exportedKinds) {
         this.importAliases.set(alias, targetModule);
         if (exportedKinds.length > 0) {
             this.importedKinds.set(alias, new Set(exportedKinds));
         }
     }
+    /** Register that `<alias>.<suffix>` re-exports the kind canonically named `canonicalKind`
+     *  (owned by a module the alias's target imports, possibly several hops away). */
+    registerKindReExport(alias, suffix, canonicalKind) {
+        this.reExportedKinds.set(`${alias}.${suffix}`, canonicalKind);
+    }
     /** Real module name an alias points at (e.g. "Console" → "console"), or undefined.
      *  Used to resolve an alias-qualified instance reference "Console.writeLine" to the
      *  forwarded resource declared in that module. The `exports.resources` gate is enforced
@@ -27,6 +36,11 @@ export class AliasResolver {
             return undefined;
         const prefix = kind.slice(0, dot);
         const suffix = kind.slice(dot + 1);
+        // Re-export takes precedence: a re-exported kind resolves to its true owning module,
+        // not `${prefix-target}.${suffix}` (and bypasses the gate — it's explicitly re-exported).
+        const reExported = this.reExportedKinds.get(`${prefix}.${suffix}`);
+        if (reExported)
+            return reExported;
         const realModule = this.importAliases.get(prefix);
         if (!realModule)
             return undefined;

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAiB9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA4hB/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAkqBvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAerB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAiB9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA4hB/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IA+sBvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAerB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -1,6 +1,6 @@
 import { defaultRegistry, isTaggedSentinel } from "@telorun/templating";
 import { AliasResolver } from "./alias-resolver.js";
-import { buildCelEnvironment, buildTypedCelEnvironment, } from "./cel-environment.js";
+import { buildCelEnvironment, buildImportInputCelEnvironment, buildTypedCelEnvironment, } from "./cel-environment.js";
 import { DefinitionRegistry } from "./definition-registry.js";
 import { buildDependencyGraph, formatCycle } from "./dependency-graph.js";
 import { buildKernelGlobalsSchema, mergeKernelGlobalsIntoContext } from "./kernel-globals.js";
@@ -579,17 +579,18 @@ export class StaticAnalyzer {
                     if (resolvedModuleName) {
                         defs.registerModuleIdentity(resolvedNamespace ?? null, resolvedModuleName);
                     }
+                    // `metadata.reExportedKinds` (stamped by flattenForAnalyzer / the editor projection)
+                    // maps an exported suffix to the true owning module's canonical kind for kinds this
+                    // import transitively re-exports (`exports.kinds: [Alias.Kind]`).
+                    const reExportedKinds = (m.metadata?.reExportedKinds ?? {});
                     // Alias registration is scoped: consumer imports vs. imported-library imports.
-                    if (!ownModule || rootModules.has(ownModule)) {
-                        aliases.registerImport(alias, targetModule, exportedKinds);
-                    }
-                    else {
-                        let libResolver = aliasesByModule.get(ownModule);
-                        if (!libResolver) {
-                            libResolver = new AliasResolver();
-                            aliasesByModule.set(ownModule, libResolver);
-                        }
-                        libResolver.registerImport(alias, targetModule, exportedKinds);
+                    const resolver = !ownModule || rootModules.has(ownModule)
+                        ? aliases
+                        : (aliasesByModule.get(ownModule) ??
+                            aliasesByModule.set(ownModule, new AliasResolver()).get(ownModule));
+                    resolver.registerImport(alias, targetModule, exportedKinds);
+                    for (const [suffix, canonical] of Object.entries(reExportedKinds)) {
+                        resolver.registerKindReExport(alias, suffix, canonical);
                     }
                 }
             }
@@ -735,6 +736,26 @@ export class StaticAnalyzer {
                     }
                 }
             }
+            // `exports.resources` entries are plain names: `Db` (local) or `Alias.Name` (re-export),
+            // mirroring `exports.kinds`. The `!ref` tag is not accepted here — a `!ref` parses to a
+            // sentinel object that the schema's CEL/ref exemption would silently pass, so reject any
+            // non-string entry with an actionable message instead.
+            const exportsResources = m.exports?.resources;
+            if (Array.isArray(exportsResources)) {
+                for (let i = 0; i < exportsResources.length; i++) {
+                    if (typeof exportsResources[i] === "string")
+                        continue;
+                    diagnostics.push({
+                        severity: DiagnosticSeverity.Error,
+                        code: "INVALID_EXPORT",
+                        source: SOURCE,
+                        message: `Telo.Library exports.resources[${i}]: write the exported name as a plain string — ` +
+                            `'Name' to export a local instance, or 'Alias.Name' to re-export an imported one. ` +
+                            `The '!ref' tag is not allowed in exports.resources.`,
+                        data: { resource, filePath, path: `exports.resources.${i}` },
+                    });
+                }
+            }
         }
         // Build typed kernel globals schema so x-telo-context chain validation
         // recognises variables, secrets, resources, env automatically
@@ -804,8 +825,22 @@ export class StaticAnalyzer {
                         },
                     }
                     : definition.schema;
-                // Phase 1: CEL type checking — walk data+schema together, check env.check() return types
-                const baseTypedEnv = buildTypedCelEnvironment(this.celEnv, m, undefined, moduleManifest);
+                // Phase 1: CEL type checking — walk data+schema together, check env.check() return types.
+                // A Telo.Import's variables/secrets are a config-only contract evaluated against the
+                // IMPORTING module's scope, so type them from the owning module doc (matched by
+                // `metadata.module`) and drop `resources`/`env` so referencing them is an error. A
+                // library's own internal import is validated against that library in the library's
+                // standalone analysis; in this flattened app pass the library doc is absent, so the
+                // importer is undefined here and variables/secrets fall back to a permissive `map`
+                // (no false positives) while resources/env stay rejected.
+                const importerModule = m.kind === "Telo.Import"
+                    ? allManifests.find((mm) => (mm.kind === "Telo.Application" || mm.kind === "Telo.Library") &&
+                        mm.metadata?.name ===
+                            m.metadata?.module)
+                    : undefined;
+                const baseTypedEnv = m.kind === "Telo.Import"
+                    ? buildImportInputCelEnvironment(this.celEnv, importerModule)
+                    : buildTypedCelEnvironment(this.celEnv, m, undefined, moduleManifest);
                 const celIssues = collectCelTypeIssues(m, schema, "", definition, m, baseTypedEnv, this.celEnv, moduleManifest);
                 // Phase 2+3: AJV on substituted data — CEL fields replaced with typed placeholders
                 const ajvIssues = validateAgainstSchema(substituteCelFields(m, schema), schema);

package/dist/builtins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EAqd/C,CAAC"}
+{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EAud/C,CAAC"}

package/dist/builtins.js

@@ -453,8 +453,10 @@ export const KERNEL_BUILTINS = [
                     type: "object",
                     properties: {
                         kinds: { type: "array", items: { type: "string" } },
-                        // `variables` / `secrets` are reserved on the resources.<Alias> value-flow
-                        // surface, so a library may not export instances under those names.
+                        // An entry is a bare name (`Db`, a locally-owned export) or a dotted `Alias.Name`
+                        // (re-export of the instance reached via this library's import aliased `Alias`,
+                        // under the name `Name`) — mirroring `exports.kinds`. `variables` / `secrets` are
+                        // reserved on the resources.<Alias> value-flow surface, so they may not be exported.
                         resources: {
                             type: "array",
                             items: { type: "string", not: { enum: ["variables", "secrets"] } },

package/dist/cel-environment.d.ts

@@ -13,4 +13,12 @@ export type { CelHandlers } from "@telorun/templating";
  *  NOTE: The set of kernel globals registered here must match `KERNEL_GLOBAL_NAMES`
  *  in kernel-globals.ts, which is used for chain-access validation. */
 export declare function buildTypedCelEnvironment(baseEnv: Environment, manifest: ResourceManifest, extraContextSchema?: Record<string, any> | null, rootModuleManifest?: ResourceManifest): Environment;
+/** CEL environment for the `variables:`/`secrets:` expressions on a `Telo.Import`.
+ *
+ *  Import inputs are a config-only contract: their expressions are evaluated
+ *  against the IMPORTING module's `variables`/`secrets`, never the import's own
+ *  values map (the bug) nor the imported child's. `resources`, `env`, and `ports`
+ *  are registered as empty typed objects, so referencing them is a "No such key"
+ *  error that steers authors to a typed `variables` entry. */
+export declare function buildImportInputCelEnvironment(baseEnv: Environment, moduleManifest: ResourceManifest | undefined): Environment;
 //# sourceMappingURL=cel-environment.d.ts.map

package/dist/cel-environment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cel-environment.d.ts","sourceRoot":"","sources":["../src/cel-environment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAUrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;;;uEASuE;AACvE,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,gBAAgB,EAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,EAI/C,kBAAkB,CAAC,EAAE,gBAAgB,GACpC,WAAW,CAuEb"}
+{"version":3,"file":"cel-environment.d.ts","sourceRoot":"","sources":["../src/cel-environment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAUrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;;;uEASuE;AACvE,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,gBAAgB,EAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,EAI/C,kBAAkB,CAAC,EAAE,gBAAgB,GACpC,WAAW,CAuEb;AAuBD;;;;;;8DAM8D;AAC9D,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,WAAW,EACpB,cAAc,EAAE,gBAAgB,GAAG,SAAS,GAC3C,WAAW,CAwBb"}

package/dist/cel-environment.js

@@ -85,3 +85,51 @@ rootModuleManifest) {
         return baseEnv.clone();
     }
 }
+/** Register a `variables`/`secrets` namespace typed from a module doc's schema map
+ *  (`{ name: <schema>, … }`), falling back to dyn `map` when absent or untyped. */
+function registerConfigNamespace(env, block, name) {
+    if (block !== null && typeof block === "object" && !Array.isArray(block)) {
+        const entries = Object.entries(block).filter(([, v]) => v !== null && typeof v === "object" && !Array.isArray(v));
+        if (entries.length > 0) {
+            const schema = {};
+            for (const [k, v] of entries)
+                schema[k] = jsonSchemaToCelType(v);
+            env.registerVariable({ name, schema });
+            return;
+        }
+    }
+    env.registerVariable(name, "map");
+}
+/** CEL environment for the `variables:`/`secrets:` expressions on a `Telo.Import`.
+ *
+ *  Import inputs are a config-only contract: their expressions are evaluated
+ *  against the IMPORTING module's `variables`/`secrets`, never the import's own
+ *  values map (the bug) nor the imported child's. `resources`, `env`, and `ports`
+ *  are registered as empty typed objects, so referencing them is a "No such key"
+ *  error that steers authors to a typed `variables` entry. */
+export function buildImportInputCelEnvironment(baseEnv, moduleManifest) {
+    const env = baseEnv.clone();
+    for (const brand of Object.keys(VALUE_BRAND_BASE)) {
+        env.registerType(brand, { fields: {} });
+    }
+    const mod = moduleManifest;
+    // Typing variables/secrets from the importer's schema can fail on a malformed
+    // schema; degrade those to permissive `map` if so — but never lose the
+    // resources/env/ports rejection registered below (the catch is scoped so a
+    // typing failure can't silently re-open the config-only contract).
+    try {
+        registerConfigNamespace(env, mod?.variables, "variables");
+        registerConfigNamespace(env, mod?.secrets, "secrets");
+    }
+    catch {
+        env.registerVariable("variables", "map");
+        env.registerVariable("secrets", "map");
+    }
+    // Override the base env's dyn `resources`/`env`/`ports` with empty typed objects
+    // so any access (`resources.X`, `env.X`) is a "No such key" error — these
+    // surfaces are not part of the config-only import contract.
+    for (const name of ["resources", "env", "ports"]) {
+        env.registerVariable({ name, schema: {} });
+    }
+    return env;
+}

package/dist/flatten-for-analyzer.d.ts

@@ -1,5 +1,18 @@
 import type { ResourceManifest } from "@telorun/sdk";
 import type { LoadedGraph, LoadedModule } from "./loaded-types.js";
+/** One parsed `exports.resources` / `exports.kinds` entry. `name` is the exported
+ *  instance name or kind suffix (the part after the dot, or the whole entry); `alias`
+ *  (when set) is this library's own import the entry RE-EXPORTS from. */
+export interface ParsedExportEntry {
+    name: string;
+    alias?: string;
+}
+/** Parse a single dotted export entry: `Alias.Name` → `{name: "Name", alias: "Alias"}`,
+ *  bare `Name` → `{name: "Name"}`. The single grammar for `exports.resources` and
+ *  `exports.kinds`, shared by the kernel's import controller and the analyzer/editor so
+ *  the dotted-name split can't drift. A leading dot (`.Name`) has no alias by design —
+ *  the empty prefix isn't a valid alias. */
+export declare function parseExportEntry(entry: string): ParsedExportEntry;
 /** The import-boundary forwarding rule, shared by `flattenForAnalyzer` (the
  *  CLI / kernel loader path) and the telo-editor's workspace projection so the
  *  two cannot drift. Given one module's stamped manifests and whether that
@@ -42,6 +55,45 @@ export declare function selectModuleManifestsForAnalysis(moduleManifests: Resour
  *  Position metadata (`positionIndex`) is NOT stamped on manifests —
  *  callers look it up via `findPositions(graph, ...)` on the LoadedGraph. */
 export declare function flattenForAnalyzer(graph: LoadedGraph): ResourceManifest[];
+/** A re-export declared in a library's `exports.resources` as a dotted `Alias.Name`:
+ *  module `module` re-exports the instance `name` reached through its own import
+ *  aliased `alias`. */
+export interface ReExportSpec {
+    module: string;
+    alias: string;
+    name: string;
+}
+/** Extract re-export specs from a library doc's `exports.resources` — the dotted `Alias.Name`
+ *  entries (bare-name locals are forwarded by the BFS instead). Shared by the CLI graph path
+ *  and the editor's workspace projection so the two cannot drift. */
+export declare function reExportSpecsFromExports(moduleName: string, exportsResources: readonly unknown[] | undefined): ReExportSpec[];
+/** Forward re-exported instances (`exports.resources: [!ref Alias.name]`) transitively so a
+ *  consumer's `!ref Consumer.name` resolves in `resolveRefSentinels` (keyed by the RE-EXPORTING
+ *  module). The owning instance is already forwarded under its own module; here we emit an
+ *  additional copy stamped under each re-exporting module, with an already-canonical kind. A
+ *  fixpoint loop forwards chains of arbitrary depth (`app → api → domain → …`): each pass can
+ *  resolve a re-export whose source was emitted in a prior pass. Graph-agnostic: `aliasToModule`
+ *  maps `(module, alias)` to the imported module's name. Mutates `result` in place. */
+export declare function forwardReExportManifests(result: ResourceManifest[], specs: readonly ReExportSpec[], aliasToModule: (module: string, alias: string) => string | undefined): void;
+/** Resolve every library's `exports.kinds` to a per-module map `suffix → canonical
+ *  <owningModule>.<Kind>`, following re-exports (`Alias.Kind`) transitively via a fixpoint.
+ *  `modules` lists each library's name + its raw `exports.kinds`; `aliasToModule(module, alias)`
+ *  maps one of that module's import aliases to the imported module's name. Graph-agnostic —
+ *  shared by the CLI graph path and the editor's workspace projection. */
+export declare function resolveExportedKinds(modules: ReadonlyArray<{
+    module: string;
+    exportsKinds: readonly string[];
+}>, aliasToModule: (module: string, alias: string) => string | undefined): Map<string, Map<string, string>>;
+/** Stamp `metadata.reExportedKinds` (suffix → canonical kind) onto every `Telo.Import` whose
+ *  target re-exports kinds, so the analyzer can register the re-export mappings. Only entries
+ *  that point at a module OTHER than the import's own target are stamped (genuine re-exports;
+ *  a locally-defined kind resolves through the normal alias path). Stamped on `metadata` (which
+ *  permits additional properties, like `resolvedModuleName`) since the `Telo.Import` schema
+ *  forbids extra top-level fields. Shared by both paths. */
+export declare function stampReExportedKinds(imports: ReadonlyArray<{
+    manifest: ResourceManifest;
+    targetModule: string;
+}>, exportedKinds: Map<string, Map<string, string>>): void;
 /** Project a LoadedModule (owner + partials) to a flat ResourceManifest[]
  *  with `metadata.module` stamped on non-module docs. The kernel's runtime
  *  entry load uses this to convert a `Loader.loadModule` result into the

package/dist/flatten-for-analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flatten-for-analyzer.d.ts","sourceRoot":"","sources":["../src/flatten-for-analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAc,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAG/E;;;;;;;;;;;;;;;;;;;2CAmB2C;AAC3C,wBAAgB,gCAAgC,CAC9C,eAAe,EAAE,gBAAgB,EAAE,EACnC,MAAM,EAAE,OAAO,GACd,gBAAgB,EAAE,CAwBpB;AAED;;;;;;;;;;;;;;;;;;;6EAmB6E;AAC7E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,gBAAgB,EAAE,CA+CzE;AAED;;;;;6BAK6B;AAC7B,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,YAAY,GAAG,gBAAgB,EAAE,CAEzE"}
+{"version":3,"file":"flatten-for-analyzer.d.ts","sourceRoot":"","sources":["../src/flatten-for-analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAInE;;yEAEyE;AACzE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;4CAI4C;AAC5C,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAGjE;AAED;;;;;;;;;;;;;;;;;;;2CAmB2C;AAC3C,wBAAgB,gCAAgC,CAC9C,eAAe,EAAE,gBAAgB,EAAE,EACnC,MAAM,EAAE,OAAO,GACd,gBAAgB,EAAE,CA6BpB;AAED;;;;;;;;;;;;;;;;;;;6EAmB6E;AAC7E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,gBAAgB,EAAE,CAiDzE;AAED;;uBAEuB;AACvB,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;qEAEqE;AACrE,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,GAC/C,YAAY,EAAE,CAShB;AAED;;;;;;uFAMuF;AACvF,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,gBAAgB,EAAE,EAC1B,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACnE,IAAI,CAgDN;AAED;;;;0EAI0E;AAC1E,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,EAC3E,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACnE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA8BlC;AAED;;;;;4DAK4D;AAC5D,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,CAAC;IAAE,QAAQ,EAAE,gBAAgB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,EAC5E,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC9C,IAAI,CAWN;AAwCD;;;;;6BAK6B;AAC7B,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,YAAY,GAAG,gBAAgB,EAAE,CAEzE"}

package/dist/flatten-for-analyzer.js

@@ -1,4 +1,13 @@
 import { isModuleKind } from "./module-kinds.js";
+/** Parse a single dotted export entry: `Alias.Name` → `{name: "Name", alias: "Alias"}`,
+ *  bare `Name` → `{name: "Name"}`. The single grammar for `exports.resources` and
+ *  `exports.kinds`, shared by the kernel's import controller and the analyzer/editor so
+ *  the dotted-name split can't drift. A leading dot (`.Name`) has no alias by design —
+ *  the empty prefix isn't a valid alias. */
+export function parseExportEntry(entry) {
+    const dot = entry.indexOf(".");
+    return dot > 0 ? { name: entry.slice(dot + 1), alias: entry.slice(0, dot) } : { name: entry };
+}
 /** The import-boundary forwarding rule, shared by `flattenForAnalyzer` (the
  *  CLI / kernel loader path) and the telo-editor's workspace projection so the
  *  two cannot drift. Given one module's stamped manifests and whether that
@@ -23,7 +32,15 @@ export function selectModuleManifestsForAnalysis(moduleManifests, isRoot) {
     if (isRoot)
         return moduleManifests;
     const libDoc = moduleManifests.find((m) => isModuleKind(m.kind));
-    const exportedResources = new Set(libDoc?.exports?.resources ?? []);
+    // An `exports.resources` entry is a bare name or a dotted `Alias.Name` (re-export). Only the
+    // export NAME matches a local instance below; re-exports are forwarded by `forwardReExports`.
+    const exportedResources = new Set();
+    for (const entry of libDoc?.exports
+        ?.resources ?? []) {
+        if (typeof entry !== "string")
+            continue;
+        exportedResources.add(parseExportEntry(entry).name);
+    }
     const out = [];
     for (const m of moduleManifests) {
         if (m.kind === "Telo.Definition" || m.kind === "Telo.Abstract" || m.kind === "Telo.Import") {
@@ -81,6 +98,7 @@ export function flattenForAnalyzer(graph) {
             result.push(...selectModuleManifestsForAnalysis(collectModuleManifests(targetModule), false));
         }
     }
+    forwardReExports(graph, result);
     // Stamp resolved import identity on every Telo.Import in the result by
     // reading the edge's pre-resolved name/namespace — no re-derivation from
     // manifest metadata. The edge is keyed by (owner-file, alias) which is
@@ -105,6 +123,179 @@ export function flattenForAnalyzer(graph) {
     }
     return result;
 }
+/** Extract re-export specs from a library doc's `exports.resources` — the dotted `Alias.Name`
+ *  entries (bare-name locals are forwarded by the BFS instead). Shared by the CLI graph path
+ *  and the editor's workspace projection so the two cannot drift. */
+export function reExportSpecsFromExports(moduleName, exportsResources) {
+    const specs = [];
+    for (const entry of exportsResources ?? []) {
+        if (typeof entry !== "string")
+            continue;
+        const { name, alias } = parseExportEntry(entry);
+        if (!alias || alias === "Self")
+            continue;
+        specs.push({ module: moduleName, alias, name });
+    }
+    return specs;
+}
+/** Forward re-exported instances (`exports.resources: [!ref Alias.name]`) transitively so a
+ *  consumer's `!ref Consumer.name` resolves in `resolveRefSentinels` (keyed by the RE-EXPORTING
+ *  module). The owning instance is already forwarded under its own module; here we emit an
+ *  additional copy stamped under each re-exporting module, with an already-canonical kind. A
+ *  fixpoint loop forwards chains of arbitrary depth (`app → api → domain → …`): each pass can
+ *  resolve a re-export whose source was emitted in a prior pass. Graph-agnostic: `aliasToModule`
+ *  maps `(module, alias)` to the imported module's name. Mutates `result` in place. */
+export function forwardReExportManifests(result, specs, aliasToModule) {
+    // Index forwarded instances by `module\0name` (only re-export TARGETS are forwarded).
+    const forwarded = new Map();
+    for (const m of result) {
+        const meta = m.metadata;
+        if (meta?.forwardedExport && meta.module && meta.name) {
+            forwarded.set(`${meta.module}\0${meta.name}`, m);
+        }
+    }
+    // Canonicalize an authored/forwarded kind to a scope-independent `<module>.<Kind>` using the
+    // owning module's own import aliases. Idempotent: an already-canonical kind whose prefix isn't
+    // an alias of `ownerModule` is returned unchanged, so re-exports of re-exports stay stable.
+    const canonicalKind = (kind, ownerModule) => {
+        if (kind.startsWith("Self."))
+            return `${ownerModule}.${kind.slice("Self.".length)}`;
+        const dot = kind.indexOf(".");
+        if (dot <= 0)
+            return kind;
+        const target = aliasToModule(ownerModule, kind.slice(0, dot));
+        return target ? `${target}.${kind.slice(dot + 1)}` : kind;
+    };
+    // Fixpoint — bounded by the number of specs (each can be satisfied at most once).
+    for (let pass = 0; pass <= specs.length; pass++) {
+        let added = false;
+        for (const spec of specs) {
+            const key = `${spec.module}\0${spec.name}`;
+            if (forwarded.has(key))
+                continue;
+            const sourceModule = aliasToModule(spec.module, spec.alias);
+            if (!sourceModule)
+                continue;
+            const src = forwarded.get(`${sourceModule}\0${spec.name}`);
+            if (!src)
+                continue; // source not forwarded yet — a later pass may satisfy it
+            const kind = canonicalKind(src.kind, sourceModule);
+            const manifest = {
+                ...src,
+                kind,
+                metadata: {
+                    ...src.metadata,
+                    name: spec.name,
+                    module: spec.module,
+                    forwardedExport: true,
+                },
+            };
+            result.push(manifest);
+            forwarded.set(key, manifest);
+            added = true;
+        }
+        if (!added)
+            break;
+    }
+}
+/** Resolve every library's `exports.kinds` to a per-module map `suffix → canonical
+ *  <owningModule>.<Kind>`, following re-exports (`Alias.Kind`) transitively via a fixpoint.
+ *  `modules` lists each library's name + its raw `exports.kinds`; `aliasToModule(module, alias)`
+ *  maps one of that module's import aliases to the imported module's name. Graph-agnostic —
+ *  shared by the CLI graph path and the editor's workspace projection. */
+export function resolveExportedKinds(modules, aliasToModule) {
+    const out = new Map();
+    const tableFor = (m) => {
+        let t = out.get(m);
+        if (!t)
+            out.set(m, (t = new Map()));
+        return t;
+    };
+    for (let pass = 0; pass <= modules.length; pass++) {
+        let changed = false;
+        for (const { module, exportsKinds } of modules) {
+            const table = tableFor(module);
+            for (const entry of exportsKinds) {
+                const { name: suffix, alias } = parseExportEntry(entry);
+                if (table.has(suffix))
+                    continue;
+                if (!alias) {
+                    table.set(suffix, `${module}.${suffix}`);
+                    changed = true;
+                    continue;
+                }
+                const source = aliasToModule(module, alias);
+                const canonical = source ? out.get(source)?.get(suffix) : undefined;
+                if (canonical) {
+                    table.set(suffix, canonical);
+                    changed = true;
+                }
+            }
+        }
+        if (!changed)
+            break;
+    }
+    return out;
+}
+/** Stamp `metadata.reExportedKinds` (suffix → canonical kind) onto every `Telo.Import` whose
+ *  target re-exports kinds, so the analyzer can register the re-export mappings. Only entries
+ *  that point at a module OTHER than the import's own target are stamped (genuine re-exports;
+ *  a locally-defined kind resolves through the normal alias path). Stamped on `metadata` (which
+ *  permits additional properties, like `resolvedModuleName`) since the `Telo.Import` schema
+ *  forbids extra top-level fields. Shared by both paths. */
+export function stampReExportedKinds(imports, exportedKinds) {
+    for (const { manifest, targetModule } of imports) {
+        const table = exportedKinds.get(targetModule);
+        if (!table)
+            continue;
+        const reExported = {};
+        for (const [suffix, canonical] of table) {
+            if (canonical !== `${targetModule}.${suffix}`)
+                reExported[suffix] = canonical;
+        }
+        if (Object.keys(reExported).length === 0)
+            continue;
+        manifest.metadata.reExportedKinds = reExported;
+    }
+}
+/** CLI/kernel adapter: collect re-export specs + alias map from a LoadedGraph. */
+function forwardReExports(graph, result) {
+    const ownerSourceOf = new Map();
+    const specs = [];
+    const kindModules = [];
+    for (const [source, mod] of graph.modules) {
+        if (source === graph.rootSource)
+            continue; // root is an Application — no exports
+        const libDoc = mod.owner.manifests.find((m) => m && isModuleKind(m.kind));
+        const moduleName = libDoc?.metadata?.name;
+        if (!libDoc || !moduleName)
+            continue;
+        ownerSourceOf.set(moduleName, mod.owner.source);
+        specs.push(...reExportSpecsFromExports(moduleName, libDoc.exports?.resources));
+        kindModules.push({ module: moduleName, exportsKinds: libDoc.exports?.kinds ?? [] });
+    }
+    const aliasToModule = (module, alias) => {
+        const ownerSource = ownerSourceOf.get(module);
+        return ownerSource
+            ? (graph.importEdges.get(ownerSource)?.get(alias)?.targetModuleName ?? undefined)
+            : undefined;
+    };
+    forwardReExportManifests(result, specs, aliasToModule);
+    // Resolve every library's re-exported kinds and stamp them onto the consumer-facing
+    // Telo.Import manifests so the analyzer can register the re-export mappings.
+    const exportedKinds = resolveExportedKinds(kindModules, aliasToModule);
+    const imports = [];
+    for (const m of result) {
+        if (m.kind !== "Telo.Import")
+            continue;
+        const owner = m.metadata?.source;
+        const alias = m.metadata?.name;
+        const target = owner && alias ? graph.importEdges.get(owner)?.get(alias)?.targetModuleName : undefined;
+        if (target)
+            imports.push({ manifest: m, targetModule: target });
+    }
+    stampReExportedKinds(imports, exportedKinds);
+}
 /** Project a LoadedModule (owner + partials) to a flat ResourceManifest[]
  *  with `metadata.module` stamped on non-module docs. The kernel's runtime
  *  entry load uses this to convert a `Loader.loadModule` result into the

package/dist/index.d.ts

@@ -2,7 +2,7 @@ export { AnalysisRegistry } from "./analysis-registry.js";
 export type { RefFieldInfo } from "./analysis-registry.js";
 export { StaticAnalyzer } from "./analyzer.js";
 export type { GraphLoadError, ImportEdge, LoadedFile, LoadedGraph, LoadedModule, ParseError, } from "./loaded-types.js";
-export { flattenForAnalyzer, flattenLoadedModule, selectModuleManifestsForAnalysis, } from "./flatten-for-analyzer.js";
+export { flattenForAnalyzer, flattenLoadedModule, forwardReExportManifests, parseExportEntry, reExportSpecsFromExports, resolveExportedKinds, selectModuleManifestsForAnalysis, stampReExportedKinds, type ParsedExportEntry, type ReExportSpec, } from "./flatten-for-analyzer.js";
 export { visitManifest } from "./manifest-visitor.js";
 export type { CelSiteEvent, ManifestVisitor, RefSiteEvent, ResourceEnterEvent, ResourceExitEvent, ScopeBoundaryEvent, SchemaFromSiteEvent, VisitOptions, } from "./manifest-visitor.js";
 export { Loader } from "./manifest-loader.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,gCAAgC,GACnC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,6 +1,6 @@
 export { AnalysisRegistry } from "./analysis-registry.js";
 export { StaticAnalyzer } from "./analyzer.js";
-export { flattenForAnalyzer, flattenLoadedModule, selectModuleManifestsForAnalysis, } from "./flatten-for-analyzer.js";
+export { flattenForAnalyzer, flattenLoadedModule, forwardReExportManifests, parseExportEntry, reExportSpecsFromExports, resolveExportedKinds, selectModuleManifestsForAnalysis, stampReExportedKinds, } from "./flatten-for-analyzer.js";
 export { visitManifest } from "./manifest-visitor.js";
 export { Loader } from "./manifest-loader.js";
 export { isModuleKind, MODULE_KINDS } from "./module-kinds.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",

package/src/alias-resolver.ts

@@ -3,6 +3,10 @@
 export class AliasResolver {
   private readonly importAliases = new Map<string, string>();
   private readonly importedKinds = new Map<string, Set<string>>();
+  /** `${alias}.${suffix}` → canonical `<owningModule>.<Kind>` for kinds an import
+   *  transitively RE-EXPORTS (`exports.kinds: [Alias.Kind]`), which don't live in the
+   *  import's own module. Resolved before the normal `<module>.<suffix>` construction. */
+  private readonly reExportedKinds = new Map<string, string>();
 
   registerImport(alias: string, targetModule: string, exportedKinds: string[]): void {
     this.importAliases.set(alias, targetModule);
@@ -11,6 +15,12 @@ export class AliasResolver {
     }
   }
 
+  /** Register that `<alias>.<suffix>` re-exports the kind canonically named `canonicalKind`
+   *  (owned by a module the alias's target imports, possibly several hops away). */
+  registerKindReExport(alias: string, suffix: string, canonicalKind: string): void {
+    this.reExportedKinds.set(`${alias}.${suffix}`, canonicalKind);
+  }
+
   /** Real module name an alias points at (e.g. "Console" → "console"), or undefined.
    *  Used to resolve an alias-qualified instance reference "Console.writeLine" to the
    *  forwarded resource declared in that module. The `exports.resources` gate is enforced
@@ -29,6 +39,10 @@ export class AliasResolver {
     if (dot === -1) return undefined;
     const prefix = kind.slice(0, dot);
     const suffix = kind.slice(dot + 1);
+    // Re-export takes precedence: a re-exported kind resolves to its true owning module,
+    // not `${prefix-target}.${suffix}` (and bypasses the gate — it's explicitly re-exported).
+    const reExported = this.reExportedKinds.get(`${prefix}.${suffix}`);
+    if (reExported) return reExported;
     const realModule = this.importAliases.get(prefix);
     if (!realModule) return undefined;
     const allowed = this.importedKinds.get(prefix);

package/src/analyzer.ts

@@ -5,6 +5,7 @@ import { AliasResolver } from "./alias-resolver.js";
 import { AnalysisRegistry } from "./analysis-registry.js";
 import {
   buildCelEnvironment,
+  buildImportInputCelEnvironment,
   buildTypedCelEnvironment,
   type CelHandlers,
 } from "./cel-environment.js";
@@ -706,16 +707,22 @@ export class StaticAnalyzer {
           if (resolvedModuleName) {
             defs.registerModuleIdentity(resolvedNamespace ?? null, resolvedModuleName);
           }
+          // `metadata.reExportedKinds` (stamped by flattenForAnalyzer / the editor projection)
+          // maps an exported suffix to the true owning module's canonical kind for kinds this
+          // import transitively re-exports (`exports.kinds: [Alias.Kind]`).
+          const reExportedKinds = ((m.metadata as any)?.reExportedKinds ?? {}) as Record<
+            string,
+            string
+          >;
           // Alias registration is scoped: consumer imports vs. imported-library imports.
-          if (!ownModule || rootModules.has(ownModule)) {
-            aliases.registerImport(alias, targetModule, exportedKinds);
-          } else {
-            let libResolver = aliasesByModule.get(ownModule);
-            if (!libResolver) {
-              libResolver = new AliasResolver();
-              aliasesByModule.set(ownModule, libResolver);
-            }
-            libResolver.registerImport(alias, targetModule, exportedKinds);
+          const resolver =
+            !ownModule || rootModules.has(ownModule)
+              ? aliases
+              : (aliasesByModule.get(ownModule) ??
+                aliasesByModule.set(ownModule, new AliasResolver()).get(ownModule)!);
+          resolver.registerImport(alias, targetModule, exportedKinds);
+          for (const [suffix, canonical] of Object.entries(reExportedKinds)) {
+            resolver.registerKindReExport(alias, suffix, canonical);
           }
         }
       }
@@ -864,6 +871,26 @@ export class StaticAnalyzer {
           }
         }
       }
+      // `exports.resources` entries are plain names: `Db` (local) or `Alias.Name` (re-export),
+      // mirroring `exports.kinds`. The `!ref` tag is not accepted here — a `!ref` parses to a
+      // sentinel object that the schema's CEL/ref exemption would silently pass, so reject any
+      // non-string entry with an actionable message instead.
+      const exportsResources = (m as Record<string, any>).exports?.resources;
+      if (Array.isArray(exportsResources)) {
+        for (let i = 0; i < exportsResources.length; i++) {
+          if (typeof exportsResources[i] === "string") continue;
+          diagnostics.push({
+            severity: DiagnosticSeverity.Error,
+            code: "INVALID_EXPORT",
+            source: SOURCE,
+            message:
+              `Telo.Library exports.resources[${i}]: write the exported name as a plain string — ` +
+              `'Name' to export a local instance, or 'Alias.Name' to re-export an imported one. ` +
+              `The '!ref' tag is not allowed in exports.resources.`,
+            data: { resource, filePath, path: `exports.resources.${i}` },
+          });
+        }
+      }
     }
 
     // Build typed kernel globals schema so x-telo-context chain validation
@@ -943,8 +970,27 @@ export class StaticAnalyzer {
                 },
               }
             : definition.schema;
-        // Phase 1: CEL type checking — walk data+schema together, check env.check() return types
-        const baseTypedEnv = buildTypedCelEnvironment(this.celEnv, m, undefined, moduleManifest);
+        // Phase 1: CEL type checking — walk data+schema together, check env.check() return types.
+        // A Telo.Import's variables/secrets are a config-only contract evaluated against the
+        // IMPORTING module's scope, so type them from the owning module doc (matched by
+        // `metadata.module`) and drop `resources`/`env` so referencing them is an error. A
+        // library's own internal import is validated against that library in the library's
+        // standalone analysis; in this flattened app pass the library doc is absent, so the
+        // importer is undefined here and variables/secrets fall back to a permissive `map`
+        // (no false positives) while resources/env stay rejected.
+        const importerModule =
+          m.kind === "Telo.Import"
+            ? allManifests.find(
+                (mm) =>
+                  (mm.kind === "Telo.Application" || mm.kind === "Telo.Library") &&
+                  (mm.metadata as { name?: string } | undefined)?.name ===
+                    (m.metadata as { module?: string } | undefined)?.module,
+              )
+            : undefined;
+        const baseTypedEnv =
+          m.kind === "Telo.Import"
+            ? buildImportInputCelEnvironment(this.celEnv, importerModule)
+            : buildTypedCelEnvironment(this.celEnv, m, undefined, moduleManifest);
         const celIssues = collectCelTypeIssues(
           m,
           schema,

package/src/builtins.ts

@@ -455,8 +455,10 @@ export const KERNEL_BUILTINS: ResourceDefinition[] = [
           type: "object",
           properties: {
             kinds: { type: "array", items: { type: "string" } },
-            // `variables` / `secrets` are reserved on the resources.<Alias> value-flow
-            // surface, so a library may not export instances under those names.
+            // An entry is a bare name (`Db`, a locally-owned export) or a dotted `Alias.Name`
+            // (re-export of the instance reached via this library's import aliased `Alias`,
+            // under the name `Name`) — mirroring `exports.kinds`. `variables` / `secrets` are
+            // reserved on the resources.<Alias> value-flow surface, so they may not be exported.
             resources: {
               type: "array",
               items: { type: "string", not: { enum: ["variables", "secrets"] } },

package/src/cel-environment.ts

@@ -102,3 +102,60 @@ export function buildTypedCelEnvironment(
     return baseEnv.clone();
   }
 }
+
+/** Register a `variables`/`secrets` namespace typed from a module doc's schema map
+ *  (`{ name: <schema>, … }`), falling back to dyn `map` when absent or untyped. */
+function registerConfigNamespace(
+  env: Environment,
+  block: unknown,
+  name: "variables" | "secrets",
+): void {
+  if (block !== null && typeof block === "object" && !Array.isArray(block)) {
+    const entries = Object.entries(block as Record<string, unknown>).filter(
+      ([, v]) => v !== null && typeof v === "object" && !Array.isArray(v),
+    );
+    if (entries.length > 0) {
+      const schema: Record<string, string> = {};
+      for (const [k, v] of entries) schema[k] = jsonSchemaToCelType(v as Record<string, any>);
+      (env as any).registerVariable({ name, schema });
+      return;
+    }
+  }
+  env.registerVariable(name, "map");
+}
+
+/** CEL environment for the `variables:`/`secrets:` expressions on a `Telo.Import`.
+ *
+ *  Import inputs are a config-only contract: their expressions are evaluated
+ *  against the IMPORTING module's `variables`/`secrets`, never the import's own
+ *  values map (the bug) nor the imported child's. `resources`, `env`, and `ports`
+ *  are registered as empty typed objects, so referencing them is a "No such key"
+ *  error that steers authors to a typed `variables` entry. */
+export function buildImportInputCelEnvironment(
+  baseEnv: Environment,
+  moduleManifest: ResourceManifest | undefined,
+): Environment {
+  const env = baseEnv.clone();
+  for (const brand of Object.keys(VALUE_BRAND_BASE)) {
+    (env as any).registerType(brand, { fields: {} });
+  }
+  const mod = moduleManifest as Record<string, unknown> | undefined;
+  // Typing variables/secrets from the importer's schema can fail on a malformed
+  // schema; degrade those to permissive `map` if so — but never lose the
+  // resources/env/ports rejection registered below (the catch is scoped so a
+  // typing failure can't silently re-open the config-only contract).
+  try {
+    registerConfigNamespace(env, mod?.variables, "variables");
+    registerConfigNamespace(env, mod?.secrets, "secrets");
+  } catch {
+    env.registerVariable("variables", "map");
+    env.registerVariable("secrets", "map");
+  }
+  // Override the base env's dyn `resources`/`env`/`ports` with empty typed objects
+  // so any access (`resources.X`, `env.X`) is a "No such key" error — these
+  // surfaces are not part of the config-only import contract.
+  for (const name of ["resources", "env", "ports"]) {
+    (env as any).registerVariable({ name, schema: {} });
+  }
+  return env;
+}

package/src/flatten-for-analyzer.ts

@@ -1,7 +1,26 @@
 import type { ResourceManifest } from "@telorun/sdk";
-import type { LoadedFile, LoadedGraph, LoadedModule } from "./loaded-types.js";
+import type { LoadedGraph, LoadedModule } from "./loaded-types.js";
+import type { LoadedFile } from "./loaded-types.js";
 import { isModuleKind } from "./module-kinds.js";
 
+/** One parsed `exports.resources` / `exports.kinds` entry. `name` is the exported
+ *  instance name or kind suffix (the part after the dot, or the whole entry); `alias`
+ *  (when set) is this library's own import the entry RE-EXPORTS from. */
+export interface ParsedExportEntry {
+  name: string;
+  alias?: string;
+}
+
+/** Parse a single dotted export entry: `Alias.Name` → `{name: "Name", alias: "Alias"}`,
+ *  bare `Name` → `{name: "Name"}`. The single grammar for `exports.resources` and
+ *  `exports.kinds`, shared by the kernel's import controller and the analyzer/editor so
+ *  the dotted-name split can't drift. A leading dot (`.Name`) has no alias by design —
+ *  the empty prefix isn't a valid alias. */
+export function parseExportEntry(entry: string): ParsedExportEntry {
+  const dot = entry.indexOf(".");
+  return dot > 0 ? { name: entry.slice(dot + 1), alias: entry.slice(0, dot) } : { name: entry };
+}
+
 /** The import-boundary forwarding rule, shared by `flattenForAnalyzer` (the
  *  CLI / kernel loader path) and the telo-editor's workspace projection so the
  *  two cannot drift. Given one module's stamped manifests and whether that
@@ -29,9 +48,14 @@ export function selectModuleManifestsForAnalysis(
   if (isRoot) return moduleManifests;
 
   const libDoc = moduleManifests.find((m) => isModuleKind(m.kind));
-  const exportedResources = new Set<string>(
-    (libDoc as { exports?: { resources?: string[] } } | undefined)?.exports?.resources ?? [],
-  );
+  // An `exports.resources` entry is a bare name or a dotted `Alias.Name` (re-export). Only the
+  // export NAME matches a local instance below; re-exports are forwarded by `forwardReExports`.
+  const exportedResources = new Set<string>();
+  for (const entry of (libDoc as { exports?: { resources?: unknown[] } } | undefined)?.exports
+    ?.resources ?? []) {
+    if (typeof entry !== "string") continue;
+    exportedResources.add(parseExportEntry(entry).name);
+  }
 
   const out: ResourceManifest[] = [];
   for (const m of moduleManifests) {
@@ -96,6 +120,8 @@ export function flattenForAnalyzer(graph: LoadedGraph): ResourceManifest[] {
     }
   }
 
+  forwardReExports(graph, result);
+
   // Stamp resolved import identity on every Telo.Import in the result by
   // reading the edge's pre-resolved name/namespace — no re-derivation from
   // manifest metadata. The edge is keyed by (owner-file, alias) which is
@@ -120,6 +146,193 @@ export function flattenForAnalyzer(graph: LoadedGraph): ResourceManifest[] {
   return result;
 }
 
+/** A re-export declared in a library's `exports.resources` as a dotted `Alias.Name`:
+ *  module `module` re-exports the instance `name` reached through its own import
+ *  aliased `alias`. */
+export interface ReExportSpec {
+  module: string;
+  alias: string;
+  name: string;
+}
+
+/** Extract re-export specs from a library doc's `exports.resources` — the dotted `Alias.Name`
+ *  entries (bare-name locals are forwarded by the BFS instead). Shared by the CLI graph path
+ *  and the editor's workspace projection so the two cannot drift. */
+export function reExportSpecsFromExports(
+  moduleName: string,
+  exportsResources: readonly unknown[] | undefined,
+): ReExportSpec[] {
+  const specs: ReExportSpec[] = [];
+  for (const entry of exportsResources ?? []) {
+    if (typeof entry !== "string") continue;
+    const { name, alias } = parseExportEntry(entry);
+    if (!alias || alias === "Self") continue;
+    specs.push({ module: moduleName, alias, name });
+  }
+  return specs;
+}
+
+/** Forward re-exported instances (`exports.resources: [!ref Alias.name]`) transitively so a
+ *  consumer's `!ref Consumer.name` resolves in `resolveRefSentinels` (keyed by the RE-EXPORTING
+ *  module). The owning instance is already forwarded under its own module; here we emit an
+ *  additional copy stamped under each re-exporting module, with an already-canonical kind. A
+ *  fixpoint loop forwards chains of arbitrary depth (`app → api → domain → …`): each pass can
+ *  resolve a re-export whose source was emitted in a prior pass. Graph-agnostic: `aliasToModule`
+ *  maps `(module, alias)` to the imported module's name. Mutates `result` in place. */
+export function forwardReExportManifests(
+  result: ResourceManifest[],
+  specs: readonly ReExportSpec[],
+  aliasToModule: (module: string, alias: string) => string | undefined,
+): void {
+  // Index forwarded instances by `module\0name` (only re-export TARGETS are forwarded).
+  const forwarded = new Map<string, ResourceManifest>();
+  for (const m of result) {
+    const meta = m.metadata as { module?: string; name?: string; forwardedExport?: boolean };
+    if (meta?.forwardedExport && meta.module && meta.name) {
+      forwarded.set(`${meta.module}\0${meta.name}`, m);
+    }
+  }
+
+  // Canonicalize an authored/forwarded kind to a scope-independent `<module>.<Kind>` using the
+  // owning module's own import aliases. Idempotent: an already-canonical kind whose prefix isn't
+  // an alias of `ownerModule` is returned unchanged, so re-exports of re-exports stay stable.
+  const canonicalKind = (kind: string, ownerModule: string): string => {
+    if (kind.startsWith("Self.")) return `${ownerModule}.${kind.slice("Self.".length)}`;
+    const dot = kind.indexOf(".");
+    if (dot <= 0) return kind;
+    const target = aliasToModule(ownerModule, kind.slice(0, dot));
+    return target ? `${target}.${kind.slice(dot + 1)}` : kind;
+  };
+
+  // Fixpoint — bounded by the number of specs (each can be satisfied at most once).
+  for (let pass = 0; pass <= specs.length; pass++) {
+    let added = false;
+    for (const spec of specs) {
+      const key = `${spec.module}\0${spec.name}`;
+      if (forwarded.has(key)) continue;
+      const sourceModule = aliasToModule(spec.module, spec.alias);
+      if (!sourceModule) continue;
+      const src = forwarded.get(`${sourceModule}\0${spec.name}`);
+      if (!src) continue; // source not forwarded yet — a later pass may satisfy it
+      const kind = canonicalKind(src.kind as string, sourceModule);
+      const manifest: ResourceManifest = {
+        ...src,
+        kind,
+        metadata: {
+          ...src.metadata,
+          name: spec.name,
+          module: spec.module,
+          forwardedExport: true,
+        } as ResourceManifest["metadata"],
+      };
+      result.push(manifest);
+      forwarded.set(key, manifest);
+      added = true;
+    }
+    if (!added) break;
+  }
+}
+
+/** Resolve every library's `exports.kinds` to a per-module map `suffix → canonical
+ *  <owningModule>.<Kind>`, following re-exports (`Alias.Kind`) transitively via a fixpoint.
+ *  `modules` lists each library's name + its raw `exports.kinds`; `aliasToModule(module, alias)`
+ *  maps one of that module's import aliases to the imported module's name. Graph-agnostic —
+ *  shared by the CLI graph path and the editor's workspace projection. */
+export function resolveExportedKinds(
+  modules: ReadonlyArray<{ module: string; exportsKinds: readonly string[] }>,
+  aliasToModule: (module: string, alias: string) => string | undefined,
+): Map<string, Map<string, string>> {
+  const out = new Map<string, Map<string, string>>();
+  const tableFor = (m: string): Map<string, string> => {
+    let t = out.get(m);
+    if (!t) out.set(m, (t = new Map()));
+    return t;
+  };
+  for (let pass = 0; pass <= modules.length; pass++) {
+    let changed = false;
+    for (const { module, exportsKinds } of modules) {
+      const table = tableFor(module);
+      for (const entry of exportsKinds) {
+        const { name: suffix, alias } = parseExportEntry(entry);
+        if (table.has(suffix)) continue;
+        if (!alias) {
+          table.set(suffix, `${module}.${suffix}`);
+          changed = true;
+          continue;
+        }
+        const source = aliasToModule(module, alias);
+        const canonical = source ? out.get(source)?.get(suffix) : undefined;
+        if (canonical) {
+          table.set(suffix, canonical);
+          changed = true;
+        }
+      }
+    }
+    if (!changed) break;
+  }
+  return out;
+}
+
+/** Stamp `metadata.reExportedKinds` (suffix → canonical kind) onto every `Telo.Import` whose
+ *  target re-exports kinds, so the analyzer can register the re-export mappings. Only entries
+ *  that point at a module OTHER than the import's own target are stamped (genuine re-exports;
+ *  a locally-defined kind resolves through the normal alias path). Stamped on `metadata` (which
+ *  permits additional properties, like `resolvedModuleName`) since the `Telo.Import` schema
+ *  forbids extra top-level fields. Shared by both paths. */
+export function stampReExportedKinds(
+  imports: ReadonlyArray<{ manifest: ResourceManifest; targetModule: string }>,
+  exportedKinds: Map<string, Map<string, string>>,
+): void {
+  for (const { manifest, targetModule } of imports) {
+    const table = exportedKinds.get(targetModule);
+    if (!table) continue;
+    const reExported: Record<string, string> = {};
+    for (const [suffix, canonical] of table) {
+      if (canonical !== `${targetModule}.${suffix}`) reExported[suffix] = canonical;
+    }
+    if (Object.keys(reExported).length === 0) continue;
+    (manifest.metadata as Record<string, unknown>).reExportedKinds = reExported;
+  }
+}
+
+/** CLI/kernel adapter: collect re-export specs + alias map from a LoadedGraph. */
+function forwardReExports(graph: LoadedGraph, result: ResourceManifest[]): void {
+  const ownerSourceOf = new Map<string, string>();
+  const specs: ReExportSpec[] = [];
+  const kindModules: Array<{ module: string; exportsKinds: string[] }> = [];
+  for (const [source, mod] of graph.modules) {
+    if (source === graph.rootSource) continue; // root is an Application — no exports
+    const libDoc = mod.owner.manifests.find((m) => m && isModuleKind(m.kind)) as
+      | (ResourceManifest & { exports?: { resources?: unknown[]; kinds?: string[] } })
+      | undefined;
+    const moduleName = libDoc?.metadata?.name as string | undefined;
+    if (!libDoc || !moduleName) continue;
+    ownerSourceOf.set(moduleName, mod.owner.source);
+    specs.push(...reExportSpecsFromExports(moduleName, libDoc.exports?.resources));
+    kindModules.push({ module: moduleName, exportsKinds: libDoc.exports?.kinds ?? [] });
+  }
+  const aliasToModule = (module: string, alias: string): string | undefined => {
+    const ownerSource = ownerSourceOf.get(module);
+    return ownerSource
+      ? (graph.importEdges.get(ownerSource)?.get(alias)?.targetModuleName ?? undefined)
+      : undefined;
+  };
+  forwardReExportManifests(result, specs, aliasToModule);
+
+  // Resolve every library's re-exported kinds and stamp them onto the consumer-facing
+  // Telo.Import manifests so the analyzer can register the re-export mappings.
+  const exportedKinds = resolveExportedKinds(kindModules, aliasToModule);
+  const imports: Array<{ manifest: ResourceManifest; targetModule: string }> = [];
+  for (const m of result) {
+    if (m.kind !== "Telo.Import") continue;
+    const owner = (m.metadata as { source?: string } | undefined)?.source;
+    const alias = m.metadata?.name as string | undefined;
+    const target = owner && alias ? graph.importEdges.get(owner)?.get(alias)?.targetModuleName : undefined;
+    if (target) imports.push({ manifest: m, targetModule: target });
+  }
+  stampReExportedKinds(imports, exportedKinds);
+}
+
 /** Project a LoadedModule (owner + partials) to a flat ResourceManifest[]
  *  with `metadata.module` stamped on non-module docs. The kernel's runtime
  *  entry load uses this to convert a `Loader.loadModule` result into the

package/src/index.ts

@@ -12,7 +12,14 @@ export type {
 export {
     flattenForAnalyzer,
     flattenLoadedModule,
+    forwardReExportManifests,
+    parseExportEntry,
+    reExportSpecsFromExports,
+    resolveExportedKinds,
     selectModuleManifestsForAnalysis,
+    stampReExportedKinds,
+    type ParsedExportEntry,
+    type ReExportSpec,
 } from "./flatten-for-analyzer.js";
 export { visitManifest } from "./manifest-visitor.js";
 export type {