@telorun/analyzer 0.22.0 → 0.23.1

package/README.md

@@ -55,8 +55,8 @@ metadata:
     A complete feedback collection REST API — no code, pure YAML.
     Persists entries to SQLite and serves them over HTTP.
 imports:
-  Http: std/http-server@0.9.0
-  Sql: std/sql@0.8.0
+  Http: std/http-server@0.11.0
+  Sql: std/sql@0.9.0
 targets:
   - !ref Migrations
   - !ref Server

package/dist/alias-resolver.d.ts

@@ -3,7 +3,14 @@
 export declare class AliasResolver {
     private readonly importAliases;
     private readonly importedKinds;
+    /** `${alias}.${suffix}` → canonical `<owningModule>.<Kind>` for kinds an import
+     *  transitively RE-EXPORTS (`exports.kinds: [Alias.Kind]`), which don't live in the
+     *  import's own module. Resolved before the normal `<module>.<suffix>` construction. */
+    private readonly reExportedKinds;
     registerImport(alias: string, targetModule: string, exportedKinds: string[]): void;
+    /** Register that `<alias>.<suffix>` re-exports the kind canonically named `canonicalKind`
+     *  (owned by a module the alias's target imports, possibly several hops away). */
+    registerKindReExport(alias: string, suffix: string, canonicalKind: string): void;
     /** Real module name an alias points at (e.g. "Console" → "console"), or undefined.
      *  Used to resolve an alias-qualified instance reference "Console.writeLine" to the
      *  forwarded resource declared in that module. The `exports.resources` gate is enforced
@@ -19,4 +26,14 @@ export declare class AliasResolver {
      *  back into its user-facing alias form (e.g. "Http.Server"). */
     aliasesFor(targetModule: string): string[];
 }
+/**
+ * The alias resolver for a resource's own lexical scope. A resource that
+ * originated in an imported library (its `ownModule` names a non-root module —
+ * e.g. an inline handler extracted from an imported Http.Api) resolves its kind
+ * aliases against THAT library's import map, so an anonymous child inherits the
+ * lexical scope of the document that declares it. Returns undefined for
+ * root/consumer-owned resources (and unknown modules), so callers fall back to
+ * the root `aliases`.
+ */
+export declare function scopeResolverForModule(ownModule: string | undefined, rootModules: Set<string>, aliasesByModule: Map<string, AliasResolver>): AliasResolver | undefined;
 //# sourceMappingURL=alias-resolver.d.ts.map

package/dist/alias-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"alias-resolver.d.ts","sourceRoot":"","sources":["../src/alias-resolver.ts"],"names":[],"mappings":"AAAA;gFACgF;AAChF,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6B;IAC3D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAkC;IAEhE,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI;IAOlF;;;;qDAIiD;IACjD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIjD,sFAAsF;IACtF,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAe7C,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIhC,YAAY,IAAI,MAAM,EAAE;IAIxB;;qEAEiE;IACjE,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE;CAO3C"}
+{"version":3,"file":"alias-resolver.d.ts","sourceRoot":"","sources":["../src/alias-resolver.ts"],"names":[],"mappings":"AAAA;gFACgF;AAChF,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6B;IAC3D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAkC;IAChE;;4FAEwF;IACxF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6B;IAE7D,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI;IAOlF;sFACkF;IAClF,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI;IAIhF;;;;qDAIiD;IACjD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIjD,sFAAsF;IACtF,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAmB7C,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIhC,YAAY,IAAI,MAAM,EAAE;IAIxB;;qEAEiE;IACjE,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE;CAO3C;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EACxB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC1C,aAAa,GAAG,SAAS,CAI3B"}

package/dist/alias-resolver.js

@@ -3,12 +3,21 @@
 export class AliasResolver {
     importAliases = new Map();
     importedKinds = new Map();
+    /** `${alias}.${suffix}` → canonical `<owningModule>.<Kind>` for kinds an import
+     *  transitively RE-EXPORTS (`exports.kinds: [Alias.Kind]`), which don't live in the
+     *  import's own module. Resolved before the normal `<module>.<suffix>` construction. */
+    reExportedKinds = new Map();
     registerImport(alias, targetModule, exportedKinds) {
         this.importAliases.set(alias, targetModule);
         if (exportedKinds.length > 0) {
             this.importedKinds.set(alias, new Set(exportedKinds));
         }
     }
+    /** Register that `<alias>.<suffix>` re-exports the kind canonically named `canonicalKind`
+     *  (owned by a module the alias's target imports, possibly several hops away). */
+    registerKindReExport(alias, suffix, canonicalKind) {
+        this.reExportedKinds.set(`${alias}.${suffix}`, canonicalKind);
+    }
     /** Real module name an alias points at (e.g. "Console" → "console"), or undefined.
      *  Used to resolve an alias-qualified instance reference "Console.writeLine" to the
      *  forwarded resource declared in that module. The `exports.resources` gate is enforced
@@ -27,6 +36,11 @@ export class AliasResolver {
             return undefined;
         const prefix = kind.slice(0, dot);
         const suffix = kind.slice(dot + 1);
+        // Re-export takes precedence: a re-exported kind resolves to its true owning module,
+        // not `${prefix-target}.${suffix}` (and bypasses the gate — it's explicitly re-exported).
+        const reExported = this.reExportedKinds.get(`${prefix}.${suffix}`);
+        if (reExported)
+            return reExported;
         const realModule = this.importAliases.get(prefix);
         if (!realModule)
             return undefined;
@@ -53,3 +67,17 @@ export class AliasResolver {
         return result;
     }
 }
+/**
+ * The alias resolver for a resource's own lexical scope. A resource that
+ * originated in an imported library (its `ownModule` names a non-root module —
+ * e.g. an inline handler extracted from an imported Http.Api) resolves its kind
+ * aliases against THAT library's import map, so an anonymous child inherits the
+ * lexical scope of the document that declares it. Returns undefined for
+ * root/consumer-owned resources (and unknown modules), so callers fall back to
+ * the root `aliases`.
+ */
+export function scopeResolverForModule(ownModule, rootModules, aliasesByModule) {
+    return ownModule && !rootModules.has(ownModule)
+        ? aliasesByModule.get(ownModule)
+        : undefined;
+}

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAiB9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA4hB/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAkqBvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAerB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAiB9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA4hB/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAstBvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAerB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -1,6 +1,6 @@
 import { defaultRegistry, isTaggedSentinel } from "@telorun/templating";
-import { AliasResolver } from "./alias-resolver.js";
-import { buildCelEnvironment, buildTypedCelEnvironment, } from "./cel-environment.js";
+import { AliasResolver, scopeResolverForModule } from "./alias-resolver.js";
+import { buildCelEnvironment, buildImportInputCelEnvironment, buildTypedCelEnvironment, } from "./cel-environment.js";
 import { DefinitionRegistry } from "./definition-registry.js";
 import { buildDependencyGraph, formatCycle } from "./dependency-graph.js";
 import { buildKernelGlobalsSchema, mergeKernelGlobalsIntoContext } from "./kernel-globals.js";
@@ -579,17 +579,18 @@ export class StaticAnalyzer {
                     if (resolvedModuleName) {
                         defs.registerModuleIdentity(resolvedNamespace ?? null, resolvedModuleName);
                     }
+                    // `metadata.reExportedKinds` (stamped by flattenForAnalyzer / the editor projection)
+                    // maps an exported suffix to the true owning module's canonical kind for kinds this
+                    // import transitively re-exports (`exports.kinds: [Alias.Kind]`).
+                    const reExportedKinds = (m.metadata?.reExportedKinds ?? {});
                     // Alias registration is scoped: consumer imports vs. imported-library imports.
-                    if (!ownModule || rootModules.has(ownModule)) {
-                        aliases.registerImport(alias, targetModule, exportedKinds);
-                    }
-                    else {
-                        let libResolver = aliasesByModule.get(ownModule);
-                        if (!libResolver) {
-                            libResolver = new AliasResolver();
-                            aliasesByModule.set(ownModule, libResolver);
-                        }
-                        libResolver.registerImport(alias, targetModule, exportedKinds);
+                    const resolver = !ownModule || rootModules.has(ownModule)
+                        ? aliases
+                        : (aliasesByModule.get(ownModule) ??
+                            aliasesByModule.set(ownModule, new AliasResolver()).get(ownModule));
+                    resolver.registerImport(alias, targetModule, exportedKinds);
+                    for (const [suffix, canonical] of Object.entries(reExportedKinds)) {
+                        resolver.registerKindReExport(alias, suffix, canonical);
                     }
                 }
             }
@@ -735,6 +736,26 @@ export class StaticAnalyzer {
                     }
                 }
             }
+            // `exports.resources` entries are plain names: `Db` (local) or `Alias.Name` (re-export),
+            // mirroring `exports.kinds`. The `!ref` tag is not accepted here — a `!ref` parses to a
+            // sentinel object that the schema's CEL/ref exemption would silently pass, so reject any
+            // non-string entry with an actionable message instead.
+            const exportsResources = m.exports?.resources;
+            if (Array.isArray(exportsResources)) {
+                for (let i = 0; i < exportsResources.length; i++) {
+                    if (typeof exportsResources[i] === "string")
+                        continue;
+                    diagnostics.push({
+                        severity: DiagnosticSeverity.Error,
+                        code: "INVALID_EXPORT",
+                        source: SOURCE,
+                        message: `Telo.Library exports.resources[${i}]: write the exported name as a plain string — ` +
+                            `'Name' to export a local instance, or 'Alias.Name' to re-export an imported one. ` +
+                            `The '!ref' tag is not allowed in exports.resources.`,
+                        data: { resource, filePath, path: `exports.resources.${i}` },
+                    });
+                }
+            }
         }
         // Build typed kernel globals schema so x-telo-context chain validation
         // recognises variables, secrets, resources, env automatically
@@ -775,8 +796,15 @@ export class StaticAnalyzer {
             const resource = { kind: m.kind, name: m.metadata?.name };
             // Resolve kind through alias if needed; direct lookup takes priority so that
             // aliases whose name matches the module name (the common case) work without
-            // path-derived name mangling.
-            const resolvedKind = aliases.resolveKind(m.kind);
+            // path-derived name mangling. A resource that originated in an imported library
+            // (its `metadata.module` names a non-root module — e.g. an inline route handler
+            // extracted from an imported Http.Api) must resolve its kind alias against THAT
+            // library's import map, not the consumer's; an anonymous child inherits the
+            // lexical scope of the document that declares it. Mirrors the nested-inline and
+            // reference-resolution paths: own-module scope first, root/consumer aliases last.
+            const ownModule = m.metadata?.module;
+            const scopeResolver = scopeResolverForModule(ownModule, rootModules, aliasesByModule);
+            const resolvedKind = scopeResolver?.resolveKind(m.kind) ?? aliases.resolveKind(m.kind);
             const definition = defs.resolve(m.kind) ?? (resolvedKind ? defs.resolve(resolvedKind) : undefined);
             if (!definition) {
                 const suggestedKind = computeSuggestKind(m.kind, aliases, defs);
@@ -804,8 +832,22 @@ export class StaticAnalyzer {
                         },
                     }
                     : definition.schema;
-                // Phase 1: CEL type checking — walk data+schema together, check env.check() return types
-                const baseTypedEnv = buildTypedCelEnvironment(this.celEnv, m, undefined, moduleManifest);
+                // Phase 1: CEL type checking — walk data+schema together, check env.check() return types.
+                // A Telo.Import's variables/secrets are a config-only contract evaluated against the
+                // IMPORTING module's scope, so type them from the owning module doc (matched by
+                // `metadata.module`) and drop `resources`/`env` so referencing them is an error. A
+                // library's own internal import is validated against that library in the library's
+                // standalone analysis; in this flattened app pass the library doc is absent, so the
+                // importer is undefined here and variables/secrets fall back to a permissive `map`
+                // (no false positives) while resources/env stay rejected.
+                const importerModule = m.kind === "Telo.Import"
+                    ? allManifests.find((mm) => (mm.kind === "Telo.Application" || mm.kind === "Telo.Library") &&
+                        mm.metadata?.name ===
+                            m.metadata?.module)
+                    : undefined;
+                const baseTypedEnv = m.kind === "Telo.Import"
+                    ? buildImportInputCelEnvironment(this.celEnv, importerModule)
+                    : buildTypedCelEnvironment(this.celEnv, m, undefined, moduleManifest);
                 const celIssues = collectCelTypeIssues(m, schema, "", definition, m, baseTypedEnv, this.celEnv, moduleManifest);
                 // Phase 2+3: AJV on substituted data — CEL fields replaced with typed placeholders
                 const ajvIssues = validateAgainstSchema(substituteCelFields(m, schema), schema);
@@ -830,9 +872,8 @@ export class StaticAnalyzer {
                 // first, then the parent module's own aliases (for resources declared
                 // inside an imported module), then the root aliases. Mirrors how the
                 // analyzer resolves kinds elsewhere so module-scoped aliases don't
-                // produce false UNDEFINED_KIND diagnostics.
-                const ownModule = m.metadata?.module;
-                const scopeResolver = ownModule && !rootModules.has(ownModule) ? aliasesByModule.get(ownModule) : undefined;
+                // produce false UNDEFINED_KIND diagnostics. `scopeResolver` is the
+                // owning module's resolver computed above.
                 diagnostics.push(...validateNestedInlineResources(m, definition.schema, (kind) => {
                     const direct = defs.resolve(kind);
                     if (direct)
@@ -1047,7 +1088,7 @@ export class StaticAnalyzer {
         // Validate provider coherence rules for `provide:` template-target definitions.
         diagnostics.push(...validateProviderCoherence(allManifests, defs, aliases));
         // Validate throws: declarations and catches: coverage (rules 1, 2, 4, 7)
-        diagnostics.push(...validateThrowsCoverage(allManifests, defs, aliases, this.celEnv));
+        diagnostics.push(...validateThrowsCoverage(allManifests, defs, aliases, this.celEnv, aliasesByModule, rootModules));
         // Warn about declared variables / secrets / ports that no CEL references.
         diagnostics.push(...validateUnusedDeclarations(allManifests, this.celEnv));
         // Reroute diagnostics on synthetic (inline-extracted) resources back to

package/dist/builtins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EAqd/C,CAAC"}
+{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EAud/C,CAAC"}

package/dist/builtins.js

@@ -453,8 +453,10 @@ export const KERNEL_BUILTINS = [
                     type: "object",
                     properties: {
                         kinds: { type: "array", items: { type: "string" } },
-                        // `variables` / `secrets` are reserved on the resources.<Alias> value-flow
-                        // surface, so a library may not export instances under those names.
+                        // An entry is a bare name (`Db`, a locally-owned export) or a dotted `Alias.Name`
+                        // (re-export of the instance reached via this library's import aliased `Alias`,
+                        // under the name `Name`) — mirroring `exports.kinds`. `variables` / `secrets` are
+                        // reserved on the resources.<Alias> value-flow surface, so they may not be exported.
                         resources: {
                             type: "array",
                             items: { type: "string", not: { enum: ["variables", "secrets"] } },

package/dist/cel-environment.d.ts

@@ -13,4 +13,12 @@ export type { CelHandlers } from "@telorun/templating";
  *  NOTE: The set of kernel globals registered here must match `KERNEL_GLOBAL_NAMES`
  *  in kernel-globals.ts, which is used for chain-access validation. */
 export declare function buildTypedCelEnvironment(baseEnv: Environment, manifest: ResourceManifest, extraContextSchema?: Record<string, any> | null, rootModuleManifest?: ResourceManifest): Environment;
+/** CEL environment for the `variables:`/`secrets:` expressions on a `Telo.Import`.
+ *
+ *  Import inputs are a config-only contract: their expressions are evaluated
+ *  against the IMPORTING module's `variables`/`secrets`, never the import's own
+ *  values map (the bug) nor the imported child's. `resources`, `env`, and `ports`
+ *  are registered as empty typed objects, so referencing them is a "No such key"
+ *  error that steers authors to a typed `variables` entry. */
+export declare function buildImportInputCelEnvironment(baseEnv: Environment, moduleManifest: ResourceManifest | undefined): Environment;
 //# sourceMappingURL=cel-environment.d.ts.map

package/dist/cel-environment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cel-environment.d.ts","sourceRoot":"","sources":["../src/cel-environment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAUrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;;;uEASuE;AACvE,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,gBAAgB,EAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,EAI/C,kBAAkB,CAAC,EAAE,gBAAgB,GACpC,WAAW,CAuEb"}
+{"version":3,"file":"cel-environment.d.ts","sourceRoot":"","sources":["../src/cel-environment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAUrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;;;uEASuE;AACvE,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,gBAAgB,EAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,EAI/C,kBAAkB,CAAC,EAAE,gBAAgB,GACpC,WAAW,CAuEb;AAuBD;;;;;;8DAM8D;AAC9D,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,WAAW,EACpB,cAAc,EAAE,gBAAgB,GAAG,SAAS,GAC3C,WAAW,CAwBb"}

package/dist/cel-environment.js

@@ -85,3 +85,51 @@ rootModuleManifest) {
         return baseEnv.clone();
     }
 }
+/** Register a `variables`/`secrets` namespace typed from a module doc's schema map
+ *  (`{ name: <schema>, … }`), falling back to dyn `map` when absent or untyped. */
+function registerConfigNamespace(env, block, name) {
+    if (block !== null && typeof block === "object" && !Array.isArray(block)) {
+        const entries = Object.entries(block).filter(([, v]) => v !== null && typeof v === "object" && !Array.isArray(v));
+        if (entries.length > 0) {
+            const schema = {};
+            for (const [k, v] of entries)
+                schema[k] = jsonSchemaToCelType(v);
+            env.registerVariable({ name, schema });
+            return;
+        }
+    }
+    env.registerVariable(name, "map");
+}
+/** CEL environment for the `variables:`/`secrets:` expressions on a `Telo.Import`.
+ *
+ *  Import inputs are a config-only contract: their expressions are evaluated
+ *  against the IMPORTING module's `variables`/`secrets`, never the import's own
+ *  values map (the bug) nor the imported child's. `resources`, `env`, and `ports`
+ *  are registered as empty typed objects, so referencing them is a "No such key"
+ *  error that steers authors to a typed `variables` entry. */
+export function buildImportInputCelEnvironment(baseEnv, moduleManifest) {
+    const env = baseEnv.clone();
+    for (const brand of Object.keys(VALUE_BRAND_BASE)) {
+        env.registerType(brand, { fields: {} });
+    }
+    const mod = moduleManifest;
+    // Typing variables/secrets from the importer's schema can fail on a malformed
+    // schema; degrade those to permissive `map` if so — but never lose the
+    // resources/env/ports rejection registered below (the catch is scoped so a
+    // typing failure can't silently re-open the config-only contract).
+    try {
+        registerConfigNamespace(env, mod?.variables, "variables");
+        registerConfigNamespace(env, mod?.secrets, "secrets");
+    }
+    catch {
+        env.registerVariable("variables", "map");
+        env.registerVariable("secrets", "map");
+    }
+    // Override the base env's dyn `resources`/`env`/`ports` with empty typed objects
+    // so any access (`resources.X`, `env.X`) is a "No such key" error — these
+    // surfaces are not part of the config-only import contract.
+    for (const name of ["resources", "env", "ports"]) {
+        env.registerVariable({ name, schema: {} });
+    }
+    return env;
+}

package/dist/flatten-for-analyzer.d.ts

@@ -1,5 +1,18 @@
 import type { ResourceManifest } from "@telorun/sdk";
 import type { LoadedGraph, LoadedModule } from "./loaded-types.js";
+/** One parsed `exports.resources` / `exports.kinds` entry. `name` is the exported
+ *  instance name or kind suffix (the part after the dot, or the whole entry); `alias`
+ *  (when set) is this library's own import the entry RE-EXPORTS from. */
+export interface ParsedExportEntry {
+    name: string;
+    alias?: string;
+}
+/** Parse a single dotted export entry: `Alias.Name` → `{name: "Name", alias: "Alias"}`,
+ *  bare `Name` → `{name: "Name"}`. The single grammar for `exports.resources` and
+ *  `exports.kinds`, shared by the kernel's import controller and the analyzer/editor so
+ *  the dotted-name split can't drift. A leading dot (`.Name`) has no alias by design —
+ *  the empty prefix isn't a valid alias. */
+export declare function parseExportEntry(entry: string): ParsedExportEntry;
 /** The import-boundary forwarding rule, shared by `flattenForAnalyzer` (the
  *  CLI / kernel loader path) and the telo-editor's workspace projection so the
  *  two cannot drift. Given one module's stamped manifests and whether that
@@ -42,6 +55,45 @@ export declare function selectModuleManifestsForAnalysis(moduleManifests: Resour
  *  Position metadata (`positionIndex`) is NOT stamped on manifests —
  *  callers look it up via `findPositions(graph, ...)` on the LoadedGraph. */
 export declare function flattenForAnalyzer(graph: LoadedGraph): ResourceManifest[];
+/** A re-export declared in a library's `exports.resources` as a dotted `Alias.Name`:
+ *  module `module` re-exports the instance `name` reached through its own import
+ *  aliased `alias`. */
+export interface ReExportSpec {
+    module: string;
+    alias: string;
+    name: string;
+}
+/** Extract re-export specs from a library doc's `exports.resources` — the dotted `Alias.Name`
+ *  entries (bare-name locals are forwarded by the BFS instead). Shared by the CLI graph path
+ *  and the editor's workspace projection so the two cannot drift. */
+export declare function reExportSpecsFromExports(moduleName: string, exportsResources: readonly unknown[] | undefined): ReExportSpec[];
+/** Forward re-exported instances (`exports.resources: [!ref Alias.name]`) transitively so a
+ *  consumer's `!ref Consumer.name` resolves in `resolveRefSentinels` (keyed by the RE-EXPORTING
+ *  module). The owning instance is already forwarded under its own module; here we emit an
+ *  additional copy stamped under each re-exporting module, with an already-canonical kind. A
+ *  fixpoint loop forwards chains of arbitrary depth (`app → api → domain → …`): each pass can
+ *  resolve a re-export whose source was emitted in a prior pass. Graph-agnostic: `aliasToModule`
+ *  maps `(module, alias)` to the imported module's name. Mutates `result` in place. */
+export declare function forwardReExportManifests(result: ResourceManifest[], specs: readonly ReExportSpec[], aliasToModule: (module: string, alias: string) => string | undefined): void;
+/** Resolve every library's `exports.kinds` to a per-module map `suffix → canonical
+ *  <owningModule>.<Kind>`, following re-exports (`Alias.Kind`) transitively via a fixpoint.
+ *  `modules` lists each library's name + its raw `exports.kinds`; `aliasToModule(module, alias)`
+ *  maps one of that module's import aliases to the imported module's name. Graph-agnostic —
+ *  shared by the CLI graph path and the editor's workspace projection. */
+export declare function resolveExportedKinds(modules: ReadonlyArray<{
+    module: string;
+    exportsKinds: readonly string[];
+}>, aliasToModule: (module: string, alias: string) => string | undefined): Map<string, Map<string, string>>;
+/** Stamp `metadata.reExportedKinds` (suffix → canonical kind) onto every `Telo.Import` whose
+ *  target re-exports kinds, so the analyzer can register the re-export mappings. Only entries
+ *  that point at a module OTHER than the import's own target are stamped (genuine re-exports;
+ *  a locally-defined kind resolves through the normal alias path). Stamped on `metadata` (which
+ *  permits additional properties, like `resolvedModuleName`) since the `Telo.Import` schema
+ *  forbids extra top-level fields. Shared by both paths. */
+export declare function stampReExportedKinds(imports: ReadonlyArray<{
+    manifest: ResourceManifest;
+    targetModule: string;
+}>, exportedKinds: Map<string, Map<string, string>>): void;
 /** Project a LoadedModule (owner + partials) to a flat ResourceManifest[]
  *  with `metadata.module` stamped on non-module docs. The kernel's runtime
  *  entry load uses this to convert a `Loader.loadModule` result into the

package/dist/flatten-for-analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flatten-for-analyzer.d.ts","sourceRoot":"","sources":["../src/flatten-for-analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAc,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAG/E;;;;;;;;;;;;;;;;;;;2CAmB2C;AAC3C,wBAAgB,gCAAgC,CAC9C,eAAe,EAAE,gBAAgB,EAAE,EACnC,MAAM,EAAE,OAAO,GACd,gBAAgB,EAAE,CAwBpB;AAED;;;;;;;;;;;;;;;;;;;6EAmB6E;AAC7E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,gBAAgB,EAAE,CA+CzE;AAED;;;;;6BAK6B;AAC7B,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,YAAY,GAAG,gBAAgB,EAAE,CAEzE"}
+{"version":3,"file":"flatten-for-analyzer.d.ts","sourceRoot":"","sources":["../src/flatten-for-analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAInE;;yEAEyE;AACzE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;4CAI4C;AAC5C,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAGjE;AAED;;;;;;;;;;;;;;;;;;;2CAmB2C;AAC3C,wBAAgB,gCAAgC,CAC9C,eAAe,EAAE,gBAAgB,EAAE,EACnC,MAAM,EAAE,OAAO,GACd,gBAAgB,EAAE,CA6BpB;AAED;;;;;;;;;;;;;;;;;;;6EAmB6E;AAC7E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,gBAAgB,EAAE,CAiDzE;AAED;;uBAEuB;AACvB,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;qEAEqE;AACrE,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,GAC/C,YAAY,EAAE,CAShB;AAED;;;;;;uFAMuF;AACvF,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,gBAAgB,EAAE,EAC1B,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACnE,IAAI,CAgDN;AAED;;;;0EAI0E;AAC1E,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,EAC3E,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACnE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA8BlC;AAED;;;;;4DAK4D;AAC5D,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,CAAC;IAAE,QAAQ,EAAE,gBAAgB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,EAC5E,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC9C,IAAI,CAWN;AAwCD;;;;;6BAK6B;AAC7B,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,YAAY,GAAG,gBAAgB,EAAE,CAEzE"}

package/dist/flatten-for-analyzer.js

@@ -1,4 +1,13 @@
 import { isModuleKind } from "./module-kinds.js";
+/** Parse a single dotted export entry: `Alias.Name` → `{name: "Name", alias: "Alias"}`,
+ *  bare `Name` → `{name: "Name"}`. The single grammar for `exports.resources` and
+ *  `exports.kinds`, shared by the kernel's import controller and the analyzer/editor so
+ *  the dotted-name split can't drift. A leading dot (`.Name`) has no alias by design —
+ *  the empty prefix isn't a valid alias. */
+export function parseExportEntry(entry) {
+    const dot = entry.indexOf(".");
+    return dot > 0 ? { name: entry.slice(dot + 1), alias: entry.slice(0, dot) } : { name: entry };
+}
 /** The import-boundary forwarding rule, shared by `flattenForAnalyzer` (the
  *  CLI / kernel loader path) and the telo-editor's workspace projection so the
  *  two cannot drift. Given one module's stamped manifests and whether that
@@ -23,7 +32,15 @@ export function selectModuleManifestsForAnalysis(moduleManifests, isRoot) {
     if (isRoot)
         return moduleManifests;
     const libDoc = moduleManifests.find((m) => isModuleKind(m.kind));
-    const exportedResources = new Set(libDoc?.exports?.resources ?? []);
+    // An `exports.resources` entry is a bare name or a dotted `Alias.Name` (re-export). Only the
+    // export NAME matches a local instance below; re-exports are forwarded by `forwardReExports`.
+    const exportedResources = new Set();
+    for (const entry of libDoc?.exports
+        ?.resources ?? []) {
+        if (typeof entry !== "string")
+            continue;
+        exportedResources.add(parseExportEntry(entry).name);
+    }
     const out = [];
     for (const m of moduleManifests) {
         if (m.kind === "Telo.Definition" || m.kind === "Telo.Abstract" || m.kind === "Telo.Import") {
@@ -81,6 +98,7 @@ export function flattenForAnalyzer(graph) {
             result.push(...selectModuleManifestsForAnalysis(collectModuleManifests(targetModule), false));
         }
     }
+    forwardReExports(graph, result);
     // Stamp resolved import identity on every Telo.Import in the result by
     // reading the edge's pre-resolved name/namespace — no re-derivation from
     // manifest metadata. The edge is keyed by (owner-file, alias) which is
@@ -105,6 +123,179 @@ export function flattenForAnalyzer(graph) {
     }
     return result;
 }
+/** Extract re-export specs from a library doc's `exports.resources` — the dotted `Alias.Name`
+ *  entries (bare-name locals are forwarded by the BFS instead). Shared by the CLI graph path
+ *  and the editor's workspace projection so the two cannot drift. */
+export function reExportSpecsFromExports(moduleName, exportsResources) {
+    const specs = [];
+    for (const entry of exportsResources ?? []) {
+        if (typeof entry !== "string")
+            continue;
+        const { name, alias } = parseExportEntry(entry);
+        if (!alias || alias === "Self")
+            continue;
+        specs.push({ module: moduleName, alias, name });
+    }
+    return specs;
+}
+/** Forward re-exported instances (`exports.resources: [!ref Alias.name]`) transitively so a
+ *  consumer's `!ref Consumer.name` resolves in `resolveRefSentinels` (keyed by the RE-EXPORTING
+ *  module). The owning instance is already forwarded under its own module; here we emit an
+ *  additional copy stamped under each re-exporting module, with an already-canonical kind. A
+ *  fixpoint loop forwards chains of arbitrary depth (`app → api → domain → …`): each pass can
+ *  resolve a re-export whose source was emitted in a prior pass. Graph-agnostic: `aliasToModule`
+ *  maps `(module, alias)` to the imported module's name. Mutates `result` in place. */
+export function forwardReExportManifests(result, specs, aliasToModule) {
+    // Index forwarded instances by `module\0name` (only re-export TARGETS are forwarded).
+    const forwarded = new Map();
+    for (const m of result) {
+        const meta = m.metadata;
+        if (meta?.forwardedExport && meta.module && meta.name) {
+            forwarded.set(`${meta.module}\0${meta.name}`, m);
+        }
+    }
+    // Canonicalize an authored/forwarded kind to a scope-independent `<module>.<Kind>` using the
+    // owning module's own import aliases. Idempotent: an already-canonical kind whose prefix isn't
+    // an alias of `ownerModule` is returned unchanged, so re-exports of re-exports stay stable.
+    const canonicalKind = (kind, ownerModule) => {
+        if (kind.startsWith("Self."))
+            return `${ownerModule}.${kind.slice("Self.".length)}`;
+        const dot = kind.indexOf(".");
+        if (dot <= 0)
+            return kind;
+        const target = aliasToModule(ownerModule, kind.slice(0, dot));
+        return target ? `${target}.${kind.slice(dot + 1)}` : kind;
+    };
+    // Fixpoint — bounded by the number of specs (each can be satisfied at most once).
+    for (let pass = 0; pass <= specs.length; pass++) {
+        let added = false;
+        for (const spec of specs) {
+            const key = `${spec.module}\0${spec.name}`;
+            if (forwarded.has(key))
+                continue;
+            const sourceModule = aliasToModule(spec.module, spec.alias);
+            if (!sourceModule)
+                continue;
+            const src = forwarded.get(`${sourceModule}\0${spec.name}`);
+            if (!src)
+                continue; // source not forwarded yet — a later pass may satisfy it
+            const kind = canonicalKind(src.kind, sourceModule);
+            const manifest = {
+                ...src,
+                kind,
+                metadata: {
+                    ...src.metadata,
+                    name: spec.name,
+                    module: spec.module,
+                    forwardedExport: true,
+                },
+            };
+            result.push(manifest);
+            forwarded.set(key, manifest);
+            added = true;
+        }
+        if (!added)
+            break;
+    }
+}
+/** Resolve every library's `exports.kinds` to a per-module map `suffix → canonical
+ *  <owningModule>.<Kind>`, following re-exports (`Alias.Kind`) transitively via a fixpoint.
+ *  `modules` lists each library's name + its raw `exports.kinds`; `aliasToModule(module, alias)`
+ *  maps one of that module's import aliases to the imported module's name. Graph-agnostic —
+ *  shared by the CLI graph path and the editor's workspace projection. */
+export function resolveExportedKinds(modules, aliasToModule) {
+    const out = new Map();
+    const tableFor = (m) => {
+        let t = out.get(m);
+        if (!t)
+            out.set(m, (t = new Map()));
+        return t;
+    };
+    for (let pass = 0; pass <= modules.length; pass++) {
+        let changed = false;
+        for (const { module, exportsKinds } of modules) {
+            const table = tableFor(module);
+            for (const entry of exportsKinds) {
+                const { name: suffix, alias } = parseExportEntry(entry);
+                if (table.has(suffix))
+                    continue;
+                if (!alias) {
+                    table.set(suffix, `${module}.${suffix}`);
+                    changed = true;
+                    continue;
+                }
+                const source = aliasToModule(module, alias);
+                const canonical = source ? out.get(source)?.get(suffix) : undefined;
+                if (canonical) {
+                    table.set(suffix, canonical);
+                    changed = true;
+                }
+            }
+        }
+        if (!changed)
+            break;
+    }
+    return out;
+}
+/** Stamp `metadata.reExportedKinds` (suffix → canonical kind) onto every `Telo.Import` whose
+ *  target re-exports kinds, so the analyzer can register the re-export mappings. Only entries
+ *  that point at a module OTHER than the import's own target are stamped (genuine re-exports;
+ *  a locally-defined kind resolves through the normal alias path). Stamped on `metadata` (which
+ *  permits additional properties, like `resolvedModuleName`) since the `Telo.Import` schema
+ *  forbids extra top-level fields. Shared by both paths. */
+export function stampReExportedKinds(imports, exportedKinds) {
+    for (const { manifest, targetModule } of imports) {
+        const table = exportedKinds.get(targetModule);
+        if (!table)
+            continue;
+        const reExported = {};
+        for (const [suffix, canonical] of table) {
+            if (canonical !== `${targetModule}.${suffix}`)
+                reExported[suffix] = canonical;
+        }
+        if (Object.keys(reExported).length === 0)
+            continue;
+        manifest.metadata.reExportedKinds = reExported;
+    }
+}
+/** CLI/kernel adapter: collect re-export specs + alias map from a LoadedGraph. */
+function forwardReExports(graph, result) {
+    const ownerSourceOf = new Map();
+    const specs = [];
+    const kindModules = [];
+    for (const [source, mod] of graph.modules) {
+        if (source === graph.rootSource)
+            continue; // root is an Application — no exports
+        const libDoc = mod.owner.manifests.find((m) => m && isModuleKind(m.kind));
+        const moduleName = libDoc?.metadata?.name;
+        if (!libDoc || !moduleName)
+            continue;
+        ownerSourceOf.set(moduleName, mod.owner.source);
+        specs.push(...reExportSpecsFromExports(moduleName, libDoc.exports?.resources));
+        kindModules.push({ module: moduleName, exportsKinds: libDoc.exports?.kinds ?? [] });
+    }
+    const aliasToModule = (module, alias) => {
+        const ownerSource = ownerSourceOf.get(module);
+        return ownerSource
+            ? (graph.importEdges.get(ownerSource)?.get(alias)?.targetModuleName ?? undefined)
+            : undefined;
+    };
+    forwardReExportManifests(result, specs, aliasToModule);
+    // Resolve every library's re-exported kinds and stamp them onto the consumer-facing
+    // Telo.Import manifests so the analyzer can register the re-export mappings.
+    const exportedKinds = resolveExportedKinds(kindModules, aliasToModule);
+    const imports = [];
+    for (const m of result) {
+        if (m.kind !== "Telo.Import")
+            continue;
+        const owner = m.metadata?.source;
+        const alias = m.metadata?.name;
+        const target = owner && alias ? graph.importEdges.get(owner)?.get(alias)?.targetModuleName : undefined;
+        if (target)
+            imports.push({ manifest: m, targetModule: target });
+    }
+    stampReExportedKinds(imports, exportedKinds);
+}
 /** Project a LoadedModule (owner + partials) to a flat ResourceManifest[]
  *  with `metadata.module` stamped on non-module docs. The kernel's runtime
  *  entry load uses this to convert a `Loader.loadModule` result into the

package/dist/index.d.ts

@@ -2,7 +2,7 @@ export { AnalysisRegistry } from "./analysis-registry.js";
 export type { RefFieldInfo } from "./analysis-registry.js";
 export { StaticAnalyzer } from "./analyzer.js";
 export type { GraphLoadError, ImportEdge, LoadedFile, LoadedGraph, LoadedModule, ParseError, } from "./loaded-types.js";
-export { flattenForAnalyzer, flattenLoadedModule, selectModuleManifestsForAnalysis, } from "./flatten-for-analyzer.js";
+export { flattenForAnalyzer, flattenLoadedModule, forwardReExportManifests, parseExportEntry, reExportSpecsFromExports, resolveExportedKinds, selectModuleManifestsForAnalysis, stampReExportedKinds, type ParsedExportEntry, type ReExportSpec, } from "./flatten-for-analyzer.js";
 export { visitManifest } from "./manifest-visitor.js";
 export type { CelSiteEvent, ManifestVisitor, RefSiteEvent, ResourceEnterEvent, ResourceExitEvent, ScopeBoundaryEvent, SchemaFromSiteEvent, VisitOptions, } from "./manifest-visitor.js";
 export { Loader } from "./manifest-loader.js";