@telorun/analyzer 0.22.0 → 0.23.1

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,gCAAgC,GACnC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,6 +1,6 @@
 export { AnalysisRegistry } from "./analysis-registry.js";
 export { StaticAnalyzer } from "./analyzer.js";
-export { flattenForAnalyzer, flattenLoadedModule, selectModuleManifestsForAnalysis, } from "./flatten-for-analyzer.js";
+export { flattenForAnalyzer, flattenLoadedModule, forwardReExportManifests, parseExportEntry, reExportSpecsFromExports, resolveExportedKinds, selectModuleManifestsForAnalysis, stampReExportedKinds, } from "./flatten-for-analyzer.js";
 export { visitManifest } from "./manifest-visitor.js";
 export { Loader } from "./manifest-loader.js";
 export { isModuleKind, MODULE_KINDS } from "./module-kinds.js";

package/dist/resolve-throws-union.d.ts

@@ -1,5 +1,5 @@
 import type { ResourceManifest } from "@telorun/sdk";
-import type { AliasResolver } from "./alias-resolver.js";
+import { type AliasResolver } from "./alias-resolver.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
 export interface ThrowsCodeMeta {
     data?: Record<string, any>;
@@ -27,10 +27,17 @@ export interface ResolveCtx {
     allManifests: ResourceManifest[];
     defs: DefinitionRegistry;
     aliases: AliasResolver;
+    /** Per-imported-library alias resolvers, keyed by module name. A manifest that
+     *  originated in an imported library resolves its kind aliases against its own
+     *  module's resolver, not the consumer's — an inline handler extracted from an
+     *  imported Http.Api inherits the lexical scope of the library that declares it. */
+    aliasesByModule: Map<string, AliasResolver>;
+    /** The consumer/root module names; resources owned by these resolve against `aliases`. */
+    rootModules: Set<string>;
     memo: Map<string, ThrowsUnion>;
     inProgress: Set<string>;
 }
-export declare function createResolveCtx(allManifests: ResourceManifest[], defs: DefinitionRegistry, aliases: AliasResolver): ResolveCtx;
+export declare function createResolveCtx(allManifests: ResourceManifest[], defs: DefinitionRegistry, aliases: AliasResolver, aliasesByModule?: Map<string, AliasResolver>, rootModules?: Set<string>): ResolveCtx;
 /** Resolve the effective throw union for a named manifest. The result combines
  *  explicit `throws.codes`, `throws.inherit: true` dataflow (step-context
  *  traversal with try/catch subtraction), and unbounded markers for

package/dist/resolve-throws-union.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-throws-union.d.ts","sourceRoot":"","sources":["../src/resolve-throws-union.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC5B;AAED;;gFAEgF;AAChF,eAAO,MAAM,gBAAgB,mBAAmB,CAAC;AAEjD,MAAM,WAAW,WAAW;IAC1B,gFAAgF;IAChF,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACnC;;;8EAG0E;IAC1E,SAAS,EAAE,OAAO,CAAC;IACnB;;;;gDAI4C;IAC5C,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC/B,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACzB;AAED,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,gBAAgB,EAAE,EAChC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,GACrB,UAAU,CAQZ;AAgCD;;;;8CAI8C;AAC9C,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,gBAAgB,EAC1B,GAAG,EAAE,UAAU,GACd,WAAW,CA+Cb"}
+{"version":3,"file":"resolve-throws-union.d.ts","sourceRoot":"","sources":["../src/resolve-throws-union.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,EAA0B,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC5B;AAED;;gFAEgF;AAChF,eAAO,MAAM,gBAAgB,mBAAmB,CAAC;AAEjD,MAAM,WAAW,WAAW;IAC1B,gFAAgF;IAChF,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACnC;;;8EAG0E;IAC1E,SAAS,EAAE,OAAO,CAAC;IACnB;;;;gDAI4C;IAC5C,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB;;;wFAGoF;IACpF,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC5C,0FAA0F;IAC1F,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC/B,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACzB;AAED,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,gBAAgB,EAAE,EAChC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,eAAe,GAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAa,EACvD,WAAW,GAAE,GAAG,CAAC,MAAM,CAAa,GACnC,UAAU,CAUZ;AA6CD;;;;8CAI8C;AAC9C,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,gBAAgB,EAC1B,GAAG,EAAE,UAAU,GACd,WAAW,CAiDb"}

package/dist/resolve-throws-union.js

@@ -1,13 +1,16 @@
 import { isTaggedSentinel } from "@telorun/templating";
+import { scopeResolverForModule } from "./alias-resolver.js";
 /** Code a non-`InvokeError` failure surfaces as inside a `catch` block. Mirrors
  *  `PLAIN_ERROR_CODE` in `@telorun/run`'s `toSequenceError`: any invoke can throw
  *  a plain error, which the catch sees as `error.code === "INTERNAL_ERROR"`. */
 export const PLAIN_ERROR_CODE = "INTERNAL_ERROR";
-export function createResolveCtx(allManifests, defs, aliases) {
+export function createResolveCtx(allManifests, defs, aliases, aliasesByModule = new Map(), rootModules = new Set()) {
     return {
         allManifests,
         defs,
         aliases,
+        aliasesByModule,
+        rootModules,
         memo: new Map(),
         inProgress: new Set(),
     };
@@ -15,6 +18,10 @@ export function createResolveCtx(allManifests, defs, aliases) {
 function emptyUnion() {
     return { codes: new Map(), unbounded: false };
 }
+/** The owning module's alias resolver for a manifest in this resolve context. */
+function scopeResolverFor(ctx, ownModule) {
+    return scopeResolverForModule(ownModule, ctx.rootModules, ctx.aliasesByModule);
+}
 function unionInto(target, src) {
     for (const [code, meta] of src.codes) {
         if (!target.codes.has(code))
@@ -25,9 +32,18 @@ function unionInto(target, src) {
     if (src.canThrowPlain)
         target.canThrowPlain = true;
 }
-function definitionFor(kind, defs, aliases) {
+function definitionFor(kind, defs, aliases, scopeResolver) {
+    const direct = defs.resolve(kind);
+    if (direct)
+        return direct;
+    const scoped = scopeResolver?.resolveKind(kind);
+    if (scoped) {
+        const d = defs.resolve(scoped);
+        if (d)
+            return d;
+    }
     const resolved = aliases.resolveKind(kind);
-    return defs.resolve(kind) ?? (resolved ? defs.resolve(resolved) : undefined);
+    return resolved ? defs.resolve(resolved) : undefined;
 }
 function codesFromDefinition(definition) {
     const out = new Map();
@@ -51,7 +67,9 @@ export function resolveThrowsUnion(manifest, ctx) {
         if (ctx.inProgress.has(name))
             return emptyUnion();
     }
-    const definition = definitionFor(manifest.kind, ctx.defs, ctx.aliases);
+    const ownModule = manifest.metadata?.module;
+    const scopeResolver = scopeResolverFor(ctx, ownModule);
+    const definition = definitionFor(manifest.kind, ctx.defs, ctx.aliases, scopeResolver);
     if (!definition) {
         const u = { codes: new Map(), unbounded: true };
         if (name)
@@ -78,7 +96,7 @@ export function resolveThrowsUnion(manifest, ctx) {
             result.unbounded = true;
         }
         if (throws.inherit) {
-            const inherited = resolveInherited(manifest, definition, ctx);
+            const inherited = resolveInherited(manifest, definition, ctx, ownModule);
             unionInto(result, inherited);
         }
         if (name)
@@ -90,7 +108,7 @@ export function resolveThrowsUnion(manifest, ctx) {
             ctx.inProgress.delete(name);
     }
 }
-function resolveInherited(manifest, definition, ctx) {
+function resolveInherited(manifest, definition, ctx, ownerModule) {
     const result = { codes: new Map(), unbounded: false };
     const props = definition.schema?.properties;
     if (!props)
@@ -102,16 +120,16 @@ function resolveInherited(manifest, definition, ctx) {
         const steps = manifest[fieldName];
         if (!Array.isArray(steps))
             continue;
-        unionInto(result, collectStepArrayThrows(steps, stepCtx.invoke, undefined, ctx));
+        unionInto(result, collectStepArrayThrows(steps, stepCtx.invoke, undefined, ctx, ownerModule));
     }
     return result;
 }
-function collectStepArrayThrows(steps, invokeField, enclosingTryCodes, ctx) {
+function collectStepArrayThrows(steps, invokeField, enclosingTryCodes, ctx, ownerModule) {
     const result = emptyUnion();
     for (const step of steps) {
         if (!step || typeof step !== "object")
             continue;
-        unionInto(result, collectStepThrows(step, invokeField, enclosingTryCodes, ctx));
+        unionInto(result, collectStepThrows(step, invokeField, enclosingTryCodes, ctx, ownerModule));
     }
     return result;
 }
@@ -120,11 +138,11 @@ function collectStepArrayThrows(steps, invokeField, enclosingTryCodes, ctx) {
  *  / `else` / `elseif` / `do` / `cases` / `default`) are the same set already
  *  traversed by the analyzer's `x-telo-step-context` schema builder, so future
  *  composers that reuse those shape conventions work without changes here. */
-function collectStepThrows(step, invokeField, enclosingTryCodes, ctx) {
+function collectStepThrows(step, invokeField, enclosingTryCodes, ctx, ownerModule) {
     if (step[invokeField]) {
         // Any invoked resource can throw a non-InvokeError at runtime, which an
         // enclosing catch surfaces as PLAIN_ERROR_CODE — record that possibility.
-        const u = cloneUnion(resolveStepInvokeThrows(step, invokeField, enclosingTryCodes, ctx));
+        const u = cloneUnion(resolveStepInvokeThrows(step, invokeField, enclosingTryCodes, ctx, ownerModule));
         u.canThrowPlain = true;
         return u;
     }
@@ -132,7 +150,7 @@ function collectStepThrows(step, invokeField, enclosingTryCodes, ctx) {
         return resolveThrowStepCode(step.throw, enclosingTryCodes);
     }
     if (Array.isArray(step.try)) {
-        const tryUnion = collectStepArrayThrows(step.try, invokeField, enclosingTryCodes, ctx);
+        const tryUnion = collectStepArrayThrows(step.try, invokeField, enclosingTryCodes, ctx, ownerModule);
         let propagated;
         if (Array.isArray(step.catch)) {
             // Catch absorbs the try block's codes; the catch's own throws propagate
@@ -144,7 +162,7 @@ function collectStepThrows(step, invokeField, enclosingTryCodes, ctx) {
             // rethrow can propagate it — seed the set the catch resolves against.
             if (tryUnion.canThrowPlain)
                 tryCodes.add(PLAIN_ERROR_CODE);
-            propagated = collectStepArrayThrows(step.catch, invokeField, tryCodes, ctx);
+            propagated = collectStepArrayThrows(step.catch, invokeField, tryCodes, ctx, ownerModule);
             // Unbounded in the try block still signals the caller to expect
             // arbitrary codes to flow through the catch (e.g. via passthrough).
             if (tryUnion.unbounded)
@@ -154,37 +172,37 @@ function collectStepThrows(step, invokeField, enclosingTryCodes, ctx) {
             propagated = cloneUnion(tryUnion);
         }
         if (Array.isArray(step.finally)) {
-            unionInto(propagated, collectStepArrayThrows(step.finally, invokeField, enclosingTryCodes, ctx));
+            unionInto(propagated, collectStepArrayThrows(step.finally, invokeField, enclosingTryCodes, ctx, ownerModule));
         }
         return propagated;
     }
     if (Array.isArray(step.then)) {
         const result = emptyUnion();
-        unionInto(result, collectStepArrayThrows(step.then, invokeField, enclosingTryCodes, ctx));
+        unionInto(result, collectStepArrayThrows(step.then, invokeField, enclosingTryCodes, ctx, ownerModule));
         if (Array.isArray(step.else)) {
-            unionInto(result, collectStepArrayThrows(step.else, invokeField, enclosingTryCodes, ctx));
+            unionInto(result, collectStepArrayThrows(step.else, invokeField, enclosingTryCodes, ctx, ownerModule));
         }
         if (Array.isArray(step.elseif)) {
             for (const branch of step.elseif) {
                 if (Array.isArray(branch?.then)) {
-                    unionInto(result, collectStepArrayThrows(branch.then, invokeField, enclosingTryCodes, ctx));
+                    unionInto(result, collectStepArrayThrows(branch.then, invokeField, enclosingTryCodes, ctx, ownerModule));
                 }
             }
         }
         return result;
     }
     if (Array.isArray(step.do)) {
-        return collectStepArrayThrows(step.do, invokeField, enclosingTryCodes, ctx);
+        return collectStepArrayThrows(step.do, invokeField, enclosingTryCodes, ctx, ownerModule);
     }
     if (step.cases && typeof step.cases === "object") {
         const result = emptyUnion();
         for (const arr of Object.values(step.cases)) {
             if (Array.isArray(arr)) {
-                unionInto(result, collectStepArrayThrows(arr, invokeField, enclosingTryCodes, ctx));
+                unionInto(result, collectStepArrayThrows(arr, invokeField, enclosingTryCodes, ctx, ownerModule));
             }
         }
         if (Array.isArray(step.default)) {
-            unionInto(result, collectStepArrayThrows(step.default, invokeField, enclosingTryCodes, ctx));
+            unionInto(result, collectStepArrayThrows(step.default, invokeField, enclosingTryCodes, ctx, ownerModule));
         }
         return result;
     }
@@ -199,14 +217,18 @@ function cloneUnion(u) {
         out.canThrowPlain = true;
     return out;
 }
-function resolveStepInvokeThrows(step, invokeField, enclosingTryCodes, ctx) {
+function resolveStepInvokeThrows(step, invokeField, enclosingTryCodes, ctx, ownerModule) {
     const invokeRef = step[invokeField];
     if (!invokeRef || typeof invokeRef !== "object")
         return emptyUnion();
     const invokedKind = invokeRef.kind;
     if (!invokedKind)
         return emptyUnion();
-    const definition = definitionFor(invokedKind, ctx.defs, ctx.aliases);
+    // The invoked kind's alias resolves in the OWNER manifest's lexical scope (the
+    // composer that declares the step), so a library's step referencing its own
+    // import resolves against that library, not the consumer.
+    const scopeResolver = scopeResolverFor(ctx, ownerModule);
+    const definition = definitionFor(invokedKind, ctx.defs, ctx.aliases, scopeResolver);
     if (!definition)
         return { codes: new Map(), unbounded: true };
     if (definition.throws?.passthrough) {
@@ -215,10 +237,12 @@ function resolveStepInvokeThrows(step, invokeField, enclosingTryCodes, ctx) {
     // Named manifest: resolve the full chain (covers transitive inherit).
     const invokeName = invokeRef.name;
     if (invokeName) {
+        const scopedInvokedKind = scopeResolver?.resolveKind(invokedKind);
         const target = ctx.allManifests.find((m) => m.metadata?.name === invokeName &&
             (m.kind === invokedKind ||
                 ctx.aliases.resolveKind(m.kind) === invokedKind ||
-                m.kind === ctx.aliases.resolveKind(invokedKind)));
+                m.kind === ctx.aliases.resolveKind(invokedKind) ||
+                (scopedInvokedKind !== undefined && m.kind === scopedInvokedKind)));
         if (target)
             return resolveThrowsUnion(target, ctx);
     }

package/dist/validate-throws-coverage.d.ts

@@ -1,8 +1,8 @@
 import type { Environment } from "@marcbachmann/cel-js";
 import type { ResourceManifest } from "@telorun/sdk";
-import type { AliasResolver } from "./alias-resolver.js";
+import { type AliasResolver } from "./alias-resolver.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
 import { type AnalysisDiagnostic } from "./types.js";
 /** Entry point — invoked once per analyze() run. */
-export declare function validateThrowsCoverage(manifests: ResourceManifest[], defs: DefinitionRegistry, aliases: AliasResolver, env: Environment): AnalysisDiagnostic[];
+export declare function validateThrowsCoverage(manifests: ResourceManifest[], defs: DefinitionRegistry, aliases: AliasResolver, env: Environment, aliasesByModule?: Map<string, AliasResolver>, rootModules?: Set<string>): AnalysisDiagnostic[];
 //# sourceMappingURL=validate-throws-coverage.d.ts.map

package/dist/validate-throws-coverage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-throws-coverage.d.ts","sourceRoot":"","sources":["../src/validate-throws-coverage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAOnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AA4dzE,oDAAoD;AACpD,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,WAAW,GACf,kBAAkB,EAAE,CAwCtB"}
+{"version":3,"file":"validate-throws-coverage.d.ts","sourceRoot":"","sources":["../src/validate-throws-coverage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAA0B,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAOnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AA4dzE,oDAAoD;AACpD,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,WAAW,EAChB,eAAe,GAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAa,EACvD,WAAW,GAAE,GAAG,CAAC,MAAM,CAAa,GACnC,kBAAkB,EAAE,CAkDtB"}

package/dist/validate-throws-coverage.js

@@ -1,3 +1,4 @@
+import { scopeResolverForModule } from "./alias-resolver.js";
 import { createResolveCtx, resolveThrowsUnion, } from "./resolve-throws-union.js";
 import { DiagnosticSeverity } from "./types.js";
 import { extractAccessChains, validateChainAgainstSchema } from "./validate-cel-context.js";
@@ -406,16 +407,20 @@ function schemaHasStepContext(schema) {
     return false;
 }
 /** Entry point — invoked once per analyze() run. */
-export function validateThrowsCoverage(manifests, defs, aliases, env) {
+export function validateThrowsCoverage(manifests, defs, aliases, env, aliasesByModule = new Map(), rootModules = new Set()) {
     const diagnostics = [];
     diagnostics.push(...validateThrowsDeclarations(manifests));
-    const resolveCtx = createResolveCtx(manifests, defs, aliases);
+    const resolveCtx = createResolveCtx(manifests, defs, aliases, aliasesByModule, rootModules);
+    // The alias resolver for a manifest's own lexical scope — an imported library's
+    // resolver when it owns the manifest, else undefined (fall back to root aliases).
+    const scopeResolverFor = (m) => scopeResolverForModule(m.metadata?.module, rootModules, aliasesByModule);
     for (const manifest of manifests) {
         if (!manifest.kind || !manifest.metadata?.name)
             continue;
         if (manifest.kind === "Telo.Definition" || manifest.kind === "Telo.Abstract")
             continue;
-        const resolvedKind = aliases.resolveKind(manifest.kind);
+        const scopeResolver = scopeResolverFor(manifest);
+        const resolvedKind = scopeResolver?.resolveKind(manifest.kind) ?? aliases.resolveKind(manifest.kind);
         const definition = defs.resolve(manifest.kind) ?? (resolvedKind ? defs.resolve(resolvedKind) : undefined);
         if (!definition?.schema)
             continue;
@@ -426,7 +431,7 @@ export function validateThrowsCoverage(manifests, defs, aliases, env) {
         }, (entries, arrayPath, siblingData, catchesFor) => {
             diagnostics.push(...checkCatchAllPlacement(entries, resource, "catches", filePath, arrayPath));
             const handlerRef = resolveHandlerRef(siblingData[catchesFor]);
-            const union = handlerRefUnion(handlerRef, manifests, resolveCtx);
+            const union = handlerRefUnion(handlerRef, manifests, resolveCtx, scopeResolver);
             diagnostics.push(...checkCatchesCoverage(entries, union, resource, filePath, arrayPath, env));
             diagnostics.push(...checkTypedErrorData(entries, union, resource, filePath, arrayPath, env));
         });
@@ -436,19 +441,22 @@ export function validateThrowsCoverage(manifests, defs, aliases, env) {
 /** Resolve a handler ref's effective throw union. Prefers the named manifest
  *  (so `inherit: true` handlers expose their transitive union); falls back to
  *  the definition's own codes when no name is given. */
-function handlerRefUnion(handlerRef, manifests, ctx) {
+function handlerRefUnion(handlerRef, manifests, ctx, scopeResolver) {
     if (!handlerRef)
         return { codes: new Map(), unbounded: false };
     if (handlerRef.name) {
-        const resolvedKind = ctx.aliases.resolveKind(handlerRef.kind);
+        const resolvedKind = scopeResolver?.resolveKind(handlerRef.kind) ?? ctx.aliases.resolveKind(handlerRef.kind);
         const targetManifest = manifests.find((m) => m.metadata?.name === handlerRef.name &&
             (m.kind === handlerRef.kind ||
                 m.kind === resolvedKind ||
+                scopeResolver?.resolveKind(m.kind) === handlerRef.kind ||
                 ctx.aliases.resolveKind(m.kind) === handlerRef.kind));
         if (targetManifest)
             return resolveThrowsUnion(targetManifest, ctx);
     }
-    const resolved = ctx.aliases.resolveKind(handlerRef.kind);
+    // No named target — fall back to the handler kind's own declared codes,
+    // resolving the kind in the owner's lexical scope first, then root aliases.
+    const resolved = scopeResolver?.resolveKind(handlerRef.kind) ?? ctx.aliases.resolveKind(handlerRef.kind);
     const def = ctx.defs.resolve(handlerRef.kind) ?? (resolved ? ctx.defs.resolve(resolved) : undefined);
     if (!def?.throws)
         return { codes: new Map(), unbounded: false };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.22.0",
+  "version": "0.23.1",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",
@@ -48,7 +48,7 @@
     "@types/node": "^20.0.0",
     "typescript": "^5.0.0",
     "vitest": "^2.1.8",
-    "@telorun/sdk": "0.23.0"
+    "@telorun/sdk": "0.26.0"
   },
   "peerDependencies": {
     "@telorun/sdk": "*"

package/src/alias-resolver.ts

@@ -3,6 +3,10 @@
 export class AliasResolver {
   private readonly importAliases = new Map<string, string>();
   private readonly importedKinds = new Map<string, Set<string>>();
+  /** `${alias}.${suffix}` → canonical `<owningModule>.<Kind>` for kinds an import
+   *  transitively RE-EXPORTS (`exports.kinds: [Alias.Kind]`), which don't live in the
+   *  import's own module. Resolved before the normal `<module>.<suffix>` construction. */
+  private readonly reExportedKinds = new Map<string, string>();
 
   registerImport(alias: string, targetModule: string, exportedKinds: string[]): void {
     this.importAliases.set(alias, targetModule);
@@ -11,6 +15,12 @@ export class AliasResolver {
     }
   }
 
+  /** Register that `<alias>.<suffix>` re-exports the kind canonically named `canonicalKind`
+   *  (owned by a module the alias's target imports, possibly several hops away). */
+  registerKindReExport(alias: string, suffix: string, canonicalKind: string): void {
+    this.reExportedKinds.set(`${alias}.${suffix}`, canonicalKind);
+  }
+
   /** Real module name an alias points at (e.g. "Console" → "console"), or undefined.
    *  Used to resolve an alias-qualified instance reference "Console.writeLine" to the
    *  forwarded resource declared in that module. The `exports.resources` gate is enforced
@@ -29,6 +39,10 @@ export class AliasResolver {
     if (dot === -1) return undefined;
     const prefix = kind.slice(0, dot);
     const suffix = kind.slice(dot + 1);
+    // Re-export takes precedence: a re-exported kind resolves to its true owning module,
+    // not `${prefix-target}.${suffix}` (and bypasses the gate — it's explicitly re-exported).
+    const reExported = this.reExportedKinds.get(`${prefix}.${suffix}`);
+    if (reExported) return reExported;
     const realModule = this.importAliases.get(prefix);
     if (!realModule) return undefined;
     const allowed = this.importedKinds.get(prefix);
@@ -55,3 +69,22 @@ export class AliasResolver {
     return result;
   }
 }
+
+/**
+ * The alias resolver for a resource's own lexical scope. A resource that
+ * originated in an imported library (its `ownModule` names a non-root module —
+ * e.g. an inline handler extracted from an imported Http.Api) resolves its kind
+ * aliases against THAT library's import map, so an anonymous child inherits the
+ * lexical scope of the document that declares it. Returns undefined for
+ * root/consumer-owned resources (and unknown modules), so callers fall back to
+ * the root `aliases`.
+ */
+export function scopeResolverForModule(
+  ownModule: string | undefined,
+  rootModules: Set<string>,
+  aliasesByModule: Map<string, AliasResolver>,
+): AliasResolver | undefined {
+  return ownModule && !rootModules.has(ownModule)
+    ? aliasesByModule.get(ownModule)
+    : undefined;
+}

package/src/analyzer.ts

@@ -1,10 +1,11 @@
 import type { ResourceDefinition, ResourceManifest } from "@telorun/sdk";
 import type { Environment } from "@marcbachmann/cel-js";
 import { defaultRegistry, isTaggedSentinel } from "@telorun/templating";
-import { AliasResolver } from "./alias-resolver.js";
+import { AliasResolver, scopeResolverForModule } from "./alias-resolver.js";
 import { AnalysisRegistry } from "./analysis-registry.js";
 import {
   buildCelEnvironment,
+  buildImportInputCelEnvironment,
   buildTypedCelEnvironment,
   type CelHandlers,
 } from "./cel-environment.js";
@@ -706,16 +707,22 @@ export class StaticAnalyzer {
           if (resolvedModuleName) {
             defs.registerModuleIdentity(resolvedNamespace ?? null, resolvedModuleName);
           }
+          // `metadata.reExportedKinds` (stamped by flattenForAnalyzer / the editor projection)
+          // maps an exported suffix to the true owning module's canonical kind for kinds this
+          // import transitively re-exports (`exports.kinds: [Alias.Kind]`).
+          const reExportedKinds = ((m.metadata as any)?.reExportedKinds ?? {}) as Record<
+            string,
+            string
+          >;
           // Alias registration is scoped: consumer imports vs. imported-library imports.
-          if (!ownModule || rootModules.has(ownModule)) {
-            aliases.registerImport(alias, targetModule, exportedKinds);
-          } else {
-            let libResolver = aliasesByModule.get(ownModule);
-            if (!libResolver) {
-              libResolver = new AliasResolver();
-              aliasesByModule.set(ownModule, libResolver);
-            }
-            libResolver.registerImport(alias, targetModule, exportedKinds);
+          const resolver =
+            !ownModule || rootModules.has(ownModule)
+              ? aliases
+              : (aliasesByModule.get(ownModule) ??
+                aliasesByModule.set(ownModule, new AliasResolver()).get(ownModule)!);
+          resolver.registerImport(alias, targetModule, exportedKinds);
+          for (const [suffix, canonical] of Object.entries(reExportedKinds)) {
+            resolver.registerKindReExport(alias, suffix, canonical);
           }
         }
       }
@@ -864,6 +871,26 @@ export class StaticAnalyzer {
           }
         }
       }
+      // `exports.resources` entries are plain names: `Db` (local) or `Alias.Name` (re-export),
+      // mirroring `exports.kinds`. The `!ref` tag is not accepted here — a `!ref` parses to a
+      // sentinel object that the schema's CEL/ref exemption would silently pass, so reject any
+      // non-string entry with an actionable message instead.
+      const exportsResources = (m as Record<string, any>).exports?.resources;
+      if (Array.isArray(exportsResources)) {
+        for (let i = 0; i < exportsResources.length; i++) {
+          if (typeof exportsResources[i] === "string") continue;
+          diagnostics.push({
+            severity: DiagnosticSeverity.Error,
+            code: "INVALID_EXPORT",
+            source: SOURCE,
+            message:
+              `Telo.Library exports.resources[${i}]: write the exported name as a plain string — ` +
+              `'Name' to export a local instance, or 'Alias.Name' to re-export an imported one. ` +
+              `The '!ref' tag is not allowed in exports.resources.`,
+            data: { resource, filePath, path: `exports.resources.${i}` },
+          });
+        }
+      }
     }
 
     // Build typed kernel globals schema so x-telo-context chain validation
@@ -911,8 +938,15 @@ export class StaticAnalyzer {
 
       // Resolve kind through alias if needed; direct lookup takes priority so that
       // aliases whose name matches the module name (the common case) work without
-      // path-derived name mangling.
-      const resolvedKind = aliases.resolveKind(m.kind);
+      // path-derived name mangling. A resource that originated in an imported library
+      // (its `metadata.module` names a non-root module — e.g. an inline route handler
+      // extracted from an imported Http.Api) must resolve its kind alias against THAT
+      // library's import map, not the consumer's; an anonymous child inherits the
+      // lexical scope of the document that declares it. Mirrors the nested-inline and
+      // reference-resolution paths: own-module scope first, root/consumer aliases last.
+      const ownModule = (m.metadata as { module?: string } | undefined)?.module;
+      const scopeResolver = scopeResolverForModule(ownModule, rootModules, aliasesByModule);
+      const resolvedKind = scopeResolver?.resolveKind(m.kind) ?? aliases.resolveKind(m.kind);
       const definition =
         defs.resolve(m.kind) ?? (resolvedKind ? defs.resolve(resolvedKind) : undefined);
       if (!definition) {
@@ -943,8 +977,27 @@ export class StaticAnalyzer {
                 },
               }
             : definition.schema;
-        // Phase 1: CEL type checking — walk data+schema together, check env.check() return types
-        const baseTypedEnv = buildTypedCelEnvironment(this.celEnv, m, undefined, moduleManifest);
+        // Phase 1: CEL type checking — walk data+schema together, check env.check() return types.
+        // A Telo.Import's variables/secrets are a config-only contract evaluated against the
+        // IMPORTING module's scope, so type them from the owning module doc (matched by
+        // `metadata.module`) and drop `resources`/`env` so referencing them is an error. A
+        // library's own internal import is validated against that library in the library's
+        // standalone analysis; in this flattened app pass the library doc is absent, so the
+        // importer is undefined here and variables/secrets fall back to a permissive `map`
+        // (no false positives) while resources/env stay rejected.
+        const importerModule =
+          m.kind === "Telo.Import"
+            ? allManifests.find(
+                (mm) =>
+                  (mm.kind === "Telo.Application" || mm.kind === "Telo.Library") &&
+                  (mm.metadata as { name?: string } | undefined)?.name ===
+                    (m.metadata as { module?: string } | undefined)?.module,
+              )
+            : undefined;
+        const baseTypedEnv =
+          m.kind === "Telo.Import"
+            ? buildImportInputCelEnvironment(this.celEnv, importerModule)
+            : buildTypedCelEnvironment(this.celEnv, m, undefined, moduleManifest);
         const celIssues = collectCelTypeIssues(
           m,
           schema,
@@ -979,10 +1032,8 @@ export class StaticAnalyzer {
         // first, then the parent module's own aliases (for resources declared
         // inside an imported module), then the root aliases. Mirrors how the
         // analyzer resolves kinds elsewhere so module-scoped aliases don't
-        // produce false UNDEFINED_KIND diagnostics.
-        const ownModule = (m.metadata as { module?: string } | undefined)?.module;
-        const scopeResolver =
-          ownModule && !rootModules.has(ownModule) ? aliasesByModule.get(ownModule) : undefined;
+        // produce false UNDEFINED_KIND diagnostics. `scopeResolver` is the
+        // owning module's resolver computed above.
         diagnostics.push(
           ...validateNestedInlineResources(
             m,
@@ -1258,7 +1309,9 @@ export class StaticAnalyzer {
     diagnostics.push(...validateProviderCoherence(allManifests, defs, aliases));
 
     // Validate throws: declarations and catches: coverage (rules 1, 2, 4, 7)
-    diagnostics.push(...validateThrowsCoverage(allManifests, defs, aliases, this.celEnv));
+    diagnostics.push(
+      ...validateThrowsCoverage(allManifests, defs, aliases, this.celEnv, aliasesByModule, rootModules),
+    );
 
     // Warn about declared variables / secrets / ports that no CEL references.
     diagnostics.push(...validateUnusedDeclarations(allManifests, this.celEnv));

package/src/builtins.ts

@@ -455,8 +455,10 @@ export const KERNEL_BUILTINS: ResourceDefinition[] = [
           type: "object",
           properties: {
             kinds: { type: "array", items: { type: "string" } },
-            // `variables` / `secrets` are reserved on the resources.<Alias> value-flow
-            // surface, so a library may not export instances under those names.
+            // An entry is a bare name (`Db`, a locally-owned export) or a dotted `Alias.Name`
+            // (re-export of the instance reached via this library's import aliased `Alias`,
+            // under the name `Name`) — mirroring `exports.kinds`. `variables` / `secrets` are
+            // reserved on the resources.<Alias> value-flow surface, so they may not be exported.
             resources: {
               type: "array",
               items: { type: "string", not: { enum: ["variables", "secrets"] } },

package/src/cel-environment.ts

@@ -102,3 +102,60 @@ export function buildTypedCelEnvironment(
     return baseEnv.clone();
   }
 }
+
+/** Register a `variables`/`secrets` namespace typed from a module doc's schema map
+ *  (`{ name: <schema>, … }`), falling back to dyn `map` when absent or untyped. */
+function registerConfigNamespace(
+  env: Environment,
+  block: unknown,
+  name: "variables" | "secrets",
+): void {
+  if (block !== null && typeof block === "object" && !Array.isArray(block)) {
+    const entries = Object.entries(block as Record<string, unknown>).filter(
+      ([, v]) => v !== null && typeof v === "object" && !Array.isArray(v),
+    );
+    if (entries.length > 0) {
+      const schema: Record<string, string> = {};
+      for (const [k, v] of entries) schema[k] = jsonSchemaToCelType(v as Record<string, any>);
+      (env as any).registerVariable({ name, schema });
+      return;
+    }
+  }
+  env.registerVariable(name, "map");
+}
+
+/** CEL environment for the `variables:`/`secrets:` expressions on a `Telo.Import`.
+ *
+ *  Import inputs are a config-only contract: their expressions are evaluated
+ *  against the IMPORTING module's `variables`/`secrets`, never the import's own
+ *  values map (the bug) nor the imported child's. `resources`, `env`, and `ports`
+ *  are registered as empty typed objects, so referencing them is a "No such key"
+ *  error that steers authors to a typed `variables` entry. */
+export function buildImportInputCelEnvironment(
+  baseEnv: Environment,
+  moduleManifest: ResourceManifest | undefined,
+): Environment {
+  const env = baseEnv.clone();
+  for (const brand of Object.keys(VALUE_BRAND_BASE)) {
+    (env as any).registerType(brand, { fields: {} });
+  }
+  const mod = moduleManifest as Record<string, unknown> | undefined;
+  // Typing variables/secrets from the importer's schema can fail on a malformed
+  // schema; degrade those to permissive `map` if so — but never lose the
+  // resources/env/ports rejection registered below (the catch is scoped so a
+  // typing failure can't silently re-open the config-only contract).
+  try {
+    registerConfigNamespace(env, mod?.variables, "variables");
+    registerConfigNamespace(env, mod?.secrets, "secrets");
+  } catch {
+    env.registerVariable("variables", "map");
+    env.registerVariable("secrets", "map");
+  }
+  // Override the base env's dyn `resources`/`env`/`ports` with empty typed objects
+  // so any access (`resources.X`, `env.X`) is a "No such key" error — these
+  // surfaces are not part of the config-only import contract.
+  for (const name of ["resources", "env", "ports"]) {
+    (env as any).registerVariable({ name, schema: {} });
+  }
+  return env;
+}