@telorun/analyzer 0.29.0 → 0.30.1

package/dist/cel-environment.d.ts

@@ -7,7 +7,7 @@ export type { CelHandlers } from "@telorun/templating";
  *
  *  - `variables`: typed from the manifest's `variables` field if it is a schema map
  *    (only module-identity docs — `Telo.Application` / `Telo.Library` — carry this); otherwise registered as `map` (dyn).
- *  - `secrets`, `resources`, `env`: always `map` (dyn — output schemas unknown).
+ *  - `secrets`, `resources`: always `map` (dyn — output schemas unknown).
  *  - `extraContextSchema`: additional variables from an `x-telo-context` annotation.
  *
  *  NOTE: The set of kernel globals registered here must match `KERNEL_GLOBAL_NAMES`
@@ -17,7 +17,7 @@ export declare function buildTypedCelEnvironment(baseEnv: Environment, manifest:
  *
  *  Import inputs are a config-only contract: their expressions are evaluated
  *  against the IMPORTING module's `variables`/`secrets`, never the import's own
- *  values map (the bug) nor the imported child's. `resources`, `env`, and `ports`
+ *  values map (the bug) nor the imported child's. `resources` and `ports`
  *  are registered as empty typed objects, so referencing them is a "No such key"
  *  error that steers authors to a typed `variables` entry. */
 export declare function buildImportInputCelEnvironment(baseEnv: Environment, moduleManifest: ResourceManifest | undefined): Environment;

package/dist/cel-environment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cel-environment.d.ts","sourceRoot":"","sources":["../src/cel-environment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAUrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;;;uEASuE;AACvE,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,gBAAgB,EAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,EAI/C,kBAAkB,CAAC,EAAE,gBAAgB,GACpC,WAAW,CAuEb;AAuBD;;;;;;8DAM8D;AAC9D,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,WAAW,EACpB,cAAc,EAAE,gBAAgB,GAAG,SAAS,GAC3C,WAAW,CAwBb"}
+{"version":3,"file":"cel-environment.d.ts","sourceRoot":"","sources":["../src/cel-environment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAUrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;;;uEASuE;AACvE,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,gBAAgB,EAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,EAI/C,kBAAkB,CAAC,EAAE,gBAAgB,GACpC,WAAW,CAsEb;AAuBD;;;;;;8DAM8D;AAC9D,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,WAAW,EACpB,cAAc,EAAE,gBAAgB,GAAG,SAAS,GAC3C,WAAW,CAwBb"}

package/dist/cel-environment.js

@@ -11,7 +11,7 @@ export { buildCelEnvironment } from "@telorun/templating";
  *
  *  - `variables`: typed from the manifest's `variables` field if it is a schema map
  *    (only module-identity docs — `Telo.Application` / `Telo.Library` — carry this); otherwise registered as `map` (dyn).
- *  - `secrets`, `resources`, `env`: always `map` (dyn — output schemas unknown).
+ *  - `secrets`, `resources`: always `map` (dyn — output schemas unknown).
  *  - `extraContextSchema`: additional variables from an `x-telo-context` annotation.
  *
  *  NOTE: The set of kernel globals registered here must match `KERNEL_GLOBAL_NAMES`
@@ -71,7 +71,6 @@ rootModuleManifest) {
         }
         env.registerVariable("secrets", "map");
         env.registerVariable("resources", "map");
-        env.registerVariable("env", "map");
         if (extraContextSchema?.properties) {
             for (const [name, propSchema] of Object.entries(extraContextSchema.properties)) {
                 if (!env.hasVariable(name)) {
@@ -104,7 +103,7 @@ function registerConfigNamespace(env, block, name) {
  *
  *  Import inputs are a config-only contract: their expressions are evaluated
  *  against the IMPORTING module's `variables`/`secrets`, never the import's own
- *  values map (the bug) nor the imported child's. `resources`, `env`, and `ports`
+ *  values map (the bug) nor the imported child's. `resources` and `ports`
  *  are registered as empty typed objects, so referencing them is a "No such key"
  *  error that steers authors to a typed `variables` entry. */
 export function buildImportInputCelEnvironment(baseEnv, moduleManifest) {
@@ -125,10 +124,10 @@ export function buildImportInputCelEnvironment(baseEnv, moduleManifest) {
         env.registerVariable("variables", "map");
         env.registerVariable("secrets", "map");
     }
-    // Override the base env's dyn `resources`/`env`/`ports` with empty typed objects
-    // so any access (`resources.X`, `env.X`) is a "No such key" error — these
+    // Override the base env's dyn `resources`/`ports` with empty typed objects
+    // so any access (`resources.X`, `ports.X`) is a "No such key" error — these
     // surfaces are not part of the config-only import contract.
-    for (const name of ["resources", "env", "ports"]) {
+    for (const name of ["resources", "ports"]) {
         env.registerVariable({ name, schema: {} });
     }
     return env;

package/dist/definition-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"definition-registry.d.ts","sourceRoot":"","sources":["../src/definition-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAGlC,+EAA+E;AAC/E,qBAAa,kBAAkB;;IAK7B;;sFAEkF;IAClF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IAEzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyC;IAC9D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D;6DACyD;IACzD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD;;0EAEsE;IACtE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA6B;IAEhE,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI;IAiC9C,OAAO,CAAC,aAAa;IASrB;;;yFAGqF;IACrF,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IA+B1E;;;;iFAI6E;IAC7E,uBAAuB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI;IAMtE;uFACmF;IACnF,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAIhC;4EACwE;IACxE,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAMnE;;;;oFAIgF;IAChF,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE;IAWtE;;;;;;iCAM6B;IAC7B,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,GAAG,SAAS;IASnE,OAAO,CAAC,iBAAiB;IAczB;;;;;;;;4FAQwF;IACxF,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAUhD,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAIrD,+FAA+F;IAC/F,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAIxD,gGAAgG;IAChG,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,GACvD,iBAAiB,GAAG,SAAS;IAOhC;;;;;;;;qFAQiF;IACjF,2BAA2B,CACzB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC1C,iBAAiB,GAAG,SAAS;IAuBhC,OAAO,CAAC,uBAAuB;IA+B/B;;qEAEiE;IACjE,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAgBxD,KAAK,IAAI,MAAM,EAAE;CAGlB"}
+{"version":3,"file":"definition-registry.d.ts","sourceRoot":"","sources":["../src/definition-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAGlC,+EAA+E;AAC/E,qBAAa,kBAAkB;;IAK7B;;sFAEkF;IAClF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IAEzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyC;IAC9D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D;6DACyD;IACzD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD;;0EAEsE;IACtE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA6B;IAEhE,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI;IAiC9C,OAAO,CAAC,aAAa;IASrB;;;yFAGqF;IACrF,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IA+B1E;;;;iFAI6E;IAC7E,uBAAuB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI;IAMtE;uFACmF;IACnF,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAIhC;4EACwE;IACxE,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAMnE;;;;oFAIgF;IAChF,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE;IAWtE;;;;;;iCAM6B;IAC7B,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,GAAG,SAAS;IASnE,OAAO,CAAC,iBAAiB;IAczB;;;;;;;;4FAQwF;IACxF,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAUhD,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAIrD,+FAA+F;IAC/F,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAIxD,gGAAgG;IAChG,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,GACvD,iBAAiB,GAAG,SAAS;IAOhC;;;;;;;;qFAQiF;IACjF,2BAA2B,CACzB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC1C,iBAAiB,GAAG,SAAS;IAkChC,OAAO,CAAC,uBAAuB;IA+B/B;;qEAEiE;IACjE,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAgBxD,KAAK,IAAI,MAAM,EAAE;CAGlB"}

package/dist/definition-registry.js

@@ -208,11 +208,20 @@ export class DefinitionRegistry {
      *  anchors depend on a sibling property at runtime and stay unexpanded; the
      *  analyzer's reference validation phase already flags the cases that matter. */
     expandedFieldMapForResource(resource, aliases, aliasesByModule) {
-        const baseMap = this.getFieldMapForKind(resource.kind, aliases);
+        // Resolve the resource's OWN kind through its module's alias scope, not the global
+        // aliases. A library-internal resource's kind uses a library-local alias
+        // (e.g. `Ai.AgentStream` in a library that imports `Ai`), which the root/global
+        // resolver doesn't know — using the global scope here left the base field map
+        // unresolved, so Phase-5 injection saw no ref fields and skipped injection.
+        const ownModule = resource.metadata?.module;
+        const moduleScope = (ownModule ? aliasesByModule.get(ownModule) : undefined) ?? aliases;
+        const baseMap = this.getFieldMapForKind(resource.kind, moduleScope);
         if (!baseMap)
             return undefined;
-        const resolvedKind = aliases.resolveKind(resource.kind) ?? resource.kind;
+        const resolvedKind = moduleScope.resolveKind(resource.kind) ?? resource.kind;
         const def = this.resolve(resource.kind) ?? this.resolve(resolvedKind);
+        // schema-from anchors resolve in the DEFINITION's module scope (where the anchor
+        // kind is declared), which may differ from the resource's own module.
         const ownerModule = def?.metadata?.module;
         const ownerScope = (ownerModule ? aliasesByModule.get(ownerModule) : undefined) ?? aliases;
         const expanded = new Map();

package/dist/kernel-globals.d.ts

@@ -5,12 +5,12 @@ import type { ResourceManifest } from "@telorun/sdk";
  * `buildTypedCelEnvironment` in cel-environment.ts (CEL type-checking)
  * must stay in sync with this list.
  *
- * Note: `env` is only available in the root module context. Child modules
- * loaded via Telo.Import do not receive host environment variables.
- * There is no `imports` namespace at runtime — import snapshots are stored
- * under `resources.<alias>`.
+ * Note: there is no `imports` namespace at runtime — import snapshots are
+ * stored under `resources.<alias>`. Host environment variables are reached
+ * by declaring a typed `variables:`/`secrets:` entry with an `env:` binding
+ * and referencing `variables.X` / `secrets.X`.
  */
-export declare const KERNEL_GLOBAL_NAMES: readonly ["variables", "secrets", "resources", "ports", "env"];
+export declare const KERNEL_GLOBAL_NAMES: readonly ["variables", "secrets", "resources", "ports"];
 /**
  * Build a typed JSON Schema describing the kernel globals available in the
  * given manifest set. Used to merge into `x-telo-context` schemas so that
@@ -23,12 +23,11 @@ export declare const KERNEL_GLOBAL_NAMES: readonly ["variables", "secrets", "res
  *   in the outer module; Libraries are only relevant when the caller scoped
  *   the manifest list to a single library's file.
  * - `resources`: enumerates all non-system resource names
- * - `env`: dynamic (runtime env vars, root module only)
  */
 export declare function buildKernelGlobalsSchema(manifests: ResourceManifest[]): Record<string, any>;
 /**
  * Merge kernel globals into an `x-telo-context` schema so chain-access
- * validation recognises `variables`, `secrets`, `resources`, `env`
+ * validation recognises `variables`, `secrets`, `resources`, `ports`
  * without module authors having to re-declare them.
  *
  * Context-specific properties take precedence over globals (spread order).

package/dist/kernel-globals.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kernel-globals.d.ts","sourceRoot":"","sources":["../src/kernel-globals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,gEAAiE,CAAC;AASlG;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,gBAAgB,EAAE,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAkCrB;AA4CD;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAClC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACjC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CASrB"}
+{"version":3,"file":"kernel-globals.d.ts","sourceRoot":"","sources":["../src/kernel-globals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,yDAA0D,CAAC;AAS3F;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,gBAAgB,EAAE,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAiCrB;AA4CD;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAClC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACjC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CASrB"}

package/dist/kernel-globals.js

@@ -5,12 +5,12 @@ import { residualEntrySchemaMap } from "./residual-schema.js";
  * `buildTypedCelEnvironment` in cel-environment.ts (CEL type-checking)
  * must stay in sync with this list.
  *
- * Note: `env` is only available in the root module context. Child modules
- * loaded via Telo.Import do not receive host environment variables.
- * There is no `imports` namespace at runtime — import snapshots are stored
- * under `resources.<alias>`.
+ * Note: there is no `imports` namespace at runtime — import snapshots are
+ * stored under `resources.<alias>`. Host environment variables are reached
+ * by declaring a typed `variables:`/`secrets:` entry with an `env:` binding
+ * and referencing `variables.X` / `secrets.X`.
  */
-export const KERNEL_GLOBAL_NAMES = ["variables", "secrets", "resources", "ports", "env"];
+export const KERNEL_GLOBAL_NAMES = ["variables", "secrets", "resources", "ports"];
 const SYSTEM_KINDS = new Set([
     "Telo.Definition",
     "Telo.Application",
@@ -29,7 +29,6 @@ const SYSTEM_KINDS = new Set([
  *   in the outer module; Libraries are only relevant when the caller scoped
  *   the manifest list to a single library's file.
  * - `resources`: enumerates all non-system resource names
- * - `env`: dynamic (runtime env vars, root module only)
  */
 export function buildKernelGlobalsSchema(manifests) {
     const moduleManifest = manifests.find((m) => m.kind === "Telo.Application") ??
@@ -56,7 +55,6 @@ export function buildKernelGlobalsSchema(manifests) {
                 additionalProperties: false,
             },
             ports: buildPortsSchema(moduleManifest?.ports),
-            env: { type: "object", additionalProperties: true },
         },
     };
 }
@@ -98,7 +96,7 @@ function buildSchemaMapSchema(schemaMap) {
 }
 /**
  * Merge kernel globals into an `x-telo-context` schema so chain-access
- * validation recognises `variables`, `secrets`, `resources`, `env`
+ * validation recognises `variables`, `secrets`, `resources`, `ports`
  * without module authors having to re-declare them.
  *
  * Context-specific properties take precedence over globals (spread order).

package/dist/reconcile-module-versions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reconcile-module-versions.d.ts","sourceRoot":"","sources":["../src/reconcile-module-versions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAElE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;0CAI0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,gEAAgE;IAChE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;2EACuE;IACvE,WAAW,EAAE,kBAAkB,EAAE,CAAC;CACnC;AA8KD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,EAClC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,GAChD,qBAAqB,CAiDvB"}
+{"version":3,"file":"reconcile-module-versions.d.ts","sourceRoot":"","sources":["../src/reconcile-module-versions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAElE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;0CAI0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,gEAAgE;IAChE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;2EACuE;IACvE,WAAW,EAAE,kBAAkB,EAAE,CAAC;CACnC;AAwKD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,EAClC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,GAChD,qBAAqB,CAiDvB"}

package/dist/reconcile-module-versions.js

@@ -148,15 +148,10 @@ function hoistDiagnostic(identity, importerSource, alias, loser, winner, conflic
             data,
         };
     }
-    return {
-        severity: DiagnosticSeverity.Warning,
-        code: "MODULE_VERSION_HOISTED",
-        source: SOURCE,
-        message: `Module '${identity}@${loser.version || "<unknown>"}' was hoisted to '${winner.version}' ` +
-            `because the same module is imported at the higher version elsewhere in the graph. ` +
-            `Pre-1.0 versions are additive, so the higher version is used for every importer.`,
-        data,
-    };
+    // Same-major hoist to a higher version: additive pre-1.0, so the redirect is
+    // non-lossy and by design — resolve to the winner silently, like a package
+    // manager picking the highest compatible version of a transitive dep.
+    return null;
 }
 /**
  * Reconcile a loaded import graph so each module identity (`namespace/name`)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.29.0",
+  "version": "0.30.1",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",

package/src/cel-environment.ts

@@ -17,7 +17,7 @@ export type { CelHandlers } from "@telorun/templating";
  *
  *  - `variables`: typed from the manifest's `variables` field if it is a schema map
  *    (only module-identity docs — `Telo.Application` / `Telo.Library` — carry this); otherwise registered as `map` (dyn).
- *  - `secrets`, `resources`, `env`: always `map` (dyn — output schemas unknown).
+ *  - `secrets`, `resources`: always `map` (dyn — output schemas unknown).
  *  - `extraContextSchema`: additional variables from an `x-telo-context` annotation.
  *
  *  NOTE: The set of kernel globals registered here must match `KERNEL_GLOBAL_NAMES`
@@ -85,7 +85,6 @@ export function buildTypedCelEnvironment(
 
     env.registerVariable("secrets", "map");
     env.registerVariable("resources", "map");
-    env.registerVariable("env", "map");
 
     if (extraContextSchema?.properties) {
       for (const [name, propSchema] of Object.entries(
@@ -128,7 +127,7 @@ function registerConfigNamespace(
  *
  *  Import inputs are a config-only contract: their expressions are evaluated
  *  against the IMPORTING module's `variables`/`secrets`, never the import's own
- *  values map (the bug) nor the imported child's. `resources`, `env`, and `ports`
+ *  values map (the bug) nor the imported child's. `resources` and `ports`
  *  are registered as empty typed objects, so referencing them is a "No such key"
  *  error that steers authors to a typed `variables` entry. */
 export function buildImportInputCelEnvironment(
@@ -151,10 +150,10 @@ export function buildImportInputCelEnvironment(
     env.registerVariable("variables", "map");
     env.registerVariable("secrets", "map");
   }
-  // Override the base env's dyn `resources`/`env`/`ports` with empty typed objects
-  // so any access (`resources.X`, `env.X`) is a "No such key" error — these
+  // Override the base env's dyn `resources`/`ports` with empty typed objects
+  // so any access (`resources.X`, `ports.X`) is a "No such key" error — these
   // surfaces are not part of the config-only import contract.
-  for (const name of ["resources", "env", "ports"]) {
+  for (const name of ["resources", "ports"]) {
     (env as any).registerVariable({ name, schema: {} });
   }
   return env;

package/src/definition-registry.ts

@@ -234,11 +234,22 @@ export class DefinitionRegistry {
     aliases: AliasResolver,
     aliasesByModule: Map<string, AliasResolver>,
   ): ReferenceFieldMap | undefined {
-    const baseMap = this.getFieldMapForKind(resource.kind, aliases);
+    // Resolve the resource's OWN kind through its module's alias scope, not the global
+    // aliases. A library-internal resource's kind uses a library-local alias
+    // (e.g. `Ai.AgentStream` in a library that imports `Ai`), which the root/global
+    // resolver doesn't know — using the global scope here left the base field map
+    // unresolved, so Phase-5 injection saw no ref fields and skipped injection.
+    const ownModule = (resource.metadata as { module?: string } | undefined)?.module;
+    const moduleScope =
+      (ownModule ? aliasesByModule.get(ownModule) : undefined) ?? aliases;
+
+    const baseMap = this.getFieldMapForKind(resource.kind, moduleScope);
     if (!baseMap) return undefined;
 
-    const resolvedKind = aliases.resolveKind(resource.kind) ?? resource.kind;
+    const resolvedKind = moduleScope.resolveKind(resource.kind) ?? resource.kind;
     const def = this.resolve(resource.kind) ?? this.resolve(resolvedKind);
+    // schema-from anchors resolve in the DEFINITION's module scope (where the anchor
+    // kind is declared), which may differ from the resource's own module.
     const ownerModule = (def?.metadata as { module?: string } | undefined)?.module;
     const ownerScope =
       (ownerModule ? aliasesByModule.get(ownerModule) : undefined) ?? aliases;

package/src/kernel-globals.ts

@@ -7,12 +7,12 @@ import { residualEntrySchemaMap } from "./residual-schema.js";
  * `buildTypedCelEnvironment` in cel-environment.ts (CEL type-checking)
  * must stay in sync with this list.
  *
- * Note: `env` is only available in the root module context. Child modules
- * loaded via Telo.Import do not receive host environment variables.
- * There is no `imports` namespace at runtime — import snapshots are stored
- * under `resources.<alias>`.
+ * Note: there is no `imports` namespace at runtime — import snapshots are
+ * stored under `resources.<alias>`. Host environment variables are reached
+ * by declaring a typed `variables:`/`secrets:` entry with an `env:` binding
+ * and referencing `variables.X` / `secrets.X`.
  */
-export const KERNEL_GLOBAL_NAMES = ["variables", "secrets", "resources", "ports", "env"] as const;
+export const KERNEL_GLOBAL_NAMES = ["variables", "secrets", "resources", "ports"] as const;
 
 const SYSTEM_KINDS = new Set([
   "Telo.Definition",
@@ -33,7 +33,6 @@ const SYSTEM_KINDS = new Set([
  *   in the outer module; Libraries are only relevant when the caller scoped
  *   the manifest list to a single library's file.
  * - `resources`: enumerates all non-system resource names
- * - `env`: dynamic (runtime env vars, root module only)
  */
 export function buildKernelGlobalsSchema(
   manifests: ResourceManifest[],
@@ -68,7 +67,6 @@ export function buildKernelGlobalsSchema(
         additionalProperties: false,
       },
       ports: buildPortsSchema(moduleManifest?.ports),
-      env: { type: "object", additionalProperties: true },
     },
   };
 }
@@ -117,7 +115,7 @@ function buildSchemaMapSchema(
 
 /**
  * Merge kernel globals into an `x-telo-context` schema so chain-access
- * validation recognises `variables`, `secrets`, `resources`, `env`
+ * validation recognises `variables`, `secrets`, `resources`, `ports`
  * without module authors having to re-declare them.
  *
  * Context-specific properties take precedence over globals (spread order).

package/src/reconcile-module-versions.ts

@@ -177,16 +177,10 @@ function hoistDiagnostic(
       data,
     };
   }
-  return {
-    severity: DiagnosticSeverity.Warning,
-    code: "MODULE_VERSION_HOISTED",
-    source: SOURCE,
-    message:
-      `Module '${identity}@${loser.version || "<unknown>"}' was hoisted to '${winner.version}' ` +
-      `because the same module is imported at the higher version elsewhere in the graph. ` +
-      `Pre-1.0 versions are additive, so the higher version is used for every importer.`,
-    data,
-  };
+  // Same-major hoist to a higher version: additive pre-1.0, so the redirect is
+  // non-lossy and by design — resolve to the winner silently, like a package
+  // manager picking the highest compatible version of a transitive dep.
+  return null;
 }
 
 /**