@telorun/analyzer 0.35.0 → 0.37.0

package/dist/alias-resolver.d.ts

@@ -7,7 +7,16 @@ export declare class AliasResolver {
      *  transitively RE-EXPORTS (`exports.kinds: [Alias.Kind]`), which don't live in the
      *  import's own module. Resolved before the normal `<module>.<suffix>` construction. */
     private readonly reExportedKinds;
-    registerImport(alias: string, targetModule: string, exportedKinds: string[]): void;
+    /** Register an import alias gated to the target's `exports.kinds`. Only listed kinds
+     *  resolve; an empty list exports nothing. `exportedKinds` is `undefined` for exactly one
+     *  case — the target declares no `exports.kinds` at all (the legacy permissive default,
+     *  kept so already-published module versions stay importable), which is the site to delete
+     *  when kinds go private. For an alias crossing no import boundary use
+     *  `registerUngatedAlias`. Mirrors `ModuleContext.registerImport`. */
+    registerImport(alias: string, targetModule: string, exportedKinds?: readonly string[]): void;
+    /** Register an alias that crosses no import boundary and is therefore never gated —
+     *  `Self`, a library resolving its own kinds. See `ModuleContext.registerUngatedAlias`. */
+    registerUngatedAlias(alias: string, targetModule: string): void;
     /** Register that `<alias>.<suffix>` re-exports the kind canonically named `canonicalKind`
      *  (owned by a module the alias's target imports, possibly several hops away). */
     registerKindReExport(alias: string, suffix: string, canonicalKind: string): void;
@@ -17,7 +26,27 @@ export declare class AliasResolver {
      *  upstream by `flattenForAnalyzer` (only exported instances are forwarded), so a name
      *  that isn't exported simply won't be found. */
     moduleForAlias(alias: string): string | undefined;
-    /** Resolves "Http.Api" → "http-server.Api". Returns undefined if alias is unknown. */
+    /** Resolve an alias-qualified kind, reporting WHY it failed. One parse, one gate check —
+     *  callers that need the reason and callers that only need the name share this, so they
+     *  cannot drift on dot-splitting, re-export precedence, or gate order.
+     *
+     *  - `ok`      — resolved to a canonical `<module>.<Kind>`.
+     *  - `gated`   — the alias is known and the target owns the name, but its `exports.kinds`
+     *                does not list it. A distinct outcome so callers can say "not exported"
+     *                instead of the misleading "no such kind".
+     *  - `unknown` — unqualified kind, or an alias this scope never imported. */
+    resolveKindResult(kind: string): {
+        status: "ok";
+        kind: string;
+    } | {
+        status: "gated";
+        module: string;
+        exported: string[];
+    } | {
+        status: "unknown";
+    };
+    /** Resolves "Http.Api" → "http-server.Api". Undefined if the alias is unknown OR the kind
+     *  is gated out — use `resolveKindResult` when the difference matters. */
     resolveKind(kind: string): string | undefined;
     hasAlias(alias: string): boolean;
     knownAliases(): string[];

package/dist/alias-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"alias-resolver.d.ts","sourceRoot":"","sources":["../src/alias-resolver.ts"],"names":[],"mappings":"AAAA;gFACgF;AAChF,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6B;IAC3D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAkC;IAChE;;4FAEwF;IACxF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6B;IAE7D,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI;IAOlF;sFACkF;IAClF,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI;IAIhF;;;;qDAIiD;IACjD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIjD,sFAAsF;IACtF,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAmB7C,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIhC,YAAY,IAAI,MAAM,EAAE;IAIxB;;qEAEiE;IACjE,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE;CAO3C;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EACxB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC1C,aAAa,GAAG,SAAS,CAI3B"}
+{"version":3,"file":"alias-resolver.d.ts","sourceRoot":"","sources":["../src/alias-resolver.ts"],"names":[],"mappings":"AAAA;gFACgF;AAChF,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6B;IAC3D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAkC;IAChE;;4FAEwF;IACxF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6B;IAE7D;;;;;0EAKsE;IACtE,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IAO5F;+FAC2F;IAC3F,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IAI/D;sFACkF;IAClF,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI;IAIhF;;;;qDAIiD;IACjD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIjD;;;;;;;;iFAQ6E;IAC7E,iBAAiB,CACf,IAAI,EAAE,MAAM,GAEV;QAAE,MAAM,EAAE,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAC9B;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,GACvD;QAAE,MAAM,EAAE,SAAS,CAAA;KAAE;IAoBzB;8EAC0E;IAC1E,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAK7C,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIhC,YAAY,IAAI,MAAM,EAAE;IAIxB;;qEAEiE;IACjE,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE;CAO3C;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EACxB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC1C,aAAa,GAAG,SAAS,CAI3B"}

package/dist/alias-resolver.js

@@ -7,12 +7,23 @@ export class AliasResolver {
      *  transitively RE-EXPORTS (`exports.kinds: [Alias.Kind]`), which don't live in the
      *  import's own module. Resolved before the normal `<module>.<suffix>` construction. */
     reExportedKinds = new Map();
+    /** Register an import alias gated to the target's `exports.kinds`. Only listed kinds
+     *  resolve; an empty list exports nothing. `exportedKinds` is `undefined` for exactly one
+     *  case — the target declares no `exports.kinds` at all (the legacy permissive default,
+     *  kept so already-published module versions stay importable), which is the site to delete
+     *  when kinds go private. For an alias crossing no import boundary use
+     *  `registerUngatedAlias`. Mirrors `ModuleContext.registerImport`. */
     registerImport(alias, targetModule, exportedKinds) {
         this.importAliases.set(alias, targetModule);
-        if (exportedKinds.length > 0) {
+        if (exportedKinds !== undefined) {
             this.importedKinds.set(alias, new Set(exportedKinds));
         }
     }
+    /** Register an alias that crosses no import boundary and is therefore never gated —
+     *  `Self`, a library resolving its own kinds. See `ModuleContext.registerUngatedAlias`. */
+    registerUngatedAlias(alias, targetModule) {
+        this.importAliases.set(alias, targetModule);
+    }
     /** Register that `<alias>.<suffix>` re-exports the kind canonically named `canonicalKind`
      *  (owned by a module the alias's target imports, possibly several hops away). */
     registerKindReExport(alias, suffix, canonicalKind) {
@@ -26,28 +37,43 @@ export class AliasResolver {
     moduleForAlias(alias) {
         return this.importAliases.get(alias);
     }
-    /** Resolves "Http.Api" → "http-server.Api". Returns undefined if alias is unknown. */
-    resolveKind(kind) {
-        if (!kind) {
-            return undefined;
-        }
+    /** Resolve an alias-qualified kind, reporting WHY it failed. One parse, one gate check —
+     *  callers that need the reason and callers that only need the name share this, so they
+     *  cannot drift on dot-splitting, re-export precedence, or gate order.
+     *
+     *  - `ok`      — resolved to a canonical `<module>.<Kind>`.
+     *  - `gated`   — the alias is known and the target owns the name, but its `exports.kinds`
+     *                does not list it. A distinct outcome so callers can say "not exported"
+     *                instead of the misleading "no such kind".
+     *  - `unknown` — unqualified kind, or an alias this scope never imported. */
+    resolveKindResult(kind) {
+        if (!kind)
+            return { status: "unknown" };
         const dot = kind.indexOf(".");
         if (dot === -1)
-            return undefined;
+            return { status: "unknown" };
         const prefix = kind.slice(0, dot);
         const suffix = kind.slice(dot + 1);
         // Re-export takes precedence: a re-exported kind resolves to its true owning module,
-        // not `${prefix-target}.${suffix}` (and bypasses the gate — it's explicitly re-exported).
+        // not `${prefix-target}.${suffix}`. It is listed in the re-exporting library's own
+        // `exports.kinds` (that is how it got here), so this is not a gate bypass.
         const reExported = this.reExportedKinds.get(`${prefix}.${suffix}`);
         if (reExported)
-            return reExported;
+            return { status: "ok", kind: reExported };
         const realModule = this.importAliases.get(prefix);
         if (!realModule)
-            return undefined;
+            return { status: "unknown" };
         const allowed = this.importedKinds.get(prefix);
-        if (allowed !== undefined && !allowed.has(suffix))
-            return undefined;
-        return `${realModule}.${suffix}`;
+        if (allowed !== undefined && !allowed.has(suffix)) {
+            return { status: "gated", module: realModule, exported: [...allowed] };
+        }
+        return { status: "ok", kind: `${realModule}.${suffix}` };
+    }
+    /** Resolves "Http.Api" → "http-server.Api". Undefined if the alias is unknown OR the kind
+     *  is gated out — use `resolveKindResult` when the difference matters. */
+    resolveKind(kind) {
+        const r = this.resolveKindResult(kind);
+        return r.status === "ok" ? r.kind : undefined;
     }
     hasAlias(alias) {
         return this.importAliases.has(alias);

package/dist/analysis-registry.d.ts

@@ -29,7 +29,12 @@ export declare class AnalysisRegistry {
     private readonly aliasesByModule;
     registerDefinition(def: ResourceDefinition): void;
     registerModuleIdentity(namespace: string | null, name: string): void;
-    registerImport(alias: string, target: string, kinds: string[]): void;
+    /** `kinds` is the target's `exports.kinds` gate — only listed kinds resolve, and an
+     *  empty list exports nothing. Omit it only for a target declaring no `exports.kinds`
+     *  (the legacy permissive default); see `AliasResolver.registerImport`. */
+    registerImport(alias: string, target: string, kinds?: readonly string[]): void;
+    /** An alias crossing no import boundary, never gated — `Self`, the `Telo` built-ins. */
+    registerUngatedAlias(alias: string, target: string): void;
     resolveKind(kind: string): string | undefined;
     /**
      * Iterates a resource's reference and scope fields as declared by its definition.

package/dist/analysis-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analysis-registry.d.ts","sourceRoot":"","sources":["../src/analysis-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAAqC,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAEhG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGlD;;wDAEwD;AACxD,MAAM,WAAW,YAAY;IAC3B;0CACsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;;8EAG0E;IAC1E,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;GAIG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IAEpE,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI;IAIjD,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAIpE,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAIpE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI7C;;;;;;;OAOG;IACH,mBAAmB,CACjB,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,EAClC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GACnC,IAAI;IAkBP;;;;;;OAMG;IACH,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,YAAY,EAAE;IAoBhE;;;;;;wBAMoB;IACpB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAQtD;;;;;;sFAMkF;IAClF,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAenE;;;;;qDAKiD;IACjD,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAepE,OAAO,CAAC,mBAAmB;IAS3B;;;;;;OAMG;IACH,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,EACxB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAAE,GACzF,IAAI;IAQP;;;;OAIG;IACH,kBAAkB,IAAI,kBAAkB,EAAE;IAI1C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAM/D;;qFAEiF;IACjF,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE;IAUzC,QAAQ,IAAI,MAAM,EAAE;IAIpB;mEAC+D;IAC/D,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE;IAIxC;;;gCAG4B;IAC5B,oBAAoB,IAAI,MAAM,EAAE;IAIhC;wEACoE;IACpE,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIhD;;;;;;;;iDAQ6C;IAC7C,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS;IAqB9D;;;;;gEAK4D;IAC5D,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;IAiB7D,qFAAqF;IACrF,QAAQ,IAAI,eAAe;CAG5B"}
+{"version":3,"file":"analysis-registry.d.ts","sourceRoot":"","sources":["../src/analysis-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAAqC,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAEhG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGlD;;wDAEwD;AACxD,MAAM,WAAW,YAAY;IAC3B;0CACsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;;8EAG0E;IAC1E,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;GAIG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IAEpE,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI;IAIjD,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAIpE;;+EAE2E;IAC3E,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IAI9E,wFAAwF;IACxF,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAIzD,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI7C;;;;;;;OAOG;IACH,mBAAmB,CACjB,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,EAClC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GACnC,IAAI;IAkBP;;;;;;OAMG;IACH,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,YAAY,EAAE;IAoBhE;;;;;;wBAMoB;IACpB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAQtD;;;;;;sFAMkF;IAClF,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAenE;;;;;qDAKiD;IACjD,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAepE,OAAO,CAAC,mBAAmB;IAS3B;;;;;;OAMG;IACH,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,EACxB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAAE,GACzF,IAAI;IAQP;;;;OAIG;IACH,kBAAkB,IAAI,kBAAkB,EAAE;IAI1C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAM/D;;qFAEiF;IACjF,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE;IAUzC,QAAQ,IAAI,MAAM,EAAE;IAIpB;mEAC+D;IAC/D,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE;IAIxC;;;gCAG4B;IAC5B,oBAAoB,IAAI,MAAM,EAAE;IAIhC;wEACoE;IACpE,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIhD;;;;;;;;iDAQ6C;IAC7C,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS;IAqB9D;;;;;gEAK4D;IAC5D,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;IAiB7D,qFAAqF;IACrF,QAAQ,IAAI,eAAe;CAG5B"}

package/dist/analysis-registry.js

@@ -20,9 +20,16 @@ export class AnalysisRegistry {
     registerModuleIdentity(namespace, name) {
         this.defs.registerModuleIdentity(namespace, name);
     }
+    /** `kinds` is the target's `exports.kinds` gate — only listed kinds resolve, and an
+     *  empty list exports nothing. Omit it only for a target declaring no `exports.kinds`
+     *  (the legacy permissive default); see `AliasResolver.registerImport`. */
     registerImport(alias, target, kinds) {
         this.aliases.registerImport(alias, target, kinds);
     }
+    /** An alias crossing no import boundary, never gated — `Self`, the `Telo` built-ins. */
+    registerUngatedAlias(alias, target) {
+        this.aliases.registerUngatedAlias(alias, target);
+    }
     resolveKind(kind) {
         return this.aliases.resolveKind(kind);
     }

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAoB9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAuxB/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAgzBvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAmBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAoB9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAuxB/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAm1BvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAmBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -735,15 +735,14 @@ export class StaticAnalyzer {
                 // Lets same-library `extends:` work (e.g. `extends: Self.Encoder` for a
                 // concrete kind whose abstract lives in the same Telo.Library) without
                 // requiring a self-import (which would loop the loader). Resolves
-                // through the same alias machinery as user-declared Telo.Imports —
-                // honours the library's `exports.kinds` list, no special cases.
+                // through the same alias machinery as user-declared Telo.Imports.
                 if (moduleName) {
                     // `Self` resolves the library's own kinds UNGATED — a library may reference
                     // its own kinds regardless of `exports.kinds`, which gates importers, not
                     // internal use. This is what lets a library declare an instance of a kind it
                     // does not export (e.g. console's `writeLine`) to enforce a singleton.
                     if (rootModules.has(moduleName)) {
-                        aliases.registerImport("Self", moduleName, []);
+                        aliases.registerUngatedAlias("Self", moduleName);
                     }
                     else {
                         let libResolver = aliasesByModule.get(moduleName);
@@ -751,14 +750,19 @@ export class StaticAnalyzer {
                             libResolver = new AliasResolver();
                             aliasesByModule.set(moduleName, libResolver);
                         }
-                        libResolver.registerImport("Self", moduleName, []);
+                        libResolver.registerUngatedAlias("Self", moduleName);
                     }
                 }
             }
             if (m.kind === "Telo.Import") {
                 const alias = m.metadata.name;
                 const source = m.source;
-                const exportedKinds = m.exports?.kinds ?? [];
+                // The target's `exports.kinds` gate, stamped onto this import by
+                // `stampExportedKinds` (the `Telo.Import` doc has no `exports` field of its own —
+                // the target `Telo.Library` doc it comes from is dropped for non-root modules).
+                // Undefined means the target declares no gate, i.e. unrestricted.
+                const exportedKinds = m.metadata
+                    ?.exportedKinds;
                 const resolvedModuleName = m.metadata.resolvedModuleName;
                 const resolvedNamespace = m.metadata.resolvedNamespace;
                 const ownModule = m.metadata?.module;
@@ -833,7 +837,7 @@ export class StaticAnalyzer {
                 aliasesByModule.set(ownModule, libResolver);
             }
             if (!libResolver.hasAlias("Self")) {
-                libResolver.registerImport("Self", ownModule, []);
+                libResolver.registerUngatedAlias("Self", ownModule);
             }
         }
         // Register definitions from Telo.Definition AND Telo.Abstract resources.
@@ -1042,7 +1046,35 @@ export class StaticAnalyzer {
             // reference-resolution paths: own-module scope first, root/consumer aliases last.
             const ownModule = m.metadata?.module;
             const scopeResolver = scopeResolverForModule(ownModule, rootModules, aliasesByModule);
-            const resolvedKind = scopeResolver?.resolveKind(m.kind) ?? aliases.resolveKind(m.kind);
+            // Either scope resolving it wins; otherwise a gate rejection is more specific than
+            // "unknown alias", so surface that.
+            const scoped = scopeResolver?.resolveKindResult(m.kind);
+            const rooted = aliases.resolveKindResult(m.kind);
+            const kindResult = scoped?.status === "ok"
+                ? scoped
+                : rooted.status === "ok"
+                    ? rooted
+                    : scoped?.status === "gated"
+                        ? scoped
+                        : rooted;
+            // The gate is checked BEFORE any definition lookup. `defs` is keyed
+            // `<metadata.module>.<Kind>`, so a library whose `metadata.name` equals the alias it
+            // is imported under (e.g. module `Foo` imported as `Foo`) makes the raw `defs.resolve(m.kind)`
+            // below hit directly — which would accept a kind the module does not export, leaving
+            // the analyzer more permissive than the kernel.
+            if (kindResult.status === "gated") {
+                diagnostics.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: "KIND_NOT_EXPORTED",
+                    source: SOURCE,
+                    message: `Kind '${m.kind}' is not exported by module '${kindResult.module}'. ` +
+                        `Add '${m.kind.slice(m.kind.indexOf(".") + 1)}' to that module's exports.kinds ` +
+                        `to make it importable. Exported kinds: ${kindResult.exported.join(", ") || "(none)"}.`,
+                    data: { resource, filePath, path: "kind" },
+                });
+                continue;
+            }
+            const resolvedKind = kindResult.status === "ok" ? kindResult.kind : undefined;
             const definition = defs.resolve(m.kind) ?? (resolvedKind ? defs.resolve(resolvedKind) : undefined);
             if (!definition) {
                 const suggestedKind = computeSuggestKind(m.kind, aliases, defs);

package/dist/flatten-for-analyzer.d.ts

@@ -82,7 +82,7 @@ export declare function forwardReExportManifests(result: ResourceManifest[], spe
  *  shared by the CLI graph path and the editor's workspace projection. */
 export declare function resolveExportedKinds(modules: ReadonlyArray<{
     module: string;
-    exportsKinds: readonly string[];
+    exportsKinds: readonly string[] | undefined;
 }>, aliasToModule: (module: string, alias: string) => string | undefined): Map<string, Map<string, string>>;
 /** Stamp `metadata.reExportedKinds` (suffix → canonical kind) onto every `Telo.Import` whose
  *  target re-exports kinds, so the analyzer can register the re-export mappings. Only entries
@@ -94,6 +94,25 @@ export declare function stampReExportedKinds(imports: ReadonlyArray<{
     manifest: ResourceManifest;
     targetModule: string;
 }>, exportedKinds: Map<string, Map<string, string>>): void;
+/** Stamp `metadata.exportedKinds` (the target's `exports.kinds` gate as bare suffixes) onto
+ *  every `Telo.Import` whose target declares one, so the analyzer enforces the same gate the
+ *  kernel does. Stamped on `metadata` for the same reason as `reExportedKinds` — the
+ *  `Telo.Import` schema forbids extra top-level fields.
+ *
+ *  The gate comes from the DECLARED entries, parsed exactly as the kernel parses them
+ *  (`parseExportEntry` — `Alias.Kind` yields `Kind`), never from the resolved re-export
+ *  table. That table drops a re-export whose source module declares no `exports.kinds`, so
+ *  deriving the gate from it would reject `exports.kinds: [Cee.Thing]` — a gate the kernel
+ *  honours — as "not exported".
+ *
+ *  A target that declares no `exports.kinds` is absent from `gatedModules` and goes unstamped,
+ *  which the analyzer reads as unrestricted. That is the legacy permissive default, kept so
+ *  already-published module versions stay importable; making kinds private by default means
+ *  stamping every loaded target instead, which breaks those versions (see import-controller). */
+export declare function stampExportedKinds(imports: ReadonlyArray<{
+    manifest: ResourceManifest;
+    targetModule: string;
+}>, declaredKinds: ReadonlyMap<string, readonly string[]>): void;
 /** Project a LoadedModule (owner + partials) to a flat ResourceManifest[]
  *  with `metadata.module` stamped on non-module docs. The kernel's runtime
  *  entry load uses this to convert a `Loader.loadModule` result into the

package/dist/flatten-for-analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flatten-for-analyzer.d.ts","sourceRoot":"","sources":["../src/flatten-for-analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAInE;;yEAEyE;AACzE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;4CAI4C;AAC5C,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAGjE;AAED;;;;;;;;;;;;;;;;;;;2CAmB2C;AAC3C,wBAAgB,gCAAgC,CAC9C,eAAe,EAAE,gBAAgB,EAAE,EACnC,MAAM,EAAE,OAAO,GACd,gBAAgB,EAAE,CA6BpB;AAED;;;;;;;;;;;;;;;;;;;6EAmB6E;AAC7E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,gBAAgB,EAAE,CAiDzE;AAED;;uBAEuB;AACvB,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;qEAEqE;AACrE,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,GAC/C,YAAY,EAAE,CAShB;AAED;;;;;;uFAMuF;AACvF,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,gBAAgB,EAAE,EAC1B,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACnE,IAAI,CAgDN;AAED;;;;0EAI0E;AAC1E,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,EAC3E,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACnE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA8BlC;AAED;;;;;4DAK4D;AAC5D,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,CAAC;IAAE,QAAQ,EAAE,gBAAgB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,EAC5E,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC9C,IAAI,CAWN;AAwCD;;;;;6BAK6B;AAC7B,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,YAAY,GAAG,gBAAgB,EAAE,CAEzE"}
+{"version":3,"file":"flatten-for-analyzer.d.ts","sourceRoot":"","sources":["../src/flatten-for-analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAInE;;yEAEyE;AACzE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;4CAI4C;AAC5C,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAGjE;AAED;;;;;;;;;;;;;;;;;;;2CAmB2C;AAC3C,wBAAgB,gCAAgC,CAC9C,eAAe,EAAE,gBAAgB,EAAE,EACnC,MAAM,EAAE,OAAO,GACd,gBAAgB,EAAE,CA6BpB;AAED;;;;;;;;;;;;;;;;;;;6EAmB6E;AAC7E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,gBAAgB,EAAE,CAiDzE;AAED;;uBAEuB;AACvB,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;qEAEqE;AACrE,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,GAC/C,YAAY,EAAE,CAShB;AAED;;;;;;uFAMuF;AACvF,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,gBAAgB,EAAE,EAC1B,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACnE,IAAI,CAgDN;AAED;;;;0EAI0E;AAC1E,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;CAAE,CAAC,EACvF,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACnE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA2ClC;AAED;;;;;4DAK4D;AAC5D,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,CAAC;IAAE,QAAQ,EAAE,gBAAgB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,EAC5E,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC9C,IAAI,CAWN;AAED;;;;;;;;;;;;;;iGAciG;AACjG,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,aAAa,CAAC;IAAE,QAAQ,EAAE,gBAAgB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,EAC5E,aAAa,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,GACpD,IAAI,CAMN;AAgDD;;;;;6BAK6B;AAC7B,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,YAAY,GAAG,gBAAgB,EAAE,CAEzE"}

package/dist/flatten-for-analyzer.js

@@ -205,6 +205,10 @@ export function forwardReExportManifests(result, specs, aliasToModule) {
  *  shared by the CLI graph path and the editor's workspace projection. */
 export function resolveExportedKinds(modules, aliasToModule) {
     const out = new Map();
+    // Modules declaring NO `exports.kinds` export every kind they define (the legacy permissive
+    // default), so they have no table to look a re-exported suffix up in. `[]` is a real gate
+    // that exports nothing — the two must stay distinguishable here.
+    const ungated = new Set(modules.filter((m) => m.exportsKinds === undefined).map((m) => m.module));
     const tableFor = (m) => {
         let t = out.get(m);
         if (!t)
@@ -215,7 +219,7 @@ export function resolveExportedKinds(modules, aliasToModule) {
         let changed = false;
         for (const { module, exportsKinds } of modules) {
             const table = tableFor(module);
-            for (const entry of exportsKinds) {
+            for (const entry of exportsKinds ?? []) {
                 const { name: suffix, alias } = parseExportEntry(entry);
                 if (table.has(suffix))
                     continue;
@@ -225,7 +229,14 @@ export function resolveExportedKinds(modules, aliasToModule) {
                     continue;
                 }
                 const source = aliasToModule(module, alias);
-                const canonical = source ? out.get(source)?.get(suffix) : undefined;
+                // Re-exporting FROM an ungated module resolves straight to it: the kernel derives
+                // the gate from the raw entry list and allows this, so dropping it here would make
+                // the analyzer reject a manifest the runtime accepts — the exact shape the migration
+                // path relies on (a gated wrapper over an already-published, ungated module).
+                const canonical = source
+                    ? (out.get(source)?.get(suffix) ??
+                        (ungated.has(source) ? `${source}.${suffix}` : undefined))
+                    : undefined;
                 if (canonical) {
                     table.set(suffix, canonical);
                     changed = true;
@@ -258,11 +269,38 @@ export function stampReExportedKinds(imports, exportedKinds) {
         manifest.metadata.reExportedKinds = reExported;
     }
 }
+/** Stamp `metadata.exportedKinds` (the target's `exports.kinds` gate as bare suffixes) onto
+ *  every `Telo.Import` whose target declares one, so the analyzer enforces the same gate the
+ *  kernel does. Stamped on `metadata` for the same reason as `reExportedKinds` — the
+ *  `Telo.Import` schema forbids extra top-level fields.
+ *
+ *  The gate comes from the DECLARED entries, parsed exactly as the kernel parses them
+ *  (`parseExportEntry` — `Alias.Kind` yields `Kind`), never from the resolved re-export
+ *  table. That table drops a re-export whose source module declares no `exports.kinds`, so
+ *  deriving the gate from it would reject `exports.kinds: [Cee.Thing]` — a gate the kernel
+ *  honours — as "not exported".
+ *
+ *  A target that declares no `exports.kinds` is absent from `gatedModules` and goes unstamped,
+ *  which the analyzer reads as unrestricted. That is the legacy permissive default, kept so
+ *  already-published module versions stay importable; making kinds private by default means
+ *  stamping every loaded target instead, which breaks those versions (see import-controller). */
+export function stampExportedKinds(imports, declaredKinds) {
+    for (const { manifest, targetModule } of imports) {
+        const declared = declaredKinds.get(targetModule);
+        if (!declared)
+            continue;
+        manifest.metadata.exportedKinds = [...declared];
+    }
+}
 /** CLI/kernel adapter: collect re-export specs + alias map from a LoadedGraph. */
 function forwardReExports(graph, result) {
     const ownerSourceOf = new Map();
     const specs = [];
     const kindModules = [];
+    // Modules that DECLARE `exports.kinds` → the gate, as bare suffixes parsed the same way
+    // the kernel parses them. A module that declares none is absent, leaving importers ungated
+    // (see stampExportedKinds).
+    const declaredKinds = new Map();
     for (const [source, mod] of graph.modules) {
         if (source === graph.rootSource)
             continue; // root is an Application — no exports
@@ -272,7 +310,10 @@ function forwardReExports(graph, result) {
             continue;
         ownerSourceOf.set(moduleName, mod.owner.source);
         specs.push(...reExportSpecsFromExports(moduleName, libDoc.exports?.resources));
-        kindModules.push({ module: moduleName, exportsKinds: libDoc.exports?.kinds ?? [] });
+        kindModules.push({ module: moduleName, exportsKinds: libDoc.exports?.kinds });
+        if (libDoc.exports?.kinds !== undefined) {
+            declaredKinds.set(moduleName, libDoc.exports.kinds.map((e) => parseExportEntry(e).name));
+        }
     }
     const aliasToModule = (module, alias) => {
         const ownerSource = ownerSourceOf.get(module);
@@ -295,6 +336,7 @@ function forwardReExports(graph, result) {
             imports.push({ manifest: m, targetModule: target });
     }
     stampReExportedKinds(imports, exportedKinds);
+    stampExportedKinds(imports, declaredKinds);
 }
 /** Project a LoadedModule (owner + partials) to a flat ResourceManifest[]
  *  with `metadata.module` stamped on non-module docs. The kernel's runtime

package/dist/index.d.ts

@@ -2,7 +2,7 @@ export { AnalysisRegistry } from "./analysis-registry.js";
 export type { RefFieldInfo } from "./analysis-registry.js";
 export { StaticAnalyzer } from "./analyzer.js";
 export type { GraphLoadError, ImportEdge, LoadedFile, LoadedGraph, LoadedModule, ParseError, } from "./loaded-types.js";
-export { flattenForAnalyzer, flattenLoadedModule, forwardReExportManifests, parseExportEntry, reExportSpecsFromExports, resolveExportedKinds, selectModuleManifestsForAnalysis, stampReExportedKinds, type ParsedExportEntry, type ReExportSpec, } from "./flatten-for-analyzer.js";
+export { flattenForAnalyzer, flattenLoadedModule, forwardReExportManifests, parseExportEntry, reExportSpecsFromExports, resolveExportedKinds, selectModuleManifestsForAnalysis, stampExportedKinds, stampReExportedKinds, type ParsedExportEntry, type ReExportSpec, } from "./flatten-for-analyzer.js";
 export { buildEvalPaths, evalPathCovers } from "./eval-paths.js";
 export { ancestorChain, controllerBearingAncestor, effectiveAuthorSchema, hasOwnControllerOrTemplate, inheritedCapability, isInheritedDelegation, resolveParent, } from "./extends-resolution.js";
 export type { DefResolver } from "./extends-resolution.js";
@@ -30,7 +30,7 @@ export { parseModuleRef, isRegistryRef } from "./sources/module-ref.js";
 export type { ParsedModuleRef } from "./sources/module-ref.js";
 export { OCI_SCHEME, isOciRef, parseOciRef } from "./sources/oci-ref.js";
 export type { ParsedOciRef } from "./sources/oci-ref.js";
-export { MANIFEST_CACHE_BASE_URL, ManifestCacheSource, manifestCacheKey, manifestCacheUrl, ociManifestCacheCoords, } from "./sources/manifest-cache.js";
+export { MANIFEST_CACHE_BASE_URL, ManifestCacheSource, isHttpsModuleRef, manifestCacheKey, manifestCacheUrl, ociManifestCacheCoords, urlManifestCacheCoords, } from "./sources/manifest-cache.js";
 export type { ManifestCacheCoords } from "./sources/manifest-cache.js";
 export { withSyntheticPositions } from "./with-synthetic-positions.js";
 export { DEFAULT_MANIFEST_FILENAME, DiagnosticSeverity } from "./types.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,qBAAqB,EACrB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC5F,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,aAAa,EACb,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,qBAAqB,EACrB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC5F,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,aAAa,EACb,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,6 +1,6 @@
 export { AnalysisRegistry } from "./analysis-registry.js";
 export { StaticAnalyzer } from "./analyzer.js";
-export { flattenForAnalyzer, flattenLoadedModule, forwardReExportManifests, parseExportEntry, reExportSpecsFromExports, resolveExportedKinds, selectModuleManifestsForAnalysis, stampReExportedKinds, } from "./flatten-for-analyzer.js";
+export { flattenForAnalyzer, flattenLoadedModule, forwardReExportManifests, parseExportEntry, reExportSpecsFromExports, resolveExportedKinds, selectModuleManifestsForAnalysis, stampExportedKinds, stampReExportedKinds, } from "./flatten-for-analyzer.js";
 export { buildEvalPaths, evalPathCovers } from "./eval-paths.js";
 export { ancestorChain, controllerBearingAncestor, effectiveAuthorSchema, hasOwnControllerOrTemplate, inheritedCapability, isInheritedDelegation, resolveParent, } from "./extends-resolution.js";
 export { buildReferenceFieldMap, isRefEntry, isScopeEntry } from "./reference-field-map.js";
@@ -18,6 +18,6 @@ export { defaultSources } from "./sources/default-sources.js";
 export { splitIntegrity, foldIntegrity, verifyIntegrity, verifiedFetch, sha256Base64Url, IntegrityError, } from "./sources/integrity.js";
 export { parseModuleRef, isRegistryRef } from "./sources/module-ref.js";
 export { OCI_SCHEME, isOciRef, parseOciRef } from "./sources/oci-ref.js";
-export { MANIFEST_CACHE_BASE_URL, ManifestCacheSource, manifestCacheKey, manifestCacheUrl, ociManifestCacheCoords, } from "./sources/manifest-cache.js";
+export { MANIFEST_CACHE_BASE_URL, ManifestCacheSource, isHttpsModuleRef, manifestCacheKey, manifestCacheUrl, ociManifestCacheCoords, urlManifestCacheCoords, } from "./sources/manifest-cache.js";
 export { withSyntheticPositions } from "./with-synthetic-positions.js";
 export { DEFAULT_MANIFEST_FILENAME, DiagnosticSeverity } from "./types.js";

package/dist/sources/manifest-cache.d.ts

@@ -23,6 +23,21 @@ export declare function manifestCacheKey(coords: ManifestCacheCoords): string |
  *  not addressable — the cache is keyed by the human version tag the tracker
  *  enumerated). The inline `#sha256-…` fragment is tolerated and ignored. */
 export declare function ociManifestCacheCoords(ref: string): ManifestCacheCoords | null;
+/** True for a direct `https://` module manifest ref. Plaintext `http://` is
+ *  deliberately excluded — the hub serves cached third-party manifests onward,
+ *  so it never ingests over an unauthenticated channel. */
+export declare function isHttpsModuleRef(ref: string): boolean;
+/** Cache coordinates for a direct `https://host/path/telo.yaml` ref.
+ *
+ *  Unlike OCI, a URL carries no version — a URL addresses one file whose
+ *  version lives *inside* it (`metadata.version`) — so the caller passes the
+ *  version it read from the manifest. Returns `null` for a non-https ref, a
+ *  URL that carries a query or userinfo (both would let two distinct URLs
+ *  collide onto one key, or smuggle a host), or an unparseable URL.
+ *
+ *  A trailing `telo.yaml` segment is dropped: the key appends the manifest
+ *  filename itself, so carrying it in `path` would duplicate it. */
+export declare function urlManifestCacheCoords(ref: string, version: string): ManifestCacheCoords | null;
 /** Full cache URL for a ref or coordinates, or `null` when not addressable. */
 export declare function manifestCacheUrl(refOrCoords: string | ManifestCacheCoords, baseUrl?: string): string | null;
 /** Resolves `oci://` module refs against the hub's static manifest cache with a

package/dist/sources/manifest-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest-cache.d.ts","sourceRoot":"","sources":["../../src/sources/manifest-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAKlD;;iFAEiF;AACjF,eAAO,MAAM,uBAAuB,8BAA8B,CAAC;AAEnE;;;;+BAI+B;AAC/B,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAOD;;kEAEkE;AAClE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI,CAO3E;AAED;;;6EAG6E;AAC7E,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAY9E;AAID,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,GAAG,mBAAmB,EACzC,OAAO,GAAE,MAAgC,GACxC,MAAM,GAAG,IAAI,CAKf;AAED;;;;;+DAK+D;AAC/D,qBAAa,mBAAoB,YAAW,cAAc;IAC5C,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,GAAE,MAAgC;IAEtE,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAQxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAalE;;;iEAG6D;IAC7D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;CAOxD"}
+{"version":3,"file":"manifest-cache.d.ts","sourceRoot":"","sources":["../../src/sources/manifest-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAKlD;;iFAEiF;AACjF,eAAO,MAAM,uBAAuB,8BAA8B,CAAC;AAEnE;;;;+BAI+B;AAC/B,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAOD;;kEAEkE;AAClE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI,CAO3E;AAED;;;6EAG6E;AAC7E,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAY9E;AAID;;2DAE2D;AAC3D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;;;;;oEASoE;AACpE,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAuB/F;AAED,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,GAAG,mBAAmB,EACzC,OAAO,GAAE,MAAgC,GACxC,MAAM,GAAG,IAAI,CAKf;AAED;;;;;+DAK+D;AAC/D,qBAAa,mBAAoB,YAAW,cAAc;IAC5C,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,GAAE,MAAgC;IAEtE,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAQxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAalE;;;iEAG6D;IAC7D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;CAOxD"}

package/dist/sources/manifest-cache.js

@@ -40,6 +40,49 @@ export function ociManifestCacheCoords(ref) {
         return null;
     return { transport: "oci", host: parsed.host, path: parsed.repo, version: parsed.reference };
 }
+/** True for a direct `https://` module manifest ref. Plaintext `http://` is
+ *  deliberately excluded — the hub serves cached third-party manifests onward,
+ *  so it never ingests over an unauthenticated channel. */
+export function isHttpsModuleRef(ref) {
+    return splitIntegrity(ref).base.startsWith("https://");
+}
+/** Cache coordinates for a direct `https://host/path/telo.yaml` ref.
+ *
+ *  Unlike OCI, a URL carries no version — a URL addresses one file whose
+ *  version lives *inside* it (`metadata.version`) — so the caller passes the
+ *  version it read from the manifest. Returns `null` for a non-https ref, a
+ *  URL that carries a query or userinfo (both would let two distinct URLs
+ *  collide onto one key, or smuggle a host), or an unparseable URL.
+ *
+ *  A trailing `telo.yaml` segment is dropped: the key appends the manifest
+ *  filename itself, so carrying it in `path` would duplicate it. */
+export function urlManifestCacheCoords(ref, version) {
+    const { base } = splitIntegrity(ref);
+    if (!isHttpsModuleRef(base))
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(base);
+    }
+    catch {
+        return null;
+    }
+    // `username`/`password` would mean the authority is not what it looks like
+    // (`https://evil.com@internal/…`); a query would make the key ambiguous.
+    if (parsed.search !== "" || parsed.username !== "" || parsed.password !== "")
+        return null;
+    const segments = parsed.pathname.split("/").filter((s) => s !== "");
+    if (segments[segments.length - 1] === DEFAULT_MANIFEST_FILENAME)
+        segments.pop();
+    if (segments.length === 0 || parsed.hostname === "")
+        return null;
+    return {
+        transport: "url",
+        host: parsed.host,
+        path: segments.map((s) => decodeURIComponent(s)).join("/"),
+        version,
+    };
+}
 /** Full cache URL for a ref or coordinates, or `null` when not addressable. */
 export function manifestCacheUrl(refOrCoords, baseUrl = MANIFEST_CACHE_BASE_URL) {
     const coords = typeof refOrCoords === "string" ? ociManifestCacheCoords(refOrCoords) : refOrCoords;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.35.0",
+  "version": "0.37.0",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",
@@ -48,7 +48,7 @@
     "@types/node": "^20.0.0",
     "typescript": "^5.0.0",
     "vitest": "^2.1.8",
-    "@telorun/sdk": "0.44.0"
+    "@telorun/sdk": "0.47.0"
   },
   "peerDependencies": {
     "@telorun/sdk": "*"

package/src/alias-resolver.ts

@@ -8,13 +8,25 @@ export class AliasResolver {
    *  import's own module. Resolved before the normal `<module>.<suffix>` construction. */
   private readonly reExportedKinds = new Map<string, string>();
 
-  registerImport(alias: string, targetModule: string, exportedKinds: string[]): void {
+  /** Register an import alias gated to the target's `exports.kinds`. Only listed kinds
+   *  resolve; an empty list exports nothing. `exportedKinds` is `undefined` for exactly one
+   *  case — the target declares no `exports.kinds` at all (the legacy permissive default,
+   *  kept so already-published module versions stay importable), which is the site to delete
+   *  when kinds go private. For an alias crossing no import boundary use
+   *  `registerUngatedAlias`. Mirrors `ModuleContext.registerImport`. */
+  registerImport(alias: string, targetModule: string, exportedKinds?: readonly string[]): void {
     this.importAliases.set(alias, targetModule);
-    if (exportedKinds.length > 0) {
+    if (exportedKinds !== undefined) {
       this.importedKinds.set(alias, new Set(exportedKinds));
     }
   }
 
+  /** Register an alias that crosses no import boundary and is therefore never gated —
+   *  `Self`, a library resolving its own kinds. See `ModuleContext.registerUngatedAlias`. */
+  registerUngatedAlias(alias: string, targetModule: string): void {
+    this.importAliases.set(alias, targetModule);
+  }
+
   /** Register that `<alias>.<suffix>` re-exports the kind canonically named `canonicalKind`
    *  (owned by a module the alias's target imports, possibly several hops away). */
   registerKindReExport(alias: string, suffix: string, canonicalKind: string): void {
@@ -30,24 +42,45 @@ export class AliasResolver {
     return this.importAliases.get(alias);
   }
 
-  /** Resolves "Http.Api" → "http-server.Api". Returns undefined if alias is unknown. */
-  resolveKind(kind: string): string | undefined {
-    if (!kind) {
-      return undefined;
-    }
+  /** Resolve an alias-qualified kind, reporting WHY it failed. One parse, one gate check —
+   *  callers that need the reason and callers that only need the name share this, so they
+   *  cannot drift on dot-splitting, re-export precedence, or gate order.
+   *
+   *  - `ok`      — resolved to a canonical `<module>.<Kind>`.
+   *  - `gated`   — the alias is known and the target owns the name, but its `exports.kinds`
+   *                does not list it. A distinct outcome so callers can say "not exported"
+   *                instead of the misleading "no such kind".
+   *  - `unknown` — unqualified kind, or an alias this scope never imported. */
+  resolveKindResult(
+    kind: string,
+  ):
+    | { status: "ok"; kind: string }
+    | { status: "gated"; module: string; exported: string[] }
+    | { status: "unknown" } {
+    if (!kind) return { status: "unknown" };
     const dot = kind.indexOf(".");
-    if (dot === -1) return undefined;
+    if (dot === -1) return { status: "unknown" };
     const prefix = kind.slice(0, dot);
     const suffix = kind.slice(dot + 1);
     // Re-export takes precedence: a re-exported kind resolves to its true owning module,
-    // not `${prefix-target}.${suffix}` (and bypasses the gate — it's explicitly re-exported).
+    // not `${prefix-target}.${suffix}`. It is listed in the re-exporting library's own
+    // `exports.kinds` (that is how it got here), so this is not a gate bypass.
     const reExported = this.reExportedKinds.get(`${prefix}.${suffix}`);
-    if (reExported) return reExported;
+    if (reExported) return { status: "ok", kind: reExported };
     const realModule = this.importAliases.get(prefix);
-    if (!realModule) return undefined;
+    if (!realModule) return { status: "unknown" };
     const allowed = this.importedKinds.get(prefix);
-    if (allowed !== undefined && !allowed.has(suffix)) return undefined;
-    return `${realModule}.${suffix}`;
+    if (allowed !== undefined && !allowed.has(suffix)) {
+      return { status: "gated", module: realModule, exported: [...allowed] };
+    }
+    return { status: "ok", kind: `${realModule}.${suffix}` };
+  }
+
+  /** Resolves "Http.Api" → "http-server.Api". Undefined if the alias is unknown OR the kind
+   *  is gated out — use `resolveKindResult` when the difference matters. */
+  resolveKind(kind: string): string | undefined {
+    const r = this.resolveKindResult(kind);
+    return r.status === "ok" ? r.kind : undefined;
   }
 
   hasAlias(alias: string): boolean {

package/src/analysis-registry.ts

@@ -44,10 +44,18 @@ export class AnalysisRegistry {
     this.defs.registerModuleIdentity(namespace, name);
   }
 
-  registerImport(alias: string, target: string, kinds: string[]): void {
+  /** `kinds` is the target's `exports.kinds` gate — only listed kinds resolve, and an
+   *  empty list exports nothing. Omit it only for a target declaring no `exports.kinds`
+   *  (the legacy permissive default); see `AliasResolver.registerImport`. */
+  registerImport(alias: string, target: string, kinds?: readonly string[]): void {
     this.aliases.registerImport(alias, target, kinds);
   }
 
+  /** An alias crossing no import boundary, never gated — `Self`, the `Telo` built-ins. */
+  registerUngatedAlias(alias: string, target: string): void {
+    this.aliases.registerUngatedAlias(alias, target);
+  }
+
   resolveKind(kind: string): string | undefined {
     return this.aliases.resolveKind(kind);
   }

package/src/analyzer.ts

@@ -896,29 +896,33 @@ export class StaticAnalyzer {
         // Lets same-library `extends:` work (e.g. `extends: Self.Encoder` for a
         // concrete kind whose abstract lives in the same Telo.Library) without
         // requiring a self-import (which would loop the loader). Resolves
-        // through the same alias machinery as user-declared Telo.Imports —
-        // honours the library's `exports.kinds` list, no special cases.
+        // through the same alias machinery as user-declared Telo.Imports.
         if (moduleName) {
           // `Self` resolves the library's own kinds UNGATED — a library may reference
           // its own kinds regardless of `exports.kinds`, which gates importers, not
           // internal use. This is what lets a library declare an instance of a kind it
           // does not export (e.g. console's `writeLine`) to enforce a singleton.
           if (rootModules.has(moduleName)) {
-            aliases.registerImport("Self", moduleName, []);
+            aliases.registerUngatedAlias("Self", moduleName);
           } else {
             let libResolver = aliasesByModule.get(moduleName);
             if (!libResolver) {
               libResolver = new AliasResolver();
               aliasesByModule.set(moduleName, libResolver);
             }
-            libResolver.registerImport("Self", moduleName, []);
+            libResolver.registerUngatedAlias("Self", moduleName);
           }
         }
       }
       if (m.kind === "Telo.Import") {
         const alias = m.metadata.name as string;
         const source = (m as any).source as string | undefined;
-        const exportedKinds: string[] = (m as any).exports?.kinds ?? [];
+        // The target's `exports.kinds` gate, stamped onto this import by
+        // `stampExportedKinds` (the `Telo.Import` doc has no `exports` field of its own —
+        // the target `Telo.Library` doc it comes from is dropped for non-root modules).
+        // Undefined means the target declares no gate, i.e. unrestricted.
+        const exportedKinds = (m.metadata as { exportedKinds?: string[] } | undefined)
+          ?.exportedKinds;
         const resolvedModuleName = (m.metadata as any).resolvedModuleName as string | undefined;
         const resolvedNamespace = (m.metadata as any).resolvedNamespace as
           | string
@@ -1001,7 +1005,7 @@ export class StaticAnalyzer {
         aliasesByModule.set(ownModule, libResolver);
       }
       if (!libResolver.hasAlias("Self")) {
-        libResolver.registerImport("Self", ownModule, []);
+        libResolver.registerUngatedAlias("Self", ownModule);
       }
     }
 
@@ -1227,7 +1231,38 @@ export class StaticAnalyzer {
       // reference-resolution paths: own-module scope first, root/consumer aliases last.
       const ownModule = (m.metadata as { module?: string } | undefined)?.module;
       const scopeResolver = scopeResolverForModule(ownModule, rootModules, aliasesByModule);
-      const resolvedKind = scopeResolver?.resolveKind(m.kind) ?? aliases.resolveKind(m.kind);
+      // Either scope resolving it wins; otherwise a gate rejection is more specific than
+      // "unknown alias", so surface that.
+      const scoped = scopeResolver?.resolveKindResult(m.kind);
+      const rooted = aliases.resolveKindResult(m.kind);
+      const kindResult =
+        scoped?.status === "ok"
+          ? scoped
+          : rooted.status === "ok"
+            ? rooted
+            : scoped?.status === "gated"
+              ? scoped
+              : rooted;
+
+      // The gate is checked BEFORE any definition lookup. `defs` is keyed
+      // `<metadata.module>.<Kind>`, so a library whose `metadata.name` equals the alias it
+      // is imported under (e.g. module `Foo` imported as `Foo`) makes the raw `defs.resolve(m.kind)`
+      // below hit directly — which would accept a kind the module does not export, leaving
+      // the analyzer more permissive than the kernel.
+      if (kindResult.status === "gated") {
+        diagnostics.push({
+          severity: DiagnosticSeverity.Error,
+          code: "KIND_NOT_EXPORTED",
+          source: SOURCE,
+          message:
+            `Kind '${m.kind}' is not exported by module '${kindResult.module}'. ` +
+            `Add '${m.kind.slice(m.kind.indexOf(".") + 1)}' to that module's exports.kinds ` +
+            `to make it importable. Exported kinds: ${kindResult.exported.join(", ") || "(none)"}.`,
+          data: { resource, filePath, path: "kind" },
+        });
+        continue;
+      }
+      const resolvedKind = kindResult.status === "ok" ? kindResult.kind : undefined;
       const definition =
         defs.resolve(m.kind) ?? (resolvedKind ? defs.resolve(resolvedKind) : undefined);
       if (!definition) {

package/src/flatten-for-analyzer.ts

@@ -239,10 +239,16 @@ export function forwardReExportManifests(
  *  maps one of that module's import aliases to the imported module's name. Graph-agnostic —
  *  shared by the CLI graph path and the editor's workspace projection. */
 export function resolveExportedKinds(
-  modules: ReadonlyArray<{ module: string; exportsKinds: readonly string[] }>,
+  modules: ReadonlyArray<{ module: string; exportsKinds: readonly string[] | undefined }>,
   aliasToModule: (module: string, alias: string) => string | undefined,
 ): Map<string, Map<string, string>> {
   const out = new Map<string, Map<string, string>>();
+  // Modules declaring NO `exports.kinds` export every kind they define (the legacy permissive
+  // default), so they have no table to look a re-exported suffix up in. `[]` is a real gate
+  // that exports nothing — the two must stay distinguishable here.
+  const ungated = new Set(
+    modules.filter((m) => m.exportsKinds === undefined).map((m) => m.module),
+  );
   const tableFor = (m: string): Map<string, string> => {
     let t = out.get(m);
     if (!t) out.set(m, (t = new Map()));
@@ -252,7 +258,7 @@ export function resolveExportedKinds(
     let changed = false;
     for (const { module, exportsKinds } of modules) {
       const table = tableFor(module);
-      for (const entry of exportsKinds) {
+      for (const entry of exportsKinds ?? []) {
         const { name: suffix, alias } = parseExportEntry(entry);
         if (table.has(suffix)) continue;
         if (!alias) {
@@ -261,7 +267,14 @@ export function resolveExportedKinds(
           continue;
         }
         const source = aliasToModule(module, alias);
-        const canonical = source ? out.get(source)?.get(suffix) : undefined;
+        // Re-exporting FROM an ungated module resolves straight to it: the kernel derives
+        // the gate from the raw entry list and allows this, so dropping it here would make
+        // the analyzer reject a manifest the runtime accepts — the exact shape the migration
+        // path relies on (a gated wrapper over an already-published, ungated module).
+        const canonical = source
+          ? (out.get(source)?.get(suffix) ??
+            (ungated.has(source) ? `${source}.${suffix}` : undefined))
+          : undefined;
         if (canonical) {
           table.set(suffix, canonical);
           changed = true;
@@ -295,11 +308,41 @@ export function stampReExportedKinds(
   }
 }
 
+/** Stamp `metadata.exportedKinds` (the target's `exports.kinds` gate as bare suffixes) onto
+ *  every `Telo.Import` whose target declares one, so the analyzer enforces the same gate the
+ *  kernel does. Stamped on `metadata` for the same reason as `reExportedKinds` — the
+ *  `Telo.Import` schema forbids extra top-level fields.
+ *
+ *  The gate comes from the DECLARED entries, parsed exactly as the kernel parses them
+ *  (`parseExportEntry` — `Alias.Kind` yields `Kind`), never from the resolved re-export
+ *  table. That table drops a re-export whose source module declares no `exports.kinds`, so
+ *  deriving the gate from it would reject `exports.kinds: [Cee.Thing]` — a gate the kernel
+ *  honours — as "not exported".
+ *
+ *  A target that declares no `exports.kinds` is absent from `gatedModules` and goes unstamped,
+ *  which the analyzer reads as unrestricted. That is the legacy permissive default, kept so
+ *  already-published module versions stay importable; making kinds private by default means
+ *  stamping every loaded target instead, which breaks those versions (see import-controller). */
+export function stampExportedKinds(
+  imports: ReadonlyArray<{ manifest: ResourceManifest; targetModule: string }>,
+  declaredKinds: ReadonlyMap<string, readonly string[]>,
+): void {
+  for (const { manifest, targetModule } of imports) {
+    const declared = declaredKinds.get(targetModule);
+    if (!declared) continue;
+    (manifest.metadata as Record<string, unknown>).exportedKinds = [...declared];
+  }
+}
+
 /** CLI/kernel adapter: collect re-export specs + alias map from a LoadedGraph. */
 function forwardReExports(graph: LoadedGraph, result: ResourceManifest[]): void {
   const ownerSourceOf = new Map<string, string>();
   const specs: ReExportSpec[] = [];
-  const kindModules: Array<{ module: string; exportsKinds: string[] }> = [];
+  const kindModules: Array<{ module: string; exportsKinds: string[] | undefined }> = [];
+  // Modules that DECLARE `exports.kinds` → the gate, as bare suffixes parsed the same way
+  // the kernel parses them. A module that declares none is absent, leaving importers ungated
+  // (see stampExportedKinds).
+  const declaredKinds = new Map<string, readonly string[]>();
   for (const [source, mod] of graph.modules) {
     if (source === graph.rootSource) continue; // root is an Application — no exports
     const libDoc = mod.owner.manifests.find((m) => m && isModuleKind(m.kind)) as
@@ -309,7 +352,10 @@ function forwardReExports(graph: LoadedGraph, result: ResourceManifest[]): void
     if (!libDoc || !moduleName) continue;
     ownerSourceOf.set(moduleName, mod.owner.source);
     specs.push(...reExportSpecsFromExports(moduleName, libDoc.exports?.resources));
-    kindModules.push({ module: moduleName, exportsKinds: libDoc.exports?.kinds ?? [] });
+    kindModules.push({ module: moduleName, exportsKinds: libDoc.exports?.kinds });
+    if (libDoc.exports?.kinds !== undefined) {
+      declaredKinds.set(moduleName, libDoc.exports.kinds.map((e) => parseExportEntry(e).name));
+    }
   }
   const aliasToModule = (module: string, alias: string): string | undefined => {
     const ownerSource = ownerSourceOf.get(module);
@@ -331,6 +377,7 @@ function forwardReExports(graph: LoadedGraph, result: ResourceManifest[]): void
     if (target) imports.push({ manifest: m, targetModule: target });
   }
   stampReExportedKinds(imports, exportedKinds);
+  stampExportedKinds(imports, declaredKinds);
 }
 
 /** Project a LoadedModule (owner + partials) to a flat ResourceManifest[]

package/src/index.ts

@@ -17,6 +17,7 @@ export {
     reExportSpecsFromExports,
     resolveExportedKinds,
     selectModuleManifestsForAnalysis,
+    stampExportedKinds,
     stampReExportedKinds,
     type ParsedExportEntry,
     type ReExportSpec,
@@ -80,9 +81,11 @@ export type { ParsedOciRef } from "./sources/oci-ref.js";
 export {
   MANIFEST_CACHE_BASE_URL,
   ManifestCacheSource,
+  isHttpsModuleRef,
   manifestCacheKey,
   manifestCacheUrl,
   ociManifestCacheCoords,
+  urlManifestCacheCoords,
 } from "./sources/manifest-cache.js";
 export type { ManifestCacheCoords } from "./sources/manifest-cache.js";
 export { withSyntheticPositions } from "./with-synthetic-positions.js";

package/src/sources/manifest-cache.ts

@@ -57,6 +57,48 @@ export function ociManifestCacheCoords(ref: string): ManifestCacheCoords | null
 
 type ParsedOciRefShape = ReturnType<typeof parseOciRef>;
 
+/** True for a direct `https://` module manifest ref. Plaintext `http://` is
+ *  deliberately excluded — the hub serves cached third-party manifests onward,
+ *  so it never ingests over an unauthenticated channel. */
+export function isHttpsModuleRef(ref: string): boolean {
+  return splitIntegrity(ref).base.startsWith("https://");
+}
+
+/** Cache coordinates for a direct `https://host/path/telo.yaml` ref.
+ *
+ *  Unlike OCI, a URL carries no version — a URL addresses one file whose
+ *  version lives *inside* it (`metadata.version`) — so the caller passes the
+ *  version it read from the manifest. Returns `null` for a non-https ref, a
+ *  URL that carries a query or userinfo (both would let two distinct URLs
+ *  collide onto one key, or smuggle a host), or an unparseable URL.
+ *
+ *  A trailing `telo.yaml` segment is dropped: the key appends the manifest
+ *  filename itself, so carrying it in `path` would duplicate it. */
+export function urlManifestCacheCoords(ref: string, version: string): ManifestCacheCoords | null {
+  const { base } = splitIntegrity(ref);
+  if (!isHttpsModuleRef(base)) return null;
+  let parsed: URL;
+  try {
+    parsed = new URL(base);
+  } catch {
+    return null;
+  }
+  // `username`/`password` would mean the authority is not what it looks like
+  // (`https://evil.com@internal/…`); a query would make the key ambiguous.
+  if (parsed.search !== "" || parsed.username !== "" || parsed.password !== "") return null;
+
+  const segments = parsed.pathname.split("/").filter((s) => s !== "");
+  if (segments[segments.length - 1] === DEFAULT_MANIFEST_FILENAME) segments.pop();
+  if (segments.length === 0 || parsed.hostname === "") return null;
+
+  return {
+    transport: "url",
+    host: parsed.host,
+    path: segments.map((s) => decodeURIComponent(s)).join("/"),
+    version,
+  };
+}
+
 /** Full cache URL for a ref or coordinates, or `null` when not addressable. */
 export function manifestCacheUrl(
   refOrCoords: string | ManifestCacheCoords,