@telorun/analyzer 0.36.0 → 0.38.0

package/dist/alias-resolver.d.ts

@@ -7,7 +7,16 @@ export declare class AliasResolver {
      *  transitively RE-EXPORTS (`exports.kinds: [Alias.Kind]`), which don't live in the
      *  import's own module. Resolved before the normal `<module>.<suffix>` construction. */
     private readonly reExportedKinds;
-    registerImport(alias: string, targetModule: string, exportedKinds: string[]): void;
+    /** Register an import alias gated to the target's `exports.kinds`. Only listed kinds
+     *  resolve; an empty list exports nothing. `exportedKinds` is `undefined` for exactly one
+     *  case — the target declares no `exports.kinds` at all (the legacy permissive default,
+     *  kept so already-published module versions stay importable), which is the site to delete
+     *  when kinds go private. For an alias crossing no import boundary use
+     *  `registerUngatedAlias`. Mirrors `ModuleContext.registerImport`. */
+    registerImport(alias: string, targetModule: string, exportedKinds?: readonly string[]): void;
+    /** Register an alias that crosses no import boundary and is therefore never gated —
+     *  `Self`, a library resolving its own kinds. See `ModuleContext.registerUngatedAlias`. */
+    registerUngatedAlias(alias: string, targetModule: string): void;
     /** Register that `<alias>.<suffix>` re-exports the kind canonically named `canonicalKind`
      *  (owned by a module the alias's target imports, possibly several hops away). */
     registerKindReExport(alias: string, suffix: string, canonicalKind: string): void;
@@ -17,7 +26,27 @@ export declare class AliasResolver {
      *  upstream by `flattenForAnalyzer` (only exported instances are forwarded), so a name
      *  that isn't exported simply won't be found. */
     moduleForAlias(alias: string): string | undefined;
-    /** Resolves "Http.Api" → "http-server.Api". Returns undefined if alias is unknown. */
+    /** Resolve an alias-qualified kind, reporting WHY it failed. One parse, one gate check —
+     *  callers that need the reason and callers that only need the name share this, so they
+     *  cannot drift on dot-splitting, re-export precedence, or gate order.
+     *
+     *  - `ok`      — resolved to a canonical `<module>.<Kind>`.
+     *  - `gated`   — the alias is known and the target owns the name, but its `exports.kinds`
+     *                does not list it. A distinct outcome so callers can say "not exported"
+     *                instead of the misleading "no such kind".
+     *  - `unknown` — unqualified kind, or an alias this scope never imported. */
+    resolveKindResult(kind: string): {
+        status: "ok";
+        kind: string;
+    } | {
+        status: "gated";
+        module: string;
+        exported: string[];
+    } | {
+        status: "unknown";
+    };
+    /** Resolves "Http.Api" → "http-server.Api". Undefined if the alias is unknown OR the kind
+     *  is gated out — use `resolveKindResult` when the difference matters. */
     resolveKind(kind: string): string | undefined;
     hasAlias(alias: string): boolean;
     knownAliases(): string[];

package/dist/alias-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"alias-resolver.d.ts","sourceRoot":"","sources":["../src/alias-resolver.ts"],"names":[],"mappings":"AAAA;gFACgF;AAChF,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6B;IAC3D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAkC;IAChE;;4FAEwF;IACxF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6B;IAE7D,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI;IAOlF;sFACkF;IAClF,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI;IAIhF;;;;qDAIiD;IACjD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIjD,sFAAsF;IACtF,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAmB7C,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIhC,YAAY,IAAI,MAAM,EAAE;IAIxB;;qEAEiE;IACjE,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE;CAO3C;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EACxB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC1C,aAAa,GAAG,SAAS,CAI3B"}
+{"version":3,"file":"alias-resolver.d.ts","sourceRoot":"","sources":["../src/alias-resolver.ts"],"names":[],"mappings":"AAAA;gFACgF;AAChF,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6B;IAC3D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAkC;IAChE;;4FAEwF;IACxF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6B;IAE7D;;;;;0EAKsE;IACtE,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IAO5F;+FAC2F;IAC3F,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IAI/D;sFACkF;IAClF,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI;IAIhF;;;;qDAIiD;IACjD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIjD;;;;;;;;iFAQ6E;IAC7E,iBAAiB,CACf,IAAI,EAAE,MAAM,GAEV;QAAE,MAAM,EAAE,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAC9B;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,GACvD;QAAE,MAAM,EAAE,SAAS,CAAA;KAAE;IAoBzB;8EAC0E;IAC1E,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAK7C,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIhC,YAAY,IAAI,MAAM,EAAE;IAIxB;;qEAEiE;IACjE,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE;CAO3C;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EACxB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC1C,aAAa,GAAG,SAAS,CAI3B"}

package/dist/alias-resolver.js

@@ -7,12 +7,23 @@ export class AliasResolver {
      *  transitively RE-EXPORTS (`exports.kinds: [Alias.Kind]`), which don't live in the
      *  import's own module. Resolved before the normal `<module>.<suffix>` construction. */
     reExportedKinds = new Map();
+    /** Register an import alias gated to the target's `exports.kinds`. Only listed kinds
+     *  resolve; an empty list exports nothing. `exportedKinds` is `undefined` for exactly one
+     *  case — the target declares no `exports.kinds` at all (the legacy permissive default,
+     *  kept so already-published module versions stay importable), which is the site to delete
+     *  when kinds go private. For an alias crossing no import boundary use
+     *  `registerUngatedAlias`. Mirrors `ModuleContext.registerImport`. */
     registerImport(alias, targetModule, exportedKinds) {
         this.importAliases.set(alias, targetModule);
-        if (exportedKinds.length > 0) {
+        if (exportedKinds !== undefined) {
             this.importedKinds.set(alias, new Set(exportedKinds));
         }
     }
+    /** Register an alias that crosses no import boundary and is therefore never gated —
+     *  `Self`, a library resolving its own kinds. See `ModuleContext.registerUngatedAlias`. */
+    registerUngatedAlias(alias, targetModule) {
+        this.importAliases.set(alias, targetModule);
+    }
     /** Register that `<alias>.<suffix>` re-exports the kind canonically named `canonicalKind`
      *  (owned by a module the alias's target imports, possibly several hops away). */
     registerKindReExport(alias, suffix, canonicalKind) {
@@ -26,28 +37,43 @@ export class AliasResolver {
     moduleForAlias(alias) {
         return this.importAliases.get(alias);
     }
-    /** Resolves "Http.Api" → "http-server.Api". Returns undefined if alias is unknown. */
-    resolveKind(kind) {
-        if (!kind) {
-            return undefined;
-        }
+    /** Resolve an alias-qualified kind, reporting WHY it failed. One parse, one gate check —
+     *  callers that need the reason and callers that only need the name share this, so they
+     *  cannot drift on dot-splitting, re-export precedence, or gate order.
+     *
+     *  - `ok`      — resolved to a canonical `<module>.<Kind>`.
+     *  - `gated`   — the alias is known and the target owns the name, but its `exports.kinds`
+     *                does not list it. A distinct outcome so callers can say "not exported"
+     *                instead of the misleading "no such kind".
+     *  - `unknown` — unqualified kind, or an alias this scope never imported. */
+    resolveKindResult(kind) {
+        if (!kind)
+            return { status: "unknown" };
         const dot = kind.indexOf(".");
         if (dot === -1)
-            return undefined;
+            return { status: "unknown" };
         const prefix = kind.slice(0, dot);
         const suffix = kind.slice(dot + 1);
         // Re-export takes precedence: a re-exported kind resolves to its true owning module,
-        // not `${prefix-target}.${suffix}` (and bypasses the gate — it's explicitly re-exported).
+        // not `${prefix-target}.${suffix}`. It is listed in the re-exporting library's own
+        // `exports.kinds` (that is how it got here), so this is not a gate bypass.
         const reExported = this.reExportedKinds.get(`${prefix}.${suffix}`);
         if (reExported)
-            return reExported;
+            return { status: "ok", kind: reExported };
         const realModule = this.importAliases.get(prefix);
         if (!realModule)
-            return undefined;
+            return { status: "unknown" };
         const allowed = this.importedKinds.get(prefix);
-        if (allowed !== undefined && !allowed.has(suffix))
-            return undefined;
-        return `${realModule}.${suffix}`;
+        if (allowed !== undefined && !allowed.has(suffix)) {
+            return { status: "gated", module: realModule, exported: [...allowed] };
+        }
+        return { status: "ok", kind: `${realModule}.${suffix}` };
+    }
+    /** Resolves "Http.Api" → "http-server.Api". Undefined if the alias is unknown OR the kind
+     *  is gated out — use `resolveKindResult` when the difference matters. */
+    resolveKind(kind) {
+        const r = this.resolveKindResult(kind);
+        return r.status === "ok" ? r.kind : undefined;
     }
     hasAlias(alias) {
         return this.importAliases.has(alias);

package/dist/analysis-registry.d.ts

@@ -29,7 +29,12 @@ export declare class AnalysisRegistry {
     private readonly aliasesByModule;
     registerDefinition(def: ResourceDefinition): void;
     registerModuleIdentity(namespace: string | null, name: string): void;
-    registerImport(alias: string, target: string, kinds: string[]): void;
+    /** `kinds` is the target's `exports.kinds` gate — only listed kinds resolve, and an
+     *  empty list exports nothing. Omit it only for a target declaring no `exports.kinds`
+     *  (the legacy permissive default); see `AliasResolver.registerImport`. */
+    registerImport(alias: string, target: string, kinds?: readonly string[]): void;
+    /** An alias crossing no import boundary, never gated — `Self`, the `Telo` built-ins. */
+    registerUngatedAlias(alias: string, target: string): void;
     resolveKind(kind: string): string | undefined;
     /**
      * Iterates a resource's reference and scope fields as declared by its definition.
@@ -91,6 +96,20 @@ export declare class AnalysisRegistry {
      */
     builtinDefinitions(): ResourceDefinition[];
     resolveDefinition(kind: string): ResourceDefinition | undefined;
+    /** A resolver scoped to `def`'s OWN module, for resolving that definition's
+     *  `extends` target.
+     *
+     *  `extends` aliases are lexically scoped to the declaring library — a library
+     *  writes `extends: Cache.Store` against its own import map, and `Self.Host`
+     *  against its own module name. The global alias table knows neither, so
+     *  {@link resolveDefinition} silently returns undefined for them and callers
+     *  fall back to an un-inherited view. Mirrors the module-scope selection in
+     *  `expandedFieldMapForResource`. */
+    resolverForDefinition(def: {
+        metadata?: {
+            module?: string;
+        };
+    }): (kind: string) => ResourceDefinition | undefined;
     /** Canonical kinds (`module.Name`) of every definition that extends the given
      *  abstract kind — the concrete implementations a caller may instantiate in
      *  its place. Empty when `kind` is not an abstract or has no implementations. */

package/dist/analysis-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analysis-registry.d.ts","sourceRoot":"","sources":["../src/analysis-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAAqC,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAEhG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGlD;;wDAEwD;AACxD,MAAM,WAAW,YAAY;IAC3B;0CACsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;;8EAG0E;IAC1E,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;GAIG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IAEpE,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI;IAIjD,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAIpE,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAIpE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI7C;;;;;;;OAOG;IACH,mBAAmB,CACjB,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,EAClC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GACnC,IAAI;IAkBP;;;;;;OAMG;IACH,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,YAAY,EAAE;IAoBhE;;;;;;wBAMoB;IACpB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAQtD;;;;;;sFAMkF;IAClF,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAenE;;;;;qDAKiD;IACjD,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAepE,OAAO,CAAC,mBAAmB;IAS3B;;;;;;OAMG;IACH,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,EACxB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAAE,GACzF,IAAI;IAQP;;;;OAIG;IACH,kBAAkB,IAAI,kBAAkB,EAAE;IAI1C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAM/D;;qFAEiF;IACjF,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE;IAUzC,QAAQ,IAAI,MAAM,EAAE;IAIpB;mEAC+D;IAC/D,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE;IAIxC;;;gCAG4B;IAC5B,oBAAoB,IAAI,MAAM,EAAE;IAIhC;wEACoE;IACpE,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIhD;;;;;;;;iDAQ6C;IAC7C,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS;IAqB9D;;;;;gEAK4D;IAC5D,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;IAiB7D,qFAAqF;IACrF,QAAQ,IAAI,eAAe;CAG5B"}
+{"version":3,"file":"analysis-registry.d.ts","sourceRoot":"","sources":["../src/analysis-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAAqC,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAEhG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGlD;;wDAEwD;AACxD,MAAM,WAAW,YAAY;IAC3B;0CACsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;;8EAG0E;IAC1E,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;GAIG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IAEpE,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI;IAIjD,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAIpE;;+EAE2E;IAC3E,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IAI9E,wFAAwF;IACxF,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAIzD,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI7C;;;;;;;OAOG;IACH,mBAAmB,CACjB,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,EAClC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GACnC,IAAI;IAkBP;;;;;;OAMG;IACH,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,YAAY,EAAE;IAoBhE;;;;;;wBAMoB;IACpB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAQtD;;;;;;sFAMkF;IAClF,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAenE;;;;;qDAKiD;IACjD,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAepE,OAAO,CAAC,mBAAmB;IAS3B;;;;;;OAMG;IACH,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,EACxB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAAE,GACzF,IAAI;IAQP;;;;OAIG;IACH,kBAAkB,IAAI,kBAAkB,EAAE;IAI1C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAM/D;;;;;;;;yCAQqC;IACrC,qBAAqB,CAAC,GAAG,EAAE;QACzB,QAAQ,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAChC,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,kBAAkB,GAAG,SAAS;IASpD;;qFAEiF;IACjF,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE;IAUzC,QAAQ,IAAI,MAAM,EAAE;IAIpB;mEAC+D;IAC/D,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE;IAIxC;;;gCAG4B;IAC5B,oBAAoB,IAAI,MAAM,EAAE;IAIhC;wEACoE;IACpE,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIhD;;;;;;;;iDAQ6C;IAC7C,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS;IAqB9D;;;;;gEAK4D;IAC5D,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;IAiB7D,qFAAqF;IACrF,QAAQ,IAAI,eAAe;CAG5B"}

package/dist/analysis-registry.js

@@ -20,9 +20,16 @@ export class AnalysisRegistry {
     registerModuleIdentity(namespace, name) {
         this.defs.registerModuleIdentity(namespace, name);
     }
+    /** `kinds` is the target's `exports.kinds` gate — only listed kinds resolve, and an
+     *  empty list exports nothing. Omit it only for a target declaring no `exports.kinds`
+     *  (the legacy permissive default); see `AliasResolver.registerImport`. */
     registerImport(alias, target, kinds) {
         this.aliases.registerImport(alias, target, kinds);
     }
+    /** An alias crossing no import boundary, never gated — `Self`, the `Telo` built-ins. */
+    registerUngatedAlias(alias, target) {
+        this.aliases.registerUngatedAlias(alias, target);
+    }
     resolveKind(kind) {
         return this.aliases.resolveKind(kind);
     }
@@ -171,6 +178,23 @@ export class AnalysisRegistry {
         const resolved = ctx.aliases?.resolveKind(kind);
         return ctx.definitions?.resolve(kind) ?? (resolved ? ctx.definitions?.resolve(resolved) : undefined);
     }
+    /** A resolver scoped to `def`'s OWN module, for resolving that definition's
+     *  `extends` target.
+     *
+     *  `extends` aliases are lexically scoped to the declaring library — a library
+     *  writes `extends: Cache.Store` against its own import map, and `Self.Host`
+     *  against its own module name. The global alias table knows neither, so
+     *  {@link resolveDefinition} silently returns undefined for them and callers
+     *  fall back to an un-inherited view. Mirrors the module-scope selection in
+     *  `expandedFieldMapForResource`. */
+    resolverForDefinition(def) {
+        const ownModule = def?.metadata?.module;
+        const scope = (ownModule ? this.aliasesByModule.get(ownModule) : undefined) ?? this.aliases;
+        return (kind) => {
+            const canonical = scope.resolveKind(kind);
+            return this.defs.resolve(kind) ?? (canonical ? this.defs.resolve(canonical) : undefined);
+        };
+    }
     /** Canonical kinds (`module.Name`) of every definition that extends the given
      *  abstract kind — the concrete implementations a caller may instantiate in
      *  its place. Empty when `kind` is not an abstract or has no implementations. */

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAoB9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAuxB/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAgzBvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAmBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAoB9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAuxB/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAm1BvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAmBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -735,15 +735,14 @@ export class StaticAnalyzer {
                 // Lets same-library `extends:` work (e.g. `extends: Self.Encoder` for a
                 // concrete kind whose abstract lives in the same Telo.Library) without
                 // requiring a self-import (which would loop the loader). Resolves
-                // through the same alias machinery as user-declared Telo.Imports —
-                // honours the library's `exports.kinds` list, no special cases.
+                // through the same alias machinery as user-declared Telo.Imports.
                 if (moduleName) {
                     // `Self` resolves the library's own kinds UNGATED — a library may reference
                     // its own kinds regardless of `exports.kinds`, which gates importers, not
                     // internal use. This is what lets a library declare an instance of a kind it
                     // does not export (e.g. console's `writeLine`) to enforce a singleton.
                     if (rootModules.has(moduleName)) {
-                        aliases.registerImport("Self", moduleName, []);
+                        aliases.registerUngatedAlias("Self", moduleName);
                     }
                     else {
                         let libResolver = aliasesByModule.get(moduleName);
@@ -751,14 +750,19 @@ export class StaticAnalyzer {
                             libResolver = new AliasResolver();
                             aliasesByModule.set(moduleName, libResolver);
                         }
-                        libResolver.registerImport("Self", moduleName, []);
+                        libResolver.registerUngatedAlias("Self", moduleName);
                     }
                 }
             }
             if (m.kind === "Telo.Import") {
                 const alias = m.metadata.name;
                 const source = m.source;
-                const exportedKinds = m.exports?.kinds ?? [];
+                // The target's `exports.kinds` gate, stamped onto this import by
+                // `stampExportedKinds` (the `Telo.Import` doc has no `exports` field of its own —
+                // the target `Telo.Library` doc it comes from is dropped for non-root modules).
+                // Undefined means the target declares no gate, i.e. unrestricted.
+                const exportedKinds = m.metadata
+                    ?.exportedKinds;
                 const resolvedModuleName = m.metadata.resolvedModuleName;
                 const resolvedNamespace = m.metadata.resolvedNamespace;
                 const ownModule = m.metadata?.module;
@@ -833,7 +837,7 @@ export class StaticAnalyzer {
                 aliasesByModule.set(ownModule, libResolver);
             }
             if (!libResolver.hasAlias("Self")) {
-                libResolver.registerImport("Self", ownModule, []);
+                libResolver.registerUngatedAlias("Self", ownModule);
             }
         }
         // Register definitions from Telo.Definition AND Telo.Abstract resources.
@@ -1042,7 +1046,35 @@ export class StaticAnalyzer {
             // reference-resolution paths: own-module scope first, root/consumer aliases last.
             const ownModule = m.metadata?.module;
             const scopeResolver = scopeResolverForModule(ownModule, rootModules, aliasesByModule);
-            const resolvedKind = scopeResolver?.resolveKind(m.kind) ?? aliases.resolveKind(m.kind);
+            // Either scope resolving it wins; otherwise a gate rejection is more specific than
+            // "unknown alias", so surface that.
+            const scoped = scopeResolver?.resolveKindResult(m.kind);
+            const rooted = aliases.resolveKindResult(m.kind);
+            const kindResult = scoped?.status === "ok"
+                ? scoped
+                : rooted.status === "ok"
+                    ? rooted
+                    : scoped?.status === "gated"
+                        ? scoped
+                        : rooted;
+            // The gate is checked BEFORE any definition lookup. `defs` is keyed
+            // `<metadata.module>.<Kind>`, so a library whose `metadata.name` equals the alias it
+            // is imported under (e.g. module `Foo` imported as `Foo`) makes the raw `defs.resolve(m.kind)`
+            // below hit directly — which would accept a kind the module does not export, leaving
+            // the analyzer more permissive than the kernel.
+            if (kindResult.status === "gated") {
+                diagnostics.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: "KIND_NOT_EXPORTED",
+                    source: SOURCE,
+                    message: `Kind '${m.kind}' is not exported by module '${kindResult.module}'. ` +
+                        `Add '${m.kind.slice(m.kind.indexOf(".") + 1)}' to that module's exports.kinds ` +
+                        `to make it importable. Exported kinds: ${kindResult.exported.join(", ") || "(none)"}.`,
+                    data: { resource, filePath, path: "kind" },
+                });
+                continue;
+            }
+            const resolvedKind = kindResult.status === "ok" ? kindResult.kind : undefined;
             const definition = defs.resolve(m.kind) ?? (resolvedKind ? defs.resolve(resolvedKind) : undefined);
             if (!definition) {
                 const suggestedKind = computeSuggestKind(m.kind, aliases, defs);

package/dist/builtins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EAujB/C,CAAC"}
+{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAwBvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EAyjB/C,CAAC"}

package/dist/builtins.js

@@ -1,3 +1,24 @@
+/** Descriptive provenance a module declares about itself, shared by
+ *  `Telo.Application` and `Telo.Library`.
+ *
+ *  These are *descriptive*, never *addressing* — nothing resolves, fetches,
+ *  caches, or publishes based on them, so they do not conflict with
+ *  identity-is-the-ref (which bans metadata from determining an artifact's
+ *  location). `repository` is the location of the module's **source code**, in
+ *  the same spirit as npm's `repository` / `license` / `homepage`. It is named
+ *  `repository` rather than `source` because `source:` already means "where to
+ *  fetch a dependency from" in the `imports` map.
+ *
+ *  A publish transport projects these into whatever its backend surfaces —
+ *  OCI maps them onto the standard `org.opencontainers.image.*` annotations;
+ *  the HTTP registry stores the manifest verbatim, so they are preserved as
+ *  declared with nothing to translate. */
+const PROVENANCE_METADATA = {
+    description: { type: "string" },
+    repository: { type: "string" },
+    license: { type: "string" },
+    documentation: { type: "string" },
+};
 export const KERNEL_BUILTINS = [
     { kind: "Telo.Abstract", metadata: { name: "Template", module: "Telo" } },
     { kind: "Telo.Abstract", metadata: { name: "Runnable", module: "Telo" } },
@@ -269,6 +290,7 @@ export const KERNEL_BUILTINS = [
                         version: { type: "string" },
                         source: { type: "string" },
                         module: { type: "string" },
+                        ...PROVENANCE_METADATA,
                     },
                     required: ["name"],
                     additionalProperties: true,
@@ -495,6 +517,7 @@ export const KERNEL_BUILTINS = [
                         version: { type: "string" },
                         source: { type: "string" },
                         module: { type: "string" },
+                        ...PROVENANCE_METADATA,
                     },
                     required: ["name"],
                     additionalProperties: true,

package/dist/flatten-for-analyzer.d.ts

@@ -82,7 +82,7 @@ export declare function forwardReExportManifests(result: ResourceManifest[], spe
  *  shared by the CLI graph path and the editor's workspace projection. */
 export declare function resolveExportedKinds(modules: ReadonlyArray<{
     module: string;
-    exportsKinds: readonly string[];
+    exportsKinds: readonly string[] | undefined;
 }>, aliasToModule: (module: string, alias: string) => string | undefined): Map<string, Map<string, string>>;
 /** Stamp `metadata.reExportedKinds` (suffix → canonical kind) onto every `Telo.Import` whose
  *  target re-exports kinds, so the analyzer can register the re-export mappings. Only entries
@@ -94,6 +94,25 @@ export declare function stampReExportedKinds(imports: ReadonlyArray<{
     manifest: ResourceManifest;
     targetModule: string;
 }>, exportedKinds: Map<string, Map<string, string>>): void;
+/** Stamp `metadata.exportedKinds` (the target's `exports.kinds` gate as bare suffixes) onto
+ *  every `Telo.Import` whose target declares one, so the analyzer enforces the same gate the
+ *  kernel does. Stamped on `metadata` for the same reason as `reExportedKinds` — the
+ *  `Telo.Import` schema forbids extra top-level fields.
+ *
+ *  The gate comes from the DECLARED entries, parsed exactly as the kernel parses them
+ *  (`parseExportEntry` — `Alias.Kind` yields `Kind`), never from the resolved re-export
+ *  table. That table drops a re-export whose source module declares no `exports.kinds`, so
+ *  deriving the gate from it would reject `exports.kinds: [Cee.Thing]` — a gate the kernel
+ *  honours — as "not exported".
+ *
+ *  A target that declares no `exports.kinds` is absent from `gatedModules` and goes unstamped,
+ *  which the analyzer reads as unrestricted. That is the legacy permissive default, kept so
+ *  already-published module versions stay importable; making kinds private by default means
+ *  stamping every loaded target instead, which breaks those versions (see import-controller). */
+export declare function stampExportedKinds(imports: ReadonlyArray<{
+    manifest: ResourceManifest;
+    targetModule: string;
+}>, declaredKinds: ReadonlyMap<string, readonly string[]>): void;
 /** Project a LoadedModule (owner + partials) to a flat ResourceManifest[]
  *  with `metadata.module` stamped on non-module docs. The kernel's runtime
  *  entry load uses this to convert a `Loader.loadModule` result into the

package/dist/flatten-for-analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flatten-for-analyzer.d.ts","sourceRoot":"","sources":["../src/flatten-for-analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAInE;;yEAEyE;AACzE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;4CAI4C;AAC5C,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAGjE;AAED;;;;;;;;;;;;;;;;;;;2CAmB2C;AAC3C,wBAAgB,gCAAgC,CAC9C,eAAe,EAAE,gBAAgB,EAAE,EACnC,MAAM,EAAE,OAAO,GACd,gBAAgB,EAAE,CA6BpB;AAED;;;;;;;;;;;;;;;;;;;6EAmB6E;AAC7E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,gBAAgB,EAAE,CAiDzE;AAED;;uBAEuB;AACvB,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;qEAEqE;AACrE,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,GAC/C,YAAY,EAAE,CAShB;AAED;;;;;;uFAMuF;AACvF,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,gBAAgB,EAAE,EAC1B,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACnE,IAAI,CAgDN;AAED;;;;0EAI0E;AAC1E,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,EAC3E,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACnE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA8BlC;AAED;;;;;4DAK4D;AAC5D,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,CAAC;IAAE,QAAQ,EAAE,gBAAgB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,EAC5E,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC9C,IAAI,CAWN;AAwCD;;;;;6BAK6B;AAC7B,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,YAAY,GAAG,gBAAgB,EAAE,CAEzE"}
+{"version":3,"file":"flatten-for-analyzer.d.ts","sourceRoot":"","sources":["../src/flatten-for-analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAInE;;yEAEyE;AACzE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;4CAI4C;AAC5C,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAGjE;AAED;;;;;;;;;;;;;;;;;;;2CAmB2C;AAC3C,wBAAgB,gCAAgC,CAC9C,eAAe,EAAE,gBAAgB,EAAE,EACnC,MAAM,EAAE,OAAO,GACd,gBAAgB,EAAE,CA6BpB;AAED;;;;;;;;;;;;;;;;;;;6EAmB6E;AAC7E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,gBAAgB,EAAE,CAiDzE;AAED;;uBAEuB;AACvB,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;qEAEqE;AACrE,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,GAC/C,YAAY,EAAE,CAShB;AAED;;;;;;uFAMuF;AACvF,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,gBAAgB,EAAE,EAC1B,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACnE,IAAI,CAgDN;AAED;;;;0EAI0E;AAC1E,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;CAAE,CAAC,EACvF,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACnE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA2ClC;AAED;;;;;4DAK4D;AAC5D,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,CAAC;IAAE,QAAQ,EAAE,gBAAgB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,EAC5E,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC9C,IAAI,CAWN;AAED;;;;;;;;;;;;;;iGAciG;AACjG,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,aAAa,CAAC;IAAE,QAAQ,EAAE,gBAAgB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,EAC5E,aAAa,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,GACpD,IAAI,CAMN;AAgDD;;;;;6BAK6B;AAC7B,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,YAAY,GAAG,gBAAgB,EAAE,CAEzE"}

package/dist/flatten-for-analyzer.js

@@ -205,6 +205,10 @@ export function forwardReExportManifests(result, specs, aliasToModule) {
  *  shared by the CLI graph path and the editor's workspace projection. */
 export function resolveExportedKinds(modules, aliasToModule) {
     const out = new Map();
+    // Modules declaring NO `exports.kinds` export every kind they define (the legacy permissive
+    // default), so they have no table to look a re-exported suffix up in. `[]` is a real gate
+    // that exports nothing — the two must stay distinguishable here.
+    const ungated = new Set(modules.filter((m) => m.exportsKinds === undefined).map((m) => m.module));
     const tableFor = (m) => {
         let t = out.get(m);
         if (!t)
@@ -215,7 +219,7 @@ export function resolveExportedKinds(modules, aliasToModule) {
         let changed = false;
         for (const { module, exportsKinds } of modules) {
             const table = tableFor(module);
-            for (const entry of exportsKinds) {
+            for (const entry of exportsKinds ?? []) {
                 const { name: suffix, alias } = parseExportEntry(entry);
                 if (table.has(suffix))
                     continue;
@@ -225,7 +229,14 @@ export function resolveExportedKinds(modules, aliasToModule) {
                     continue;
                 }
                 const source = aliasToModule(module, alias);
-                const canonical = source ? out.get(source)?.get(suffix) : undefined;
+                // Re-exporting FROM an ungated module resolves straight to it: the kernel derives
+                // the gate from the raw entry list and allows this, so dropping it here would make
+                // the analyzer reject a manifest the runtime accepts — the exact shape the migration
+                // path relies on (a gated wrapper over an already-published, ungated module).
+                const canonical = source
+                    ? (out.get(source)?.get(suffix) ??
+                        (ungated.has(source) ? `${source}.${suffix}` : undefined))
+                    : undefined;
                 if (canonical) {
                     table.set(suffix, canonical);
                     changed = true;
@@ -258,11 +269,38 @@ export function stampReExportedKinds(imports, exportedKinds) {
         manifest.metadata.reExportedKinds = reExported;
     }
 }
+/** Stamp `metadata.exportedKinds` (the target's `exports.kinds` gate as bare suffixes) onto
+ *  every `Telo.Import` whose target declares one, so the analyzer enforces the same gate the
+ *  kernel does. Stamped on `metadata` for the same reason as `reExportedKinds` — the
+ *  `Telo.Import` schema forbids extra top-level fields.
+ *
+ *  The gate comes from the DECLARED entries, parsed exactly as the kernel parses them
+ *  (`parseExportEntry` — `Alias.Kind` yields `Kind`), never from the resolved re-export
+ *  table. That table drops a re-export whose source module declares no `exports.kinds`, so
+ *  deriving the gate from it would reject `exports.kinds: [Cee.Thing]` — a gate the kernel
+ *  honours — as "not exported".
+ *
+ *  A target that declares no `exports.kinds` is absent from `gatedModules` and goes unstamped,
+ *  which the analyzer reads as unrestricted. That is the legacy permissive default, kept so
+ *  already-published module versions stay importable; making kinds private by default means
+ *  stamping every loaded target instead, which breaks those versions (see import-controller). */
+export function stampExportedKinds(imports, declaredKinds) {
+    for (const { manifest, targetModule } of imports) {
+        const declared = declaredKinds.get(targetModule);
+        if (!declared)
+            continue;
+        manifest.metadata.exportedKinds = [...declared];
+    }
+}
 /** CLI/kernel adapter: collect re-export specs + alias map from a LoadedGraph. */
 function forwardReExports(graph, result) {
     const ownerSourceOf = new Map();
     const specs = [];
     const kindModules = [];
+    // Modules that DECLARE `exports.kinds` → the gate, as bare suffixes parsed the same way
+    // the kernel parses them. A module that declares none is absent, leaving importers ungated
+    // (see stampExportedKinds).
+    const declaredKinds = new Map();
     for (const [source, mod] of graph.modules) {
         if (source === graph.rootSource)
             continue; // root is an Application — no exports
@@ -272,7 +310,10 @@ function forwardReExports(graph, result) {
             continue;
         ownerSourceOf.set(moduleName, mod.owner.source);
         specs.push(...reExportSpecsFromExports(moduleName, libDoc.exports?.resources));
-        kindModules.push({ module: moduleName, exportsKinds: libDoc.exports?.kinds ?? [] });
+        kindModules.push({ module: moduleName, exportsKinds: libDoc.exports?.kinds });
+        if (libDoc.exports?.kinds !== undefined) {
+            declaredKinds.set(moduleName, libDoc.exports.kinds.map((e) => parseExportEntry(e).name));
+        }
     }
     const aliasToModule = (module, alias) => {
         const ownerSource = ownerSourceOf.get(module);
@@ -295,6 +336,7 @@ function forwardReExports(graph, result) {
             imports.push({ manifest: m, targetModule: target });
     }
     stampReExportedKinds(imports, exportedKinds);
+    stampExportedKinds(imports, declaredKinds);
 }
 /** Project a LoadedModule (owner + partials) to a flat ResourceManifest[]
  *  with `metadata.module` stamped on non-module docs. The kernel's runtime

package/dist/index.d.ts

@@ -2,7 +2,7 @@ export { AnalysisRegistry } from "./analysis-registry.js";
 export type { RefFieldInfo } from "./analysis-registry.js";
 export { StaticAnalyzer } from "./analyzer.js";
 export type { GraphLoadError, ImportEdge, LoadedFile, LoadedGraph, LoadedModule, ParseError, } from "./loaded-types.js";
-export { flattenForAnalyzer, flattenLoadedModule, forwardReExportManifests, parseExportEntry, reExportSpecsFromExports, resolveExportedKinds, selectModuleManifestsForAnalysis, stampReExportedKinds, type ParsedExportEntry, type ReExportSpec, } from "./flatten-for-analyzer.js";
+export { flattenForAnalyzer, flattenLoadedModule, forwardReExportManifests, parseExportEntry, reExportSpecsFromExports, resolveExportedKinds, selectModuleManifestsForAnalysis, stampExportedKinds, stampReExportedKinds, type ParsedExportEntry, type ReExportSpec, } from "./flatten-for-analyzer.js";
 export { buildEvalPaths, evalPathCovers } from "./eval-paths.js";
 export { ancestorChain, controllerBearingAncestor, effectiveAuthorSchema, hasOwnControllerOrTemplate, inheritedCapability, isInheritedDelegation, resolveParent, } from "./extends-resolution.js";
 export type { DefResolver } from "./extends-resolution.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,qBAAqB,EACrB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC5F,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,aAAa,EACb,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,qBAAqB,EACrB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC5F,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,aAAa,EACb,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,6 +1,6 @@
 export { AnalysisRegistry } from "./analysis-registry.js";
 export { StaticAnalyzer } from "./analyzer.js";
-export { flattenForAnalyzer, flattenLoadedModule, forwardReExportManifests, parseExportEntry, reExportSpecsFromExports, resolveExportedKinds, selectModuleManifestsForAnalysis, stampReExportedKinds, } from "./flatten-for-analyzer.js";
+export { flattenForAnalyzer, flattenLoadedModule, forwardReExportManifests, parseExportEntry, reExportSpecsFromExports, resolveExportedKinds, selectModuleManifestsForAnalysis, stampExportedKinds, stampReExportedKinds, } from "./flatten-for-analyzer.js";
 export { buildEvalPaths, evalPathCovers } from "./eval-paths.js";
 export { ancestorChain, controllerBearingAncestor, effectiveAuthorSchema, hasOwnControllerOrTemplate, inheritedCapability, isInheritedDelegation, resolveParent, } from "./extends-resolution.js";
 export { buildReferenceFieldMap, isRefEntry, isScopeEntry } from "./reference-field-map.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.36.0",
+  "version": "0.38.0",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",
@@ -48,7 +48,7 @@
     "@types/node": "^20.0.0",
     "typescript": "^5.0.0",
     "vitest": "^2.1.8",
-    "@telorun/sdk": "0.44.0"
+    "@telorun/sdk": "0.48.0"
   },
   "peerDependencies": {
     "@telorun/sdk": "*"

package/src/alias-resolver.ts

@@ -8,13 +8,25 @@ export class AliasResolver {
    *  import's own module. Resolved before the normal `<module>.<suffix>` construction. */
   private readonly reExportedKinds = new Map<string, string>();
 
-  registerImport(alias: string, targetModule: string, exportedKinds: string[]): void {
+  /** Register an import alias gated to the target's `exports.kinds`. Only listed kinds
+   *  resolve; an empty list exports nothing. `exportedKinds` is `undefined` for exactly one
+   *  case — the target declares no `exports.kinds` at all (the legacy permissive default,
+   *  kept so already-published module versions stay importable), which is the site to delete
+   *  when kinds go private. For an alias crossing no import boundary use
+   *  `registerUngatedAlias`. Mirrors `ModuleContext.registerImport`. */
+  registerImport(alias: string, targetModule: string, exportedKinds?: readonly string[]): void {
     this.importAliases.set(alias, targetModule);
-    if (exportedKinds.length > 0) {
+    if (exportedKinds !== undefined) {
       this.importedKinds.set(alias, new Set(exportedKinds));
     }
   }
 
+  /** Register an alias that crosses no import boundary and is therefore never gated —
+   *  `Self`, a library resolving its own kinds. See `ModuleContext.registerUngatedAlias`. */
+  registerUngatedAlias(alias: string, targetModule: string): void {
+    this.importAliases.set(alias, targetModule);
+  }
+
   /** Register that `<alias>.<suffix>` re-exports the kind canonically named `canonicalKind`
    *  (owned by a module the alias's target imports, possibly several hops away). */
   registerKindReExport(alias: string, suffix: string, canonicalKind: string): void {
@@ -30,24 +42,45 @@ export class AliasResolver {
     return this.importAliases.get(alias);
   }
 
-  /** Resolves "Http.Api" → "http-server.Api". Returns undefined if alias is unknown. */
-  resolveKind(kind: string): string | undefined {
-    if (!kind) {
-      return undefined;
-    }
+  /** Resolve an alias-qualified kind, reporting WHY it failed. One parse, one gate check —
+   *  callers that need the reason and callers that only need the name share this, so they
+   *  cannot drift on dot-splitting, re-export precedence, or gate order.
+   *
+   *  - `ok`      — resolved to a canonical `<module>.<Kind>`.
+   *  - `gated`   — the alias is known and the target owns the name, but its `exports.kinds`
+   *                does not list it. A distinct outcome so callers can say "not exported"
+   *                instead of the misleading "no such kind".
+   *  - `unknown` — unqualified kind, or an alias this scope never imported. */
+  resolveKindResult(
+    kind: string,
+  ):
+    | { status: "ok"; kind: string }
+    | { status: "gated"; module: string; exported: string[] }
+    | { status: "unknown" } {
+    if (!kind) return { status: "unknown" };
     const dot = kind.indexOf(".");
-    if (dot === -1) return undefined;
+    if (dot === -1) return { status: "unknown" };
     const prefix = kind.slice(0, dot);
     const suffix = kind.slice(dot + 1);
     // Re-export takes precedence: a re-exported kind resolves to its true owning module,
-    // not `${prefix-target}.${suffix}` (and bypasses the gate — it's explicitly re-exported).
+    // not `${prefix-target}.${suffix}`. It is listed in the re-exporting library's own
+    // `exports.kinds` (that is how it got here), so this is not a gate bypass.
     const reExported = this.reExportedKinds.get(`${prefix}.${suffix}`);
-    if (reExported) return reExported;
+    if (reExported) return { status: "ok", kind: reExported };
     const realModule = this.importAliases.get(prefix);
-    if (!realModule) return undefined;
+    if (!realModule) return { status: "unknown" };
     const allowed = this.importedKinds.get(prefix);
-    if (allowed !== undefined && !allowed.has(suffix)) return undefined;
-    return `${realModule}.${suffix}`;
+    if (allowed !== undefined && !allowed.has(suffix)) {
+      return { status: "gated", module: realModule, exported: [...allowed] };
+    }
+    return { status: "ok", kind: `${realModule}.${suffix}` };
+  }
+
+  /** Resolves "Http.Api" → "http-server.Api". Undefined if the alias is unknown OR the kind
+   *  is gated out — use `resolveKindResult` when the difference matters. */
+  resolveKind(kind: string): string | undefined {
+    const r = this.resolveKindResult(kind);
+    return r.status === "ok" ? r.kind : undefined;
   }
 
   hasAlias(alias: string): boolean {

package/src/analysis-registry.ts

@@ -44,10 +44,18 @@ export class AnalysisRegistry {
     this.defs.registerModuleIdentity(namespace, name);
   }
 
-  registerImport(alias: string, target: string, kinds: string[]): void {
+  /** `kinds` is the target's `exports.kinds` gate — only listed kinds resolve, and an
+   *  empty list exports nothing. Omit it only for a target declaring no `exports.kinds`
+   *  (the legacy permissive default); see `AliasResolver.registerImport`. */
+  registerImport(alias: string, target: string, kinds?: readonly string[]): void {
     this.aliases.registerImport(alias, target, kinds);
   }
 
+  /** An alias crossing no import boundary, never gated — `Self`, the `Telo` built-ins. */
+  registerUngatedAlias(alias: string, target: string): void {
+    this.aliases.registerUngatedAlias(alias, target);
+  }
+
   resolveKind(kind: string): string | undefined {
     return this.aliases.resolveKind(kind);
   }
@@ -210,6 +218,26 @@ export class AnalysisRegistry {
     return ctx.definitions?.resolve(kind) ?? (resolved ? ctx.definitions?.resolve(resolved) : undefined);
   }
 
+  /** A resolver scoped to `def`'s OWN module, for resolving that definition's
+   *  `extends` target.
+   *
+   *  `extends` aliases are lexically scoped to the declaring library — a library
+   *  writes `extends: Cache.Store` against its own import map, and `Self.Host`
+   *  against its own module name. The global alias table knows neither, so
+   *  {@link resolveDefinition} silently returns undefined for them and callers
+   *  fall back to an un-inherited view. Mirrors the module-scope selection in
+   *  `expandedFieldMapForResource`. */
+  resolverForDefinition(def: {
+    metadata?: { module?: string };
+  }): (kind: string) => ResourceDefinition | undefined {
+    const ownModule = def?.metadata?.module;
+    const scope = (ownModule ? this.aliasesByModule.get(ownModule) : undefined) ?? this.aliases;
+    return (kind) => {
+      const canonical = scope.resolveKind(kind);
+      return this.defs.resolve(kind) ?? (canonical ? this.defs.resolve(canonical) : undefined);
+    };
+  }
+
   /** Canonical kinds (`module.Name`) of every definition that extends the given
    *  abstract kind — the concrete implementations a caller may instantiate in
    *  its place. Empty when `kind` is not an abstract or has no implementations. */

package/src/analyzer.ts

@@ -896,29 +896,33 @@ export class StaticAnalyzer {
         // Lets same-library `extends:` work (e.g. `extends: Self.Encoder` for a
         // concrete kind whose abstract lives in the same Telo.Library) without
         // requiring a self-import (which would loop the loader). Resolves
-        // through the same alias machinery as user-declared Telo.Imports —
-        // honours the library's `exports.kinds` list, no special cases.
+        // through the same alias machinery as user-declared Telo.Imports.
         if (moduleName) {
           // `Self` resolves the library's own kinds UNGATED — a library may reference
           // its own kinds regardless of `exports.kinds`, which gates importers, not
           // internal use. This is what lets a library declare an instance of a kind it
           // does not export (e.g. console's `writeLine`) to enforce a singleton.
           if (rootModules.has(moduleName)) {
-            aliases.registerImport("Self", moduleName, []);
+            aliases.registerUngatedAlias("Self", moduleName);
           } else {
             let libResolver = aliasesByModule.get(moduleName);
             if (!libResolver) {
               libResolver = new AliasResolver();
               aliasesByModule.set(moduleName, libResolver);
             }
-            libResolver.registerImport("Self", moduleName, []);
+            libResolver.registerUngatedAlias("Self", moduleName);
           }
         }
       }
       if (m.kind === "Telo.Import") {
         const alias = m.metadata.name as string;
         const source = (m as any).source as string | undefined;
-        const exportedKinds: string[] = (m as any).exports?.kinds ?? [];
+        // The target's `exports.kinds` gate, stamped onto this import by
+        // `stampExportedKinds` (the `Telo.Import` doc has no `exports` field of its own —
+        // the target `Telo.Library` doc it comes from is dropped for non-root modules).
+        // Undefined means the target declares no gate, i.e. unrestricted.
+        const exportedKinds = (m.metadata as { exportedKinds?: string[] } | undefined)
+          ?.exportedKinds;
         const resolvedModuleName = (m.metadata as any).resolvedModuleName as string | undefined;
         const resolvedNamespace = (m.metadata as any).resolvedNamespace as
           | string
@@ -1001,7 +1005,7 @@ export class StaticAnalyzer {
         aliasesByModule.set(ownModule, libResolver);
       }
       if (!libResolver.hasAlias("Self")) {
-        libResolver.registerImport("Self", ownModule, []);
+        libResolver.registerUngatedAlias("Self", ownModule);
       }
     }
 
@@ -1227,7 +1231,38 @@ export class StaticAnalyzer {
       // reference-resolution paths: own-module scope first, root/consumer aliases last.
       const ownModule = (m.metadata as { module?: string } | undefined)?.module;
       const scopeResolver = scopeResolverForModule(ownModule, rootModules, aliasesByModule);
-      const resolvedKind = scopeResolver?.resolveKind(m.kind) ?? aliases.resolveKind(m.kind);
+      // Either scope resolving it wins; otherwise a gate rejection is more specific than
+      // "unknown alias", so surface that.
+      const scoped = scopeResolver?.resolveKindResult(m.kind);
+      const rooted = aliases.resolveKindResult(m.kind);
+      const kindResult =
+        scoped?.status === "ok"
+          ? scoped
+          : rooted.status === "ok"
+            ? rooted
+            : scoped?.status === "gated"
+              ? scoped
+              : rooted;
+
+      // The gate is checked BEFORE any definition lookup. `defs` is keyed
+      // `<metadata.module>.<Kind>`, so a library whose `metadata.name` equals the alias it
+      // is imported under (e.g. module `Foo` imported as `Foo`) makes the raw `defs.resolve(m.kind)`
+      // below hit directly — which would accept a kind the module does not export, leaving
+      // the analyzer more permissive than the kernel.
+      if (kindResult.status === "gated") {
+        diagnostics.push({
+          severity: DiagnosticSeverity.Error,
+          code: "KIND_NOT_EXPORTED",
+          source: SOURCE,
+          message:
+            `Kind '${m.kind}' is not exported by module '${kindResult.module}'. ` +
+            `Add '${m.kind.slice(m.kind.indexOf(".") + 1)}' to that module's exports.kinds ` +
+            `to make it importable. Exported kinds: ${kindResult.exported.join(", ") || "(none)"}.`,
+          data: { resource, filePath, path: "kind" },
+        });
+        continue;
+      }
+      const resolvedKind = kindResult.status === "ok" ? kindResult.kind : undefined;
       const definition =
         defs.resolve(m.kind) ?? (resolvedKind ? defs.resolve(resolvedKind) : undefined);
       if (!definition) {

package/src/builtins.ts

@@ -1,5 +1,27 @@
 import type { ResourceDefinition } from "@telorun/sdk";
 
+/** Descriptive provenance a module declares about itself, shared by
+ *  `Telo.Application` and `Telo.Library`.
+ *
+ *  These are *descriptive*, never *addressing* — nothing resolves, fetches,
+ *  caches, or publishes based on them, so they do not conflict with
+ *  identity-is-the-ref (which bans metadata from determining an artifact's
+ *  location). `repository` is the location of the module's **source code**, in
+ *  the same spirit as npm's `repository` / `license` / `homepage`. It is named
+ *  `repository` rather than `source` because `source:` already means "where to
+ *  fetch a dependency from" in the `imports` map.
+ *
+ *  A publish transport projects these into whatever its backend surfaces —
+ *  OCI maps them onto the standard `org.opencontainers.image.*` annotations;
+ *  the HTTP registry stores the manifest verbatim, so they are preserved as
+ *  declared with nothing to translate. */
+const PROVENANCE_METADATA = {
+  description: { type: "string" },
+  repository: { type: "string" },
+  license: { type: "string" },
+  documentation: { type: "string" },
+};
+
 export const KERNEL_BUILTINS: ResourceDefinition[] = [
   { kind: "Telo.Abstract", metadata: { name: "Template", module: "Telo" } },
   { kind: "Telo.Abstract", metadata: { name: "Runnable", module: "Telo" } },
@@ -271,6 +293,7 @@ export const KERNEL_BUILTINS: ResourceDefinition[] = [
             version: { type: "string" },
             source: { type: "string" },
             module: { type: "string" },
+            ...PROVENANCE_METADATA,
           },
           required: ["name"],
           additionalProperties: true,
@@ -497,6 +520,7 @@ export const KERNEL_BUILTINS: ResourceDefinition[] = [
             version: { type: "string" },
             source: { type: "string" },
             module: { type: "string" },
+            ...PROVENANCE_METADATA,
           },
           required: ["name"],
           additionalProperties: true,

package/src/flatten-for-analyzer.ts

@@ -239,10 +239,16 @@ export function forwardReExportManifests(
  *  maps one of that module's import aliases to the imported module's name. Graph-agnostic —
  *  shared by the CLI graph path and the editor's workspace projection. */
 export function resolveExportedKinds(
-  modules: ReadonlyArray<{ module: string; exportsKinds: readonly string[] }>,
+  modules: ReadonlyArray<{ module: string; exportsKinds: readonly string[] | undefined }>,
   aliasToModule: (module: string, alias: string) => string | undefined,
 ): Map<string, Map<string, string>> {
   const out = new Map<string, Map<string, string>>();
+  // Modules declaring NO `exports.kinds` export every kind they define (the legacy permissive
+  // default), so they have no table to look a re-exported suffix up in. `[]` is a real gate
+  // that exports nothing — the two must stay distinguishable here.
+  const ungated = new Set(
+    modules.filter((m) => m.exportsKinds === undefined).map((m) => m.module),
+  );
   const tableFor = (m: string): Map<string, string> => {
     let t = out.get(m);
     if (!t) out.set(m, (t = new Map()));
@@ -252,7 +258,7 @@ export function resolveExportedKinds(
     let changed = false;
     for (const { module, exportsKinds } of modules) {
       const table = tableFor(module);
-      for (const entry of exportsKinds) {
+      for (const entry of exportsKinds ?? []) {
         const { name: suffix, alias } = parseExportEntry(entry);
         if (table.has(suffix)) continue;
         if (!alias) {
@@ -261,7 +267,14 @@ export function resolveExportedKinds(
           continue;
         }
         const source = aliasToModule(module, alias);
-        const canonical = source ? out.get(source)?.get(suffix) : undefined;
+        // Re-exporting FROM an ungated module resolves straight to it: the kernel derives
+        // the gate from the raw entry list and allows this, so dropping it here would make
+        // the analyzer reject a manifest the runtime accepts — the exact shape the migration
+        // path relies on (a gated wrapper over an already-published, ungated module).
+        const canonical = source
+          ? (out.get(source)?.get(suffix) ??
+            (ungated.has(source) ? `${source}.${suffix}` : undefined))
+          : undefined;
         if (canonical) {
           table.set(suffix, canonical);
           changed = true;
@@ -295,11 +308,41 @@ export function stampReExportedKinds(
   }
 }
 
+/** Stamp `metadata.exportedKinds` (the target's `exports.kinds` gate as bare suffixes) onto
+ *  every `Telo.Import` whose target declares one, so the analyzer enforces the same gate the
+ *  kernel does. Stamped on `metadata` for the same reason as `reExportedKinds` — the
+ *  `Telo.Import` schema forbids extra top-level fields.
+ *
+ *  The gate comes from the DECLARED entries, parsed exactly as the kernel parses them
+ *  (`parseExportEntry` — `Alias.Kind` yields `Kind`), never from the resolved re-export
+ *  table. That table drops a re-export whose source module declares no `exports.kinds`, so
+ *  deriving the gate from it would reject `exports.kinds: [Cee.Thing]` — a gate the kernel
+ *  honours — as "not exported".
+ *
+ *  A target that declares no `exports.kinds` is absent from `gatedModules` and goes unstamped,
+ *  which the analyzer reads as unrestricted. That is the legacy permissive default, kept so
+ *  already-published module versions stay importable; making kinds private by default means
+ *  stamping every loaded target instead, which breaks those versions (see import-controller). */
+export function stampExportedKinds(
+  imports: ReadonlyArray<{ manifest: ResourceManifest; targetModule: string }>,
+  declaredKinds: ReadonlyMap<string, readonly string[]>,
+): void {
+  for (const { manifest, targetModule } of imports) {
+    const declared = declaredKinds.get(targetModule);
+    if (!declared) continue;
+    (manifest.metadata as Record<string, unknown>).exportedKinds = [...declared];
+  }
+}
+
 /** CLI/kernel adapter: collect re-export specs + alias map from a LoadedGraph. */
 function forwardReExports(graph: LoadedGraph, result: ResourceManifest[]): void {
   const ownerSourceOf = new Map<string, string>();
   const specs: ReExportSpec[] = [];
-  const kindModules: Array<{ module: string; exportsKinds: string[] }> = [];
+  const kindModules: Array<{ module: string; exportsKinds: string[] | undefined }> = [];
+  // Modules that DECLARE `exports.kinds` → the gate, as bare suffixes parsed the same way
+  // the kernel parses them. A module that declares none is absent, leaving importers ungated
+  // (see stampExportedKinds).
+  const declaredKinds = new Map<string, readonly string[]>();
   for (const [source, mod] of graph.modules) {
     if (source === graph.rootSource) continue; // root is an Application — no exports
     const libDoc = mod.owner.manifests.find((m) => m && isModuleKind(m.kind)) as
@@ -309,7 +352,10 @@ function forwardReExports(graph: LoadedGraph, result: ResourceManifest[]): void
     if (!libDoc || !moduleName) continue;
     ownerSourceOf.set(moduleName, mod.owner.source);
     specs.push(...reExportSpecsFromExports(moduleName, libDoc.exports?.resources));
-    kindModules.push({ module: moduleName, exportsKinds: libDoc.exports?.kinds ?? [] });
+    kindModules.push({ module: moduleName, exportsKinds: libDoc.exports?.kinds });
+    if (libDoc.exports?.kinds !== undefined) {
+      declaredKinds.set(moduleName, libDoc.exports.kinds.map((e) => parseExportEntry(e).name));
+    }
   }
   const aliasToModule = (module: string, alias: string): string | undefined => {
     const ownerSource = ownerSourceOf.get(module);
@@ -331,6 +377,7 @@ function forwardReExports(graph: LoadedGraph, result: ResourceManifest[]): void
     if (target) imports.push({ manifest: m, targetModule: target });
   }
   stampReExportedKinds(imports, exportedKinds);
+  stampExportedKinds(imports, declaredKinds);
 }
 
 /** Project a LoadedModule (owner + partials) to a flat ResourceManifest[]

package/src/index.ts

@@ -17,6 +17,7 @@ export {
     reExportSpecsFromExports,
     resolveExportedKinds,
     selectModuleManifestsForAnalysis,
+    stampExportedKinds,
     stampReExportedKinds,
     type ParsedExportEntry,
     type ReExportSpec,