@telorun/analyzer 0.1.4 → 0.2.1

package/src/analyzer.ts

@@ -1,10 +1,16 @@
 import type { ResourceDefinition, ResourceManifest } from "@telorun/sdk";
+import type { Environment } from "@marcbachmann/cel-js";
 import { AliasResolver } from "./alias-resolver.js";
 import { AnalysisRegistry } from "./analysis-registry.js";
-import { buildTypedCelEnvironment, celEnvironment } from "./cel-environment.js";
+import {
+  buildCelEnvironment,
+  buildTypedCelEnvironment,
+  type CelHandlers,
+} from "./cel-environment.js";
 import { DefinitionRegistry } from "./definition-registry.js";
 import { buildDependencyGraph, formatCycle } from "./dependency-graph.js";
 import { buildKernelGlobalsSchema, mergeKernelGlobalsIntoContext } from "./kernel-globals.js";
+import { isModuleKind } from "./module-kinds.js";
 import { normalizeInlineResources } from "./normalize-inline-resources.js";
 import {
   celTypeSatisfiesJsonSchema,
@@ -22,6 +28,7 @@ import {
   validateChainAgainstSchema,
 } from "./validate-cel-context.js";
 import { validateReferences } from "./validate-references.js";
+import { validateThrowsCoverage } from "./validate-throws-coverage.js";
 
 const TEMPLATE_REGEX = /\$\{\{\s*([^}]+?)\s*\}\}/g;
 
@@ -174,7 +181,8 @@ function collectCelTypeIssues(
   path: string,
   definition: { schema?: Record<string, any> },
   manifest: ResourceManifest,
-  baseEnv: ReturnType<typeof buildTypedCelEnvironment>,
+  baseTypedEnv: Environment,
+  rootEnv: Environment,
 ): SchemaIssue[] {
   const issues: SchemaIssue[] = [];
 
@@ -184,11 +192,11 @@ function collectCelTypeIssues(
       const expr = exprMatch[1].trim();
 
       // Merge x-telo-context variables for this path if applicable
-      let typedEnv = baseEnv;
+      let typedEnv = baseTypedEnv;
       if (definition.schema) {
         for (const ctx of extractContextsFromSchema(definition.schema)) {
           if (!pathMatchesScope(path, ctx.scope)) continue;
-          typedEnv = buildTypedCelEnvironment(manifest, ctx.schema);
+          typedEnv = buildTypedCelEnvironment(rootEnv, manifest, ctx.schema);
           break;
         }
       }
@@ -200,7 +208,15 @@ function collectCelTypeIssues(
         /* degrade gracefully */
       }
 
-      if (checkResult?.valid && checkResult.type && schema) {
+      if (checkResult?.valid === false && checkResult.error) {
+        // env.check() rejected the expression itself — e.g. wrong method, wrong
+        // argument types, wrong operator overload. Surface the first line of the
+        // error message; the tail is a source-code caret diagram we don't need.
+        const message = String((checkResult.error as { message?: string }).message ?? checkResult.error)
+          .split("\n")[0]
+          .trim();
+        issues.push({ message: `CEL type error: ${message}`, path });
+      } else if (checkResult?.valid && checkResult.type && schema) {
         const celType = checkResult.type.split("<")[0]!;
         if (!celTypeSatisfiesJsonSchema(celType, schema)) {
           issues.push({
@@ -223,7 +239,8 @@ function collectCelTypeIssues(
           `${path}[${i}]`,
           definition,
           manifest,
-          baseEnv,
+          baseTypedEnv,
+          rootEnv,
         ),
       );
     }
@@ -237,7 +254,8 @@ function collectCelTypeIssues(
           path ? `${path}.${k}` : k,
           definition,
           manifest,
-          baseEnv,
+          baseTypedEnv,
+          rootEnv,
         ),
       );
     }
@@ -246,7 +264,17 @@ function collectCelTypeIssues(
   return issues;
 }
 
+export interface StaticAnalyzerOptions {
+  celHandlers?: CelHandlers;
+}
+
 export class StaticAnalyzer {
+  private readonly celEnv: Environment;
+
+  constructor(options: StaticAnalyzerOptions = {}) {
+    this.celEnv = buildCelEnvironment(options.celHandlers);
+  }
+
   analyze(
     manifests: ResourceManifest[],
     options?: AnalysisOptions,
@@ -262,17 +290,18 @@ export class StaticAnalyzer {
     const defs = ctx?.definitions ?? new DefinitionRegistry();
 
     // Register module identities and aliases.
-    // The root Kernel.Module provides its own identity; imported modules surface their
-    // identity via resolvedModuleName/resolvedNamespace stamped onto the Kernel.Import
-    // by the loader (so we don't need to include imported Kernel.Module manifests in
-    // the analysis set, avoiding false reference errors in the parent context).
+    // The root module doc (Telo.Application or Telo.Library) provides its own
+    // identity; imported modules surface their identity via resolvedModuleName/
+    // resolvedNamespace stamped onto the Telo.Import by the loader (so we don't
+    // need to include imported module manifests in the analysis set, avoiding false
+    // reference errors in the parent context).
     for (const m of manifests) {
-      if (m.kind === "Kernel.Module") {
+      if (isModuleKind(m.kind)) {
         const namespace = ((m.metadata as any).namespace as string | undefined) ?? null;
         const moduleName = m.metadata.name as string;
         if (moduleName) defs.registerModuleIdentity(namespace, moduleName);
       }
-      if (m.kind === "Kernel.Import") {
+      if (m.kind === "Telo.Import") {
         const alias = m.metadata.name as string;
         const source = (m as any).source as string | undefined;
         const exportedKinds: string[] = (m as any).exports?.kinds ?? [];
@@ -292,11 +321,11 @@ export class StaticAnalyzer {
       }
     }
 
-    // Register definitions from Kernel.Definition resources.
+    // Register definitions from Telo.Definition resources.
     // Normalize alias-prefixed `capability` to canonical form so extendedBy lookup works
     // (e.g. "Workflow.Backend" → "workflow.Backend" when "Workflow" is a known alias).
     for (const m of manifests) {
-      if (m.kind === "Kernel.Definition") {
+      if (m.kind === "Telo.Definition") {
         const def = m as unknown as ResourceDefinition;
         const resolvedCapability = def.capability
           ? (aliases.resolveKind(def.capability) ?? def.capability)
@@ -324,17 +353,18 @@ export class StaticAnalyzer {
 
     // Validate each non-definition, non-system resource
     for (const m of allManifests) {
+      const filePath = (m.metadata as { source?: string } | undefined)?.source;
       if (!m.kind || !m.metadata?.name) {
         diagnostics.push({
           severity: DiagnosticSeverity.Error,
           code: "MISSING_KIND_OR_NAME",
           source: SOURCE,
           message: "Resource is missing required 'kind' or 'metadata.name' field.",
-          data: { path: !m.kind ? "kind" : "metadata.name" },
+          data: { filePath, path: !m.kind ? "kind" : "metadata.name" },
         });
         continue;
       }
-      if (m.kind === "Kernel.Definition" || m.kind === "Kernel.Abstract") {
+      if (m.kind === "Telo.Definition" || m.kind === "Telo.Abstract") {
         continue;
       }
 
@@ -357,8 +387,8 @@ export class StaticAnalyzer {
           severity: DiagnosticSeverity.Error,
           code: "UNDEFINED_KIND",
           source: SOURCE,
-          message: `No Kernel.Definition found for kind '${m.kind}'.${hint}`,
-          data: { resource, path: "kind" },
+          message: `No Telo.Definition found for kind '${m.kind}'.${hint}`,
+          data: { resource, filePath, path: "kind" },
         });
         continue;
       }
@@ -379,8 +409,8 @@ export class StaticAnalyzer {
               }
             : definition.schema;
         // Phase 1: CEL type checking — walk data+schema together, check env.check() return types
-        const baseEnv = buildTypedCelEnvironment(m);
-        const celIssues = collectCelTypeIssues(m, schema, "", definition, m, baseEnv);
+        const baseTypedEnv = buildTypedCelEnvironment(this.celEnv, m);
+        const celIssues = collectCelTypeIssues(m, schema, "", definition, m, baseTypedEnv, this.celEnv);
         // Phase 2+3: AJV on substituted data — CEL fields replaced with typed placeholders
         const ajvIssues = validateAgainstSchema(substituteCelFields(m, schema), schema);
         const issues = [...celIssues, ...ajvIssues];
@@ -390,7 +420,7 @@ export class StaticAnalyzer {
             code: "SCHEMA_VIOLATION",
             source: SOURCE,
             message: `${m.kind}/${resource.name}: ${issue.message}`,
-            data: { resource, path: issue.path },
+            data: { resource, filePath, path: issue.path },
           });
         }
       }
@@ -401,6 +431,7 @@ export class StaticAnalyzer {
     // Validate CEL syntax and context variable access in all manifests
     for (const m of allManifests) {
       const resource = { kind: m.kind, name: m.metadata?.name as string };
+      const filePath = (m.metadata as { source?: string } | undefined)?.source;
 
       const resolvedKind = aliases.resolveKind(m.kind);
       const mDefinition =
@@ -416,16 +447,16 @@ export class StaticAnalyzer {
         : undefined;
 
       walkCelExpressions(m, "", (expr, path) => {
-        let parsed: ReturnType<typeof celEnvironment.parse> | undefined;
+        let parsed: ReturnType<typeof this.celEnv.parse> | undefined;
         try {
-          parsed = celEnvironment.parse(expr);
+          parsed = this.celEnv.parse(expr);
         } catch (e) {
           diagnostics.push({
             severity: DiagnosticSeverity.Error,
             code: "CEL_SYNTAX_ERROR",
             source: SOURCE,
             message: `CEL syntax error at ${path}: ${e instanceof Error ? e.message : String(e)}`,
-            data: { resource, path },
+            data: { resource, filePath, path },
           });
           return;
         }
@@ -483,7 +514,7 @@ export class StaticAnalyzer {
             code: "CEL_UNKNOWN_FIELD",
             source: SOURCE,
             message: `${m.kind}/${resource.name}: CEL at '${path}': ${err}`,
-            data: { resource, path },
+            data: { resource, filePath, path },
           });
         }
       });
@@ -492,6 +523,9 @@ export class StaticAnalyzer {
     // Validate resource references (Phase 3)
     diagnostics.push(...validateReferences(allManifests, { aliases, definitions: defs }));
 
+    // Validate throws: declarations and catches: coverage (rules 1, 2, 4, 7)
+    diagnostics.push(...validateThrowsCoverage(allManifests, defs, aliases, this.celEnv));
+
     return diagnostics;
   }
 

package/src/builtins.ts

@@ -1,21 +1,21 @@
 import type { ResourceDefinition } from "@telorun/sdk";
 
 export const KERNEL_BUILTINS: ResourceDefinition[] = [
-  { kind: "Kernel.Abstract", metadata: { name: "Template", module: "Kernel" } },
-  { kind: "Kernel.Abstract", metadata: { name: "Runnable", module: "Kernel" } },
-  { kind: "Kernel.Abstract", metadata: { name: "Service", module: "Kernel" } },
-  { kind: "Kernel.Abstract", metadata: { name: "Invocable", module: "Kernel" } },
-  { kind: "Kernel.Abstract", metadata: { name: "Mount", module: "Kernel" } },
-  { kind: "Kernel.Abstract", metadata: { name: "Type", module: "Kernel" } },
+  { kind: "Telo.Abstract", metadata: { name: "Template", module: "Telo" } },
+  { kind: "Telo.Abstract", metadata: { name: "Runnable", module: "Telo" } },
+  { kind: "Telo.Abstract", metadata: { name: "Service", module: "Telo" } },
+  { kind: "Telo.Abstract", metadata: { name: "Invocable", module: "Telo" } },
+  { kind: "Telo.Abstract", metadata: { name: "Mount", module: "Telo" } },
+  { kind: "Telo.Abstract", metadata: { name: "Type", module: "Telo" } },
   {
-    kind: "Kernel.Abstract",
-    metadata: { name: "Provider", module: "Kernel" },
+    kind: "Telo.Abstract",
+    metadata: { name: "Provider", module: "Telo" },
     schema: { "x-telo-eval": "compile" },
   },
   {
-    kind: "Kernel.Definition",
-    metadata: { name: "Abstract", module: "Kernel" },
-    capability: "Kernel.Template",
+    kind: "Telo.Definition",
+    metadata: { name: "Abstract", module: "Telo" },
+    capability: "Telo.Template",
     schema: {
       type: "object",
       properties: {
@@ -33,15 +33,15 @@ export const KERNEL_BUILTINS: ResourceDefinition[] = [
     },
   },
   {
-    kind: "Kernel.Definition",
-    metadata: { name: "Definition", module: "Kernel" },
-    capability: "Kernel.Template",
+    kind: "Telo.Definition",
+    metadata: { name: "Definition", module: "Telo" },
+    capability: "Telo.Template",
     schema: { type: "object" },
   },
   {
-    kind: "Kernel.Definition",
-    metadata: { name: "Import", module: "Kernel" },
-    capability: "Kernel.Template",
+    kind: "Telo.Definition",
+    metadata: { name: "Import", module: "Telo" },
+    capability: "Telo.Template",
     schema: {
       type: "object",
       properties: {
@@ -61,9 +61,9 @@ export const KERNEL_BUILTINS: ResourceDefinition[] = [
     },
   },
   {
-    kind: "Kernel.Definition",
-    metadata: { name: "Module", module: "Kernel" },
-    capability: "Kernel.Template",
+    kind: "Telo.Definition",
+    metadata: { name: "Application", module: "Telo" },
+    capability: "Telo.Template",
     schema: {
       type: "object",
       properties: {
@@ -85,14 +85,12 @@ export const KERNEL_BUILTINS: ResourceDefinition[] = [
           default: "shared",
         },
         keepAlive: { type: "boolean", default: false },
-        variables: { type: "object" },
-        secrets: { type: "object" },
         targets: {
           type: "array",
           items: {
             anyOf: [
-              { type: "string", "x-telo-ref": "kernel#Runnable" },
-              { type: "string", "x-telo-ref": "kernel#Service" },
+              { type: "string", "x-telo-ref": "telo#Runnable" },
+              { type: "string", "x-telo-ref": "telo#Service" },
             ],
           },
         },
@@ -100,6 +98,36 @@ export const KERNEL_BUILTINS: ResourceDefinition[] = [
           type: "array",
           items: { type: "string" },
         },
+      },
+      required: ["metadata"],
+      additionalProperties: false,
+    },
+  },
+  {
+    kind: "Telo.Definition",
+    metadata: { name: "Library", module: "Telo" },
+    capability: "Telo.Template",
+    schema: {
+      type: "object",
+      properties: {
+        kind: { type: "string" },
+        metadata: {
+          type: "object",
+          properties: {
+            name: { type: "string" },
+            version: { type: "string" },
+            source: { type: "string" },
+            module: { type: "string" },
+          },
+          required: ["name"],
+          additionalProperties: true,
+        },
+        variables: { type: "object" },
+        secrets: { type: "object" },
+        include: {
+          type: "array",
+          items: { type: "string" },
+        },
         exports: {
           type: "object",
           properties: {

package/src/cel-environment.ts

@@ -1,36 +1,59 @@
-import type { ResourceManifest } from "@telorun/sdk";
 import { Environment } from "@marcbachmann/cel-js";
+import type { ResourceManifest } from "@telorun/sdk";
 import { jsonSchemaToCelType } from "./schema-compat.js";
 
-export const celEnvironment = new Environment({ unlistedVariablesAreDyn: true })
-  .registerFunction("join(list, string): string", (list: unknown[], sep: string) =>
-    list.map(String).join(sep),
-  )
-  .registerFunction("keys(map): list", (map: unknown) => {
-    if (map instanceof Map) return [...map.keys()];
-    return Object.keys(map as Record<string, unknown>);
-  })
-  .registerFunction("values(map): list", (map: unknown) => {
-    if (map instanceof Map) return [...map.values()];
-    return Object.values(map as Record<string, unknown>);
-  });
+export interface CelHandlers {
+  sha256: (s: string) => string;
+}
+
+const stub = (name: string) => () => {
+  throw new Error(
+    `${name}() is not available in this environment. ` +
+      `Construct StaticAnalyzer or Loader with celHandlers to enable it.`,
+  );
+};
+
+const STUB_HANDLERS: CelHandlers = {
+  sha256: stub("sha256"),
+};
+
+/** Build a CEL `Environment` with Telo's stdlib of functions. Always registers the
+ *  same function signatures (so `env.check()` succeeds for type-inference) — the
+ *  handlers govern what the function does when called at runtime. Analyzer-only
+ *  callers can omit handlers; runtime callers (kernel) must supply real ones. */
+export function buildCelEnvironment(handlers: CelHandlers = STUB_HANDLERS): Environment {
+  return new Environment({ unlistedVariablesAreDyn: true })
+    .registerFunction("join(list, string): string", (list: unknown[], sep: string) =>
+      list.map(String).join(sep),
+    )
+    .registerFunction("keys(map): list", (map: unknown) => {
+      if (map instanceof Map) return [...map.keys()];
+      return Object.keys(map as Record<string, unknown>);
+    })
+    .registerFunction("values(map): list", (map: unknown) => {
+      if (map instanceof Map) return [...map.values()];
+      return Object.values(map as Record<string, unknown>);
+    })
+    .registerFunction("sha256(string): string", (s: string) => handlers.sha256(s));
+}
 
-/** Clone `celEnvironment` and register typed variable declarations so that
+/** Clone `baseEnv` and register typed variable declarations so that
  *  `env.check(expr)` can infer return types for expressions referencing known variables.
  *
  *  - `variables`: typed from the manifest's `variables` field if it is a schema map
- *    (only `Kernel.Module` resources carry this); otherwise registered as `map` (dyn).
+ *    (only module-identity docs — `Telo.Application` / `Telo.Library` — carry this); otherwise registered as `map` (dyn).
  *  - `secrets`, `resources`, `env`: always `map` (dyn — output schemas unknown).
  *  - `extraContextSchema`: additional variables from an `x-telo-context` annotation.
  *
  *  NOTE: The set of kernel globals registered here must match `KERNEL_GLOBAL_NAMES`
  *  in kernel-globals.ts, which is used for chain-access validation. */
 export function buildTypedCelEnvironment(
+  baseEnv: Environment,
   manifest: ResourceManifest,
   extraContextSchema?: Record<string, any> | null,
 ): Environment {
   try {
-    const env = celEnvironment.clone();
+    const env = baseEnv.clone();
 
     // Build typed ObjectSchema from manifest.variables if it looks like a schema map
     const vars = (manifest as Record<string, unknown>).variables;
@@ -67,6 +90,6 @@ export function buildTypedCelEnvironment(
 
     return env;
   } catch {
-    return celEnvironment.clone();
+    return baseEnv.clone();
   }
 }

package/src/definition-registry.ts

@@ -20,10 +20,10 @@ export class DefinitionRegistry {
   /** Reverse inheritance index: parent kind → direct child kinds. */
   private readonly extendedBy = new Map<string, string[]>();
   /** Module identity table: identity string → canonical module name.
-   *  "kernel" → "Kernel", "std/pipeline" → "pipeline", etc. */
+   *  "telo" → "Telo", "std/pipeline" → "pipeline", etc. */
   private readonly identityMap = new Map<string, string>();
   /** Reverse identity table: canonical module name → full identity string.
-   *  "Kernel" → "kernel", "pipeline" → "std/pipeline", etc.
+   *  "Telo" → "telo", "pipeline" → "std/pipeline", etc.
    *  Used to compute definition $id values for the AJV schema store. */
   private readonly reverseIdentityMap = new Map<string, string>();
 
@@ -40,10 +40,10 @@ export class DefinitionRegistry {
         this.extendedBy.set(definition.capability, [key]);
       }
     }
-    // Auto-register the kernel identity when any Kernel built-in is registered.
-    if (definition.kind === "Kernel.Abstract" && mod === "Kernel") {
-      this.identityMap.set("kernel", "Kernel");
-      this.reverseIdentityMap.set("Kernel", "kernel");
+    // Auto-register the telo identity when any Telo built-in is registered.
+    if (definition.kind === "Telo.Abstract" && mod === "Telo") {
+      this.identityMap.set("telo", "Telo");
+      this.reverseIdentityMap.set("Telo", "telo");
     }
     // If identity is already known, register the schema in AJV immediately.
     if (mod && definition.schema) {
@@ -52,11 +52,11 @@ export class DefinitionRegistry {
   }
 
   /** Register a module identity for x-telo-ref resolution.
-   *  Call once per Kernel.Module manifest when the manifest is loaded.
-   *  @param namespace  The module's metadata.namespace (e.g. "std"), or null for kernel built-ins.
+   *  Call once per module doc (Telo.Application or Telo.Library) when the manifest is loaded.
+   *  @param namespace  The module's metadata.namespace (e.g. "std"), or null for telo built-ins.
    *  @param moduleName The module's metadata.name (e.g. "pipeline", "http-server"). */
   registerModuleIdentity(namespace: string | null, moduleName: string): void {
-    const identity = namespace ? `${namespace}/${moduleName}` : "kernel";
+    const identity = namespace ? `${namespace}/${moduleName}` : "telo";
     this.identityMap.set(identity, moduleName);
     this.reverseIdentityMap.set(moduleName, identity);
     // Retroactively register AJV schemas for definitions of this module already in the registry.
@@ -110,7 +110,7 @@ export class DefinitionRegistry {
    *  Splits on "#", looks up the left side in the identity table, and returns
    *  "<canonicalModule>.<TypeName>".
    *
-   *  "kernel#Invocable"       → "Kernel.Invocable"
+   *  "telo#Invocable"         → "Telo.Invocable"
    *  "std/pipeline#Job"       → "pipeline.Job"
    *  "std/http-server#Server" → "http-server.Server"
    *

package/src/dependency-graph.ts

@@ -17,8 +17,15 @@ export interface DependencyGraph {
   cycle?: ReadonlyArray<ResourceNode>;
 }
 
-/** System resource kinds that are not runtime nodes in the dependency graph. */
-const SYSTEM_KINDS = new Set(["Kernel.Definition", "Kernel.Import"]);
+/** System resource kinds that are not runtime nodes in the dependency graph.
+ *  Module-identity docs (Telo.Application, Telo.Library) are intentionally
+ *  not in this set: an Application's `targets` use `x-telo-ref` to real
+ *  Runnable/Service resources, so the Application legitimately depends on
+ *  them in boot order — modeling that as a graph edge is correct. A Library
+ *  has no `targets`, so it becomes a zero-edge node, which is harmless.
+ *  If the graph is ever consumed as "things to init", skip these kinds at
+ *  the consumer site; the controller already runs them separately. */
+const SYSTEM_KINDS = new Set(["Telo.Definition", "Telo.Import"]);
 
 const nodeKey = (kind: string, name: string) => `${kind}\0${name}`;
 

package/src/index.ts

@@ -3,6 +3,8 @@ export { RegistryAdapter } from "./adapters/registry-adapter.js";
 export { AnalysisRegistry } from "./analysis-registry.js";
 export { StaticAnalyzer } from "./analyzer.js";
 export { Loader } from "./manifest-loader.js";
+export { MODULE_KINDS, isModuleKind } from "./module-kinds.js";
+export type { ModuleKind } from "./module-kinds.js";
 export { DEFAULT_MANIFEST_FILENAME, DiagnosticSeverity } from "./types.js";
 export type {
     AnalysisDiagnostic,

package/src/kernel-globals.ts

@@ -7,16 +7,17 @@ import type { ResourceManifest } from "@telorun/sdk";
  * must stay in sync with this list.
  *
  * Note: `env` is only available in the root module context. Child modules
- * loaded via Kernel.Import do not receive host environment variables.
+ * loaded via Telo.Import do not receive host environment variables.
  * There is no `imports` namespace at runtime — import snapshots are stored
  * under `resources.<alias>`.
  */
 export const KERNEL_GLOBAL_NAMES = ["variables", "secrets", "resources", "env"] as const;
 
 const SYSTEM_KINDS = new Set([
-  "Kernel.Definition",
-  "Kernel.Module",
-  "Kernel.Abstract",
+  "Telo.Definition",
+  "Telo.Application",
+  "Telo.Library",
+  "Telo.Abstract",
 ]);
 
 /**
@@ -25,22 +26,30 @@ const SYSTEM_KINDS = new Set([
  * chain-access validation recognises kernel globals without module authors
  * having to re-declare them.
  *
- * - `variables` / `secrets`: typed from the `Kernel.Module` declaration
+ * - `variables` / `secrets`: typed from the root module doc — prefer
+ *   Telo.Application when present, otherwise fall back to Telo.Library.
+ *   Applications are the root whose variables/secrets contract governs CEL
+ *   in the outer module; Libraries are only relevant when the caller scoped
+ *   the manifest list to a single library's file.
  * - `resources`: enumerates all non-system resource names
  * - `env`: dynamic (runtime env vars, root module only)
  */
 export function buildKernelGlobalsSchema(
   manifests: ResourceManifest[],
 ): Record<string, any> {
-  const moduleManifest = manifests.find((m) => m.kind === "Kernel.Module") as
-    | Record<string, any>
-    | undefined;
+  const moduleManifest =
+    (manifests.find((m) => m.kind === "Telo.Application") as
+      | Record<string, any>
+      | undefined) ??
+    (manifests.find((m) => m.kind === "Telo.Library") as
+      | Record<string, any>
+      | undefined);
 
   const resourceProps: Record<string, any> = {};
   for (const m of manifests) {
     const name = m.metadata?.name as string | undefined;
     if (!name || !m.kind) continue;
-    // Kernel.Import snapshots are stored under resources.<alias> at runtime,
+    // Telo.Import snapshots are stored under resources.<alias> at runtime,
     // so they appear here alongside regular resources.
     if (!SYSTEM_KINDS.has(m.kind)) {
       resourceProps[name] = { type: "object", additionalProperties: true };
@@ -62,7 +71,7 @@ export function buildKernelGlobalsSchema(
   };
 }
 
-/** Wrap a JSON Schema property map (like `Kernel.Module.variables`) into a
+/** Wrap a JSON Schema property map (like `Telo.Application.variables`) into a
  *  closed object schema suitable for chain-access validation. Falls back to
  *  an open map when the module declares no variables/secrets. */
 function buildSchemaMapSchema(