@telorun/analyzer 0.55.0 → 0.56.1

package/README.md

@@ -23,9 +23,9 @@ Built to be language-agnostic and infinitely extensible.
 
 ```bash
 # Reconcile your manifest into a running backend
-$ telo ./examples/hello-api
+$ telo ./examples/todo-app
 
-{"level":30,"time":1771610393008,"pid":1310178,"hostname":"dev","msg":"Server listening at http://127.0.0.1:8844"}
+{"level":30,"time":1771610393008,"pid":1310178,"hostname":"dev","msg":"Server listening at http://127.0.0.1:8077"}
 ```
 
 ## Why use Telo?

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIzE,OAAO,EACL,aAAa,EAEb,KAAK,YAAY,EAElB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EACL,KAAK,aAAa,EAGnB,MAAM,0BAA0B,CAAC;AAsBlC,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAiBvF,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAqF/F;;;;;uDAKuD;AACvD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,aAAa,GAAG;IAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAA;CAAE,CAO9F;AA6FD;0CAC0C;AAC1C,eAAO,MAAM,eAAe,GAAI,OAAO;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OACT,CAAC;AAErD;8EAC8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhD;AAuBD;2DAC2D;AAC3D,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACvC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CASjC;AAED;4EAC4E;AAC5E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAmBvG;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,OAAO,EAAE,EAChB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EAC/C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,GAC3D,IAAI,CAiDN;AA8mBD,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAywCvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAyBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIzE,OAAO,EACL,aAAa,EAEb,KAAK,YAAY,EAElB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EACL,KAAK,aAAa,EAGnB,MAAM,0BAA0B,CAAC;AAsBlC,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAiBvF,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAqF/F;;;;;uDAKuD;AACvD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,aAAa,GAAG;IAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAA;CAAE,CAO9F;AA6FD;0CAC0C;AAC1C,eAAO,MAAM,eAAe,GAAI,OAAO;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OACT,CAAC;AAErD;8EAC8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhD;AAuBD;2DAC2D;AAC3D,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACvC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CASjC;AAED;4EAC4E;AAC5E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAmBvG;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,OAAO,EAAE,EAChB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EAC/C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,GAC3D,IAAI,CAiDN;AA8mBD,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IA6wCvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAyBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -7,7 +7,7 @@ import { effectiveAuthorSchema } from "./extends-resolution.js";
 import { PERMISSIVE_CONTRACT, resolveContract, } from "./invocation-contract.js";
 import { buildCallGraph } from "./call-graph.js";
 import { buildDependencyGraph, formatCycle } from "./dependency-graph.js";
-import { buildKernelGlobalsSchema, KERNEL_GLOBAL_NAMES, mergeKernelGlobalsIntoContext, } from "./kernel-globals.js";
+import { buildKernelGlobalsIndex, KERNEL_GLOBAL_NAMES, mergeKernelGlobalsIntoContext, } from "./kernel-globals.js";
 import { buildObservedStateIndex, buildObservedStateResourcesSchema, collectRunReachableNames, observedStateRead, validateObservedStateDeclarations, } from "./validate-observed-state.js";
 import { computeSuggestKind } from "./kind-suggest.js";
 import { visitManifest } from "./manifest-visitor.js";
@@ -1361,7 +1361,7 @@ export class StaticAnalyzer {
             : new Set();
         // Build typed kernel globals schema so x-telo-context chain validation
         // recognises variables, secrets, resources, env automatically
-        const kernelGlobals = buildKernelGlobalsSchema(allManifests, observedState);
+        const kernelGlobals = buildKernelGlobalsIndex(allManifests, observedState);
         // Fallback context for CEL in a slot with no `x-telo-context` annotation:
         // everything stays open except the typed `.status` nodes, so unknown-field
         // checking reaches observed state everywhere without newly rejecting any
@@ -1377,7 +1377,8 @@ export class StaticAnalyzer {
             : null;
         // The module doc (Application/Library) carries the Application-only `ports`
         // namespace; threaded into per-resource CEL typing so `${{ ports.X }}`
-        // resolves its nominal brand cross-doc.
+        // resolves its nominal brand cross-doc. A flattened set holds exactly one —
+        // the entry's; see `buildKernelGlobalsSchema`.
         const moduleManifest = allManifests.find((mm) => mm.kind === "Telo.Application") ??
             allManifests.find((mm) => mm.kind === "Telo.Library");
         // Validate each non-definition, non-system resource
@@ -1849,7 +1850,11 @@ export class StaticAnalyzer {
                         aliases,
                         allManifests: allManifests,
                     });
-                    effectiveContext = mergeKernelGlobalsIntoContext(withBindingNames(resolvedContext, m), kernelGlobals);
+                    effectiveContext = mergeKernelGlobalsIntoContext(withBindingNames(resolvedContext, m), 
+                    // Typed in the module that DECLARED this resource — for a manifest
+                    // forwarded from an imported library, that is its `moduleGlobals`
+                    // stamp, not the consuming application's block.
+                    kernelGlobals.forResource(m));
                 }
                 else if (observedStateContext) {
                     // No `x-telo-context` matched, so nothing was chain-validated here

package/dist/binary-slot.d.ts

@@ -0,0 +1,39 @@
+import type { KeywordDefinition } from "ajv";
+/**
+ * `x-telo-binary: true` — the annotation that gives a byte buffer a declared
+ * identity, and the single accessor every surface reads it through (the
+ * `ref-slot.ts` precedent).
+ *
+ * WHY AN ANNOTATION RATHER THAN A TYPE. Bytes are not expressible in JSON
+ * Schema's type vocabulary. `type: object` is the closest fit and it is a lie
+ * that costs a real check: every arbitrary object satisfies it, so a mistyped
+ * `content: { foo: bar }` reaches the controller instead of failing statically.
+ * `type: binary` would fix the honesty and break everything else — AJV refuses
+ * to compile an unknown type at all (`type must be JSONType or JSONType[]`),
+ * with no option to allow it, so the schema would produce no validator; and a
+ * published `telo.yaml` would stop being JSON Schema, which is what the hub, the
+ * editor and any third-party reader consume. An `x-` keyword is ignored by
+ * unaware tooling BY SPECIFICATION, so it degrades to "unconstrained" rather
+ * than to "cannot validate this kind at all".
+ *
+ * ONE RULE, BOTH HALVES. The keyword is implemented as AJV CODEGEN rather than a
+ * `validate` function so it inlines into standalone-compiled validators — the
+ * kernel compiles and caches those, and a function-valued keyword would not
+ * survive serialization. The analyzer registers the identical keyword, and
+ * `celPlaceholderForSchema` hands a real `Uint8Array` to a CEL leaf at a binary
+ * slot, so static and runtime agree by construction instead of by two rules kept
+ * in step. What falls out is the check the annotation exists for: **bytes can
+ * never be manifest-authored** — no YAML literal is a `Uint8Array` — so a literal
+ * at a binary slot is rejected while a value arriving by reference passes.
+ */
+export declare const X_TELO_BINARY = "x-telo-binary";
+/** True when this schema node declares its value to be raw bytes. */
+export declare function isBinarySlot(schema: unknown): boolean;
+/**
+ * The AJV keyword. `Uint8Array` is the structural test rather than any richer
+ * notion of "binary": it is what every byte producer in the runtime hands over
+ * (`Buffer` extends it, so Node buffers pass), and it is the one check that means
+ * the same thing in a browser-side analyzer and in the kernel.
+ */
+export declare function binaryKeyword(): KeywordDefinition;
+//# sourceMappingURL=binary-slot.d.ts.map

package/dist/binary-slot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"binary-slot.d.ts","sourceRoot":"","sources":["../src/binary-slot.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,KAAK,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAE7C,qEAAqE;AACrE,wBAAgB,YAAY,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAMrD;AAWD;;;;;GAKG;AACH,wBAAgB,aAAa,IAAI,iBAAiB,CAajD"}

package/dist/binary-slot.js

@@ -0,0 +1,58 @@
+import * as AjvNS from "ajv";
+/**
+ * `x-telo-binary: true` — the annotation that gives a byte buffer a declared
+ * identity, and the single accessor every surface reads it through (the
+ * `ref-slot.ts` precedent).
+ *
+ * WHY AN ANNOTATION RATHER THAN A TYPE. Bytes are not expressible in JSON
+ * Schema's type vocabulary. `type: object` is the closest fit and it is a lie
+ * that costs a real check: every arbitrary object satisfies it, so a mistyped
+ * `content: { foo: bar }` reaches the controller instead of failing statically.
+ * `type: binary` would fix the honesty and break everything else — AJV refuses
+ * to compile an unknown type at all (`type must be JSONType or JSONType[]`),
+ * with no option to allow it, so the schema would produce no validator; and a
+ * published `telo.yaml` would stop being JSON Schema, which is what the hub, the
+ * editor and any third-party reader consume. An `x-` keyword is ignored by
+ * unaware tooling BY SPECIFICATION, so it degrades to "unconstrained" rather
+ * than to "cannot validate this kind at all".
+ *
+ * ONE RULE, BOTH HALVES. The keyword is implemented as AJV CODEGEN rather than a
+ * `validate` function so it inlines into standalone-compiled validators — the
+ * kernel compiles and caches those, and a function-valued keyword would not
+ * survive serialization. The analyzer registers the identical keyword, and
+ * `celPlaceholderForSchema` hands a real `Uint8Array` to a CEL leaf at a binary
+ * slot, so static and runtime agree by construction instead of by two rules kept
+ * in step. What falls out is the check the annotation exists for: **bytes can
+ * never be manifest-authored** — no YAML literal is a `Uint8Array` — so a literal
+ * at a binary slot is rejected while a value arriving by reference passes.
+ */
+export const X_TELO_BINARY = "x-telo-binary";
+/** True when this schema node declares its value to be raw bytes. */
+export function isBinarySlot(schema) {
+    return (typeof schema === "object" &&
+        schema !== null &&
+        schema[X_TELO_BINARY] === true);
+}
+const ajvExports = AjvNS.default ?? AjvNS;
+const codegen = ajvExports._ ?? AjvNS._;
+/**
+ * The AJV keyword. `Uint8Array` is the structural test rather than any richer
+ * notion of "binary": it is what every byte producer in the runtime hands over
+ * (`Buffer` extends it, so Node buffers pass), and it is the one check that means
+ * the same thing in a browser-side analyzer and in the kernel.
+ */
+export function binaryKeyword() {
+    return {
+        keyword: X_TELO_BINARY,
+        schemaType: "boolean",
+        code(cxt) {
+            // `x-telo-binary: false` states nothing, so it constrains nothing.
+            if (cxt.schema !== true)
+                return;
+            cxt.pass(codegen `${cxt.data} instanceof Uint8Array`);
+        },
+        error: {
+            message: "must be raw bytes (a Uint8Array) — bytes cannot be written inline in a manifest",
+        },
+    };
+}

package/dist/flatten-for-analyzer.d.ts

@@ -33,8 +33,27 @@ export declare function parseExportEntry(entry: string): ParsedExportEntry;
  *  `byModuleName` and `!ref Alias.name` resolves, while `validate-references` /
  *  the per-resource validation loop never re-walk or re-validate it against the
  *  consumer's scope. A consumer that instead emits every module doc as a peer
- *  local manifest silently breaks both. */
+ *  local manifest silently breaks both.
+ *
+ *  Dropping the module doc costs the consumer's analysis the one thing a
+ *  forwarded manifest's CEL still needs: the `variables` / `secrets` / `ports`
+ *  contract its expressions are evaluated against. That contract is carried
+ *  across as {@link ModuleGlobals} on each forwarded manifest instead, so the
+ *  consumer can check those reads in the DECLARING module's scope rather than
+ *  either skipping them (a diagnostic performed nowhere) or judging them by its
+ *  own block (a hard error the library author cannot act on). Stamped here
+ *  because this is the only point where a manifest and its module doc are both
+ *  in hand — by the time `analyze()` sees the flat list, the doc is gone. */
 export declare function selectModuleManifestsForAnalysis(moduleManifests: ResourceManifest[], isRoot: boolean): ResourceManifest[];
+/** The declaring module's config contract, carried on a forwarded manifest so
+ *  the consumer's analysis can type its CEL globals in the right scope. Only the
+ *  namespaces whose typing is scope-dependent: `resources` is deliberately
+ *  absent, see {@link readModuleGlobals}. */
+export interface ModuleGlobals {
+    variables?: Record<string, unknown>;
+    secrets?: Record<string, unknown>;
+    ports?: Record<string, unknown>;
+}
 /** Produce the flat manifest list `analyze()` consumes today.
  *
  *  Combines the entry module's manifests with `Telo.Definition`,

package/dist/flatten-for-analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flatten-for-analyzer.d.ts","sourceRoot":"","sources":["../src/flatten-for-analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEtE;;yEAEyE;AACzE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;4CAI4C;AAC5C,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAGjE;AAED;;;;;;;;;;;;;;;;;;;2CAmB2C;AAC3C,wBAAgB,gCAAgC,CAC9C,eAAe,EAAE,gBAAgB,EAAE,EACnC,MAAM,EAAE,OAAO,GACd,gBAAgB,EAAE,CA6BpB;AAED;;;;;;;;;;;;;;;;;;;6EAmB6E;AAC7E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,gBAAgB,EAAE,CAiDzE;AAED;;uBAEuB;AACvB,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;qEAEqE;AACrE,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,GAC/C,YAAY,EAAE,CAShB;AAED;;;;;;uFAMuF;AACvF,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,gBAAgB,EAAE,EAC1B,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACnE,IAAI,CAgDN;AAED;;;;0EAI0E;AAC1E,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;CAAE,CAAC,EACvF,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACnE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA2ClC;AAED;;;;;4DAK4D;AAC5D,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,CAAC;IAAE,QAAQ,EAAE,gBAAgB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,EAC5E,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC9C,IAAI,CAWN;AAED;;;;;;;;;;;;;;iGAciG;AACjG,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,aAAa,CAAC;IAAE,QAAQ,EAAE,gBAAgB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,EAC5E,aAAa,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,GACpD,IAAI,CAMN;AAgDD;;;;;oEAKoE;AACpE,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,WAAW,GAAG,mBAAmB,EAAE,CAuBpF;AAED;;;;;6BAK6B;AAC7B,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,YAAY,GAAG,gBAAgB,EAAE,CAEzE"}
+{"version":3,"file":"flatten-for-analyzer.d.ts","sourceRoot":"","sources":["../src/flatten-for-analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEtE;;yEAEyE;AACzE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;4CAI4C;AAC5C,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAGjE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6EA6B6E;AAC7E,wBAAgB,gCAAgC,CAC9C,eAAe,EAAE,gBAAgB,EAAE,EACnC,MAAM,EAAE,OAAO,GACd,gBAAgB,EAAE,CAmCpB;AAED;;;6CAG6C;AAC7C,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAkCD;;;;;;;;;;;;;;;;;;;6EAmB6E;AAC7E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,gBAAgB,EAAE,CAiDzE;AAED;;uBAEuB;AACvB,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;qEAEqE;AACrE,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,GAC/C,YAAY,EAAE,CAShB;AAED;;;;;;uFAMuF;AACvF,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,gBAAgB,EAAE,EAC1B,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACnE,IAAI,CAgDN;AAED;;;;0EAI0E;AAC1E,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;CAAE,CAAC,EACvF,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACnE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA2ClC;AAED;;;;;4DAK4D;AAC5D,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,CAAC;IAAE,QAAQ,EAAE,gBAAgB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,EAC5E,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC9C,IAAI,CAWN;AAED;;;;;;;;;;;;;;iGAciG;AACjG,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,aAAa,CAAC;IAAE,QAAQ,EAAE,gBAAgB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,EAC5E,aAAa,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,GACpD,IAAI,CAMN;AAgDD;;;;;oEAKoE;AACpE,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,WAAW,GAAG,mBAAmB,EAAE,CAuBpF;AAED;;;;;6BAK6B;AAC7B,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,YAAY,GAAG,gBAAgB,EAAE,CAEzE"}

package/dist/flatten-for-analyzer.js

@@ -27,7 +27,17 @@ export function parseExportEntry(entry) {
  *  `byModuleName` and `!ref Alias.name` resolves, while `validate-references` /
  *  the per-resource validation loop never re-walk or re-validate it against the
  *  consumer's scope. A consumer that instead emits every module doc as a peer
- *  local manifest silently breaks both. */
+ *  local manifest silently breaks both.
+ *
+ *  Dropping the module doc costs the consumer's analysis the one thing a
+ *  forwarded manifest's CEL still needs: the `variables` / `secrets` / `ports`
+ *  contract its expressions are evaluated against. That contract is carried
+ *  across as {@link ModuleGlobals} on each forwarded manifest instead, so the
+ *  consumer can check those reads in the DECLARING module's scope rather than
+ *  either skipping them (a diagnostic performed nowhere) or judging them by its
+ *  own block (a hard error the library author cannot act on). Stamped here
+ *  because this is the only point where a manifest and its module doc are both
+ *  in hand — by the time `analyze()` sees the flat list, the doc is gone. */
 export function selectModuleManifestsForAnalysis(moduleManifests, isRoot) {
     if (isRoot)
         return moduleManifests;
@@ -41,22 +51,57 @@ export function selectModuleManifestsForAnalysis(moduleManifests, isRoot) {
             continue;
         exportedResources.add(parseExportEntry(entry).name);
     }
+    const moduleGlobals = readModuleGlobals(libDoc);
     const out = [];
     for (const m of moduleManifests) {
         if (m.kind === "Telo.Definition" || m.kind === "Telo.Abstract" || m.kind === "Telo.Import") {
-            out.push(m);
+            out.push(withModuleGlobals(m, moduleGlobals));
         }
         else if (!isModuleKind(m.kind) &&
             typeof m.metadata?.name === "string" &&
             exportedResources.has(m.metadata.name)) {
             out.push({
                 ...m,
-                metadata: { ...m.metadata, forwardedExport: true },
+                metadata: {
+                    ...m.metadata,
+                    forwardedExport: true,
+                    ...(moduleGlobals ? { moduleGlobals } : {}),
+                },
             });
         }
     }
     return out;
 }
+/** Read the schema-map blocks off a module doc, or `undefined` when it declares
+ *  none (the globals then stay permissive, exactly as an absent doc does).
+ *
+ *  `resources` is NOT carried. The flat list holds only this module's EXPORTED
+ *  instances, so a name list built from it would omit every internal one — and a
+ *  `with:`-scoped resource is declared inline rather than as a doc, so it would
+ *  be missing too. Both would read as "no such resource" in a consumer's pass:
+ *  a false positive worse than the unchecked read it replaced. The consumer
+ *  leaves a forwarded manifest's `resources` node open and the library's own
+ *  analysis, which sees every name, does that check. */
+function readModuleGlobals(libDoc) {
+    const doc = libDoc;
+    if (!doc)
+        return undefined;
+    const globals = {};
+    for (const key of ["variables", "secrets", "ports"]) {
+        const block = doc[key];
+        if (block && typeof block === "object" && !Array.isArray(block))
+            globals[key] = block;
+    }
+    return Object.keys(globals).length > 0 ? globals : undefined;
+}
+function withModuleGlobals(m, moduleGlobals) {
+    if (!moduleGlobals)
+        return m;
+    return {
+        ...m,
+        metadata: { ...m.metadata, moduleGlobals },
+    };
+}
 /** Produce the flat manifest list `analyze()` consumes today.
  *
  *  Combines the entry module's manifests with `Telo.Definition`,

package/dist/index.d.ts

@@ -23,6 +23,7 @@ export { buildReferenceFieldMap, isRefEntry, isScopeEntry } from "./reference-fi
 export type { ReferenceFieldMap, RefFieldEntry } from "./reference-field-map.js";
 export { hasDeclaredUse, isRefSlot, isRefUse, possibleUses, readRefSlot, REF_USES, refSlotAnnotation, rewriteRefSlotKinds, transfersControl, } from "./ref-slot.js";
 export type { RefSlot, RefUse, RefUseCases } from "./ref-slot.js";
+export { binaryKeyword, isBinarySlot, X_TELO_BINARY } from "./binary-slot.js";
 export { hasProvidesZone, hasRequiresZone, readProvidesZone, readRequiresZone, rewriteRequiresZoneKind, } from "./zone-slot.js";
 export type { ProvidesZoneSlot, RequiresZoneSlot } from "./zone-slot.js";
 export { deriveLibraryExportRequirements, projectZoneRequirements, runZoneAnalysis, zoneDocumentsSignature, } from "./resolve-zone-requirements.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACjF,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,0BAA0B,EAC1B,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,iCAAiC,EACjC,wBAAwB,EACxB,iBAAiB,EACjB,iCAAiC,EACjC,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACxF,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACtF,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,oBAAoB,EACpB,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAChG,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7E,YAAY,EACV,qBAAqB,EACrB,SAAS,EACT,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC5F,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EACL,cAAc,EACd,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EACL,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,EACvB,eAAe,EACf,sBAAsB,GACvB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAChG,YAAY,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACnB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC/E,YAAY,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EACL,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,sBAAsB,EACtB,WAAW,EACX,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,SAAS,EACT,YAAY,EACZ,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,eAAe,EACf,cAAc,GACf,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAIvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC3E,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACjF,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,0BAA0B,EAC1B,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,iCAAiC,EACjC,wBAAwB,EACxB,iBAAiB,EACjB,iCAAiC,EACjC,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACxF,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACtF,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,oBAAoB,EACpB,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAChG,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7E,YAAY,EACV,qBAAqB,EACrB,SAAS,EACT,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC5F,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EACL,cAAc,EACd,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EACL,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,EACvB,eAAe,EACf,sBAAsB,GACvB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAChG,YAAY,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACnB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC/E,YAAY,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EACL,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,sBAAsB,EACtB,WAAW,EACX,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,SAAS,EACT,YAAY,EACZ,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,eAAe,EACf,cAAc,GACf,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAIvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC3E,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -12,6 +12,7 @@ export { hasIntermediateWildcard, parseRedactionPath, RedactionPathError, } from
 export { buildCallGraph, projectToPairs, resourceId } from "./call-graph.js";
 export { buildReferenceFieldMap, isRefEntry, isScopeEntry } from "./reference-field-map.js";
 export { hasDeclaredUse, isRefSlot, isRefUse, possibleUses, readRefSlot, REF_USES, refSlotAnnotation, rewriteRefSlotKinds, transfersControl, } from "./ref-slot.js";
+export { binaryKeyword, isBinarySlot, X_TELO_BINARY } from "./binary-slot.js";
 export { hasProvidesZone, hasRequiresZone, readProvidesZone, readRequiresZone, rewriteRequiresZoneKind, } from "./zone-slot.js";
 export { deriveLibraryExportRequirements, projectZoneRequirements, runZoneAnalysis, zoneDocumentsSignature, } from "./resolve-zone-requirements.js";
 export { validateZoneSlotDeclarations } from "./validate-zone-slots.js";

package/dist/kernel-globals.d.ts

@@ -11,20 +11,34 @@ import type { ResourceManifest } from "@telorun/sdk";
  * and referencing `variables.X` / `secrets.X`.
  */
 export declare const KERNEL_GLOBAL_NAMES: readonly ["variables", "secrets", "resources", "ports"];
+/** Kernel globals as ONE resource's declaring module sees them. */
+export interface KernelGlobalsIndex {
+    forResource(m: ResourceManifest): Record<string, any>;
+}
 /**
- * Build a typed JSON Schema describing the kernel globals available in the
- * given manifest set. Used to merge into `x-telo-context` schemas so that
- * chain-access validation recognises kernel globals without module authors
+ * Build the typed JSON Schema describing the kernel globals available to each
+ * resource in a manifest set. Used to merge into `x-telo-context` schemas so
+ * that chain-access validation recognises kernel globals without module authors
  * having to re-declare them.
  *
- * - `variables` / `secrets`: typed from the root module doc — prefer
- *   Telo.Application when present, otherwise fall back to Telo.Library.
- *   Applications are the root whose variables/secrets contract governs CEL
- *   in the outer module; Libraries are only relevant when the caller scoped
- *   the manifest list to a single library's file.
- * - `resources`: enumerates all non-system resource names
+ * `variables` / `secrets` / `ports` are typed **per declaring module**, because
+ * that is the contract the resource's CEL is evaluated against at runtime. An
+ * application analysis is flattened — `selectModuleManifestsForAnalysis` drops
+ * an imported library's module doc and carries its config blocks across as
+ * `metadata.moduleGlobals` instead — so a resource forwarded from a library is
+ * typed from that stamp, and everything else from the entry module's own doc
+ * (the only module doc left in the set).
+ *
+ * Typing every resource from the entry doc is what made a library's
+ * `variables.x` a hard error the library author could not act on, and — in the
+ * other direction — let a library read a variable it never declared whenever the
+ * app happened to declare that name.
+ *
+ * `resources` is NOT per module: it enumerates every non-system resource name in
+ * the set, and stays OPEN for a forwarded manifest (see `readModuleGlobals` for
+ * why a name list cannot be carried across the boundary honestly).
  */
-export declare function buildKernelGlobalsSchema(manifests: ResourceManifest[], 
+export declare function buildKernelGlobalsIndex(manifests: ResourceManifest[], 
 /** Every resource a CEL read can name, including scope-declared ones (see
  *  `buildObservedStateIndex`). Kinds that declare a `status:` get a typed,
  *  closed `status` node; every other resource node stays open, so no flat read
@@ -32,7 +46,7 @@ export declare function buildKernelGlobalsSchema(manifests: ResourceManifest[],
 resources?: ReadonlyMap<string, {
     kind: string;
     status?: Record<string, any>;
-}>): Record<string, any>;
+}>): KernelGlobalsIndex;
 /**
  * Merge kernel globals into an `x-telo-context` schema so chain-access
  * validation recognises `variables`, `secrets`, `resources`, `ports`

package/dist/kernel-globals.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kernel-globals.d.ts","sourceRoot":"","sources":["../src/kernel-globals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIrD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,yDAA0D,CAAC;AAS3F;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,gBAAgB,EAAE;AAC7B;;;2CAG2C;AAC3C,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAC,GAC9E,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CA+CrB;AA4CD;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAClC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACjC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CASrB"}
+{"version":3,"file":"kernel-globals.d.ts","sourceRoot":"","sources":["../src/kernel-globals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIrD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,yDAA0D,CAAC;AAS3F,mEAAmE;AACnE,MAAM,WAAW,kBAAkB;IACjC,WAAW,CAAC,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACvD;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,gBAAgB,EAAE;AAC7B;;;2CAG2C;AAC3C,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAC,GAC9E,kBAAkB,CA0BpB;AAmGD;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAClC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACjC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CASrB"}

package/dist/kernel-globals.js

@@ -19,26 +19,68 @@ const SYSTEM_KINDS = new Set([
     "Telo.Abstract",
 ]);
 /**
- * Build a typed JSON Schema describing the kernel globals available in the
- * given manifest set. Used to merge into `x-telo-context` schemas so that
- * chain-access validation recognises kernel globals without module authors
+ * Build the typed JSON Schema describing the kernel globals available to each
+ * resource in a manifest set. Used to merge into `x-telo-context` schemas so
+ * that chain-access validation recognises kernel globals without module authors
  * having to re-declare them.
  *
- * - `variables` / `secrets`: typed from the root module doc — prefer
- *   Telo.Application when present, otherwise fall back to Telo.Library.
- *   Applications are the root whose variables/secrets contract governs CEL
- *   in the outer module; Libraries are only relevant when the caller scoped
- *   the manifest list to a single library's file.
- * - `resources`: enumerates all non-system resource names
+ * `variables` / `secrets` / `ports` are typed **per declaring module**, because
+ * that is the contract the resource's CEL is evaluated against at runtime. An
+ * application analysis is flattened — `selectModuleManifestsForAnalysis` drops
+ * an imported library's module doc and carries its config blocks across as
+ * `metadata.moduleGlobals` instead — so a resource forwarded from a library is
+ * typed from that stamp, and everything else from the entry module's own doc
+ * (the only module doc left in the set).
+ *
+ * Typing every resource from the entry doc is what made a library's
+ * `variables.x` a hard error the library author could not act on, and — in the
+ * other direction — let a library read a variable it never declared whenever the
+ * app happened to declare that name.
+ *
+ * `resources` is NOT per module: it enumerates every non-system resource name in
+ * the set, and stays OPEN for a forwarded manifest (see `readModuleGlobals` for
+ * why a name list cannot be carried across the boundary honestly).
  */
-export function buildKernelGlobalsSchema(manifests, 
+export function buildKernelGlobalsIndex(manifests, 
 /** Every resource a CEL read can name, including scope-declared ones (see
  *  `buildObservedStateIndex`). Kinds that declare a `status:` get a typed,
  *  closed `status` node; every other resource node stays open, so no flat read
  *  that passes today can start failing. */
 resources) {
-    const moduleManifest = manifests.find((m) => m.kind === "Telo.Application") ??
+    const entryDoc = manifests.find((m) => m.kind === "Telo.Application") ??
         manifests.find((m) => m.kind === "Telo.Library");
+    const entrySchema = globalsSchema(entryDoc, buildResourcesSchema(manifests, resources));
+    const openResources = { type: "object", additionalProperties: true };
+    const byModule = new Map();
+    return {
+        forResource(m) {
+            const meta = m.metadata;
+            const stamped = meta?.moduleGlobals;
+            if (!stamped)
+                return entrySchema;
+            const key = meta?.module ?? "";
+            const cached = byModule.get(key);
+            if (cached)
+                return cached;
+            const schema = globalsSchema(stamped, openResources);
+            byModule.set(key, schema);
+            return schema;
+        },
+    };
+}
+function globalsSchema(doc, resourcesSchema) {
+    return {
+        type: "object",
+        properties: {
+            variables: buildSchemaMapSchema(doc?.variables),
+            secrets: buildSchemaMapSchema(doc?.secrets),
+            resources: resourcesSchema,
+            ports: buildPortsSchema(doc?.ports),
+        },
+    };
+}
+/** Every non-system resource name in the set, plus the scope-declared ones. */
+function buildResourcesSchema(manifests, resources) {
     const resourceProps = {};
     for (const m of manifests) {
         const name = m.metadata?.name;
@@ -67,19 +109,7 @@ resources) {
             continue;
         applyObservedStateNode(resourceProps, key, entry.status);
     }
-    return {
-        type: "object",
-        properties: {
-            variables: buildSchemaMapSchema(moduleManifest?.variables),
-            secrets: buildSchemaMapSchema(moduleManifest?.secrets),
-            resources: {
-                type: "object",
-                properties: resourceProps,
-                additionalProperties: false,
-            },
-            ports: buildPortsSchema(moduleManifest?.ports),
-        },
-    };
+    return { type: "object", properties: resourceProps, additionalProperties: false };
 }
 /** Build the closed `ports` chain-access schema: each declared port is an
  *  integer, so `ports.<name>` resolves and `ports.typo` (or member access past

package/dist/schema-compat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-compat.d.ts","sourceRoot":"","sources":["../src/schema-compat.ts"],"names":[],"mappings":"AAIA,QAAA,MAAM,GAAG,KAA0C,CAAC;AAEpD;;;;;;;mCAOmC;AACnC,wBAAgB,SAAS,IAAI,YAAY,CAAC,OAAO,GAAG,CAAC,CAOpD;AAKD,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;oEAEoE;AACpE,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC1B,mBAAmB,CAIrB;AAiDD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAelD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAGxE;AAuBD,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;CACd;AAaD,0GAA0G;AAC1G,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,WAAW,EAAE,CA2B/F;AAED;qFACqF;AACrF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAQ7E;AAED;;;;6DAI6D;AAC7D,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,EAAE,MAAM,GACX,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAsBjC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGnD,CAAC;AAEF,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAGzF;AAED,8DAA8D;AAC9D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,CAyBnF;AAED,wFAAwF;AACxF,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAiChG;AAkED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAqC/E;AAqBD,0EAA0E;AAC1E,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAOtG;AAyDD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAwBlF;AAED;iGACiG;AACjG,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;AAChC;;;;;;;;6DAQ6D;AAC7D,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EACrC,IAAI,SAAK,GACR,OAAO,CAgDT"}
+{"version":3,"file":"schema-compat.d.ts","sourceRoot":"","sources":["../src/schema-compat.ts"],"names":[],"mappings":"AAKA,QAAA,MAAM,GAAG,KAA0C,CAAC;AAEpD;;;;;;;mCAOmC;AACnC,wBAAgB,SAAS,IAAI,YAAY,CAAC,OAAO,GAAG,CAAC,CAWpD;AAKD,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;oEAEoE;AACpE,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC1B,mBAAmB,CAIrB;AAiDD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAelD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAGxE;AAuBD,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;CACd;AAaD,0GAA0G;AAC1G,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,WAAW,EAAE,CA2B/F;AAED;qFACqF;AACrF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAQ7E;AAED;;;;6DAI6D;AAC7D,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,EAAE,MAAM,GACX,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAsBjC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGnD,CAAC;AAEF,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAGzF;AAED,8DAA8D;AAC9D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,CAyBnF;AAED,wFAAwF;AACxF,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAiChG;AAkED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CA0C/E;AAqBD,0EAA0E;AAC1E,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAOtG;AAyDD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAwBlF;AAED;iGACiG;AACjG,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;AAChC;;;;;;;;6DAQ6D;AAC7D,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EACrC,IAAI,SAAK,GACR,OAAO,CAgDT"}

package/dist/schema-compat.js

@@ -1,6 +1,7 @@
 import AjvModule from "ajv";
 import addFormats from "ajv-formats";
 import { isRefSentinel, isTaggedSentinel, ManifestRootSchema, normalizeRefSlots } from "@telorun/templating";
+import { binaryKeyword, isBinarySlot } from "./binary-slot.js";
 const Ajv = AjvModule.default ?? AjvModule;
 /** Creates a configured AJV instance (allErrors, strict: false, with formats).
  *  Also registers the kernel manifest root schema under `telo://manifest` so
@@ -15,6 +16,10 @@ export function createAjv() {
     addFormats.default
         ? addFormats.default(instance)
         : addFormats(instance);
+    // Bytes have no JSON Schema type, so the annotation carries the check. Registered
+    // here and in the kernel's validators from one definition, so a literal at a byte
+    // slot is rejected statically and at dispatch by the identical rule.
+    instance.addKeyword(binaryKeyword());
     instance.addSchema(ManifestRootSchema);
     return instance;
 }
@@ -352,6 +357,12 @@ function foldedConstraints(schema) {
 }
 export function celPlaceholderForSchema(rawSchema) {
     const schema = foldedConstraints(rawSchema);
+    // A byte slot's placeholder must BE bytes: the same keyword validates statically
+    // and at dispatch, so a CEL leaf standing in for a runtime buffer has to satisfy
+    // it. This is what keeps the rule single — a literal is rejected because no YAML
+    // literal is a Uint8Array, while a value arriving by reference passes.
+    if (isBinarySlot(schema))
+        return new Uint8Array();
     if (schema.default !== undefined)
         return schema.default;
     // An enum-constrained field needs a placeholder drawn from the enum: the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.55.0",
+  "version": "0.56.1",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",
@@ -48,7 +48,7 @@
     "@types/node": "^20.0.0",
     "typescript": "^5.0.0",
     "vitest": "^2.1.8",
-    "@telorun/sdk": "0.68.0"
+    "@telorun/sdk": "0.70.0"
   },
   "peerDependencies": {
     "@telorun/sdk": "*"

package/src/analyzer.ts

@@ -25,7 +25,7 @@ import {
 import { buildCallGraph } from "./call-graph.js";
 import { buildDependencyGraph, formatCycle } from "./dependency-graph.js";
 import {
-  buildKernelGlobalsSchema,
+  buildKernelGlobalsIndex,
   KERNEL_GLOBAL_NAMES,
   mergeKernelGlobalsIntoContext,
 } from "./kernel-globals.js";
@@ -1613,7 +1613,7 @@ export class StaticAnalyzer {
 
     // Build typed kernel globals schema so x-telo-context chain validation
     // recognises variables, secrets, resources, env automatically
-    const kernelGlobals = buildKernelGlobalsSchema(allManifests, observedState);
+    const kernelGlobals = buildKernelGlobalsIndex(allManifests, observedState);
 
     // Fallback context for CEL in a slot with no `x-telo-context` annotation:
     // everything stays open except the typed `.status` nodes, so unknown-field
@@ -1632,7 +1632,8 @@ export class StaticAnalyzer {
 
     // The module doc (Application/Library) carries the Application-only `ports`
     // namespace; threaded into per-resource CEL typing so `${{ ports.X }}`
-    // resolves its nominal brand cross-doc.
+    // resolves its nominal brand cross-doc. A flattened set holds exactly one —
+    // the entry's; see `buildKernelGlobalsSchema`.
     const moduleManifest =
       allManifests.find((mm) => mm.kind === "Telo.Application") ??
       allManifests.find((mm) => mm.kind === "Telo.Library");
@@ -2217,7 +2218,10 @@ export class StaticAnalyzer {
             });
             effectiveContext = mergeKernelGlobalsIntoContext(
               withBindingNames(resolvedContext, m as Record<string, any>),
-              kernelGlobals,
+              // Typed in the module that DECLARED this resource — for a manifest
+              // forwarded from an imported library, that is its `moduleGlobals`
+              // stamp, not the consuming application's block.
+              kernelGlobals.forResource(m),
             );
           } else if (observedStateContext) {
             // No `x-telo-context` matched, so nothing was chain-validated here

package/src/binary-slot.ts

@@ -0,0 +1,71 @@
+import * as AjvNS from "ajv";
+import type { KeywordDefinition } from "ajv";
+
+/**
+ * `x-telo-binary: true` — the annotation that gives a byte buffer a declared
+ * identity, and the single accessor every surface reads it through (the
+ * `ref-slot.ts` precedent).
+ *
+ * WHY AN ANNOTATION RATHER THAN A TYPE. Bytes are not expressible in JSON
+ * Schema's type vocabulary. `type: object` is the closest fit and it is a lie
+ * that costs a real check: every arbitrary object satisfies it, so a mistyped
+ * `content: { foo: bar }` reaches the controller instead of failing statically.
+ * `type: binary` would fix the honesty and break everything else — AJV refuses
+ * to compile an unknown type at all (`type must be JSONType or JSONType[]`),
+ * with no option to allow it, so the schema would produce no validator; and a
+ * published `telo.yaml` would stop being JSON Schema, which is what the hub, the
+ * editor and any third-party reader consume. An `x-` keyword is ignored by
+ * unaware tooling BY SPECIFICATION, so it degrades to "unconstrained" rather
+ * than to "cannot validate this kind at all".
+ *
+ * ONE RULE, BOTH HALVES. The keyword is implemented as AJV CODEGEN rather than a
+ * `validate` function so it inlines into standalone-compiled validators — the
+ * kernel compiles and caches those, and a function-valued keyword would not
+ * survive serialization. The analyzer registers the identical keyword, and
+ * `celPlaceholderForSchema` hands a real `Uint8Array` to a CEL leaf at a binary
+ * slot, so static and runtime agree by construction instead of by two rules kept
+ * in step. What falls out is the check the annotation exists for: **bytes can
+ * never be manifest-authored** — no YAML literal is a `Uint8Array` — so a literal
+ * at a binary slot is rejected while a value arriving by reference passes.
+ */
+
+export const X_TELO_BINARY = "x-telo-binary";
+
+/** True when this schema node declares its value to be raw bytes. */
+export function isBinarySlot(schema: unknown): boolean {
+  return (
+    typeof schema === "object" &&
+    schema !== null &&
+    (schema as Record<string, unknown>)[X_TELO_BINARY] === true
+  );
+}
+
+// AJV's codegen template tag. The package is consumed in both ESM and CJS interop
+// shapes, so the named export may sit on the namespace or behind `.default` —
+// the same fallback `schema-compat` uses to reach the constructor. Skipping it
+// would leave `codegen` undefined under a loader that does not detect AJV's named
+// CJS re-exports, and the keyword would throw on its first compile.
+type CodegenTag = (s: TemplateStringsArray, ...a: unknown[]) => unknown;
+const ajvExports = (AjvNS as any).default ?? AjvNS;
+const codegen: CodegenTag = ajvExports._ ?? (AjvNS as any)._;
+
+/**
+ * The AJV keyword. `Uint8Array` is the structural test rather than any richer
+ * notion of "binary": it is what every byte producer in the runtime hands over
+ * (`Buffer` extends it, so Node buffers pass), and it is the one check that means
+ * the same thing in a browser-side analyzer and in the kernel.
+ */
+export function binaryKeyword(): KeywordDefinition {
+  return {
+    keyword: X_TELO_BINARY,
+    schemaType: "boolean",
+    code(cxt: any) {
+      // `x-telo-binary: false` states nothing, so it constrains nothing.
+      if (cxt.schema !== true) return;
+      cxt.pass(codegen`${cxt.data} instanceof Uint8Array`);
+    },
+    error: {
+      message: "must be raw bytes (a Uint8Array) — bytes cannot be written inline in a manifest",
+    },
+  } as KeywordDefinition;
+}

package/src/flatten-for-analyzer.ts

@@ -41,7 +41,17 @@ export function parseExportEntry(entry: string): ParsedExportEntry {
  *  `byModuleName` and `!ref Alias.name` resolves, while `validate-references` /
  *  the per-resource validation loop never re-walk or re-validate it against the
  *  consumer's scope. A consumer that instead emits every module doc as a peer
- *  local manifest silently breaks both. */
+ *  local manifest silently breaks both.
+ *
+ *  Dropping the module doc costs the consumer's analysis the one thing a
+ *  forwarded manifest's CEL still needs: the `variables` / `secrets` / `ports`
+ *  contract its expressions are evaluated against. That contract is carried
+ *  across as {@link ModuleGlobals} on each forwarded manifest instead, so the
+ *  consumer can check those reads in the DECLARING module's scope rather than
+ *  either skipping them (a diagnostic performed nowhere) or judging them by its
+ *  own block (a hard error the library author cannot act on). Stamped here
+ *  because this is the only point where a manifest and its module doc are both
+ *  in hand — by the time `analyze()` sees the flat list, the doc is gone. */
 export function selectModuleManifestsForAnalysis(
   moduleManifests: ResourceManifest[],
   isRoot: boolean,
@@ -58,10 +68,12 @@ export function selectModuleManifestsForAnalysis(
     exportedResources.add(parseExportEntry(entry).name);
   }
 
+  const moduleGlobals = readModuleGlobals(libDoc);
+
   const out: ResourceManifest[] = [];
   for (const m of moduleManifests) {
     if (m.kind === "Telo.Definition" || m.kind === "Telo.Abstract" || m.kind === "Telo.Import") {
-      out.push(m);
+      out.push(withModuleGlobals(m, moduleGlobals));
     } else if (
       !isModuleKind(m.kind) &&
       typeof m.metadata?.name === "string" &&
@@ -69,13 +81,59 @@ export function selectModuleManifestsForAnalysis(
     ) {
       out.push({
         ...m,
-        metadata: { ...m.metadata, forwardedExport: true } as ResourceManifest["metadata"],
+        metadata: {
+          ...m.metadata,
+          forwardedExport: true,
+          ...(moduleGlobals ? { moduleGlobals } : {}),
+        } as ResourceManifest["metadata"],
       });
     }
   }
   return out;
 }
 
+/** The declaring module's config contract, carried on a forwarded manifest so
+ *  the consumer's analysis can type its CEL globals in the right scope. Only the
+ *  namespaces whose typing is scope-dependent: `resources` is deliberately
+ *  absent, see {@link readModuleGlobals}. */
+export interface ModuleGlobals {
+  variables?: Record<string, unknown>;
+  secrets?: Record<string, unknown>;
+  ports?: Record<string, unknown>;
+}
+
+/** Read the schema-map blocks off a module doc, or `undefined` when it declares
+ *  none (the globals then stay permissive, exactly as an absent doc does).
+ *
+ *  `resources` is NOT carried. The flat list holds only this module's EXPORTED
+ *  instances, so a name list built from it would omit every internal one — and a
+ *  `with:`-scoped resource is declared inline rather than as a doc, so it would
+ *  be missing too. Both would read as "no such resource" in a consumer's pass:
+ *  a false positive worse than the unchecked read it replaced. The consumer
+ *  leaves a forwarded manifest's `resources` node open and the library's own
+ *  analysis, which sees every name, does that check. */
+function readModuleGlobals(libDoc: ResourceManifest | undefined): ModuleGlobals | undefined {
+  const doc = libDoc as Record<string, any> | undefined;
+  if (!doc) return undefined;
+  const globals: ModuleGlobals = {};
+  for (const key of ["variables", "secrets", "ports"] as const) {
+    const block = doc[key];
+    if (block && typeof block === "object" && !Array.isArray(block)) globals[key] = block;
+  }
+  return Object.keys(globals).length > 0 ? globals : undefined;
+}
+
+function withModuleGlobals(
+  m: ResourceManifest,
+  moduleGlobals: ModuleGlobals | undefined,
+): ResourceManifest {
+  if (!moduleGlobals) return m;
+  return {
+    ...m,
+    metadata: { ...m.metadata, moduleGlobals } as ResourceManifest["metadata"],
+  };
+}
+
 /** Produce the flat manifest list `analyze()` consumes today.
  *
  *  Combines the entry module's manifests with `Telo.Definition`,

package/src/index.ts

@@ -97,6 +97,7 @@ export {
   transfersControl,
 } from "./ref-slot.js";
 export type { RefSlot, RefUse, RefUseCases } from "./ref-slot.js";
+export { binaryKeyword, isBinarySlot, X_TELO_BINARY } from "./binary-slot.js";
 export {
   hasProvidesZone,
   hasRequiresZone,

package/src/kernel-globals.ts

@@ -22,28 +22,43 @@ const SYSTEM_KINDS = new Set([
   "Telo.Abstract",
 ]);
 
+/** Kernel globals as ONE resource's declaring module sees them. */
+export interface KernelGlobalsIndex {
+  forResource(m: ResourceManifest): Record<string, any>;
+}
+
 /**
- * Build a typed JSON Schema describing the kernel globals available in the
- * given manifest set. Used to merge into `x-telo-context` schemas so that
- * chain-access validation recognises kernel globals without module authors
+ * Build the typed JSON Schema describing the kernel globals available to each
+ * resource in a manifest set. Used to merge into `x-telo-context` schemas so
+ * that chain-access validation recognises kernel globals without module authors
  * having to re-declare them.
  *
- * - `variables` / `secrets`: typed from the root module doc — prefer
- *   Telo.Application when present, otherwise fall back to Telo.Library.
- *   Applications are the root whose variables/secrets contract governs CEL
- *   in the outer module; Libraries are only relevant when the caller scoped
- *   the manifest list to a single library's file.
- * - `resources`: enumerates all non-system resource names
+ * `variables` / `secrets` / `ports` are typed **per declaring module**, because
+ * that is the contract the resource's CEL is evaluated against at runtime. An
+ * application analysis is flattened — `selectModuleManifestsForAnalysis` drops
+ * an imported library's module doc and carries its config blocks across as
+ * `metadata.moduleGlobals` instead — so a resource forwarded from a library is
+ * typed from that stamp, and everything else from the entry module's own doc
+ * (the only module doc left in the set).
+ *
+ * Typing every resource from the entry doc is what made a library's
+ * `variables.x` a hard error the library author could not act on, and — in the
+ * other direction — let a library read a variable it never declared whenever the
+ * app happened to declare that name.
+ *
+ * `resources` is NOT per module: it enumerates every non-system resource name in
+ * the set, and stays OPEN for a forwarded manifest (see `readModuleGlobals` for
+ * why a name list cannot be carried across the boundary honestly).
  */
-export function buildKernelGlobalsSchema(
+export function buildKernelGlobalsIndex(
   manifests: ResourceManifest[],
   /** Every resource a CEL read can name, including scope-declared ones (see
    *  `buildObservedStateIndex`). Kinds that declare a `status:` get a typed,
    *  closed `status` node; every other resource node stays open, so no flat read
    *  that passes today can start failing. */
   resources?: ReadonlyMap<string, { kind: string; status?: Record<string, any> }>,
-): Record<string, any> {
-  const moduleManifest =
+): KernelGlobalsIndex {
+  const entryDoc =
     (manifests.find((m) => m.kind === "Telo.Application") as
       | Record<string, any>
       | undefined) ??
@@ -51,6 +66,52 @@ export function buildKernelGlobalsSchema(
       | Record<string, any>
       | undefined);
 
+  const entrySchema = globalsSchema(entryDoc, buildResourcesSchema(manifests, resources));
+  const openResources = { type: "object", additionalProperties: true };
+  const byModule = new Map<string, Record<string, any>>();
+
+  return {
+    forResource(m: ResourceManifest): Record<string, any> {
+      const meta = m.metadata as { module?: string; moduleGlobals?: ModuleGlobals } | undefined;
+      const stamped = meta?.moduleGlobals;
+      if (!stamped) return entrySchema;
+      const key = meta?.module ?? "";
+      const cached = byModule.get(key);
+      if (cached) return cached;
+      const schema = globalsSchema(stamped, openResources);
+      byModule.set(key, schema);
+      return schema;
+    },
+  };
+}
+
+/** The blocks a declaring module contributes to its resources' CEL globals. */
+interface ModuleGlobals {
+  variables?: Record<string, unknown>;
+  secrets?: Record<string, unknown>;
+  ports?: Record<string, unknown>;
+}
+
+function globalsSchema(
+  doc: ModuleGlobals | Record<string, any> | undefined,
+  resourcesSchema: Record<string, any>,
+): Record<string, any> {
+  return {
+    type: "object",
+    properties: {
+      variables: buildSchemaMapSchema(doc?.variables as Record<string, any> | undefined),
+      secrets: buildSchemaMapSchema(doc?.secrets as Record<string, any> | undefined),
+      resources: resourcesSchema,
+      ports: buildPortsSchema(doc?.ports as Record<string, any> | undefined),
+    },
+  };
+}
+
+/** Every non-system resource name in the set, plus the scope-declared ones. */
+function buildResourcesSchema(
+  manifests: ResourceManifest[],
+  resources?: ReadonlyMap<string, { kind: string; status?: Record<string, any> }>,
+): Record<string, any> {
   const resourceProps: Record<string, any> = {};
   for (const m of manifests) {
     const name = m.metadata?.name as string | undefined;
@@ -76,19 +137,7 @@ export function buildKernelGlobalsSchema(
     applyObservedStateNode(resourceProps, key, entry.status);
   }
 
-  return {
-    type: "object",
-    properties: {
-      variables: buildSchemaMapSchema(moduleManifest?.variables),
-      secrets: buildSchemaMapSchema(moduleManifest?.secrets),
-      resources: {
-        type: "object",
-        properties: resourceProps,
-        additionalProperties: false,
-      },
-      ports: buildPortsSchema(moduleManifest?.ports),
-    },
-  };
+  return { type: "object", properties: resourceProps, additionalProperties: false };
 }
 
 /** Build the closed `ports` chain-access schema: each declared port is an

package/src/schema-compat.ts

@@ -1,6 +1,7 @@
 import AjvModule from "ajv";
 import addFormats from "ajv-formats";
 import { isRefSentinel, isTaggedSentinel, ManifestRootSchema, normalizeRefSlots } from "@telorun/templating";
+import { binaryKeyword, isBinarySlot } from "./binary-slot.js";
 
 const Ajv = (AjvModule as any).default ?? AjvModule;
 
@@ -17,6 +18,10 @@ export function createAjv(): InstanceType<typeof Ajv> {
   (addFormats as any).default
     ? (addFormats as any).default(instance)
     : (addFormats as any)(instance);
+  // Bytes have no JSON Schema type, so the annotation carries the check. Registered
+  // here and in the kernel's validators from one definition, so a literal at a byte
+  // slot is rejected statically and at dispatch by the identical rule.
+  instance.addKeyword(binaryKeyword());
   instance.addSchema(ManifestRootSchema);
   return instance;
 }
@@ -371,6 +376,11 @@ function foldedConstraints(schema: Record<string, any>): Record<string, any> {
 
 export function celPlaceholderForSchema(rawSchema: Record<string, any>): unknown {
   const schema = foldedConstraints(rawSchema);
+  // A byte slot's placeholder must BE bytes: the same keyword validates statically
+  // and at dispatch, so a CEL leaf standing in for a runtime buffer has to satisfy
+  // it. This is what keeps the rule single — a literal is rejected because no YAML
+  // literal is a Uint8Array, while a value arriving by reference passes.
+  if (isBinarySlot(schema)) return new Uint8Array();
   if (schema.default !== undefined) return schema.default;
   // An enum-constrained field needs a placeholder drawn from the enum: the
   // type-based fallbacks below ("" for a string, 0 for a number) satisfy `type`