@telorun/analyzer 0.56.0 → 0.56.1

package/README.md

@@ -23,9 +23,9 @@ Built to be language-agnostic and infinitely extensible.
 
 ```bash
 # Reconcile your manifest into a running backend
-$ telo ./examples/hello-api
+$ telo ./examples/todo-app
 
-{"level":30,"time":1771610393008,"pid":1310178,"hostname":"dev","msg":"Server listening at http://127.0.0.1:8844"}
+{"level":30,"time":1771610393008,"pid":1310178,"hostname":"dev","msg":"Server listening at http://127.0.0.1:8077"}
 ```
 
 ## Why use Telo?

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIzE,OAAO,EACL,aAAa,EAEb,KAAK,YAAY,EAElB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EACL,KAAK,aAAa,EAGnB,MAAM,0BAA0B,CAAC;AAsBlC,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAiBvF,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAqF/F;;;;;uDAKuD;AACvD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,aAAa,GAAG;IAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAA;CAAE,CAO9F;AA6FD;0CAC0C;AAC1C,eAAO,MAAM,eAAe,GAAI,OAAO;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OACT,CAAC;AAErD;8EAC8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhD;AAuBD;2DAC2D;AAC3D,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACvC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CASjC;AAED;4EAC4E;AAC5E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAmBvG;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,OAAO,EAAE,EAChB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EAC/C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,GAC3D,IAAI,CAiDN;AA8mBD,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAywCvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAyBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIzE,OAAO,EACL,aAAa,EAEb,KAAK,YAAY,EAElB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EACL,KAAK,aAAa,EAGnB,MAAM,0BAA0B,CAAC;AAsBlC,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAiBvF,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAqF/F;;;;;uDAKuD;AACvD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,aAAa,GAAG;IAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAA;CAAE,CAO9F;AA6FD;0CAC0C;AAC1C,eAAO,MAAM,eAAe,GAAI,OAAO;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OACT,CAAC;AAErD;8EAC8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhD;AAuBD;2DAC2D;AAC3D,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACvC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CASjC;AAED;4EAC4E;AAC5E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAmBvG;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,OAAO,EAAE,EAChB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EAC/C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,GAC3D,IAAI,CAiDN;AA8mBD,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IA6wCvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAyBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -7,7 +7,7 @@ import { effectiveAuthorSchema } from "./extends-resolution.js";
 import { PERMISSIVE_CONTRACT, resolveContract, } from "./invocation-contract.js";
 import { buildCallGraph } from "./call-graph.js";
 import { buildDependencyGraph, formatCycle } from "./dependency-graph.js";
-import { buildKernelGlobalsSchema, KERNEL_GLOBAL_NAMES, mergeKernelGlobalsIntoContext, } from "./kernel-globals.js";
+import { buildKernelGlobalsIndex, KERNEL_GLOBAL_NAMES, mergeKernelGlobalsIntoContext, } from "./kernel-globals.js";
 import { buildObservedStateIndex, buildObservedStateResourcesSchema, collectRunReachableNames, observedStateRead, validateObservedStateDeclarations, } from "./validate-observed-state.js";
 import { computeSuggestKind } from "./kind-suggest.js";
 import { visitManifest } from "./manifest-visitor.js";
@@ -1361,7 +1361,7 @@ export class StaticAnalyzer {
             : new Set();
         // Build typed kernel globals schema so x-telo-context chain validation
         // recognises variables, secrets, resources, env automatically
-        const kernelGlobals = buildKernelGlobalsSchema(allManifests, observedState);
+        const kernelGlobals = buildKernelGlobalsIndex(allManifests, observedState);
         // Fallback context for CEL in a slot with no `x-telo-context` annotation:
         // everything stays open except the typed `.status` nodes, so unknown-field
         // checking reaches observed state everywhere without newly rejecting any
@@ -1377,7 +1377,8 @@ export class StaticAnalyzer {
             : null;
         // The module doc (Application/Library) carries the Application-only `ports`
         // namespace; threaded into per-resource CEL typing so `${{ ports.X }}`
-        // resolves its nominal brand cross-doc.
+        // resolves its nominal brand cross-doc. A flattened set holds exactly one —
+        // the entry's; see `buildKernelGlobalsSchema`.
         const moduleManifest = allManifests.find((mm) => mm.kind === "Telo.Application") ??
             allManifests.find((mm) => mm.kind === "Telo.Library");
         // Validate each non-definition, non-system resource
@@ -1849,7 +1850,11 @@ export class StaticAnalyzer {
                         aliases,
                         allManifests: allManifests,
                     });
-                    effectiveContext = mergeKernelGlobalsIntoContext(withBindingNames(resolvedContext, m), kernelGlobals);
+                    effectiveContext = mergeKernelGlobalsIntoContext(withBindingNames(resolvedContext, m), 
+                    // Typed in the module that DECLARED this resource — for a manifest
+                    // forwarded from an imported library, that is its `moduleGlobals`
+                    // stamp, not the consuming application's block.
+                    kernelGlobals.forResource(m));
                 }
                 else if (observedStateContext) {
                     // No `x-telo-context` matched, so nothing was chain-validated here

package/dist/flatten-for-analyzer.d.ts

@@ -33,8 +33,27 @@ export declare function parseExportEntry(entry: string): ParsedExportEntry;
  *  `byModuleName` and `!ref Alias.name` resolves, while `validate-references` /
  *  the per-resource validation loop never re-walk or re-validate it against the
  *  consumer's scope. A consumer that instead emits every module doc as a peer
- *  local manifest silently breaks both. */
+ *  local manifest silently breaks both.
+ *
+ *  Dropping the module doc costs the consumer's analysis the one thing a
+ *  forwarded manifest's CEL still needs: the `variables` / `secrets` / `ports`
+ *  contract its expressions are evaluated against. That contract is carried
+ *  across as {@link ModuleGlobals} on each forwarded manifest instead, so the
+ *  consumer can check those reads in the DECLARING module's scope rather than
+ *  either skipping them (a diagnostic performed nowhere) or judging them by its
+ *  own block (a hard error the library author cannot act on). Stamped here
+ *  because this is the only point where a manifest and its module doc are both
+ *  in hand — by the time `analyze()` sees the flat list, the doc is gone. */
 export declare function selectModuleManifestsForAnalysis(moduleManifests: ResourceManifest[], isRoot: boolean): ResourceManifest[];
+/** The declaring module's config contract, carried on a forwarded manifest so
+ *  the consumer's analysis can type its CEL globals in the right scope. Only the
+ *  namespaces whose typing is scope-dependent: `resources` is deliberately
+ *  absent, see {@link readModuleGlobals}. */
+export interface ModuleGlobals {
+    variables?: Record<string, unknown>;
+    secrets?: Record<string, unknown>;
+    ports?: Record<string, unknown>;
+}
 /** Produce the flat manifest list `analyze()` consumes today.
  *
  *  Combines the entry module's manifests with `Telo.Definition`,

package/dist/flatten-for-analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flatten-for-analyzer.d.ts","sourceRoot":"","sources":["../src/flatten-for-analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEtE;;yEAEyE;AACzE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;4CAI4C;AAC5C,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAGjE;AAED;;;;;;;;;;;;;;;;;;;2CAmB2C;AAC3C,wBAAgB,gCAAgC,CAC9C,eAAe,EAAE,gBAAgB,EAAE,EACnC,MAAM,EAAE,OAAO,GACd,gBAAgB,EAAE,CA6BpB;AAED;;;;;;;;;;;;;;;;;;;6EAmB6E;AAC7E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,gBAAgB,EAAE,CAiDzE;AAED;;uBAEuB;AACvB,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;qEAEqE;AACrE,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,GAC/C,YAAY,EAAE,CAShB;AAED;;;;;;uFAMuF;AACvF,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,gBAAgB,EAAE,EAC1B,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACnE,IAAI,CAgDN;AAED;;;;0EAI0E;AAC1E,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;CAAE,CAAC,EACvF,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACnE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA2ClC;AAED;;;;;4DAK4D;AAC5D,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,CAAC;IAAE,QAAQ,EAAE,gBAAgB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,EAC5E,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC9C,IAAI,CAWN;AAED;;;;;;;;;;;;;;iGAciG;AACjG,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,aAAa,CAAC;IAAE,QAAQ,EAAE,gBAAgB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,EAC5E,aAAa,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,GACpD,IAAI,CAMN;AAgDD;;;;;oEAKoE;AACpE,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,WAAW,GAAG,mBAAmB,EAAE,CAuBpF;AAED;;;;;6BAK6B;AAC7B,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,YAAY,GAAG,gBAAgB,EAAE,CAEzE"}
+{"version":3,"file":"flatten-for-analyzer.d.ts","sourceRoot":"","sources":["../src/flatten-for-analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEtE;;yEAEyE;AACzE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;4CAI4C;AAC5C,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAGjE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6EA6B6E;AAC7E,wBAAgB,gCAAgC,CAC9C,eAAe,EAAE,gBAAgB,EAAE,EACnC,MAAM,EAAE,OAAO,GACd,gBAAgB,EAAE,CAmCpB;AAED;;;6CAG6C;AAC7C,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAkCD;;;;;;;;;;;;;;;;;;;6EAmB6E;AAC7E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,gBAAgB,EAAE,CAiDzE;AAED;;uBAEuB;AACvB,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;qEAEqE;AACrE,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,GAC/C,YAAY,EAAE,CAShB;AAED;;;;;;uFAMuF;AACvF,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,gBAAgB,EAAE,EAC1B,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACnE,IAAI,CAgDN;AAED;;;;0EAI0E;AAC1E,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;CAAE,CAAC,EACvF,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACnE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA2ClC;AAED;;;;;4DAK4D;AAC5D,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,CAAC;IAAE,QAAQ,EAAE,gBAAgB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,EAC5E,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC9C,IAAI,CAWN;AAED;;;;;;;;;;;;;;iGAciG;AACjG,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,aAAa,CAAC;IAAE,QAAQ,EAAE,gBAAgB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,EAC5E,aAAa,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,GACpD,IAAI,CAMN;AAgDD;;;;;oEAKoE;AACpE,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,WAAW,GAAG,mBAAmB,EAAE,CAuBpF;AAED;;;;;6BAK6B;AAC7B,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,YAAY,GAAG,gBAAgB,EAAE,CAEzE"}

package/dist/flatten-for-analyzer.js

@@ -27,7 +27,17 @@ export function parseExportEntry(entry) {
  *  `byModuleName` and `!ref Alias.name` resolves, while `validate-references` /
  *  the per-resource validation loop never re-walk or re-validate it against the
  *  consumer's scope. A consumer that instead emits every module doc as a peer
- *  local manifest silently breaks both. */
+ *  local manifest silently breaks both.
+ *
+ *  Dropping the module doc costs the consumer's analysis the one thing a
+ *  forwarded manifest's CEL still needs: the `variables` / `secrets` / `ports`
+ *  contract its expressions are evaluated against. That contract is carried
+ *  across as {@link ModuleGlobals} on each forwarded manifest instead, so the
+ *  consumer can check those reads in the DECLARING module's scope rather than
+ *  either skipping them (a diagnostic performed nowhere) or judging them by its
+ *  own block (a hard error the library author cannot act on). Stamped here
+ *  because this is the only point where a manifest and its module doc are both
+ *  in hand — by the time `analyze()` sees the flat list, the doc is gone. */
 export function selectModuleManifestsForAnalysis(moduleManifests, isRoot) {
     if (isRoot)
         return moduleManifests;
@@ -41,22 +51,57 @@ export function selectModuleManifestsForAnalysis(moduleManifests, isRoot) {
             continue;
         exportedResources.add(parseExportEntry(entry).name);
     }
+    const moduleGlobals = readModuleGlobals(libDoc);
     const out = [];
     for (const m of moduleManifests) {
         if (m.kind === "Telo.Definition" || m.kind === "Telo.Abstract" || m.kind === "Telo.Import") {
-            out.push(m);
+            out.push(withModuleGlobals(m, moduleGlobals));
         }
         else if (!isModuleKind(m.kind) &&
             typeof m.metadata?.name === "string" &&
             exportedResources.has(m.metadata.name)) {
             out.push({
                 ...m,
-                metadata: { ...m.metadata, forwardedExport: true },
+                metadata: {
+                    ...m.metadata,
+                    forwardedExport: true,
+                    ...(moduleGlobals ? { moduleGlobals } : {}),
+                },
             });
         }
     }
     return out;
 }
+/** Read the schema-map blocks off a module doc, or `undefined` when it declares
+ *  none (the globals then stay permissive, exactly as an absent doc does).
+ *
+ *  `resources` is NOT carried. The flat list holds only this module's EXPORTED
+ *  instances, so a name list built from it would omit every internal one — and a
+ *  `with:`-scoped resource is declared inline rather than as a doc, so it would
+ *  be missing too. Both would read as "no such resource" in a consumer's pass:
+ *  a false positive worse than the unchecked read it replaced. The consumer
+ *  leaves a forwarded manifest's `resources` node open and the library's own
+ *  analysis, which sees every name, does that check. */
+function readModuleGlobals(libDoc) {
+    const doc = libDoc;
+    if (!doc)
+        return undefined;
+    const globals = {};
+    for (const key of ["variables", "secrets", "ports"]) {
+        const block = doc[key];
+        if (block && typeof block === "object" && !Array.isArray(block))
+            globals[key] = block;
+    }
+    return Object.keys(globals).length > 0 ? globals : undefined;
+}
+function withModuleGlobals(m, moduleGlobals) {
+    if (!moduleGlobals)
+        return m;
+    return {
+        ...m,
+        metadata: { ...m.metadata, moduleGlobals },
+    };
+}
 /** Produce the flat manifest list `analyze()` consumes today.
  *
  *  Combines the entry module's manifests with `Telo.Definition`,

package/dist/kernel-globals.d.ts

@@ -11,20 +11,34 @@ import type { ResourceManifest } from "@telorun/sdk";
  * and referencing `variables.X` / `secrets.X`.
  */
 export declare const KERNEL_GLOBAL_NAMES: readonly ["variables", "secrets", "resources", "ports"];
+/** Kernel globals as ONE resource's declaring module sees them. */
+export interface KernelGlobalsIndex {
+    forResource(m: ResourceManifest): Record<string, any>;
+}
 /**
- * Build a typed JSON Schema describing the kernel globals available in the
- * given manifest set. Used to merge into `x-telo-context` schemas so that
- * chain-access validation recognises kernel globals without module authors
+ * Build the typed JSON Schema describing the kernel globals available to each
+ * resource in a manifest set. Used to merge into `x-telo-context` schemas so
+ * that chain-access validation recognises kernel globals without module authors
  * having to re-declare them.
  *
- * - `variables` / `secrets`: typed from the root module doc — prefer
- *   Telo.Application when present, otherwise fall back to Telo.Library.
- *   Applications are the root whose variables/secrets contract governs CEL
- *   in the outer module; Libraries are only relevant when the caller scoped
- *   the manifest list to a single library's file.
- * - `resources`: enumerates all non-system resource names
+ * `variables` / `secrets` / `ports` are typed **per declaring module**, because
+ * that is the contract the resource's CEL is evaluated against at runtime. An
+ * application analysis is flattened — `selectModuleManifestsForAnalysis` drops
+ * an imported library's module doc and carries its config blocks across as
+ * `metadata.moduleGlobals` instead — so a resource forwarded from a library is
+ * typed from that stamp, and everything else from the entry module's own doc
+ * (the only module doc left in the set).
+ *
+ * Typing every resource from the entry doc is what made a library's
+ * `variables.x` a hard error the library author could not act on, and — in the
+ * other direction — let a library read a variable it never declared whenever the
+ * app happened to declare that name.
+ *
+ * `resources` is NOT per module: it enumerates every non-system resource name in
+ * the set, and stays OPEN for a forwarded manifest (see `readModuleGlobals` for
+ * why a name list cannot be carried across the boundary honestly).
  */
-export declare function buildKernelGlobalsSchema(manifests: ResourceManifest[], 
+export declare function buildKernelGlobalsIndex(manifests: ResourceManifest[], 
 /** Every resource a CEL read can name, including scope-declared ones (see
  *  `buildObservedStateIndex`). Kinds that declare a `status:` get a typed,
  *  closed `status` node; every other resource node stays open, so no flat read
@@ -32,7 +46,7 @@ export declare function buildKernelGlobalsSchema(manifests: ResourceManifest[],
 resources?: ReadonlyMap<string, {
     kind: string;
     status?: Record<string, any>;
-}>): Record<string, any>;
+}>): KernelGlobalsIndex;
 /**
  * Merge kernel globals into an `x-telo-context` schema so chain-access
  * validation recognises `variables`, `secrets`, `resources`, `ports`

package/dist/kernel-globals.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kernel-globals.d.ts","sourceRoot":"","sources":["../src/kernel-globals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIrD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,yDAA0D,CAAC;AAS3F;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,gBAAgB,EAAE;AAC7B;;;2CAG2C;AAC3C,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAC,GAC9E,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CA+CrB;AA4CD;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAClC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACjC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CASrB"}
+{"version":3,"file":"kernel-globals.d.ts","sourceRoot":"","sources":["../src/kernel-globals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIrD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,yDAA0D,CAAC;AAS3F,mEAAmE;AACnE,MAAM,WAAW,kBAAkB;IACjC,WAAW,CAAC,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACvD;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,gBAAgB,EAAE;AAC7B;;;2CAG2C;AAC3C,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAC,GAC9E,kBAAkB,CA0BpB;AAmGD;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAClC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACjC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CASrB"}

package/dist/kernel-globals.js

@@ -19,26 +19,68 @@ const SYSTEM_KINDS = new Set([
     "Telo.Abstract",
 ]);
 /**
- * Build a typed JSON Schema describing the kernel globals available in the
- * given manifest set. Used to merge into `x-telo-context` schemas so that
- * chain-access validation recognises kernel globals without module authors
+ * Build the typed JSON Schema describing the kernel globals available to each
+ * resource in a manifest set. Used to merge into `x-telo-context` schemas so
+ * that chain-access validation recognises kernel globals without module authors
  * having to re-declare them.
  *
- * - `variables` / `secrets`: typed from the root module doc — prefer
- *   Telo.Application when present, otherwise fall back to Telo.Library.
- *   Applications are the root whose variables/secrets contract governs CEL
- *   in the outer module; Libraries are only relevant when the caller scoped
- *   the manifest list to a single library's file.
- * - `resources`: enumerates all non-system resource names
+ * `variables` / `secrets` / `ports` are typed **per declaring module**, because
+ * that is the contract the resource's CEL is evaluated against at runtime. An
+ * application analysis is flattened — `selectModuleManifestsForAnalysis` drops
+ * an imported library's module doc and carries its config blocks across as
+ * `metadata.moduleGlobals` instead — so a resource forwarded from a library is
+ * typed from that stamp, and everything else from the entry module's own doc
+ * (the only module doc left in the set).
+ *
+ * Typing every resource from the entry doc is what made a library's
+ * `variables.x` a hard error the library author could not act on, and — in the
+ * other direction — let a library read a variable it never declared whenever the
+ * app happened to declare that name.
+ *
+ * `resources` is NOT per module: it enumerates every non-system resource name in
+ * the set, and stays OPEN for a forwarded manifest (see `readModuleGlobals` for
+ * why a name list cannot be carried across the boundary honestly).
  */
-export function buildKernelGlobalsSchema(manifests, 
+export function buildKernelGlobalsIndex(manifests, 
 /** Every resource a CEL read can name, including scope-declared ones (see
  *  `buildObservedStateIndex`). Kinds that declare a `status:` get a typed,
  *  closed `status` node; every other resource node stays open, so no flat read
  *  that passes today can start failing. */
 resources) {
-    const moduleManifest = manifests.find((m) => m.kind === "Telo.Application") ??
+    const entryDoc = manifests.find((m) => m.kind === "Telo.Application") ??
         manifests.find((m) => m.kind === "Telo.Library");
+    const entrySchema = globalsSchema(entryDoc, buildResourcesSchema(manifests, resources));
+    const openResources = { type: "object", additionalProperties: true };
+    const byModule = new Map();
+    return {
+        forResource(m) {
+            const meta = m.metadata;
+            const stamped = meta?.moduleGlobals;
+            if (!stamped)
+                return entrySchema;
+            const key = meta?.module ?? "";
+            const cached = byModule.get(key);
+            if (cached)
+                return cached;
+            const schema = globalsSchema(stamped, openResources);
+            byModule.set(key, schema);
+            return schema;
+        },
+    };
+}
+function globalsSchema(doc, resourcesSchema) {
+    return {
+        type: "object",
+        properties: {
+            variables: buildSchemaMapSchema(doc?.variables),
+            secrets: buildSchemaMapSchema(doc?.secrets),
+            resources: resourcesSchema,
+            ports: buildPortsSchema(doc?.ports),
+        },
+    };
+}
+/** Every non-system resource name in the set, plus the scope-declared ones. */
+function buildResourcesSchema(manifests, resources) {
     const resourceProps = {};
     for (const m of manifests) {
         const name = m.metadata?.name;
@@ -67,19 +109,7 @@ resources) {
             continue;
         applyObservedStateNode(resourceProps, key, entry.status);
     }
-    return {
-        type: "object",
-        properties: {
-            variables: buildSchemaMapSchema(moduleManifest?.variables),
-            secrets: buildSchemaMapSchema(moduleManifest?.secrets),
-            resources: {
-                type: "object",
-                properties: resourceProps,
-                additionalProperties: false,
-            },
-            ports: buildPortsSchema(moduleManifest?.ports),
-        },
-    };
+    return { type: "object", properties: resourceProps, additionalProperties: false };
 }
 /** Build the closed `ports` chain-access schema: each declared port is an
  *  integer, so `ports.<name>` resolves and `ports.typo` (or member access past

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.56.0",
+  "version": "0.56.1",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",
@@ -48,7 +48,7 @@
     "@types/node": "^20.0.0",
     "typescript": "^5.0.0",
     "vitest": "^2.1.8",
-    "@telorun/sdk": "0.68.0"
+    "@telorun/sdk": "0.70.0"
   },
   "peerDependencies": {
     "@telorun/sdk": "*"

package/src/analyzer.ts

@@ -25,7 +25,7 @@ import {
 import { buildCallGraph } from "./call-graph.js";
 import { buildDependencyGraph, formatCycle } from "./dependency-graph.js";
 import {
-  buildKernelGlobalsSchema,
+  buildKernelGlobalsIndex,
   KERNEL_GLOBAL_NAMES,
   mergeKernelGlobalsIntoContext,
 } from "./kernel-globals.js";
@@ -1613,7 +1613,7 @@ export class StaticAnalyzer {
 
     // Build typed kernel globals schema so x-telo-context chain validation
     // recognises variables, secrets, resources, env automatically
-    const kernelGlobals = buildKernelGlobalsSchema(allManifests, observedState);
+    const kernelGlobals = buildKernelGlobalsIndex(allManifests, observedState);
 
     // Fallback context for CEL in a slot with no `x-telo-context` annotation:
     // everything stays open except the typed `.status` nodes, so unknown-field
@@ -1632,7 +1632,8 @@ export class StaticAnalyzer {
 
     // The module doc (Application/Library) carries the Application-only `ports`
     // namespace; threaded into per-resource CEL typing so `${{ ports.X }}`
-    // resolves its nominal brand cross-doc.
+    // resolves its nominal brand cross-doc. A flattened set holds exactly one —
+    // the entry's; see `buildKernelGlobalsSchema`.
     const moduleManifest =
       allManifests.find((mm) => mm.kind === "Telo.Application") ??
       allManifests.find((mm) => mm.kind === "Telo.Library");
@@ -2217,7 +2218,10 @@ export class StaticAnalyzer {
             });
             effectiveContext = mergeKernelGlobalsIntoContext(
               withBindingNames(resolvedContext, m as Record<string, any>),
-              kernelGlobals,
+              // Typed in the module that DECLARED this resource — for a manifest
+              // forwarded from an imported library, that is its `moduleGlobals`
+              // stamp, not the consuming application's block.
+              kernelGlobals.forResource(m),
             );
           } else if (observedStateContext) {
             // No `x-telo-context` matched, so nothing was chain-validated here

package/src/flatten-for-analyzer.ts

@@ -41,7 +41,17 @@ export function parseExportEntry(entry: string): ParsedExportEntry {
  *  `byModuleName` and `!ref Alias.name` resolves, while `validate-references` /
  *  the per-resource validation loop never re-walk or re-validate it against the
  *  consumer's scope. A consumer that instead emits every module doc as a peer
- *  local manifest silently breaks both. */
+ *  local manifest silently breaks both.
+ *
+ *  Dropping the module doc costs the consumer's analysis the one thing a
+ *  forwarded manifest's CEL still needs: the `variables` / `secrets` / `ports`
+ *  contract its expressions are evaluated against. That contract is carried
+ *  across as {@link ModuleGlobals} on each forwarded manifest instead, so the
+ *  consumer can check those reads in the DECLARING module's scope rather than
+ *  either skipping them (a diagnostic performed nowhere) or judging them by its
+ *  own block (a hard error the library author cannot act on). Stamped here
+ *  because this is the only point where a manifest and its module doc are both
+ *  in hand — by the time `analyze()` sees the flat list, the doc is gone. */
 export function selectModuleManifestsForAnalysis(
   moduleManifests: ResourceManifest[],
   isRoot: boolean,
@@ -58,10 +68,12 @@ export function selectModuleManifestsForAnalysis(
     exportedResources.add(parseExportEntry(entry).name);
   }
 
+  const moduleGlobals = readModuleGlobals(libDoc);
+
   const out: ResourceManifest[] = [];
   for (const m of moduleManifests) {
     if (m.kind === "Telo.Definition" || m.kind === "Telo.Abstract" || m.kind === "Telo.Import") {
-      out.push(m);
+      out.push(withModuleGlobals(m, moduleGlobals));
     } else if (
       !isModuleKind(m.kind) &&
       typeof m.metadata?.name === "string" &&
@@ -69,13 +81,59 @@ export function selectModuleManifestsForAnalysis(
     ) {
       out.push({
         ...m,
-        metadata: { ...m.metadata, forwardedExport: true } as ResourceManifest["metadata"],
+        metadata: {
+          ...m.metadata,
+          forwardedExport: true,
+          ...(moduleGlobals ? { moduleGlobals } : {}),
+        } as ResourceManifest["metadata"],
       });
     }
   }
   return out;
 }
 
+/** The declaring module's config contract, carried on a forwarded manifest so
+ *  the consumer's analysis can type its CEL globals in the right scope. Only the
+ *  namespaces whose typing is scope-dependent: `resources` is deliberately
+ *  absent, see {@link readModuleGlobals}. */
+export interface ModuleGlobals {
+  variables?: Record<string, unknown>;
+  secrets?: Record<string, unknown>;
+  ports?: Record<string, unknown>;
+}
+
+/** Read the schema-map blocks off a module doc, or `undefined` when it declares
+ *  none (the globals then stay permissive, exactly as an absent doc does).
+ *
+ *  `resources` is NOT carried. The flat list holds only this module's EXPORTED
+ *  instances, so a name list built from it would omit every internal one — and a
+ *  `with:`-scoped resource is declared inline rather than as a doc, so it would
+ *  be missing too. Both would read as "no such resource" in a consumer's pass:
+ *  a false positive worse than the unchecked read it replaced. The consumer
+ *  leaves a forwarded manifest's `resources` node open and the library's own
+ *  analysis, which sees every name, does that check. */
+function readModuleGlobals(libDoc: ResourceManifest | undefined): ModuleGlobals | undefined {
+  const doc = libDoc as Record<string, any> | undefined;
+  if (!doc) return undefined;
+  const globals: ModuleGlobals = {};
+  for (const key of ["variables", "secrets", "ports"] as const) {
+    const block = doc[key];
+    if (block && typeof block === "object" && !Array.isArray(block)) globals[key] = block;
+  }
+  return Object.keys(globals).length > 0 ? globals : undefined;
+}
+
+function withModuleGlobals(
+  m: ResourceManifest,
+  moduleGlobals: ModuleGlobals | undefined,
+): ResourceManifest {
+  if (!moduleGlobals) return m;
+  return {
+    ...m,
+    metadata: { ...m.metadata, moduleGlobals } as ResourceManifest["metadata"],
+  };
+}
+
 /** Produce the flat manifest list `analyze()` consumes today.
  *
  *  Combines the entry module's manifests with `Telo.Definition`,

package/src/kernel-globals.ts

@@ -22,28 +22,43 @@ const SYSTEM_KINDS = new Set([
   "Telo.Abstract",
 ]);
 
+/** Kernel globals as ONE resource's declaring module sees them. */
+export interface KernelGlobalsIndex {
+  forResource(m: ResourceManifest): Record<string, any>;
+}
+
 /**
- * Build a typed JSON Schema describing the kernel globals available in the
- * given manifest set. Used to merge into `x-telo-context` schemas so that
- * chain-access validation recognises kernel globals without module authors
+ * Build the typed JSON Schema describing the kernel globals available to each
+ * resource in a manifest set. Used to merge into `x-telo-context` schemas so
+ * that chain-access validation recognises kernel globals without module authors
  * having to re-declare them.
  *
- * - `variables` / `secrets`: typed from the root module doc — prefer
- *   Telo.Application when present, otherwise fall back to Telo.Library.
- *   Applications are the root whose variables/secrets contract governs CEL
- *   in the outer module; Libraries are only relevant when the caller scoped
- *   the manifest list to a single library's file.
- * - `resources`: enumerates all non-system resource names
+ * `variables` / `secrets` / `ports` are typed **per declaring module**, because
+ * that is the contract the resource's CEL is evaluated against at runtime. An
+ * application analysis is flattened — `selectModuleManifestsForAnalysis` drops
+ * an imported library's module doc and carries its config blocks across as
+ * `metadata.moduleGlobals` instead — so a resource forwarded from a library is
+ * typed from that stamp, and everything else from the entry module's own doc
+ * (the only module doc left in the set).
+ *
+ * Typing every resource from the entry doc is what made a library's
+ * `variables.x` a hard error the library author could not act on, and — in the
+ * other direction — let a library read a variable it never declared whenever the
+ * app happened to declare that name.
+ *
+ * `resources` is NOT per module: it enumerates every non-system resource name in
+ * the set, and stays OPEN for a forwarded manifest (see `readModuleGlobals` for
+ * why a name list cannot be carried across the boundary honestly).
  */
-export function buildKernelGlobalsSchema(
+export function buildKernelGlobalsIndex(
   manifests: ResourceManifest[],
   /** Every resource a CEL read can name, including scope-declared ones (see
    *  `buildObservedStateIndex`). Kinds that declare a `status:` get a typed,
    *  closed `status` node; every other resource node stays open, so no flat read
    *  that passes today can start failing. */
   resources?: ReadonlyMap<string, { kind: string; status?: Record<string, any> }>,
-): Record<string, any> {
-  const moduleManifest =
+): KernelGlobalsIndex {
+  const entryDoc =
     (manifests.find((m) => m.kind === "Telo.Application") as
       | Record<string, any>
       | undefined) ??
@@ -51,6 +66,52 @@ export function buildKernelGlobalsSchema(
       | Record<string, any>
       | undefined);
 
+  const entrySchema = globalsSchema(entryDoc, buildResourcesSchema(manifests, resources));
+  const openResources = { type: "object", additionalProperties: true };
+  const byModule = new Map<string, Record<string, any>>();
+
+  return {
+    forResource(m: ResourceManifest): Record<string, any> {
+      const meta = m.metadata as { module?: string; moduleGlobals?: ModuleGlobals } | undefined;
+      const stamped = meta?.moduleGlobals;
+      if (!stamped) return entrySchema;
+      const key = meta?.module ?? "";
+      const cached = byModule.get(key);
+      if (cached) return cached;
+      const schema = globalsSchema(stamped, openResources);
+      byModule.set(key, schema);
+      return schema;
+    },
+  };
+}
+
+/** The blocks a declaring module contributes to its resources' CEL globals. */
+interface ModuleGlobals {
+  variables?: Record<string, unknown>;
+  secrets?: Record<string, unknown>;
+  ports?: Record<string, unknown>;
+}
+
+function globalsSchema(
+  doc: ModuleGlobals | Record<string, any> | undefined,
+  resourcesSchema: Record<string, any>,
+): Record<string, any> {
+  return {
+    type: "object",
+    properties: {
+      variables: buildSchemaMapSchema(doc?.variables as Record<string, any> | undefined),
+      secrets: buildSchemaMapSchema(doc?.secrets as Record<string, any> | undefined),
+      resources: resourcesSchema,
+      ports: buildPortsSchema(doc?.ports as Record<string, any> | undefined),
+    },
+  };
+}
+
+/** Every non-system resource name in the set, plus the scope-declared ones. */
+function buildResourcesSchema(
+  manifests: ResourceManifest[],
+  resources?: ReadonlyMap<string, { kind: string; status?: Record<string, any> }>,
+): Record<string, any> {
   const resourceProps: Record<string, any> = {};
   for (const m of manifests) {
     const name = m.metadata?.name as string | undefined;
@@ -76,19 +137,7 @@ export function buildKernelGlobalsSchema(
     applyObservedStateNode(resourceProps, key, entry.status);
   }
 
-  return {
-    type: "object",
-    properties: {
-      variables: buildSchemaMapSchema(moduleManifest?.variables),
-      secrets: buildSchemaMapSchema(moduleManifest?.secrets),
-      resources: {
-        type: "object",
-        properties: resourceProps,
-        additionalProperties: false,
-      },
-      ports: buildPortsSchema(moduleManifest?.ports),
-    },
-  };
+  return { type: "object", properties: resourceProps, additionalProperties: false };
 }
 
 /** Build the closed `ports` chain-access schema: each declared port is an