@telorun/kernel 0.12.0 → 0.13.0

package/dist/schema-valiator.js

@@ -0,0 +1,127 @@
+import { evaluate } from "@marcbachmann/cel-js";
+import { RuntimeError } from "@telorun/sdk";
+import AjvModule from "ajv";
+import addFormats from "ajv-formats";
+import { formatAjvErrors } from "./manifest-schemas.js";
+const Ajv = AjvModule.default ?? AjvModule;
+export class SchemaValidator {
+    constructor() {
+        this.typeRules = new Map();
+        this.rawSchemas = new Map();
+        this.compiledValidators = new WeakMap();
+        this.ajv = new Ajv({
+            strict: false,
+            removeAdditional: false,
+            useDefaults: true,
+        });
+        addFormats.default(this.ajv);
+        for (const kw of [
+            "x-telo-ref",
+            "x-telo-eval",
+            "x-telo-scope",
+            "x-telo-context",
+            "x-telo-context-from",
+            "x-telo-context-ref-from",
+            "x-telo-schema-from",
+            "x-telo-topology-role",
+            "x-telo-step-context",
+        ]) {
+            this.ajv.addKeyword(kw);
+        }
+    }
+    addSchema(name, schema) {
+        if (!this.ajv.getSchema(name)) {
+            this.ajv.addSchema(schema, name);
+        }
+        this.rawSchemas.set(name, schema);
+    }
+    getSchema(name) {
+        return this.rawSchemas.get(name);
+    }
+    addTypeRules(name, rules) {
+        this.typeRules.set(name, rules);
+    }
+    getTypeRules(name) {
+        return this.typeRules.get(name);
+    }
+    compile(schema) {
+        if (schema && typeof schema === "object") {
+            const cached = this.compiledValidators.get(schema);
+            if (cached)
+                return cached;
+        }
+        const isFullSchema = ("type" in schema && typeof schema.type === "string") ||
+            "allOf" in schema ||
+            "anyOf" in schema ||
+            "oneOf" in schema ||
+            "$ref" in schema;
+        const normalized = isFullSchema
+            ? schema
+            : {
+                type: "object",
+                properties: schema,
+                required: Object.keys(schema),
+                additionalProperties: false,
+            };
+        const injected = normalized.additionalProperties === false
+            ? {
+                ...normalized,
+                properties: {
+                    kind: { type: "string" },
+                    metadata: { type: "object" },
+                    ...normalized.properties,
+                },
+            }
+            : normalized;
+        const validate = this.ajv.compile(injected);
+        const validator = {
+            validate: (data) => {
+                const isValid = validate(data);
+                if (!isValid) {
+                    throw new RuntimeError("ERR_RESOURCE_SCHEMA_VALIDATION_FAILED", `Invalid value passed: ${JSON.stringify(data)}. Error: ${formatAjvErrors(validate.errors)}`);
+                }
+            },
+            isValid: (data) => {
+                return validate(data);
+            },
+        };
+        if (schema && typeof schema === "object") {
+            this.compiledValidators.set(schema, validator);
+        }
+        return validator;
+    }
+    composeWithRules(base, typeName, rules) {
+        return {
+            validate: (data) => {
+                base.validate(data);
+                for (const rule of rules) {
+                    let result;
+                    try {
+                        result = evaluate(rule.condition, { this: data });
+                    }
+                    catch (err) {
+                        throw new RuntimeError("ERR_TYPE_VALIDATION_FAILED", `Type "${typeName}" rule evaluation failed: ${err instanceof Error ? err.message : String(err)}`);
+                    }
+                    if (result !== true) {
+                        throw new RuntimeError(rule.code ?? "ERR_TYPE_VALIDATION_FAILED", rule.message ?? `Type "${typeName}" validation failed: rule "${rule.code}" not satisfied`);
+                    }
+                }
+            },
+            isValid: (data) => {
+                if (!base.isValid(data))
+                    return false;
+                for (const rule of rules) {
+                    try {
+                        if (evaluate(rule.condition, { this: data }) !== true)
+                            return false;
+                    }
+                    catch {
+                        return false;
+                    }
+                }
+                return true;
+            },
+        };
+    }
+}
+//# sourceMappingURL=schema-valiator.js.map

package/dist/schema-valiator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-valiator.js","sourceRoot":"","sources":["../src/schema-valiator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAiB,YAAY,EAAY,MAAM,cAAc,CAAC;AACrE,OAAO,SAAS,MAAM,KAAK,CAAC;AAC5B,OAAO,UAAU,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC;AAE3C,MAAM,OAAO,eAAe;IAM1B;QAJQ,cAAS,GAAG,IAAI,GAAG,EAAsB,CAAC;QAC1C,eAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;QACvC,uBAAkB,GAAG,IAAI,OAAO,EAAyB,CAAC;QAGhE,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC;YACjB,MAAM,EAAE,KAAK;YACb,gBAAgB,EAAE,KAAK;YACvB,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,KAAK,MAAM,EAAE,IAAI;YACf,YAAY;YACZ,aAAa;YACb,cAAc;YACd,gBAAgB;YAChB,qBAAqB;YACrB,yBAAyB;YACzB,oBAAoB;YACpB,sBAAsB;YACtB,qBAAqB;SACtB,EAAE,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,SAAS,CAAC,IAAY,EAAE,MAAc;QACpC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,SAAS,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,YAAY,CAAC,IAAY,EAAE,KAAiB;QAC1C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,YAAY,CAAC,IAAY;QACvB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,CAAC,MAAW;QACjB,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAgB,CAAC,CAAC;YAC7D,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QAED,MAAM,YAAY,GAChB,CAAC,MAAM,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC;YACrD,OAAO,IAAI,MAAM;YACjB,OAAO,IAAI,MAAM;YACjB,OAAO,IAAI,MAAM;YACjB,MAAM,IAAI,MAAM,CAAC;QACnB,MAAM,UAAU,GAAG,YAAY;YAC7B,CAAC,CAAC,MAAM;YACR,CAAC,CAAC;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,MAAM;gBAClB,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC7B,oBAAoB,EAAE,KAAK;aAC5B,CAAC;QACN,MAAM,QAAQ,GACZ,UAAU,CAAC,oBAAoB,KAAK,KAAK;YACvC,CAAC,CAAC;gBACE,GAAG,UAAU;gBACb,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACxB,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC5B,GAAG,UAAU,CAAC,UAAU;iBACzB;aACF;YACH,CAAC,CAAC,UAAU,CAAC;QACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAE5C,MAAM,SAAS,GAAG;YAChB,QAAQ,EAAE,CAAC,IAAS,EAAE,EAAE;gBACtB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,YAAY,CACpB,uCAAuC,EACvC,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAC5F,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,EAAE,CAAC,IAAS,EAAE,EAAE;gBACrB,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;YACxB,CAAC;SACF,CAAC;QAEF,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAgB,EAAE,SAAS,CAAC,CAAC;QAC3D,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,gBAAgB,CAAC,IAAmB,EAAE,QAAgB,EAAE,KAAiB;QACvE,OAAO;YACL,QAAQ,EAAE,CAAC,IAAS,EAAE,EAAE;gBACtB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,IAAI,MAAe,CAAC;oBACpB,IAAI,CAAC;wBACH,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;oBACpD,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,IAAI,YAAY,CACpB,4BAA4B,EAC5B,SAAS,QAAQ,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACjG,CAAC;oBACJ,CAAC;oBACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;wBACpB,MAAM,IAAI,YAAY,CACpB,IAAI,CAAC,IAAI,IAAI,4BAA4B,EACzC,IAAI,CAAC,OAAO,IAAI,SAAS,QAAQ,8BAA8B,IAAI,CAAC,IAAI,iBAAiB,CAC1F,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,EAAE,CAAC,IAAS,EAAE,EAAE;gBACrB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,IAAI,CAAC;wBACH,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK,IAAI;4BAAE,OAAO,KAAK,CAAC;oBACtE,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,KAAK,CAAC;oBACf,CAAC;gBACH,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/schema-validator.d.ts

@@ -4,12 +4,40 @@ export declare class SchemaValidator {
     private typeRules;
     private rawSchemas;
     private compiledValidators;
+    private cacheDir;
+    /** Tracks (schema-hash → in-memory compiled validator) so two distinct
+     *  but content-equal schema objects share one compile across the kernel
+     *  process — `compiledValidators` is keyed by object identity and would
+     *  miss those cases. */
+    private hashCache;
     constructor();
     addSchema(name: string, schema: object): void;
     getSchema(name: string): object | undefined;
     addTypeRules(name: string, rules: TypeRule[]): void;
     getTypeRules(name: string): TypeRule[] | undefined;
+    /** Enable the on-disk validator cache rooted at `dir`. Compiled AJV
+     *  validators are written as standalone CJS modules keyed by content
+     *  hash, so subsequent process invocations skip the ≈2–10 ms AJV
+     *  codegen for each unseen schema. Safe to call before or after
+     *  `compile()` — already-compiled in-memory entries are unaffected.
+     *  The caller is responsible for choosing a writable directory; the
+     *  kernel anchors this under `<entry-dir>/.telo/manifests/__validators/`
+     *  so it lives next to the manifest cache and rides along in
+     *  `COPY --from=build /srv /srv` Docker images. */
+    setCacheDir(dir: string | undefined): void;
     compile(schema: any): DataValidator;
+    /** Load `<cacheDir>/<hash>.cjs` if present, else compile via AJV and
+     *  persist as standalone CJS. Cached files start with a
+     *  `// sha256:<hex>\n` header covering the rest of the file; a
+     *  mismatch (truncated write, FS corruption, tampering inside a baked
+     *  Docker image) is treated as a cache miss and the validator is
+     *  recompiled — and overwritten — so the cache self-heals. The cached
+     *  body is wrapped so its embedded `require("ajv/...")` /
+     *  `require("ajv-formats/...")` calls resolve against the kernel
+     *  package; the cache file lives outside any `node_modules` tree, so a
+     *  bare `require()` from its own path would fail. Read/write failures
+     *  surface to stderr but never abort compilation. */
+    private compileAjvOrLoadCached;
     composeWithRules(base: DataValidator, typeName: string, rules: TypeRule[]): DataValidator;
 }
 //# sourceMappingURL=schema-validator.d.ts.map

package/dist/schema-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-validator.d.ts","sourceRoot":"","sources":["../src/schema-validator.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAgB,QAAQ,EAAE,MAAM,cAAc,CAAC;AAOrE,qBAAa,eAAe;IAC1B,OAAO,CAAC,GAAG,CAA2B;IACtC,OAAO,CAAC,SAAS,CAAiC;IAClD,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,kBAAkB,CAAwC;;IAyBlE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAO7C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI3C,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI;IAInD,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,GAAG,SAAS;IAIlD,OAAO,CAAC,MAAM,EAAE,GAAG,GAAG,aAAa;IAuDnC,gBAAgB,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,aAAa;CAmC1F"}
+{"version":3,"file":"schema-validator.d.ts","sourceRoot":"","sources":["../src/schema-validator.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAgB,QAAQ,EAAE,MAAM,cAAc,CAAC;AA+ErE,qBAAa,eAAe;IAC1B,OAAO,CAAC,GAAG,CAA2B;IACtC,OAAO,CAAC,SAAS,CAAiC;IAClD,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,kBAAkB,CAAwC;IAClE,OAAO,CAAC,QAAQ,CAAqB;IACrC;;;4BAGwB;IACxB,OAAO,CAAC,SAAS,CAAoC;;IAiCrD,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAO7C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI3C,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI;IAInD,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,GAAG,SAAS;IAIlD;;;;;;;;uDAQmD;IACnD,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAI1C,OAAO,CAAC,MAAM,EAAE,GAAG,GAAG,aAAa;IAqEnC;;;;;;;;;;yDAUqD;IACrD,OAAO,CAAC,sBAAsB;IAoD9B,gBAAgB,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,aAAa;CAmC1F"}

package/dist/schema-validator.js

@@ -1,18 +1,99 @@
 import { evaluate } from "@marcbachmann/cel-js";
 import { RuntimeError } from "@telorun/sdk";
 import AjvModule from "ajv";
+import standaloneCodeMod from "ajv/dist/standalone/index.js";
 import addFormats from "ajv-formats";
+import { createHash } from "node:crypto";
+import * as fs from "node:fs";
+import { createRequire } from "node:module";
+import * as path from "node:path";
 import { formatAjvErrors } from "./manifest-schemas.js";
+import { ManifestRootSchema } from "@telorun/templating";
 const Ajv = AjvModule.default ?? AjvModule;
+// AJV's standalone subpath is CJS — the default export shows up as either
+// the function itself or `.default` depending on how the bundler/loader
+// rewrites it. Normalise once.
+const standaloneCode = standaloneCodeMod.default ?? standaloneCodeMod;
+/** `require` resolved from this file's URL — used to satisfy `ajv/dist/...`
+ *  / `ajv-formats/...` imports embedded in standalone-compiled validators
+ *  loaded back off disk. Anchored here so it always resolves through the
+ *  kernel package's node_modules, regardless of where the cache file
+ *  lives on disk. */
+const kernelRequire = createRequire(import.meta.url);
+/** Resolved AJV + ajv-formats versions, baked into every cache key so a
+ *  pnpm/npm install that upgrades either package invalidates all stale
+ *  `<hash>.cjs` files automatically. Standalone-compiled validators
+ *  embed `require("ajv/dist/runtime/...")` — running a validator built
+ *  against an older AJV against the current runtime is undefined
+ *  behaviour, so the version pin must be part of the hash, not a manual
+ *  bump. Falls back to walking up from the package's main entry when
+ *  the dependency restricts subpath access via `exports`. */
+function readDepVersion(spec) {
+    try {
+        const pkg = kernelRequire(`${spec}/package.json`);
+        if (typeof pkg.version === "string")
+            return pkg.version;
+    }
+    catch {
+        // restricted exports — try the filesystem walk below
+    }
+    try {
+        const entry = kernelRequire.resolve(spec);
+        let dir = path.dirname(entry);
+        while (dir !== path.dirname(dir)) {
+            const candidate = path.join(dir, "package.json");
+            try {
+                const pkg = JSON.parse(fs.readFileSync(candidate, "utf-8"));
+                const expectedName = spec.split("/").slice(0, spec.startsWith("@") ? 2 : 1).join("/");
+                if (typeof pkg.name === "string" && pkg.name === expectedName) {
+                    return typeof pkg.version === "string" ? pkg.version : "unknown";
+                }
+            }
+            catch {
+                // keep walking — not at the package root yet
+            }
+            dir = path.dirname(dir);
+        }
+    }
+    catch {
+        // package not installed
+    }
+    return "unknown";
+}
+const AJV_VERSION = readDepVersion("ajv");
+const AJV_FORMATS_VERSION = readDepVersion("ajv-formats");
+const VALIDATOR_RUNTIME_TAG = `ajv@${AJV_VERSION}+ajv-formats@${AJV_FORMATS_VERSION}`;
+const SHA256_HEADER_PATTERN = /^\/\/ sha256:([0-9a-f]{64})\n/;
+/** Verify a cached validator file's SHA-256 integrity header and return
+ *  the body when the digest matches. Returns `null` on any mismatch /
+ *  malformed header — the caller treats that as a cache miss and
+ *  recompiles + overwrites the file. */
+function verifyAndExtractBody(text) {
+    const match = text.match(SHA256_HEADER_PATTERN);
+    if (!match)
+        return null;
+    const body = text.slice(match[0].length);
+    const actual = createHash("sha256").update(body).digest("hex");
+    return actual === match[1] ? body : null;
+}
 export class SchemaValidator {
     constructor() {
         this.typeRules = new Map();
         this.rawSchemas = new Map();
         this.compiledValidators = new WeakMap();
+        /** Tracks (schema-hash → in-memory compiled validator) so two distinct
+         *  but content-equal schema objects share one compile across the kernel
+         *  process — `compiledValidators` is keyed by object identity and would
+         *  miss those cases. */
+        this.hashCache = new Map();
         this.ajv = new Ajv({
             strict: false,
             removeAdditional: false,
             useDefaults: true,
+            // Required for `standaloneCode` extraction — tells AJV to keep the
+            // generated validator's source available rather than wrapping it
+            // through `new Function`. The cost at compile time is negligible.
+            code: { source: true },
         });
         addFormats.default(this.ajv);
         for (const kw of [
@@ -29,6 +110,10 @@ export class SchemaValidator {
         ]) {
             this.ajv.addKeyword(kw);
         }
+        // Register the shared manifest root so module schemas can
+        // `$ref: "telo://manifest#/$defs/ResourceRef"` without each manifest
+        // bundling its own copy. Mirrors the analyzer's createAjv().
+        this.ajv.addSchema(ManifestRootSchema);
     }
     addSchema(name, schema) {
         if (!this.ajv.getSchema(name)) {
@@ -45,6 +130,18 @@ export class SchemaValidator {
     getTypeRules(name) {
         return this.typeRules.get(name);
     }
+    /** Enable the on-disk validator cache rooted at `dir`. Compiled AJV
+     *  validators are written as standalone CJS modules keyed by content
+     *  hash, so subsequent process invocations skip the ≈2–10 ms AJV
+     *  codegen for each unseen schema. Safe to call before or after
+     *  `compile()` — already-compiled in-memory entries are unaffected.
+     *  The caller is responsible for choosing a writable directory; the
+     *  kernel anchors this under `<entry-dir>/.telo/manifests/__validators/`
+     *  so it lives next to the manifest cache and rides along in
+     *  `COPY --from=build /srv /srv` Docker images. */
+    setCacheDir(dir) {
+        this.cacheDir = dir;
+    }
     compile(schema) {
         if (schema && typeof schema === "object") {
             const cached = this.compiledValidators.get(schema);
@@ -74,7 +171,18 @@ export class SchemaValidator {
                 },
             }
             : normalized;
-        const validate = this.ajv.compile(injected);
+        const hash = createHash("sha256")
+            .update(JSON.stringify({ runtime: VALIDATOR_RUNTIME_TAG, schema: injected }))
+            .digest("hex")
+            .slice(0, 32);
+        const cachedByHash = this.hashCache.get(hash);
+        if (cachedByHash) {
+            if (schema && typeof schema === "object") {
+                this.compiledValidators.set(schema, cachedByHash);
+            }
+            return cachedByHash;
+        }
+        const validate = this.compileAjvOrLoadCached(injected, hash);
         const validator = {
             validate: (data) => {
                 const isValid = validate(data);
@@ -86,11 +194,63 @@ export class SchemaValidator {
                 return validate(data);
             },
         };
+        this.hashCache.set(hash, validator);
         if (schema && typeof schema === "object") {
             this.compiledValidators.set(schema, validator);
         }
         return validator;
     }
+    /** Load `<cacheDir>/<hash>.cjs` if present, else compile via AJV and
+     *  persist as standalone CJS. Cached files start with a
+     *  `// sha256:<hex>\n` header covering the rest of the file; a
+     *  mismatch (truncated write, FS corruption, tampering inside a baked
+     *  Docker image) is treated as a cache miss and the validator is
+     *  recompiled — and overwritten — so the cache self-heals. The cached
+     *  body is wrapped so its embedded `require("ajv/...")` /
+     *  `require("ajv-formats/...")` calls resolve against the kernel
+     *  package; the cache file lives outside any `node_modules` tree, so a
+     *  bare `require()` from its own path would fail. Read/write failures
+     *  surface to stderr but never abort compilation. */
+    compileAjvOrLoadCached(schema, hash) {
+        const cacheDir = this.cacheDir;
+        if (cacheDir) {
+            const cachePath = path.join(cacheDir, `${hash}.cjs`);
+            try {
+                const text = fs.readFileSync(cachePath, "utf-8");
+                const body = verifyAndExtractBody(text);
+                if (body !== null) {
+                    const factory = new Function("require", "module", "exports", `${body}\nreturn module.exports;`);
+                    const mod = { exports: {} };
+                    const loaded = factory(kernelRequire, mod, mod.exports);
+                    if (typeof loaded === "function") {
+                        return loaded;
+                    }
+                }
+                // Header missing / mismatched / non-function export — fall
+                // through and recompile. The write step below overwrites the
+                // stale file with a fresh hash header.
+            }
+            catch (err) {
+                if (err?.code !== "ENOENT") {
+                    process.stderr.write(`[telo:kernel] validator cache load failed (${hash}): ${err instanceof Error ? err.message : String(err)}\n`);
+                }
+            }
+        }
+        const validate = this.ajv.compile(schema);
+        if (cacheDir) {
+            try {
+                const body = standaloneCode(this.ajv, validate);
+                const integrity = createHash("sha256").update(body).digest("hex");
+                const payload = `// sha256:${integrity}\n${body}`;
+                fs.mkdirSync(cacheDir, { recursive: true });
+                fs.writeFileSync(path.join(cacheDir, `${hash}.cjs`), payload, "utf-8");
+            }
+            catch (err) {
+                process.stderr.write(`[telo:kernel] validator cache write failed (${hash}): ${err instanceof Error ? err.message : String(err)}\n`);
+            }
+        }
+        return validate;
+    }
     composeWithRules(base, typeName, rules) {
         return {
             validate: (data) => {

package/dist/schema-validator.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema-validator.js","sourceRoot":"","sources":["../src/schema-validator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAiB,YAAY,EAAY,MAAM,cAAc,CAAC;AACrE,OAAO,SAAS,MAAM,KAAK,CAAC;AAC5B,OAAO,UAAU,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC;AAE3C,MAAM,OAAO,eAAe;IAM1B;QAJQ,cAAS,GAAG,IAAI,GAAG,EAAsB,CAAC;QAC1C,eAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;QACvC,uBAAkB,GAAG,IAAI,OAAO,EAAyB,CAAC;QAGhE,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC;YACjB,MAAM,EAAE,KAAK;YACb,gBAAgB,EAAE,KAAK;YACvB,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,KAAK,MAAM,EAAE,IAAI;YACf,YAAY;YACZ,aAAa;YACb,cAAc;YACd,gBAAgB;YAChB,qBAAqB;YACrB,yBAAyB;YACzB,oBAAoB;YACpB,sBAAsB;YACtB,qBAAqB;YACrB,eAAe;SAChB,EAAE,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,SAAS,CAAC,IAAY,EAAE,MAAc;QACpC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,SAAS,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,YAAY,CAAC,IAAY,EAAE,KAAiB;QAC1C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,YAAY,CAAC,IAAY;QACvB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,CAAC,MAAW;QACjB,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAgB,CAAC,CAAC;YAC7D,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QAED,MAAM,YAAY,GAChB,CAAC,MAAM,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC;YACrD,OAAO,IAAI,MAAM;YACjB,OAAO,IAAI,MAAM;YACjB,OAAO,IAAI,MAAM;YACjB,MAAM,IAAI,MAAM,CAAC;QACnB,MAAM,UAAU,GAAG,YAAY;YAC7B,CAAC,CAAC,MAAM;YACR,CAAC,CAAC;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,MAAM;gBAClB,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC7B,oBAAoB,EAAE,KAAK;aAC5B,CAAC;QACN,MAAM,QAAQ,GACZ,UAAU,CAAC,oBAAoB,KAAK,KAAK;YACvC,CAAC,CAAC;gBACE,GAAG,UAAU;gBACb,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACxB,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC5B,GAAG,UAAU,CAAC,UAAU;iBACzB;aACF;YACH,CAAC,CAAC,UAAU,CAAC;QACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAE5C,MAAM,SAAS,GAAG;YAChB,QAAQ,EAAE,CAAC,IAAS,EAAE,EAAE;gBACtB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,YAAY,CACpB,uCAAuC,EACvC,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAC5F,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,EAAE,CAAC,IAAS,EAAE,EAAE;gBACrB,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;YACxB,CAAC;SACF,CAAC;QAEF,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAgB,EAAE,SAAS,CAAC,CAAC;QAC3D,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,gBAAgB,CAAC,IAAmB,EAAE,QAAgB,EAAE,KAAiB;QACvE,OAAO;YACL,QAAQ,EAAE,CAAC,IAAS,EAAE,EAAE;gBACtB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,IAAI,MAAe,CAAC;oBACpB,IAAI,CAAC;wBACH,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;oBACpD,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,IAAI,YAAY,CACpB,4BAA4B,EAC5B,SAAS,QAAQ,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACjG,CAAC;oBACJ,CAAC;oBACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;wBACpB,MAAM,IAAI,YAAY,CACpB,IAAI,CAAC,IAAI,IAAI,4BAA4B,EACzC,IAAI,CAAC,OAAO,IAAI,SAAS,QAAQ,8BAA8B,IAAI,CAAC,IAAI,iBAAiB,CAC1F,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,EAAE,CAAC,IAAS,EAAE,EAAE;gBACrB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,IAAI,CAAC;wBACH,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK,IAAI;4BAAE,OAAO,KAAK,CAAC;oBACtE,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,KAAK,CAAC;oBACf,CAAC;gBACH,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;SACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"schema-validator.js","sourceRoot":"","sources":["../src/schema-validator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAiB,YAAY,EAAY,MAAM,cAAc,CAAC;AACrE,OAAO,SAAoC,MAAM,KAAK,CAAC;AACvD,OAAO,iBAAiB,MAAM,8BAA8B,CAAC;AAC7D,OAAO,UAAU,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC;AAC3C,0EAA0E;AAC1E,wEAAwE;AACxE,+BAA+B;AAC/B,MAAM,cAAc,GACjB,iBAAyB,CAAC,OAAO,IAAK,iBAAyB,CAAC;AAEnE;;;;qBAIqB;AACrB,MAAM,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAErD;;;;;;;6DAO6D;AAC7D,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,IAAI,eAAe,CAAC,CAAC;QAClD,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,qDAAqD;IACvD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACtF,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAC9D,OAAO,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;gBACnE,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,6CAA6C;YAC/C,CAAC;YACD,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wBAAwB;IAC1B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AACD,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;AAC1C,MAAM,mBAAmB,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;AAC1D,MAAM,qBAAqB,GAAG,OAAO,WAAW,gBAAgB,mBAAmB,EAAE,CAAC;AAEtF,MAAM,qBAAqB,GAAG,+BAA+B,CAAC;AAE9D;;;wCAGwC;AACxC,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/D,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC;AAED,MAAM,OAAO,eAAe;IAY1B;QAVQ,cAAS,GAAG,IAAI,GAAG,EAAsB,CAAC;QAC1C,eAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;QACvC,uBAAkB,GAAG,IAAI,OAAO,EAAyB,CAAC;QAElE;;;gCAGwB;QAChB,cAAS,GAAG,IAAI,GAAG,EAAyB,CAAC;QAGnD,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC;YACjB,MAAM,EAAE,KAAK;YACb,gBAAgB,EAAE,KAAK;YACvB,WAAW,EAAE,IAAI;YACjB,mEAAmE;YACnE,iEAAiE;YACjE,kEAAkE;YAClE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;SACvB,CAAC,CAAC;QACH,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,KAAK,MAAM,EAAE,IAAI;YACf,YAAY;YACZ,aAAa;YACb,cAAc;YACd,gBAAgB;YAChB,qBAAqB;YACrB,yBAAyB;YACzB,oBAAoB;YACpB,sBAAsB;YACtB,qBAAqB;YACrB,eAAe;SAChB,EAAE,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC;QACD,0DAA0D;QAC1D,qEAAqE;QACrE,6DAA6D;QAC7D,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACzC,CAAC;IAED,SAAS,CAAC,IAAY,EAAE,MAAc;QACpC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,SAAS,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,YAAY,CAAC,IAAY,EAAE,KAAiB;QAC1C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,YAAY,CAAC,IAAY;QACvB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;;uDAQmD;IACnD,WAAW,CAAC,GAAuB;QACjC,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC;IACtB,CAAC;IAED,OAAO,CAAC,MAAW;QACjB,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAgB,CAAC,CAAC;YAC7D,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QAED,MAAM,YAAY,GAChB,CAAC,MAAM,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC;YACrD,OAAO,IAAI,MAAM;YACjB,OAAO,IAAI,MAAM;YACjB,OAAO,IAAI,MAAM;YACjB,MAAM,IAAI,MAAM,CAAC;QACnB,MAAM,UAAU,GAAG,YAAY;YAC7B,CAAC,CAAC,MAAM;YACR,CAAC,CAAC;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,MAAM;gBAClB,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC7B,oBAAoB,EAAE,KAAK;aAC5B,CAAC;QACN,MAAM,QAAQ,GACZ,UAAU,CAAC,oBAAoB,KAAK,KAAK;YACvC,CAAC,CAAC;gBACE,GAAG,UAAU;gBACb,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACxB,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC5B,GAAG,UAAU,CAAC,UAAU;iBACzB;aACF;YACH,CAAC,CAAC,UAAU,CAAC;QAEjB,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC;aAC9B,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;aAC5E,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChB,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACzC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAgB,EAAE,YAAY,CAAC,CAAC;YAC9D,CAAC;YACD,OAAO,YAAY,CAAC;QACtB,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAE7D,MAAM,SAAS,GAAG;YAChB,QAAQ,EAAE,CAAC,IAAS,EAAE,EAAE;gBACtB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,YAAY,CACpB,uCAAuC,EACvC,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAC5F,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,EAAE,CAAC,IAAS,EAAE,EAAE;gBACrB,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;YACxB,CAAC;SACF,CAAC;QAEF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACpC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAgB,EAAE,SAAS,CAAC,CAAC;QAC3D,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;;yDAUqD;IAC7C,sBAAsB,CAC5B,MAAW,EACX,IAAY;QAEZ,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;YACrD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBACjD,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;gBACxC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAClB,MAAM,OAAO,GAAG,IAAI,QAAQ,CAC1B,SAAS,EACT,QAAQ,EACR,SAAS,EACT,GAAG,IAAI,0BAA0B,CAClC,CAAC;oBACF,MAAM,GAAG,GAAqB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;oBAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;oBACxD,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;wBACjC,OAAO,MAA0B,CAAC;oBACpC,CAAC;gBACH,CAAC;gBACD,2DAA2D;gBAC3D,6DAA6D;gBAC7D,uCAAuC;YACzC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAA6B,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,8CAA8C,IAAI,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAC7G,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAqB,CAAC;QAC9D,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAChD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAClE,MAAM,OAAO,GAAG,aAAa,SAAS,KAAK,IAAI,EAAE,CAAC;gBAClD,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC5C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YACzE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+CAA+C,IAAI,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAC9G,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,gBAAgB,CAAC,IAAmB,EAAE,QAAgB,EAAE,KAAiB;QACvE,OAAO;YACL,QAAQ,EAAE,CAAC,IAAS,EAAE,EAAE;gBACtB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,IAAI,MAAe,CAAC;oBACpB,IAAI,CAAC;wBACH,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;oBACpD,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,IAAI,YAAY,CACpB,4BAA4B,EAC5B,SAAS,QAAQ,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACjG,CAAC;oBACJ,CAAC;oBACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;wBACpB,MAAM,IAAI,YAAY,CACpB,IAAI,CAAC,IAAI,IAAI,4BAA4B,EACzC,IAAI,CAAC,OAAO,IAAI,SAAS,QAAQ,8BAA8B,IAAI,CAAC,IAAI,iBAAiB,CAC1F,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,EAAE,CAAC,IAAS,EAAE,EAAE;gBACrB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,IAAI,CAAC;wBACH,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK,IAAI;4BAAE,OAAO,KAAK,CAAC;oBACtE,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,KAAK,CAAC;oBACf,CAAC;gBACH,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/snapshot-serializer.d.ts

@@ -0,0 +1,62 @@
+import { ResourceInstance, RuntimeResource } from "@telorun/sdk";
+export interface SnapshotData {
+    timestamp: string;
+    resources: Array<{
+        kind: string;
+        name: string;
+        metadata: Record<string, any>;
+        data: Record<string, any>;
+        snapshot?: Record<string, any>;
+    }>;
+}
+/**
+ * Serializes runtime state into YAML snapshots
+ * Captures resource definitions, instances, and custom state
+ * Recursively includes nested resources based on generationDepth
+ */
+export declare class SnapshotSerializer {
+    /**
+     * Take a snapshot of runtime state
+     * @param resources Map of resources organized by kind
+     * @param resourceInstances Map of resource instances to include custom snapshots
+     * @param filePath Optional file path to write snapshot to
+     * @returns Snapshot data object
+     */
+    takeSnapshot(resources: Map<string, Map<string, RuntimeResource>>, resourceInstances?: Map<string, {
+        resource: RuntimeResource;
+        instance: ResourceInstance;
+    }>, filePath?: string): Promise<SnapshotData>;
+    /**
+     * Serialize a single resource
+     */
+    private serializeResource;
+    /**
+     * Get snapshot from resource instance if it implements snapshot() method
+     */
+    private getInstanceSnapshot;
+    /**
+     * Serialize metadata, filtering out circular references and functions
+     */
+    private serializeMetadata;
+    /**
+     * Serialize resource data, filtering out circular references and functions
+     */
+    private serializeData;
+    /**
+     * Group resources by generation depth for hierarchical ordering
+     */
+    private groupByGenerationDepth;
+    /**
+     * Write snapshot to YAML file
+     */
+    private writeSnapshotToFile;
+    /**
+     * Generate resource key for instance lookup
+     */
+    private getResourceKey;
+    /**
+     * Load snapshot from YAML file
+     */
+    loadSnapshotFromFile(filePath: string): Promise<SnapshotData>;
+}
+//# sourceMappingURL=snapshot-serializer.d.ts.map

package/dist/snapshot-serializer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot-serializer.d.ts","sourceRoot":"","sources":["../src/snapshot-serializer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAKjE,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,KAAK,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;KAChC,CAAC,CAAC;CACJ;AAED;;;;GAIG;AACH,qBAAa,kBAAkB;IAC7B;;;;;;OAMG;IACG,YAAY,CAChB,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,EACpD,iBAAiB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,eAAe,CAAC;QAAC,QAAQ,EAAE,gBAAgB,CAAA;KAAE,CAAC,EAC1F,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,YAAY,CAAC;IA4BxB;;OAEG;YACW,iBAAiB;IAoC/B;;OAEG;YACW,mBAAmB;IAmBjC;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAiBzB;;OAEG;IACH,OAAO,CAAC,aAAa;IAiBrB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAoB9B;;OAEG;YACW,mBAAmB;IAgBjC;;OAEG;IACH,OAAO,CAAC,cAAc;IAItB;;OAEG;IACG,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;CAIpE"}

package/dist/snapshot-serializer.js

@@ -0,0 +1,164 @@
+import * as fs from "fs/promises";
+import * as YAML from "js-yaml";
+import * as path from "path";
+/**
+ * Serializes runtime state into YAML snapshots
+ * Captures resource definitions, instances, and custom state
+ * Recursively includes nested resources based on generationDepth
+ */
+export class SnapshotSerializer {
+    /**
+     * Take a snapshot of runtime state
+     * @param resources Map of resources organized by kind
+     * @param resourceInstances Map of resource instances to include custom snapshots
+     * @param filePath Optional file path to write snapshot to
+     * @returns Snapshot data object
+     */
+    async takeSnapshot(resources, resourceInstances, filePath) {
+        const snapshot = {
+            timestamp: new Date().toISOString(),
+            resources: [],
+        };
+        // Get all resources organized by generation depth (0 = first level)
+        // Start with depth 0 (directly loaded resources) and recursively include nested ones
+        const resourcesByDepth = this.groupByGenerationDepth(resources);
+        // Process resources starting from depth 0
+        for (const depth of Array.from(resourcesByDepth.keys()).sort((a, b) => a - b)) {
+            const resourcesAtDepth = resourcesByDepth.get(depth) || [];
+            for (const resource of resourcesAtDepth) {
+                const resourceEntry = await this.serializeResource(resource, resourceInstances);
+                snapshot.resources.push(resourceEntry);
+            }
+        }
+        // Write to file if path provided
+        if (filePath) {
+            await this.writeSnapshotToFile(snapshot, filePath);
+        }
+        return snapshot;
+    }
+    /**
+     * Serialize a single resource
+     */
+    async serializeResource(resource, resourceInstances) {
+        const { kind, metadata, ...data } = resource;
+        const { name } = metadata;
+        const resourceEntry = {
+            kind,
+            name,
+            metadata: this.serializeMetadata(metadata),
+            data: this.serializeData(data),
+        };
+        // Include custom snapshot if resource instance has snapshot() method
+        if (resourceInstances) {
+            const key = this.getResourceKey(kind, name);
+            const instanceData = resourceInstances.get(key);
+            if (instanceData && instanceData.instance) {
+                const snapshotData = await this.getInstanceSnapshot(instanceData.instance);
+                if (snapshotData) {
+                    resourceEntry.snapshot = snapshotData;
+                }
+            }
+        }
+        return resourceEntry;
+    }
+    /**
+     * Get snapshot from resource instance if it implements snapshot() method
+     */
+    async getInstanceSnapshot(instance) {
+        const instanceAny = instance;
+        // Check if snapshot method exists
+        if (typeof instanceAny.snapshot === "function") {
+            try {
+                const result = await Promise.resolve(instanceAny.snapshot(instance));
+                return result;
+            }
+            catch (error) {
+                console.error("Error calling snapshot() on resource instance:", error);
+                return null;
+            }
+        }
+        return null;
+    }
+    /**
+     * Serialize metadata, filtering out circular references and functions
+     */
+    serializeMetadata(metadata) {
+        const serialized = {};
+        for (const [key, value] of Object.entries(metadata)) {
+            if (typeof value === "function") {
+                continue;
+            }
+            try {
+                serialized[key] = JSON.parse(JSON.stringify(value));
+            }
+            catch {
+                // Skip non-serializable values
+            }
+        }
+        return serialized;
+    }
+    /**
+     * Serialize resource data, filtering out circular references and functions
+     */
+    serializeData(data) {
+        const serialized = {};
+        for (const [key, value] of Object.entries(data)) {
+            if (typeof value === "function") {
+                continue;
+            }
+            try {
+                serialized[key] = JSON.parse(JSON.stringify(value));
+            }
+            catch {
+                // Skip non-serializable values
+            }
+        }
+        return serialized;
+    }
+    /**
+     * Group resources by generation depth for hierarchical ordering
+     */
+    groupByGenerationDepth(resources) {
+        const grouped = new Map();
+        for (const kindMap of resources.values()) {
+            for (const resource of kindMap.values()) {
+                const depth = resource.metadata.generationDepth ?? 0;
+                if (!grouped.has(depth)) {
+                    grouped.set(depth, []);
+                }
+                grouped.get(depth).push(resource);
+            }
+        }
+        return grouped;
+    }
+    /**
+     * Write snapshot to YAML file
+     */
+    async writeSnapshotToFile(snapshot, filePath) {
+        // Ensure directory exists
+        const dir = path.dirname(filePath);
+        if (dir !== "." && dir !== "") {
+            await fs.mkdir(dir, { recursive: true });
+        }
+        // Convert to YAML
+        const yaml = YAML.dump(snapshot, {
+            indent: 2,
+            lineWidth: 0,
+        });
+        await fs.writeFile(filePath, yaml, "utf-8");
+    }
+    /**
+     * Generate resource key for instance lookup
+     */
+    getResourceKey(kind, name) {
+        return `${kind}:${name}`;
+    }
+    /**
+     * Load snapshot from YAML file
+     */
+    async loadSnapshotFromFile(filePath) {
+        const content = await fs.readFile(filePath, "utf-8");
+        return YAML.load(content);
+    }
+}
+//# sourceMappingURL=snapshot-serializer.js.map