@telorun/kernel 0.2.4 → 0.2.6

package/dist/kernel.js

@@ -1,14 +1,12 @@
-import { isContextProvider } from "@telorun/sdk";
+import { AnalysisRegistry, StaticAnalyzer } from "@telorun/analyzer";
+import { ModuleContext, RuntimeError, isCompiledValue, } from "@telorun/sdk";
 import * as path from "path";
-import { BootContextRegistry } from "./boot-context-registry.js";
 import { ControllerRegistry } from "./controller-registry.js";
 import { EventStream } from "./event-stream.js";
 import { EventBus } from "./events.js";
-import { evaluateCel, expandValue, resolveManifestWithContext } from "./expressions.js";
 import { Loader } from "./loader.js";
 import { ResourceContextImpl } from "./resource-context.js";
 import { SchemaValidator } from "./schema-valiator.js";
-import { RuntimeError, } from "./types.js";
 /**
  * Kernel: Central orchestrator managing lifecycle and message bus
  * Handles resource loading, initialization, and execution through controllers
@@ -16,65 +14,26 @@ import { RuntimeError, } from "./types.js";
 export class Kernel {
     constructor() {
         this.loader = new Loader();
+        this.analyzer = new StaticAnalyzer();
+        this.registry = new AnalysisRegistry();
         // private manifests: ManifestRegistry = new ManifestRegistry();
-        this.initializationQueue = [];
         this.controllers = new ControllerRegistry();
         this.eventBus = new EventBus();
         this.eventStream = new EventStream();
         // private snapshotSerializer: SnapshotSerializer = new SnapshotSerializer();
         // private runtimeManifests: ResourceManifest[] | null = null;
-        this.resourceInstances = new Map();
-        this.resourceEventBuses = new Map();
-        this.resourceChildren = new Map();
+        // private resourceInstances: Map<
+        //   string,
+        //   { resource: ResourceManifest; instance: ResourceInstance }
+        // > = new Map();
         this.holdCount = 0;
         this.idleResolvers = [];
         this._exitCode = 0;
-        this.bootContextRegistry = new BootContextRegistry();
+        // private bootContextRegistry = new BootContextRegistry();
         this.sharedSchemaValidator = new SchemaValidator();
+        this.staticManifests = [];
         this.setupEventStreaming();
     }
-    /**
-     * Register a resource dynamically during initialization
-     */
-    registerManifest(resource) {
-        this.initializationQueue.push(resource);
-    }
-    /**
-     * Register a child resource and track the parent-child relationship for cascade teardown
-     */
-    registerChildManifest(parentKey, resource) {
-        this.initializationQueue.push(resource);
-        const childKey = this.getResourceKey(resource.metadata.module, resource.kind, resource.metadata.name);
-        const children = this.resourceChildren.get(parentKey) ?? [];
-        children.push(childKey);
-        this.resourceChildren.set(parentKey, children);
-    }
-    /**
-     * Tear down a single resource and cascade to its children first
-     */
-    async teardownResource(module, kind, name) {
-        const key = this.getResourceKey(module, kind, name);
-        // Cascade: tear down children in reverse registration order first
-        const childKeys = this.resourceChildren.get(key) ?? [];
-        for (const childKey of [...childKeys].reverse()) {
-            const childEntry = this.resourceInstances.get(childKey);
-            if (childEntry) {
-                await this.teardownResource(childEntry.resource.metadata.module, childEntry.resource.kind, childEntry.resource.metadata.name);
-            }
-        }
-        this.resourceChildren.delete(key);
-        // Tear down self
-        const entry = this.resourceInstances.get(key);
-        if (!entry)
-            return;
-        const { resource, instance } = entry;
-        if (instance.teardown) {
-            await instance.teardown();
-        }
-        await this.eventBus.emit(`${resource.metadata.module}.${resource.kind}.${resource.metadata.name}.Teardown`, { resource: { kind: resource.kind, name: resource.metadata.name } });
-        this.resourceInstances.delete(key);
-        this.resourceEventBuses.delete(key);
-    }
     async registerController(moduleName, kindName, controllerInstance) {
         this.controllers.registerController(`${moduleName}.${kindName}`, controllerInstance);
         await controllerInstance.register?.(this.createControllerContext(`${moduleName}.${kindName}`));
@@ -84,59 +43,93 @@ export class Kernel {
      */
     registerResourceDefinition(definition) {
         this.controllers.registerDefinition(definition);
+        this.registry.registerDefinition(definition);
     }
-    registerCapability(name, schema) {
-        this.controllers.registerCapability(name, schema);
+    getModuleContext(_moduleName) {
+        return this.rootContext;
     }
-    isCapabilityRegistered(name) {
-        return this.controllers.isCapabilityRegistered(name);
+    resolveModuleAlias(_declaringModule, alias) {
+        return this.rootContext.importAliases.get(alias);
     }
-    getCapabilitySchema(name) {
-        return this.controllers.getCapabilitySchema(name);
+    registerModuleImport(_declaringModule, alias, targetModule, kinds) {
+        this.rootContext.registerImport(alias, targetModule, kinds);
+        this.registry.registerImport(alias, targetModule, kinds);
+    }
+    /** Returns the live analysis registry backed by this kernel's known definitions and aliases.
+     *  Pass to StaticAnalyzer.analyze() for incremental validation of new manifests against
+     *  already-registered types (e.g. front-end editor validating a manifest before submitting). */
+    getAnalysisRegistry() {
+        return this.registry;
     }
     /**
-     * Load built-in Runtime definitions (e.g., Runtime.Module)
+     * Load built-in Runtime definitions (e.g., Kernel.Module)
+     * Also declares all known module namespaces upfront so that resources can be
+     * registered to them. User-defined modules are declared explicitly by Kernel.Module
+     * resources during the initialization phase.
      */
     async loadBuiltinDefinitions() {
-        this.controllers.registerDefinition({
-            kind: "Runtime.Definition",
-            metadata: { name: "Definition", module: "Runtime" },
-            capabilities: ["template"],
-            schema: { type: "object" },
-        });
-        this.controllers.registerController("Runtime.Definition", await import("./controllers/resource-definition/resource-definition-controller.js"));
-        const moduleSchema = await import("./controllers/module/module.json", {
-            with: { type: "json" },
-        });
-        this.controllers.registerDefinition({
-            kind: "Runtime.Definition",
-            metadata: { name: "Module", module: "Runtime" },
-            capabilities: ["template"],
-            schema: moduleSchema,
-        });
-        this.controllers.registerController("Runtime.Module", await import("./controllers/module/module-controller.js"));
-        this.controllers.registerDefinition({
-            kind: "Runtime.Definition",
-            metadata: { name: "Capability", module: "Runtime" },
-            capabilities: ["template"],
-            schema: { type: "object" },
-        });
-        this.controllers.registerController("Runtime.Capability", await import("./controllers/capability/capability-controller.js"));
+        // Declare built-in module namespaces upfront so getContext() can distinguish
+        // "not yet populated" from a completely unknown module name.
+        this.rootContext.registerImport("Kernel", "Kernel", []); // built-ins, unrestricted
+        // Register built-in definitions with the controller registry.
+        // AnalysisRegistry's underlying DefinitionRegistry already seeds KERNEL_BUILTINS on construction.
+        for (const def of this.registry.builtinDefinitions())
+            this.controllers.registerDefinition(def);
+        this.controllers.registerController("Kernel.Definition", await import("./controllers/resource-definition/resource-definition-controller.js"));
+        this.controllers.registerController("Kernel.Module", await import("./controllers/module/module-controller.js"));
+        this.controllers.registerController("Kernel.Import", await import("./controllers/module/import-controller.js"));
     }
     /**
      * Load from runtime configuration file
      */
     async loadFromConfig(runtimeYamlPath) {
+        // Resolve directory paths to their module.yaml so that relative imports
+        // (e.g. ../../modules/foo) use the correct base directory.
+        const sourceUrl = await this.loader.resolveEntryPoint(new URL(runtimeYamlPath, `file://${process.cwd()}/`).href);
+        this.rootContext = new ModuleContext(sourceUrl, {}, {}, {}, [], this._createInstance.bind(this), (event, payload) => this.eventBus.emit(event, payload), process.env);
         // Initialize built-in Runtime definitions first
         await this.loadBuiltinDefinitions();
-        // Load built-in capability manifests before user configuration so that
-        // capability resources are available in the first initialization pass
-        const { fileURLToPath } = await import("url");
-        const capabilitiesDir = fileURLToPath(new URL("./capabilities/", import.meta.url));
-        const capabilityManifests = await this.loader.loadDirectory(capabilitiesDir);
-        // Load runtime configuration
-        const userManifests = await this.loader.loadManifest(runtimeYamlPath);
-        this.initializationQueue = [...capabilityManifests, ...userManifests];
+        // Phase 5: attach injection hook — fires between create() and init() for every resource
+        this.rootContext.preInitHook = (resource, getInstance) => this._injectDependencies(resource, getInstance);
+        // Static analysis pre-flight: validates schemas and invocation context compatibility.
+        // All errors are fatal — kernel does not start if analysis fails.
+        const staticManifests = await this.loader.loadManifests(sourceUrl);
+        this.staticManifests = staticManifests;
+        // Register module identities for x-telo-ref resolution (Phase 3 prerequisite).
+        // Kernel built-ins ("kernel" → "Kernel") are auto-registered when Kernel.Abstract
+        // definitions are registered in loadBuiltinDefinitions() above.
+        for (const m of staticManifests) {
+            if (m.kind === "Kernel.Module" && m.metadata?.name && m.metadata?.namespace) {
+                this.registry.registerModuleIdentity(m.metadata.namespace, m.metadata.name);
+            }
+        }
+        const errors = this.analyzer.analyzeErrors(staticManifests, {}, this.registry);
+        if (errors.length > 0) {
+            throw new RuntimeError("ERR_MANIFEST_VALIDATION_FAILED", "Manifest validation failed", errors.map((d) => ({
+                severity: "error",
+                message: d.message,
+                code: d.code !== undefined ? String(d.code) : undefined,
+                resource: d.data?.resource
+                    ? `${d.data.resource.kind}.${d.data.resource.name}`
+                    : undefined,
+            })));
+        }
+        // Load runtime configuration — root module gets access to host env
+        const allManifests = await this.loader.loadModule(sourceUrl, { compile: true });
+        // Phase 2: normalize inline resources — extract inline values from x-telo-ref slots
+        // into first-class named manifests and replace them in-place with {kind, name} references.
+        // Update staticManifests so Phase 3 (validateReferences) and Phase 4 (DAG) see
+        // the same normalized structure.
+        const normalizedManifests = this.analyzer.normalize(allManifests, this.registry);
+        this.staticManifests = normalizedManifests;
+        for (const manifest of normalizedManifests) {
+            if (manifest.kind === "Kernel.Module") {
+                this.rootContext.setSecrets(manifest.secrets ?? {});
+                this.rootContext.setVariables(manifest.variables ?? {});
+                this.rootContext.setTargets(manifest.targets ?? []);
+            }
+            this.rootContext.registerManifest(manifest);
+        }
     }
     /**
      * Phase 1: Load - Ingest files from directory and load runtime config
@@ -152,32 +145,44 @@ export class Kernel {
     async start() {
         // Call controller register hooks first (before any initialization)
         for (const kind of this.controllers.getKinds()) {
-            const controller = await this.controllers.getController(kind);
+            const controller = this.controllers.getController(kind);
             if (controller?.register) {
                 await controller.register(this.createControllerContext(`controller:${kind}`));
             }
         }
+        // Phase 3+4: reference validation, cycle detection, and topo sort
+        const { diagnostics: refErrors, order, cycleError, } = this.analyzer.prepare(this.staticManifests, this.registry);
+        if (refErrors.length > 0) {
+            throw new RuntimeError("ERR_MANIFEST_VALIDATION_FAILED", "Manifest validation failed", refErrors.map((d) => ({
+                severity: "error",
+                message: d.message,
+                code: d.code !== undefined ? String(d.code) : undefined,
+                resource: d.data?.resource
+                    ? `${d.data.resource.kind}.${d.data.resource.name}`
+                    : undefined,
+            })));
+        }
+        if (cycleError) {
+            throw new RuntimeError("ERR_CIRCULAR_DEPENDENCY", cycleError);
+        }
+        // Phase 5: sort pending resources into topo order so injection always finds
+        // initialized dependencies, then run the init loop.
+        if (order) {
+            this.rootContext.setInitOrder(order);
+        }
         // Initialize resources
         try {
-            await this.initializeResources();
-            await this.eventBus.emit("Runtime.Initialized", {});
-            await this.eventBus.emit("Runtime.Starting", {});
-            await this.runInstances();
-            await this.eventBus.emit("Runtime.Started", {});
+            await this.rootContext.initializeResources();
+            await this.eventBus.emit("Kernel.Initialized", {});
+            await this.eventBus.emit("Kernel.Starting", {});
+            await this.rootContext.runTargets();
+            await this.eventBus.emit("Kernel.Started", {});
             await this.waitForIdle();
         }
         finally {
-            await this.eventBus.emit("Runtime.Stopping", {});
-            await this.teardownResources();
-            await this.eventBus.emit("Runtime.Stopped", { exitCode: this._exitCode });
-        }
-    }
-    async runInstances() {
-        for (const entry of this.resourceInstances.values()) {
-            const { resource, instance } = entry;
-            if (instance.run) {
-                await instance.run();
-            }
+            await this.eventBus.emit("Kernel.Stopping", {});
+            await this.rootContext.teardownResources();
+            await this.eventBus.emit("Kernel.Stopped", { exitCode: this._exitCode });
         }
     }
     async emitRuntimeEvent(event, payload) {
@@ -192,7 +197,7 @@ export class Kernel {
     acquireHold(reason) {
         this.holdCount += 1;
         if (this.holdCount === 1) {
-            void this.eventBus.emit("Runtime.Blocked", {
+            void this.eventBus.emit("Kernel.Blocked", {
                 reason,
                 count: this.holdCount,
             });
@@ -209,7 +214,7 @@ export class Kernel {
                 for (const resolve of resolvers) {
                     resolve();
                 }
-                void this.eventBus.emit("Runtime.Unblocked", { count: this.holdCount });
+                void this.eventBus.emit("Kernel.Unblocked", { count: this.holdCount });
             }
         };
     }
@@ -234,18 +239,6 @@ export class Kernel {
     hasEventHandlers(event) {
         return this.eventBus.hasHandlers(event);
     }
-    hasResourceInstances() {
-        return this.resourceInstances.size > 0;
-    }
-    async teardownResources() {
-        const keys = Array.from(this.resourceInstances.keys()).reverse();
-        for (const key of keys) {
-            const entry = this.resourceInstances.get(key);
-            if (!entry)
-                continue; // already removed by a cascade
-            await this.teardownResource(entry.resource.metadata.module, entry.resource.kind, entry.resource.metadata.name);
-        }
-    }
     on(event, handler) {
         this.eventBus.on(event, handler);
     }
@@ -259,261 +252,94 @@ export class Kernel {
                 void this.eventBus.emit(namespaced, payload);
             },
             acquireHold: (reason) => this.acquireHold(reason),
-            evaluateCel: (expression, context) => evaluateCel(expression, context),
-            expandValue: (value, context) => expandValue(value, context),
+            expandValue: (value, context) => this.rootContext.expandWith(value, context),
             requestExit: (code) => this.requestExit(code),
         };
     }
-    createResourceContext(resource) {
-        const key = this.getResourceKey(resource.metadata.module, resource.kind, resource.metadata.name);
-        return new ResourceContextImpl(this, resource.metadata, this.sharedSchemaValidator, key);
-    }
-    getResourcesByKind(kind) {
-        const resources = [];
-        for (const entry of this.resourceInstances.values()) {
-            if (entry.resource.kind === kind) {
-                resources.push(entry.instance);
-            }
-        }
-        return resources;
-    }
-    getResourceByName(module, kind, name) {
-        // const [declarationModule, knd] = kind.includes('.')
-        //   ? kind.split('.', 2)
-        //   : ['Runtime', kind];
-        const key = this.getResourceKey(module, kind, name);
-        const entry = this.resourceInstances.get(key);
-        if (entry) {
-            return entry.instance;
-        }
-        return null;
+    createResourceContext(moduleContext, resource) {
+        return new ResourceContextImpl(this, moduleContext, resource.metadata, this.sharedSchemaValidator);
     }
     /**
-     * Returns the unique set of local file paths from which resources were loaded.
-     * HTTP/HTTPS sources are excluded — they cannot be watched on disk.
+     * Create phase only: resolves the controller, validates the schema, and calls
+     * controller.create(). Returns { instance, ctx } so initializeResources can
+     * run init() separately in its second phase. Returns null when the controller
+     * is not yet registered (retry signal).
      */
-    getSourceFiles() {
-        const seen = new Set();
-        for (const { resource } of this.resourceInstances.values()) {
-            const src = resource.metadata.source;
-            if (src && !src.startsWith("http://") && !src.startsWith("https://")) {
-                seen.add(src);
-            }
+    async _createInstance(evalContext, resource) {
+        const kind = resource.kind;
+        // Resolve the alias-prefixed kind to its real fully-qualified kind.
+        // resolveKind() throws with a clear message if the alias or kind is not found.
+        const resolvedKind = this.rootContext.resolveKind(kind);
+        const controller = this.controllers.getControllerOrUndefined(resolvedKind);
+        if (!controller) {
+            const kindInfo = resolvedKind !== kind ? `'${kind}' (resolved to '${resolvedKind}')` : `'${kind}'`;
+            throw new Error(`No controller registered for kind ${kindInfo}, known controllers are: ${this.controllers.getKinds().join(", ")}`);
         }
-        return Array.from(seen);
-    }
-    /**
-     * Reload all resources that were loaded from the given source file.
-     * Safe order: parse first → if parse succeeds, tear down old → init new → run new only.
-     */
-    async reloadSource(sourcePath) {
-        // Parse first — bail before touching running resources if the file is invalid
-        const newManifests = await this.loader.loadManifest(sourcePath);
-        // Collect keys of resources loaded from this source (in insertion order)
-        const keysFromSource = [];
-        for (const [key, { resource }] of this.resourceInstances.entries()) {
-            if (resource.metadata.source === sourcePath) {
-                keysFromSource.push(key);
-            }
+        if (!controller.create) {
+            throw new RuntimeError("ERR_CONTROLLER_INVALID", `Controller for ${kind} does not implement create method`);
         }
-        // Tear down in reverse order (children first via cascade)
-        for (const key of [...keysFromSource].reverse()) {
-            const entry = this.resourceInstances.get(key);
-            if (!entry)
-                continue; // already removed by a cascade
-            await this.teardownResource(entry.resource.metadata.module, entry.resource.kind, entry.resource.metadata.name);
+        if (!controller.schema?.type) {
+            throw new Error(`No schema defined for ${kind} controller`);
         }
-        // Queue new manifests and initialize them
-        for (const manifest of newManifests) {
-            this.initializationQueue.push(manifest);
+        // Resolve eval paths from x-telo-eval annotations in the parent and own schema
+        const definition = this.controllers.getDefinition(resolvedKind);
+        const parentDef = definition?.capability
+            ? this.controllers.getDefinition(definition.capability)
+            : undefined;
+        const parentEval = parentDef?.schema
+            ? buildEvalPaths(parentDef.schema)
+            : { compile: [], runtime: [] };
+        const ownEval = definition?.schema
+            ? buildEvalPaths(definition.schema)
+            : { compile: [], runtime: [] };
+        const compile = [...parentEval.compile, ...ownEval.compile];
+        const runtime = [...parentEval.runtime, ...ownEval.runtime];
+        // Schema validation runs before CEL evaluation so it sees the original manifest
+        // shape. CompiledValue wrappers (from load-time precompilation) are stripped,
+        // restoring the pre-CEL string view that the schema expects.
+        try {
+            this.sharedSchemaValidator
+                .compile(controller.schema)
+                .validate(stripCompiledValues(resource, controller.schema));
         }
-        const keysBefore = new Set(this.resourceInstances.keys());
-        await this.initializeResources();
-        // Run only newly created instances (not all instances — avoids double-run)
-        const newKeys = Array.from(this.resourceInstances.keys()).filter((k) => !keysBefore.has(k));
-        for (const key of newKeys) {
-            const entry = this.resourceInstances.get(key);
-            if (entry?.instance.run) {
-                await entry.instance.run();
-            }
+        catch (error) {
+            throw new RuntimeError("ERR_RESOURCE_SCHEMA_VALIDATION_FAILED", `Resource does not match schema for kind ${kind}: ${error instanceof Error ? error.message : String(error)}`);
         }
+        // Expand compile-time CEL fields before passing to the controller.
+        const processedResource = compile.length
+            ? evalContext.expandPaths(resource, compile, runtime)
+            : resource;
+        const ctx = this.createResourceContext(evalContext, processedResource);
+        const instance = await controller.create(processedResource, ctx);
+        if (!instance)
+            return null;
+        if (!runtime.length)
+            return { instance, ctx };
+        const wrapped = {
+            ...instance,
+            invoke: async (inputs) => {
+                const expanded = evalContext.expandPaths(inputs, runtime);
+                return instance.invoke(expanded);
+            },
+        };
+        return { instance: wrapped, ctx };
     }
-    async initializeResources() {
-        /**
-         * Step 4: Multi-Pass Controller Discovery Loop (Max 10 Passes)
-         * Loop up to 10 passes to discover controllers and create resource instances.
-         * Each pass removes handled resources from the list, making subsequent passes faster.
-         */
-        // Collect all resources from registry as a list
-        let passNumber = 1;
-        const MAX_PASSES = 10;
-        const createdResources = [];
-        let handledThisPass = [];
-        // Track latest error for each resource
-        const resourceErrors = new Map();
-        // Multi-pass loop
-        do {
-            handledThisPass = [];
-            for (const resource of this.initializationQueue) {
-                const kind = resource.kind;
-                const key = this.getResourceKey(resource.metadata.module, kind, resource.metadata.name);
-                const resourceId = `${kind}:${resource.metadata.name}`;
-                // Skip if already created
-                if (this.resourceInstances.has(key)) {
-                    continue;
-                }
-                const controller = this.controllers.getControllerOrUndefined(kind);
-                if (!controller) {
-                    // No controller and no definition - track error and skip for now
-                    resourceErrors.set(resourceId, `No controller registered for kind: ${kind}`);
-                    continue;
-                }
-                if (!controller.create) {
-                    // Controller exists but has no create method, skip
-                    throw new RuntimeError("ERR_CONTROLLER_INVALID", `Controller for ${kind} does not implement create method`);
-                }
-                try {
-                    if (!controller.schema || !controller.schema.type) {
-                        throw new Error(`No schema defined for ${kind} controller`);
-                    }
-                    // AOT: resolve static boot-context expressions before schema validation
-                    // and controller creation. This is a no-op until at least one provider
-                    // has registered its context.
-                    let resolvedResource = resource;
-                    if (this.bootContextRegistry.hasProviders()) {
-                        const bootContext = this.bootContextRegistry.buildContext(resource.kind, resource.metadata.name, resource);
-                        resolvedResource = resolveManifestWithContext(resource, bootContext);
-                    }
-                    this.sharedSchemaValidator.compile(controller.schema).validate(resolvedResource);
-                    // Create resource instance using the resolved manifest
-                    const instance = await controller.create(resolvedResource, this.createResourceContext(resolvedResource));
-                    if (instance) {
-                        if (instance.init) {
-                            await instance.init(this.createResourceContext(resolvedResource));
-                        }
-                        // Register ContextProvider after init() — init may populate context state
-                        if (isContextProvider(instance)) {
-                            this.bootContextRegistry.register(resource.kind, resource.metadata.name, resource.metadata.module, resource.grants, instance.provideContext());
-                        }
-                        this.resourceInstances.set(key, { resource: resolvedResource, instance });
-                        createdResources.push({ kind, resource: resolvedResource, instance });
-                        handledThisPass.push({ kind, resource });
-                        resourceErrors.delete(resourceId);
-                    }
-                    this.initializationQueue = this.initializationQueue.filter((r) => r.metadata.module !== resource.metadata.module ||
-                        r.kind !== resource.kind ||
-                        r.metadata.name !== resource.metadata.name);
-                }
-                catch (error) {
-                    // Security violations are fatal — never retry
-                    if (error instanceof RuntimeError && error.code === "ERR_VISIBILITY_DENIED") {
-                        throw error;
-                    }
-                    // Creation failed - track latest error and retry later
-                    resourceErrors.set(resourceId, error instanceof Error ? (error.stack ?? error.message) : String(error));
-                }
-            }
-            passNumber++;
-        } while (passNumber <= MAX_PASSES && handledThisPass.length > 0);
-        const unhandledResources = new Map();
-        // After loop, collect any resources that were never handled
-        for (const { kind, metadata } of this.initializationQueue) {
-            const key = this.getResourceKey(metadata.module, kind, metadata.name);
-            if (!this.resourceInstances.has(key)) {
-                const resourceId = `${kind}:${metadata.name}`;
-                const errorMessage = resourceErrors.get(resourceId) || "Unknown error";
-                unhandledResources.set(resourceId, errorMessage);
+    /**
+     * Phase 5 — Inject live instances into reference fields of a resource config.
+     *
+     * Called between create() and init() for every resource. Walks the definition's
+     * field map and replaces each {kind, name} reference value (outside scope visibility
+     * paths) with the live ResourceInstance returned by getInstance(name). Fields within
+     * scope paths are left as {kind, name} — the controller resolves them at runtime.
+     */
+    _injectDependencies(resource, getInstance) {
+        this.registry.iterateFieldEntries(resource, (fieldPath) => injectAtPath(resource, fieldPath, getInstance), (fieldPath) => {
+            const val = resource[fieldPath];
+            if (Array.isArray(val)) {
+                resource[fieldPath] = this.rootContext.createScopeHandle(val);
             }
-        }
-        // After all passes complete, check for unhandled resources
-        if (unhandledResources.size > 0) {
-            const unhandledList = Array.from(unhandledResources.entries())
-                .reverse() // Most relevant errors (root causes) are last in the list, so reverse to show them first
-                .map(([resource, error]) => `- ${resource}: ${error}`)
-                .join("\n");
-            throw new RuntimeError("ERR_CONTROLLER_NOT_FOUND", `Unable to process resources:\n\n${unhandledList}`);
-        }
-    }
-    // /**
-    //  * Execute - Dispatch execution request to appropriate controller
-    //  */
-    // async execute(urn: string, input: any, ctx?: any): Promise<any> {
-    //   const [kind, name] = this.parseUrn(urn);
-    //   // Lookup resource
-    //   const resource = this.manifests.get(kind, name);
-    //   if (!resource) {
-    //     throw new RuntimeError("ERR_RESOURCE_NOT_FOUND", `Resource not found: ${urn}`);
-    //   }
-    //   // Find controller for this Kind
-    //   const controller = await this.controllers.getController(kind);
-    //   if (!controller) {
-    //     throw new RuntimeError(
-    //       "ERR_CONTROLLER_NOT_FOUND",
-    //       `No controller registered for Kind: ${kind}`,
-    //     );
-    //   }
-    //   // Create execution context with recursive execute capability
-    //   const execContext: ExecContext = {
-    //     execute: (nestedUrn: string, nestedInput: any) => this.execute(nestedUrn, nestedInput, ctx),
-    //     ...ctx,
-    //   };
-    //   try {
-    //     await this.eventBus.emit(`${name}.ExecutionStarted`, { urn });
-    //     const result = await controller.execute?.(name, input, {
-    //       ...execContext,
-    //       resource,
-    //     });
-    //     await this.eventBus.emit(`${name}.ExecutionCompleted`, { urn });
-    //     return result;
-    //   } catch (error) {
-    //     await this.eventBus.emit(`${name}.ExecutionFailed`, {
-    //       urn,
-    //       error: error instanceof Error ? error.message : String(error),
-    //     });
-    //     throw new RuntimeError(
-    //       "ERR_EXECUTION_FAILED",
-    //       `Execution failed for ${urn}: ${error instanceof Error ? error.message : String(error)}`,
-    //     );
-    //   }
-    // }
-    // private parseUrn(urn: string): [string, string] {
-    //   const separator = urn.lastIndexOf(".");
-    //   if (separator <= 0 || separator === urn.length - 1) {
-    //     throw new Error(
-    //       `Invalid URN format: ${urn}. Expected "Kind.Name" where Kind can include dots`,
-    //     );
-    //   }
-    //   const kind = urn.slice(0, separator);
-    //   const name = urn.slice(separator + 1);
-    //   return [kind, name];
-    // }
-    async invoke(module, kind, name, ...args) {
-        const instance = this.getResourceByName(module, kind, name);
-        if (!instance) {
-            throw new RuntimeError("ERR_RESOURCE_NOT_FOUND", `Resource not found for invocation: ${module}.${kind}.${name}`);
-        }
-        if (typeof instance !== "object" || typeof instance["invoke"] !== "function") {
-            throw new RuntimeError("ERR_RESOURCE_NOT_INVOKABLE", `Resource ${kind}.${name} does not have an invoke method`);
-        }
-        const outputs = await instance["invoke"](...args);
-        this.emitRuntimeEvent(`${module}.${kind}.${name}.Invoked`, {
-            outputs,
         });
-        return outputs;
     }
-    getResourceKey(module, kind, name) {
-        if (!kind.includes(".")) {
-            throw new Error(`Resource kind must include module prefix: ${kind}`);
-        }
-        return `${module}.${kind}.${name}`;
-    }
-    // private assertResourceEventAllowed(event: string): void {
-    //   const parts = event.split(".");
-    //   const leaf = parts[parts.length - 1];
-    //   if (leaf === "Initialized" || leaf === "Teardown") {
-    //     throw new Error(`Resource events cannot use reserved lifecycle event: ${leaf}`);
-    //   }
-    // }
     /**
      * Enable event streaming to a file (JSONL format)
      */
@@ -532,16 +358,6 @@ export class Kernel {
     getEventStream() {
         return this.eventStream;
     }
-    /**
-     * Take a snapshot of current runtime state
-     */
-    // async takeSnapshot(filePath?: string) {
-    //   return this.snapshotSerializer.takeSnapshot(
-    //     this.manifests.getAll(),
-    //     this.resourceInstances,
-    //     filePath,
-    //   );
-    // }
     /**
      * Setup event streaming hook to capture all events
      */
@@ -555,4 +371,132 @@ export class Kernel {
         };
     }
 }
+/** Returns a schema-appropriate placeholder value for a CompiledValue field. */
+function placeholderForSchema(schema) {
+    if (schema.default !== undefined)
+        return schema.default;
+    switch (schema.type) {
+        case "integer":
+        case "number":
+            return schema.minimum ?? 0;
+        case "boolean":
+            return false;
+        case "array":
+            return [];
+        case "object":
+            return {};
+        default:
+            return "";
+    }
+}
+/** Replaces CompiledValue wrappers with schema-appropriate placeholders for schema validation.
+ *  Template strings were compiled from YAML at load time; this restores a shape
+ *  that AJV can validate without evaluating expressions. */
+function stripCompiledValues(v, schema = {}) {
+    if (isCompiledValue(v))
+        return placeholderForSchema(schema);
+    if (Array.isArray(v)) {
+        const itemSchema = (schema.items ?? {});
+        return v.map((item) => stripCompiledValues(item, itemSchema));
+    }
+    if (v !== null && typeof v === "object") {
+        const props = (schema.properties ?? {});
+        const out = {};
+        for (const [k, val] of Object.entries(v)) {
+            out[k] = stripCompiledValues(val, props[k] ?? {});
+        }
+        return out;
+    }
+    return v;
+}
+/**
+ * Walks `resource` following `fieldPath` (dot notation, `[]` = array traversal).
+ * For each leaf value that looks like a {kind, name} reference, calls getInstance(name)
+ * and replaces the value in-place with the returned live ResourceInstance.
+ * Values where getInstance returns undefined are left unchanged.
+ */
+/**
+ * Traverses a definition schema and collects all paths annotated with `x-telo-eval`.
+ * Root-level `x-telo-eval` produces the `"**"` wildcard (expand all fields).
+ * Property-level annotations produce the dot-notation path to that property.
+ */
+function buildEvalPaths(schema) {
+    const compile = [];
+    const runtime = [];
+    if (schema["x-telo-eval"] === "compile")
+        compile.push("**");
+    else if (schema["x-telo-eval"] === "runtime")
+        runtime.push("**");
+    if (schema.properties) {
+        for (const [key, propSchema] of Object.entries(schema.properties)) {
+            collectEvalPathsNode(propSchema, key, compile, runtime);
+        }
+    }
+    return { compile, runtime };
+}
+function collectEvalPathsNode(node, path, compile, runtime) {
+    if (node["x-telo-eval"] === "compile") {
+        compile.push(path);
+        return;
+    }
+    if (node["x-telo-eval"] === "runtime") {
+        runtime.push(path);
+        return;
+    }
+    if (node.properties) {
+        for (const [key, propSchema] of Object.entries(node.properties)) {
+            collectEvalPathsNode(propSchema, `${path}.${key}`, compile, runtime);
+        }
+    }
+}
+function injectAtPath(resource, fieldPath, getInstance) {
+    const parts = fieldPath.split(".");
+    function traverse(obj, partsLeft) {
+        if (!obj || typeof obj !== "object" || partsLeft.length === 0)
+            return;
+        const [head, ...rest] = partsLeft;
+        const isArr = head.endsWith("[]");
+        const key = isArr ? head.slice(0, -2) : head;
+        const container = obj;
+        const val = container[key];
+        if (val == null)
+            return;
+        if (isArr) {
+            if (!Array.isArray(val))
+                return;
+            for (let i = 0; i < val.length; i++) {
+                const elem = val[i];
+                if (!elem || typeof elem !== "object")
+                    continue;
+                if (rest.length === 0) {
+                    const ref = elem;
+                    if (typeof ref.kind === "string" && typeof ref.name === "string") {
+                        const instance = getInstance(ref.name);
+                        if (instance)
+                            val[i] = instance;
+                    }
+                }
+                else {
+                    traverse(elem, rest);
+                }
+            }
+        }
+        else {
+            if (rest.length === 0) {
+                if (val && typeof val === "object" && !Array.isArray(val)) {
+                    const ref = val;
+                    if (typeof ref.kind === "string" && typeof ref.name === "string") {
+                        const instance = getInstance(ref.name);
+                        if (instance)
+                            container[key] = instance;
+                    }
+                }
+            }
+            else {
+                traverse(val, rest);
+            }
+        }
+    }
+    traverse(resource, parts);
+}
 //# sourceMappingURL=kernel.js.map