@telorun/kernel 0.2.9 → 0.3.0

package/src/controllers/module/import-controller.ts

@@ -1,25 +1,34 @@
-import { DiagnosticSeverity, Loader, StaticAnalyzer } from "@telorun/analyzer";
+import { DiagnosticSeverity, StaticAnalyzer } from "@telorun/analyzer";
 import type { ResourceContext, ResourceInstance } from "@telorun/sdk";
 import { RuntimeError } from "@telorun/sdk";
 import { ModuleContext } from "../../module-context.js";
-import { LocalFileAdapter } from "../../manifest-adapters/local-file-adapter.js";
 
 const importAnalysisCache = new Map<
   string,
   { signature: string; errors: string[] }
 >();
 
+// Only resolve relative/absolute-path sources against the importer's URL. Registry refs
+// (std/foo@1.2.3) and absolute URLs (https://, file://) must pass through unchanged so the
+// loader's adapter chain can dispatch them — otherwise `new URL("std/foo@1", "file:///srv/telo.yaml")`
+// turns a registry ref into a bogus file path and LocalFileAdapter ENOENTs on it.
+function resolveImportSource(source: string, baseSource: string): string {
+  if (source.startsWith(".") || source.startsWith("/")) {
+    return new URL(source, baseSource).toString();
+  }
+  return source;
+}
+
 export async function create(resource: any, ctx: ResourceContext): Promise<ResourceInstance> {
   const alias = resource.metadata.name as string;
-  const loader = new Loader([new LocalFileAdapter()]);
 
   const moduleSource: string = resource.module ?? resource.source;
 
   // Validate the imported module and all its transitive imports before loading for runtime.
-  // loadManifests() follows Kernel.Import chains so definitions from sub-imports are present,
+  // loadManifests() follows Telo.Import chains so definitions from sub-imports are present,
   // preventing false UNDEFINED_KIND errors for kinds that come from the module's own imports.
-  const resolvedUrl = new URL(moduleSource, ctx.moduleContext.source).toString();
-  const analysisManifests = await loader.loadManifests(resolvedUrl);
+  const resolvedUrl = resolveImportSource(moduleSource, ctx.moduleContext.source);
+  const analysisManifests = await ctx.loadManifests(resolvedUrl);
   const signature = JSON.stringify(analysisManifests);
   const cached = importAnalysisCache.get(resolvedUrl);
   let errors: string[];
@@ -44,16 +53,20 @@ export async function create(resource: any, ctx: ResourceContext): Promise<Resou
   // Load target module manifests for runtime. Inject variables/secrets as compile context so
   // that ${{ variables.x }} / ${{ secrets.y }} templates in the child module resolve correctly.
   // No env — child modules are isolated from host environment.
-  const manifests = await loader.loadModule(
-    new URL(moduleSource, ctx.moduleContext.source).toString(),
-    {
-      compile: true,
-    },
-  );
-  // Find the kind: Module manifest to learn the target module name and contract.
-  const moduleManifest = manifests.find((m: any) => m.kind === "Kernel.Module");
+  const manifests = await ctx.loadModule(resolvedUrl, {
+    compile: true,
+  });
+  // Import targets must be Telo.Library — Applications are run directly, not imported.
+  const moduleManifest = manifests.find((m: any) => m.kind === "Telo.Library");
   if (!moduleManifest) {
-    throw new Error(`No kind: Module manifest found in source "${resource.source as string}"`);
+    const applicationManifest = manifests.find((m: any) => m.kind === "Telo.Application");
+    if (applicationManifest) {
+      throw new RuntimeError(
+        "ERR_MANIFEST_VALIDATION_FAILED",
+        `Telo.Import target '${resource.source as string}' is a Telo.Application. Only Telo.Library modules may be imported. Applications are run directly, not imported.`,
+      );
+    }
+    throw new Error(`No Telo.Library manifest found in source "${resource.source as string}"`);
   }
   const targetModule: string = moduleManifest.metadata.name;
 
@@ -102,19 +115,6 @@ export async function create(resource: any, ctx: ResourceContext): Promise<Resou
       variables: ctx.expandValue(resource.variables, {}) ?? {},
       secrets: ctx.expandValue(resource.secrets, {}) ?? {},
     }),
-    run: async () => {
-      // Proxy run to target module
-      for (const target of (moduleManifest.targets as string[]) ?? []) {
-        await child.run(target);
-      }
-    },
-    invoke: async () => {
-      // Proxy run to target module
-      // for (const target of (moduleManifest.targets as string[]) ?? []) {
-      //   child.invoke(target);
-      // }
-      console.log("invoking");
-    },
     init: async () => {
       await child.initializeResources();
     },

package/src/controllers/resource-definition/resource-definition-controller.ts

@@ -9,7 +9,7 @@ import { formatAjvErrors, validateResourceDefinition } from "../../manifest-sche
 import { createTemplateController } from "./resource-template-controller.js";
 
 type ResourceDefinitionResource = RuntimeResource & {
-  kind: "Kernel.Definition";
+  kind: "Telo.Definition";
   metadata: {
     [key: string]: any;
     name: string;

package/src/evaluation-context.ts

@@ -1,11 +1,13 @@
 import {
   isCompiledValue,
+  isInvokeError,
   resourceKey,
   type EvaluationContext as IEvaluationContext,
   type EmitEvent,
   type InstanceFactory,
   type LifecycleState,
   type PreInitHook,
+  type ResourceDefinition,
   type ResourceInstance,
   type ResourceManifest,
   type RuntimeDiagnostic,
@@ -62,6 +64,13 @@ export class EvaluationContext implements IEvaluationContext {
    */
   preInitHook?: PreInitHook;
 
+  /**
+   * Optional definition lookup used by invoke()/invokeResolved() to check
+   * thrown InvokeError.code against the declared throw union (rule 9).
+   * Set by the kernel; propagates through spawnChild() like preInitHook.
+   */
+  getDefinition?: (kind: string) => ResourceDefinition | undefined;
+
   constructor(
     readonly source: string,
     context: Record<string, unknown>,
@@ -139,6 +148,9 @@ export class EvaluationContext implements IEvaluationContext {
     if (this.preInitHook && !child.preInitHook) {
       child.preInitHook = this.preInitHook;
     }
+    if (this.getDefinition && !child.getDefinition) {
+      child.getDefinition = this.getDefinition;
+    }
     return child;
   }
 
@@ -152,13 +164,13 @@ export class EvaluationContext implements IEvaluationContext {
    *      resource. Successful results go into resourceInstances.
    *
    * Interleaving is necessary because some resources' create() depends on effects
-   * produced by other resources' init() (e.g. Kernel.Import.init() runs
+   * produced by other resources' init() (e.g. Telo.Import.init() runs
    * child.initializeResources() which registers controllers needed by sibling
    * resources' create()). Running both sub-phases each pass lets those effects
    * propagate before the next create attempt.
    *
    * Each resource is created at most once and inited at most once.
-   * ERR_VISIBILITY_DENIED is fatal and re-thrown immediately.
+   * ERR_VISIBILITY_DENIED and ERR_FATAL are re-thrown immediately.
    * All other errors are tracked and retried until no progress is made.
    */
   async initializeResources(): Promise<void> {
@@ -189,7 +201,7 @@ export class EvaluationContext implements IEvaluationContext {
             progress = true;
           }
         } catch (error) {
-          if (error instanceof RuntimeError && error.code === "ERR_VISIBILITY_DENIED") throw error;
+          if (error instanceof RuntimeError && (error.code === "ERR_VISIBILITY_DENIED" || error.code === "ERR_FATAL")) throw error;
           errors.set(name, error instanceof Error ? error.message : String(error));
         }
       }
@@ -211,7 +223,7 @@ export class EvaluationContext implements IEvaluationContext {
           errors.delete(name);
           progress = true;
         } catch (error) {
-          if (error instanceof RuntimeError && error.code === "ERR_VISIBILITY_DENIED") throw error;
+          if (error instanceof RuntimeError && (error.code === "ERR_VISIBILITY_DENIED" || error.code === "ERR_FATAL")) throw error;
           errors.set(name, error instanceof Error ? error.message : String(error));
         }
       }
@@ -362,27 +374,98 @@ export class EvaluationContext implements IEvaluationContext {
 
   /**
    * Invoke a resource by kind and name within this context's resourceInstances.
-   * Emits a scoped Invoked event via the injected emit callback after invocation.
+   * Emits a scoped Invoked/InvokeRejected/InvokeFailed event via the injected
+   * emit callback. The single emission point for invoke-level events — callers
+   * holding an already-resolved instance should use invokeResolved() instead.
    */
   async invoke<TInputs>(kind: string, name: string, inputs: TInputs): Promise<any> {
     const entry = this.resourceInstances.get(name);
 
-    if (entry) {
-      if (typeof entry.instance.invoke !== "function") {
-        throw new RuntimeError(
-          "ERR_RESOURCE_NOT_INVOKABLE",
-          `Resource ${kind}.${name} does not have an invoke method`,
-        );
-      }
-      const outputs = await entry.instance.invoke(inputs as any);
+    if (!entry) {
+      throw new RuntimeError(
+        "ERR_RESOURCE_NOT_FOUND",
+        `Resource not found for invocation: ${kind}.${name}. Available resources: ${[...this.resourceInstances.keys()].join(", ")}`,
+      );
+    }
+
+    if (typeof entry.instance.invoke !== "function") {
+      throw new RuntimeError(
+        "ERR_RESOURCE_NOT_INVOKABLE",
+        `Resource ${kind}.${name} does not have an invoke method`,
+      );
+    }
+
+    return this.runInvoke(kind, name, entry.instance, inputs);
+  }
+
+  /**
+   * Like invoke(), but the caller has already resolved the instance (e.g. the
+   * scope path in Run.Sequence, or the live-injected Http.Api route handler).
+   * Shares the single emission point so events fire exactly once per call
+   * regardless of which path reached the instance.
+   */
+  async invokeResolved<TInputs>(
+    kind: string,
+    name: string,
+    instance: ResourceInstance,
+    inputs: TInputs,
+  ): Promise<any> {
+    if (typeof instance.invoke !== "function") {
+      throw new RuntimeError(
+        "ERR_RESOURCE_NOT_INVOKABLE",
+        `Resource ${kind}.${name} does not have an invoke method`,
+      );
+    }
+    return this.runInvoke(kind, name, instance, inputs);
+  }
+
+  private async runInvoke<TInputs>(
+    kind: string,
+    name: string,
+    instance: ResourceInstance,
+    inputs: TInputs,
+  ): Promise<any> {
+    try {
+      const outputs = await (instance.invoke as (i: any) => any)(inputs as any);
       await this.emit(`${kind}.${name}.Invoked`, { outputs });
       return outputs;
+    } catch (err) {
+      if (isInvokeError(err)) {
+        const payload = { code: err.code, message: err.message, data: err.data };
+        await this.emit(`${kind}.${name}.InvokeRejected`, payload);
+        const declaredCodes = this.getDeclaredThrowCodes(kind);
+        if (declaredCodes && !declaredCodes.has(err.code)) {
+          await this.emit(`${kind}.${name}.InvokeRejected.Undeclared`, payload);
+        }
+      } else if (err instanceof Error) {
+        await this.emit(`${kind}.${name}.InvokeFailed`, {
+          name: err.name,
+          message: err.message,
+        });
+      } else {
+        await this.emit(`${kind}.${name}.InvokeFailed`, {
+          name: "UnknownError",
+          message: String(err),
+        });
+      }
+      throw err;
     }
+  }
 
-    throw new RuntimeError(
-      "ERR_RESOURCE_NOT_FOUND",
-      `Resource not found for invocation: ${kind}.${name}. Available resources: ${[...this.resourceInstances.keys()].join(", ")}`,
-    );
+  private getDeclaredThrowCodes(kind: string): Set<string> | null {
+    if (!this.getDefinition) return null;
+    const def = this.getDefinition(kind);
+    if (!def) return null;
+    const throws = def.throws;
+    if (!throws) return new Set();
+    // inherit / passthrough unions are dynamic — resolved statically by the
+    // analyzer, not re-derivable here without a manifest-wide traversal. Skip
+    // the rule 9 check rather than mis-report every propagated code as
+    // undeclared at runtime.
+    if (throws.inherit || throws.passthrough) return null;
+    const codes = throws.codes;
+    if (!codes) return new Set();
+    return new Set(Object.keys(codes));
   }
 
   async run(name: string): Promise<void> {
@@ -402,7 +485,13 @@ export class EvaluationContext implements IEvaluationContext {
    */
   expand(value: unknown): unknown {
     if (isCompiledValue(value)) {
-      return value.call(this._context);
+      try {
+        return value.call(this._context);
+      } catch (error) {
+        const expr = value.source ? `\${{ ${value.source} }}` : "unknown expression";
+        const msg = error instanceof Error ? error.message : String(error);
+        throw new Error(`Expression ${expr} failed: ${msg}`);
+      }
     }
     if (Array.isArray(value)) {
       return value.map((entry) => this.expand(entry));

package/src/kernel.ts

@@ -1,7 +1,8 @@
-import { AnalysisRegistry, DEFAULT_MANIFEST_FILENAME, Loader, StaticAnalyzer } from "@telorun/analyzer";
+import { AnalysisRegistry, DEFAULT_MANIFEST_FILENAME, isModuleKind, Loader, StaticAnalyzer } from "@telorun/analyzer";
 import {
   ControllerContext,
   Kernel as IKernel,
+  type LoadOptions,
   ResourceContext,
   ResourceDefinition,
   ResourceInstance,
@@ -13,6 +14,7 @@ import {
   type ModuleContext as IModuleContext,
   type ParsedArgs,
 } from "@telorun/sdk";
+import { createHash } from "node:crypto";
 import { ModuleContext } from "./module-context.js";
 import * as path from "path";
 import { parseArgs } from "util";
@@ -29,15 +31,23 @@ export interface KernelOptions {
   stderr?: NodeJS.WritableStream;
   env?: Record<string, string | undefined>;
   argv?: string[];
+  /** Base URL for the registry adapter. When unset, the RegistryAdapter
+   *  default applies. Callers (e.g. the CLI) are responsible for resolving
+   *  `TELO_REGISTRY_URL` or any other env-based fallback before passing. */
+  registryUrl?: string;
 }
 
 /**
  * Kernel: Central orchestrator managing lifecycle and message bus
  * Handles resource loading, initialization, and execution through controllers
  */
+const celHandlers = {
+  sha256: (s: string) => createHash("sha256").update(s).digest("hex"),
+};
+
 export class Kernel implements IKernel {
-  private readonly loader = new Loader();
-  private readonly analyzer = new StaticAnalyzer();
+  private readonly loader: Loader;
+  private readonly analyzer = new StaticAnalyzer({ celHandlers });
   private readonly registry = new AnalysisRegistry();
   private controllers: ControllerRegistry = new ControllerRegistry();
   private eventBus: EventBus = new EventBus();
@@ -55,6 +65,7 @@ export class Kernel implements IKernel {
   readonly stderr: NodeJS.WritableStream;
   readonly env: Record<string, string | undefined>;
   readonly argv: string[];
+  readonly registryUrl: string | undefined;
 
   constructor(options: KernelOptions = {}) {
     this.stdin = options.stdin ?? process.stdin;
@@ -62,6 +73,8 @@ export class Kernel implements IKernel {
     this.stderr = options.stderr ?? process.stderr;
     this.env = options.env ?? process.env;
     this.argv = options.argv ?? [];
+    this.registryUrl = options.registryUrl;
+    this.loader = new Loader({ registryUrl: this.registryUrl, celHandlers });
     this.loader.register(new LocalFileAdapter());
     this.setupEventStreaming();
   }
@@ -101,6 +114,14 @@ export class Kernel implements IKernel {
     this.registry.registerImport(alias, targetModule, kinds);
   }
 
+  loadModule(url: string, options?: LoadOptions): Promise<ResourceManifest[]> {
+    return this.loader.loadModule(url, options);
+  }
+
+  loadManifests(url: string): Promise<ResourceManifest[]> {
+    return this.loader.loadManifests(url);
+  }
+
   /** Returns the live analysis registry backed by this kernel's known definitions and aliases.
    *  Pass to StaticAnalyzer.analyze() for incremental validation of new manifests against
    *  already-registered types (e.g. front-end editor validating a manifest before submitting). */
@@ -109,30 +130,29 @@ export class Kernel implements IKernel {
   }
 
   /**
-   * Load built-in Runtime definitions (e.g., Kernel.Module)
+   * Load built-in Runtime definitions (e.g., Telo.Application, Telo.Library).
    * Also declares all known module namespaces upfront so that resources can be
-   * registered to them. User-defined modules are declared explicitly by Kernel.Module
-   * resources during the initialization phase.
+   * registered to them. User-defined modules are declared explicitly by
+   * Telo.Application or Telo.Library resources during the initialization phase.
    */
   private async loadBuiltinDefinitions(): Promise<void> {
     // Declare built-in module namespaces upfront so getContext() can distinguish
     // "not yet populated" from a completely unknown module name.
-    this.rootContext.registerImport("Kernel", "Kernel", []); // built-ins, unrestricted
+    this.rootContext.registerImport("Telo", "Telo", []); // built-ins, unrestricted
 
     // Register built-in definitions with the controller registry.
     // AnalysisRegistry's underlying DefinitionRegistry already seeds KERNEL_BUILTINS on construction.
     for (const def of this.registry.builtinDefinitions()) this.controllers.registerDefinition(def);
 
     this.controllers.registerController(
-      "Kernel.Definition",
+      "Telo.Definition",
       await import("./controllers/resource-definition/resource-definition-controller.js"),
     );
+    const moduleController = await import("./controllers/module/module-controller.js");
+    this.controllers.registerController("Telo.Application", moduleController);
+    this.controllers.registerController("Telo.Library", moduleController);
     this.controllers.registerController(
-      "Kernel.Module",
-      await import("./controllers/module/module-controller.js"),
-    );
-    this.controllers.registerController(
-      "Kernel.Import",
+      "Telo.Import",
       await import("./controllers/module/import-controller.js"),
     );
   }
@@ -160,16 +180,28 @@ export class Kernel implements IKernel {
     this.rootContext.preInitHook = (resource, getInstance) =>
       this._injectDependencies(resource, getInstance);
 
+    // Expose definition lookup so invoke()/invokeResolved() can check thrown
+    // InvokeError.code against the declared throw union (rule 9). Propagates
+    // through spawnChild() to module imports and scoped handles.
+    this.rootContext.getDefinition = (kind) => this.controllers.getDefinition(kind);
+
     // Static analysis pre-flight: validates schemas and invocation context compatibility.
     // All errors are fatal — kernel does not start if analysis fails.
     const staticManifests = await this.loader.loadManifests(sourceUrl);
     this.staticManifests = staticManifests;
 
     // Register module identities for x-telo-ref resolution (Phase 3 prerequisite).
-    // Kernel built-ins ("kernel" → "Kernel") are auto-registered when Kernel.Abstract
+    // Telo built-ins ("telo" → "Telo") are auto-registered when Telo.Abstract
     // definitions are registered in loadBuiltinDefinitions() above.
+    const rootModuleDoc = staticManifests.find((m) => isModuleKind(m.kind));
+    if (rootModuleDoc?.kind === "Telo.Library") {
+      throw new RuntimeError(
+        "ERR_MANIFEST_VALIDATION_FAILED",
+        `Root manifest '${sourceUrl}' is a Telo.Library. Only Telo.Application manifests can be run directly — libraries are imported via Telo.Import.`,
+      );
+    }
     for (const m of staticManifests) {
-      if (m.kind === "Kernel.Module" && m.metadata?.name && m.metadata?.namespace) {
+      if (isModuleKind(m.kind) && m.metadata?.name && m.metadata?.namespace) {
         this.registry.registerModuleIdentity(
           m.metadata.namespace as string,
           m.metadata.name as string,
@@ -204,9 +236,10 @@ export class Kernel implements IKernel {
     this.staticManifests = normalizedManifests;
 
     for (const manifest of normalizedManifests) {
-      if (manifest.kind === "Kernel.Module") {
-        this.rootContext.setSecrets(manifest.secrets ?? {});
-        this.rootContext.setVariables(manifest.variables ?? {});
+      if (isModuleKind(manifest.kind)) {
+        // Root is always Telo.Application (Library root rejected above). Applications
+        // have no variables/secrets fields — those are a Library-only contract, populated
+        // by importers, not by the root manifest itself.
         this.rootContext.setTargets(manifest.targets ?? []);
       }
       this.rootContext.registerManifest(manifest);
@@ -386,6 +419,7 @@ export class Kernel implements IKernel {
       moduleContext,
       resource.metadata,
       this.sharedSchemaValidator,
+      this.env,
       this.stdin,
       this.stdout,
       this.stderr,

package/src/manifest-schemas.ts

@@ -21,41 +21,87 @@ const metadataSchema = {
   additionalProperties: true,
 };
 
+const throwsSchema = {
+  type: "object",
+  additionalProperties: false,
+  properties: {
+    codes: {
+      type: "object",
+      propertyNames: { pattern: "^[A-Z][A-Z0-9_]*$" },
+      additionalProperties: {
+        type: "object",
+        required: ["description"],
+        additionalProperties: false,
+        properties: {
+          description: { type: "string" },
+          data: { type: "object", additionalProperties: true },
+        },
+      },
+    },
+    // "my throw union includes every code thrown by every invocable I call
+    //  (minus codes caught in an enclosing try/catch)". Analyzer enforces
+    //  that this is only legal on definitions whose schema declares at least
+    //  one `x-telo-step-context` array.
+    inherit: { type: "boolean" },
+    // "my throw union is whatever `inputs.code` resolves to statically." Used
+    // by passthrough-style adapters. Analyzer resolves per call site.
+    passthrough: { type: "boolean" },
+  },
+};
+
 const baseDefinition = {
   type: "object",
   required: ["kind", "metadata"],
   properties: {
-    kind: { const: "Kernel.Definition" },
+    kind: { const: "Telo.Definition" },
     metadata: metadataSchema,
     capability: { type: "string" },
     schema: { type: "object", additionalProperties: true },
     controllers: { type: "array", items: { type: "string" } },
+    throws: throwsSchema,
   },
   unevaluatedProperties: false,
 };
 
 const KNOWN_CAPABILITIES = [
-  "Kernel.Service",
-  "Kernel.Runnable",
-  "Kernel.Invocable",
-  "Kernel.Provider",
-  "Kernel.Type",
-  "Kernel.Mount",
+  "Telo.Service",
+  "Telo.Runnable",
+  "Telo.Invocable",
+  "Telo.Provider",
+  "Telo.Type",
+  "Telo.Mount",
 ] as const;
 
+/** Rule 8: `throws:` is only meaningful on Telo.Invocable or Telo.Runnable.
+ *  On Service/Mount/Provider/Type/etc. a thrown error is a boot-time failure,
+ *  not a structured runtime error for a downstream caller, so declaring one
+ *  is a schema error. */
+const forbidThrows = { not: { required: ["throws"] } };
+
 export const ResourceDefinitionSchema = {
   ...baseDefinition,
   oneOf: [
-    { required: ["capability"], properties: { capability: { const: "Kernel.Service" } } },
-    { required: ["capability"], properties: { capability: { const: "Kernel.Runnable" } } },
-    { required: ["capability"], properties: { capability: { const: "Kernel.Invocable" } } },
-    { required: ["capability"], properties: { capability: { const: "Kernel.Provider" } } },
-    { required: ["capability"], properties: { capability: { const: "Kernel.Type" } } },
     {
       required: ["capability"],
-      properties: {
-        capability: { const: "Kernel.Mount" },
-      },
+      properties: { capability: { const: "Telo.Service" } },
+      ...forbidThrows,
+    },
+    { required: ["capability"], properties: { capability: { const: "Telo.Runnable" } } },
+    { required: ["capability"], properties: { capability: { const: "Telo.Invocable" } } },
+    {
+      required: ["capability"],
+      properties: { capability: { const: "Telo.Provider" } },
+      ...forbidThrows,
+    },
+    {
+      required: ["capability"],
+      properties: { capability: { const: "Telo.Type" } },
+      ...forbidThrows,
+    },
+    {
+      required: ["capability"],
+      properties: { capability: { const: "Telo.Mount" } },
+      ...forbidThrows,
     },
     // Unknown/absent capability: open schema for third-party extensibility
     {

package/src/module-context.ts

@@ -109,7 +109,7 @@ export class ModuleContext extends EvaluationContext implements IModuleContext {
 
   /**
    * Register an imported module under the given alias, with the list of kind names
-   * it exports. An empty kinds array means no restriction (used for built-ins like Kernel).
+   * it exports. An empty kinds array means no restriction (used for built-ins like Telo).
    */
   registerImport(alias: string, targetModule: string, kinds: string[]): void {
     this.importAliases.set(alias, targetModule);

package/src/resource-context.ts

@@ -1,10 +1,13 @@
 import {
   NoopValidator,
   ResourceContext,
+  ResourceInstance,
+  ResourceManifest,
   RuntimeError,
   RuntimeResource,
   isCompiledValue,
   type EvaluationContext as IEvaluationContext,
+  type LoadOptions,
   type ModuleContext,
   type ParsedArgs,
   type TypeRule,
@@ -19,6 +22,7 @@ import { SchemaValidator } from "./schema-validator.js";
 const Ajv = AjvModule.default ?? AjvModule;
 
 export class ResourceContextImpl implements ResourceContext {
+  readonly env: Record<string, string | undefined>;
   readonly stdin: NodeJS.ReadableStream;
   readonly stdout: NodeJS.WritableStream;
   readonly stderr: NodeJS.WritableStream;
@@ -29,11 +33,13 @@ export class ResourceContextImpl implements ResourceContext {
     readonly moduleContext: ModuleContext,
     private readonly metadata: Record<string, any>,
     private readonly validator: SchemaValidator = new SchemaValidator(),
+    env?: Record<string, string | undefined>,
     stdin?: NodeJS.ReadableStream,
     stdout?: NodeJS.WritableStream,
     stderr?: NodeJS.WritableStream,
     args?: ParsedArgs,
   ) {
+    this.env = env ?? process.env;
     this.stdin = stdin ?? process.stdin;
     this.stdout = stdout ?? process.stdout;
     this.stderr = stderr ?? process.stderr;
@@ -128,6 +134,15 @@ export class ResourceContextImpl implements ResourceContext {
     return this.moduleContext.invoke(kind, name, inputs);
   }
 
+  invokeResolved<TInputs>(
+    kind: string,
+    name: string,
+    instance: ResourceInstance,
+    inputs: TInputs,
+  ): Promise<any> {
+    return this.moduleContext.invokeResolved(kind, name, instance, inputs);
+  }
+
   async run(name: string) {
     await this.moduleContext.run(name);
   }
@@ -136,6 +151,14 @@ export class ResourceContextImpl implements ResourceContext {
     this.moduleContext.registerManifest(resource);
   }
 
+  loadModule(url: string, options?: LoadOptions): Promise<ResourceManifest[]> {
+    return this.kernel.loadModule(url, options);
+  }
+
+  loadManifests(url: string): Promise<ResourceManifest[]> {
+    return this.kernel.loadManifests(url);
+  }
+
   /**
    * Resolves a resource into a normalized {kind, name} reference.
    * If the resource contains a definition (kind + properties), registers it as a manifest.
@@ -168,12 +191,24 @@ export class ResourceContextImpl implements ResourceContext {
       resourceName ??
       `Unnamed${Math.random().toString(16).slice(2, 8)}`;
 
-    // If resource has properties beyond kind/name, it's a definition - register it
-    const definitionKeys = Object.keys(resource).filter(
+    // Register an inline manifest when:
+    //  - the ref carries definition properties (clearly an inline definition), or
+    //  - the ref is bare `{kind}` with no explicit name and the caller supplied
+    //    a `resourceName` (the slot is known-inline — e.g. a Run.Sequence step
+    //    with `invoke: {kind: SomeInvocable}` — and wants a fresh stateless
+    //    instance registered under the generated name).
+    // Pure references (`{kind, name}` pointing at an existing resource) carry
+    // an explicit name and skip registration.
+    const hasInlineProperties = Object.keys(resource).some(
       (k) => k !== "kind" && k !== "name" && k !== "metadata",
     );
+    const hasExplicitName =
+      resource.name !== undefined || resource.metadata?.name !== undefined;
+    const shouldRegister =
+      (hasInlineProperties || (!hasExplicitName && resourceName !== undefined)) &&
+      !this.moduleContext.hasManifest(name);
 
-    if (definitionKeys.length > 0 && !this.moduleContext.hasManifest(name)) {
+    if (shouldRegister) {
       this.registerManifest({
         ...resource,
         metadata: {