@telorun/kernel 0.24.1 → 0.25.0

package/dist/schema-validator.js

@@ -1,5 +1,5 @@
 import { evaluate } from "@marcbachmann/cel-js";
-import { RuntimeError } from "@telorun/sdk";
+import { isCompiledValue, RuntimeError } from "@telorun/sdk";
 import AjvModule from "ajv";
 import standaloneCodeMod from "ajv/dist/standalone/index.js";
 import addFormats from "ajv-formats";
@@ -8,7 +8,7 @@ import * as fs from "node:fs";
 import { createRequire } from "node:module";
 import * as path from "node:path";
 import { formatAjvErrors } from "./manifest-schemas.js";
-import { ManifestRootSchema, normalizeRefSlots } from "@telorun/templating";
+import { isTaggedSentinel, ManifestRootSchema, normalizeRefSlots } from "@telorun/templating";
 const Ajv = AjvModule.default ?? AjvModule;
 // AJV's standalone subpath is CJS — the default export shows up as either
 // the function itself or `.default` depending on how the bundler/loader
@@ -76,6 +76,39 @@ function verifyAndExtractBody(text) {
     const actual = createHash("sha256").update(body).digest("hex");
     return actual === match[1] ? body : null;
 }
+/** Deep-clone `value` collapsing every CEL/template sentinel to its original
+ *  `source` string, for use as the validator cache *key* only.
+ *
+ *  The same `Telo.Definition` schema reaches `compile()` in two forms: the
+ *  build-time validator warm feeds the raw analysis graph (parse-time
+ *  `{__tagged, engine, source}` sentinels, or plain `${{ }}` strings for inline
+ *  templates), while the runtime feeds the compile-loader output (`{__compiled,
+ *  source, parts}`). A `!cel` / `!sql` tag embedded anywhere in a schema — most
+ *  commonly inside `examples` / `description`, but the loader rewrites them at
+ *  any position — therefore serialises differently between the two, so without
+ *  normalisation the same kind hashes differently and the runtime misses the
+ *  warmed cache (and fails to persist it read-only). Both sentinel shapes carry
+ *  the same original `source`, so collapsing each to that string converges them.
+ *
+ *  This rewrites only the hash key — AJV still compiles the full `injected`
+ *  schema. Unlike dropping keys by name, it never removes a structural node, so
+ *  a property literally named `description` / `examples` keeps its schema in the
+ *  key and two genuinely different shapes never collide. */
+function normalizeSentinelsForHash(value) {
+    if (isCompiledValue(value) || isTaggedSentinel(value)) {
+        return typeof value.source === "string" ? value.source : { __teloSentinel: true };
+    }
+    if (Array.isArray(value))
+        return value.map(normalizeSentinelsForHash);
+    if (value && typeof value === "object") {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            out[k] = normalizeSentinelsForHash(v);
+        }
+        return out;
+    }
+    return value;
+}
 export class SchemaValidator {
     constructor() {
         this.typeRules = new Map();
@@ -179,7 +212,10 @@ export class SchemaValidator {
         // would otherwise reject.
         const injected = normalizeRefSlots(withImplicit);
         const hash = createHash("sha256")
-            .update(JSON.stringify({ runtime: VALIDATOR_RUNTIME_TAG, schema: injected }))
+            .update(JSON.stringify({
+            runtime: VALIDATOR_RUNTIME_TAG,
+            schema: normalizeSentinelsForHash(injected),
+        }))
             .digest("hex")
             .slice(0, 32);
         const cachedByHash = this.hashCache.get(hash);

package/dist/schema-validator.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema-validator.js","sourceRoot":"","sources":["../src/schema-validator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAiB,YAAY,EAAY,MAAM,cAAc,CAAC;AACrE,OAAO,SAAoC,MAAM,KAAK,CAAC;AACvD,OAAO,iBAAiB,MAAM,8BAA8B,CAAC;AAC7D,OAAO,UAAU,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAE5E,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC;AAC3C,0EAA0E;AAC1E,wEAAwE;AACxE,+BAA+B;AAC/B,MAAM,cAAc,GACjB,iBAAyB,CAAC,OAAO,IAAK,iBAAyB,CAAC;AAEnE;;;;qBAIqB;AACrB,MAAM,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAErD;;;;;;;6DAO6D;AAC7D,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,IAAI,eAAe,CAAC,CAAC;QAClD,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,qDAAqD;IACvD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACtF,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAC9D,OAAO,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;gBACnE,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,6CAA6C;YAC/C,CAAC;YACD,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wBAAwB;IAC1B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AACD,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;AAC1C,MAAM,mBAAmB,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;AAC1D,MAAM,qBAAqB,GAAG,OAAO,WAAW,gBAAgB,mBAAmB,EAAE,CAAC;AAEtF,MAAM,qBAAqB,GAAG,+BAA+B,CAAC;AAE9D;;;wCAGwC;AACxC,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/D,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC;AAED,MAAM,OAAO,eAAe;IAY1B;QAVQ,cAAS,GAAG,IAAI,GAAG,EAAsB,CAAC;QAC1C,eAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;QACvC,uBAAkB,GAAG,IAAI,OAAO,EAAyB,CAAC;QAElE;;;gCAGwB;QAChB,cAAS,GAAG,IAAI,GAAG,EAAyB,CAAC;QAGnD,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC;YACjB,MAAM,EAAE,KAAK;YACb,gBAAgB,EAAE,KAAK;YACvB,WAAW,EAAE,IAAI;YACjB,mEAAmE;YACnE,iEAAiE;YACjE,kEAAkE;YAClE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;SACvB,CAAC,CAAC;QACH,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,KAAK,MAAM,EAAE,IAAI;YACf,YAAY;YACZ,aAAa;YACb,cAAc;YACd,gBAAgB;YAChB,qBAAqB;YACrB,yBAAyB;YACzB,oBAAoB;YACpB,sBAAsB;YACtB,qBAAqB;YACrB,eAAe;YACf,aAAa;SACd,EAAE,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC;QACD,0DAA0D;QAC1D,qEAAqE;QACrE,6DAA6D;QAC7D,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACzC,CAAC;IAED,SAAS,CAAC,IAAY,EAAE,MAAc;QACpC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,SAAS,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,YAAY,CAAC,IAAY,EAAE,KAAiB;QAC1C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,YAAY,CAAC,IAAY;QACvB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;;uDAQmD;IACnD,WAAW,CAAC,GAAuB;QACjC,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC;IACtB,CAAC;IAED,OAAO,CAAC,MAAW;QACjB,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAgB,CAAC,CAAC;YAC7D,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QAED,MAAM,YAAY,GAChB,CAAC,MAAM,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC;YACrD,OAAO,IAAI,MAAM;YACjB,OAAO,IAAI,MAAM;YACjB,OAAO,IAAI,MAAM;YACjB,MAAM,IAAI,MAAM,CAAC;QACnB,MAAM,UAAU,GAAG,YAAY;YAC7B,CAAC,CAAC,MAAM;YACR,CAAC,CAAC;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,MAAM;gBAClB,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC7B,oBAAoB,EAAE,KAAK;aAC5B,CAAC;QACN,MAAM,YAAY,GAChB,UAAU,CAAC,oBAAoB,KAAK,KAAK;YACvC,CAAC,CAAC;gBACE,GAAG,UAAU;gBACb,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACxB,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC5B,GAAG,UAAU,CAAC,UAAU;iBACzB;aACF;YACH,CAAC,CAAC,UAAU,CAAC;QAEjB,2EAA2E;QAC3E,4EAA4E;QAC5E,4EAA4E;QAC5E,wEAAwE;QACxE,0BAA0B;QAC1B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,YAAY,CAAwB,CAAC;QAExE,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC;aAC9B,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;aAC5E,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChB,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACzC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAgB,EAAE,YAAY,CAAC,CAAC;YAC9D,CAAC;YACD,OAAO,YAAY,CAAC;QACtB,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAE7D,MAAM,SAAS,GAAG;YAChB,QAAQ,EAAE,CAAC,IAAS,EAAE,EAAE;gBACtB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,YAAY,CACpB,uCAAuC,EACvC,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAC5F,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,EAAE,CAAC,IAAS,EAAE,EAAE;gBACrB,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;YACxB,CAAC;SACF,CAAC;QAEF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACpC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAgB,EAAE,SAAS,CAAC,CAAC;QAC3D,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;;yDAUqD;IAC7C,sBAAsB,CAC5B,MAAW,EACX,IAAY;QAEZ,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;YACrD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBACjD,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;gBACxC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAClB,MAAM,OAAO,GAAG,IAAI,QAAQ,CAC1B,SAAS,EACT,QAAQ,EACR,SAAS,EACT,GAAG,IAAI,0BAA0B,CAClC,CAAC;oBACF,MAAM,GAAG,GAAqB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;oBAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;oBACxD,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;wBACjC,OAAO,MAA0B,CAAC;oBACpC,CAAC;gBACH,CAAC;gBACD,2DAA2D;gBAC3D,6DAA6D;gBAC7D,uCAAuC;YACzC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAA6B,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,8CAA8C,IAAI,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAC7G,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAqB,CAAC;QAC9D,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAChD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAClE,MAAM,OAAO,GAAG,aAAa,SAAS,KAAK,IAAI,EAAE,CAAC;gBAClD,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC5C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YACzE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+CAA+C,IAAI,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAC9G,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,gBAAgB,CAAC,IAAmB,EAAE,QAAgB,EAAE,KAAiB;QACvE,OAAO;YACL,QAAQ,EAAE,CAAC,IAAS,EAAE,EAAE;gBACtB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,IAAI,MAAe,CAAC;oBACpB,IAAI,CAAC;wBACH,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;oBACpD,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,IAAI,YAAY,CACpB,4BAA4B,EAC5B,SAAS,QAAQ,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACjG,CAAC;oBACJ,CAAC;oBACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;wBACpB,MAAM,IAAI,YAAY,CACpB,IAAI,CAAC,IAAI,IAAI,4BAA4B,EACzC,IAAI,CAAC,OAAO,IAAI,SAAS,QAAQ,8BAA8B,IAAI,CAAC,IAAI,iBAAiB,CAC1F,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,EAAE,CAAC,IAAS,EAAE,EAAE;gBACrB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,IAAI,CAAC;wBACH,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK,IAAI;4BAAE,OAAO,KAAK,CAAC;oBACtE,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,KAAK,CAAC;oBACf,CAAC;gBACH,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;SACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"schema-validator.js","sourceRoot":"","sources":["../src/schema-validator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAiB,eAAe,EAAE,YAAY,EAAY,MAAM,cAAc,CAAC;AACtF,OAAO,SAAoC,MAAM,KAAK,CAAC;AACvD,OAAO,iBAAiB,MAAM,8BAA8B,CAAC;AAC7D,OAAO,UAAU,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAE9F,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC;AAC3C,0EAA0E;AAC1E,wEAAwE;AACxE,+BAA+B;AAC/B,MAAM,cAAc,GACjB,iBAAyB,CAAC,OAAO,IAAK,iBAAyB,CAAC;AAEnE;;;;qBAIqB;AACrB,MAAM,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAErD;;;;;;;6DAO6D;AAC7D,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,IAAI,eAAe,CAAC,CAAC;QAClD,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,qDAAqD;IACvD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACtF,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAC9D,OAAO,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;gBACnE,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,6CAA6C;YAC/C,CAAC;YACD,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wBAAwB;IAC1B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AACD,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;AAC1C,MAAM,mBAAmB,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;AAC1D,MAAM,qBAAqB,GAAG,OAAO,WAAW,gBAAgB,mBAAmB,EAAE,CAAC;AAEtF,MAAM,qBAAqB,GAAG,+BAA+B,CAAC;AAE9D;;;wCAGwC;AACxC,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/D,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;;;;;;4DAiB4D;AAC5D,SAAS,yBAAyB,CAAC,KAAc;IAC/C,IAAI,eAAe,CAAC,KAAK,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,OAAO,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACtE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,CAAC,CAAC,GAAG,yBAAyB,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,eAAe;IAY1B;QAVQ,cAAS,GAAG,IAAI,GAAG,EAAsB,CAAC;QAC1C,eAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;QACvC,uBAAkB,GAAG,IAAI,OAAO,EAAyB,CAAC;QAElE;;;gCAGwB;QAChB,cAAS,GAAG,IAAI,GAAG,EAAyB,CAAC;QAGnD,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC;YACjB,MAAM,EAAE,KAAK;YACb,gBAAgB,EAAE,KAAK;YACvB,WAAW,EAAE,IAAI;YACjB,mEAAmE;YACnE,iEAAiE;YACjE,kEAAkE;YAClE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;SACvB,CAAC,CAAC;QACH,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,KAAK,MAAM,EAAE,IAAI;YACf,YAAY;YACZ,aAAa;YACb,cAAc;YACd,gBAAgB;YAChB,qBAAqB;YACrB,yBAAyB;YACzB,oBAAoB;YACpB,sBAAsB;YACtB,qBAAqB;YACrB,eAAe;YACf,aAAa;SACd,EAAE,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC;QACD,0DAA0D;QAC1D,qEAAqE;QACrE,6DAA6D;QAC7D,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACzC,CAAC;IAED,SAAS,CAAC,IAAY,EAAE,MAAc;QACpC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,SAAS,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,YAAY,CAAC,IAAY,EAAE,KAAiB;QAC1C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,YAAY,CAAC,IAAY;QACvB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;;uDAQmD;IACnD,WAAW,CAAC,GAAuB;QACjC,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC;IACtB,CAAC;IAED,OAAO,CAAC,MAAW;QACjB,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAgB,CAAC,CAAC;YAC7D,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QAED,MAAM,YAAY,GAChB,CAAC,MAAM,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC;YACrD,OAAO,IAAI,MAAM;YACjB,OAAO,IAAI,MAAM;YACjB,OAAO,IAAI,MAAM;YACjB,MAAM,IAAI,MAAM,CAAC;QACnB,MAAM,UAAU,GAAG,YAAY;YAC7B,CAAC,CAAC,MAAM;YACR,CAAC,CAAC;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,MAAM;gBAClB,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC7B,oBAAoB,EAAE,KAAK;aAC5B,CAAC;QACN,MAAM,YAAY,GAChB,UAAU,CAAC,oBAAoB,KAAK,KAAK;YACvC,CAAC,CAAC;gBACE,GAAG,UAAU;gBACb,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACxB,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC5B,GAAG,UAAU,CAAC,UAAU;iBACzB;aACF;YACH,CAAC,CAAC,UAAU,CAAC;QAEjB,2EAA2E;QAC3E,4EAA4E;QAC5E,4EAA4E;QAC5E,wEAAwE;QACxE,0BAA0B;QAC1B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,YAAY,CAAwB,CAAC;QAExE,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC;aAC9B,MAAM,CACL,IAAI,CAAC,SAAS,CAAC;YACb,OAAO,EAAE,qBAAqB;YAC9B,MAAM,EAAE,yBAAyB,CAAC,QAAQ,CAAC;SAC5C,CAAC,CACH;aACA,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChB,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACzC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAgB,EAAE,YAAY,CAAC,CAAC;YAC9D,CAAC;YACD,OAAO,YAAY,CAAC;QACtB,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAE7D,MAAM,SAAS,GAAG;YAChB,QAAQ,EAAE,CAAC,IAAS,EAAE,EAAE;gBACtB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,YAAY,CACpB,uCAAuC,EACvC,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAC5F,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,EAAE,CAAC,IAAS,EAAE,EAAE;gBACrB,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;YACxB,CAAC;SACF,CAAC;QAEF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACpC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAgB,EAAE,SAAS,CAAC,CAAC;QAC3D,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;;yDAUqD;IAC7C,sBAAsB,CAC5B,MAAW,EACX,IAAY;QAEZ,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;YACrD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBACjD,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;gBACxC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAClB,MAAM,OAAO,GAAG,IAAI,QAAQ,CAC1B,SAAS,EACT,QAAQ,EACR,SAAS,EACT,GAAG,IAAI,0BAA0B,CAClC,CAAC;oBACF,MAAM,GAAG,GAAqB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;oBAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;oBACxD,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;wBACjC,OAAO,MAA0B,CAAC;oBACpC,CAAC;gBACH,CAAC;gBACD,2DAA2D;gBAC3D,6DAA6D;gBAC7D,uCAAuC;YACzC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAA6B,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,8CAA8C,IAAI,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAC7G,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAqB,CAAC;QAC9D,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAChD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAClE,MAAM,OAAO,GAAG,aAAa,SAAS,KAAK,IAAI,EAAE,CAAC;gBAClD,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC5C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YACzE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+CAA+C,IAAI,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAC9G,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,gBAAgB,CAAC,IAAmB,EAAE,QAAgB,EAAE,KAAiB;QACvE,OAAO;YACL,QAAQ,EAAE,CAAC,IAAS,EAAE,EAAE;gBACtB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,IAAI,MAAe,CAAC;oBACpB,IAAI,CAAC;wBACH,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;oBACpD,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,IAAI,YAAY,CACpB,4BAA4B,EAC5B,SAAS,QAAQ,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACjG,CAAC;oBACJ,CAAC;oBACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;wBACpB,MAAM,IAAI,YAAY,CACpB,IAAI,CAAC,IAAI,IAAI,4BAA4B,EACzC,IAAI,CAAC,OAAO,IAAI,SAAS,QAAQ,8BAA8B,IAAI,CAAC,IAAI,iBAAiB,CAC1F,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,EAAE,CAAC,IAAS,EAAE,EAAE;gBACrB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,IAAI,CAAC;wBACH,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK,IAAI;4BAAE,OAAO,KAAK,CAAC;oBACtE,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,KAAK,CAAC;oBACf,CAAC;gBACH,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;SACF,CAAC;IACJ,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/kernel",
-  "version": "0.24.1",
+  "version": "0.25.0",
   "description": "Telo Runtime - A lightweight, polyglot execution host.",
   "keywords": [
     "telo",
@@ -47,7 +47,7 @@
   "dependencies": {
     "@marcbachmann/cel-js": "^7.6.1",
     "@sinclair/typebox": "^0.34.48",
-    "@telorun/analyzer": "0.22.0",
+    "@telorun/analyzer": "0.23.0",
     "@telorun/templating": "0.8.0",
     "ajv": "^8.17.1",
     "ajv-formats": "^3.0.1",

package/src/application-env.ts

@@ -80,6 +80,87 @@ export function resolveApplicationEnv(
   return { variables, secrets, ports };
 }
 
+/**
+ * Build-time cache warm: compile — but do NOT validate — the residual schema
+ * for every `variables` / `secrets` / `ports` entry the runtime
+ * `resolveApplicationEnv` would, so each standalone validator lands in the
+ * on-disk `__validators` cache. Schema *compilation* is value-independent, so
+ * this needs none of the host env vars / secrets `resolveApplicationEnv`
+ * requires — it can run during `telo install`. At run time on a read-only
+ * session rootfs `resolveApplicationEnv` then hits the cache instead of
+ * recompiling and failing to persist (ENOENT / EROFS).
+ *
+ * Mirrors `resolveApplicationEnv` exactly: same `residualEntrySchema` per
+ * variable/secret and the same `PORT_RESIDUAL_SCHEMA`, so the cache keys
+ * match byte-for-byte. Compile failures are swallowed — a genuinely broken
+ * schema surfaces through the normal analysis/runtime path, not here.
+ */
+export function precompileApplicationEnvSchemas(
+  manifest: Record<string, any>,
+  validator: SchemaValidator,
+): void {
+  const compile = (schema: Record<string, unknown>): void => {
+    try {
+      validator.compile(schema as any);
+    } catch {
+      // Broken schemas are reported by analysis / runtime, not the warm pass.
+    }
+  };
+  for (const block of [manifest.variables, manifest.secrets]) {
+    if (!block || typeof block !== "object" || Array.isArray(block)) continue;
+    for (const entry of Object.values(block as Record<string, EnvEntry>)) {
+      if (!entry || typeof entry !== "object") continue;
+      compile(residualEntrySchema(entry as Record<string, unknown>));
+    }
+  }
+  const ports = manifest.ports;
+  if (
+    ports &&
+    typeof ports === "object" &&
+    !Array.isArray(ports) &&
+    Object.keys(ports).length > 0
+  ) {
+    compile(PORT_RESIDUAL_SCHEMA);
+  }
+}
+
+/**
+ * Build-time cache warm for resource-config validators. The runtime
+ * `_createInstance` compiles `controller.schema` — which falls back to the
+ * declaring `Telo.Definition`'s own `schema` — to validate every resource's
+ * config, then validates inputs/outputs against `inputType` / `outputType`.
+ * The analyze-only warm pass stops before instantiation, so without this those
+ * validators are absent from the `__validators` cache and the runtime
+ * recompiles (and, on a read-only image, fails to persist) them on every boot.
+ *
+ * Compiling each definition's `schema` (plus any inline `inputType` /
+ * `outputType` object schemas) here writes them into the same content-addressed
+ * cache the runtime reads, keyed identically because the same schema object is
+ * fed to the same `validator.compile`. Definitions whose controller exports its
+ * own `schema` (rare) still recompile at runtime — that needs the controller
+ * loaded, which the warm pass does not do. Compile failures are swallowed; a
+ * genuinely broken schema surfaces through analysis / runtime, not here.
+ */
+export function precompileDefinitionSchemas(
+  manifests: Array<Record<string, any>>,
+  validator: SchemaValidator,
+): void {
+  const compile = (schema: unknown): void => {
+    if (!schema || typeof schema !== "object") return;
+    try {
+      validator.compile(schema as any);
+    } catch {
+      // Broken schemas are reported by analysis / runtime, not the warm pass.
+    }
+  };
+  for (const m of manifests) {
+    if (m?.kind !== "Telo.Definition") continue;
+    compile(m.schema);
+    compile(m.inputType);
+    compile(m.outputType);
+  }
+}
+
 /**
  * Populate the root Application's `ports` namespace from host environment
  * variables. Mirrors `resolveBlock` but fixes the value type to a port integer

package/src/controller-loaders/npm-loader.ts

@@ -104,14 +104,17 @@ export interface NpmControllerLoaderOptions {
  * local entry manifest (`file://` URL or bare path) the root lives at
  * `<entry-manifest-dir>/.telo/npm/`; for an HTTP(S) entry URL it lives in a
  * user-level cache keyed by `sha256(entryUrl)` (see `computeInstallRoot`).
- * Every controller — registry tag or `local_path` — is installed via
- * `npm install <spec>` into this root, then imported from
- * `<root>/node_modules/<pkg>`. This collapses two parallel
- * module realms (kernel-side @telorun/sdk vs. controller-side @telorun/sdk)
- * into one: the kernel's own SDK is wired in as a `file:` dep, npm/pnpm
- * symlink it, and Node's ESM resolver follows the symlink to the same
- * realpath as the kernel — so `Stream` (and any other class-identity-sensitive
- * type) has a single constructor across the process.
+ * Every controller — registry tag or `local_path` — is installed under a
+ * version-scoped npm alias (`npm install <alias>@<spec>`, see `installAlias`)
+ * into this root, then imported from `<root>/node_modules/<alias>`. The alias
+ * encodes `name@version`, so a graph that references one package at two
+ * versions keeps both in the single flat `node_modules` instead of the last
+ * `--save` clobbering the first. This still collapses two parallel module
+ * realms (kernel-side @telorun/sdk vs. controller-side @telorun/sdk) into one:
+ * `@telorun/sdk` is exempt from aliasing and wired in as a `file:` dep under
+ * its real name, npm/pnpm hoist a single copy, and Node's ESM resolver follows
+ * it to the same realpath as the kernel — so `Stream` (and any other
+ * class-identity-sensitive type) has a single constructor across the process.
  *
  * Per-kernel state lives on each `NpmControllerLoader` instance (one is
  * constructed per `ControllerLoader`, which is itself constructed per
@@ -169,17 +172,21 @@ export class NpmControllerLoader {
       throw new Error(`Invalid PURL '${purl}': missing package name`);
     }
     const packageName = parsed.namespace ? `${parsed.namespace}/${parsed.name}` : parsed.name;
+    const version = parsed.version ?? null;
+    // Version-scope the install under an alias so the same package at two
+    // versions can coexist in one flat node_modules (see installAlias).
+    const alias = installAlias(packageName, version);
 
     const installRoot = await this.ensureInstallRoot();
     const resolved = await resolveInstallSpec(parsed, packageName, baseUri);
     const source = await this.installPackage(
       installRoot,
-      packageName,
+      alias,
       resolved.spec,
       resolved.kind,
-      parsed.version ?? null,
+      version,
     );
-    const instance = await loadFromInstall(installRoot, packageName, parsed.subpath ?? null, purl);
+    const instance = await loadFromInstall(installRoot, alias, parsed.subpath ?? null, purl);
     return { instance, source };
   }
 
@@ -296,6 +303,11 @@ export class NpmControllerLoader {
     installRoot: string,
     dependencies: Record<string, string>,
   ): Promise<void> {
+    // `dependencies` is only the realm-collapse deps (`@telorun/sdk`), keyed by
+    // real `name@spec`. Controllers, by contrast, key `installedSpecs` by their
+    // version-scoped alias in `installPackage`. The two key spaces are
+    // intentionally disjoint — realm-collapse names are wired in here and never
+    // flow through `installPackage`, so an alias and a `name@spec` never clash.
     for (const [name, spec] of Object.entries(dependencies)) {
       this.installedSpecs.add(`${name}@${spec}`);
     }
@@ -303,11 +315,14 @@ export class NpmControllerLoader {
   }
 
   /**
-   * Install one controller spec into the existing root. Single-flight per
-   * spec within the process; cross-process safety is the fs-lock around the
-   * `npm install` call. If the spec is already present in the manifest's
-   * package.json (under `dependencies`), skip — reusing the previous install.
+   * Install one controller into the existing root under its version-scoped
+   * `alias` folder. Single-flight per alias within the process; cross-process
+   * safety is the fs-lock around the `npm install` call. If the alias is
+   * already installed (right version on disk, or a matching `file:` record),
+   * skip — reusing the previous install.
    *
+   * `spec` is the source half of the install (`npm:<name>@<version>` or
+   * `file:<abs>`); the package manager is invoked with `<alias>@<spec>`.
    * `kind` distinguishes a `local_path` source (loader synthesized `file:`
    * spec) from a registry tag. The CLI silences progress for both `cache`
    * and `local`; `npm-install` is the only event surfaced. Folding this
@@ -316,12 +331,12 @@ export class NpmControllerLoader {
    */
   private async installPackage(
     installRoot: string,
-    packageName: string,
+    alias: string,
     spec: string,
     kind: SpecKind,
     requestedVersion: string | null,
   ): Promise<NpmResolveSource> {
-    const cacheKey = `${packageName}@${spec}`;
+    const cacheKey = alias;
     if (this.installedSpecs.has(cacheKey)) return "cache";
 
     const inFlight = this.inFlight.get(cacheKey);
@@ -330,17 +345,20 @@ export class NpmControllerLoader {
       return "cache";
     }
 
-    const targetPath = path.join(installRoot, "node_modules", ...packageName.split("/"));
+    // The package is installed under its version-scoped alias, so its folder
+    // name in node_modules is the alias, not the bare package name.
+    const targetPath = path.join(installRoot, "node_modules", alias);
 
     // Registry fast path: compare against the installed package's own
-    // `package.json` version field. `rootDeps[packageName]` can't be used
-    // here because npm rewrites registry specs on `--save` — we pass
-    // `@scope/pkg@0.3.4`, npm writes `^0.3.4` — so a string comparison
-    // never matches and every fresh `NpmControllerLoader` (one per
-    // `Telo.Definition.init`) would fall through to a no-op but ~200ms
+    // `package.json` version field. The recorded dep spec can't be used here
+    // because npm rewrites registry specs on `--save` — we pass
+    // `<alias>@npm:@scope/pkg@0.3.4`, npm writes `npm:@scope/pkg@^0.3.4` — so a
+    // string comparison never matches and every fresh `NpmControllerLoader`
+    // (one per `Telo.Definition.init`) would fall through to a no-op but ~200ms
     // `npm install`. Reading the installed package.json sidesteps that
-    // entirely: if the requested PURL version equals what's on disk, we
-    // already have the right thing.
+    // entirely: if the requested PURL version equals what's on disk under this
+    // alias, we already have the right thing. Because the alias encodes the
+    // version, a present alias folder is always the requested version.
     //
     // Ranges (`^1.0.0`, `~2.3.0`) fall through to a real `npm install` —
     // they're rare in PURLs (which typically pin) and a proper range check
@@ -354,37 +372,47 @@ export class NpmControllerLoader {
         this.installedSpecs.add(cacheKey);
         return "cache";
       }
-    }
-
-    // Local (`file:`) spec fast path: consult the in-process snapshot of the
-    // install root's `dependencies` map (seeded by `materializeInstallRoot`).
-    // Normalize because npm rewrites absolute `file:` deps to relative paths
-    // inside the install root's `package.json` — the loader passes the
-    // absolute path, the on-disk record is `file:../../foo`.
-    const cachedSpec = this.rootDeps[packageName];
-    if (
-      cachedSpec !== undefined &&
-      normalizeFileSpec(cachedSpec, installRoot) === normalizeFileSpec(spec, installRoot) &&
-      (await pathExists(targetPath))
-    ) {
-      this.installedSpecs.add(cacheKey);
-      return "cache";
+    } else {
+      // Local (`file:`) spec fast path: consult the in-process snapshot of the
+      // install root's `dependencies` map (seeded by `materializeInstallRoot`).
+      // Normalize because npm rewrites absolute `file:` deps to relative paths
+      // inside the install root's `package.json` — the loader passes the
+      // absolute path, the on-disk record is `file:../../foo`.
+      const cachedSpec = this.rootDeps[alias];
+      if (
+        cachedSpec !== undefined &&
+        normalizeFileSpec(cachedSpec, installRoot) === normalizeFileSpec(spec, installRoot) &&
+        (await pathExists(targetPath))
+      ) {
+        this.installedSpecs.add(cacheKey);
+        return "cache";
+      }
     }
 
     const work = (async () => {
       await withInstallLock(installRoot, async () => {
         // Re-check inside the lock: a peer process may have installed the
-        // spec between the fast-path miss and our acquisition. Normalize
-        // the on-disk record to absolute form before comparing — npm
-        // rewrites `file:` deps to be relative to the install root.
-        const lockedSpec = await readDepSpec(installRoot, packageName);
-        if (
-          lockedSpec !== undefined &&
-          normalizeFileSpec(lockedSpec, installRoot) === normalizeFileSpec(spec, installRoot) &&
-          (await pathExists(targetPath))
-        ) {
-          this.rootDeps[packageName] = lockedSpec;
-          return;
+        // spec between the fast-path miss and our acquisition.
+        if (kind === "registry") {
+          const installedVersion = await readInstalledVersion(targetPath);
+          if (
+            installedVersion !== null &&
+            (requestedVersion === null || requestedVersion === installedVersion)
+          ) {
+            return;
+          }
+        } else {
+          // Normalize the on-disk record to absolute form before comparing —
+          // npm rewrites `file:` deps to be relative to the install root.
+          const lockedSpec = await readDepSpec(installRoot, alias);
+          if (
+            lockedSpec !== undefined &&
+            normalizeFileSpec(lockedSpec, installRoot) === normalizeFileSpec(spec, installRoot) &&
+            (await pathExists(targetPath))
+          ) {
+            this.rootDeps[alias] = lockedSpec;
+            return;
+          }
         }
 
         await runPackageManager(installRoot, [
@@ -394,14 +422,17 @@ export class NpmControllerLoader {
           "--silent",
           ...PEER_INSTALL_FLAGS,
           "--save",
-          spec,
+          // `<alias>@<source-spec>` installs the package under the alias folder
+          // (`npm:` for registry, `file:` for local) so multiple versions of
+          // one package name coexist in the single install root.
+          `${alias}@${spec}`,
         ]);
         // Re-read what npm actually wrote (it normalizes `file:` paths to
         // be relative to the install root). Caching the spec in its on-disk
         // form keeps subsequent fast-path comparisons stable.
-        const written = await readDepSpec(installRoot, packageName);
-        if (written !== undefined) this.rootDeps[packageName] = written;
-        else this.rootDeps[packageName] = spec;
+        const written = await readDepSpec(installRoot, alias);
+        if (written !== undefined) this.rootDeps[alias] = written;
+        else this.rootDeps[alias] = spec;
       });
     })();
 
@@ -693,6 +724,35 @@ function computeInstallRoot(entryUrl: string): string {
   );
 }
 
+/**
+ * Version-qualified install alias for a controller package. The kernel's single
+ * flat install root can hold only one folder per package name, but a manifest
+ * graph may legitimately reference the same package at multiple versions (e.g.
+ * a library pins `@telorun/mcp-client@0.3.1` while the app uses `0.4.0`).
+ * Installing each `name@version` under a distinct npm alias
+ * (`npm install <alias>@npm:<name>@<version>`) lets every version coexist in
+ * one `node_modules`, mirroring the per-(name, version) identity of a Telo
+ * module singleton. `@telorun/sdk` is intentionally NOT routed through here —
+ * it stays under its real name so realm-collapse hoists a single copy across
+ * the kernel/controller boundary (see REALM_COLLAPSE_NAMES).
+ *
+ * The result is a valid unscoped npm package name: the scope `@` is dropped,
+ * `/` becomes `__`, and any character outside npm's name grammar is replaced
+ * with `-`. Because that sanitization is lossy (e.g. build metadata `1.0.0+x`
+ * and prerelease `1.0.0-x` both fold to `1.0.0-x`, and a `__` already in a
+ * package name overlaps the scope separator), the alias ends with a short hash
+ * of the *exact* `name@version` — so two distinct pairs can never collide onto
+ * one folder regardless of how their readable prefixes sanitize. The readable
+ * prefix is kept purely so the install tree is greppable.
+ */
+function installAlias(packageName: string, version: string | null): string {
+  const prefix = `${packageName.replace(/^@/, "").replace(/\//g, "__")}__${version ?? "latest"}`
+    .replace(/[^a-zA-Z0-9._-]/g, "-")
+    .toLowerCase();
+  const digest = sha256(`${packageName}@${version ?? ""}`).slice(0, 8);
+  return `${prefix}__${digest}`;
+}
+
 /**
  * Normalize a `file:` spec to an absolute path so two specs that point at the
  * same source — one absolute (what the loader synthesizes from `local_path`)
@@ -770,7 +830,10 @@ async function resolveInstallSpec(
       return { kind: "local", spec: `file:${absolutePath}`, absolutePath };
     }
   }
-  const spec = parsed.version ? `${packageName}@${parsed.version}` : packageName;
+  // `npm:` source spec so the caller can install it under a version-scoped
+  // alias (`<alias>@npm:<name>@<version>`); both versions of one package name
+  // then coexist in the single flat install root.
+  const spec = parsed.version ? `npm:${packageName}@${parsed.version}` : `npm:${packageName}`;
   return { kind: "registry", spec };
 }
 
@@ -782,11 +845,13 @@ async function resolveInstallSpec(
  */
 async function loadFromInstall(
   installRoot: string,
-  packageName: string,
+  alias: string,
   subpath: string | null,
   purl: string,
 ): Promise<ControllerInstance> {
-  const packageRoot = path.join(installRoot, "node_modules", ...packageName.split("/"));
+  // The package lives under its version-scoped alias folder (see installAlias),
+  // not its bare scoped name.
+  const packageRoot = path.join(installRoot, "node_modules", alias);
   const entry = subpath ? `./${subpath}` : ".";
   const entryFile = await resolvePackageEntry(packageRoot, entry);
   // ESM dynamic `import()` accepts either a relative specifier or a `file://`
@@ -937,6 +1002,7 @@ function resolveExportTargetValue(
  * Not part of the kernel's public API — consumers should not import these.
  */
 export const __testing__ = {
+  installAlias,
   normalizeFileSpec,
   resolvePackageExportTarget,
   resolveExportTargetValue,

package/src/controller-registry.ts

@@ -98,6 +98,24 @@ export class ControllerRegistry {
     return Array.from(this.controllersByKind.keys());
   }
 
+  /**
+   * Distinct controller `schema` objects across all registered kinds (one per
+   * kind, default fingerprint preferred). Used by the build-time validator warm
+   * to pre-compile the framework/builtin controller schemas (`Telo.Import`,
+   * `Telo.Definition`, the module controller, …) the runtime validates
+   * resources against — module-defined kinds aren't registered here until
+   * instantiation, so those are warmed from the static manifests instead.
+   */
+  getControllerSchemas(): object[] {
+    const schemas: object[] = [];
+    for (const byFp of this.controllersByKind.values()) {
+      const controller = byFp.get(DEFAULT_FINGERPRINT) ?? byFp.values().next().value;
+      const schema = controller?.schema;
+      if (schema && typeof schema === "object") schemas.push(schema);
+    }
+    return schemas;
+  }
+
   /**
    * Register a controller for a (kind, fingerprint). Multiple registrations
    * for the same kind with different fingerprints coexist; same fingerprint