@telorun/kernel 0.25.0 → 0.26.0

package/src/manifest-sources/analysis-stamp.ts

@@ -136,9 +136,13 @@ export function computeAnalysisSignature(graph: LoadedGraph): string {
  *  reading a newer stamp (or vice versa) discard rather than misparse. */
 export async function readAnalysisStamp(
   entryDir: string,
+  manifestsDir?: string,
 ): Promise<AnalysisStamp | undefined> {
+  const stampPath = manifestsDir
+    ? path.join(manifestsDir, ".validated.json")
+    : path.join(entryDir, ANALYSIS_STAMP_FILE);
   try {
-    const text = await fs.readFile(path.join(entryDir, ANALYSIS_STAMP_FILE), "utf-8");
+    const text = await fs.readFile(stampPath, "utf-8");
     const parsed = JSON.parse(text) as Partial<AnalysisStamp>;
     if (
       parsed?.version === ANALYSIS_STAMP_FORMAT_VERSION &&
@@ -158,12 +162,15 @@ export async function readAnalysisStamp(
 export async function writeAnalysisStamp(
   entryDir: string,
   signature: string,
+  manifestsDir?: string,
 ): Promise<void> {
   const stamp: AnalysisStamp = {
     version: ANALYSIS_STAMP_FORMAT_VERSION,
     signature,
   };
-  const target = path.join(entryDir, ANALYSIS_STAMP_FILE);
+  const target = manifestsDir
+    ? path.join(manifestsDir, ".validated.json")
+    : path.join(entryDir, ANALYSIS_STAMP_FILE);
   await fs.mkdir(path.dirname(target), { recursive: true });
   await fs.writeFile(target, JSON.stringify(stamp), "utf-8");
 }

package/src/manifest-sources/local-manifest-cache-source.ts

@@ -133,8 +133,15 @@ export class LocalManifestCacheSource implements ManifestSource {
   private readonly cacheRoot: string;
   private readonly registryUrl: string;
 
-  constructor(entryDir: string, registryUrl: string = DEFAULT_REGISTRY_URL) {
-    this.cacheRoot = path.join(entryDir, CACHE_SUBDIR);
+  constructor(
+    entryDir: string,
+    registryUrl: string = DEFAULT_REGISTRY_URL,
+    manifestsDir?: string,
+  ) {
+    // `manifestsDir` is the resolved manifest-cache directory threaded from a
+    // single `resolveCacheRoot` (honours `TELO_CACHE_DIR`); when absent we fall
+    // back to the entry-anchored default so library/test callers are unchanged.
+    this.cacheRoot = manifestsDir ?? path.join(entryDir, CACHE_SUBDIR);
     this.registryUrl = registryUrl;
   }
 
@@ -189,8 +196,9 @@ export function cachePathForCanonical(
   canonicalSource: string,
   entryDir: string,
   registryUrl: string,
+  manifestsDir?: string,
 ): string | null {
-  const cacheRoot = path.join(entryDir, CACHE_SUBDIR);
+  const cacheRoot = manifestsDir ?? path.join(entryDir, CACHE_SUBDIR);
   return cachePathForUrl(canonicalSource, cacheRoot, registryUrl);
 }
 
@@ -210,6 +218,7 @@ export async function writeManifestCache(
   graph: LoadedGraph,
   entryDir: string,
   registryUrl: string = DEFAULT_REGISTRY_URL,
+  manifestsDir?: string,
 ): Promise<string[]> {
   const written: string[] = [];
   const seen = new Set<string>();
@@ -220,7 +229,7 @@ export async function writeManifestCache(
       if (seen.has(file.source)) continue;
       seen.add(file.source);
 
-      const target = cachePathForCanonical(file.source, entryDir, registryUrl);
+      const target = cachePathForCanonical(file.source, entryDir, registryUrl, manifestsDir);
       if (!target) continue;
 
       await fs.mkdir(path.dirname(target), { recursive: true });
@@ -254,3 +263,19 @@ export function resolveEntryDir(entryPath: string): string | null {
     return path.dirname(absolute);
   }
 }
+
+/** The single `.telo` cache root for an entry, resolved once and threaded to
+ *  every consumer (manifest cache, compiled validators, analysis stamp, npm
+ *  install root) so none of them re-derive it or read the env independently.
+ *
+ *  `TELO_CACHE_DIR` (the relocated root a prebuilt image bakes its deps into)
+ *  wins; otherwise the root sits beside the entry at `<entry-dir>/.telo`.
+ *  Returns `null` for http(s) entries with no local anchor (disk cache skipped).
+ *  Consumers append the conventional subdirs: `manifests/`, `manifests/__validators/`,
+ *  `npm/`. */
+export function resolveCacheRoot(entryPath: string): string | null {
+  const override = process.env.TELO_CACHE_DIR;
+  if (override && override.trim()) return path.resolve(override.trim());
+  const entryDir = resolveEntryDir(entryPath);
+  return entryDir ? path.join(entryDir, ".telo") : null;
+}

package/src/resource-context.ts

@@ -344,6 +344,10 @@ export class ResourceContextImpl implements ResourceContext {
     return this.kernel.getEntryUrl();
   }
 
+  getInstallRoot(): string | undefined {
+    return this.kernel.getInstallRoot();
+  }
+
   on(event: string, handler: (payload?: any) => void | Promise<void>): void {
     this.kernel.on(event, handler);
   }

package/src/schema-validator.ts

@@ -117,6 +117,11 @@ export class SchemaValidator {
   private rawSchemas = new Map<string, object>();
   private compiledValidators = new WeakMap<object, DataValidator>();
   private cacheDir: string | undefined;
+  /** When false, the disk cache is read-only: compiled validators are still
+   *  loaded from `cacheDir` but never written back. `telo run --no-cache-write`
+   *  sets this so an ephemeral, read-only session rootfs validates in-memory
+   *  without touching (or failing to write) the baked cache. */
+  private cacheWritable = true;
   /** Tracks (schema-hash → in-memory compiled validator) so two distinct
    *  but content-equal schema objects share one compile across the kernel
    *  process — `compiledValidators` is keyed by object identity and would
@@ -183,8 +188,9 @@ export class SchemaValidator {
    *  kernel anchors this under `<entry-dir>/.telo/manifests/__validators/`
    *  so it lives next to the manifest cache and rides along in
    *  `COPY --from=build /srv /srv` Docker images. */
-  setCacheDir(dir: string | undefined): void {
+  setCacheDir(dir: string | undefined, opts?: { write?: boolean }): void {
     this.cacheDir = dir;
+    this.cacheWritable = opts?.write ?? true;
   }
 
   compile(schema: any): DataValidator {
@@ -315,7 +321,7 @@ export class SchemaValidator {
     }
 
     const validate = this.ajv.compile(schema) as ValidateFunction;
-    if (cacheDir) {
+    if (cacheDir && this.cacheWritable) {
       try {
         const body = standaloneCode(this.ajv, validate);
         const integrity = createHash("sha256").update(body).digest("hex");