@telorun/kernel 0.4.1 → 0.6.0

package/src/index.ts

@@ -1,7 +1,8 @@
 export { ControllerLoader } from "./controller-loader.js";
 export { ControllerRegistry } from "./controller-registry.js";
 export { EvaluationContext } from "./evaluation-context.js";
-export { LocalFileAdapter } from "./manifest-adapters/local-file-adapter.js";
+export { LocalFileSource } from "./manifest-sources/local-file-source.js";
+export { MemorySource } from "./manifest-sources/memory-source.js";
 export { EventStream } from "./event-stream.js";
 export { ExecutionContext } from "./execution-context.js";
 export { Kernel, type KernelOptions } from "./kernel.js";

package/src/kernel.ts

@@ -1,37 +1,65 @@
-import { AnalysisRegistry, DEFAULT_MANIFEST_FILENAME, isModuleKind, Loader, StaticAnalyzer } from "@telorun/analyzer";
+import {
+  AnalysisRegistry,
+  isModuleKind,
+  Loader,
+  StaticAnalyzer,
+  type ManifestSource,
+} from "@telorun/analyzer";
 import {
   ControllerContext,
+  ControllerPolicy,
   Kernel as IKernel,
-  type LoadOptions,
+  isCompiledValue,
   ResourceContext,
   ResourceDefinition,
   ResourceInstance,
   ResourceManifest,
   RuntimeError,
   RuntimeEvent,
-  isCompiledValue,
   type EvaluationContext as IEvaluationContext,
   type ModuleContext as IModuleContext,
+  type LoadOptions,
   type ParsedArgs,
 } from "@telorun/sdk";
 import { createHash } from "node:crypto";
-import { ModuleContext } from "./module-context.js";
-import * as path from "path";
 import { parseArgs } from "util";
 import { ControllerRegistry } from "./controller-registry.js";
 import { EventStream } from "./event-stream.js";
 import { EventBus } from "./events.js";
-import { LocalFileAdapter } from "./manifest-adapters/local-file-adapter.js";
+import { ModuleContext } from "./module-context.js";
 import { ResourceContextImpl } from "./resource-context.js";
+import { policyFingerprint } from "./runtime-registry.js";
 import { SchemaValidator } from "./schema-validator.js";
 
+/** Walks up the EvaluationContext parent chain to the nearest enclosing
+ *  ModuleContext and returns its controller policy (or undefined). Used to
+ *  pick the right cache entry when a kind has been loaded under multiple
+ *  runtime selections. */
+function findEnclosingModule(ctx: IEvaluationContext): ModuleContext | undefined {
+  let cur: IEvaluationContext | undefined = ctx;
+  while (cur) {
+    if (cur instanceof ModuleContext) return cur;
+    cur = cur.parent;
+  }
+  return undefined;
+}
+
+function findEnclosingPolicy(ctx: IEvaluationContext): ControllerPolicy | undefined {
+  return findEnclosingModule(ctx)?.getControllerPolicy();
+}
+
 export interface KernelOptions {
   stdin?: NodeJS.ReadableStream;
   stdout?: NodeJS.WritableStream;
   stderr?: NodeJS.WritableStream;
   env?: Record<string, string | undefined>;
   argv?: string[];
-  /** Base URL for the registry adapter. When unset, the RegistryAdapter
+  /** Manifest sources the kernel uses to resolve URLs passed to `load()`.
+   *  Required: pass an explicit list (`[]` is allowed but means every URL
+   *  fails to dispatch). Order matters — later entries take priority over
+   *  earlier ones (sources are unshifted onto the dispatch chain). */
+  sources: ManifestSource[];
+  /** Base URL for the registry source. When unset, the `RegistrySource`
    *  default applies. Callers (e.g. the CLI) are responsible for resolving
    *  `TELO_REGISTRY_URL` or any other env-based fallback before passing. */
   registryUrl?: string;
@@ -67,7 +95,7 @@ export class Kernel implements IKernel {
   readonly argv: string[];
   readonly registryUrl: string | undefined;
 
-  constructor(options: KernelOptions = {}) {
+  constructor(options: KernelOptions) {
     this.stdin = options.stdin ?? process.stdin;
     this.stdout = options.stdout ?? process.stdout;
     this.stderr = options.stderr ?? process.stderr;
@@ -75,7 +103,9 @@ export class Kernel implements IKernel {
     this.argv = options.argv ?? [];
     this.registryUrl = options.registryUrl;
     this.loader = new Loader({ registryUrl: this.registryUrl, celHandlers });
-    this.loader.register(new LocalFileAdapter());
+    for (const source of options.sources) {
+      this.loader.register(source);
+    }
     this.setupEventStreaming();
   }
 
@@ -83,8 +113,13 @@ export class Kernel implements IKernel {
     moduleName: string,
     kindName: string,
     controllerInstance: any,
+    fingerprint?: string,
   ): Promise<void> {
-    this.controllers.registerController(`${moduleName}.${kindName}`, controllerInstance);
+    this.controllers.registerController(
+      `${moduleName}.${kindName}`,
+      controllerInstance,
+      fingerprint,
+    );
     await controllerInstance.register?.(this.createControllerContext(`${moduleName}.${kindName}`));
   }
 
@@ -96,24 +131,6 @@ export class Kernel implements IKernel {
     this.registry.registerDefinition(definition);
   }
 
-  getModuleContext(_moduleName: string): ModuleContext {
-    return this.rootContext;
-  }
-
-  resolveModuleAlias(_declaringModule: string, alias: string): string | undefined {
-    return this.rootContext.importAliases.get(alias);
-  }
-
-  registerModuleImport(
-    _declaringModule: string,
-    alias: string,
-    targetModule: string,
-    kinds: string[],
-  ): void {
-    this.rootContext.registerImport(alias, targetModule, kinds);
-    this.registry.registerImport(alias, targetModule, kinds);
-  }
-
   loadModule(url: string, options?: LoadOptions): Promise<ResourceManifest[]> {
     return this.loader.loadModule(url, options);
   }
@@ -148,6 +165,10 @@ export class Kernel implements IKernel {
       "Telo.Definition",
       await import("./controllers/resource-definition/resource-definition-controller.js"),
     );
+    this.controllers.registerController(
+      "Telo.Abstract",
+      await import("./controllers/resource-definition/abstract-controller.js"),
+    );
     const moduleController = await import("./controllers/module/module-controller.js");
     this.controllers.registerController("Telo.Application", moduleController);
     this.controllers.registerController("Telo.Library", moduleController);
@@ -158,11 +179,12 @@ export class Kernel implements IKernel {
   }
 
   /**
-   * Load from runtime configuration file
+   * Load a manifest by URL. The URL is dispatched through the registered
+   * `ManifestSource` chain (file://, http://, pkg:, memory://, …); URL-shape
+   * normalization is each source's responsibility.
    */
-  async loadFromConfig(runtimeYamlPath: string): Promise<void> {
-    const resolvedUrl = new URL(runtimeYamlPath, `file://${process.cwd()}/`).href;
-    const sourceUrl = await this.loader.resolveEntryPoint(resolvedUrl);
+  async load(url: string): Promise<void> {
+    const sourceUrl = await this.loader.resolveEntryPoint(url);
     this.rootContext = new ModuleContext(
       sourceUrl,
       {},
@@ -246,24 +268,16 @@ export class Kernel implements IKernel {
     }
   }
 
-  /**
-   * Phase 1: Load - Ingest files from directory and load runtime config
-   * @deprecated Use loadFromConfig instead
-   */
-  async loadDirectory(dirPath: string): Promise<void> {
-    const configYamlPath = path.join(dirPath, DEFAULT_MANIFEST_FILENAME);
-
-    await this.loadFromConfig(configYamlPath);
-  }
-
   /**
    * Phase 2: Start - Initialize resources
    */
   async start(): Promise<void> {
-    // Call controller register hooks first (before any initialization)
-    for (const kind of this.controllers.getKinds()) {
+    // Call register hooks for controllers actually loaded at this point (built-ins).
+    // User-module kinds load their controllers during Phase 3 (Telo.Definition.init),
+    // and registerController() fires their register hook there.
+    for (const kind of this.controllers.getControllerKinds()) {
       const controller = this.controllers.getController(kind);
-      if (controller?.register) {
+      if (controller.register) {
         await controller.register(this.createControllerContext(`controller:${kind}`));
       }
     }
@@ -381,10 +395,6 @@ export class Kernel implements IKernel {
     return {
       on: (event: string, handler: (event: RuntimeEvent) => void | Promise<void>) =>
         this.eventBus.on(event, handler),
-      once: (event: string, handler: (event: RuntimeEvent) => void | Promise<void>) =>
-        this.eventBus.once(event, handler),
-      off: (event: string, handler: (event: RuntimeEvent) => void | Promise<void>) =>
-        this.eventBus.off(event, handler),
       emit: (event: string, payload?: any) => {
         const namespaced = event.includes(".") ? event : `${kind}.${event}`;
         void this.eventBus.emit(namespaced, payload);
@@ -471,16 +481,19 @@ export class Kernel implements IKernel {
   ): Promise<{ instance: ResourceInstance; ctx: ResourceContext } | null> {
     const kind = resource.kind;
 
-    // Resolve the alias-prefixed kind to its real fully-qualified kind.
-    // resolveKind() throws with a clear message if the alias or kind is not found.
-    const resolvedKind = this.rootContext.resolveKind(kind);
+    // Resolve the alias-prefixed kind to its real fully-qualified kind against the
+    // declaring module's own scope. resolveKind() walks up the parent chain so root
+    // built-ins (like `Telo`) remain visible from inside imported libraries; sibling
+    // modules stay isolated because they're not in the chain.
+    const resolvedKind = (findEnclosingModule(evalContext) ?? this.rootContext).resolveKind(kind);
 
-    const controller = this.controllers.getControllerOrUndefined(resolvedKind);
+    const fingerprint = policyFingerprint(findEnclosingPolicy(evalContext));
+    const controller = this.controllers.getControllerOrUndefined(resolvedKind, fingerprint);
     if (!controller) {
       const kindInfo =
         resolvedKind !== kind ? `'${kind}' (resolved to '${resolvedKind}')` : `'${kind}'`;
       throw new Error(
-        `No controller registered for kind ${kindInfo}, known controllers are: ${this.controllers.getKinds().join(", ")}`,
+        `No controller registered for kind ${kindInfo} (runtime fingerprint "${fingerprint}"), known controllers are: ${this.controllers.getKinds().join(", ")}`,
       );
     }
 
@@ -539,14 +552,17 @@ export class Kernel implements IKernel {
 
     if (!runtime.length) return { instance, ctx };
 
-    const wrapped: ResourceInstance = {
-      ...instance,
-      invoke: async (inputs: any) => {
-        const expanded = evalContext.expandPaths(inputs as Record<string, unknown>, runtime);
-        return instance.invoke!(expanded);
-      },
+    // Override invoke in-place so all lifecycle methods (init/invoke/teardown/snapshot)
+    // share the same `this`. A wrapper object would split identity: state mutated by
+    // init() on the wrapper would be invisible to the original invoke(), which still
+    // runs with `this === instance`. Mutating in place also preserves the prototype
+    // chain — class-declared methods remain reachable.
+    const originalInvoke = instance.invoke!.bind(instance);
+    instance.invoke = async (inputs: any) => {
+      const expanded = evalContext.expandPaths(inputs as Record<string, unknown>, runtime);
+      return originalInvoke(expanded);
     };
-    return { instance: wrapped, ctx };
+    return { instance, ctx };
   }
 
   /**
@@ -633,7 +649,11 @@ function resolveSchemaRef(
   schema: Record<string, unknown>,
   root: Record<string, unknown>,
 ): Record<string, unknown> {
-  if (schema.$ref && typeof schema.$ref === "string" && (schema.$ref as string).startsWith("#/$defs/")) {
+  if (
+    schema.$ref &&
+    typeof schema.$ref === "string" &&
+    (schema.$ref as string).startsWith("#/$defs/")
+  ) {
     const defName = (schema.$ref as string).slice("#/$defs/".length);
     const defs = root.$defs as Record<string, Record<string, unknown>> | undefined;
     const resolved = defs?.[defName];
@@ -651,7 +671,9 @@ function collectSchemaProperties(
   };
   for (const sub of (schema.oneOf ?? schema.anyOf ?? []) as Record<string, unknown>[]) {
     if (sub && typeof sub === "object" && sub.properties) {
-      for (const [k, v] of Object.entries(sub.properties as Record<string, Record<string, unknown>>)) {
+      for (const [k, v] of Object.entries(
+        sub.properties as Record<string, Record<string, unknown>>,
+      )) {
         if (!(k in props)) props[k] = v;
       }
     }
@@ -672,10 +694,7 @@ function stripCompiledValues(
 
   if (isCompiledValue(v)) return placeholderForSchema(resolved);
   if (Array.isArray(v)) {
-    const itemSchema = resolveSchemaRef(
-      (resolved.items ?? {}) as Record<string, unknown>,
-      root,
-    );
+    const itemSchema = resolveSchemaRef((resolved.items ?? {}) as Record<string, unknown>, root);
     return v.map((item) => stripCompiledValues(item, itemSchema, root));
   }
   if (v !== null && typeof v === "object") {

package/src/manifest-schemas.ts

@@ -49,6 +49,16 @@ const throwsSchema = {
   },
 };
 
+/** Alias-form pattern for `extends` values: "<Alias>.<AbstractName>".
+ *  Resolved against the declaring file's `Telo.Import` aliases — identical to how
+ *  kind prefixes work (e.g. `kind: Http.Api` resolves `Http` via the importer's
+ *  alias registration). Identity form (`std/mod#Name`) is intentionally not
+ *  accepted: aliases carry the module version via their `Telo.Import` source,
+ *  which canonical module names can't.
+ *  - Alias: PascalCase (first letter uppercase)
+ *  - Name: PascalCase */
+const EXTENDS_ALIAS_PATTERN = "^[A-Z][A-Za-z0-9_]*\\.[A-Z][A-Za-z0-9_]*$";
+
 const baseDefinition = {
   type: "object",
   required: ["kind", "metadata"],
@@ -56,6 +66,7 @@ const baseDefinition = {
     kind: { const: "Telo.Definition" },
     metadata: metadataSchema,
     capability: { type: "string" },
+    extends: { type: "string", pattern: EXTENDS_ALIAS_PATTERN },
     schema: { type: "object", additionalProperties: true },
     controllers: { type: "array", items: { type: "string" } },
     throws: throwsSchema,
@@ -114,11 +125,33 @@ export const ResourceDefinitionSchema = {
   ],
 };
 
+/** Schema for `kind: Telo.Abstract`. Library-declared abstracts are type blueprints —
+ *  they may carry an optional `capability` (lifecycle inherited by implementations)
+ *  and an optional `schema` (shared base for implementations). `controllers` and `throws`
+ *  are forbidden (no runtime implementation; throws lives on concrete definitions).
+ *  Other fields are permitted for forward compatibility with typed-abstracts work
+ *  (inputType, outputType, …) — Telo.Abstract is an extension point by design. */
+export const ResourceAbstractSchema = {
+  type: "object",
+  required: ["kind", "metadata"],
+  properties: {
+    kind: { const: "Telo.Abstract" },
+    metadata: metadataSchema,
+    capability: { type: "string" },
+    schema: { type: "object", additionalProperties: true },
+  },
+  not: {
+    anyOf: [{ required: ["controllers"] }, { required: ["throws"] }],
+  },
+  additionalProperties: true,
+};
+
 const ajv = new Ajv({ allErrors: true, strict: false });
 addFormats.default(ajv);
 
 export const validateRuntimeResource = ajv.compile(RuntimeResourceSchema);
 export const validateResourceDefinition = ajv.compile(ResourceDefinitionSchema);
+export const validateResourceAbstract = ajv.compile(ResourceAbstractSchema);
 
 export function formatAjvErrors(errors: any[] | null | undefined): string {
   if (!errors || errors.length === 0) return "Unknown schema error";

package/src/{manifest-adapters/local-file-adapter.ts → manifest-sources/local-file-source.ts}

@@ -1,4 +1,4 @@
-import { DEFAULT_MANIFEST_FILENAME, type ManifestAdapter } from "@telorun/analyzer";
+import { DEFAULT_MANIFEST_FILENAME, type ManifestSource } from "@telorun/analyzer";
 import * as fs from "fs/promises";
 import * as path from "path";
 import { fileURLToPath, pathToFileURL } from "url";
@@ -12,7 +12,7 @@ function toFileUrl(filePath: string): string {
   return pathToFileURL(filePath).href;
 }
 
-export class LocalFileAdapter implements ManifestAdapter {
+export class LocalFileSource implements ManifestSource {
   supports(pathOrUrl: string): boolean {
     return (
       pathOrUrl.startsWith("file://") ||

package/src/manifest-sources/memory-source.ts

@@ -0,0 +1,104 @@
+import { DEFAULT_MANIFEST_FILENAME, type ManifestSource } from "@telorun/analyzer";
+import { posix } from "node:path";
+import { stringify as yamlStringify } from "yaml";
+
+const SCHEME = "memory://";
+
+function stripScheme(url: string): string {
+  return url.startsWith(SCHEME) ? url.slice(SCHEME.length) : url;
+}
+
+function isAbsoluteUrl(s: string): boolean {
+  return /^[a-zA-Z][a-zA-Z0-9+\-.]*:/.test(s);
+}
+
+/** In-memory `ManifestSource` for embedders and tests. Register manifest text
+ *  (or parsed-manifest object arrays) under bare module names; the source
+ *  canonicalizes module entry points as `<name>/telo.yaml`, mirroring disk's
+ *  "module is a directory containing telo.yaml" convention so relative imports
+ *  (`./sub`, `../sibling`) work transparently with POSIX path resolution. */
+export class MemorySource implements ManifestSource {
+  private readonly entries = new Map<string, string>();
+
+  /** Register a manifest source. `name` is a bare module name (`"app"`,
+   *  `"lib"`, or hierarchical `"auth/login"`) or a partial-file path with a
+   *  `.yaml`/`.yml` extension. Bare names are stored under `<name>/telo.yaml`;
+   *  extension-bearing names are stored literally. Object-array `content` is
+   *  serialized via `yaml.stringify` so the loader downstream is identical to
+   *  the YAML-text path. */
+  set(name: string, content: string | unknown[]): void {
+    if (!name) {
+      throw new Error("MemorySource.set: name must be non-empty");
+    }
+    if (name.startsWith("/")) {
+      throw new Error(
+        `MemorySource.set: name '${name}' must not start with '/' — memory:// has no absolute root`,
+      );
+    }
+    if (isAbsoluteUrl(name)) {
+      throw new Error(
+        `MemorySource.set: name '${name}' must be a bare key, not a URL with a scheme`,
+      );
+    }
+    const normalized = posix.normalize(name);
+    if (normalized.startsWith("..") || normalized === "." || normalized === "..") {
+      throw new Error(
+        `MemorySource.set: name '${name}' contains '..' segments that escape the namespace`,
+      );
+    }
+
+    const text = typeof content === "string"
+      ? content
+      : content
+          .filter((doc) => doc !== null && doc !== undefined)
+          .map((doc) => yamlStringify(doc))
+          .join("---\n");
+
+    const hasYamlExt = normalized.endsWith(".yaml") || normalized.endsWith(".yml");
+    const key = hasYamlExt ? normalized : `${normalized}/${DEFAULT_MANIFEST_FILENAME}`;
+    this.entries.set(key, text);
+  }
+
+  supports(url: string): boolean {
+    return url.startsWith(SCHEME);
+  }
+
+  async read(url: string): Promise<{ text: string; source: string }> {
+    const key = stripScheme(url);
+    // Direct hit (literal-extension files, or already-canonicalized telo.yaml URLs).
+    const direct = this.entries.get(key);
+    if (direct !== undefined) {
+      return { text: direct, source: `${SCHEME}${key}` };
+    }
+    // Directory-style fall-through: bare module name → <name>/telo.yaml.
+    const fallback = `${key}/${DEFAULT_MANIFEST_FILENAME}`;
+    const fallbackText = this.entries.get(fallback);
+    if (fallbackText !== undefined) {
+      return { text: fallbackText, source: `${SCHEME}${fallback}` };
+    }
+    throw new Error(
+      `MemorySource: no entry for '${url}'. Tried keys '${key}' and '${fallback}'.`,
+    );
+  }
+
+  resolveRelative(base: string, relative: string): string {
+    if (isAbsoluteUrl(relative)) {
+      throw new Error(
+        `MemorySource.resolveRelative: relative '${relative}' is an absolute URL — pass it directly, not through resolveRelative`,
+      );
+    }
+    if (relative.startsWith("/")) {
+      throw new Error(
+        `MemorySource.resolveRelative: 'memory://' has no absolute root; use a full 'memory://<name>' URL instead of '${relative}'`,
+      );
+    }
+    const baseKey = stripScheme(base);
+    const joined = posix.normalize(posix.join(posix.dirname(baseKey), relative));
+    if (joined === ".." || joined.startsWith("../")) {
+      throw new Error(
+        `MemorySource.resolveRelative: relative '${relative}' escapes the memory:// namespace from base '${base}'`,
+      );
+    }
+    return `${SCHEME}${joined}`;
+  }
+}

package/src/module-context.ts

@@ -1,4 +1,8 @@
-import type { Invocable, ModuleContext as IModuleContext } from "@telorun/sdk";
+import type {
+  ControllerPolicy,
+  Invocable,
+  ModuleContext as IModuleContext,
+} from "@telorun/sdk";
 import type { EmitEvent, InstanceFactory } from "@telorun/sdk";
 import { EvaluationContext } from "./evaluation-context.js";
 
@@ -50,11 +54,20 @@ export class ModuleContext extends EvaluationContext implements IModuleContext {
   private _resources: Record<string, unknown>;
 
   /** Maps import alias → real module name for kind resolution. */
-  readonly importAliases = new Map<string, string>();
+  private readonly importAliases = new Map<string, string>();
 
   /** Maps import alias → allowed kind names. Absent entry = unrestricted (e.g. Kernel). */
   private readonly importedKinds = new Map<string, Set<string>>();
 
+  /**
+   * Resolved controller-selection policy for this module's `Telo.Definition`s.
+   * Stamped by the parent `Telo.Import` controller from the import's `runtime:`
+   * field; read by `Telo.Definition.init` (via `ResourceContext.getControllerPolicy`)
+   * when invoking `ControllerLoader.load`. `undefined` means "no policy set" —
+   * loader treats it as `auto`.
+   */
+  private _controllerPolicy: ControllerPolicy | undefined;
+
   constructor(
     source: string,
     variables: Record<string, unknown> = {},
@@ -103,6 +116,14 @@ export class ModuleContext extends EvaluationContext implements IModuleContext {
     this._rebuildContext();
   }
 
+  setControllerPolicy(policy: ControllerPolicy | undefined): void {
+    this._controllerPolicy = policy;
+  }
+
+  getControllerPolicy(): ControllerPolicy | undefined {
+    return this._controllerPolicy;
+  }
+
   protected override onResourceSnapshotted(name: string, snap: Record<string, unknown>): void {
     this.setResource(name, snap);
   }
@@ -118,6 +139,10 @@ export class ModuleContext extends EvaluationContext implements IModuleContext {
     }
   }
 
+  hasImport(alias: string): boolean {
+    return this.importAliases.has(alias);
+  }
+
   getInstance(name: string): unknown {
     const entry = this.resourceInstances.get(name);
     if (!entry) {
@@ -142,7 +167,10 @@ export class ModuleContext extends EvaluationContext implements IModuleContext {
   /**
    * Resolve a fully-qualified kind like "Http.Server" to its real kind "http-server.Server".
    * Splits on the first dot, looks up the prefix in importAliases, validates against
-   * importedKinds (if set), and reconstructs the resolved kind.
+   * importedKinds (if set), and reconstructs the resolved kind. When the alias is not
+   * present locally, walks up the lifecycle parent chain so children inherit ancestors'
+   * imports (notably the root's `Telo` built-in). Sibling modules — being absent from the
+   * chain — remain isolated.
    * Throws with a clear message if the alias is unknown or the kind is not exported.
    */
   resolveKind(kind: string): string {
@@ -154,6 +182,11 @@ export class ModuleContext extends EvaluationContext implements IModuleContext {
     const suffix = kind.slice(dot + 1);
     const realModule = this.importAliases.get(prefix);
     if (!realModule) {
+      let cur = this.parent;
+      while (cur) {
+        if (cur instanceof ModuleContext) return cur.resolveKind(kind);
+        cur = cur.parent;
+      }
       const known = [...this.importAliases.keys()].join(", ") || "(none)";
       throw new Error(
         `Kind '${kind}': no module imported with alias '${prefix}'. Known aliases: ${known}`,

package/src/registry.ts

@@ -15,7 +15,6 @@ export class ManifestRegistry {
   register(resource: RuntimeResource): void {
     const { kind, metadata } = resource;
     const { name } = metadata;
-    console.log("Registering resource:", kind, name);
     if (!this.resources.has(kind)) {
       this.resources.set(kind, new Map());
     }

package/src/resource-context.ts

@@ -6,17 +6,19 @@ import {
   RuntimeError,
   RuntimeResource,
   isCompiledValue,
+  type ControllerPolicy,
   type EvaluationContext as IEvaluationContext,
   type LoadOptions,
   type ModuleContext,
   type ParsedArgs,
   type TypeRule,
 } from "@telorun/sdk";
-import { EvaluationContext } from "./evaluation-context.js";
 import AjvModule from "ajv";
 import addFormats from "ajv-formats";
+import { EvaluationContext } from "./evaluation-context.js";
 import { Kernel } from "./kernel.js";
 import { formatAjvErrors } from "./manifest-schemas.js";
+import { policyFingerprint } from "./runtime-registry.js";
 import { SchemaValidator } from "./schema-validator.js";
 
 const Ajv = AjvModule.default ?? AjvModule;
@@ -217,8 +219,7 @@ export class ResourceContextImpl implements ResourceContext {
     const hasInlineProperties = Object.keys(resource).some(
       (k) => k !== "kind" && k !== "name" && k !== "metadata",
     );
-    const hasExplicitName =
-      resource.name !== undefined || resource.metadata?.name !== undefined;
+    const hasExplicitName = resource.name !== undefined || resource.metadata?.name !== undefined;
     const shouldRegister =
       (hasInlineProperties || (!hasExplicitName && resourceName !== undefined)) &&
       !this.moduleContext.hasManifest(name);
@@ -237,20 +238,6 @@ export class ResourceContextImpl implements ResourceContext {
     return { kind, name };
   }
 
-  teardownResource(kind: string, name: string): Promise<void> {
-    throw new Error("Method teardownResource not implemented.");
-    // const parts = kind.split(".");
-    // if (parts.length > 2) {
-    //   return this.kernel.teardownResource(parts[0], parts.slice(1).join("."), name);
-    // }
-    // return this.kernel.teardownResource(this.metadata.module, kind, name);
-  }
-
-  getResources(kind: string): RuntimeResource[] {
-    throw new Error("Method teardownResource not implemented.");
-    // return this.kernel.getResourcesByKind(kind);
-  }
-
   getResourcesByName(_kind: string, name: string): RuntimeResource | null {
     const entry = this.moduleContext.resourceInstances.get(name);
     return (entry?.resource ?? null) as RuntimeResource | null;
@@ -261,23 +248,20 @@ export class ResourceContextImpl implements ResourceContext {
     kindName: string,
     controllerInstance: any,
   ): Promise<void> {
-    await this.kernel.registerController(moduleName, kindName, controllerInstance);
+    const fingerprint = policyFingerprint(this.moduleContext.getControllerPolicy());
+    await this.kernel.registerController(moduleName, kindName, controllerInstance, fingerprint);
   }
 
   registerDefinition(def: any) {
     this.kernel.registerResourceDefinition(def);
   }
 
-  on(event: string, handler: (payload?: any) => void | Promise<void>): void {
-    this.kernel.on(event, handler);
-  }
-
-  once(event: string, handler: (payload?: any) => void | Promise<void>): void {
-    throw new Error("Method once not implemented.");
+  getControllerPolicy(): ControllerPolicy | undefined {
+    return this.moduleContext.getControllerPolicy();
   }
 
-  off(event: string, handler: (payload?: any) => void | Promise<void>): void {
-    throw new Error("Method off not implemented.");
+  on(event: string, handler: (payload?: any) => void | Promise<void>): void {
+    this.kernel.on(event, handler);
   }
 
   async emit(event: string, payload?: any) {
@@ -301,16 +285,7 @@ export class ResourceContextImpl implements ResourceContext {
   }
 
   registerModuleImport(alias: string, targetModule: string, kinds: string[]): void {
-    const declaringModule = (this.metadata as any).module as string | undefined;
-    this.kernel.registerModuleImport(declaringModule ?? "", alias, targetModule, kinds);
-  }
-
-  resolveModuleAlias(declaringModule: string, alias: string): string | undefined {
-    return this.kernel.resolveModuleAlias(declaringModule, alias);
-  }
-
-  getModuleContext(moduleName: string): ModuleContext {
-    return this.kernel.getModuleContext(moduleName);
+    this.moduleContext.registerImport(alias, targetModule, kinds);
   }
 
   /**