@telorun/kernel 0.59.0 → 0.60.0

package/src/bundle/files-integrity.ts

@@ -1,4 +1,8 @@
-import { DEFAULT_MANIFEST_FILENAME, sha256Base64Url } from "@telorun/analyzer";
+import {
+  DEFAULT_MANIFEST_FILENAME,
+  sha256Base64Url,
+  type ArtifactLayer,
+} from "@telorun/analyzer";
 
 import { findOwnerDoc, parseManifestDocs } from "./module-manifest.js";
 
@@ -9,16 +13,18 @@ export interface PayloadFile {
 }
 
 /**
- * Canonical per-file content digest of a module's `files:` payload — the value
- * of `filesIntegrity` in a bundle's `telo.yaml`. SHA-256 over the sorted
- * `<path>\0<sha256(content)>` lines of every payload file, `telo.yaml`
- * excluded (the importer's `#sha256-...` hash already covers the manifest, and
- * excluding it breaks the self-reference — the manifest embeds this value).
+ * Canonical per-file content digest of one **layer**'s files — the `integrity`
+ * value of that layer's entry in the published `layers:` index. SHA-256 over the
+ * sorted `<path>\0<sha256(content)>` lines of every file in the layer,
+ * `telo.yaml` excluded (it is the manifest layer, which carries the index and so
+ * cannot hash itself; the importer's `#sha256-...` pin covers it instead).
  *
  * Hashing file *contents* rather than the tar/gzip bytes makes the digest
  * independent of archive framing, so publisher and client compute the same
  * value from the same file set, and it can be re-derived from the extracted
- * files on disk. Returns `sha256-<base64url>`.
+ * files on disk — which is what makes a per-layer cache marker checkable without
+ * re-tarring. Distinct from the layer's `blob` digest, which covers the pushed
+ * bytes and addresses the layer. Returns `sha256-<base64url>`.
  */
 export async function computeFilesIntegrity(files: PayloadFile[]): Promise<string> {
   const lines: string[] = [];
@@ -32,15 +38,29 @@ export async function computeFilesIntegrity(files: PayloadFile[]): Promise<strin
   return `sha256-${await sha256Base64Url(canonical)}`;
 }
 
-/** Write `filesIntegrity` onto the manifest's owner doc so the published
- *  `telo.yaml` pins its payload — transitively covered by importers'
- *  `#sha256-...` hash. The digest excludes `telo.yaml`, so injecting it does
- *  not change the digest. Returns the manifest unchanged when it has no owner
- *  doc. */
-export function injectFilesIntegrity(manifest: string, hash: string): string {
+/**
+ * Write the `layers:` index onto the manifest's owner doc so the published
+ * `telo.yaml` pins and addresses every payload layer — transitively covered by
+ * importers' `#sha256-...` hash over this manifest.
+ *
+ * Called after the payload blobs are pushed and before the manifest blob is,
+ * which is what keeps the index non-circular: it names only layers other than
+ * the one carrying it. Each layer's own digest excludes `telo.yaml`, so
+ * injecting the index does not invalidate any of them. Returns the manifest
+ * unchanged when it has no owner doc.
+ */
+export function injectLayerIndex(manifest: string, layers: readonly ArtifactLayer[]): string {
   const docs = parseManifestDocs(manifest);
   const owner = findOwnerDoc(docs);
   if (!owner) return manifest;
-  owner.set("filesIntegrity", hash);
+  owner.set(
+    "layers",
+    layers.map((layer) => ({
+      role: layer.role,
+      ...(layer.selector ? { selector: { ...layer.selector } } : {}),
+      blob: layer.blob,
+      integrity: layer.integrity,
+    })),
+  );
   return docs.map((d) => d.toString()).join("---\n");
 }

package/src/bundle/module-artifact.ts

@@ -0,0 +1,375 @@
+import {
+  matchControllerLayers,
+  selectorKey,
+  singletonLayer,
+  splitIntegrity,
+  describeSelector,
+  type ArtifactLayer,
+  type ArtifactSelector,
+  type PlatformTarget,
+} from "@telorun/analyzer";
+import { NOOP_LOGGER, RuntimeError, type Logger } from "@telorun/sdk";
+import { existsSync } from "fs";
+import * as fs from "fs/promises";
+import * as path from "path";
+import { fileURLToPath } from "url";
+
+import { withDirectoryLock } from "../directory-lock.js";
+import { cachePathForCanonical } from "../manifest-sources/local-manifest-cache-source.js";
+import type { TransportRegistry } from "../transports/transport-registry.js";
+import { computeFilesIntegrity, type PayloadFile } from "./files-integrity.js";
+
+/** A materialized layer: the directory its files were extracted into (the
+ *  module's cache directory) and the manifest-relative paths it wrote. */
+export interface MaterializedLayer {
+  dir: string;
+  files: string[];
+}
+
+/**
+ * Map Node's platform vocabulary onto the canonical OCI/GOOS names selectors are
+ * published with. Node says `win32`/`x64`; OCI descriptors say
+ * `windows`/`amd64`, and the published artifact is what has to be matched.
+ */
+const NODE_OS_TO_OCI: Readonly<Record<string, string>> = {
+  win32: "windows",
+  darwin: "darwin",
+  linux: "linux",
+  freebsd: "freebsd",
+  openbsd: "openbsd",
+  sunos: "solaris",
+  aix: "aix",
+};
+
+const NODE_ARCH_TO_OCI: Readonly<Record<string, string>> = {
+  x64: "amd64",
+  ia32: "386",
+  arm64: "arm64",
+  arm: "arm",
+  ppc64: "ppc64le",
+  s390x: "s390x",
+  riscv64: "riscv64",
+  loong64: "loong64",
+};
+
+/**
+ * Which libc this process is linked against, or `undefined` when it cannot be
+ * determined. Undetermined is deliberately *not* guessed: a selector that
+ * constrains `libc` then matches nothing, so a glibc binary is never handed to
+ * an Alpine host on the assumption it will run. Node reports
+ * `glibcVersionRuntime` in its process report only on a glibc build, which makes
+ * its absence on Linux the musl signal.
+ */
+function detectLibc(): string | undefined {
+  if (process.platform !== "linux") return undefined;
+  try {
+    const report = process.report?.getReport() as
+      | { header?: { glibcVersionRuntime?: string } }
+      | undefined;
+    return report?.header?.glibcVersionRuntime ? "gnu" : "musl";
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * The platform this kernel is running on, in the published vocabulary. An axis
+ * Node cannot name is left absent rather than guessed.
+ *
+ * Computed once: the host cannot change mid-process, and `detectLibc` generates a
+ * full Node diagnostic report (a heap and stack walk costing tens of milliseconds).
+ * The controller loader asks per candidate per definition — oauth-client alone has
+ * seventeen — so recomputing would put that squarely inside the init loop.
+ */
+let cachedHostTarget: PlatformTarget | undefined;
+
+export function hostPlatformTarget(): PlatformTarget {
+  cachedHostTarget ??= {
+    os: NODE_OS_TO_OCI[process.platform],
+    arch: NODE_ARCH_TO_OCI[process.arch],
+    libc: detectLibc(),
+  };
+  return cachedHostTarget;
+}
+
+/**
+ * A module's artifact, scoped to one loaded module.
+ *
+ * Built during module load, where the **pinned** import ref and the
+ * already-verified manifest are both in hand — which is the whole reason this
+ * exists as its own object rather than as logic inside a controller loader. A
+ * loader is handed only the canonical base URI, which carries no `#sha256-`, so
+ * a loader that fetched for itself would have to re-read the layer index off the
+ * cache directory: verification silently downgraded from "anchored at the
+ * importer's pin" to "trust whatever is already on disk".
+ *
+ * Materialization is per layer, memoized in-process, and guarded by the shared
+ * cross-process directory lock — oauth-client alone has seventeen definitions
+ * resolving concurrently against one controller layer, and several kernels may
+ * populate one cache directory at once.
+ *
+ * Verification runs before extraction: the transport checks the transfer against
+ * the layer's `blob` digest, and the extracted file set is checked against its
+ * `integrity` content digest here. A per-layer marker keyed by the blob digest
+ * records success, so a republish to different bytes re-extracts rather than
+ * being mistaken for an already-populated layer.
+ */
+export class ModuleArtifact {
+  /** The importer's pinned ref — what the transport verifies the manifest layer
+   *  against, and what keeps the Merkle chain anchored. */
+  private readonly pinnedRef: string;
+  private readonly layers: readonly ArtifactLayer[];
+  private readonly dir: string;
+  private readonly transports: TransportRegistry;
+  private readonly log: Logger;
+  /** In-flight / completed materializations, keyed by blob digest. Rejections
+   *  are dropped so a transient fetch failure retries on the next ask. */
+  private readonly inFlight = new Map<string, Promise<MaterializedLayer>>();
+
+  constructor(opts: {
+    pinnedRef: string;
+    layers: readonly ArtifactLayer[];
+    dir: string;
+    transports: TransportRegistry;
+    log?: Logger;
+  }) {
+    this.pinnedRef = opts.pinnedRef;
+    this.layers = opts.layers;
+    this.dir = opts.dir;
+    this.transports = opts.transports;
+    this.log = opts.log ?? NOOP_LOGGER;
+  }
+
+  /** The module's local directory — where every materialized layer lands, and
+   *  what a module-relative path resolves against. */
+  get directory(): string {
+    return this.dir;
+  }
+
+  /**
+   * Materialize the layer carrying `selector` exactly, plus the `common` layer.
+   *
+   * Looked up by exact selector key rather than by re-matching the host: the
+   * candidate being resolved already *is* one selector, and it is by construction
+   * the key of the layer that carries it. Re-matching would take the first layer
+   * in declaration order that the host satisfies, so a module shipping both a
+   * platform-neutral and a platform-constrained layer of one format would fetch
+   * whichever came first regardless of which candidate asked — materializing the
+   * wrong layer and then reporting "bundle not found".
+   *
+   * The `common` layer rides along because it is the sink for files no candidate
+   * claimed — an undeclared sidecar an entry point loads at runtime. Pulling it
+   * with any controller layer is what makes a forgotten declaration cost bytes
+   * instead of a module-not-found at import.
+   *
+   * Returns `undefined` when the artifact ships no layer for this selector, which
+   * is how a loader learns to fall through to the next candidate.
+   */
+  async materializeController(selector: ArtifactSelector): Promise<MaterializedLayer | undefined> {
+    const key = selectorKey(selector);
+    const layer = this.layers.find(
+      (l) => l.role === "controller" && l.selector !== undefined && selectorKey(l.selector) === key,
+    );
+    if (!layer) return undefined;
+    await this.materializeCommon();
+    return this.materialize(layer);
+  }
+
+  /**
+   * Materialize everything a module-relative file read could need: the `assets`
+   * layer **and** the `common` layer.
+   *
+   * Both, because `common` is where the sink rule puts a file the author did not
+   * claim via `assets:` — and a module that ships static files but has no bundled
+   * controller has no other path to its own payload. Assets alone would leave such
+   * a module's `Http.Static` root resolving into an empty directory, which is the
+   * exact silent failure this design promises not to have.
+   */
+  async materializeModuleFiles(): Promise<void> {
+    await Promise.all([this.materializeAssets(), this.materializeCommon()]);
+  }
+
+  /** Materialize the lazily-fetched `assets` layer, if the module ships one. */
+  async materializeAssets(): Promise<MaterializedLayer | undefined> {
+    const layer = singletonLayer(this.layers, "assets");
+    return layer ? this.materialize(layer) : undefined;
+  }
+
+  /** Materialize the `common` layer, if the module ships one. */
+  async materializeCommon(): Promise<MaterializedLayer | undefined> {
+    const layer = singletonLayer(this.layers, "common");
+    return layer ? this.materialize(layer) : undefined;
+  }
+
+  /**
+   * Materialize every layer a `target` platform could need — both singletons and
+   * each controller layer matching it. `telo install`'s make-this-offline pass,
+   * where being exhaustive for one platform is the point.
+   */
+  async materializeAll(target: PlatformTarget): Promise<MaterializedLayer[]> {
+    const wanted = [
+      ...matchControllerLayers(this.layers, target),
+      singletonLayer(this.layers, "assets"),
+      singletonLayer(this.layers, "common"),
+    ].filter((l): l is ArtifactLayer => l !== undefined);
+    const out: MaterializedLayer[] = [];
+    for (const layer of wanted) out.push(await this.materialize(layer));
+    return out;
+  }
+
+  /** Human-facing description of what this artifact ships, for diagnostics that
+   *  have to explain why no layer matched. */
+  describeLayers(): string {
+    if (this.layers.length === 0) return "(no payload layers)";
+    return this.layers
+      .map((l) => (l.selector ? `${l.role} ${describeSelector(l.selector)}` : l.role))
+      .join(", ");
+  }
+
+  private materialize(layer: ArtifactLayer): Promise<MaterializedLayer> {
+    const pending = this.inFlight.get(layer.blob);
+    if (pending) return pending;
+    const work = this.materializeUncached(layer).catch((err) => {
+      // Drop the rejection so a transient fetch failure is retried rather than
+      // cached for the lifetime of the module.
+      this.inFlight.delete(layer.blob);
+      throw err;
+    });
+    this.inFlight.set(layer.blob, work);
+    return work;
+  }
+
+  private markerPath(layer: ArtifactLayer): string {
+    // Keyed by the blob digest, so a republish to different bytes gets a new
+    // marker and re-extracts instead of being read as already-populated. The
+    // role is in the name purely so a human can tell the markers apart.
+    const short = layer.blob.replace(/^sha256:/, "").slice(0, 16);
+    return path.join(this.dir, `.telo-layer-${layer.role}-${short}`);
+  }
+
+  private async materializeUncached(layer: ArtifactLayer): Promise<MaterializedLayer> {
+    const marker = this.markerPath(layer);
+    if (existsSync(marker)) {
+      return { dir: this.dir, files: await readMarker(marker) };
+    }
+
+    return withDirectoryLock(
+      this.dir,
+      "module layer",
+      async () => {
+        // Re-check inside the lock: a peer may have extracted this layer between
+        // the fast-path miss and our acquisition.
+        if (existsSync(marker)) {
+          return { dir: this.dir, files: await readMarker(marker) };
+        }
+
+        const files = await this.transports.fetchLayer(this.pinnedRef, layer.blob);
+        const actual = await computeFilesIntegrity(files);
+        if (actual !== layer.integrity) {
+          throw new RuntimeError(
+            "ERR_MODULE_LAYER_INTEGRITY",
+            `Integrity check failed for the ${layer.role} layer of ${this.pinnedRef}: ` +
+              `expected ${layer.integrity}, got ${actual}. The layer's contents do not match ` +
+              `the digest recorded in the module's pinned telo.yaml — it may have been ` +
+              `tampered with or republished.`,
+          );
+        }
+
+        const written = await this.extract(files, layer);
+        // Marker last, so a partial extraction leaves none and re-runs.
+        await fs.writeFile(marker, `${written.join("\n")}\n`, "utf-8");
+        this.log.debug("materialized module layer", {
+          "telo.module.ref": this.pinnedRef,
+          "telo.layer.role": layer.role,
+          "telo.layer.files": written.length,
+        });
+        return { dir: this.dir, files: written };
+      },
+      this.log,
+    );
+  }
+
+  private async extract(files: PayloadFile[], layer: ArtifactLayer): Promise<string[]> {
+    const root = path.resolve(this.dir) + path.sep;
+    const written: string[] = [];
+    for (const entry of files) {
+      const dest = path.resolve(this.dir, entry.name);
+      if (!dest.startsWith(root)) {
+        throw new RuntimeError(
+          "ERR_MODULE_LAYER_INVALID",
+          `The ${layer.role} layer of ${this.pinnedRef} contains entry '${entry.name}', which ` +
+            `resolves outside the module's cache directory.`,
+        );
+      }
+      await fs.mkdir(path.dirname(dest), { recursive: true });
+      await fs.writeFile(dest, entry.content);
+      written.push(entry.name);
+    }
+    return written.sort();
+  }
+}
+
+async function readMarker(marker: string): Promise<string[]> {
+  const text = await fs.readFile(marker, "utf-8");
+  return text.split("\n").filter((line) => line !== "");
+}
+
+/**
+ * The directory a module's layers live in.
+ *
+ * Derived from the **pinned** `requestedUrl`, not the canonical `source`, because
+ * those diverge exactly when the manifest cache is warm: a cache hit is served as
+ * a `file://` URL into `.telo/manifests/`, which no transport claims, so a
+ * `source`-derived path is `null` on every run after the first. The pinned ref is
+ * what the importer wrote and survives the hit, so it places the module
+ * identically cold and warm. A genuinely local `source` (development, or a module
+ * loaded straight off disk) resolves to its own directory.
+ *
+ * Returns `null` when neither route yields a directory — a `memory://` module, or
+ * a ref this cache has no coordinates for.
+ */
+export function moduleDirectoryFor(
+  requestedUrl: string,
+  source: string,
+  entryDir: string,
+  registryUrl: string | undefined,
+  manifestsDir: string | undefined,
+): string | null {
+  const cacheFile = cachePathForCanonical(
+    splitIntegrity(requestedUrl).base,
+    entryDir,
+    registryUrl,
+    manifestsDir,
+  );
+  if (cacheFile) return path.dirname(cacheFile);
+  if (source.startsWith("file://")) return path.dirname(fileURLToPath(source));
+  if (path.isAbsolute(source)) return path.dirname(source);
+  return null;
+}
+
+/**
+ * Build the artifact handle for a loaded module, or `undefined` when the module
+ * has no payload to materialize.
+ *
+ * The trigger is the presence of a `layers:` index — a module that ships nothing
+ * needs no handle. `pinnedRef` is the ref **as the importer wrote it**, integrity
+ * fragment included, which is what keeps verification anchored to the importer's
+ * pin; `moduleDir` is where its layers extract to (see {@link moduleDirectoryFor}).
+ */
+export function moduleArtifactFor(opts: {
+  pinnedRef: string;
+  layers: readonly ArtifactLayer[] | undefined;
+  moduleDir: string | null;
+  transports: TransportRegistry;
+  log?: Logger;
+}): ModuleArtifact | undefined {
+  if (!opts.layers || opts.layers.length === 0) return undefined;
+  if (!opts.moduleDir) return undefined;
+  return new ModuleArtifact({
+    pinnedRef: opts.pinnedRef,
+    layers: opts.layers,
+    dir: opts.moduleDir,
+    transports: opts.transports,
+    log: opts.log,
+  });
+}

package/src/bundle/module-manifest.ts

@@ -1,3 +1,4 @@
+import { parseLayerIndex, type ArtifactLayer } from "@telorun/analyzer";
 import { defaultCustomTags } from "@telorun/templating";
 import { parseAllDocuments, type Document } from "yaml";
 
@@ -9,8 +10,9 @@ export function parseManifestDocs(text: string): Document[] {
 }
 
 /** The owner document of a manifest — the single `Telo.Application` /
- *  `Telo.Library` doc that carries its identity, `files:`, and `filesIntegrity`.
- *  The one place that selects it, shared by every reader/writer. */
+ *  `Telo.Library` doc that carries its identity, `files:` / `assets:`, and the
+ *  published `layers:` index. The one place that selects it, shared by every
+ *  reader/writer. */
 export function findOwnerDoc(docs: Document[]): Document | undefined {
   return docs.find((d) => {
     const kind = (d.toJSON() as { kind?: string } | null)?.kind;
@@ -23,7 +25,13 @@ export function findOwnerDoc(docs: Document[]): Document | undefined {
 export interface OwnerManifest {
   name?: string;
   version?: string;
-  filesIntegrity?: string;
+  /** The published layer index, absent on an unpublished manifest. Parsed and
+   *  validated through the analyzer's shared model, so a malformed index is a
+   *  hard `LayerIndexError` rather than a silently ignored field. */
+  layers?: ArtifactLayer[];
+  /** Ordered `.gitignore`-style patterns the author claimed as the lazily
+   *  materialized `assets` layer. */
+  assetPatterns: string[];
   /** True when the owner doc declares a non-empty `files:` list. */
   declaresFiles: boolean;
   /** Descriptive provenance a transport projects into its backend's metadata
@@ -36,18 +44,26 @@ export interface OwnerManifest {
 
 /** Read the owner doc's identity + payload fields from a manifest, parsing once
  *  (never regex-scraping). The single source both transports call for the
- *  module's name and version, `filesIntegrity`, and payload detection. */
+ *  module's name and version, its layer index, and payload detection. */
 export function readOwnerManifest(text: string): OwnerManifest {
   const owner = findOwnerDoc(parseManifestDocs(text));
   const parsed = owner?.toJSON() as
-    | { metadata?: Record<string, unknown>; files?: unknown; filesIntegrity?: unknown }
+    | {
+        metadata?: Record<string, unknown>;
+        files?: unknown;
+        assets?: unknown;
+        layers?: unknown;
+      }
     | undefined;
   const md = parsed?.metadata ?? {};
   const str = (v: unknown): string | undefined => (typeof v === "string" ? v : undefined);
+  const patterns = (v: unknown): string[] =>
+    Array.isArray(v) ? v.filter((p): p is string => typeof p === "string") : [];
   return {
     name: str(md.name),
     version: str(md.version),
-    filesIntegrity: str(parsed?.filesIntegrity),
+    layers: parsed?.layers === undefined ? undefined : parseLayerIndex(parsed.layers),
+    assetPatterns: patterns(parsed?.assets),
     declaresFiles: Array.isArray(parsed?.files) && parsed.files.length > 0,
     description: str(md.description),
     repository: str(md.repository),

package/src/controller-loader.ts

@@ -1,5 +1,6 @@
 import { ControllerInstance, RuntimeError, type Logger } from "@telorun/sdk";
 import { BundleControllerLoader } from "./controller-loaders/bundle-loader.js";
+import type { ModuleArtifact } from "./bundle/module-artifact.js";
 import { ControllerEnvMissingError, NapiControllerLoader } from "./controller-loaders/napi-loader.js";
 import { NpmControllerLoader } from "./controller-loaders/npm-loader.js";
 import { ControllerPolicy, DEFAULT_POLICY, POLICY_WILDCARD } from "./runtime-registry.js";
@@ -117,6 +118,7 @@ export class ControllerLoader {
     purlCandidates: string[],
     baseUri: string,
     policy?: ControllerPolicy,
+    artifact?: ModuleArtifact,
   ): Promise<ControllerInstance> {
     if (!purlCandidates || purlCandidates.length === 0) {
       throw new RuntimeError("ERR_CONTROLLER_NOT_FOUND", "Missing controller PURL candidates");
@@ -135,7 +137,7 @@ export class ControllerLoader {
       await this.emit?.({ name: "ControllerLoading", payload: { purl } });
       const startedAt = Date.now();
       try {
-        const { instance, source } = await this.dispatchOne(purl, baseUri);
+        const { instance, source } = await this.dispatchOne(purl, baseUri, artifact);
         await this.emit?.({
           name: "ControllerLoaded",
           payload: { purl, source, durationMs: Date.now() - startedAt },
@@ -187,6 +189,7 @@ export class ControllerLoader {
     purlCandidates: string[],
     baseUri: string,
     policy?: ControllerPolicy,
+    artifact?: ModuleArtifact,
   ): Promise<ResolvedController> {
     if (!purlCandidates || purlCandidates.length === 0) {
       throw new RuntimeError("ERR_CONTROLLER_NOT_FOUND", "Missing controller PURL candidates");
@@ -202,7 +205,7 @@ export class ControllerLoader {
     const errors: string[] = [];
     for (const purl of ordered) {
       try {
-        const { source, importInstance } = await this.dispatchResolveOne(purl, baseUri);
+        const { source, importInstance } = await this.dispatchResolveOne(purl, baseUri, artifact);
         return { purl, source, importInstance };
       } catch (err) {
         if (err instanceof ControllerEnvMissingError) {
@@ -221,14 +224,16 @@ export class ControllerLoader {
   private async dispatchOne(
     purl: string,
     baseUri: string,
+    artifact?: ModuleArtifact,
   ): Promise<{ instance: ControllerInstance; source: ControllerResolveSource }> {
-    const { source, importInstance } = await this.dispatchResolveOne(purl, baseUri);
+    const { source, importInstance } = await this.dispatchResolveOne(purl, baseUri, artifact);
     return { instance: await importInstance(), source };
   }
 
   private async dispatchResolveOne(
     purl: string,
     baseUri: string,
+    artifact?: ModuleArtifact,
   ): Promise<{ source: ControllerResolveSource; importInstance: () => Promise<ControllerInstance> }> {
     if (purl.startsWith("pkg:npm")) {
       return this.npmLoader.resolve(purl, baseUri);
@@ -237,7 +242,7 @@ export class ControllerLoader {
       return this.napiLoader.resolve(purl, baseUri);
     }
     if (purl.startsWith("pkg:telo")) {
-      return this.bundleLoader.resolve(purl, baseUri);
+      return this.bundleLoader.resolve(purl, baseUri, artifact);
     }
     throw new ControllerEnvMissingError(`Unsupported PURL scheme: ${purl}`);
   }