@telorun/kernel 0.59.0 → 0.61.0

package/dist/invocation-contract-binding.d.ts

@@ -0,0 +1,105 @@
+import { type ContractDirection, type DefResolver } from "@telorun/analyzer";
+import type { ResourceDefinition, ResourceInstance, ResourceManifest } from "@telorun/sdk";
+/**
+ * Binds a resource's resolved invocation contract to its dispatch entry points,
+ * at the moment the kernel produces the instance.
+ *
+ * A contract is only a guarantee if it cannot be dispatched around, and most
+ * consumers never reach the kernel's dispatch chokepoint: Phase-5 injection puts
+ * the live instance straight into a consumer's config object, so `Ai.Agent`
+ * reads `this.resource.model` and calls `model.invoke(...)` in hand. Enforcing at
+ * a handoff would mean enforcing at every handoff — Phase-5 injection,
+ * `ctx.resolveRef`, scope-handle resolution, the template controller's direct
+ * dispatch, `ctx.invoke`'s target lookup — and one forgotten site silently
+ * reopens the hole.
+ *
+ * So the kernel binds instead, at `_createInstance`: its single production site.
+ * Every consumer, on every path, then holds an instance whose dispatch already
+ * enforces. Binding rather than wrapping is also what keeps the rest a
+ * non-problem — there is one object, so controller-specific members are
+ * genuinely its own, the prototype chain (and `instanceof` across the SDK realm
+ * boundary) is untouched, and `stripCompiledValues` / `detachSnapshotValue` see
+ * exactly the object they always saw. It is the same in-place technique the
+ * kernel already uses to fold detached-task draining into `teardown()` and
+ * runtime CEL expansion into `invoke()`.
+ *
+ * Consequence, stated rather than left to be discovered: the bound `invoke`
+ * shadows the controller's, so a controller calling `this.invoke()` internally
+ * goes through its own contract.
+ */
+/** Compiles a JSON Schema to a validator. The kernel's `SchemaValidator` runs
+ *  with `useDefaults`, so validating also fills declared defaults. */
+export interface ContractValidatorFactory {
+    (typeRef: unknown): {
+        validate(value: unknown): void;
+    };
+    /** Resolves a type field to its JSON Schema, for the schema-level decisions
+     *  (stream skipping, default paths) a compiled validator can't answer. */
+    schemaOf(typeRef: unknown): Record<string, any> | undefined;
+    /** Resolves a `$ref` to the registered schema it names, so the schema walks
+     *  can see through the reference form the compiled validator keeps intact. */
+    resolveRef(ref: string): Record<string, any> | undefined;
+    /** Compiles an adjusted schema while keeping the CEL `rules:` registered under
+     *  a named type — the one path that survives stripping a stream property from
+     *  a named contract without abandoning its invariants. */
+    withRules(name: string | undefined, schema: Record<string, any>): {
+        validate(value: unknown): void;
+    };
+}
+export interface BoundContract {
+    direction: ContractDirection;
+    validate(value: unknown): void;
+    /** Paths a default can be written to — how far the caller's value must be
+     *  copied before validation runs. Empty when the contract declares none. */
+    defaultPaths(): string[][];
+}
+export declare function resolveBoundContract(direction: ContractDirection, manifest: ResourceManifest, definition: ResourceDefinition | undefined, resolveDef: DefResolver, factory: ContractValidatorFactory): BoundContract | undefined;
+/**
+ * A copy of `value` deep along exactly the paths a default can be written to and
+ * shared everywhere else.
+ *
+ * A flat shallow copy would not do: AJV's `useDefaults` writes at every level it
+ * finds a default, so a nested default would mutate the structure the caller
+ * still holds. Bounded by the schema's defaults rather than by the size of the
+ * payload — a contract declaring no defaults copies one level and nothing more.
+ */
+export declare function copyForDefaults(value: unknown, paths: readonly string[][]): unknown;
+/**
+ * Raise a contract violation as a structured {@link InvokeError}.
+ *
+ * Structured rather than a plain error because the run engine assigns
+ * `INTERNAL_ERROR` to anything that is not an `InvokeError` — a contract
+ * violation would then reach a `catch` block indistinguishable from a crash, and
+ * an author could neither match it nor rethrow it faithfully. These are ambient
+ * kernel codes: catchable by name, and never counted against a kind's own
+ * `throws:` union.
+ *
+ * The message names the target, the direction, and the offending detail, because
+ * a caller several steps away otherwise cannot tell which boundary rejected the
+ * value or which side supplied it.
+ */
+export declare function contractViolation(direction: ContractDirection, describeTarget: () => string, cause: unknown): Error;
+export interface ContractBinding {
+    input?: BoundContract;
+    output?: BoundContract;
+    /** Names the resource in a violation message — the target, so a caller several
+     *  steps away can tell which boundary rejected the value. */
+    describeTarget(): string;
+}
+/**
+ * Bind `invoke()` and `provide()` in place.
+ *
+ * `provide()` takes no caller arguments, so it has no input side, but it returns
+ * a value against a declared `outputType` and that result is validated exactly as
+ * an invocable's is — same path, same stream skip, same ambient error code.
+ * `run()` is bound to nothing: parameterless and void, there is nothing to fill
+ * defaults into and no result to validate, so it is guarded statically instead.
+ */
+export declare function bindContract(instance: ResourceInstance, binding: ContractBinding): void;
+/** A structural copy with every BigInt rendered as a Number, for validation
+ *  only. A value beyond the safe-integer range loses precision in the VIEW,
+ *  which can only affect a bound check at the extremes; the dispatched value is
+ *  untouched. Non-plain objects (a live `Stream`, a resource instance) pass
+ *  through by reference — they are not data to be walked. */
+export declare function withBigIntsAsNumbers(value: unknown): unknown;
+//# sourceMappingURL=invocation-contract-binding.d.ts.map

package/dist/invocation-contract-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invocation-contract-binding.d.ts","sourceRoot":"","sources":["../src/invocation-contract-binding.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,iBAAiB,EAGtB,KAAK,WAAW,EAEjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAQ3F;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH;sEACsE;AACtE,MAAM,WAAW,wBAAwB;IACvC,CAAC,OAAO,EAAE,OAAO,GAAG;QAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;IACvD;8EAC0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;IAC5D;kFAC8E;IAC9E,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;IACzD;;8DAE0D;IAC1D,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG;QAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;CACtG;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,iBAAiB,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IAC/B;gFAC4E;IAC5E,YAAY,IAAI,MAAM,EAAE,EAAE,CAAC;CAC5B;AA4CD,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,iBAAiB,EAC5B,QAAQ,EAAE,gBAAgB,EAC1B,UAAU,EAAE,kBAAkB,GAAG,SAAS,EAC1C,UAAU,EAAE,WAAW,EACvB,OAAO,EAAE,wBAAwB,GAChC,aAAa,GAAG,SAAS,CA+C3B;AAUD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,OAAO,CAWnF;AAwBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,iBAAiB,EAC5B,cAAc,EAAE,MAAM,MAAM,EAC5B,KAAK,EAAE,OAAO,GACb,KAAK,CAuBP;AAeD,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB;iEAC6D;IAC7D,cAAc,IAAI,MAAM,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,eAAe,GAAG,IAAI,CA2DvF;AAED;;;;6DAI6D;AAC7D,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAqB5D"}

package/dist/invocation-contract-binding.js

@@ -0,0 +1,296 @@
+import { defaultBearingPaths, effectiveContractField, withStreamPropertiesSkipped, } from "@telorun/analyzer";
+import { ERR_CONTRACT_UNRESOLVABLE, ERR_INPUT_INVALID, ERR_OUTPUT_INVALID, InvokeError, } from "@telorun/sdk";
+const CONTRACT_ERROR = {
+    inputType: ERR_INPUT_INVALID,
+    outputType: ERR_OUTPUT_INVALID,
+};
+/**
+ * Resolve one direction of a resource's contract to a bound validator.
+ *
+ * The declaration is layered instance-manifest → nearest along `extends` (see
+ * `effectiveContractField` — nearest wins, contracts never merge), then compiled.
+ *
+ * A NAMED reference (`inputType: RequestShape`, or a `!ref` to a type) is
+ * compiled by name so it keeps the CEL `rules:` registered alongside it, which a
+ * plain schema copy would drop. Everything else is compiled from the resolved
+ * schema — inline `{kind, schema}` and raw forms carry no rules, and resolving
+ * first is what lets a `{ $ref: "telo://Self/X" }` contract compile at all
+ * (`resolveTypeSchema` follows it through the kernel's registry, which AJV
+ * cannot).
+ *
+ * The resolved schema is stripped of `x-telo-stream` properties first: a live
+ * `Stream` in a declared slot is not data to be traversed, the same defect as
+ * `stripCompiledValues` walking a live instance in a ref slot. Streams travel in
+ * both directions (`Codec.Encoder` marks `input` on its `inputType` and requires
+ * it), so the skip is not one-directional.
+ *
+ * WHICH declaration applies is decided here, at create time — that is a fact
+ * about the manifest. COMPILING it is deferred to first dispatch and memoized: a
+ * contract may reference a named `telo#Type` whose `Type.JsonSchema` resource
+ * initializes later in the same multi-pass loop, and resolving it eagerly would
+ * make every contract-declaring kind depend on type-registration order. Nothing
+ * can dispatch before the loop finishes, so first-use is always late enough.
+ */
+/** True when a type field names a registered `telo#Type` — a bare name, or the
+ *  `{kind, name}` object a `!ref` normalizes to. Only these carry CEL `rules:`,
+ *  so only these are worth compiling by name rather than from their schema. */
+function isNamedTypeReference(declared) {
+    if (typeof declared === "string")
+        return true;
+    if (!declared || typeof declared !== "object")
+        return false;
+    const ref = declared;
+    return typeof ref.name === "string" && !(ref.schema && typeof ref.schema === "object");
+}
+export function resolveBoundContract(direction, manifest, definition, resolveDef, factory) {
+    const own = manifest[direction];
+    const declared = own !== undefined && own !== null
+        ? own
+        : effectiveContractField(definition, resolveDef, direction);
+    if (declared === undefined || declared === null)
+        return undefined;
+    let compiled;
+    let paths;
+    const resolve = () => {
+        if (compiled !== undefined)
+            return compiled;
+        const schema = factory.schemaOf(declared);
+        if (!schema) {
+            // A declared contract that resolves to nothing is a manifest fault — a
+            // named type that never registered — and it MUST NOT degrade to
+            // "unvalidated". Silently disabling enforcement is the failure mode
+            // nobody notices: every later call passes because nothing is checking.
+            throw new InvokeError(ERR_CONTRACT_UNRESOLVABLE, `declared \`${direction}\` could not be resolved to a schema: ${describeDeclaration(declared)}. ` +
+                `The type is not registered, so the contract cannot be enforced.`);
+        }
+        const stripped = withStreamPropertiesSkipped(schema, factory.resolveRef);
+        paths = defaultBearingPaths(stripped, factory.resolveRef);
+        // Compile by NAME whenever the declaration is one, so the type's CEL
+        // `rules:` are composed in — including when a stream had to be stripped, in
+        // which case the stream-bearing properties are dropped from the schema the
+        // named validator sees rather than the reference being abandoned.
+        compiled = !isNamedTypeReference(declared)
+            ? factory(stripped)
+            : stripped === schema
+                ? factory(declared)
+                : factory.withRules(nameOf(declared), stripped);
+        return compiled;
+    };
+    return {
+        direction,
+        validate: (value) => resolve().validate(value),
+        defaultPaths: () => {
+            resolve();
+            return paths ?? [];
+        },
+    };
+}
+const nameOf = (declared) => typeof declared === "string"
+    ? declared
+    : declared?.name;
+const describeDeclaration = (declared) => typeof declared === "string" ? `'${declared}'` : JSON.stringify(declared);
+/**
+ * A copy of `value` deep along exactly the paths a default can be written to and
+ * shared everywhere else.
+ *
+ * A flat shallow copy would not do: AJV's `useDefaults` writes at every level it
+ * finds a default, so a nested default would mutate the structure the caller
+ * still holds. Bounded by the schema's defaults rather than by the size of the
+ * payload — a contract declaring no defaults copies one level and nothing more.
+ */
+export function copyForDefaults(value, paths) {
+    if (!value || typeof value !== "object")
+        return value;
+    let out = shallowCopy(value);
+    for (const path of paths) {
+        // The leaf is what gets written; every CONTAINER above it is what must not
+        // be shared. An `[]` segment fans out: the default lands in each element, so
+        // the array and every element on the path have to be copied too — bailing
+        // there would leave `rows[0]` shared and let a fill mutate the caller's data.
+        out = copyAlong(out, path.slice(0, -1));
+    }
+    return out;
+}
+const shallowCopy = (value) => Array.isArray(value) ? [...value] : { ...value };
+function copyAlong(node, segments) {
+    if (!node || typeof node !== "object")
+        return node;
+    if (segments.length === 0)
+        return node;
+    const [head, ...rest] = segments;
+    if (head === "[]") {
+        if (!Array.isArray(node))
+            return node;
+        return node.map((item) => item && typeof item === "object" ? copyAlong(shallowCopy(item), rest) : item);
+    }
+    const container = node;
+    const child = container[head];
+    if (!child || typeof child !== "object")
+        return node;
+    container[head] = copyAlong(shallowCopy(child), rest);
+    return node;
+}
+/**
+ * Raise a contract violation as a structured {@link InvokeError}.
+ *
+ * Structured rather than a plain error because the run engine assigns
+ * `INTERNAL_ERROR` to anything that is not an `InvokeError` — a contract
+ * violation would then reach a `catch` block indistinguishable from a crash, and
+ * an author could neither match it nor rethrow it faithfully. These are ambient
+ * kernel codes: catchable by name, and never counted against a kind's own
+ * `throws:` union.
+ *
+ * The message names the target, the direction, and the offending detail, because
+ * a caller several steps away otherwise cannot tell which boundary rejected the
+ * value or which side supplied it.
+ */
+export function contractViolation(direction, describeTarget, cause) {
+    // A type's CEL `rules:` raise the author's OWN code — that is the whole point
+    // of declaring one, and `modules/type` documents rule codes as catchable.
+    // Only a structural schema failure is the ambient contract violation.
+    //
+    // Re-raised as a STRUCTURED error carrying that code: the rule itself throws a
+    // `RuntimeError`, which has a code but not the marker a catch block matches
+    // on, so it used to reach `catch` as the generic plain-failure code — the
+    // documented behaviour never actually worked. Wrapping preserves the code and
+    // makes it match.
+    const ruleCode = ruleViolationCode(cause);
+    if (ruleCode) {
+        return new InvokeError(ruleCode, cause.message, undefined, { cause });
+    }
+    const side = direction === "inputType" ? "inputs" : "result";
+    const detail = cause instanceof Error ? cause.message : String(cause);
+    return new InvokeError(CONTRACT_ERROR[direction], `${describeTarget()}: ${side} do not satisfy the declared ${direction}: ${detail}`, undefined, { cause });
+}
+/** Codes the validator itself raises for a STRUCTURAL failure. Anything else
+ *  carrying a code came from a declared rule and belongs to its author. */
+const STRUCTURAL_VALIDATION_CODES = new Set([
+    "ERR_RESOURCE_SCHEMA_VALIDATION_FAILED",
+    "ERR_TYPE_NOT_FOUND",
+]);
+function ruleViolationCode(cause) {
+    const code = cause?.code;
+    if (typeof code !== "string" || code.length === 0)
+        return undefined;
+    return STRUCTURAL_VALIDATION_CODES.has(code) ? undefined : code;
+}
+/**
+ * Bind `invoke()` and `provide()` in place.
+ *
+ * `provide()` takes no caller arguments, so it has no input side, but it returns
+ * a value against a declared `outputType` and that result is validated exactly as
+ * an invocable's is — same path, same stream skip, same ambient error code.
+ * `run()` is bound to nothing: parameterless and void, there is nothing to fill
+ * defaults into and no result to validate, so it is guarded statically instead.
+ */
+export function bindContract(instance, binding) {
+    const { input, output, describeTarget } = binding;
+    if (!input && !output)
+        return;
+    if (typeof instance.invoke === "function") {
+        const original = instance.invoke.bind(instance);
+        // EVERY argument is forwarded, not just `inputs`. `invoke(inputs, ctx)`
+        // carries the InvokeContext — cancellation, tracing — as its second
+        // parameter, and a wrapper that takes only `inputs` silently drops it: a
+        // detached body would then never see its cancellation token and a lease
+        // holding across it would never be released. The contract only concerns the
+        // first argument; the rest belong to the caller and the callee.
+        instance.invoke = async (inputs, ...rest) => {
+            let effective = inputs;
+            if (input) {
+                effective = copyForDefaults(inputs, input.defaultPaths());
+                // Validate a BIGINT-NORMALIZED view, not the values themselves. CEL
+                // evaluates an integer literal to a BigInt, which a JSON Schema
+                // validator does not recognise as `integer` — so every computed integer
+                // reaching a declared integer input would be rejected for a reason the
+                // author cannot act on. The dispatched values keep their BigInts, since
+                // a controller may need the full 64-bit range.
+                const view = withBigIntsAsNumbers(effective);
+                try {
+                    input.validate(view);
+                }
+                catch (error) {
+                    throw contractViolation("inputType", describeTarget, error);
+                }
+                // Defaults are additive, so anything the validator filled into the view
+                // is a key the caller omitted — copy exactly those back.
+                effective = mergeFilledDefaults(effective, view);
+            }
+            const result = await original(effective, ...rest);
+            if (output) {
+                try {
+                    output.validate(withBigIntsAsNumbers(result));
+                }
+                catch (error) {
+                    throw contractViolation("outputType", describeTarget, error);
+                }
+            }
+            return result;
+        };
+    }
+    if (output && typeof instance.provide === "function") {
+        const original = instance.provide.bind(instance);
+        instance.provide = async (...args) => {
+            const result = await original(...args);
+            try {
+                output.validate(withBigIntsAsNumbers(result));
+            }
+            catch (error) {
+                throw contractViolation("outputType", describeTarget, error);
+            }
+            return result;
+        };
+    }
+}
+/** A structural copy with every BigInt rendered as a Number, for validation
+ *  only. A value beyond the safe-integer range loses precision in the VIEW,
+ *  which can only affect a bound check at the extremes; the dispatched value is
+ *  untouched. Non-plain objects (a live `Stream`, a resource instance) pass
+ *  through by reference — they are not data to be walked. */
+export function withBigIntsAsNumbers(value) {
+    if (typeof value === "bigint")
+        return Number(value);
+    if (Array.isArray(value)) {
+        let changed = false;
+        const items = value.map((item) => {
+            const next = withBigIntsAsNumbers(item);
+            if (next !== item)
+                changed = true;
+            return next;
+        });
+        return changed ? items : value;
+    }
+    if (!value || typeof value !== "object")
+        return value;
+    if (Object.getPrototypeOf(value) !== Object.prototype)
+        return value;
+    let changed = false;
+    const out = {};
+    for (const [key, item] of Object.entries(value)) {
+        const next = withBigIntsAsNumbers(item);
+        if (next !== item)
+            changed = true;
+        out[key] = next;
+    }
+    return changed ? out : value;
+}
+/** Copy keys the validator's default-fill added to `view` back onto `target`.
+ *  Only ADDITIONS are taken: a key already present came from the caller and its
+ *  original (possibly BigInt) value is the one to dispatch. */
+function mergeFilledDefaults(target, view) {
+    if (target === view)
+        return target;
+    if (!target || typeof target !== "object" || Array.isArray(target))
+        return target;
+    if (!view || typeof view !== "object" || Array.isArray(view))
+        return target;
+    const out = target;
+    for (const [key, filled] of Object.entries(view)) {
+        if (!(key in out))
+            out[key] = filled;
+        else
+            out[key] = mergeFilledDefaults(out[key], filled);
+    }
+    return out;
+}
+//# sourceMappingURL=invocation-contract-binding.js.map

package/dist/invocation-contract-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invocation-contract-binding.js","sourceRoot":"","sources":["../src/invocation-contract-binding.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,mBAAmB,EACnB,sBAAsB,EAEtB,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,GACZ,MAAM,cAAc,CAAC;AAsDtB,MAAM,cAAc,GAAsC;IACxD,SAAS,EAAE,iBAAiB;IAC5B,UAAU,EAAE,kBAAkB;CAC/B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH;;+EAE+E;AAC/E,SAAS,oBAAoB,CAAC,QAAiB;IAC7C,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,GAAG,GAAG,QAAmC,CAAC;IAChD,OAAO,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,SAA4B,EAC5B,QAA0B,EAC1B,UAA0C,EAC1C,UAAuB,EACvB,OAAiC;IAEjC,MAAM,GAAG,GAAI,QAA+C,CAAC,SAAS,CAAC,CAAC;IACxE,MAAM,QAAQ,GACZ,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAC/B,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,sBAAsB,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAChE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAElE,IAAI,QAAwD,CAAC;IAC7D,IAAI,KAA6B,CAAC;IAElC,MAAM,OAAO,GAAG,GAAuC,EAAE;QACvD,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,uEAAuE;YACvE,gEAAgE;YAChE,oEAAoE;YACpE,uEAAuE;YACvE,MAAM,IAAI,WAAW,CACnB,yBAAyB,EACzB,cAAc,SAAS,yCAAyC,mBAAmB,CAAC,QAAQ,CAAC,IAAI;gBAC/F,iEAAiE,CACpE,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QACzE,KAAK,GAAG,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1D,qEAAqE;QACrE,4EAA4E;QAC5E,2EAA2E;QAC3E,kEAAkE;QAClE,QAAQ,GAAG,CAAC,oBAAoB,CAAC,QAAQ,CAAC;YACxC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;YACnB,CAAC,CAAC,QAAQ,KAAK,MAAM;gBACnB,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACnB,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;QACpD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO;QACL,SAAS;QACT,QAAQ,EAAE,CAAC,KAAc,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QACvD,YAAY,EAAE,GAAG,EAAE;YACjB,OAAO,EAAE,CAAC;YACV,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,QAAiB,EAAsB,EAAE,CACvD,OAAO,QAAQ,KAAK,QAAQ;IAC1B,CAAC,CAAC,QAAQ;IACV,CAAC,CAAG,QAA2C,EAAE,IAA2B,CAAC;AAEjF,MAAM,mBAAmB,GAAG,CAAC,QAAiB,EAAU,EAAE,CACxD,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE5E;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc,EAAE,KAA0B;IACxE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,2EAA2E;QAC3E,6EAA6E;QAC7E,0EAA0E;QAC1E,8EAA8E;QAC9E,GAAG,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,KAAa,EAAO,EAAE,CACzC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAI,KAAiC,EAAE,CAAC;AAEhF,SAAS,SAAS,CAAC,IAAa,EAAE,QAA2B;IAC3D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,QAAQ,CAAC;IAEjC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACvB,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAC7E,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,IAA+B,CAAC;IAClD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrD,SAAS,CAAC,IAAK,CAAC,GAAG,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAA4B,EAC5B,cAA4B,EAC5B,KAAc;IAEd,8EAA8E;IAC9E,0EAA0E;IAC1E,sEAAsE;IACtE,EAAE;IACF,+EAA+E;IAC/E,4EAA4E;IAC5E,0EAA0E;IAC1E,8EAA8E;IAC9E,kBAAkB;IAClB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,IAAI,WAAW,CAAC,QAAQ,EAAG,KAAe,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC7D,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,OAAO,IAAI,WAAW,CACpB,cAAc,CAAC,SAAS,CAAC,EACzB,GAAG,cAAc,EAAE,KAAK,IAAI,gCAAgC,SAAS,KAAK,MAAM,EAAE,EAClF,SAAS,EACT,EAAE,KAAK,EAAE,CACV,CAAC;AACJ,CAAC;AAED;2EAC2E;AAC3E,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IAC1C,uCAAuC;IACvC,oBAAoB;CACrB,CAAC,CAAC;AAEH,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,IAAI,GAAI,KAAmC,EAAE,IAAI,CAAC;IACxD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACpE,OAAO,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAClE,CAAC;AAUD;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,QAA0B,EAAE,OAAwB;IAC/E,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IAClD,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO;IAE9B,IAAI,OAAO,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAGzB,CAAC;QACtB,wEAAwE;QACxE,oEAAoE;QACpE,yEAAyE;QACzE,wEAAwE;QACxE,4EAA4E;QAC5E,gEAAgE;QAChE,QAAQ,CAAC,MAAM,GAAG,KAAK,EAAE,MAAW,EAAE,GAAG,IAAe,EAAE,EAAE;YAC1D,IAAI,SAAS,GAAG,MAAM,CAAC;YACvB,IAAI,KAAK,EAAE,CAAC;gBACV,SAAS,GAAG,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;gBAC1D,oEAAoE;gBACpE,gEAAgE;gBAChE,wEAAwE;gBACxE,uEAAuE;gBACvE,wEAAwE;gBACxE,+CAA+C;gBAC/C,MAAM,IAAI,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;gBAC7C,IAAI,CAAC;oBACH,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACvB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,iBAAiB,CAAC,WAAW,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;gBAC9D,CAAC;gBACD,wEAAwE;gBACxE,yDAAyD;gBACzD,SAAS,GAAG,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,CAAC;YAClD,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC;oBACH,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;gBAChD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,iBAAiB,CAAC,YAAY,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;gBAC/D,CAAC;YACH,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAA6C,CAAC;QAC7F,QAAQ,CAAC,OAAO,GAAG,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE;YAC9C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;YAChD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,iBAAiB,CAAC,YAAY,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;YAC/D,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;6DAI6D;AAC7D,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC/B,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,GAAG,IAAI,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IACpE,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,GAAG,IAAI,CAAC;QAClC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AAC/B,CAAC;AAED;;+DAE+D;AAC/D,SAAS,mBAAmB,CAAC,MAAe,EAAE,IAAa;IACzD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IACnC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAClF,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5E,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;QAC5E,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;;YAChC,GAAG,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/kernel.d.ts

@@ -2,6 +2,7 @@ import { AnalysisRegistry, type LoadedGraph, type ManifestSource } from "@teloru
 import { Kernel as IKernel, ResourceDefinition, ResourceInstance, ResourceManifest, RuntimeEvent, type EvaluationContext as IEvaluationContext, type InvokeOptions, type LoadOptions } from "@telorun/sdk";
 import { KernelLogging } from "./logging/kernel-logging.js";
 import type { ScopeConfig } from "./logging/scope-config.js";
+import { type ModuleArtifact } from "./bundle/module-artifact.js";
 export interface KernelOptions {
     stdin?: NodeJS.ReadableStream;
     stdout?: NodeJS.WritableStream;
@@ -44,6 +45,9 @@ export declare class Kernel implements IKernel {
     /** The `.telo` cache root for this load, resolved once in `load()` and
      *  threaded to the validator, analysis stamp, and npm install root. */
     private _cacheRoot?;
+    /** Per-module artifact handles, keyed by canonical manifest source. Rebuilt on
+     *  every `load()`; empty for a graph of purely local / manifest-only modules. */
+    private readonly moduleArtifacts;
     private _loadedGraph?;
     private _bootCalled;
     private _isBooted;
@@ -219,6 +223,34 @@ export declare class Kernel implements IKernel {
     /** The npm install root for this load (`<cache-root>/npm`), threaded to the
      *  controller loader so it doesn't re-derive it from the entry URL. */
     getInstallRoot(): string | undefined;
+    /**
+     * Build one {@link ModuleArtifact} per loaded module that ships a payload.
+     *
+     * Here, and not inside a controller loader, because this is the only point
+     * where both halves are in hand: the **pinned** ref the importer wrote
+     * (`requestedUrl`, integrity fragment included) and the manifest text that has
+     * already been verified against it. A loader sees only the canonical base URI,
+     * which carries no `#sha256-`, so a loader that fetched for itself would have
+     * to re-read the index off the cache directory — verification downgraded from
+     * "anchored at the importer's pin" to "trust whatever is on disk".
+     *
+     * Keyed by canonical `source`, which is what a definition's `metadata.source`
+     * carries, so a controller resolution can find its module's artifact.
+     *
+     * The trigger is "this manifest carries a `layers:` index", never "its source
+     * maps to a cache path". Those differ the moment the cache is warm:
+     * `LocalManifestCacheSource` serves a hit as a `file://` URL into
+     * `.telo/manifests/`, which no transport claims, so deriving the directory from
+     * `source` yields nothing and every OCI module would silently lose its artifact
+     * on the second and every later run — taking lazy asset materialization with it.
+     * The **pinned** `requestedUrl` survives a cache hit, so placement is derived
+     * from that, with a local `source` resolving to its own directory.
+     */
+    private buildModuleArtifacts;
+    /** The artifact of the module whose manifest resolved from `source`, or
+     *  `undefined` for a module with no fetchable payload (already on disk,
+     *  manifest-only, or not cacheable). */
+    getModuleArtifact(source: string | undefined): ModuleArtifact | undefined;
     /** Authored `kind` of a declared resource by name, from the static manifest
      *  set. Init-order-independent (unlike `resourceInstances`), so a controller
      *  resolving a `!ref <name>` sentinel before the target initializes can still
@@ -265,6 +297,17 @@ export declare class Kernel implements IKernel {
      * is not yet registered (retry signal).
      */
     private _createInstance;
+    /**
+     * Resolve and bind both directions of a resource's invocation contract.
+     *
+     * The declaration is layered instance-manifest → nearest along `extends`;
+     * contracts never merge (a call signature is not additive the way construction
+     * config is), so a definition that declares one fully replaces its ancestor's.
+     * Resolution runs in the scope that DECLARED each definition — an `extends`
+     * alias is lexical, and a `telo#Type` reference goes through import aliases, so
+     * a chain crossing module boundaries re-scopes at every hop.
+     */
+    private bindInvocationContract;
     /**
      * Create phase for an inherited (concrete-`extends`) definition's parent: runs
      * the ordinary create pipeline (controller resolution + lazy load, schema
@@ -282,6 +325,12 @@ export declare class Kernel implements IKernel {
      * field map and replaces each {kind, name} reference value (outside scope visibility
      * paths) with the live ResourceInstance returned by getInstance(name). Fields within
      * scope paths are left as {kind, name} — the controller resolves them at runtime.
+     *
+     * `owner` is the context the resource belongs to, and the scope handle built for an
+     * `x-telo-scope` field hangs off it rather than off the root: a `with:` block's inline
+     * declarations name their kinds through the import aliases of the module that DECLARED
+     * the resource, so a library's scoped `kind: OAuth.RedirectListener` resolves against
+     * that library's imports — the root has never heard of the alias.
      */
     private _injectDependencies;
 }

package/dist/kernel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kernel.d.ts","sourceRoot":"","sources":["../src/kernel.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAOhB,KAAK,WAAW,EAChB,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAIL,MAAM,IAAI,OAAO,EAEjB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAEhB,YAAY,EAGZ,KAAK,iBAAiB,IAAI,kBAAkB,EAC5C,KAAK,aAAa,EAElB,KAAK,WAAW,EAEjB,MAAM,cAAc,CAAC;AAMtB,OAAO,EAAE,aAAa,EAA6B,MAAM,6BAA6B,CAAC;AACvF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAmD7D,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB;;;wEAGoE;IACpE,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B;;8EAE0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,qBAAa,MAAO,YAAW,OAAO;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwD;IACjF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0B;IACnD,OAAO,CAAC,WAAW,CAAgD;IACnE,OAAO,CAAC,QAAQ,CAA4B;IAC5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAE7C,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,aAAa,CAAyB;IAC9C,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAyB;IAC/D,OAAO,CAAC,WAAW,CAAiB;IACpC,OAAO,CAAC,eAAe,CAA0B;IACjD,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B;;wCAEoC;IACpC,OAAO,CAAC,cAAc,CAAsE;IAG5F,OAAO,CAAC,gBAAgB,CAAgB;IACxC;2EACuE;IACvE,OAAO,CAAC,UAAU,CAAC,CAAgB;IACnC,OAAO,CAAC,YAAY,CAAC,CAAc;IAGnC,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,WAAW,CAAS;IAI5B,OAAO,CAAC,iBAAiB,CAAC,CAAqB;IAG/C,OAAO,CAAC,QAAQ,CAAC,CAAS;IAE1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,cAAc,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC;;;;uEAImE;IACnE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;gBAEpB,OAAO,EAAE,aAAa;IAoC5B,kBAAkB,CACtB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,kBAAkB,EAAE,GAAG,EACvB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC;IAShB;;;;;OAKG;IACH,sBAAsB,CACpB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GACxB,IAAI;IAIP;;OAEG;IACH,0BAA0B,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI;IAK1D,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAK3E,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAM7D;;oGAEgG;IAChG,mBAAmB,IAAI,gBAAgB;IAIvC;;;;+DAI2D;IAC3D,cAAc,IAAI,WAAW,GAAG,SAAS;IAIzC;;;;4CAIwC;IACxC,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAO7C;;;;;sDAKkD;IAClD,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAkBlE;;;;;OAKG;YACW,sBAAsB;IAsCpC;;;;;;;;;;;;;OAaG;IACG,IAAI,CACR,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GAClF,OAAO,CAAC,IAAI,CAAC;IAoShB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,kBAAkB;IAU1B;;;;;;OAMG;IACH,gBAAgB,IAAI,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,KAAK,GAAG,KAAK,CAAA;KAAE,CAAC;IAI1F;;;;;;;OAOG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAmF3B;;sCAEkC;IAClC,aAAa,IAAI,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC;IAIzC;;;;;;OAMG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAiBjC;gEAC4D;IAC5D,OAAO,KAAK,gBAAgB,GAG3B;IAED;;;;;OAKG;IACH,MAAM,CAAC,MAAM,SAAc,GAAG,IAAI;IAIlC;;;;;OAKG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAwB/B;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAU5B;;;;;OAKG;IACG,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,EACvC,GAAG,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAC5C,MAAM,EAAE,OAAO,EACf,IAAI,CAAC,EAAE,aAAa,GACnB,OAAO,CAAC,OAAO,CAAC;IAqBb,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAInE;;;;;;OAMG;IACH,WAAW,IAAI,MAAM,GAAG,SAAS;IAIjC;2EACuE;IACvE,cAAc,IAAI,MAAM,GAAG,SAAS;IAIpC;;;wDAGoD;IACpD,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAOpD,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAI/B,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,IAAI;IAyBxC,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAS5B;;;;;;;OAOG;IACH,SAAS,IAAI,IAAI;IAKjB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIxC;;;;;OAKG;IACH,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAIlC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAI/E,OAAO,CAAC,uBAAuB;IAe/B;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,qBAAqB;IAsB7B;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IA4B9B;;;;;OAKG;YACW,eAAe;IA2I7B;;;;;;;;OAQG;IACG,uBAAuB,CAC3B,WAAW,EAAE,kBAAkB,EAC/B,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAKnC;;;;;;;OAOG;IACH,OAAO,CAAC,mBAAmB;CAyC5B"}
+{"version":3,"file":"kernel.d.ts","sourceRoot":"","sources":["../src/kernel.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAQhB,KAAK,WAAW,EAChB,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAM3B,OAAO,EAIL,MAAM,IAAI,OAAO,EAEjB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAEhB,YAAY,EAGZ,KAAK,iBAAiB,IAAI,kBAAkB,EAC5C,KAAK,aAAa,EAElB,KAAK,WAAW,EAEjB,MAAM,cAAc,CAAC;AAMtB,OAAO,EAAE,aAAa,EAA6B,MAAM,6BAA6B,CAAC;AACvF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAoB7D,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,6BAA6B,CAAC;AAmCrC,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB;;;wEAGoE;IACpE,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B;;8EAE0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,qBAAa,MAAO,YAAW,OAAO;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwD;IACjF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0B;IACnD,OAAO,CAAC,WAAW,CAAgD;IACnE,OAAO,CAAC,QAAQ,CAA4B;IAC5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAE7C,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,aAAa,CAAyB;IAC9C,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAyB;IAC/D,OAAO,CAAC,WAAW,CAAiB;IACpC,OAAO,CAAC,eAAe,CAA0B;IACjD,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B;;wCAEoC;IACpC,OAAO,CAAC,cAAc,CAAsE;IAG5F,OAAO,CAAC,gBAAgB,CAAgB;IACxC;2EACuE;IACvE,OAAO,CAAC,UAAU,CAAC,CAAgB;IACnC;qFACiF;IACjF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqC;IACrE,OAAO,CAAC,YAAY,CAAC,CAAc;IAGnC,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,WAAW,CAAS;IAI5B,OAAO,CAAC,iBAAiB,CAAC,CAAqB;IAG/C,OAAO,CAAC,QAAQ,CAAC,CAAS;IAE1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,cAAc,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC;;;;uEAImE;IACnE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;gBAEpB,OAAO,EAAE,aAAa;IAoC5B,kBAAkB,CACtB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,kBAAkB,EAAE,GAAG,EACvB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC;IAShB;;;;;OAKG;IACH,sBAAsB,CACpB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GACxB,IAAI;IAIP;;OAEG;IACH,0BAA0B,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI;IAK1D,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAK3E,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAM7D;;oGAEgG;IAChG,mBAAmB,IAAI,gBAAgB;IAIvC;;;;+DAI2D;IAC3D,cAAc,IAAI,WAAW,GAAG,SAAS;IAIzC;;;;4CAIwC;IACxC,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAO7C;;;;;sDAKkD;IAClD,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAkBlE;;;;;OAKG;YACW,sBAAsB;IA6CpC;;;;;;;;;;;;;OAaG;IACG,IAAI,CACR,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GAClF,OAAO,CAAC,IAAI,CAAC;IAqShB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,kBAAkB;IAU1B;;;;;;OAMG;IACH,gBAAgB,IAAI,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,KAAK,GAAG,KAAK,CAAA;KAAE,CAAC;IAI1F;;;;;;;OAOG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAmF3B;;sCAEkC;IAClC,aAAa,IAAI,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC;IAIzC;;;;;;OAMG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAiBjC;gEAC4D;IAC5D,OAAO,KAAK,gBAAgB,GAG3B;IAED;;;;;OAKG;IACH,MAAM,CAAC,MAAM,SAAc,GAAG,IAAI;IAIlC;;;;;OAKG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAwB/B;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAU5B;;;;;OAKG;IACG,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,EACvC,GAAG,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAC5C,MAAM,EAAE,OAAO,EACf,IAAI,CAAC,EAAE,aAAa,GACnB,OAAO,CAAC,OAAO,CAAC;IAqBb,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAInE;;;;;;OAMG;IACH,WAAW,IAAI,MAAM,GAAG,SAAS;IAIjC;2EACuE;IACvE,cAAc,IAAI,MAAM,GAAG,SAAS;IAIpC;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,oBAAoB;IAwB5B;;4CAEwC;IACxC,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,cAAc,GAAG,SAAS;IAIzE;;;wDAGoD;IACpD,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAOpD,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAI/B,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,IAAI;IAyBxC,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAS5B;;;;;;;OAOG;IACH,SAAS,IAAI,IAAI;IAKjB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIxC;;;;;OAKG;IACH,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAIlC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAI/E,OAAO,CAAC,uBAAuB;IAe/B;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,qBAAqB;IAsB7B;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IA4B9B;;;;;OAKG;YACW,eAAe;IA2J7B;;;;;;;;;OASG;IACH,OAAO,CAAC,sBAAsB;IA+B9B;;;;;;;;OAQG;IACG,uBAAuB,CAC3B,WAAW,EAAE,kBAAkB,EAC/B,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAKnC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,mBAAmB;CA0C5B"}