@telorun/kernel 0.77.0 → 0.79.0

package/src/kernel.ts

@@ -17,6 +17,7 @@ import {
   type ContractValidatorFactory,
   resolveBoundContract,
 } from "./invocation-contract-binding.js";
+import { readProjectionRef, type ProjectionScope } from "@telorun/analyzer";
 import {
   ControllerContext,
   ControllerPolicy,
@@ -26,6 +27,7 @@ import {
   ResourceDefinition,
   ResourceInstance,
   ResourceManifest,
+  stampRefIdentity,
   RuntimeError,
   RuntimeEvent,
   type BootTarget,
@@ -49,6 +51,7 @@ import { ambientInvokeContext } from "./evaluation-context.js";
 import { ModuleContext } from "./module-context.js";
 import { ResourceContextImpl } from "./resource-context.js";
 import { mintResourceHandle } from "./resource-handle.js";
+import { declarationOfInstance, recordInstanceDeclaration } from "./instance-declaration.js";
 import { nodeHostVersions } from "./host-versions.js";
 import { nodeCelHandlers } from "./cel-handlers.js";
 import { parseRef, seedInvokeSource } from "./invoke-dispatch.js";
@@ -1417,6 +1420,18 @@ export class Kernel implements IKernel {
       resolvedKind,
       (processedResource.metadata?.name as string | undefined) ?? "<unnamed>",
     );
+    recordInstanceDeclaration(instance, processedResource);
+    // Stamp the DECLARATION SITE here rather than at Phase-5 injection, because
+    // this is the only point where the instance and the context that declared it
+    // are both in hand: injection sees the consumer's context, not the target's,
+    // so a module stamped there would be whoever referenced it. Without it a
+    // durable step could not name its target anywhere the instance does not
+    // exist — the whole reason `step()` takes an identity at all.
+    const originPointer = originPointerOf(processedResource);
+    stampRefIdentity(instance, resolvedKind, processedResource.metadata?.name ?? "<unnamed>", {
+      ...(moduleCtx?.source ? { module: moduleCtx.source } : {}),
+      ...(originPointer === undefined ? {} : { pointer: originPointer }),
+    });
     (ctx as ResourceContextImpl).bindResourceIdentity(handle, resolvedKind, processedResource);
 
     // Bind the resolved invocation contract to the instance, here at the kernel's
@@ -1491,8 +1506,43 @@ export class Kernel implements IKernel {
     const resolveDef: DefResolver = (kind, from) =>
       this.registry.resolveDefinitionIn(kind, from?.metadata?.module);
 
-    const input = resolveBoundContract("inputType", resource, definition, resolveDef, factory);
-    const output = resolveBoundContract("outputType", resource, definition, resolveDef, factory);
+    // A DECLARATION-derived slot is resolved against the context that OWNS this
+    // resource, so a bare name means the same thing here as it does to `!ref`
+    // and to CEL — scope-local first, enclosing module as the fallback — and an
+    // alias routes into that import's exported instances.
+    const projections: ProjectionScope = {
+      resolveDefinition: (kind) =>
+        this.controllers.getDefinition(kind) as unknown as Record<string, any> | undefined,
+      // The slot holds the LIVE INSTANCE by now — Phase-5 injection runs before
+      // create — so the declaration is recovered by instance identity. The ref
+      // shape is still accepted, because a ref slot on a `with:`-scoped resource
+      // is not an injection site and reaches the controller unresolved.
+      resolveManifest: (value) => {
+        const injected = declarationOfInstance(value);
+        if (injected) return { manifest: injected as unknown as Record<string, any> };
+        const ref = readProjectionRef(value);
+        if (!ref) return undefined;
+        const found = impl.resolveDeclaredManifest(ref.name, ref.alias);
+        return found ? { manifest: found as unknown as Record<string, any> } : undefined;
+      },
+    };
+
+    const input = resolveBoundContract(
+      "inputType",
+      resource,
+      definition,
+      resolveDef,
+      factory,
+      projections,
+    );
+    const output = resolveBoundContract(
+      "outputType",
+      resource,
+      definition,
+      resolveDef,
+      factory,
+      projections,
+    );
     if (!input && !output) return;
 
     bindContract(instance, {
@@ -1576,3 +1626,28 @@ export class Kernel implements IKernel {
     );
   }
 }
+
+/**
+ * The JSON pointer to an inline declaration, from the origin the loader stamped.
+ *
+ * `xTeloOrigin.pathFromParent` is a dotted path with `[N]` indices — the loader's
+ * own spelling, which addresses the manifest tree and nothing else. A pointer is
+ * what crosses a boundary, so the conversion happens here rather than being left
+ * to each recipient to reinvent: segments are identifiers and indices, so the
+ * rewrite is mechanical and total.
+ */
+function originPointerOf(resource: ResourceManifest): string | undefined {
+  const origin = resource.metadata?.xTeloOrigin as
+    | { parentName?: unknown; pathFromParent?: unknown }
+    | undefined;
+  if (typeof origin?.parentName !== "string" || typeof origin.pathFromParent !== "string") {
+    return undefined;
+  }
+  const pointer = origin.pathFromParent
+    .replace(/\[(\d+)\]/g, ".$1")
+    .split(".")
+    .filter((segment) => segment.length > 0)
+    .map((segment) => segment.replace(/~/g, "~0").replace(/\//g, "~1"))
+    .join("/");
+  return `${origin.parentName}#/${pointer}`;
+}

package/src/manifest-schemas.ts

@@ -22,6 +22,7 @@ export {
   manifestFragmentRef,
   ResourceRefSchema,
   RetryPolicySchema,
+  StepSchema,
   withSchemaFragments,
 } from "@telorun/analyzer";
 

package/src/module-context.ts

@@ -15,6 +15,7 @@ import type {
   InvokeStepContext,
   ModuleContext as IModuleContext,
   ResourceInstance,
+  ResourceManifest,
 } from "@telorun/sdk";
 import type { EmitEvent, InstanceFactory } from "@telorun/sdk";
 import { EvaluationContext } from "./evaluation-context.js";
@@ -106,7 +107,11 @@ export class ModuleContext extends EvaluationContext implements IModuleContext {
       names: Set<string>;
       terminal: (
         name: string,
-      ) => (() => { kind: string; instance: ResourceInstance } | undefined) | undefined;
+      ) =>
+        | (() =>
+            | { kind: string; instance: ResourceInstance; manifest?: ResourceManifest }
+            | undefined)
+        | undefined;
     }
   >();
 
@@ -292,7 +297,11 @@ export class ModuleContext extends EvaluationContext implements IModuleContext {
     names: string[],
     terminal: (
       name: string,
-    ) => (() => { kind: string; instance: ResourceInstance } | undefined) | undefined,
+    ) =>
+      | (() =>
+          | { kind: string; instance: ResourceInstance; manifest?: ResourceManifest }
+          | undefined)
+      | undefined,
   ): void {
     this.importedScopes.set(alias, { names: new Set(names), terminal });
   }
@@ -369,7 +378,11 @@ export class ModuleContext extends EvaluationContext implements IModuleContext {
         const kind = rawKind.startsWith("Self.")
           ? `${moduleName}.${rawKind.slice("Self.".length)}`
           : rawKind;
-        return { kind, instance: inst.instance };
+        // The manifest rides along because a DECLARATION-derived contract
+        // (`x-telo-schema-projection-from`) reads the target's own declaration,
+        // and a re-export forwards this getter verbatim — so carrying it here
+        // makes it reachable at any depth with no second table.
+        return { kind, instance: inst.instance, manifest: inst.resource };
       });
     }
     for (const k of kindEntries) {
@@ -407,6 +420,14 @@ export class ModuleContext extends EvaluationContext implements IModuleContext {
     return scope.terminal(name)?.()?.instance;
   }
 
+  /** The manifest half of `resolveImportedInstance` — what a name was DECLARED
+   *  with, for a contract typed from a referenced declaration. */
+  override resolveImportedManifest(alias: string, name: string): ResourceManifest | undefined {
+    const scope = this.importedScopes.get(alias);
+    if (!scope || !scope.names.has(name)) return undefined;
+    return scope.terminal(name)?.()?.manifest;
+  }
+
   /** Like `resolveImportedInstance`, but returns the `{kind, name}` ref (canonical kind)
    *  for controllers that resolve step/handler invokes to refs rather than live instances
    *  (e.g. Run.Sequence via `ensureKindRef`). The alias is reattached by the caller. */

package/src/resource-context.ts

@@ -26,6 +26,7 @@ import {
   type ResourceHandle,
   type RuntimeSeam,
   type TypeRule,
+  type OpenZoneAttributes,
   type ZoneEntry,
 } from "@telorun/sdk";
 import { registerTeloKeywords } from "@telorun/analyzer";
@@ -426,6 +427,10 @@ export class ResourceContextImpl implements ResourceContext {
     return this.zoneContext().zonesFor(instance, ctx);
   }
 
+  zoneAttributes(ctx?: InvokeContext): readonly OpenZoneAttributes[] {
+    return this.zoneContext().zoneAttributes(ctx);
+  }
+
   /** The root context for runtime-driven inbound work — inherits nothing from
    *  whatever ambient happens to be live at the registration site. */
   rootContext(opts?: { cancellation?: CancellationSource }): InvokeContext {
@@ -514,6 +519,19 @@ export class ResourceContextImpl implements ResourceContext {
     return this.moduleContext.resolveImportedInstance(alias, name);
   }
 
+  /**
+   * The manifest a name was DECLARED with, resolved in the context that OWNS
+   * this resource — scope-local first, enclosing module as the fallback, an
+   * alias routing into that import's exports. The same order `resolveRef` and
+   * the CEL `resources` layering use, so a declaration lookup cannot disagree
+   * with them about what a name means.
+   *
+   * Used to resolve a DECLARATION-derived contract slot at bind time.
+   */
+  resolveDeclaredManifest(name: string, alias?: string): ResourceManifest | undefined {
+    return this.owningContext.resolveDeclaredManifest?.(name, alias);
+  }
+
   resolveRef<T>(
     value: unknown,
     guard: (candidate: unknown) => candidate is T,

package/src/transports/oci/oci-client.ts

@@ -71,6 +71,13 @@ export interface OciManifest {
   annotations?: Record<string, string>;
 }
 
+/** A blob's OCI digest, as `pushBlob` addresses it. Exported because the
+ *  `layers:` index has to name a layer's digest BEFORE it is pushed — a second
+ *  spelling of this would be a second answer to what a blob is called. */
+export function blobDigest(bytes: Uint8Array): string {
+  return `sha256:${sha256Hex(bytes)}`;
+}
+
 function sha256Hex(bytes: Uint8Array): string {
   return createHash("sha256").update(bytes).digest("hex");
 }
@@ -270,7 +277,7 @@ export class OciClient {
    *  `sha256:<hex>` digest. Two-step upload: obtain a session, then PUT with
    *  the digest. */
   async pushBlob(bytes: Uint8Array): Promise<string> {
-    const digest = `sha256:${sha256Hex(bytes)}`;
+    const digest = blobDigest(bytes);
 
     const head = await this.authedFetch(
       `${this.base()}/blobs/${digest}`,

package/src/transports/oci/oci-transport.ts

@@ -5,25 +5,25 @@ import {
   sha256Base64Url,
   verifyIntegrity,
   type ArtifactLayer,
+  type ArtifactSelector,
   type ManifestCacheCoords,
   type ManifestSource,
 } from "@telorun/analyzer";
-import { createHash } from "node:crypto";
-
 import {
   computeFilesIntegrity,
-  injectLayerIndex,
   type PayloadFile,
 } from "../../bundle/files-integrity.js";
 import { readOwnerManifest, type OwnerManifest } from "../../bundle/module-manifest.js";
 import { makeTarGz, readTarGz, toPayloadFiles } from "../../bundle/tar.js";
 import type {
+  PayloadLayer,
   PublishBundle,
   PublishOptions,
   PublishResult,
   Transport,
 } from "../transport.js";
 import {
+  blobDigest,
   OciClient,
   OCI_MANIFEST_MEDIA_TYPE,
   TELO_LAYER_ROLE_ANNOTATION,
@@ -42,6 +42,21 @@ import {
   withRefVersion,
 } from "./oci-ref.js";
 
+/** A layer's identity within one artifact: role plus, for a controller layer,
+ *  its selector. Role alone is not it — there is one controller layer per
+ *  selector. Same shape the release ledger keys on. */
+function layerKey(role: string, selector?: ArtifactSelector): string {
+  return selector ? `${role}/${selectorKey(selector)}` : role;
+}
+
+/** The `layers:` index the bundle's own manifest declares, keyed for lookup.
+ *  Read back out of the text rather than passed alongside it, because the text
+ *  is what ships — anything else would be a second copy to keep in agreement. */
+function declaredLayerIndex(bundle: PublishBundle): Map<string, ArtifactLayer> {
+  const declared = readOwnerManifest(bundle.manifest).layers ?? [];
+  return new Map(declared.map((layer) => [layerKey(layer.role, layer.selector), layer]));
+}
+
 /**
  * Pull only the **manifest layer** and return its verified `telo.yaml` text.
  *
@@ -211,17 +226,17 @@ export class OciTransport implements Transport {
    *  republish that reorders layers is simply invisible here rather than a
    *  failure. Content verification is the artifact handle's, which holds the
    *  expected `integrity`. */
-  async fetchLayer(ref: string, blobDigest: string): Promise<PayloadFile[]> {
+  async fetchLayer(ref: string, digest: string): Promise<PayloadFile[]> {
     const { host, repo } = parseOciRef(ref);
-    const tar = await this.readClient(host, repo).pullBlob(blobDigest);
+    const tar = await this.readClient(host, repo).pullBlob(digest);
     // Verify the transfer against the digest that addressed it. A registry is
     // not trusted to return the blob that was asked for, and this is the only
     // place the pushed bytes exist — the content digest checked after extraction
     // covers the file set, not the archive that carried it.
-    const actual = `sha256:${createHash("sha256").update(tar).digest("hex")}`;
-    if (actual !== blobDigest) {
+    const actual = blobDigest(tar);
+    if (actual !== digest) {
       throw new IntegrityError(
-        `Blob digest mismatch fetching a layer of ${ref}: requested ${blobDigest}, ` +
+        `Blob digest mismatch fetching a layer of ${ref}: requested ${digest}, ` +
           `received ${actual}. The registry returned different bytes than were addressed.`,
       );
     }
@@ -258,6 +273,27 @@ export class OciTransport implements Transport {
     return Object.fromEntries(mapped.filter((e): e is [string, string] => Boolean(e[1])));
   }
 
+  /** The index as it will be published: `blob` over the gzipped tar this
+   *  transport pushes, `integrity` over the layer's file contents. Both are
+   *  computed from the files alone, which is what lets the payload builder
+   *  write the index into `telo.yaml` before a single byte is pushed. */
+  async layerIndex(layers: readonly PayloadLayer[]): Promise<ArtifactLayer[]> {
+    const index: ArtifactLayer[] = [];
+    for (const layer of layers) {
+      if (layer.files.length === 0) continue;
+      const tar = await makeTarGz(
+        layer.files.map((f) => ({ name: f.name, content: Buffer.from(f.content) })),
+      );
+      index.push({
+        role: layer.role,
+        ...(layer.selector ? { selector: layer.selector } : {}),
+        blob: blobDigest(tar),
+        integrity: await computeFilesIntegrity(layer.files),
+      });
+    }
+    return index;
+  }
+
   async publish(
     destination: string,
     bundle: PublishBundle,
@@ -285,17 +321,42 @@ export class OciTransport implements Transport {
     const tag = identity.version;
     const client = new OciClient(host, repo);
 
-    // Push every payload layer first, collecting the digests that address them.
-    // This ordering is what keeps the index non-circular: the manifest layer is
-    // pushed last and names only the layers pushed before it, never itself.
+    // Push every payload layer first. This ordering is what keeps the index
+    // non-circular: the manifest layer is pushed last and names only the layers
+    // pushed before it, never itself.
+    //
+    // The index is NOT written here — `bundle.manifest` already carries it, and
+    // rewriting the manifest at this point is precisely the bug this replaced:
+    // the bytes a dependent hashed to derive its pin would then never be the
+    // bytes pushed. So each pushed blob is CHECKED against what the manifest
+    // already claims, which is also the standing test that framing stayed
+    // deterministic — a claim nobody can satisfy is a hard failure, not a
+    // silently corrected index.
+    const declared = declaredLayerIndex(bundle);
     const payloadDescriptors: OciDescriptor[] = [];
-    const index: ArtifactLayer[] = [];
     for (const layer of bundle.layers) {
       if (layer.files.length === 0) continue;
+      const key = layerKey(layer.role, layer.selector);
       const tar = await makeTarGz(
         layer.files.map((f) => ({ name: f.name, content: Buffer.from(f.content) })),
       );
       const blob = await client.pushBlob(tar);
+      const claim = declared.get(key);
+      if (!claim) {
+        throw new Error(
+          `layer '${key}' is being pushed but the manifest's 'layers:' index does not name it. ` +
+            `The index is written by the payload builder before publish, so a layer missing ` +
+            `from it would be unaddressable by any importer.`,
+        );
+      }
+      if (claim.blob !== blob) {
+        throw new Error(
+          `layer '${key}' framed to ${blob}, but the manifest's 'layers:' index claims ` +
+            `${claim.blob}. The published telo.yaml is hashed into every dependent's import ` +
+            `pin, so it cannot be corrected here — the archive framing must be a pure ` +
+            `function of the layer's files.`,
+        );
+      }
       payloadDescriptors.push({
         mediaType: TELO_PAYLOAD_LAYER_MEDIA_TYPE,
         digest: blob,
@@ -307,18 +368,11 @@ export class OciTransport implements Transport {
             : {}),
         },
       });
-      index.push({
-        role: layer.role,
-        ...(layer.selector ? { selector: layer.selector } : {}),
-        blob,
-        integrity: await computeFilesIntegrity(layer.files),
-      });
     }
 
-    // Inject the index, then push telo.yaml as its own layer so a manifest read
-    // never has to pull a payload.
-    const manifestText =
-      index.length > 0 ? injectLayerIndex(bundle.manifest, index) : bundle.manifest;
+    // Push telo.yaml as its own layer so a manifest read never has to pull a
+    // payload. Verbatim — these are the bytes importers pin.
+    const manifestText = bundle.manifest;
     const manifestTar = await makeTarGz([
       { name: DEFAULT_MANIFEST_FILENAME, content: manifestText },
     ]);

package/src/transports/registry-transport.ts

@@ -8,6 +8,7 @@ import {
   sha256Base64Url,
   withRefVersion,
   splitIntegrity,
+  type ArtifactLayer,
   type ManifestCacheCoords,
   type ManifestSource,
 } from "@telorun/analyzer";
@@ -17,6 +18,7 @@ import { createHash } from "crypto";
 import type { PayloadFile } from "../bundle/files-integrity.js";
 import { assertPublicEgress } from "./egress-guard.js";
 import type {
+  PayloadLayer,
   PublishBundle,
   PublishOptions,
   PublishResult,
@@ -279,6 +281,18 @@ export class RegistryTransport implements Transport {
     );
   }
 
+  async layerIndex(layers: readonly PayloadLayer[]): Promise<ArtifactLayer[]> {
+    // Same boundary `fetchLayer` and `publish` draw: the HTTP registry serves
+    // manifests only, so it frames no layer and can name no blob. An empty set
+    // is not a payload, so it answers rather than throws — a manifest-only
+    // module builds its payload through this transport during analysis.
+    if (layers.every((layer) => layer.files.length === 0)) return [];
+    throw new Error(
+      "The Telo registry serves manifests only, so it cannot index payload layers. " +
+        "A module with a bundled payload is published as an OCI artifact (oci://host/repo).",
+    );
+  }
+
   async publish(
     destination: string,
     bundle: PublishBundle,

package/src/transports/transport.ts

@@ -1,4 +1,5 @@
 import type {
+  ArtifactLayer,
   ArtifactSelector,
   LayerRole,
   ManifestCacheCoords,
@@ -19,10 +20,10 @@ export interface PayloadLayer {
 
 /** The module bundle handed to a transport for publishing: the final,
  *  already-analyzed / pinned / canonicalized `telo.yaml` bytes plus the payload
- *  partitioned into layers (empty for a manifest-only module). The transport
- *  pushes each layer as its own blob, injects the resulting `layers:` index into
- *  the manifest, and only then pushes the manifest layer — the order that keeps
- *  the index non-circular. */
+ *  partitioned into layers (empty for a manifest-only module), whose `layers:`
+ *  index the manifest already carries. The transport pushes each layer as its
+ *  own blob, checks the digest against what the index claims, and only then
+ *  pushes the manifest layer — the order that keeps the index non-circular. */
 export interface PublishBundle {
   manifest: string;
   layers: PayloadLayer[];
@@ -151,9 +152,29 @@ export interface Transport {
    *  verifies. */
   manifestHash(ref: string): Promise<string>;
 
+  /** The `layers:` index `layers` will be published under: each entry's
+   *  `integrity` over the layer's file contents and its `blob` over the exact
+   *  bytes this transport will push.
+   *
+   *  On the interface, and called BEFORE anything is pushed, because the index
+   *  goes *inside* `telo.yaml` and a dependent's import pin is a hash of that
+   *  file. Injecting the index at push time — which is what this replaced —
+   *  meant the payload builder's manifest was never the published one, so every
+   *  sibling pin derived from it named bytes the registry does not have. The
+   *  builder therefore needs the index up front, and only the transport knows
+   *  the framing a `blob` digest covers.
+   *
+   *  Requires the framing to be a pure function of the files (see `makeTarGz`),
+   *  since `publish` re-frames the same layers and hard-fails if a digest moved.
+   *  Returns `[]` for an empty layer set; throws when this transport cannot
+   *  publish payload layers at all. */
+  layerIndex(layers: readonly PayloadLayer[]): Promise<ArtifactLayer[]>;
+
   /** Push `bundle` to `destination` (a base ref / repo whose scheme this
    *  transport owns), pinning the payload and writing the transport-native
-   *  artifact shape. Throws on failure. Used by `telo publish`. */
+   *  artifact shape. `bundle.manifest` already carries the `layers:` index this
+   *  transport returned from {@link layerIndex}; publish verifies rather than
+   *  rewrites it. Throws on failure. Used by `telo publish`. */
   publish(
     destination: string,
     bundle: PublishBundle,

package/src/zone-context.ts

@@ -28,9 +28,16 @@ import {
   type ResourceDefinition,
   type ResourceHandle,
   type ResourceInstance,
+  type OpenZoneAttributes,
+  type ZoneAttributes,
   type ZoneEntry,
 } from "@telorun/sdk";
-import { readProvidesZone, readRequiresZone, type RequiresZoneSlot } from "@telorun/analyzer";
+import {
+  effectiveAuthorSchema,
+  readProvidesZone,
+  readRequiresZone,
+  type RequiresZoneSlot,
+} from "@telorun/analyzer";
 import { isRefSentinel } from "@telorun/templating";
 import { ambientInvokeContext, runWithAmbientContext } from "./evaluation-context.js";
 import { handleOfInstance } from "./resource-handle.js";
@@ -77,6 +84,10 @@ export class ZoneContext {
   readonly #requirements = new Map<string, ResolvedRequirement>();
   /** Slot → resolved correlation handle for a providing slot. */
   readonly #providers = new Map<string, { key?: ResourceHandle }>();
+  /** Providing kind → what the zone it provides declares about its contents.
+   *  Keyed by kind rather than by slot because the question a caller asks is
+   *  about an OPEN zone, which is reached by its entry's kind. */
+  readonly #attributes = new Map<string, ZoneAttributes>();
 
   constructor(host: ZoneHost) {
     this.#host = host;
@@ -132,6 +143,64 @@ export class ZoneContext {
     return out;
   }
 
+  zoneAttributes(ctx?: InvokeContext): readonly OpenZoneAttributes[] {
+    const zones = (ctx ?? ambientInvokeContext())?.zones;
+    if (!zones || zones.length === 0) return [];
+    const out: OpenZoneAttributes[] = [];
+    // Innermost first, matching `match` and `zonesFor` — a nested zone's
+    // constraint is the one a controller meets first.
+    for (let i = zones.length - 1; i >= 0; i--) {
+      const entry = zones[i]!;
+      out.push({ kind: entry.kind, attributes: this.attributesOfKind(entry.kind), entry });
+    }
+    return out;
+  }
+
+  /**
+   * What the zone a kind provides declares, read off that kind's own schema.
+   *
+   * NOT off the entry: a `ZoneEntry` is three identities precisely so it stays
+   * ABI-serializable and no module can read another's private state off the
+   * stack, and an attributes field on it would trade that away for every zone.
+   * The kernel is the one place the declaring kind's schema is already
+   * reachable, so it resolves and hands the values over — branching on no name,
+   * exactly as `readRefSlot` returns `use` without acting on it.
+   *
+   * Memoized per kind: this sits behind every dispatch a durable step engine
+   * makes, and the answer is fixed once definitions are registered.
+   */
+  private attributesOfKind(kind: string): ZoneAttributes {
+    const cached = this.#attributes.get(kind);
+    if (cached) return cached;
+    const def = this.#host.resolveDefinition(kind);
+    // A kind that does not resolve is NOT cached: definitions are registered
+    // during init and this is called at dispatch, so an unresolved lookup is a
+    // transient state — caching the empty answer would make it permanent, and a
+    // zone would silently declare nothing for the life of the process.
+    if (!def) return {};
+    // Resolved along `extends`, so a child that inherits its parent's
+    // zone-providing slot reports the attributes that slot declares. Reading the
+    // own schema alone would have a child's zone silently constrain nothing.
+    const properties = (effectiveAuthorSchema(def, (k) => this.#host.resolveDefinition(k)) as
+      | { properties?: Record<string, unknown> }
+      | undefined)?.properties;
+    const merged: Record<string, string> = {};
+    for (const slotSchema of Object.values(properties ?? {})) {
+      // Every providing slot of one kind provides that same kind's zone — the
+      // annotation never names a zone — so their attributes describe one region
+      // and merge. First declaration wins, so the reading is stable rather than
+      // dependent on property order.
+      for (const [name, reason] of Object.entries(
+        readProvidesZone(slotSchema as Record<string, any>)?.attributes ?? {},
+      )) {
+        if (!(name in merged) && typeof reason === "string") merged[name] = reason;
+      }
+    }
+    const attributes = merged as ZoneAttributes;
+    this.#attributes.set(kind, attributes);
+    return attributes;
+  }
+
   // ── resolution ────────────────────────────────────────────────────────────
 
   private resolveProvider(slot: string): { key?: ResourceHandle } {