@telorun/analyzer 0.37.0 → 0.39.0

package/dist/analysis-registry.d.ts

@@ -96,6 +96,20 @@ export declare class AnalysisRegistry {
      */
     builtinDefinitions(): ResourceDefinition[];
     resolveDefinition(kind: string): ResourceDefinition | undefined;
+    /** A resolver scoped to `def`'s OWN module, for resolving that definition's
+     *  `extends` target.
+     *
+     *  `extends` aliases are lexically scoped to the declaring library — a library
+     *  writes `extends: Cache.Store` against its own import map, and `Self.Host`
+     *  against its own module name. The global alias table knows neither, so
+     *  {@link resolveDefinition} silently returns undefined for them and callers
+     *  fall back to an un-inherited view. Mirrors the module-scope selection in
+     *  `expandedFieldMapForResource`. */
+    resolverForDefinition(def: {
+        metadata?: {
+            module?: string;
+        };
+    }): (kind: string) => ResourceDefinition | undefined;
     /** Canonical kinds (`module.Name`) of every definition that extends the given
      *  abstract kind — the concrete implementations a caller may instantiate in
      *  its place. Empty when `kind` is not an abstract or has no implementations. */

package/dist/analysis-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analysis-registry.d.ts","sourceRoot":"","sources":["../src/analysis-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAAqC,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAEhG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGlD;;wDAEwD;AACxD,MAAM,WAAW,YAAY;IAC3B;0CACsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;;8EAG0E;IAC1E,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;GAIG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IAEpE,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI;IAIjD,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAIpE;;+EAE2E;IAC3E,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IAI9E,wFAAwF;IACxF,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAIzD,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI7C;;;;;;;OAOG;IACH,mBAAmB,CACjB,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,EAClC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GACnC,IAAI;IAkBP;;;;;;OAMG;IACH,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,YAAY,EAAE;IAoBhE;;;;;;wBAMoB;IACpB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAQtD;;;;;;sFAMkF;IAClF,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAenE;;;;;qDAKiD;IACjD,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAepE,OAAO,CAAC,mBAAmB;IAS3B;;;;;;OAMG;IACH,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,EACxB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAAE,GACzF,IAAI;IAQP;;;;OAIG;IACH,kBAAkB,IAAI,kBAAkB,EAAE;IAI1C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAM/D;;qFAEiF;IACjF,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE;IAUzC,QAAQ,IAAI,MAAM,EAAE;IAIpB;mEAC+D;IAC/D,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE;IAIxC;;;gCAG4B;IAC5B,oBAAoB,IAAI,MAAM,EAAE;IAIhC;wEACoE;IACpE,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIhD;;;;;;;;iDAQ6C;IAC7C,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS;IAqB9D;;;;;gEAK4D;IAC5D,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;IAiB7D,qFAAqF;IACrF,QAAQ,IAAI,eAAe;CAG5B"}
+{"version":3,"file":"analysis-registry.d.ts","sourceRoot":"","sources":["../src/analysis-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAAqC,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAEhG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGlD;;wDAEwD;AACxD,MAAM,WAAW,YAAY;IAC3B;0CACsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;;8EAG0E;IAC1E,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;GAIG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IAEpE,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI;IAIjD,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAIpE;;+EAE2E;IAC3E,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IAI9E,wFAAwF;IACxF,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAIzD,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI7C;;;;;;;OAOG;IACH,mBAAmB,CACjB,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,EAClC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GACnC,IAAI;IAkBP;;;;;;OAMG;IACH,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,YAAY,EAAE;IAoBhE;;;;;;wBAMoB;IACpB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAQtD;;;;;;sFAMkF;IAClF,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAenE;;;;;qDAKiD;IACjD,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAepE,OAAO,CAAC,mBAAmB;IAS3B;;;;;;OAMG;IACH,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,EACxB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAAE,GACzF,IAAI;IAQP;;;;OAIG;IACH,kBAAkB,IAAI,kBAAkB,EAAE;IAI1C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAM/D;;;;;;;;yCAQqC;IACrC,qBAAqB,CAAC,GAAG,EAAE;QACzB,QAAQ,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAChC,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,kBAAkB,GAAG,SAAS;IASpD;;qFAEiF;IACjF,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE;IAUzC,QAAQ,IAAI,MAAM,EAAE;IAIpB;mEAC+D;IAC/D,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE;IAIxC;;;gCAG4B;IAC5B,oBAAoB,IAAI,MAAM,EAAE;IAIhC;wEACoE;IACpE,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIhD;;;;;;;;iDAQ6C;IAC7C,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS;IAqB9D;;;;;gEAK4D;IAC5D,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;IAiB7D,qFAAqF;IACrF,QAAQ,IAAI,eAAe;CAG5B"}

package/dist/analysis-registry.js

@@ -178,6 +178,23 @@ export class AnalysisRegistry {
         const resolved = ctx.aliases?.resolveKind(kind);
         return ctx.definitions?.resolve(kind) ?? (resolved ? ctx.definitions?.resolve(resolved) : undefined);
     }
+    /** A resolver scoped to `def`'s OWN module, for resolving that definition's
+     *  `extends` target.
+     *
+     *  `extends` aliases are lexically scoped to the declaring library — a library
+     *  writes `extends: Cache.Store` against its own import map, and `Self.Host`
+     *  against its own module name. The global alias table knows neither, so
+     *  {@link resolveDefinition} silently returns undefined for them and callers
+     *  fall back to an un-inherited view. Mirrors the module-scope selection in
+     *  `expandedFieldMapForResource`. */
+    resolverForDefinition(def) {
+        const ownModule = def?.metadata?.module;
+        const scope = (ownModule ? this.aliasesByModule.get(ownModule) : undefined) ?? this.aliases;
+        return (kind) => {
+            const canonical = scope.resolveKind(kind);
+            return this.defs.resolve(kind) ?? (canonical ? this.defs.resolve(canonical) : undefined);
+        };
+    }
     /** Canonical kinds (`module.Name`) of every definition that extends the given
      *  abstract kind — the concrete implementations a caller may instantiate in
      *  its place. Empty when `kind` is not an abstract or has no implementations. */

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAoB9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAuxB/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAm1BvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAmBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAoB9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA8xB/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IA81BvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAmBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -20,6 +20,7 @@ import { DiagnosticSeverity } from "./types.js";
 import { extractCelRegionScopes, extractContextsFromSchema, getManifestItem, pathMatchesScope, resolveContextAnnotations, resolveTypeFieldToSchema, } from "./validate-cel-context.js";
 import { buildEvalPaths, evalPathsCover } from "./eval-paths.js";
 import { validateExtends } from "./validate-extends.js";
+import { validateLogging } from "./validate-logging.js";
 import { validateBaseMapping } from "./validate-base-mapping.js";
 import { validateNestedInlineResources } from "./validate-nested-inline.js";
 import { validateProviderCoherence } from "./validate-provider-coherence.js";
@@ -339,11 +340,16 @@ function buildStepContextSchema(manifest, defSchema, allManifests, defs, aliases
  * handler dispatched directly, e.g. `Lambda.Function`), so it can't be rejected
  * statically without false positives. This is the sound subset of the runtime rule.
  */
+/** The built-in namespace: globally resolvable, crossing no import boundary. */
+const TELO_BUILTIN_MODULE = "Telo";
 const NON_INVOKABLE_CAPABILITIES = new Set([
     "Telo.Provider",
     "Telo.Mount",
     "Telo.Type",
     "Telo.Template",
+    // A sink is written to through a direct contract on the controller instance,
+    // never dispatched — so invoking one is statically wrong.
+    "Telo.Sink",
 ]);
 /**
  * Validate `x-telo-step-context` step `invoke` references (e.g. `Run.Sequence`
@@ -698,6 +704,12 @@ export class StaticAnalyzer {
         // so state builds up across successive calls (e.g. incremental editor validation).
         const ctx = registry?._context();
         const aliases = ctx?.aliases ?? new AliasResolver();
+        // `Telo` crosses no import boundary — the kernel built-ins are globally
+        // resolvable, which is what lets `kind: Telo.ConsoleSink` and
+        // `extends: Telo.LogSink` work with no `imports:` entry (§10.2). The kernel
+        // registers the same ungated alias at boot; registering it here keeps the
+        // static and runtime halves agreeing.
+        aliases.registerUngatedAlias(TELO_BUILTIN_MODULE, TELO_BUILTIN_MODULE);
         const defs = ctx?.definitions ?? new DefinitionRegistry();
         // Register module identities and aliases.
         // The root module doc (Telo.Application or Telo.Library) provides its own
@@ -748,6 +760,7 @@ export class StaticAnalyzer {
                         let libResolver = aliasesByModule.get(moduleName);
                         if (!libResolver) {
                             libResolver = new AliasResolver();
+                            libResolver.registerUngatedAlias(TELO_BUILTIN_MODULE, TELO_BUILTIN_MODULE);
                             aliasesByModule.set(moduleName, libResolver);
                         }
                         libResolver.registerUngatedAlias("Self", moduleName);
@@ -834,6 +847,7 @@ export class StaticAnalyzer {
             let libResolver = aliasesByModule.get(ownModule);
             if (!libResolver) {
                 libResolver = new AliasResolver();
+                libResolver.registerUngatedAlias(TELO_BUILTIN_MODULE, TELO_BUILTIN_MODULE);
                 aliasesByModule.set(ownModule, libResolver);
             }
             if (!libResolver.hasAlias("Self")) {
@@ -903,6 +917,9 @@ export class StaticAnalyzer {
         }
         if (!options?.skipValidation) {
             diagnostics.push(...validateSchemaTypeRefs(allManifests, defs, aliases, aliasesByModule, rootModules));
+            // §14.1 / §10.3: redaction paths and `on_full: block` are statically
+            // detectable, so they fail `telo check` rather than only at boot.
+            diagnostics.push(...validateLogging(allManifests, defs, aliases, aliasesByModule));
         }
         resolveSchemaTypeRefs(allManifests, aliases, aliasesByModule);
         // Trusted-input fast path: when the caller has already attested that

package/dist/builtins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EAujB/C,CAAC"}
+{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AA2GvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EA8nB/C,CAAC"}

package/dist/builtins.js

@@ -1,3 +1,101 @@
+/** Descriptive provenance a module declares about itself, shared by
+ *  `Telo.Application` and `Telo.Library`.
+ *
+ *  These are *descriptive*, never *addressing* — nothing resolves, fetches,
+ *  caches, or publishes based on them, so they do not conflict with
+ *  identity-is-the-ref (which bans metadata from determining an artifact's
+ *  location). `repository` is the location of the module's **source code**, in
+ *  the same spirit as npm's `repository` / `license` / `homepage`. It is named
+ *  `repository` rather than `source` because `source:` already means "where to
+ *  fetch a dependency from" in the `imports` map.
+ *
+ *  A publish transport projects these into whatever its backend surfaces —
+ *  OCI maps them onto the standard `org.opencontainers.image.*` annotations;
+ *  the HTTP registry stores the manifest verbatim, so they are preserved as
+ *  declared with nothing to translate. */
+const PROVENANCE_METADATA = {
+    description: { type: "string" },
+    repository: { type: "string" },
+    license: { type: "string" },
+    documentation: { type: "string" },
+};
+/** The six named levels of `kernel/specs/logging.md` §5.1. The full 1–24 OTel
+ *  range stays valid on the wire; only these are nameable in a manifest. */
+const LOG_LEVEL_ENUM = ["trace", "debug", "info", "warn", "error", "fatal"];
+const DURATION_PATTERN = "^\\s*\\d+(\\.\\d+)?\\s*(ms|s|m|h)\\s*$";
+/** Fields every sink kind inherits from `Telo.LogSink` (§12.1). A concrete sink
+ *  kind may narrow a default but must not remove a field — a buffering policy
+ *  that cannot be configured from the only permitted configuration source is
+ *  not a policy. */
+const LOG_SINK_COMMON_PROPERTIES = {
+    level: { type: "string", enum: LOG_LEVEL_ENUM },
+    buffer: { type: "integer", minimum: 1 },
+    on_full: { type: "string", enum: ["block", "drop_new", "drop_old"] },
+    flush_interval: { type: "string", pattern: DURATION_PATTERN },
+};
+/** Threshold / redaction / sampling — the fields an `imports:` entry may
+ *  override for its subtree (§12.2). Deliberately excludes `sinks`: sinks are
+ *  process-level I/O and belong to the root Application that owns the process,
+ *  so an imported library can never open a log file on its importer's behalf. */
+const LOGGING_SCOPE_PROPERTIES = {
+    level: { type: "string", enum: LOG_LEVEL_ENUM },
+    attributes: { type: "object" },
+    redact: {
+        type: "object",
+        properties: {
+            paths: { type: "array", items: { type: "string" } },
+            censor: { type: "string" },
+            // Deletion destroys schema stability and hides that a field was present
+            // at all, so §14 offers this but never as the default.
+            remove: { type: "boolean" },
+        },
+        additionalProperties: false,
+    },
+    sampling: {
+        type: "object",
+        properties: {
+            first: { type: "integer", minimum: 0 },
+            thereafter: { type: "integer", minimum: 0 },
+            tick: { type: "string", pattern: DURATION_PATTERN },
+            sampleErrors: { type: "boolean" },
+        },
+        additionalProperties: false,
+    },
+};
+/** The per-import `logging:` override. */
+const IMPORT_LOGGING_SCHEMA = {
+    type: "object",
+    "x-telo-eval": "compile",
+    properties: LOGGING_SCOPE_PROPERTIES,
+    additionalProperties: false,
+};
+/** The root Application's `logging:` block — the scope fields plus `sinks`.
+ *
+ *  `x-telo-eval: compile` covers the whole block: every value resolves once at
+ *  load, which is what lets a level come from the host environment through a
+ *  `variables:` entry read with `!cel` rather than through a parallel
+ *  `TELO_LOG_*` path that would be invisible to the analyzer and the editor
+ *  (§12.3, D6). */
+const ROOT_LOGGING_SCHEMA = {
+    type: "object",
+    "x-telo-eval": "compile",
+    properties: {
+        ...LOGGING_SCOPE_PROPERTIES,
+        // A list rather than a keyed map because sinks are root-only and therefore
+        // never merged; with no merge to disambiguate, a list matches how Telo
+        // spells every other ref-or-inline collection. `x-telo-inline` opts this one
+        // slot into inline-resource extraction — see normalize-inline-resources.ts.
+        sinks: {
+            type: "array",
+            items: {
+                type: "object",
+                "x-telo-ref": "telo#LogSink",
+                "x-telo-inline": true,
+            },
+        },
+    },
+    additionalProperties: false,
+};
 export const KERNEL_BUILTINS = [
     { kind: "Telo.Abstract", metadata: { name: "Template", module: "Telo" } },
     { kind: "Telo.Abstract", metadata: { name: "Runnable", module: "Telo" } },
@@ -10,6 +108,59 @@ export const KERNEL_BUILTINS = [
         metadata: { name: "Provider", module: "Telo" },
         schema: { "x-telo-eval": "compile" },
     },
+    // The sink lifecycle role: attach, write a record, flush, detach. Deliberately
+    // payload-opaque — it carries no filtering and no encoding — so a future
+    // `Telo.TraceSink` reuses the same capability with a different record type.
+    // Scoped to record-stream sinks; metrics aggregate rather than stream and are
+    // not covered. See kernel/specs/logging.md §10.
+    { kind: "Telo.Abstract", metadata: { name: "Sink", module: "Telo" } },
+    // The abstract every *log* sink kind extends, carrying the log-specific
+    // configuration. A kernel built-in resolvable without an import, so a sink
+    // author depends on the kernel contract rather than on a standard-library
+    // module version and kernel↔module skew never becomes a compatibility surface
+    // for "where do logs go".
+    {
+        kind: "Telo.Abstract",
+        metadata: { name: "LogSink", module: "Telo" },
+        capability: "Telo.Sink",
+        schema: {
+            type: "object",
+            properties: LOG_SINK_COMMON_PROPERTIES,
+            additionalProperties: true,
+        },
+    },
+    {
+        kind: "Telo.Definition",
+        metadata: { name: "ConsoleSink", module: "Telo" },
+        capability: "Telo.Sink",
+        extends: "Telo.LogSink",
+        schema: {
+            type: "object",
+            properties: {
+                ...LOG_SINK_COMMON_PROPERTIES,
+                destination: { type: "string", enum: ["stderr", "stdout"] },
+                encoding: { type: "string", enum: ["auto", "pretty", "json"] },
+                color: { type: "string", enum: ["auto", "always", "never"] },
+            },
+            additionalProperties: false,
+        },
+    },
+    {
+        kind: "Telo.Definition",
+        metadata: { name: "FileSink", module: "Telo" },
+        capability: "Telo.Sink",
+        extends: "Telo.LogSink",
+        schema: {
+            type: "object",
+            properties: {
+                ...LOG_SINK_COMMON_PROPERTIES,
+                destination: { type: "string" },
+                encoding: { type: "string", enum: ["json", "pretty"] },
+            },
+            required: ["destination"],
+            additionalProperties: false,
+        },
+    },
     {
         kind: "Telo.Definition",
         metadata: { name: "Abstract", module: "Telo" },
@@ -249,6 +400,7 @@ export const KERNEL_BUILTINS = [
                         { type: "array", items: { type: "string" } },
                     ],
                 },
+                logging: IMPORT_LOGGING_SCHEMA,
             },
             required: ["metadata", "source"],
             additionalProperties: false,
@@ -269,6 +421,7 @@ export const KERNEL_BUILTINS = [
                         version: { type: "string" },
                         source: { type: "string" },
                         module: { type: "string" },
+                        ...PROVENANCE_METADATA,
                     },
                     required: ["name"],
                     additionalProperties: true,
@@ -406,6 +559,11 @@ export const KERNEL_BUILTINS = [
                                             { type: "array", items: { type: "string" } },
                                         ],
                                     },
+                                    // Threshold / redaction / sampling override for this import's
+                                    // subtree. Attached to the import rather than to a map keyed
+                                    // by module name because an alias is already uniqueness-
+                                    // enforced, while module names collide (§12.2, D9).
+                                    logging: IMPORT_LOGGING_SCHEMA,
                                 },
                                 additionalProperties: false,
                             },
@@ -475,6 +633,11 @@ export const KERNEL_BUILTINS = [
                         additionalProperties: false,
                     },
                 },
+                // Structured logging configuration. The manifest is the only
+                // configuration source — there is no TELO_LOG_* variable and no logging
+                // CLI flag — so a level derived from the host environment goes through a
+                // `variables:` entry read with `!cel`. See kernel/specs/logging.md §12.
+                logging: ROOT_LOGGING_SCHEMA,
             },
             required: ["metadata"],
             additionalProperties: false,
@@ -495,6 +658,7 @@ export const KERNEL_BUILTINS = [
                         version: { type: "string" },
                         source: { type: "string" },
                         module: { type: "string" },
+                        ...PROVENANCE_METADATA,
                     },
                     required: ["name"],
                     additionalProperties: true,
@@ -539,6 +703,11 @@ export const KERNEL_BUILTINS = [
                                             { type: "array", items: { type: "string" } },
                                         ],
                                     },
+                                    // Threshold / redaction / sampling override for this import's
+                                    // subtree. Attached to the import rather than to a map keyed
+                                    // by module name because an alias is already uniqueness-
+                                    // enforced, while module names collide (§12.2, D9).
+                                    logging: IMPORT_LOGGING_SCHEMA,
                                 },
                                 additionalProperties: false,
                             },

package/dist/index.d.ts

@@ -6,6 +6,8 @@ export { flattenForAnalyzer, flattenLoadedModule, forwardReExportManifests, pars
 export { buildEvalPaths, evalPathCovers } from "./eval-paths.js";
 export { ancestorChain, controllerBearingAncestor, effectiveAuthorSchema, hasOwnControllerOrTemplate, inheritedCapability, isInheritedDelegation, resolveParent, } from "./extends-resolution.js";
 export type { DefResolver } from "./extends-resolution.js";
+export { hasIntermediateWildcard, parseRedactionPath, RedactionPathError, } from "./redaction-path.js";
+export type { RedactionSegment } from "./redaction-path.js";
 export { buildReferenceFieldMap, isRefEntry, isScopeEntry } from "./reference-field-map.js";
 export type { ReferenceFieldMap, RefFieldEntry } from "./reference-field-map.js";
 export { visitManifest } from "./manifest-visitor.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,qBAAqB,EACrB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC5F,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,aAAa,EACb,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,qBAAqB,EACrB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC5F,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,aAAa,EACb,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -3,6 +3,7 @@ export { StaticAnalyzer } from "./analyzer.js";
 export { flattenForAnalyzer, flattenLoadedModule, forwardReExportManifests, parseExportEntry, reExportSpecsFromExports, resolveExportedKinds, selectModuleManifestsForAnalysis, stampExportedKinds, stampReExportedKinds, } from "./flatten-for-analyzer.js";
 export { buildEvalPaths, evalPathCovers } from "./eval-paths.js";
 export { ancestorChain, controllerBearingAncestor, effectiveAuthorSchema, hasOwnControllerOrTemplate, inheritedCapability, isInheritedDelegation, resolveParent, } from "./extends-resolution.js";
+export { hasIntermediateWildcard, parseRedactionPath, RedactionPathError, } from "./redaction-path.js";
 export { buildReferenceFieldMap, isRefEntry, isScopeEntry } from "./reference-field-map.js";
 export { visitManifest } from "./manifest-visitor.js";
 export { Loader } from "./manifest-loader.js";

package/dist/inline-imports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inline-imports.d.ts","sourceRoot":"","sources":["../src/inline-imports.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG/D;;6CAE6C;AAC7C,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,EAAE,gBAAgB,CAAC;CAC5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CACnC,cAAc,EAAE,gBAAgB,EAChC,cAAc,EAAE,gBAAgB,GAAG,SAAS,GAC3C,eAAe,EAAE,CA+BnB;AAED;;;;;;;iFAOiF;AACjF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAmB9D"}
+{"version":3,"file":"inline-imports.d.ts","sourceRoot":"","sources":["../src/inline-imports.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG/D;;6CAE6C;AAC7C,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,EAAE,gBAAgB,CAAC;CAC5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CACnC,cAAc,EAAE,gBAAgB,EAChC,cAAc,EAAE,gBAAgB,GAAG,SAAS,GAC3C,eAAe,EAAE,CAgCnB;AAED;;;;;;;iFAOiF;AACjF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAmB9D"}

package/dist/inline-imports.js

@@ -38,6 +38,7 @@ export function inlineImportManifests(moduleManifest, modulePosition) {
             ...(entry.variables !== undefined ? { variables: entry.variables } : {}),
             ...(entry.secrets !== undefined ? { secrets: entry.secrets } : {}),
             ...(entry.runtime !== undefined ? { runtime: entry.runtime } : {}),
+            ...(entry.logging !== undefined ? { logging: entry.logging } : {}),
         };
         out.push({ manifest, position: synthPosition(modulePosition, alias, scalar) });
     }

package/dist/normalize-inline-resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"normalize-inline-resources.d.ts","sourceRoot":"","sources":["../src/normalize-inline-resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AA8BzD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE,aAAa,EACvB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC3C,gBAAgB,EAAE,CAsEpB"}
+{"version":3,"file":"normalize-inline-resources.d.ts","sourceRoot":"","sources":["../src/normalize-inline-resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AA6CzD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE,aAAa,EACvB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC3C,gBAAgB,EAAE,CA0EpB"}

package/dist/normalize-inline-resources.js

@@ -5,6 +5,20 @@ const SYSTEM_KINDS = new Set([
     "Telo.Library",
     "Telo.Import",
 ]);
+/**
+ * System kinds are excluded from inline extraction by default, but a single slot
+ * may opt back in with `x-telo-inline: true` — `Telo.Application.logging.sinks`
+ * is the case this exists for.
+ *
+ * The opt-in is per slot rather than per kind because this pass runs *upstream*
+ * of schema validation on both the analyzer and runtime paths. Admitting the
+ * whole Application document would rewrite an inline `{kind, ...}` in `targets`
+ * into a valid `{kind, name}` before AJV ever saw it, silently converting a
+ * deliberate rejection into a working feature.
+ */
+function acceptsInline(resourceKind, entry) {
+    return !SYSTEM_KINDS.has(resourceKind) || entry.inline === true;
+}
 /** Replaces characters outside [a-zA-Z0-9_] with underscores. */
 function sanitizeName(raw) {
     return raw.replace(/[^a-zA-Z0-9_]/g, "_");
@@ -55,7 +69,10 @@ export function normalizeInlineResources(resources, registry, aliases, aliasesBy
     const result = resources.map(cloneForMutation);
     // Queue: all non-system resources with a name. Extracted resources are appended.
     // Filter the CLONES (not the originals) so traversal mutates copies.
-    const queue = result.filter((r) => typeof r.metadata?.name === "string" && !!r.kind && !SYSTEM_KINDS.has(r.kind));
+    // System kinds join the queue too: their inline-accepting slots are filtered
+    // per entry below, so a system document is walked but only its opted-in slots
+    // are extracted from.
+    const queue = result.filter((r) => typeof r.metadata?.name === "string" && !!r.kind);
     let i = 0;
     while (i < queue.length) {
         const resource = queue[i++];
@@ -82,6 +99,8 @@ export function normalizeInlineResources(resources, registry, aliases, aliasesBy
         for (const [fieldPath, entry] of fieldMap) {
             if (!isRefEntry(entry))
                 continue;
+            if (!acceptsInline(resource.kind, entry))
+                continue;
             const inScope = scopePrefixes.some((prefix) => fieldPath === prefix ||
                 fieldPath.startsWith(prefix + ".") ||
                 fieldPath.startsWith(prefix + "["));

package/dist/redaction-path.d.ts

@@ -0,0 +1,49 @@
+/**
+ * The redaction path grammar of `kernel/specs/logging.md` §14 — a hand-written
+ * parser over a closed grammar.
+ *
+ * §14.1 makes this a security requirement rather than a style preference. The
+ * implementation this syntax is borrowed from compiles paths through the
+ * `Function` constructor and validates them by "evaluate it and see whether it
+ * parses", which is exactly why that implementation must forbid user input. A
+ * real parser removes the injection surface entirely and, as a bonus, makes
+ * paths statically checkable by `telo check`.
+ *
+ * Browser-safe by construction: this module is imported by both the analyzer's
+ * static check and the kernel's runtime redaction pass, so the grammar has one
+ * definition rather than two that can drift.
+ *
+ * Grammar:
+ *
+ *     path     := segment ( "." segment | bracket )*
+ *     segment  := bareKey | "*"
+ *     bracket  := "[" ( quoted | integer | "*" ) "]"
+ *     quoted   := '"' ... '"' | "'" ... "'"
+ *
+ * More than one wildcard per path is supported — `items[*].tokens[*].value` is
+ * valid. The one-wildcard limit in the best-known implementation is an artifact
+ * of how it compiles accessors, not a property of the grammar.
+ */
+export type RedactionSegment = {
+    kind: "key";
+    name: string;
+} | {
+    kind: "wildcard";
+};
+export declare class RedactionPathError extends Error {
+    readonly code = "INVALID_REDACTION_PATH";
+    readonly path: string;
+    readonly offset: number;
+    constructor(path: string, offset: number, detail: string);
+}
+/**
+ * Parse a redaction path into its segments. Throws {@link RedactionPathError}
+ * with the offending offset so `telo check` can point at the character rather
+ * than the whole path.
+ */
+export declare function parseRedactionPath(path: string): RedactionSegment[];
+/** `true` when the path contains a wildcard anywhere but its last segment.
+ *  §14.2 measures intermediate wildcards at 25–55% over plain serialization,
+ *  against 1–2% for explicit paths, so a runtime may warn when one is used. */
+export declare function hasIntermediateWildcard(segments: readonly RedactionSegment[]): boolean;
+//# sourceMappingURL=redaction-path.d.ts.map

package/dist/redaction-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction-path.d.ts","sourceRoot":"","sources":["../src/redaction-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,MAAM,MAAM,gBAAgB,GAAG;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC;AAEpF,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,4BAA4B;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAMzD;AAID;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAyCnE;AA2CD;;+EAE+E;AAC/E,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,GAAG,OAAO,CAKtF"}

package/dist/redaction-path.js

@@ -0,0 +1,133 @@
+/**
+ * The redaction path grammar of `kernel/specs/logging.md` §14 — a hand-written
+ * parser over a closed grammar.
+ *
+ * §14.1 makes this a security requirement rather than a style preference. The
+ * implementation this syntax is borrowed from compiles paths through the
+ * `Function` constructor and validates them by "evaluate it and see whether it
+ * parses", which is exactly why that implementation must forbid user input. A
+ * real parser removes the injection surface entirely and, as a bonus, makes
+ * paths statically checkable by `telo check`.
+ *
+ * Browser-safe by construction: this module is imported by both the analyzer's
+ * static check and the kernel's runtime redaction pass, so the grammar has one
+ * definition rather than two that can drift.
+ *
+ * Grammar:
+ *
+ *     path     := segment ( "." segment | bracket )*
+ *     segment  := bareKey | "*"
+ *     bracket  := "[" ( quoted | integer | "*" ) "]"
+ *     quoted   := '"' ... '"' | "'" ... "'"
+ *
+ * More than one wildcard per path is supported — `items[*].tokens[*].value` is
+ * valid. The one-wildcard limit in the best-known implementation is an artifact
+ * of how it compiles accessors, not a property of the grammar.
+ */
+export class RedactionPathError extends Error {
+    code = "INVALID_REDACTION_PATH";
+    path;
+    offset;
+    constructor(path, offset, detail) {
+        super(`Invalid redaction path "${path}" at position ${offset}: ${detail}`);
+        this.name = "RedactionPathError";
+        this.path = path;
+        this.offset = offset;
+    }
+}
+const BARE_KEY_TERMINATORS = new Set([".", "[", "]"]);
+/**
+ * Parse a redaction path into its segments. Throws {@link RedactionPathError}
+ * with the offending offset so `telo check` can point at the character rather
+ * than the whole path.
+ */
+export function parseRedactionPath(path) {
+    if (path.length === 0)
+        throw new RedactionPathError(path, 0, "path is empty");
+    const segments = [];
+    let index = 0;
+    let expectSegment = true;
+    while (index < path.length) {
+        const char = path[index];
+        if (char === "[") {
+            index = parseBracket(path, index, segments);
+            expectSegment = false;
+            continue;
+        }
+        if (char === ".") {
+            if (expectSegment) {
+                throw new RedactionPathError(path, index, "expected a key before '.'");
+            }
+            index += 1;
+            expectSegment = true;
+            continue;
+        }
+        if (char === "]") {
+            throw new RedactionPathError(path, index, "unmatched ']'");
+        }
+        const start = index;
+        while (index < path.length && !BARE_KEY_TERMINATORS.has(path[index]))
+            index += 1;
+        const raw = path.slice(start, index);
+        if (raw.length === 0)
+            throw new RedactionPathError(path, start, "empty key");
+        segments.push(raw === "*" ? { kind: "wildcard" } : { kind: "key", name: raw });
+        expectSegment = false;
+    }
+    if (expectSegment) {
+        throw new RedactionPathError(path, path.length, "path ends with a trailing '.'");
+    }
+    return segments;
+}
+function parseBracket(path, open, segments) {
+    let index = open + 1;
+    if (index >= path.length)
+        throw new RedactionPathError(path, open, "unterminated '['");
+    const quote = path[index];
+    if (quote === '"' || quote === "'") {
+        index += 1;
+        const start = index;
+        while (index < path.length && path[index] !== quote)
+            index += 1;
+        if (index >= path.length) {
+            throw new RedactionPathError(path, start, `unterminated ${quote} quoted key`);
+        }
+        const name = path.slice(start, index);
+        if (name.length === 0)
+            throw new RedactionPathError(path, start, "empty quoted key");
+        index += 1;
+        if (path[index] !== "]") {
+            throw new RedactionPathError(path, index, "expected ']' after quoted key");
+        }
+        segments.push({ kind: "key", name });
+        return index + 1;
+    }
+    const start = index;
+    while (index < path.length && path[index] !== "]")
+        index += 1;
+    if (index >= path.length)
+        throw new RedactionPathError(path, open, "unterminated '['");
+    const raw = path.slice(start, index);
+    if (raw.length === 0)
+        throw new RedactionPathError(path, start, "empty '[]'");
+    if (raw === "*") {
+        segments.push({ kind: "wildcard" });
+    }
+    else if (/^\d+$/.test(raw)) {
+        segments.push({ kind: "key", name: raw });
+    }
+    else {
+        throw new RedactionPathError(path, start, `expected a quoted key, an integer index, or '*', got "${raw}" — quote it as ["${raw}"]`);
+    }
+    return index + 1;
+}
+/** `true` when the path contains a wildcard anywhere but its last segment.
+ *  §14.2 measures intermediate wildcards at 25–55% over plain serialization,
+ *  against 1–2% for explicit paths, so a runtime may warn when one is used. */
+export function hasIntermediateWildcard(segments) {
+    for (let i = 0; i < segments.length - 1; i += 1) {
+        if (segments[i].kind === "wildcard")
+            return true;
+    }
+    return false;
+}