@telorun/analyzer 0.38.0 → 0.39.0

package/dist/validate-extends.d.ts

@@ -2,25 +2,5 @@ import type { ResourceManifest } from "@telorun/sdk";
 import type { AliasResolver } from "./alias-resolver.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
 import { type AnalysisDiagnostic } from "./types.js";
-/**
- * Phase 3b — Validate `extends` fields on Telo.Definition docs, and flag the legacy
- * `capability: <UserAbstract>` overload with CAPABILITY_SHADOWS_EXTENDS so users migrate.
- *
- * `extends` uses alias form ("<Alias>.<Name>") resolved against the declaring file's
- * Telo.Import declarations — same pattern as `kind:` prefixes. The analyzer pre-resolves
- * via AliasResolver before register() is called, so by the time this validator runs,
- * the definition's effective `extends` is either the canonical form (when the alias was
- * known) or the original alias-prefixed string (when it wasn't).
- *
- * Diagnostics:
- *  - EXTENDS_MALFORMED: value not in "<Alias>.<Name>" alias form, or not resolvable
- *    via the declaring file's imports (alias unknown → can't distinguish from a typo).
- *  - EXTENDS_UNKNOWN_TARGET: alias resolves to a module, but that module has no
- *    registered definition with the target name.
- *  - EXTENDS_NON_ABSTRACT: target resolves to a Telo.Definition, not a Telo.Abstract.
- *  - CAPABILITY_SHADOWS_EXTENDS (warning): `capability` names a user-declared abstract
- *    (metadata.module !== "Telo"). Builtin lifecycle capabilities (Telo.Invocable, etc.)
- *    never trigger this — they're lifecycle roles by design.
- */
 export declare function validateExtends(manifests: ResourceManifest[], registry: DefinitionRegistry, aliases: AliasResolver): AnalysisDiagnostic[];
 //# sourceMappingURL=validate-extends.d.ts.map

package/dist/validate-extends.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-extends.d.ts","sourceRoot":"","sources":["../src/validate-extends.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAOzE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,GACrB,kBAAkB,EAAE,CAwJtB"}
+{"version":3,"file":"validate-extends.d.ts","sourceRoot":"","sources":["../src/validate-extends.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AA8BzE,wBAAgB,eAAe,CAC7B,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,GACrB,kBAAkB,EAAE,CA4JtB"}

package/dist/validate-extends.js

@@ -23,6 +23,8 @@ const EXTENDS_ALIAS_RE = /^[A-Z][A-Za-z0-9_]*\.[A-Z][A-Za-z0-9_]*$/;
  *    (metadata.module !== "Telo"). Builtin lifecycle capabilities (Telo.Invocable, etc.)
  *    never trigger this — they're lifecycle roles by design.
  */
+/** The built-in namespace, resolvable without a `Telo.Import`. */
+const TELO_BUILTIN_ALIAS = "Telo";
 export function validateExtends(manifests, registry, aliases) {
     const diagnostics = [];
     // Defs forwarded from imported libraries carry `metadata.module` set to that
@@ -81,7 +83,11 @@ export function validateExtends(manifests, registry, aliases) {
             }
             else {
                 const prefix = extendsValue.slice(0, extendsValue.indexOf("."));
-                if (!aliases.hasAlias(prefix)) {
+                // `Telo` needs no import: the kernel built-ins are globally resolvable
+                // by design, which is what lets a sink author depend on the kernel
+                // contract (`extends: Telo.LogSink`) rather than on a standard-library
+                // module version — see kernel/specs/logging.md §10.2.
+                if (prefix !== TELO_BUILTIN_ALIAS && !aliases.hasAlias(prefix)) {
                     diagnostics.push({
                         severity: DiagnosticSeverity.Error,
                         code: "EXTENDS_MALFORMED",

package/dist/validate-logging.d.ts

@@ -0,0 +1,22 @@
+import type { ResourceManifest } from "@telorun/sdk";
+import type { AliasResolver } from "./alias-resolver.js";
+import type { DefinitionRegistry } from "./definition-registry.js";
+import { type AnalysisDiagnostic } from "./types.js";
+/**
+ * Static validation of the `logging:` block — `kernel/specs/logging.md` §14.1
+ * and §10.3.
+ *
+ * Two things the spec explicitly says are statically detectable, so leaving them
+ * to a runtime failure would contradict Telo's "manifests must remain statically
+ * analyzable" goal:
+ *
+ * 1. **Redaction paths** parse against the closed §14 grammar. §14.1's whole
+ *    argument for a hand-written parser is that it makes paths checkable by
+ *    `telo check`; a bad path must fail here, not silently fail to redact at
+ *    runtime.
+ * 2. **`on_full: block`** is unimplementable on a single-threaded runtime and
+ *    §10.3 calls it "statically detectable by `telo check`". Catching it here —
+ *    rather than only at boot — is what lets an operator fix it before shipping.
+ */
+export declare function validateLogging(manifests: ResourceManifest[], registry: DefinitionRegistry, aliases: AliasResolver, aliasesByModule?: Map<string, AliasResolver>): AnalysisDiagnostic[];
+//# sourceMappingURL=validate-logging.d.ts.map

package/dist/validate-logging.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-logging.d.ts","sourceRoot":"","sources":["../src/validate-logging.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,EACtB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC3C,kBAAkB,EAAE,CAqBtB"}

package/dist/validate-logging.js

@@ -0,0 +1,116 @@
+import { parseRedactionPath, RedactionPathError } from "./redaction-path.js";
+import { DiagnosticSeverity } from "./types.js";
+const SOURCE = "telo-analyzer";
+/**
+ * Static validation of the `logging:` block — `kernel/specs/logging.md` §14.1
+ * and §10.3.
+ *
+ * Two things the spec explicitly says are statically detectable, so leaving them
+ * to a runtime failure would contradict Telo's "manifests must remain statically
+ * analyzable" goal:
+ *
+ * 1. **Redaction paths** parse against the closed §14 grammar. §14.1's whole
+ *    argument for a hand-written parser is that it makes paths checkable by
+ *    `telo check`; a bad path must fail here, not silently fail to redact at
+ *    runtime.
+ * 2. **`on_full: block`** is unimplementable on a single-threaded runtime and
+ *    §10.3 calls it "statically detectable by `telo check`". Catching it here —
+ *    rather than only at boot — is what lets an operator fix it before shipping.
+ */
+export function validateLogging(manifests, registry, aliases, aliasesByModule) {
+    const diagnostics = [];
+    for (const manifest of manifests) {
+        const kind = manifest.kind;
+        // Redaction paths live on the `logging:` block of the root Application and on
+        // any `Telo.Import` / `Telo.Library` doc carrying a per-import override.
+        if (kind === "Telo.Application" || kind === "Telo.Import" || kind === "Telo.Library") {
+            validateRedactPaths(manifest, diagnostics);
+        }
+        // `on_full` lives on any sink instance — an inline `logging.sinks[]` entry
+        // (extracted by Phase 2 into a first-class manifest by now) or a standalone
+        // sink resource declared elsewhere and reached via `!ref`.
+        if (isSinkKind(manifest, registry, aliases, aliasesByModule)) {
+            validateOnFull(manifest, diagnostics);
+        }
+    }
+    return diagnostics;
+}
+function validateRedactPaths(manifest, out) {
+    const name = manifest.metadata?.name;
+    const filePath = manifest.metadata?.source;
+    const resource = { kind: manifest.kind, name };
+    for (const { block, prefix } of loggingBlocks(manifest)) {
+        const paths = block.redact?.paths;
+        if (!Array.isArray(paths))
+            continue;
+        paths.forEach((path, index) => {
+            // A `!cel` path is a compiled/sentinel node by now, not a string — its
+            // value isn't known statically, so there is nothing to parse.
+            if (typeof path !== "string")
+                return;
+            try {
+                parseRedactionPath(path);
+            }
+            catch (err) {
+                if (!(err instanceof RedactionPathError))
+                    throw err;
+                out.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: "INVALID_REDACTION_PATH",
+                    source: SOURCE,
+                    message: `${manifest.kind}/${name ?? "(unnamed)"}: ${err.message}`,
+                    data: { resource, filePath, path: `${prefix}redact.paths[${index}]` },
+                });
+            }
+        });
+    }
+}
+function validateOnFull(manifest, out) {
+    const onFull = manifest.on_full;
+    if (onFull !== "block")
+        return;
+    const name = manifest.metadata?.name;
+    const filePath = manifest.metadata?.source;
+    out.push({
+        severity: DiagnosticSeverity.Error,
+        code: "LOG_SINK_ON_FULL_UNSUPPORTED",
+        source: SOURCE,
+        message: `${manifest.kind}/${name ?? "(unnamed)"}: on_full: block is not supported on a ` +
+            `single-threaded runtime — blocking the producer would stall the writer. ` +
+            `Use drop_new or drop_old.`,
+        data: { resource: { kind: manifest.kind, name }, filePath, path: "on_full" },
+    });
+}
+/** The root `logging:` block plus every per-import `logging:` override, each
+ *  with the dotted path prefix a diagnostic anchors against. */
+function loggingBlocks(manifest) {
+    const blocks = [];
+    const root = manifest.logging;
+    if (isObject(root))
+        blocks.push({ block: root, prefix: "logging." });
+    // Inline imports map: `imports.<Alias>.logging`.
+    const imports = manifest.imports;
+    if (isObject(imports)) {
+        for (const [alias, entry] of Object.entries(imports)) {
+            if (!isObject(entry))
+                continue;
+            const block = entry.logging;
+            if (isObject(block))
+                blocks.push({ block, prefix: `imports.${alias}.logging.` });
+        }
+    }
+    return blocks;
+}
+function isSinkKind(manifest, registry, aliases, aliasesByModule) {
+    if (typeof manifest.kind !== "string")
+        return false;
+    if (manifest.kind === "Telo.ConsoleSink" || manifest.kind === "Telo.FileSink")
+        return true;
+    const ownModule = manifest.metadata?.module;
+    const resolver = (ownModule ? aliasesByModule?.get(ownModule) : undefined) ?? aliases;
+    const canonical = resolver.resolveKind(manifest.kind) ?? manifest.kind;
+    return registry.resolve(canonical)?.capability === "Telo.Sink";
+}
+function isObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.38.0",
+  "version": "0.39.0",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",
@@ -48,7 +48,7 @@
     "@types/node": "^20.0.0",
     "typescript": "^5.0.0",
     "vitest": "^2.1.8",
-    "@telorun/sdk": "0.48.0"
+    "@telorun/sdk": "0.50.0"
   },
   "peerDependencies": {
     "@telorun/sdk": "*"

package/src/analyzer.ts

@@ -40,6 +40,7 @@ import {
 } from "./validate-cel-context.js";
 import { buildEvalPaths, evalPathsCover } from "./eval-paths.js";
 import { validateExtends } from "./validate-extends.js";
+import { validateLogging } from "./validate-logging.js";
 import { validateBaseMapping } from "./validate-base-mapping.js";
 import { validateNestedInlineResources } from "./validate-nested-inline.js";
 import { validateProviderCoherence } from "./validate-provider-coherence.js";
@@ -432,11 +433,17 @@ function buildStepContextSchema(
  * handler dispatched directly, e.g. `Lambda.Function`), so it can't be rejected
  * statically without false positives. This is the sound subset of the runtime rule.
  */
+/** The built-in namespace: globally resolvable, crossing no import boundary. */
+const TELO_BUILTIN_MODULE = "Telo";
+
 const NON_INVOKABLE_CAPABILITIES = new Set([
   "Telo.Provider",
   "Telo.Mount",
   "Telo.Type",
   "Telo.Template",
+  // A sink is written to through a direct contract on the controller instance,
+  // never dispatched — so invoking one is statically wrong.
+  "Telo.Sink",
 ]);
 
 /**
@@ -859,6 +866,12 @@ export class StaticAnalyzer {
     // so state builds up across successive calls (e.g. incremental editor validation).
     const ctx = registry?._context();
     const aliases = ctx?.aliases ?? new AliasResolver();
+    // `Telo` crosses no import boundary — the kernel built-ins are globally
+    // resolvable, which is what lets `kind: Telo.ConsoleSink` and
+    // `extends: Telo.LogSink` work with no `imports:` entry (§10.2). The kernel
+    // registers the same ungated alias at boot; registering it here keeps the
+    // static and runtime halves agreeing.
+    aliases.registerUngatedAlias(TELO_BUILTIN_MODULE, TELO_BUILTIN_MODULE);
     const defs = ctx?.definitions ?? new DefinitionRegistry();
 
     // Register module identities and aliases.
@@ -908,6 +921,7 @@ export class StaticAnalyzer {
             let libResolver = aliasesByModule.get(moduleName);
             if (!libResolver) {
               libResolver = new AliasResolver();
+              libResolver.registerUngatedAlias(TELO_BUILTIN_MODULE, TELO_BUILTIN_MODULE);
               aliasesByModule.set(moduleName, libResolver);
             }
             libResolver.registerUngatedAlias("Self", moduleName);
@@ -1002,6 +1016,7 @@ export class StaticAnalyzer {
       let libResolver = aliasesByModule.get(ownModule);
       if (!libResolver) {
         libResolver = new AliasResolver();
+        libResolver.registerUngatedAlias(TELO_BUILTIN_MODULE, TELO_BUILTIN_MODULE);
         aliasesByModule.set(ownModule, libResolver);
       }
       if (!libResolver.hasAlias("Self")) {
@@ -1082,6 +1097,9 @@ export class StaticAnalyzer {
       diagnostics.push(
         ...validateSchemaTypeRefs(allManifests, defs, aliases, aliasesByModule, rootModules),
       );
+      // §14.1 / §10.3: redaction paths and `on_full: block` are statically
+      // detectable, so they fail `telo check` rather than only at boot.
+      diagnostics.push(...validateLogging(allManifests, defs, aliases, aliasesByModule));
     }
     resolveSchemaTypeRefs(allManifests, aliases, aliasesByModule);
 

package/src/builtins.ts

@@ -22,6 +22,89 @@ const PROVENANCE_METADATA = {
   documentation: { type: "string" },
 };
 
+/** The six named levels of `kernel/specs/logging.md` §5.1. The full 1–24 OTel
+ *  range stays valid on the wire; only these are nameable in a manifest. */
+const LOG_LEVEL_ENUM = ["trace", "debug", "info", "warn", "error", "fatal"];
+
+const DURATION_PATTERN = "^\\s*\\d+(\\.\\d+)?\\s*(ms|s|m|h)\\s*$";
+
+/** Fields every sink kind inherits from `Telo.LogSink` (§12.1). A concrete sink
+ *  kind may narrow a default but must not remove a field — a buffering policy
+ *  that cannot be configured from the only permitted configuration source is
+ *  not a policy. */
+const LOG_SINK_COMMON_PROPERTIES = {
+  level: { type: "string", enum: LOG_LEVEL_ENUM },
+  buffer: { type: "integer", minimum: 1 },
+  on_full: { type: "string", enum: ["block", "drop_new", "drop_old"] },
+  flush_interval: { type: "string", pattern: DURATION_PATTERN },
+};
+
+/** Threshold / redaction / sampling — the fields an `imports:` entry may
+ *  override for its subtree (§12.2). Deliberately excludes `sinks`: sinks are
+ *  process-level I/O and belong to the root Application that owns the process,
+ *  so an imported library can never open a log file on its importer's behalf. */
+const LOGGING_SCOPE_PROPERTIES = {
+  level: { type: "string", enum: LOG_LEVEL_ENUM },
+  attributes: { type: "object" },
+  redact: {
+    type: "object",
+    properties: {
+      paths: { type: "array", items: { type: "string" } },
+      censor: { type: "string" },
+      // Deletion destroys schema stability and hides that a field was present
+      // at all, so §14 offers this but never as the default.
+      remove: { type: "boolean" },
+    },
+    additionalProperties: false,
+  },
+  sampling: {
+    type: "object",
+    properties: {
+      first: { type: "integer", minimum: 0 },
+      thereafter: { type: "integer", minimum: 0 },
+      tick: { type: "string", pattern: DURATION_PATTERN },
+      sampleErrors: { type: "boolean" },
+    },
+    additionalProperties: false,
+  },
+};
+
+/** The per-import `logging:` override. */
+const IMPORT_LOGGING_SCHEMA = {
+  type: "object",
+  "x-telo-eval": "compile",
+  properties: LOGGING_SCOPE_PROPERTIES,
+  additionalProperties: false,
+};
+
+/** The root Application's `logging:` block — the scope fields plus `sinks`.
+ *
+ *  `x-telo-eval: compile` covers the whole block: every value resolves once at
+ *  load, which is what lets a level come from the host environment through a
+ *  `variables:` entry read with `!cel` rather than through a parallel
+ *  `TELO_LOG_*` path that would be invisible to the analyzer and the editor
+ *  (§12.3, D6). */
+const ROOT_LOGGING_SCHEMA = {
+  type: "object",
+  "x-telo-eval": "compile",
+  properties: {
+    ...LOGGING_SCOPE_PROPERTIES,
+    // A list rather than a keyed map because sinks are root-only and therefore
+    // never merged; with no merge to disambiguate, a list matches how Telo
+    // spells every other ref-or-inline collection. `x-telo-inline` opts this one
+    // slot into inline-resource extraction — see normalize-inline-resources.ts.
+    sinks: {
+      type: "array",
+      items: {
+        type: "object",
+        "x-telo-ref": "telo#LogSink",
+        "x-telo-inline": true,
+      },
+    },
+  },
+  additionalProperties: false,
+};
+
 export const KERNEL_BUILTINS: ResourceDefinition[] = [
   { kind: "Telo.Abstract", metadata: { name: "Template", module: "Telo" } },
   { kind: "Telo.Abstract", metadata: { name: "Runnable", module: "Telo" } },
@@ -34,6 +117,59 @@ export const KERNEL_BUILTINS: ResourceDefinition[] = [
     metadata: { name: "Provider", module: "Telo" },
     schema: { "x-telo-eval": "compile" },
   },
+  // The sink lifecycle role: attach, write a record, flush, detach. Deliberately
+  // payload-opaque — it carries no filtering and no encoding — so a future
+  // `Telo.TraceSink` reuses the same capability with a different record type.
+  // Scoped to record-stream sinks; metrics aggregate rather than stream and are
+  // not covered. See kernel/specs/logging.md §10.
+  { kind: "Telo.Abstract", metadata: { name: "Sink", module: "Telo" } },
+  // The abstract every *log* sink kind extends, carrying the log-specific
+  // configuration. A kernel built-in resolvable without an import, so a sink
+  // author depends on the kernel contract rather than on a standard-library
+  // module version and kernel↔module skew never becomes a compatibility surface
+  // for "where do logs go".
+  {
+    kind: "Telo.Abstract",
+    metadata: { name: "LogSink", module: "Telo" },
+    capability: "Telo.Sink",
+    schema: {
+      type: "object",
+      properties: LOG_SINK_COMMON_PROPERTIES,
+      additionalProperties: true,
+    },
+  },
+  {
+    kind: "Telo.Definition",
+    metadata: { name: "ConsoleSink", module: "Telo" },
+    capability: "Telo.Sink",
+    extends: "Telo.LogSink",
+    schema: {
+      type: "object",
+      properties: {
+        ...LOG_SINK_COMMON_PROPERTIES,
+        destination: { type: "string", enum: ["stderr", "stdout"] },
+        encoding: { type: "string", enum: ["auto", "pretty", "json"] },
+        color: { type: "string", enum: ["auto", "always", "never"] },
+      },
+      additionalProperties: false,
+    },
+  },
+  {
+    kind: "Telo.Definition",
+    metadata: { name: "FileSink", module: "Telo" },
+    capability: "Telo.Sink",
+    extends: "Telo.LogSink",
+    schema: {
+      type: "object",
+      properties: {
+        ...LOG_SINK_COMMON_PROPERTIES,
+        destination: { type: "string" },
+        encoding: { type: "string", enum: ["json", "pretty"] },
+      },
+      required: ["destination"],
+      additionalProperties: false,
+    },
+  },
   {
     kind: "Telo.Definition",
     metadata: { name: "Abstract", module: "Telo" },
@@ -273,6 +409,7 @@ export const KERNEL_BUILTINS: ResourceDefinition[] = [
             { type: "array", items: { type: "string" } },
           ],
         },
+        logging: IMPORT_LOGGING_SCHEMA,
       },
       required: ["metadata", "source"],
       additionalProperties: false,
@@ -431,6 +568,11 @@ export const KERNEL_BUILTINS: ResourceDefinition[] = [
                       { type: "array", items: { type: "string" } },
                     ],
                   },
+                  // Threshold / redaction / sampling override for this import's
+                  // subtree. Attached to the import rather than to a map keyed
+                  // by module name because an alias is already uniqueness-
+                  // enforced, while module names collide (§12.2, D9).
+                  logging: IMPORT_LOGGING_SCHEMA,
                 },
                 additionalProperties: false,
               },
@@ -500,6 +642,11 @@ export const KERNEL_BUILTINS: ResourceDefinition[] = [
             additionalProperties: false,
           },
         },
+        // Structured logging configuration. The manifest is the only
+        // configuration source — there is no TELO_LOG_* variable and no logging
+        // CLI flag — so a level derived from the host environment goes through a
+        // `variables:` entry read with `!cel`. See kernel/specs/logging.md §12.
+        logging: ROOT_LOGGING_SCHEMA,
       },
       required: ["metadata"],
       additionalProperties: false,
@@ -565,6 +712,11 @@ export const KERNEL_BUILTINS: ResourceDefinition[] = [
                       { type: "array", items: { type: "string" } },
                     ],
                   },
+                  // Threshold / redaction / sampling override for this import's
+                  // subtree. Attached to the import rather than to a map keyed
+                  // by module name because an alias is already uniqueness-
+                  // enforced, while module names collide (§12.2, D9).
+                  logging: IMPORT_LOGGING_SCHEMA,
                 },
                 additionalProperties: false,
               },

package/src/index.ts

@@ -33,6 +33,12 @@ export {
   resolveParent,
 } from "./extends-resolution.js";
 export type { DefResolver } from "./extends-resolution.js";
+export {
+  hasIntermediateWildcard,
+  parseRedactionPath,
+  RedactionPathError,
+} from "./redaction-path.js";
+export type { RedactionSegment } from "./redaction-path.js";
 export { buildReferenceFieldMap, isRefEntry, isScopeEntry } from "./reference-field-map.js";
 export type { ReferenceFieldMap, RefFieldEntry } from "./reference-field-map.js";
 export { visitManifest } from "./manifest-visitor.js";

package/src/inline-imports.ts

@@ -55,6 +55,7 @@ export function inlineImportManifests(
       ...(entry.variables !== undefined ? { variables: entry.variables } : {}),
       ...(entry.secrets !== undefined ? { secrets: entry.secrets } : {}),
       ...(entry.runtime !== undefined ? { runtime: entry.runtime } : {}),
+      ...(entry.logging !== undefined ? { logging: entry.logging } : {}),
     } as unknown as ResourceManifest;
 
     out.push({ manifest, position: synthPosition(modulePosition, alias, scalar) });

package/src/normalize-inline-resources.ts

@@ -10,6 +10,21 @@ const SYSTEM_KINDS = new Set([
   "Telo.Import",
 ]);
 
+/**
+ * System kinds are excluded from inline extraction by default, but a single slot
+ * may opt back in with `x-telo-inline: true` — `Telo.Application.logging.sinks`
+ * is the case this exists for.
+ *
+ * The opt-in is per slot rather than per kind because this pass runs *upstream*
+ * of schema validation on both the analyzer and runtime paths. Admitting the
+ * whole Application document would rewrite an inline `{kind, ...}` in `targets`
+ * into a valid `{kind, name}` before AJV ever saw it, silently converting a
+ * deliberate rejection into a working feature.
+ */
+function acceptsInline(resourceKind: string, entry: { inline?: boolean }): boolean {
+  return !SYSTEM_KINDS.has(resourceKind) || entry.inline === true;
+}
+
 /** Replaces characters outside [a-zA-Z0-9_] with underscores. */
 function sanitizeName(raw: string): string {
   return raw.replace(/[^a-zA-Z0-9_]/g, "_");
@@ -65,9 +80,12 @@ export function normalizeInlineResources(
 
   // Queue: all non-system resources with a name. Extracted resources are appended.
   // Filter the CLONES (not the originals) so traversal mutates copies.
+  // System kinds join the queue too: their inline-accepting slots are filtered
+  // per entry below, so a system document is walked but only its opted-in slots
+  // are extracted from.
   const queue = result.filter(
     (r): r is ResourceManifest & { metadata: { name: string } } =>
-      typeof r.metadata?.name === "string" && !!r.kind && !SYSTEM_KINDS.has(r.kind),
+      typeof r.metadata?.name === "string" && !!r.kind,
   );
 
   let i = 0;
@@ -97,6 +115,7 @@ export function normalizeInlineResources(
 
     for (const [fieldPath, entry] of fieldMap) {
       if (!isRefEntry(entry)) continue;
+      if (!acceptsInline(resource.kind, entry)) continue;
 
       const inScope = scopePrefixes.some(
         (prefix) =>