@telorun/analyzer 0.38.0 → 0.40.0

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAoB9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAuxB/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAm1BvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAmBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAoB9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA8xB/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IA81BvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAmBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -20,6 +20,7 @@ import { DiagnosticSeverity } from "./types.js";
 import { extractCelRegionScopes, extractContextsFromSchema, getManifestItem, pathMatchesScope, resolveContextAnnotations, resolveTypeFieldToSchema, } from "./validate-cel-context.js";
 import { buildEvalPaths, evalPathsCover } from "./eval-paths.js";
 import { validateExtends } from "./validate-extends.js";
+import { validateLogging } from "./validate-logging.js";
 import { validateBaseMapping } from "./validate-base-mapping.js";
 import { validateNestedInlineResources } from "./validate-nested-inline.js";
 import { validateProviderCoherence } from "./validate-provider-coherence.js";
@@ -339,11 +340,16 @@ function buildStepContextSchema(manifest, defSchema, allManifests, defs, aliases
  * handler dispatched directly, e.g. `Lambda.Function`), so it can't be rejected
  * statically without false positives. This is the sound subset of the runtime rule.
  */
+/** The built-in namespace: globally resolvable, crossing no import boundary. */
+const TELO_BUILTIN_MODULE = "Telo";
 const NON_INVOKABLE_CAPABILITIES = new Set([
     "Telo.Provider",
     "Telo.Mount",
     "Telo.Type",
     "Telo.Template",
+    // A sink is written to through a direct contract on the controller instance,
+    // never dispatched — so invoking one is statically wrong.
+    "Telo.Sink",
 ]);
 /**
  * Validate `x-telo-step-context` step `invoke` references (e.g. `Run.Sequence`
@@ -698,6 +704,12 @@ export class StaticAnalyzer {
         // so state builds up across successive calls (e.g. incremental editor validation).
         const ctx = registry?._context();
         const aliases = ctx?.aliases ?? new AliasResolver();
+        // `Telo` crosses no import boundary — the kernel built-ins are globally
+        // resolvable, which is what lets `kind: Telo.ConsoleSink` and
+        // `extends: Telo.LogSink` work with no `imports:` entry (§10.2). The kernel
+        // registers the same ungated alias at boot; registering it here keeps the
+        // static and runtime halves agreeing.
+        aliases.registerUngatedAlias(TELO_BUILTIN_MODULE, TELO_BUILTIN_MODULE);
         const defs = ctx?.definitions ?? new DefinitionRegistry();
         // Register module identities and aliases.
         // The root module doc (Telo.Application or Telo.Library) provides its own
@@ -748,6 +760,7 @@ export class StaticAnalyzer {
                         let libResolver = aliasesByModule.get(moduleName);
                         if (!libResolver) {
                             libResolver = new AliasResolver();
+                            libResolver.registerUngatedAlias(TELO_BUILTIN_MODULE, TELO_BUILTIN_MODULE);
                             aliasesByModule.set(moduleName, libResolver);
                         }
                         libResolver.registerUngatedAlias("Self", moduleName);
@@ -834,6 +847,7 @@ export class StaticAnalyzer {
             let libResolver = aliasesByModule.get(ownModule);
             if (!libResolver) {
                 libResolver = new AliasResolver();
+                libResolver.registerUngatedAlias(TELO_BUILTIN_MODULE, TELO_BUILTIN_MODULE);
                 aliasesByModule.set(ownModule, libResolver);
             }
             if (!libResolver.hasAlias("Self")) {
@@ -903,6 +917,9 @@ export class StaticAnalyzer {
         }
         if (!options?.skipValidation) {
             diagnostics.push(...validateSchemaTypeRefs(allManifests, defs, aliases, aliasesByModule, rootModules));
+            // §14.1 / §10.3: redaction paths and `on_full: block` are statically
+            // detectable, so they fail `telo check` rather than only at boot.
+            diagnostics.push(...validateLogging(allManifests, defs, aliases, aliasesByModule));
         }
         resolveSchemaTypeRefs(allManifests, aliases, aliasesByModule);
         // Trusted-input fast path: when the caller has already attested that

package/dist/builtins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAwBvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EAyjB/C,CAAC"}
+{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AA2GvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EA8nB/C,CAAC"}

package/dist/builtins.js

@@ -19,6 +19,83 @@ const PROVENANCE_METADATA = {
     license: { type: "string" },
     documentation: { type: "string" },
 };
+/** The six named levels of `kernel/specs/logging.md` §5.1. The full 1–24 OTel
+ *  range stays valid on the wire; only these are nameable in a manifest. */
+const LOG_LEVEL_ENUM = ["trace", "debug", "info", "warn", "error", "fatal"];
+const DURATION_PATTERN = "^\\s*\\d+(\\.\\d+)?\\s*(ms|s|m|h)\\s*$";
+/** Fields every sink kind inherits from `Telo.LogSink` (§12.1). A concrete sink
+ *  kind may narrow a default but must not remove a field — a buffering policy
+ *  that cannot be configured from the only permitted configuration source is
+ *  not a policy. */
+const LOG_SINK_COMMON_PROPERTIES = {
+    level: { type: "string", enum: LOG_LEVEL_ENUM },
+    buffer: { type: "integer", minimum: 1 },
+    on_full: { type: "string", enum: ["block", "drop_new", "drop_old"] },
+    flush_interval: { type: "string", pattern: DURATION_PATTERN },
+};
+/** Threshold / redaction / sampling — the fields an `imports:` entry may
+ *  override for its subtree (§12.2). Deliberately excludes `sinks`: sinks are
+ *  process-level I/O and belong to the root Application that owns the process,
+ *  so an imported library can never open a log file on its importer's behalf. */
+const LOGGING_SCOPE_PROPERTIES = {
+    level: { type: "string", enum: LOG_LEVEL_ENUM },
+    attributes: { type: "object" },
+    redact: {
+        type: "object",
+        properties: {
+            paths: { type: "array", items: { type: "string" } },
+            censor: { type: "string" },
+            // Deletion destroys schema stability and hides that a field was present
+            // at all, so §14 offers this but never as the default.
+            remove: { type: "boolean" },
+        },
+        additionalProperties: false,
+    },
+    sampling: {
+        type: "object",
+        properties: {
+            first: { type: "integer", minimum: 0 },
+            thereafter: { type: "integer", minimum: 0 },
+            tick: { type: "string", pattern: DURATION_PATTERN },
+            sampleErrors: { type: "boolean" },
+        },
+        additionalProperties: false,
+    },
+};
+/** The per-import `logging:` override. */
+const IMPORT_LOGGING_SCHEMA = {
+    type: "object",
+    "x-telo-eval": "compile",
+    properties: LOGGING_SCOPE_PROPERTIES,
+    additionalProperties: false,
+};
+/** The root Application's `logging:` block — the scope fields plus `sinks`.
+ *
+ *  `x-telo-eval: compile` covers the whole block: every value resolves once at
+ *  load, which is what lets a level come from the host environment through a
+ *  `variables:` entry read with `!cel` rather than through a parallel
+ *  `TELO_LOG_*` path that would be invisible to the analyzer and the editor
+ *  (§12.3, D6). */
+const ROOT_LOGGING_SCHEMA = {
+    type: "object",
+    "x-telo-eval": "compile",
+    properties: {
+        ...LOGGING_SCOPE_PROPERTIES,
+        // A list rather than a keyed map because sinks are root-only and therefore
+        // never merged; with no merge to disambiguate, a list matches how Telo
+        // spells every other ref-or-inline collection. `x-telo-inline` opts this one
+        // slot into inline-resource extraction — see normalize-inline-resources.ts.
+        sinks: {
+            type: "array",
+            items: {
+                type: "object",
+                "x-telo-ref": "telo#LogSink",
+                "x-telo-inline": true,
+            },
+        },
+    },
+    additionalProperties: false,
+};
 export const KERNEL_BUILTINS = [
     { kind: "Telo.Abstract", metadata: { name: "Template", module: "Telo" } },
     { kind: "Telo.Abstract", metadata: { name: "Runnable", module: "Telo" } },
@@ -31,6 +108,59 @@ export const KERNEL_BUILTINS = [
         metadata: { name: "Provider", module: "Telo" },
         schema: { "x-telo-eval": "compile" },
     },
+    // The sink lifecycle role: attach, write a record, flush, detach. Deliberately
+    // payload-opaque — it carries no filtering and no encoding — so a future
+    // `Telo.TraceSink` reuses the same capability with a different record type.
+    // Scoped to record-stream sinks; metrics aggregate rather than stream and are
+    // not covered. See kernel/specs/logging.md §10.
+    { kind: "Telo.Abstract", metadata: { name: "Sink", module: "Telo" } },
+    // The abstract every *log* sink kind extends, carrying the log-specific
+    // configuration. A kernel built-in resolvable without an import, so a sink
+    // author depends on the kernel contract rather than on a standard-library
+    // module version and kernel↔module skew never becomes a compatibility surface
+    // for "where do logs go".
+    {
+        kind: "Telo.Abstract",
+        metadata: { name: "LogSink", module: "Telo" },
+        capability: "Telo.Sink",
+        schema: {
+            type: "object",
+            properties: LOG_SINK_COMMON_PROPERTIES,
+            additionalProperties: true,
+        },
+    },
+    {
+        kind: "Telo.Definition",
+        metadata: { name: "ConsoleSink", module: "Telo" },
+        capability: "Telo.Sink",
+        extends: "Telo.LogSink",
+        schema: {
+            type: "object",
+            properties: {
+                ...LOG_SINK_COMMON_PROPERTIES,
+                destination: { type: "string", enum: ["stderr", "stdout"] },
+                encoding: { type: "string", enum: ["auto", "pretty", "json"] },
+                color: { type: "string", enum: ["auto", "always", "never"] },
+            },
+            additionalProperties: false,
+        },
+    },
+    {
+        kind: "Telo.Definition",
+        metadata: { name: "FileSink", module: "Telo" },
+        capability: "Telo.Sink",
+        extends: "Telo.LogSink",
+        schema: {
+            type: "object",
+            properties: {
+                ...LOG_SINK_COMMON_PROPERTIES,
+                destination: { type: "string" },
+                encoding: { type: "string", enum: ["json", "pretty"] },
+            },
+            required: ["destination"],
+            additionalProperties: false,
+        },
+    },
     {
         kind: "Telo.Definition",
         metadata: { name: "Abstract", module: "Telo" },
@@ -270,6 +400,7 @@ export const KERNEL_BUILTINS = [
                         { type: "array", items: { type: "string" } },
                     ],
                 },
+                logging: IMPORT_LOGGING_SCHEMA,
             },
             required: ["metadata", "source"],
             additionalProperties: false,
@@ -428,6 +559,11 @@ export const KERNEL_BUILTINS = [
                                             { type: "array", items: { type: "string" } },
                                         ],
                                     },
+                                    // Threshold / redaction / sampling override for this import's
+                                    // subtree. Attached to the import rather than to a map keyed
+                                    // by module name because an alias is already uniqueness-
+                                    // enforced, while module names collide (§12.2, D9).
+                                    logging: IMPORT_LOGGING_SCHEMA,
                                 },
                                 additionalProperties: false,
                             },
@@ -497,6 +633,11 @@ export const KERNEL_BUILTINS = [
                         additionalProperties: false,
                     },
                 },
+                // Structured logging configuration. The manifest is the only
+                // configuration source — there is no TELO_LOG_* variable and no logging
+                // CLI flag — so a level derived from the host environment goes through a
+                // `variables:` entry read with `!cel`. See kernel/specs/logging.md §12.
+                logging: ROOT_LOGGING_SCHEMA,
             },
             required: ["metadata"],
             additionalProperties: false,
@@ -562,6 +703,11 @@ export const KERNEL_BUILTINS = [
                                             { type: "array", items: { type: "string" } },
                                         ],
                                     },
+                                    // Threshold / redaction / sampling override for this import's
+                                    // subtree. Attached to the import rather than to a map keyed
+                                    // by module name because an alias is already uniqueness-
+                                    // enforced, while module names collide (§12.2, D9).
+                                    logging: IMPORT_LOGGING_SCHEMA,
                                 },
                                 additionalProperties: false,
                             },

package/dist/import-resolution-diagnostics.d.ts

@@ -0,0 +1,20 @@
+import type { LoadedGraph } from "./loaded-types.js";
+import { type AnalysisDiagnostic } from "./types.js";
+/**
+ * Convert a graph's import-resolution failures (`graph.errors`) into structured,
+ * coded diagnostics. This is the single source of truth for surfacing a broken
+ * import — every host (CLI, VS Code, telo-editor) routes these instead of each
+ * re-deriving the channel and drifting (the VS Code extension used to drop it
+ * entirely, showing nothing for a broken import).
+ *
+ * The analyzer owns only this raw channel conversion; the *presentation* policy
+ * — which analysis cascade to hold back for a compromised file — lives in
+ * `@telorun/ide-support`'s `assembleGraphDiagnostics`.
+ *
+ * Each diagnostic adopts the same `data` shape as version-reconciliation
+ * diagnostics — `{ filePath, path: "imports.<alias>" }` — so the shared
+ * `findPositions` / `resolveRange` routing anchors it on the offending import
+ * line with no host-specific code.
+ */
+export declare function importResolutionDiagnostics(graph: LoadedGraph): AnalysisDiagnostic[];
+//# sourceMappingURL=import-resolution-diagnostics.d.ts.map

package/dist/import-resolution-diagnostics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-resolution-diagnostics.d.ts","sourceRoot":"","sources":["../src/import-resolution-diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAkB,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIrE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AA8BzE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,WAAW,GAAG,kBAAkB,EAAE,CAepF"}

package/dist/import-resolution-diagnostics.js

@@ -0,0 +1,59 @@
+import { isLocalPathSource } from "./sources/local-path-ref.js";
+import { isRegistryRef } from "./sources/module-ref.js";
+import { isOciRef } from "./sources/oci-ref.js";
+import { DiagnosticSeverity } from "./types.js";
+const SOURCE = "telo-analyzer";
+/** True when `source` is a shape some transport claims — a registry ref, an OCI
+ *  ref, an HTTP(S) URL, or a relative/absolute path. A source matching none of
+ *  these is malformed (no transport can ever resolve it), which we report
+ *  differently from a well-formed ref that simply failed to fetch. */
+function isRecognizedSourceShape(source) {
+    return (isRegistryRef(source) ||
+        isOciRef(source) ||
+        source.startsWith("http://") ||
+        source.startsWith("https://") ||
+        isLocalPathSource(source));
+}
+function messageFor(e, malformed) {
+    const authored = e.source ?? e.url;
+    const via = e.alias ? `import '${e.alias}' → '${authored}'` : `'${authored}'`;
+    if (malformed) {
+        return (`Cannot resolve ${via}: not a recognized module reference. Expected ` +
+            `'namespace/name@version', 'oci://host/repo@tag', 'https://…', or a relative path.`);
+    }
+    return `Cannot resolve ${via}: ${e.error.message}`;
+}
+/**
+ * Convert a graph's import-resolution failures (`graph.errors`) into structured,
+ * coded diagnostics. This is the single source of truth for surfacing a broken
+ * import — every host (CLI, VS Code, telo-editor) routes these instead of each
+ * re-deriving the channel and drifting (the VS Code extension used to drop it
+ * entirely, showing nothing for a broken import).
+ *
+ * The analyzer owns only this raw channel conversion; the *presentation* policy
+ * — which analysis cascade to hold back for a compromised file — lives in
+ * `@telorun/ide-support`'s `assembleGraphDiagnostics`.
+ *
+ * Each diagnostic adopts the same `data` shape as version-reconciliation
+ * diagnostics — `{ filePath, path: "imports.<alias>" }` — so the shared
+ * `findPositions` / `resolveRange` routing anchors it on the offending import
+ * line with no host-specific code.
+ */
+export function importResolutionDiagnostics(graph) {
+    return graph.errors.map((e) => {
+        const filePath = e.fromSource ?? graph.entry.owner.source;
+        const malformed = !isRecognizedSourceShape(e.source ?? e.url);
+        const data = { filePath };
+        if (e.alias)
+            data.path = `imports.${e.alias}`;
+        if (e.sourceLine !== undefined)
+            data.sourceLine = e.sourceLine;
+        return {
+            severity: DiagnosticSeverity.Error,
+            code: malformed ? "INVALID_IMPORT_SOURCE" : "IMPORT_UNRESOLVED",
+            source: SOURCE,
+            message: messageFor(e, malformed),
+            data,
+        };
+    });
+}

package/dist/index.d.ts

@@ -1,11 +1,14 @@
 export { AnalysisRegistry } from "./analysis-registry.js";
 export type { RefFieldInfo } from "./analysis-registry.js";
 export { StaticAnalyzer } from "./analyzer.js";
+export { importResolutionDiagnostics } from "./import-resolution-diagnostics.js";
 export type { GraphLoadError, ImportEdge, LoadedFile, LoadedGraph, LoadedModule, ParseError, } from "./loaded-types.js";
 export { flattenForAnalyzer, flattenLoadedModule, forwardReExportManifests, parseExportEntry, reExportSpecsFromExports, resolveExportedKinds, selectModuleManifestsForAnalysis, stampExportedKinds, stampReExportedKinds, type ParsedExportEntry, type ReExportSpec, } from "./flatten-for-analyzer.js";
 export { buildEvalPaths, evalPathCovers } from "./eval-paths.js";
 export { ancestorChain, controllerBearingAncestor, effectiveAuthorSchema, hasOwnControllerOrTemplate, inheritedCapability, isInheritedDelegation, resolveParent, } from "./extends-resolution.js";
 export type { DefResolver } from "./extends-resolution.js";
+export { hasIntermediateWildcard, parseRedactionPath, RedactionPathError, } from "./redaction-path.js";
+export type { RedactionSegment } from "./redaction-path.js";
 export { buildReferenceFieldMap, isRefEntry, isScopeEntry } from "./reference-field-map.js";
 export type { ReferenceFieldMap, RefFieldEntry } from "./reference-field-map.js";
 export { visitManifest } from "./manifest-visitor.js";
@@ -30,6 +33,7 @@ export { parseModuleRef, isRegistryRef } from "./sources/module-ref.js";
 export type { ParsedModuleRef } from "./sources/module-ref.js";
 export { OCI_SCHEME, isOciRef, parseOciRef } from "./sources/oci-ref.js";
 export type { ParsedOciRef } from "./sources/oci-ref.js";
+export { isLocalPathSource } from "./sources/local-path-ref.js";
 export { MANIFEST_CACHE_BASE_URL, ManifestCacheSource, isHttpsModuleRef, manifestCacheKey, manifestCacheUrl, ociManifestCacheCoords, urlManifestCacheCoords, } from "./sources/manifest-cache.js";
 export type { ManifestCacheCoords } from "./sources/manifest-cache.js";
 export { withSyntheticPositions } from "./with-synthetic-positions.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,qBAAqB,EACrB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC5F,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,aAAa,EACb,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACjF,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,qBAAqB,EACrB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC5F,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,aAAa,EACb,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,8 +1,10 @@
 export { AnalysisRegistry } from "./analysis-registry.js";
 export { StaticAnalyzer } from "./analyzer.js";
+export { importResolutionDiagnostics } from "./import-resolution-diagnostics.js";
 export { flattenForAnalyzer, flattenLoadedModule, forwardReExportManifests, parseExportEntry, reExportSpecsFromExports, resolveExportedKinds, selectModuleManifestsForAnalysis, stampExportedKinds, stampReExportedKinds, } from "./flatten-for-analyzer.js";
 export { buildEvalPaths, evalPathCovers } from "./eval-paths.js";
 export { ancestorChain, controllerBearingAncestor, effectiveAuthorSchema, hasOwnControllerOrTemplate, inheritedCapability, isInheritedDelegation, resolveParent, } from "./extends-resolution.js";
+export { hasIntermediateWildcard, parseRedactionPath, RedactionPathError, } from "./redaction-path.js";
 export { buildReferenceFieldMap, isRefEntry, isScopeEntry } from "./reference-field-map.js";
 export { visitManifest } from "./manifest-visitor.js";
 export { Loader } from "./manifest-loader.js";
@@ -18,6 +20,7 @@ export { defaultSources } from "./sources/default-sources.js";
 export { splitIntegrity, foldIntegrity, verifyIntegrity, verifiedFetch, sha256Base64Url, IntegrityError, } from "./sources/integrity.js";
 export { parseModuleRef, isRegistryRef } from "./sources/module-ref.js";
 export { OCI_SCHEME, isOciRef, parseOciRef } from "./sources/oci-ref.js";
+export { isLocalPathSource } from "./sources/local-path-ref.js";
 export { MANIFEST_CACHE_BASE_URL, ManifestCacheSource, isHttpsModuleRef, manifestCacheKey, manifestCacheUrl, ociManifestCacheCoords, urlManifestCacheCoords, } from "./sources/manifest-cache.js";
 export { withSyntheticPositions } from "./with-synthetic-positions.js";
 export { DEFAULT_MANIFEST_FILENAME, DiagnosticSeverity } from "./types.js";

package/dist/inline-imports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inline-imports.d.ts","sourceRoot":"","sources":["../src/inline-imports.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG/D;;6CAE6C;AAC7C,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,EAAE,gBAAgB,CAAC;CAC5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CACnC,cAAc,EAAE,gBAAgB,EAChC,cAAc,EAAE,gBAAgB,GAAG,SAAS,GAC3C,eAAe,EAAE,CA+BnB;AAED;;;;;;;iFAOiF;AACjF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAmB9D"}
+{"version":3,"file":"inline-imports.d.ts","sourceRoot":"","sources":["../src/inline-imports.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG/D;;6CAE6C;AAC7C,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,EAAE,gBAAgB,CAAC;CAC5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CACnC,cAAc,EAAE,gBAAgB,EAChC,cAAc,EAAE,gBAAgB,GAAG,SAAS,GAC3C,eAAe,EAAE,CAgCnB;AAED;;;;;;;iFAOiF;AACjF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAmB9D"}

package/dist/inline-imports.js

@@ -38,6 +38,7 @@ export function inlineImportManifests(moduleManifest, modulePosition) {
             ...(entry.variables !== undefined ? { variables: entry.variables } : {}),
             ...(entry.secrets !== undefined ? { secrets: entry.secrets } : {}),
             ...(entry.runtime !== undefined ? { runtime: entry.runtime } : {}),
+            ...(entry.logging !== undefined ? { logging: entry.logging } : {}),
         };
         out.push({ manifest, position: synthPosition(modulePosition, alias, scalar) });
     }

package/dist/loaded-types.d.ts

@@ -90,10 +90,21 @@ export interface LoadedGraph {
     errors: GraphLoadError[];
 }
 export interface GraphLoadError {
-    /** URL of the file that failed to load. */
+    /** URL of the file that failed to load (resolved — may be a `file://` URL for
+     *  a relative import). */
     url: string;
+    /** The import source string exactly as authored (`./lib`, `std/x@1.0.0`),
+     *  before relative-path resolution. Preferred over `url` for classification
+     *  and display, so a diagnostic quotes what the author wrote. */
+    source?: string;
     /** Source of the import that triggered the load, or null for the entry. */
     fromSource: string | null;
+    /** Import alias the failed source was bound to in `fromSource`'s `imports:`
+     *  map, when the failure is a transitive import (absent for an entry-load
+     *  failure). Lets a consumer anchor the diagnostic at `imports.<alias>`. */
+    alias?: string;
+    /** Line of the `Telo.Import` doc in `fromSource`, for position fallback. */
+    sourceLine?: number;
     error: Error;
 }
 //# sourceMappingURL=loaded-types.d.ts.map

package/dist/loaded-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loaded-types.d.ts","sourceRoot":"","sources":["../src/loaded-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAE5D;;;;4EAI4E;AAC5E,MAAM,WAAW,UAAU;IACzB;+DAC2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf;gEAC4D;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,6EAA6E;IAC7E,SAAS,EAAE,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC1C,0EAA0E;IAC1E,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,0EAA0E;IAC1E,WAAW,EAAE,UAAU,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED;mCACmC;AACnC,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,UAAU,CAAC;IAClB;oEACgE;IAChE,QAAQ,EAAE,UAAU,EAAE,CAAC;CACxB;AAED;;;;;2EAK2E;AAC3E,MAAM,WAAW,UAAU;IACzB,mEAAmE;IACnE,YAAY,EAAE,MAAM,CAAC;IACrB;6EACyE;IACzE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,oEAAoE;IACpE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;0BAC0B;AAC1B,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,YAAY,CAAC;IACpB;;wBAEoB;IACpB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACnC;;;;2BAIuB;IACvB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IAClD;;;iFAG6E;IAC7E,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;;;iDAG6C;IAC7C,kBAAkB,EAAE,kBAAkB,EAAE,CAAC;IACzC;;;8EAG0E;IAC1E,gBAAgB,EAAE,kBAAkB,EAAE,CAAC;IACvC;yCACqC;IACrC,MAAM,EAAE,cAAc,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,2EAA2E;IAC3E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,KAAK,CAAC;CACd"}
+{"version":3,"file":"loaded-types.d.ts","sourceRoot":"","sources":["../src/loaded-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAE5D;;;;4EAI4E;AAC5E,MAAM,WAAW,UAAU;IACzB;+DAC2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf;gEAC4D;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,6EAA6E;IAC7E,SAAS,EAAE,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC1C,0EAA0E;IAC1E,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,0EAA0E;IAC1E,WAAW,EAAE,UAAU,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED;mCACmC;AACnC,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,UAAU,CAAC;IAClB;oEACgE;IAChE,QAAQ,EAAE,UAAU,EAAE,CAAC;CACxB;AAED;;;;;2EAK2E;AAC3E,MAAM,WAAW,UAAU;IACzB,mEAAmE;IACnE,YAAY,EAAE,MAAM,CAAC;IACrB;6EACyE;IACzE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,oEAAoE;IACpE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;0BAC0B;AAC1B,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,YAAY,CAAC;IACpB;;wBAEoB;IACpB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACnC;;;;2BAIuB;IACvB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IAClD;;;iFAG6E;IAC7E,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;;;iDAG6C;IAC7C,kBAAkB,EAAE,kBAAkB,EAAE,CAAC;IACzC;;;8EAG0E;IAC1E,gBAAgB,EAAE,kBAAkB,EAAE,CAAC;IACvC;yCACqC;IACrC,MAAM,EAAE,cAAc,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B;8BAC0B;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;gFAE4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,KAAK,CAAC;CACd"}

package/dist/manifest-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest-loader.d.ts","sourceRoot":"","sources":["../src/manifest-loader.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAGV,UAAU,EACV,WAAW,EACX,YAAY,EACb,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAIL,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACpB,MAAM,YAAY,CAAC;AAwCpB,qBAAa,MAAM;IACjB;;;yEAGqE;IACrE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiC;IAE3D;;;;;8BAK0B;IAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IAEzD,SAAS,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IAErC;;;;mBAIe;gBACH,OAAO,GAAE,cAAc,EAAO,EAAE,OAAO,GAAE,iBAAsB;IAK3E,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;IAKtC,OAAO,CAAC,IAAI;IAMN,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUrD;;;;2CAIuC;IACvC,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAM7C;;;+BAG2B;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAyCvE;;;;gEAI4D;IAC5D,OAAO,CAAC,oBAAoB;IAa5B;gFAC4E;IAC5E,OAAO,CAAC,cAAc;IAQtB;;wEAEoE;IAC9D,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;IAsB3E;;;qCAGiC;IAC3B,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAsH9E;;;;;;;;sBAQkB;IAClB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAOlE,OAAO,CAAC,6BAA6B;IAarC,OAAO,CAAC,mCAAmC;IAc3C,OAAO,CAAC,2BAA2B;YAkCrB,eAAe;IAmB7B;;;0CAGsC;IAChC,gBAAgB,CACpB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC;QAAE,KAAK,EAAE,WAAW,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CA0B5D"}
+{"version":3,"file":"manifest-loader.d.ts","sourceRoot":"","sources":["../src/manifest-loader.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAGV,UAAU,EACV,WAAW,EACX,YAAY,EACb,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAIL,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACpB,MAAM,YAAY,CAAC;AAwCpB,qBAAa,MAAM;IACjB;;;yEAGqE;IACrE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiC;IAE3D;;;;;8BAK0B;IAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IAEzD,SAAS,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IAErC;;;;mBAIe;gBACH,OAAO,GAAE,cAAc,EAAO,EAAE,OAAO,GAAE,iBAAsB;IAK3E,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;IAKtC,OAAO,CAAC,IAAI;IAMN,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUrD;;;;2CAIuC;IACvC,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAM7C;;;+BAG2B;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAyCvE;;;;gEAI4D;IAC5D,OAAO,CAAC,oBAAoB;IAa5B;gFAC4E;IAC5E,OAAO,CAAC,cAAc;IAQtB;;wEAEoE;IAC9D,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;IAsB3E;;;qCAGiC;IAC3B,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAgI9E;;;;;;;;sBAQkB;IAClB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAOlE,OAAO,CAAC,6BAA6B;IAarC,OAAO,CAAC,mCAAmC;IAc3C,OAAO,CAAC,2BAA2B;YAkCrB,eAAe;IAmB7B;;;0CAGsC;IAChC,gBAAgB,CACpB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC;QAAE,KAAK,EAAE,WAAW,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CA0B5D"}

package/dist/manifest-loader.js

@@ -215,7 +215,10 @@ export class Loader {
                     catch (err) {
                         errors.push({
                             url: importSource,
+                            source: importSource,
                             fromSource: file.source,
+                            alias,
+                            sourceLine,
                             error: err instanceof Error ? err : new Error(String(err)),
                         });
                         continue;
@@ -243,7 +246,14 @@ export class Loader {
                         catch (err) {
                             const e = err instanceof Error ? err : new Error(String(err));
                             e.sourceLine = sourceLine;
-                            errors.push({ url: resolvedTarget, fromSource: file.source, error: e });
+                            errors.push({
+                                url: resolvedTarget,
+                                source: importSource,
+                                fromSource: file.source,
+                                alias,
+                                sourceLine,
+                                error: e,
+                            });
                             continue;
                         }
                     }

package/dist/normalize-inline-resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"normalize-inline-resources.d.ts","sourceRoot":"","sources":["../src/normalize-inline-resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AA8BzD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE,aAAa,EACvB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC3C,gBAAgB,EAAE,CAsEpB"}
+{"version":3,"file":"normalize-inline-resources.d.ts","sourceRoot":"","sources":["../src/normalize-inline-resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AA6CzD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE,aAAa,EACvB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC3C,gBAAgB,EAAE,CA0EpB"}

package/dist/normalize-inline-resources.js

@@ -5,6 +5,20 @@ const SYSTEM_KINDS = new Set([
     "Telo.Library",
     "Telo.Import",
 ]);
+/**
+ * System kinds are excluded from inline extraction by default, but a single slot
+ * may opt back in with `x-telo-inline: true` — `Telo.Application.logging.sinks`
+ * is the case this exists for.
+ *
+ * The opt-in is per slot rather than per kind because this pass runs *upstream*
+ * of schema validation on both the analyzer and runtime paths. Admitting the
+ * whole Application document would rewrite an inline `{kind, ...}` in `targets`
+ * into a valid `{kind, name}` before AJV ever saw it, silently converting a
+ * deliberate rejection into a working feature.
+ */
+function acceptsInline(resourceKind, entry) {
+    return !SYSTEM_KINDS.has(resourceKind) || entry.inline === true;
+}
 /** Replaces characters outside [a-zA-Z0-9_] with underscores. */
 function sanitizeName(raw) {
     return raw.replace(/[^a-zA-Z0-9_]/g, "_");
@@ -55,7 +69,10 @@ export function normalizeInlineResources(resources, registry, aliases, aliasesBy
     const result = resources.map(cloneForMutation);
     // Queue: all non-system resources with a name. Extracted resources are appended.
     // Filter the CLONES (not the originals) so traversal mutates copies.
-    const queue = result.filter((r) => typeof r.metadata?.name === "string" && !!r.kind && !SYSTEM_KINDS.has(r.kind));
+    // System kinds join the queue too: their inline-accepting slots are filtered
+    // per entry below, so a system document is walked but only its opted-in slots
+    // are extracted from.
+    const queue = result.filter((r) => typeof r.metadata?.name === "string" && !!r.kind);
     let i = 0;
     while (i < queue.length) {
         const resource = queue[i++];
@@ -82,6 +99,8 @@ export function normalizeInlineResources(resources, registry, aliases, aliasesBy
         for (const [fieldPath, entry] of fieldMap) {
             if (!isRefEntry(entry))
                 continue;
+            if (!acceptsInline(resource.kind, entry))
+                continue;
             const inScope = scopePrefixes.some((prefix) => fieldPath === prefix ||
                 fieldPath.startsWith(prefix + ".") ||
                 fieldPath.startsWith(prefix + "["));

package/dist/redaction-path.d.ts

@@ -0,0 +1,49 @@
+/**
+ * The redaction path grammar of `kernel/specs/logging.md` §14 — a hand-written
+ * parser over a closed grammar.
+ *
+ * §14.1 makes this a security requirement rather than a style preference. The
+ * implementation this syntax is borrowed from compiles paths through the
+ * `Function` constructor and validates them by "evaluate it and see whether it
+ * parses", which is exactly why that implementation must forbid user input. A
+ * real parser removes the injection surface entirely and, as a bonus, makes
+ * paths statically checkable by `telo check`.
+ *
+ * Browser-safe by construction: this module is imported by both the analyzer's
+ * static check and the kernel's runtime redaction pass, so the grammar has one
+ * definition rather than two that can drift.
+ *
+ * Grammar:
+ *
+ *     path     := segment ( "." segment | bracket )*
+ *     segment  := bareKey | "*"
+ *     bracket  := "[" ( quoted | integer | "*" ) "]"
+ *     quoted   := '"' ... '"' | "'" ... "'"
+ *
+ * More than one wildcard per path is supported — `items[*].tokens[*].value` is
+ * valid. The one-wildcard limit in the best-known implementation is an artifact
+ * of how it compiles accessors, not a property of the grammar.
+ */
+export type RedactionSegment = {
+    kind: "key";
+    name: string;
+} | {
+    kind: "wildcard";
+};
+export declare class RedactionPathError extends Error {
+    readonly code = "INVALID_REDACTION_PATH";
+    readonly path: string;
+    readonly offset: number;
+    constructor(path: string, offset: number, detail: string);
+}
+/**
+ * Parse a redaction path into its segments. Throws {@link RedactionPathError}
+ * with the offending offset so `telo check` can point at the character rather
+ * than the whole path.
+ */
+export declare function parseRedactionPath(path: string): RedactionSegment[];
+/** `true` when the path contains a wildcard anywhere but its last segment.
+ *  §14.2 measures intermediate wildcards at 25–55% over plain serialization,
+ *  against 1–2% for explicit paths, so a runtime may warn when one is used. */
+export declare function hasIntermediateWildcard(segments: readonly RedactionSegment[]): boolean;
+//# sourceMappingURL=redaction-path.d.ts.map

package/dist/redaction-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction-path.d.ts","sourceRoot":"","sources":["../src/redaction-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,MAAM,MAAM,gBAAgB,GAAG;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC;AAEpF,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,4BAA4B;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAMzD;AAID;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAyCnE;AA2CD;;+EAE+E;AAC/E,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,GAAG,OAAO,CAKtF"}