@telorun/analyzer 0.38.0 → 0.40.0

package/dist/redaction-path.js

@@ -0,0 +1,133 @@
+/**
+ * The redaction path grammar of `kernel/specs/logging.md` §14 — a hand-written
+ * parser over a closed grammar.
+ *
+ * §14.1 makes this a security requirement rather than a style preference. The
+ * implementation this syntax is borrowed from compiles paths through the
+ * `Function` constructor and validates them by "evaluate it and see whether it
+ * parses", which is exactly why that implementation must forbid user input. A
+ * real parser removes the injection surface entirely and, as a bonus, makes
+ * paths statically checkable by `telo check`.
+ *
+ * Browser-safe by construction: this module is imported by both the analyzer's
+ * static check and the kernel's runtime redaction pass, so the grammar has one
+ * definition rather than two that can drift.
+ *
+ * Grammar:
+ *
+ *     path     := segment ( "." segment | bracket )*
+ *     segment  := bareKey | "*"
+ *     bracket  := "[" ( quoted | integer | "*" ) "]"
+ *     quoted   := '"' ... '"' | "'" ... "'"
+ *
+ * More than one wildcard per path is supported — `items[*].tokens[*].value` is
+ * valid. The one-wildcard limit in the best-known implementation is an artifact
+ * of how it compiles accessors, not a property of the grammar.
+ */
+export class RedactionPathError extends Error {
+    code = "INVALID_REDACTION_PATH";
+    path;
+    offset;
+    constructor(path, offset, detail) {
+        super(`Invalid redaction path "${path}" at position ${offset}: ${detail}`);
+        this.name = "RedactionPathError";
+        this.path = path;
+        this.offset = offset;
+    }
+}
+const BARE_KEY_TERMINATORS = new Set([".", "[", "]"]);
+/**
+ * Parse a redaction path into its segments. Throws {@link RedactionPathError}
+ * with the offending offset so `telo check` can point at the character rather
+ * than the whole path.
+ */
+export function parseRedactionPath(path) {
+    if (path.length === 0)
+        throw new RedactionPathError(path, 0, "path is empty");
+    const segments = [];
+    let index = 0;
+    let expectSegment = true;
+    while (index < path.length) {
+        const char = path[index];
+        if (char === "[") {
+            index = parseBracket(path, index, segments);
+            expectSegment = false;
+            continue;
+        }
+        if (char === ".") {
+            if (expectSegment) {
+                throw new RedactionPathError(path, index, "expected a key before '.'");
+            }
+            index += 1;
+            expectSegment = true;
+            continue;
+        }
+        if (char === "]") {
+            throw new RedactionPathError(path, index, "unmatched ']'");
+        }
+        const start = index;
+        while (index < path.length && !BARE_KEY_TERMINATORS.has(path[index]))
+            index += 1;
+        const raw = path.slice(start, index);
+        if (raw.length === 0)
+            throw new RedactionPathError(path, start, "empty key");
+        segments.push(raw === "*" ? { kind: "wildcard" } : { kind: "key", name: raw });
+        expectSegment = false;
+    }
+    if (expectSegment) {
+        throw new RedactionPathError(path, path.length, "path ends with a trailing '.'");
+    }
+    return segments;
+}
+function parseBracket(path, open, segments) {
+    let index = open + 1;
+    if (index >= path.length)
+        throw new RedactionPathError(path, open, "unterminated '['");
+    const quote = path[index];
+    if (quote === '"' || quote === "'") {
+        index += 1;
+        const start = index;
+        while (index < path.length && path[index] !== quote)
+            index += 1;
+        if (index >= path.length) {
+            throw new RedactionPathError(path, start, `unterminated ${quote} quoted key`);
+        }
+        const name = path.slice(start, index);
+        if (name.length === 0)
+            throw new RedactionPathError(path, start, "empty quoted key");
+        index += 1;
+        if (path[index] !== "]") {
+            throw new RedactionPathError(path, index, "expected ']' after quoted key");
+        }
+        segments.push({ kind: "key", name });
+        return index + 1;
+    }
+    const start = index;
+    while (index < path.length && path[index] !== "]")
+        index += 1;
+    if (index >= path.length)
+        throw new RedactionPathError(path, open, "unterminated '['");
+    const raw = path.slice(start, index);
+    if (raw.length === 0)
+        throw new RedactionPathError(path, start, "empty '[]'");
+    if (raw === "*") {
+        segments.push({ kind: "wildcard" });
+    }
+    else if (/^\d+$/.test(raw)) {
+        segments.push({ kind: "key", name: raw });
+    }
+    else {
+        throw new RedactionPathError(path, start, `expected a quoted key, an integer index, or '*', got "${raw}" — quote it as ["${raw}"]`);
+    }
+    return index + 1;
+}
+/** `true` when the path contains a wildcard anywhere but its last segment.
+ *  §14.2 measures intermediate wildcards at 25–55% over plain serialization,
+ *  against 1–2% for explicit paths, so a runtime may warn when one is used. */
+export function hasIntermediateWildcard(segments) {
+    for (let i = 0; i < segments.length - 1; i += 1) {
+        if (segments[i].kind === "wildcard")
+            return true;
+    }
+    return false;
+}

package/dist/reference-field-map.d.ts

@@ -8,6 +8,18 @@ export interface RefFieldEntry {
     /** x-telo-context schema declared on this ref slot, if any. Describes the CEL invocation
      *  context available to resources placed in this slot. */
     context?: Record<string, any>;
+    /** `x-telo-inline: true` — this slot accepts an inline `{kind, ...config}`
+     *  definition, not only a `!ref`.
+     *
+     *  Only meaningful on the *system* kinds (`Telo.Application` and friends),
+     *  which are otherwise excluded from inline-resource normalization wholesale.
+     *  Ordinary resource kinds accept inline definitions at every ref slot and
+     *  need no annotation. The flag exists so `logging.sinks` can opt in without
+     *  also legalizing an inline definition in `targets`, where the Application
+     *  schema rejects one deliberately — normalization runs upstream of AJV, so
+     *  an unconditional opt-in would rewrite the value into a valid shape before
+     *  the schema ever saw it. */
+    inline?: boolean;
 }
 /** An entry for a field that declares an execution scope (x-telo-scope). */
 export interface ScopeFieldEntry {

package/dist/reference-field-map.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reference-field-map.d.ts","sourceRoot":"","sources":["../src/reference-field-map.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,MAAM,WAAW,aAAa;IAC5B;sDACkD;IAClD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,0FAA0F;IAC1F,OAAO,EAAE,OAAO,CAAC;IACjB;8DAC0D;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC/B;AAED,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAC9B;2CACuC;IACvC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC1B;AAED;8CAC8C;AAC9C,MAAM,WAAW,oBAAoB;IACnC;;qFAEiF;IACjF,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,eAAe,GAAG,oBAAoB,CAAC;AAEnF;0FAC0F;AAC1F,MAAM,MAAM,iBAAiB,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAE3D,wBAAgB,UAAU,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,IAAI,aAAa,CAEvE;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,IAAI,eAAe,CAE3E;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,IAAI,oBAAoB,CAErF;AAED,oGAAoG;AACpG,eAAO,MAAM,cAAc,aAAwC,CAAC;AAEpE;;;;;;;;;2EAS2E;AAC3E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAItE;AAED;;;;sEAIsE;AACtE,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;wDAUwD;AACxD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAoCpF;AAED;+DAC+D;AAC/D,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,EAAE,CAExE;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,iBAAiB,CAQrF;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE,CAa/D;AAED;;;8CAG8C;AAC9C,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,EAAE,MAAM,GACjB,iBAAiB,CAInB"}
+{"version":3,"file":"reference-field-map.d.ts","sourceRoot":"","sources":["../src/reference-field-map.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,MAAM,WAAW,aAAa;IAC5B;sDACkD;IAClD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,0FAA0F;IAC1F,OAAO,EAAE,OAAO,CAAC;IACjB;8DAC0D;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9B;;;;;;;;;;kCAU8B;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAC9B;2CACuC;IACvC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC1B;AAED;8CAC8C;AAC9C,MAAM,WAAW,oBAAoB;IACnC;;qFAEiF;IACjF,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,eAAe,GAAG,oBAAoB,CAAC;AAEnF;0FAC0F;AAC1F,MAAM,MAAM,iBAAiB,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAE3D,wBAAgB,UAAU,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,IAAI,aAAa,CAEvE;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,IAAI,eAAe,CAE3E;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,IAAI,oBAAoB,CAErF;AAED,oGAAoG;AACpG,eAAO,MAAM,cAAc,aAAwC,CAAC;AAEpE;;;;;;;;;2EAS2E;AAC3E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAItE;AAED;;;;sEAIsE;AACtE,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;wDAUwD;AACxD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAoCpF;AAED;+DAC+D;AAC/D,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,EAAE,CAExE;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,iBAAiB,CAQrF;AASD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE,CAa/D;AAED;;;8CAG8C;AAC9C,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,EAAE,MAAM,GACjB,iBAAiB,CAInB"}

package/dist/reference-field-map.js

@@ -103,6 +103,13 @@ export function buildReferenceFieldMap(schema) {
     }
     return map;
 }
+/** `x-telo-inline` declared on any `anyOf` branch marks the whole slot as
+ *  inline-accepting, matching how {@link collectRefs} unions branch refs. */
+function collectInlineFlag(node) {
+    if (!Array.isArray(node.anyOf))
+        return false;
+    return node.anyOf.some((branch) => branch?.["x-telo-inline"] === true);
+}
 export function collectRefs(node) {
     const refs = [];
     if (typeof node["x-telo-ref"] === "string") {
@@ -156,6 +163,8 @@ function traverseNode(node, path, map, root, visitedRefs = new Set()) {
         const entry = { refs, isArray: path.includes("[]") };
         if (node["x-telo-context"])
             entry.context = node["x-telo-context"];
+        if (node["x-telo-inline"] === true || collectInlineFlag(node))
+            entry.inline = true;
         map.set(path, entry);
         // A node can mix item-level ref branches (a bare string / `{kind, name}`)
         // with object branches that carry their OWN nested refs — e.g. Application

package/dist/schema-compat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-compat.d.ts","sourceRoot":"","sources":["../src/schema-compat.ts"],"names":[],"mappings":"AAIA,QAAA,MAAM,GAAG,KAA0C,CAAC;AAEpD;;;;;;;mCAOmC;AACnC,wBAAgB,SAAS,IAAI,YAAY,CAAC,OAAO,GAAG,CAAC,CAOpD;AAKD,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;oEAEoE;AACpE,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC1B,mBAAmB,CAIrB;AAiDD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAelD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAGxE;AAuBD,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;CACd;AAaD,0GAA0G;AAC1G,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,WAAW,EAAE,CA2B/F;AAED;qFACqF;AACrF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAQ7E;AAED;;;;6DAI6D;AAC7D,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,EAAE,MAAM,GACX,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAsBjC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGnD,CAAC;AAEF,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAGzF;AAED,8DAA8D;AAC9D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,CAyBnF;AAED,wFAAwF;AACxF,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAiChG;AAED,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAiB5E;AAID,0EAA0E;AAC1E,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAOtG;AAED,gGAAgG;AAChG,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAUlF;AAED;iGACiG;AACjG,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC/B,OAAO,CAqCT"}
+{"version":3,"file":"schema-compat.d.ts","sourceRoot":"","sources":["../src/schema-compat.ts"],"names":[],"mappings":"AAIA,QAAA,MAAM,GAAG,KAA0C,CAAC;AAEpD;;;;;;;mCAOmC;AACnC,wBAAgB,SAAS,IAAI,YAAY,CAAC,OAAO,GAAG,CAAC,CAOpD;AAKD,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;oEAEoE;AACpE,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC1B,mBAAmB,CAIrB;AAiDD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAelD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAGxE;AAuBD,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;CACd;AAaD,0GAA0G;AAC1G,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,WAAW,EAAE,CA2B/F;AAED;qFACqF;AACrF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAQ7E;AAED;;;;6DAI6D;AAC7D,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,EAAE,MAAM,GACX,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAsBjC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGnD,CAAC;AAEF,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAGzF;AAED,8DAA8D;AAC9D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,CAyBnF;AAED,wFAAwF;AACxF,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAiChG;AAED,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAwB5E;AAID,0EAA0E;AAC1E,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAOtG;AAED,gGAAgG;AAChG,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAUlF;AAED;iGACiG;AACjG,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC/B,OAAO,CAqCT"}

package/dist/schema-compat.js

@@ -285,6 +285,14 @@ export function celTypeSatisfiesJsonSchema(celType, schema) {
 export function celPlaceholderForSchema(schema) {
     if (schema.default !== undefined)
         return schema.default;
+    // An enum-constrained field needs a placeholder drawn from the enum: the
+    // type-based fallbacks below ("" for a string, 0 for a number) satisfy `type`
+    // but violate `enum`, so a CEL expression feeding any enum field would report
+    // a spurious SCHEMA_VIOLATION against a value the author never wrote. The
+    // member chosen is irrelevant — only its acceptability to AJV matters, since
+    // the real value is checked at runtime once the expression resolves.
+    if (Array.isArray(schema.enum) && schema.enum.length > 0)
+        return schema.enum[0];
     switch (schema.type) {
         case "integer":
         case "number":

package/dist/sources/local-path-ref.d.ts

@@ -0,0 +1,4 @@
+/** True when `source` names an on-disk sibling manifest — a relative (`./`,
+ *  `../`) or absolute (`/`) path — rather than a transport-owned remote ref. */
+export declare function isLocalPathSource(source: string): boolean;
+//# sourceMappingURL=local-path-ref.d.ts.map

package/dist/sources/local-path-ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-path-ref.d.ts","sourceRoot":"","sources":["../../src/sources/local-path-ref.ts"],"names":[],"mappings":"AAAA;gFACgF;AAChF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEzD"}

package/dist/sources/local-path-ref.js

@@ -0,0 +1,5 @@
+/** True when `source` names an on-disk sibling manifest — a relative (`./`,
+ *  `../`) or absolute (`/`) path — rather than a transport-owned remote ref. */
+export function isLocalPathSource(source) {
+    return source.startsWith(".") || source.startsWith("/");
+}

package/dist/validate-extends.d.ts

@@ -2,25 +2,5 @@ import type { ResourceManifest } from "@telorun/sdk";
 import type { AliasResolver } from "./alias-resolver.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
 import { type AnalysisDiagnostic } from "./types.js";
-/**
- * Phase 3b — Validate `extends` fields on Telo.Definition docs, and flag the legacy
- * `capability: <UserAbstract>` overload with CAPABILITY_SHADOWS_EXTENDS so users migrate.
- *
- * `extends` uses alias form ("<Alias>.<Name>") resolved against the declaring file's
- * Telo.Import declarations — same pattern as `kind:` prefixes. The analyzer pre-resolves
- * via AliasResolver before register() is called, so by the time this validator runs,
- * the definition's effective `extends` is either the canonical form (when the alias was
- * known) or the original alias-prefixed string (when it wasn't).
- *
- * Diagnostics:
- *  - EXTENDS_MALFORMED: value not in "<Alias>.<Name>" alias form, or not resolvable
- *    via the declaring file's imports (alias unknown → can't distinguish from a typo).
- *  - EXTENDS_UNKNOWN_TARGET: alias resolves to a module, but that module has no
- *    registered definition with the target name.
- *  - EXTENDS_NON_ABSTRACT: target resolves to a Telo.Definition, not a Telo.Abstract.
- *  - CAPABILITY_SHADOWS_EXTENDS (warning): `capability` names a user-declared abstract
- *    (metadata.module !== "Telo"). Builtin lifecycle capabilities (Telo.Invocable, etc.)
- *    never trigger this — they're lifecycle roles by design.
- */
 export declare function validateExtends(manifests: ResourceManifest[], registry: DefinitionRegistry, aliases: AliasResolver): AnalysisDiagnostic[];
 //# sourceMappingURL=validate-extends.d.ts.map

package/dist/validate-extends.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-extends.d.ts","sourceRoot":"","sources":["../src/validate-extends.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAOzE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,GACrB,kBAAkB,EAAE,CAwJtB"}
+{"version":3,"file":"validate-extends.d.ts","sourceRoot":"","sources":["../src/validate-extends.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AA8BzE,wBAAgB,eAAe,CAC7B,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,GACrB,kBAAkB,EAAE,CA4JtB"}

package/dist/validate-extends.js

@@ -23,6 +23,8 @@ const EXTENDS_ALIAS_RE = /^[A-Z][A-Za-z0-9_]*\.[A-Z][A-Za-z0-9_]*$/;
  *    (metadata.module !== "Telo"). Builtin lifecycle capabilities (Telo.Invocable, etc.)
  *    never trigger this — they're lifecycle roles by design.
  */
+/** The built-in namespace, resolvable without a `Telo.Import`. */
+const TELO_BUILTIN_ALIAS = "Telo";
 export function validateExtends(manifests, registry, aliases) {
     const diagnostics = [];
     // Defs forwarded from imported libraries carry `metadata.module` set to that
@@ -81,7 +83,11 @@ export function validateExtends(manifests, registry, aliases) {
             }
             else {
                 const prefix = extendsValue.slice(0, extendsValue.indexOf("."));
-                if (!aliases.hasAlias(prefix)) {
+                // `Telo` needs no import: the kernel built-ins are globally resolvable
+                // by design, which is what lets a sink author depend on the kernel
+                // contract (`extends: Telo.LogSink`) rather than on a standard-library
+                // module version — see kernel/specs/logging.md §10.2.
+                if (prefix !== TELO_BUILTIN_ALIAS && !aliases.hasAlias(prefix)) {
                     diagnostics.push({
                         severity: DiagnosticSeverity.Error,
                         code: "EXTENDS_MALFORMED",

package/dist/validate-logging.d.ts

@@ -0,0 +1,22 @@
+import type { ResourceManifest } from "@telorun/sdk";
+import type { AliasResolver } from "./alias-resolver.js";
+import type { DefinitionRegistry } from "./definition-registry.js";
+import { type AnalysisDiagnostic } from "./types.js";
+/**
+ * Static validation of the `logging:` block — `kernel/specs/logging.md` §14.1
+ * and §10.3.
+ *
+ * Two things the spec explicitly says are statically detectable, so leaving them
+ * to a runtime failure would contradict Telo's "manifests must remain statically
+ * analyzable" goal:
+ *
+ * 1. **Redaction paths** parse against the closed §14 grammar. §14.1's whole
+ *    argument for a hand-written parser is that it makes paths checkable by
+ *    `telo check`; a bad path must fail here, not silently fail to redact at
+ *    runtime.
+ * 2. **`on_full: block`** is unimplementable on a single-threaded runtime and
+ *    §10.3 calls it "statically detectable by `telo check`". Catching it here —
+ *    rather than only at boot — is what lets an operator fix it before shipping.
+ */
+export declare function validateLogging(manifests: ResourceManifest[], registry: DefinitionRegistry, aliases: AliasResolver, aliasesByModule?: Map<string, AliasResolver>): AnalysisDiagnostic[];
+//# sourceMappingURL=validate-logging.d.ts.map

package/dist/validate-logging.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-logging.d.ts","sourceRoot":"","sources":["../src/validate-logging.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,EACtB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC3C,kBAAkB,EAAE,CAqBtB"}

package/dist/validate-logging.js

@@ -0,0 +1,116 @@
+import { parseRedactionPath, RedactionPathError } from "./redaction-path.js";
+import { DiagnosticSeverity } from "./types.js";
+const SOURCE = "telo-analyzer";
+/**
+ * Static validation of the `logging:` block — `kernel/specs/logging.md` §14.1
+ * and §10.3.
+ *
+ * Two things the spec explicitly says are statically detectable, so leaving them
+ * to a runtime failure would contradict Telo's "manifests must remain statically
+ * analyzable" goal:
+ *
+ * 1. **Redaction paths** parse against the closed §14 grammar. §14.1's whole
+ *    argument for a hand-written parser is that it makes paths checkable by
+ *    `telo check`; a bad path must fail here, not silently fail to redact at
+ *    runtime.
+ * 2. **`on_full: block`** is unimplementable on a single-threaded runtime and
+ *    §10.3 calls it "statically detectable by `telo check`". Catching it here —
+ *    rather than only at boot — is what lets an operator fix it before shipping.
+ */
+export function validateLogging(manifests, registry, aliases, aliasesByModule) {
+    const diagnostics = [];
+    for (const manifest of manifests) {
+        const kind = manifest.kind;
+        // Redaction paths live on the `logging:` block of the root Application and on
+        // any `Telo.Import` / `Telo.Library` doc carrying a per-import override.
+        if (kind === "Telo.Application" || kind === "Telo.Import" || kind === "Telo.Library") {
+            validateRedactPaths(manifest, diagnostics);
+        }
+        // `on_full` lives on any sink instance — an inline `logging.sinks[]` entry
+        // (extracted by Phase 2 into a first-class manifest by now) or a standalone
+        // sink resource declared elsewhere and reached via `!ref`.
+        if (isSinkKind(manifest, registry, aliases, aliasesByModule)) {
+            validateOnFull(manifest, diagnostics);
+        }
+    }
+    return diagnostics;
+}
+function validateRedactPaths(manifest, out) {
+    const name = manifest.metadata?.name;
+    const filePath = manifest.metadata?.source;
+    const resource = { kind: manifest.kind, name };
+    for (const { block, prefix } of loggingBlocks(manifest)) {
+        const paths = block.redact?.paths;
+        if (!Array.isArray(paths))
+            continue;
+        paths.forEach((path, index) => {
+            // A `!cel` path is a compiled/sentinel node by now, not a string — its
+            // value isn't known statically, so there is nothing to parse.
+            if (typeof path !== "string")
+                return;
+            try {
+                parseRedactionPath(path);
+            }
+            catch (err) {
+                if (!(err instanceof RedactionPathError))
+                    throw err;
+                out.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: "INVALID_REDACTION_PATH",
+                    source: SOURCE,
+                    message: `${manifest.kind}/${name ?? "(unnamed)"}: ${err.message}`,
+                    data: { resource, filePath, path: `${prefix}redact.paths[${index}]` },
+                });
+            }
+        });
+    }
+}
+function validateOnFull(manifest, out) {
+    const onFull = manifest.on_full;
+    if (onFull !== "block")
+        return;
+    const name = manifest.metadata?.name;
+    const filePath = manifest.metadata?.source;
+    out.push({
+        severity: DiagnosticSeverity.Error,
+        code: "LOG_SINK_ON_FULL_UNSUPPORTED",
+        source: SOURCE,
+        message: `${manifest.kind}/${name ?? "(unnamed)"}: on_full: block is not supported on a ` +
+            `single-threaded runtime — blocking the producer would stall the writer. ` +
+            `Use drop_new or drop_old.`,
+        data: { resource: { kind: manifest.kind, name }, filePath, path: "on_full" },
+    });
+}
+/** The root `logging:` block plus every per-import `logging:` override, each
+ *  with the dotted path prefix a diagnostic anchors against. */
+function loggingBlocks(manifest) {
+    const blocks = [];
+    const root = manifest.logging;
+    if (isObject(root))
+        blocks.push({ block: root, prefix: "logging." });
+    // Inline imports map: `imports.<Alias>.logging`.
+    const imports = manifest.imports;
+    if (isObject(imports)) {
+        for (const [alias, entry] of Object.entries(imports)) {
+            if (!isObject(entry))
+                continue;
+            const block = entry.logging;
+            if (isObject(block))
+                blocks.push({ block, prefix: `imports.${alias}.logging.` });
+        }
+    }
+    return blocks;
+}
+function isSinkKind(manifest, registry, aliases, aliasesByModule) {
+    if (typeof manifest.kind !== "string")
+        return false;
+    if (manifest.kind === "Telo.ConsoleSink" || manifest.kind === "Telo.FileSink")
+        return true;
+    const ownModule = manifest.metadata?.module;
+    const resolver = (ownModule ? aliasesByModule?.get(ownModule) : undefined) ?? aliases;
+    const canonical = resolver.resolveKind(manifest.kind) ?? manifest.kind;
+    return registry.resolve(canonical)?.capability === "Telo.Sink";
+}
+function isObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.38.0",
+  "version": "0.40.0",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",
@@ -48,7 +48,7 @@
     "@types/node": "^20.0.0",
     "typescript": "^5.0.0",
     "vitest": "^2.1.8",
-    "@telorun/sdk": "0.48.0"
+    "@telorun/sdk": "0.50.0"
   },
   "peerDependencies": {
     "@telorun/sdk": "*"

package/src/analyzer.ts

@@ -40,6 +40,7 @@ import {
 } from "./validate-cel-context.js";
 import { buildEvalPaths, evalPathsCover } from "./eval-paths.js";
 import { validateExtends } from "./validate-extends.js";
+import { validateLogging } from "./validate-logging.js";
 import { validateBaseMapping } from "./validate-base-mapping.js";
 import { validateNestedInlineResources } from "./validate-nested-inline.js";
 import { validateProviderCoherence } from "./validate-provider-coherence.js";
@@ -432,11 +433,17 @@ function buildStepContextSchema(
  * handler dispatched directly, e.g. `Lambda.Function`), so it can't be rejected
  * statically without false positives. This is the sound subset of the runtime rule.
  */
+/** The built-in namespace: globally resolvable, crossing no import boundary. */
+const TELO_BUILTIN_MODULE = "Telo";
+
 const NON_INVOKABLE_CAPABILITIES = new Set([
   "Telo.Provider",
   "Telo.Mount",
   "Telo.Type",
   "Telo.Template",
+  // A sink is written to through a direct contract on the controller instance,
+  // never dispatched — so invoking one is statically wrong.
+  "Telo.Sink",
 ]);
 
 /**
@@ -859,6 +866,12 @@ export class StaticAnalyzer {
     // so state builds up across successive calls (e.g. incremental editor validation).
     const ctx = registry?._context();
     const aliases = ctx?.aliases ?? new AliasResolver();
+    // `Telo` crosses no import boundary — the kernel built-ins are globally
+    // resolvable, which is what lets `kind: Telo.ConsoleSink` and
+    // `extends: Telo.LogSink` work with no `imports:` entry (§10.2). The kernel
+    // registers the same ungated alias at boot; registering it here keeps the
+    // static and runtime halves agreeing.
+    aliases.registerUngatedAlias(TELO_BUILTIN_MODULE, TELO_BUILTIN_MODULE);
     const defs = ctx?.definitions ?? new DefinitionRegistry();
 
     // Register module identities and aliases.
@@ -908,6 +921,7 @@ export class StaticAnalyzer {
             let libResolver = aliasesByModule.get(moduleName);
             if (!libResolver) {
               libResolver = new AliasResolver();
+              libResolver.registerUngatedAlias(TELO_BUILTIN_MODULE, TELO_BUILTIN_MODULE);
               aliasesByModule.set(moduleName, libResolver);
             }
             libResolver.registerUngatedAlias("Self", moduleName);
@@ -1002,6 +1016,7 @@ export class StaticAnalyzer {
       let libResolver = aliasesByModule.get(ownModule);
       if (!libResolver) {
         libResolver = new AliasResolver();
+        libResolver.registerUngatedAlias(TELO_BUILTIN_MODULE, TELO_BUILTIN_MODULE);
         aliasesByModule.set(ownModule, libResolver);
       }
       if (!libResolver.hasAlias("Self")) {
@@ -1082,6 +1097,9 @@ export class StaticAnalyzer {
       diagnostics.push(
         ...validateSchemaTypeRefs(allManifests, defs, aliases, aliasesByModule, rootModules),
       );
+      // §14.1 / §10.3: redaction paths and `on_full: block` are statically
+      // detectable, so they fail `telo check` rather than only at boot.
+      diagnostics.push(...validateLogging(allManifests, defs, aliases, aliasesByModule));
     }
     resolveSchemaTypeRefs(allManifests, aliases, aliasesByModule);