@telorun/analyzer 0.38.0 → 0.40.0

package/src/builtins.ts

@@ -22,6 +22,89 @@ const PROVENANCE_METADATA = {
   documentation: { type: "string" },
 };
 
+/** The six named levels of `kernel/specs/logging.md` §5.1. The full 1–24 OTel
+ *  range stays valid on the wire; only these are nameable in a manifest. */
+const LOG_LEVEL_ENUM = ["trace", "debug", "info", "warn", "error", "fatal"];
+
+const DURATION_PATTERN = "^\\s*\\d+(\\.\\d+)?\\s*(ms|s|m|h)\\s*$";
+
+/** Fields every sink kind inherits from `Telo.LogSink` (§12.1). A concrete sink
+ *  kind may narrow a default but must not remove a field — a buffering policy
+ *  that cannot be configured from the only permitted configuration source is
+ *  not a policy. */
+const LOG_SINK_COMMON_PROPERTIES = {
+  level: { type: "string", enum: LOG_LEVEL_ENUM },
+  buffer: { type: "integer", minimum: 1 },
+  on_full: { type: "string", enum: ["block", "drop_new", "drop_old"] },
+  flush_interval: { type: "string", pattern: DURATION_PATTERN },
+};
+
+/** Threshold / redaction / sampling — the fields an `imports:` entry may
+ *  override for its subtree (§12.2). Deliberately excludes `sinks`: sinks are
+ *  process-level I/O and belong to the root Application that owns the process,
+ *  so an imported library can never open a log file on its importer's behalf. */
+const LOGGING_SCOPE_PROPERTIES = {
+  level: { type: "string", enum: LOG_LEVEL_ENUM },
+  attributes: { type: "object" },
+  redact: {
+    type: "object",
+    properties: {
+      paths: { type: "array", items: { type: "string" } },
+      censor: { type: "string" },
+      // Deletion destroys schema stability and hides that a field was present
+      // at all, so §14 offers this but never as the default.
+      remove: { type: "boolean" },
+    },
+    additionalProperties: false,
+  },
+  sampling: {
+    type: "object",
+    properties: {
+      first: { type: "integer", minimum: 0 },
+      thereafter: { type: "integer", minimum: 0 },
+      tick: { type: "string", pattern: DURATION_PATTERN },
+      sampleErrors: { type: "boolean" },
+    },
+    additionalProperties: false,
+  },
+};
+
+/** The per-import `logging:` override. */
+const IMPORT_LOGGING_SCHEMA = {
+  type: "object",
+  "x-telo-eval": "compile",
+  properties: LOGGING_SCOPE_PROPERTIES,
+  additionalProperties: false,
+};
+
+/** The root Application's `logging:` block — the scope fields plus `sinks`.
+ *
+ *  `x-telo-eval: compile` covers the whole block: every value resolves once at
+ *  load, which is what lets a level come from the host environment through a
+ *  `variables:` entry read with `!cel` rather than through a parallel
+ *  `TELO_LOG_*` path that would be invisible to the analyzer and the editor
+ *  (§12.3, D6). */
+const ROOT_LOGGING_SCHEMA = {
+  type: "object",
+  "x-telo-eval": "compile",
+  properties: {
+    ...LOGGING_SCOPE_PROPERTIES,
+    // A list rather than a keyed map because sinks are root-only and therefore
+    // never merged; with no merge to disambiguate, a list matches how Telo
+    // spells every other ref-or-inline collection. `x-telo-inline` opts this one
+    // slot into inline-resource extraction — see normalize-inline-resources.ts.
+    sinks: {
+      type: "array",
+      items: {
+        type: "object",
+        "x-telo-ref": "telo#LogSink",
+        "x-telo-inline": true,
+      },
+    },
+  },
+  additionalProperties: false,
+};
+
 export const KERNEL_BUILTINS: ResourceDefinition[] = [
   { kind: "Telo.Abstract", metadata: { name: "Template", module: "Telo" } },
   { kind: "Telo.Abstract", metadata: { name: "Runnable", module: "Telo" } },
@@ -34,6 +117,59 @@ export const KERNEL_BUILTINS: ResourceDefinition[] = [
     metadata: { name: "Provider", module: "Telo" },
     schema: { "x-telo-eval": "compile" },
   },
+  // The sink lifecycle role: attach, write a record, flush, detach. Deliberately
+  // payload-opaque — it carries no filtering and no encoding — so a future
+  // `Telo.TraceSink` reuses the same capability with a different record type.
+  // Scoped to record-stream sinks; metrics aggregate rather than stream and are
+  // not covered. See kernel/specs/logging.md §10.
+  { kind: "Telo.Abstract", metadata: { name: "Sink", module: "Telo" } },
+  // The abstract every *log* sink kind extends, carrying the log-specific
+  // configuration. A kernel built-in resolvable without an import, so a sink
+  // author depends on the kernel contract rather than on a standard-library
+  // module version and kernel↔module skew never becomes a compatibility surface
+  // for "where do logs go".
+  {
+    kind: "Telo.Abstract",
+    metadata: { name: "LogSink", module: "Telo" },
+    capability: "Telo.Sink",
+    schema: {
+      type: "object",
+      properties: LOG_SINK_COMMON_PROPERTIES,
+      additionalProperties: true,
+    },
+  },
+  {
+    kind: "Telo.Definition",
+    metadata: { name: "ConsoleSink", module: "Telo" },
+    capability: "Telo.Sink",
+    extends: "Telo.LogSink",
+    schema: {
+      type: "object",
+      properties: {
+        ...LOG_SINK_COMMON_PROPERTIES,
+        destination: { type: "string", enum: ["stderr", "stdout"] },
+        encoding: { type: "string", enum: ["auto", "pretty", "json"] },
+        color: { type: "string", enum: ["auto", "always", "never"] },
+      },
+      additionalProperties: false,
+    },
+  },
+  {
+    kind: "Telo.Definition",
+    metadata: { name: "FileSink", module: "Telo" },
+    capability: "Telo.Sink",
+    extends: "Telo.LogSink",
+    schema: {
+      type: "object",
+      properties: {
+        ...LOG_SINK_COMMON_PROPERTIES,
+        destination: { type: "string" },
+        encoding: { type: "string", enum: ["json", "pretty"] },
+      },
+      required: ["destination"],
+      additionalProperties: false,
+    },
+  },
   {
     kind: "Telo.Definition",
     metadata: { name: "Abstract", module: "Telo" },
@@ -273,6 +409,7 @@ export const KERNEL_BUILTINS: ResourceDefinition[] = [
             { type: "array", items: { type: "string" } },
           ],
         },
+        logging: IMPORT_LOGGING_SCHEMA,
       },
       required: ["metadata", "source"],
       additionalProperties: false,
@@ -431,6 +568,11 @@ export const KERNEL_BUILTINS: ResourceDefinition[] = [
                       { type: "array", items: { type: "string" } },
                     ],
                   },
+                  // Threshold / redaction / sampling override for this import's
+                  // subtree. Attached to the import rather than to a map keyed
+                  // by module name because an alias is already uniqueness-
+                  // enforced, while module names collide (§12.2, D9).
+                  logging: IMPORT_LOGGING_SCHEMA,
                 },
                 additionalProperties: false,
               },
@@ -500,6 +642,11 @@ export const KERNEL_BUILTINS: ResourceDefinition[] = [
             additionalProperties: false,
           },
         },
+        // Structured logging configuration. The manifest is the only
+        // configuration source — there is no TELO_LOG_* variable and no logging
+        // CLI flag — so a level derived from the host environment goes through a
+        // `variables:` entry read with `!cel`. See kernel/specs/logging.md §12.
+        logging: ROOT_LOGGING_SCHEMA,
       },
       required: ["metadata"],
       additionalProperties: false,
@@ -565,6 +712,11 @@ export const KERNEL_BUILTINS: ResourceDefinition[] = [
                       { type: "array", items: { type: "string" } },
                     ],
                   },
+                  // Threshold / redaction / sampling override for this import's
+                  // subtree. Attached to the import rather than to a map keyed
+                  // by module name because an alias is already uniqueness-
+                  // enforced, while module names collide (§12.2, D9).
+                  logging: IMPORT_LOGGING_SCHEMA,
                 },
                 additionalProperties: false,
               },

package/src/import-resolution-diagnostics.ts

@@ -0,0 +1,66 @@
+import type { GraphLoadError, LoadedGraph } from "./loaded-types.js";
+import { isLocalPathSource } from "./sources/local-path-ref.js";
+import { isRegistryRef } from "./sources/module-ref.js";
+import { isOciRef } from "./sources/oci-ref.js";
+import { DiagnosticSeverity, type AnalysisDiagnostic } from "./types.js";
+
+const SOURCE = "telo-analyzer";
+
+/** True when `source` is a shape some transport claims — a registry ref, an OCI
+ *  ref, an HTTP(S) URL, or a relative/absolute path. A source matching none of
+ *  these is malformed (no transport can ever resolve it), which we report
+ *  differently from a well-formed ref that simply failed to fetch. */
+function isRecognizedSourceShape(source: string): boolean {
+  return (
+    isRegistryRef(source) ||
+    isOciRef(source) ||
+    source.startsWith("http://") ||
+    source.startsWith("https://") ||
+    isLocalPathSource(source)
+  );
+}
+
+function messageFor(e: GraphLoadError, malformed: boolean): string {
+  const authored = e.source ?? e.url;
+  const via = e.alias ? `import '${e.alias}' → '${authored}'` : `'${authored}'`;
+  if (malformed) {
+    return (
+      `Cannot resolve ${via}: not a recognized module reference. Expected ` +
+      `'namespace/name@version', 'oci://host/repo@tag', 'https://…', or a relative path.`
+    );
+  }
+  return `Cannot resolve ${via}: ${e.error.message}`;
+}
+
+/**
+ * Convert a graph's import-resolution failures (`graph.errors`) into structured,
+ * coded diagnostics. This is the single source of truth for surfacing a broken
+ * import — every host (CLI, VS Code, telo-editor) routes these instead of each
+ * re-deriving the channel and drifting (the VS Code extension used to drop it
+ * entirely, showing nothing for a broken import).
+ *
+ * The analyzer owns only this raw channel conversion; the *presentation* policy
+ * — which analysis cascade to hold back for a compromised file — lives in
+ * `@telorun/ide-support`'s `assembleGraphDiagnostics`.
+ *
+ * Each diagnostic adopts the same `data` shape as version-reconciliation
+ * diagnostics — `{ filePath, path: "imports.<alias>" }` — so the shared
+ * `findPositions` / `resolveRange` routing anchors it on the offending import
+ * line with no host-specific code.
+ */
+export function importResolutionDiagnostics(graph: LoadedGraph): AnalysisDiagnostic[] {
+  return graph.errors.map((e) => {
+    const filePath = e.fromSource ?? graph.entry.owner.source;
+    const malformed = !isRecognizedSourceShape(e.source ?? e.url);
+    const data: { filePath: string; path?: string; sourceLine?: number } = { filePath };
+    if (e.alias) data.path = `imports.${e.alias}`;
+    if (e.sourceLine !== undefined) data.sourceLine = e.sourceLine;
+    return {
+      severity: DiagnosticSeverity.Error,
+      code: malformed ? "INVALID_IMPORT_SOURCE" : "IMPORT_UNRESOLVED",
+      source: SOURCE,
+      message: messageFor(e, malformed),
+      data,
+    };
+  });
+}

package/src/index.ts

@@ -1,6 +1,7 @@
 export { AnalysisRegistry } from "./analysis-registry.js";
 export type { RefFieldInfo } from "./analysis-registry.js";
 export { StaticAnalyzer } from "./analyzer.js";
+export { importResolutionDiagnostics } from "./import-resolution-diagnostics.js";
 export type {
     GraphLoadError,
     ImportEdge,
@@ -33,6 +34,12 @@ export {
   resolveParent,
 } from "./extends-resolution.js";
 export type { DefResolver } from "./extends-resolution.js";
+export {
+  hasIntermediateWildcard,
+  parseRedactionPath,
+  RedactionPathError,
+} from "./redaction-path.js";
+export type { RedactionSegment } from "./redaction-path.js";
 export { buildReferenceFieldMap, isRefEntry, isScopeEntry } from "./reference-field-map.js";
 export type { ReferenceFieldMap, RefFieldEntry } from "./reference-field-map.js";
 export { visitManifest } from "./manifest-visitor.js";
@@ -78,6 +85,7 @@ export { parseModuleRef, isRegistryRef } from "./sources/module-ref.js";
 export type { ParsedModuleRef } from "./sources/module-ref.js";
 export { OCI_SCHEME, isOciRef, parseOciRef } from "./sources/oci-ref.js";
 export type { ParsedOciRef } from "./sources/oci-ref.js";
+export { isLocalPathSource } from "./sources/local-path-ref.js";
 export {
   MANIFEST_CACHE_BASE_URL,
   ManifestCacheSource,

package/src/inline-imports.ts

@@ -55,6 +55,7 @@ export function inlineImportManifests(
       ...(entry.variables !== undefined ? { variables: entry.variables } : {}),
       ...(entry.secrets !== undefined ? { secrets: entry.secrets } : {}),
       ...(entry.runtime !== undefined ? { runtime: entry.runtime } : {}),
+      ...(entry.logging !== undefined ? { logging: entry.logging } : {}),
     } as unknown as ResourceManifest;
 
     out.push({ manifest, position: synthPosition(modulePosition, alias, scalar) });

package/src/loaded-types.ts

@@ -96,9 +96,20 @@ export interface LoadedGraph {
 }
 
 export interface GraphLoadError {
-  /** URL of the file that failed to load. */
+  /** URL of the file that failed to load (resolved — may be a `file://` URL for
+   *  a relative import). */
   url: string;
+  /** The import source string exactly as authored (`./lib`, `std/x@1.0.0`),
+   *  before relative-path resolution. Preferred over `url` for classification
+   *  and display, so a diagnostic quotes what the author wrote. */
+  source?: string;
   /** Source of the import that triggered the load, or null for the entry. */
   fromSource: string | null;
+  /** Import alias the failed source was bound to in `fromSource`'s `imports:`
+   *  map, when the failure is a transitive import (absent for an entry-load
+   *  failure). Lets a consumer anchor the diagnostic at `imports.<alias>`. */
+  alias?: string;
+  /** Line of the `Telo.Import` doc in `fromSource`, for position fallback. */
+  sourceLine?: number;
   error: Error;
 }

package/src/manifest-loader.ts

@@ -258,7 +258,10 @@ export class Loader {
           } catch (err) {
             errors.push({
               url: importSource,
+              source: importSource,
               fromSource: file.source,
+              alias,
+              sourceLine,
               error: err instanceof Error ? err : new Error(String(err)),
             });
             continue;
@@ -284,7 +287,14 @@ export class Loader {
             } catch (err) {
               const e = err instanceof Error ? err : new Error(String(err));
               (e as { sourceLine?: number }).sourceLine = sourceLine;
-              errors.push({ url: resolvedTarget, fromSource: file.source, error: e });
+              errors.push({
+                url: resolvedTarget,
+                source: importSource,
+                fromSource: file.source,
+                alias,
+                sourceLine,
+                error: e,
+              });
               continue;
             }
           }

package/src/normalize-inline-resources.ts

@@ -10,6 +10,21 @@ const SYSTEM_KINDS = new Set([
   "Telo.Import",
 ]);
 
+/**
+ * System kinds are excluded from inline extraction by default, but a single slot
+ * may opt back in with `x-telo-inline: true` — `Telo.Application.logging.sinks`
+ * is the case this exists for.
+ *
+ * The opt-in is per slot rather than per kind because this pass runs *upstream*
+ * of schema validation on both the analyzer and runtime paths. Admitting the
+ * whole Application document would rewrite an inline `{kind, ...}` in `targets`
+ * into a valid `{kind, name}` before AJV ever saw it, silently converting a
+ * deliberate rejection into a working feature.
+ */
+function acceptsInline(resourceKind: string, entry: { inline?: boolean }): boolean {
+  return !SYSTEM_KINDS.has(resourceKind) || entry.inline === true;
+}
+
 /** Replaces characters outside [a-zA-Z0-9_] with underscores. */
 function sanitizeName(raw: string): string {
   return raw.replace(/[^a-zA-Z0-9_]/g, "_");
@@ -65,9 +80,12 @@ export function normalizeInlineResources(
 
   // Queue: all non-system resources with a name. Extracted resources are appended.
   // Filter the CLONES (not the originals) so traversal mutates copies.
+  // System kinds join the queue too: their inline-accepting slots are filtered
+  // per entry below, so a system document is walked but only its opted-in slots
+  // are extracted from.
   const queue = result.filter(
     (r): r is ResourceManifest & { metadata: { name: string } } =>
-      typeof r.metadata?.name === "string" && !!r.kind && !SYSTEM_KINDS.has(r.kind),
+      typeof r.metadata?.name === "string" && !!r.kind,
   );
 
   let i = 0;
@@ -97,6 +115,7 @@ export function normalizeInlineResources(
 
     for (const [fieldPath, entry] of fieldMap) {
       if (!isRefEntry(entry)) continue;
+      if (!acceptsInline(resource.kind, entry)) continue;
 
       const inScope = scopePrefixes.some(
         (prefix) =>

package/src/redaction-path.ts

@@ -0,0 +1,142 @@
+/**
+ * The redaction path grammar of `kernel/specs/logging.md` §14 — a hand-written
+ * parser over a closed grammar.
+ *
+ * §14.1 makes this a security requirement rather than a style preference. The
+ * implementation this syntax is borrowed from compiles paths through the
+ * `Function` constructor and validates them by "evaluate it and see whether it
+ * parses", which is exactly why that implementation must forbid user input. A
+ * real parser removes the injection surface entirely and, as a bonus, makes
+ * paths statically checkable by `telo check`.
+ *
+ * Browser-safe by construction: this module is imported by both the analyzer's
+ * static check and the kernel's runtime redaction pass, so the grammar has one
+ * definition rather than two that can drift.
+ *
+ * Grammar:
+ *
+ *     path     := segment ( "." segment | bracket )*
+ *     segment  := bareKey | "*"
+ *     bracket  := "[" ( quoted | integer | "*" ) "]"
+ *     quoted   := '"' ... '"' | "'" ... "'"
+ *
+ * More than one wildcard per path is supported — `items[*].tokens[*].value` is
+ * valid. The one-wildcard limit in the best-known implementation is an artifact
+ * of how it compiles accessors, not a property of the grammar.
+ */
+
+export type RedactionSegment = { kind: "key"; name: string } | { kind: "wildcard" };
+
+export class RedactionPathError extends Error {
+  readonly code = "INVALID_REDACTION_PATH";
+  readonly path: string;
+  readonly offset: number;
+
+  constructor(path: string, offset: number, detail: string) {
+    super(`Invalid redaction path "${path}" at position ${offset}: ${detail}`);
+    this.name = "RedactionPathError";
+    this.path = path;
+    this.offset = offset;
+  }
+}
+
+const BARE_KEY_TERMINATORS = new Set([".", "[", "]"]);
+
+/**
+ * Parse a redaction path into its segments. Throws {@link RedactionPathError}
+ * with the offending offset so `telo check` can point at the character rather
+ * than the whole path.
+ */
+export function parseRedactionPath(path: string): RedactionSegment[] {
+  if (path.length === 0) throw new RedactionPathError(path, 0, "path is empty");
+
+  const segments: RedactionSegment[] = [];
+  let index = 0;
+  let expectSegment = true;
+
+  while (index < path.length) {
+    const char = path[index]!;
+
+    if (char === "[") {
+      index = parseBracket(path, index, segments);
+      expectSegment = false;
+      continue;
+    }
+
+    if (char === ".") {
+      if (expectSegment) {
+        throw new RedactionPathError(path, index, "expected a key before '.'");
+      }
+      index += 1;
+      expectSegment = true;
+      continue;
+    }
+
+    if (char === "]") {
+      throw new RedactionPathError(path, index, "unmatched ']'");
+    }
+
+    const start = index;
+    while (index < path.length && !BARE_KEY_TERMINATORS.has(path[index]!)) index += 1;
+    const raw = path.slice(start, index);
+    if (raw.length === 0) throw new RedactionPathError(path, start, "empty key");
+    segments.push(raw === "*" ? { kind: "wildcard" } : { kind: "key", name: raw });
+    expectSegment = false;
+  }
+
+  if (expectSegment) {
+    throw new RedactionPathError(path, path.length, "path ends with a trailing '.'");
+  }
+  return segments;
+}
+
+function parseBracket(path: string, open: number, segments: RedactionSegment[]): number {
+  let index = open + 1;
+  if (index >= path.length) throw new RedactionPathError(path, open, "unterminated '['");
+
+  const quote = path[index];
+  if (quote === '"' || quote === "'") {
+    index += 1;
+    const start = index;
+    while (index < path.length && path[index] !== quote) index += 1;
+    if (index >= path.length) {
+      throw new RedactionPathError(path, start, `unterminated ${quote} quoted key`);
+    }
+    const name = path.slice(start, index);
+    if (name.length === 0) throw new RedactionPathError(path, start, "empty quoted key");
+    index += 1;
+    if (path[index] !== "]") {
+      throw new RedactionPathError(path, index, "expected ']' after quoted key");
+    }
+    segments.push({ kind: "key", name });
+    return index + 1;
+  }
+
+  const start = index;
+  while (index < path.length && path[index] !== "]") index += 1;
+  if (index >= path.length) throw new RedactionPathError(path, open, "unterminated '['");
+  const raw = path.slice(start, index);
+  if (raw.length === 0) throw new RedactionPathError(path, start, "empty '[]'");
+  if (raw === "*") {
+    segments.push({ kind: "wildcard" });
+  } else if (/^\d+$/.test(raw)) {
+    segments.push({ kind: "key", name: raw });
+  } else {
+    throw new RedactionPathError(
+      path,
+      start,
+      `expected a quoted key, an integer index, or '*', got "${raw}" — quote it as ["${raw}"]`,
+    );
+  }
+  return index + 1;
+}
+
+/** `true` when the path contains a wildcard anywhere but its last segment.
+ *  §14.2 measures intermediate wildcards at 25–55% over plain serialization,
+ *  against 1–2% for explicit paths, so a runtime may warn when one is used. */
+export function hasIntermediateWildcard(segments: readonly RedactionSegment[]): boolean {
+  for (let i = 0; i < segments.length - 1; i += 1) {
+    if (segments[i]!.kind === "wildcard") return true;
+  }
+  return false;
+}

package/src/reference-field-map.ts

@@ -8,6 +8,18 @@ export interface RefFieldEntry {
   /** x-telo-context schema declared on this ref slot, if any. Describes the CEL invocation
    *  context available to resources placed in this slot. */
   context?: Record<string, any>;
+  /** `x-telo-inline: true` — this slot accepts an inline `{kind, ...config}`
+   *  definition, not only a `!ref`.
+   *
+   *  Only meaningful on the *system* kinds (`Telo.Application` and friends),
+   *  which are otherwise excluded from inline-resource normalization wholesale.
+   *  Ordinary resource kinds accept inline definitions at every ref slot and
+   *  need no annotation. The flag exists so `logging.sinks` can opt in without
+   *  also legalizing an inline definition in `targets`, where the Application
+   *  schema rejects one deliberately — normalization runs upstream of AJV, so
+   *  an unconditional opt-in would rewrite the value into a valid shape before
+   *  the schema ever saw it. */
+  inline?: boolean;
 }
 
 /** An entry for a field that declares an execution scope (x-telo-scope). */
@@ -148,6 +160,13 @@ export function buildReferenceFieldMap(schema: Record<string, any>): ReferenceFi
   return map;
 }
 
+/** `x-telo-inline` declared on any `anyOf` branch marks the whole slot as
+ *  inline-accepting, matching how {@link collectRefs} unions branch refs. */
+function collectInlineFlag(node: Record<string, any>): boolean {
+  if (!Array.isArray(node.anyOf)) return false;
+  return node.anyOf.some((branch: Record<string, any>) => branch?.["x-telo-inline"] === true);
+}
+
 export function collectRefs(node: Record<string, any>): string[] {
   const refs: string[] = [];
   if (typeof node["x-telo-ref"] === "string") {
@@ -212,6 +231,7 @@ function traverseNode(
   if (refs.length > 0) {
     const entry: RefFieldEntry = { refs, isArray: path.includes("[]") };
     if (node["x-telo-context"]) entry.context = node["x-telo-context"] as Record<string, any>;
+    if (node["x-telo-inline"] === true || collectInlineFlag(node)) entry.inline = true;
     map.set(path, entry);
     // A node can mix item-level ref branches (a bare string / `{kind, name}`)
     // with object branches that carry their OWN nested refs — e.g. Application

package/src/schema-compat.ts

@@ -308,6 +308,13 @@ export function celTypeSatisfiesJsonSchema(celType: string, schema: Record<strin
 /** Return a literal placeholder value of the correct schema type for AJV. */
 export function celPlaceholderForSchema(schema: Record<string, any>): unknown {
   if (schema.default !== undefined) return schema.default;
+  // An enum-constrained field needs a placeholder drawn from the enum: the
+  // type-based fallbacks below ("" for a string, 0 for a number) satisfy `type`
+  // but violate `enum`, so a CEL expression feeding any enum field would report
+  // a spurious SCHEMA_VIOLATION against a value the author never wrote. The
+  // member chosen is irrelevant — only its acceptability to AJV matters, since
+  // the real value is checked at runtime once the expression resolves.
+  if (Array.isArray(schema.enum) && schema.enum.length > 0) return schema.enum[0];
   switch (schema.type) {
     case "integer":
     case "number":

package/src/sources/local-path-ref.ts

@@ -0,0 +1,5 @@
+/** True when `source` names an on-disk sibling manifest — a relative (`./`,
+ *  `../`) or absolute (`/`) path — rather than a transport-owned remote ref. */
+export function isLocalPathSource(source: string): boolean {
+  return source.startsWith(".") || source.startsWith("/");
+}

package/src/validate-extends.ts

@@ -29,6 +29,9 @@ const EXTENDS_ALIAS_RE = /^[A-Z][A-Za-z0-9_]*\.[A-Z][A-Za-z0-9_]*$/;
  *    (metadata.module !== "Telo"). Builtin lifecycle capabilities (Telo.Invocable, etc.)
  *    never trigger this — they're lifecycle roles by design.
  */
+/** The built-in namespace, resolvable without a `Telo.Import`. */
+const TELO_BUILTIN_ALIAS = "Telo";
+
 export function validateExtends(
   manifests: ResourceManifest[],
   registry: DefinitionRegistry,
@@ -88,7 +91,11 @@ export function validateExtends(
         });
       } else {
         const prefix = extendsValue.slice(0, extendsValue.indexOf("."));
-        if (!aliases.hasAlias(prefix)) {
+        // `Telo` needs no import: the kernel built-ins are globally resolvable
+        // by design, which is what lets a sink author depend on the kernel
+        // contract (`extends: Telo.LogSink`) rather than on a standard-library
+        // module version — see kernel/specs/logging.md §10.2.
+        if (prefix !== TELO_BUILTIN_ALIAS && !aliases.hasAlias(prefix)) {
           diagnostics.push({
             severity: DiagnosticSeverity.Error,
             code: "EXTENDS_MALFORMED",