@telorun/analyzer 0.67.0 → 0.68.0

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAiBzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AA8B9B,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAWvF,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAwDjE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAkG/F;0CAC0C;AAC1C,eAAO,MAAM,eAAe,GAAI,OAAO;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OACT,CAAC;AAErD;8EAC8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhD;AAqUD,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACtC;AA6DD,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAkFD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IA+6DvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAyBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAiBzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AA8B9B,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAWvF,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AA4DjE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAkG/F;0CAC0C;AAC1C,eAAO,MAAM,eAAe,GAAI,OAAO;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OACT,CAAC;AAErD;8EAC8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhD;AAqUD,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACtC;AA6DD,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAkFD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAq8DvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAyBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -37,6 +37,7 @@ import { analyzerPeerBinder, analyzerPeersTarget } from "./peer-binding.js";
 import { describeProjectionFailure, manifestListScope, resolveSchemaProjections, } from "./schema-projection.js";
 import { validateDynamicSelectors, validateRefSlotDeclarations, } from "./validate-ref-slots.js";
 import { validateValueTypeSlots, } from "./validate-value-type-slots.js";
+import { validateSensitiveSlots, } from "./validate-sensitive-slots.js";
 import { resolveSchemaTypeRefs } from "./resolve-schema-type-refs.js";
 import { validateSchemaTypeRefs } from "./validate-schema-type-refs.js";
 import { rewriteSyntheticOrigins } from "./rewrite-synthetic-origins.js";
@@ -800,10 +801,16 @@ export class StaticAnalyzer {
         // definition's `schema:` does. Same scoping as every other schema issue —
         // the entry's own modules, since a dependency is not the consumer's to fix.
         const valueTypeSlotIssues = [];
+        // `x-telo-sensitive` rides the same walk and the same scoping. It is read by
+        // ONE consumer — the kernel, off a bound contract — so an occurrence outside
+        // `inputType` / `outputType` is inert; for a security control, inert-and-
+        // silent is the failure worth reporting.
+        const sensitiveSlotIssues = [];
         for (const m of manifests) {
             const declaringModule = m.metadata?.module;
             if (!declaringModule || rootModules.has(declaringModule)) {
                 valueTypeSlotIssues.push(...validateValueTypeSlots(m));
+                sensitiveSlotIssues.push(...validateSensitiveSlots(m));
             }
         }
         for (const m of manifests) {
@@ -1020,6 +1027,22 @@ export class StaticAnalyzer {
                     },
                 });
             }
+            for (const issue of sensitiveSlotIssues) {
+                diagnostics.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: issue.code,
+                    source: SOURCE,
+                    message: issue.message,
+                    data: {
+                        resource: {
+                            kind: issue.manifest.kind,
+                            name: issue.manifest.metadata?.name,
+                        },
+                        filePath: issue.manifest.metadata?.source,
+                        path: issue.path,
+                    },
+                });
+            }
             // Same split for the two zone annotations. Unreadable ones fail in
             // OPPOSITE directions — a dropped requirement is silently unenforced, a
             // dropped provision invents failures — so neither can be left to

package/dist/extends-resolution.d.ts

@@ -36,6 +36,26 @@ export declare function inheritedCapability(def: ResourceDefinition | undefined,
  *    `mergeTypeSchemas` that `Type.JsonSchema.extends` uses.
  *  - no `extends` → the own schema unchanged. */
 export declare function effectiveAuthorSchema(def: ResourceDefinition | undefined, resolve: DefResolver): Record<string, any>;
+/**
+ * The fields a merge-form inheriting child publishes over its parent's reading.
+ *
+ * A child that inherits its controller by delegation and declares no `base:` IS
+ * the parent instance, so `resources.<child>` is the parent's `snapshot()` — and
+ * a field the parent has never heard of would be readable from nowhere. These
+ * are exactly those fields: the ones the effective (merged) schema declares that
+ * the controller-bearing ancestor's does not.
+ *
+ * A REDECLARED name is deliberately excluded. Narrowing an inherited field (a
+ * description, a pattern, a widget hint) is ordinary in an additive extension and
+ * says nothing about publication, while the parent's `snapshot()` is the sole
+ * authority on what a parent instance publishes — its normalizations, its
+ * deliberate omissions, and its redactions. Republishing such a field from raw
+ * config would silently undo a provider's decision to keep it out.
+ *
+ * Empty for the `base:` form, whose fields are construction inputs consumed by
+ * the mapping, and for a child with its own controller, which publishes itself.
+ */
+export declare function publishedOwnFields(def: ResourceDefinition | undefined, resolve: DefResolver): string[];
 /** The two directions of a kind's invocation contract. `inputType` is what a
  *  caller sends to `invoke()`; `outputType` is what `invoke()` / `provide()`
  *  returns. */

package/dist/extends-resolution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extends-resolution.d.ts","sourceRoot":"","sources":["../src/extends-resolution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAGvD;;;;;;;2DAO2D;AAC3D,MAAM,MAAM,WAAW,GAAG,CACxB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,kBAAkB,KACtB,kBAAkB,GAAG,SAAS,CAAC;AA0BpC;sDACsD;AACtD,wBAAgB,aAAa,CAC3B,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,kBAAkB,GAAG,SAAS,CAIhC;AAED;6EAC6E;AAC7E,wBAAgB,aAAa,CAC3B,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,kBAAkB,EAAE,CAUtB;AAED;iFACiF;AACjF,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,kBAAkB,GAAG,SAAS,GAAG,OAAO,CAUvF;AAED;;mFAEmF;AACnF,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,kBAAkB,GAAG,SAAS,CAMhC;AAED;;sCAEsC;AACtC,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,OAAO,CAGT;AAED;2EAC2E;AAC3E,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,MAAM,GAAG,SAAS,CAMpB;AAED;;;;;;iDAMiD;AACjD,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAOrB;AAED;;eAEe;AACf,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,YAAY,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,iBAAiB,GAC3B,OAAO,CAQT;AAED;;;6BAG6B;AAC7B,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,iBAAiB,GAC3B,kBAAkB,GAAG,SAAS,CAShC;AAED;;;;;8CAK8C;AAC9C,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,iBAAiB,GAC3B,OAAO,CAKT;AAED;;8EAE8E;AAC9E,wBAAgB,eAAe,CAAC,SAAS,EAAE,iBAAiB,GAAG,QAAQ,GAAG,QAAQ,CAEjF;AAED;;;;;;;;;gDASgD;AAChD,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CASjC"}
+{"version":3,"file":"extends-resolution.d.ts","sourceRoot":"","sources":["../src/extends-resolution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAGvD;;;;;;;2DAO2D;AAC3D,MAAM,MAAM,WAAW,GAAG,CACxB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,kBAAkB,KACtB,kBAAkB,GAAG,SAAS,CAAC;AA0BpC;sDACsD;AACtD,wBAAgB,aAAa,CAC3B,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,kBAAkB,GAAG,SAAS,CAIhC;AAED;6EAC6E;AAC7E,wBAAgB,aAAa,CAC3B,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,kBAAkB,EAAE,CAUtB;AAED;iFACiF;AACjF,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,kBAAkB,GAAG,SAAS,GAAG,OAAO,CAUvF;AAED;;mFAEmF;AACnF,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,kBAAkB,GAAG,SAAS,CAMhC;AAED;;sCAEsC;AACtC,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,OAAO,CAGT;AAED;2EAC2E;AAC3E,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,MAAM,GAAG,SAAS,CAMpB;AAED;;;;;;iDAMiD;AACjD,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAOrB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,MAAM,EAAE,CASV;AAED;;eAEe;AACf,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,YAAY,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,iBAAiB,GAC3B,OAAO,CAQT;AAED;;;6BAG6B;AAC7B,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,iBAAiB,GAC3B,kBAAkB,GAAG,SAAS,CAShC;AAED;;;;;8CAK8C;AAC9C,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,iBAAiB,GAC3B,OAAO,CAKT;AAED;;8EAE8E;AAC9E,wBAAgB,eAAe,CAAC,SAAS,EAAE,iBAAiB,GAAG,QAAQ,GAAG,QAAQ,CAEjF;AAED;;;;;;;;;gDASgD;AAChD,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,OAAO,EAAE,WAAW,GACnB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CASjC"}

package/dist/extends-resolution.js

@@ -80,6 +80,35 @@ export function effectiveAuthorSchema(def, resolve) {
     const parentSchema = effectiveAuthorSchema(parent, resolve);
     return mergeTypeSchemas([parentSchema, own]);
 }
+/**
+ * The fields a merge-form inheriting child publishes over its parent's reading.
+ *
+ * A child that inherits its controller by delegation and declares no `base:` IS
+ * the parent instance, so `resources.<child>` is the parent's `snapshot()` — and
+ * a field the parent has never heard of would be readable from nowhere. These
+ * are exactly those fields: the ones the effective (merged) schema declares that
+ * the controller-bearing ancestor's does not.
+ *
+ * A REDECLARED name is deliberately excluded. Narrowing an inherited field (a
+ * description, a pattern, a widget hint) is ordinary in an additive extension and
+ * says nothing about publication, while the parent's `snapshot()` is the sole
+ * authority on what a parent instance publishes — its normalizations, its
+ * deliberate omissions, and its redactions. Republishing such a field from raw
+ * config would silently undo a provider's decision to keep it out.
+ *
+ * Empty for the `base:` form, whose fields are construction inputs consumed by
+ * the mapping, and for a child with its own controller, which publishes itself.
+ */
+export function publishedOwnFields(def, resolve) {
+    if (body(def).base || !isInheritedDelegation(def, resolve))
+        return [];
+    const ancestor = controllerBearingAncestor(def, resolve);
+    if (!ancestor)
+        return [];
+    const inherited = new Set(Object.keys((effectiveAuthorSchema(ancestor, resolve).properties ?? {})));
+    const own = (effectiveAuthorSchema(def, resolve).properties ?? {});
+    return Object.keys(own).filter((name) => !inherited.has(name));
+}
 /**
  * The **nearest declaration** of an invocation contract along the `extends`
  * chain, self first — the raw type-field value, still to be resolved to a schema

package/dist/index.d.ts

@@ -16,9 +16,11 @@ export { applyObservedStateNode, buildObservedStateIndex, buildObservedStateReso
 export type { AnalyzedResource, ObservedStateRead } from "./validate-observed-state.js";
 export { moduleScopedDefResolver, scopeResolverForModule } from "./alias-resolver.js";
 export type { ModuleScopes } from "./alias-resolver.js";
-export { ancestorChain, contractDeclarer, controllerBearingAncestor, effectiveAuthorSchema, effectiveContractField, effectiveStatusSchema, hasOwnControllerOrTemplate, inheritedCapability, isInheritedDelegation, mappingFieldFor, needsContractMapping, resolveParent, } from "./extends-resolution.js";
+export { ancestorChain, contractDeclarer, controllerBearingAncestor, effectiveAuthorSchema, effectiveContractField, effectiveStatusSchema, hasOwnControllerOrTemplate, inheritedCapability, isInheritedDelegation, mappingFieldFor, needsContractMapping, publishedOwnFields, resolveParent, } from "./extends-resolution.js";
 export type { ContractDirection, DefResolver } from "./extends-resolution.js";
-export { defaultBearingPaths, declaredScalarPaths, PERMISSIVE_CONTRACT, resolveContract, resolveContractSchema, withLiveValuesSkipped, } from "./invocation-contract.js";
+export { validateSensitiveSlots } from "./validate-sensitive-slots.js";
+export type { SensitiveSlotIssue } from "./validate-sensitive-slots.js";
+export { defaultBearingPaths, declaredScalarPaths, PERMISSIVE_CONTRACT, resolveContract, resolveContractSchema, sensitivePaths, withLiveValuesSkipped, } from "./invocation-contract.js";
 export type { ContractOrigin, ContractScope, DeclaredScalarForm, DeclaredScalarPath, ResolvedContract, } from "./invocation-contract.js";
 export { hasIntermediateWildcard, parseRedactionPath, RedactionPathError, } from "./redaction-path.js";
 export type { RedactionSegment } from "./redaction-path.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACjF,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,0BAA0B,EAC1B,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,cAAc,EACd,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,SAAS,GACV,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,iCAAiC,EACjC,wBAAwB,EACxB,iBAAiB,EACjB,iCAAiC,EACjC,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACxF,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACtF,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,oBAAoB,EACpB,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7E,YAAY,EACV,qBAAqB,EACrB,SAAS,EACT,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,sBAAsB,EACtB,UAAU,EACV,YAAY,EACZ,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,iBAAiB,EACjB,aAAa,EACb,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,cAAc,EACd,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACzE,YAAY,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,cAAc,EACd,WAAW,EACX,YAAY,EACZ,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACtF,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,aAAa,EACb,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,YAAY,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EACL,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,YAAY,EACZ,UAAU,GACX,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,EACvB,eAAe,EACf,sBAAsB,GACvB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,WAAW,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,gCAAgC,EAChC,qBAAqB,EACrB,aAAa,EACb,uBAAuB,EACvB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,GACzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,gCAAgC,EAChC,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,6BAA6B,EAC7B,KAAK,QAAQ,EACb,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,8BAA8B,GACpC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,UAAU,EACV,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,WAAW,GACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EACL,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,wBAAwB,EACxB,yBAAyB,EACzB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wBAAwB,EAAE,KAAK,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACvG,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,UAAU,GAChB,MAAM,+BAA+B,CAAC;AACvC,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAChG,YAAY,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,YAAY,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC/F,YAAY,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,EACL,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EACL,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACnB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC/E,YAAY,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,WAAW,EACX,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,SAAS,EACT,YAAY,EACZ,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,YAAY,EACV,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,eAAe,EACf,YAAY,EACZ,eAAe,EACf,eAAe,EACf,cAAc,GACf,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAIvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC3E,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAKxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,YAAY,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAGzF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC1F,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC;AACpB,cAAc,uBAAuB,CAAC;AAGtC,cAAc,sBAAsB,CAAC;AAIrC,OAAO,EACL,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AACpC,cAAc,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACjF,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,0BAA0B,EAC1B,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,cAAc,EACd,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,SAAS,GACV,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,iCAAiC,EACjC,wBAAwB,EACxB,iBAAiB,EACjB,iCAAiC,EACjC,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACxF,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACtF,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,YAAY,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7E,YAAY,EACV,qBAAqB,EACrB,SAAS,EACT,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,sBAAsB,EACtB,UAAU,EACV,YAAY,EACZ,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,iBAAiB,EACjB,aAAa,EACb,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,cAAc,EACd,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACzE,YAAY,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,cAAc,EACd,WAAW,EACX,YAAY,EACZ,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACtF,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,aAAa,EACb,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,YAAY,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EACL,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,YAAY,EACZ,UAAU,GACX,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,EACvB,eAAe,EACf,sBAAsB,GACvB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,WAAW,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,gCAAgC,EAChC,qBAAqB,EACrB,aAAa,EACb,uBAAuB,EACvB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,GACzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,gCAAgC,EAChC,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,6BAA6B,EAC7B,KAAK,QAAQ,EACb,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,8BAA8B,GACpC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,UAAU,EACV,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,WAAW,GACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EACL,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,wBAAwB,EACxB,yBAAyB,EACzB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wBAAwB,EAAE,KAAK,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACvG,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,UAAU,GAChB,MAAM,+BAA+B,CAAC;AACvC,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAChG,YAAY,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,YAAY,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC/F,YAAY,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,EACL,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EACL,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACnB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC/E,YAAY,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,WAAW,EACX,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,SAAS,EACT,YAAY,EACZ,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,YAAY,EACV,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,eAAe,EACf,YAAY,EACZ,eAAe,EACf,eAAe,EACf,cAAc,GACf,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAIvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC3E,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAKxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,YAAY,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAGzF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC1F,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC;AACpB,cAAc,uBAAuB,CAAC;AAGtC,cAAc,sBAAsB,CAAC;AAIrC,OAAO,EACL,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AACpC,cAAc,oBAAoB,CAAC"}

package/dist/index.js

@@ -8,8 +8,9 @@ export { BINDINGS_ANNOTATION, bindingContextProperties, bindingDependencies, fin
 export { CEL_RESERVED_WORDS, TYPE_LEVEL_DOC_KINDS, checkName, } from "./identifier-name.js";
 export { applyObservedStateNode, buildObservedStateIndex, buildObservedStateResourcesSchema, collectRunReachableNames, observedStateRead, validateObservedStateDeclarations, OBSERVED_STATE_SCHEMA, } from "./validate-observed-state.js";
 export { moduleScopedDefResolver, scopeResolverForModule } from "./alias-resolver.js";
-export { ancestorChain, contractDeclarer, controllerBearingAncestor, effectiveAuthorSchema, effectiveContractField, effectiveStatusSchema, hasOwnControllerOrTemplate, inheritedCapability, isInheritedDelegation, mappingFieldFor, needsContractMapping, resolveParent, } from "./extends-resolution.js";
-export { defaultBearingPaths, declaredScalarPaths, PERMISSIVE_CONTRACT, resolveContract, resolveContractSchema, withLiveValuesSkipped, } from "./invocation-contract.js";
+export { ancestorChain, contractDeclarer, controllerBearingAncestor, effectiveAuthorSchema, effectiveContractField, effectiveStatusSchema, hasOwnControllerOrTemplate, inheritedCapability, isInheritedDelegation, mappingFieldFor, needsContractMapping, publishedOwnFields, resolveParent, } from "./extends-resolution.js";
+export { validateSensitiveSlots } from "./validate-sensitive-slots.js";
+export { defaultBearingPaths, declaredScalarPaths, PERMISSIVE_CONTRACT, resolveContract, resolveContractSchema, sensitivePaths, withLiveValuesSkipped, } from "./invocation-contract.js";
 export { hasIntermediateWildcard, parseRedactionPath, RedactionPathError, } from "./redaction-path.js";
 export { buildCallGraph, projectToPairs, resourceId } from "./call-graph.js";
 export { buildReferenceFieldMap, isRefEntry, isScopeEntry, satisfiesValueBranch, } from "./reference-field-map.js";

package/dist/invocation-contract.d.ts

@@ -121,6 +121,26 @@ export declare function defaultBearingPaths(schema: Record<string, any>,
  *  declares its defaults behind the reference, and a walk that cannot follow
  *  it would report none, leaving the caller's data shared where a fill lands. */
 resolveRef?: (ref: string) => Record<string, any> | undefined): string[][];
+/** Every path in `schema` the author marked `x-telo-sensitive: true` — the
+ *  values a trace payload must carry as `[redacted]` rather than verbatim.
+ *
+ *  It exists because making a credential a dispatched `Telo.Invocable` turns its
+ *  material into an invoke OUTPUT, and invoke inputs and outputs ride the debug
+ *  wire on every call under `--inspect` — which is every watch session. The
+ *  kernel's substring scrubbing does not reach them: it has one call site, the
+ *  resource-Created event's properties.
+ *
+ *  Declared by the kind that OWNS the contract, so the kernel names no kind and
+ *  any module opts in — the `x-telo-eval` shape. Exempting "an Http.Credential
+ *  result" directly would be kind-knowledge in the kernel, and would stop at
+ *  that one kind while the same token surfaces wherever else a contract carries
+ *  it.
+ *
+ *  Bounded by the schema's declarations exactly as {@link defaultBearingPaths}
+ *  is: a contract marking nothing walks nothing at dispatch. The key is kept and
+ *  only the value replaced, per the logging spec §14 — a payload that silently
+ *  loses a key reads as a value that was never produced. */
+export declare function sensitivePaths(schema: Record<string, any>, resolveRef?: (ref: string) => Record<string, any> | undefined): string[][];
 /** The scalar form a declared node's value takes at runtime. `int64` and
  *  `double` are the two JSON scalars whose runtime representation is NOT decided
  *  by the value that arrives: a CEL integer is a BigInt and a CEL double a JS

package/dist/invocation-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"invocation-contract.d.ts","sourceRoot":"","sources":["../src/invocation-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,kBAAkB,EAAe,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,aAAa,EAA2B,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EACL,KAAK,iBAAiB,EAEtB,KAAK,WAAW,EAEjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,wBAAwB,CAAC;AAEhC,YAAY,EAAE,iBAAiB,EAAE,CAAC;AAElC;;;;;uDAKuD;AACvD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,aAAa,GAAG;IAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAA;CAAE,CAO9F;AAED;;;;;;;;;;;;GAYG;AAEH;;oCAEoC;AACpC,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,MAAM,CAAC;AAEjD,MAAM,WAAW,gBAAgB;IAC/B,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5B,MAAM,EAAE,cAAc,CAAC;IACvB;gFAC4E;IAC5E,UAAU,CAAC,EAAE,kBAAkB,CAAC;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B;;kEAE8D;IAC9D,iBAAiB,EAAE,WAAW,CAAC;IAC/B;;;;;;;;;OASG;IACH,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CAC9E;AAED;;uCAEuC;AACvC,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAGnD,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,iBAAiB,EAC5B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACzC,UAAU,EAAE,kBAAkB,GAAG,SAAS,EAC1C,KAAK,EAAE,aAAa;AACpB;;uBAEuB;AACvB,kBAAkB,CAAC,EAAE,iBAAiB,EAAE,GACvC,gBAAgB,GAAG,SAAS,CAsB9B;AA2BD;;mDAEmD;AACnD,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,iBAAiB,EAC5B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACzC,UAAU,EAAE,kBAAkB,GAAG,SAAS,EAC1C,KAAK,EAAE,aAAa,GACnB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAErB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;AAC3B;;;;6CAI6C;AAC7C,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAC5D,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAErB;AAoFD;;;;;gEAKgE;AAChE,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;AAC3B;;iFAEiF;AACjF,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAC5D,MAAM,EAAE,EAAE,CA+BZ;AAED;;;;;;kCAMkC;AAClC,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEpD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;;;;+DAuB+D;AAC/D,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAC5D,kBAAkB,EAAE,CAoCtB"}
+{"version":3,"file":"invocation-contract.d.ts","sourceRoot":"","sources":["../src/invocation-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,kBAAkB,EAAe,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,aAAa,EAA2B,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EACL,KAAK,iBAAiB,EAEtB,KAAK,WAAW,EAEjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,wBAAwB,CAAC;AAEhC,YAAY,EAAE,iBAAiB,EAAE,CAAC;AAElC;;;;;uDAKuD;AACvD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,aAAa,GAAG;IAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAA;CAAE,CAO9F;AAED;;;;;;;;;;;;GAYG;AAEH;;oCAEoC;AACpC,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,MAAM,CAAC;AAEjD,MAAM,WAAW,gBAAgB;IAC/B,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5B,MAAM,EAAE,cAAc,CAAC;IACvB;gFAC4E;IAC5E,UAAU,CAAC,EAAE,kBAAkB,CAAC;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B;;kEAE8D;IAC9D,iBAAiB,EAAE,WAAW,CAAC;IAC/B;;;;;;;;;OASG;IACH,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CAC9E;AAED;;uCAEuC;AACvC,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAGnD,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,iBAAiB,EAC5B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACzC,UAAU,EAAE,kBAAkB,GAAG,SAAS,EAC1C,KAAK,EAAE,aAAa;AACpB;;uBAEuB;AACvB,kBAAkB,CAAC,EAAE,iBAAiB,EAAE,GACvC,gBAAgB,GAAG,SAAS,CAsB9B;AA2BD;;mDAEmD;AACnD,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,iBAAiB,EAC5B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACzC,UAAU,EAAE,kBAAkB,GAAG,SAAS,EAC1C,KAAK,EAAE,aAAa,GACnB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAErB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;AAC3B;;;;6CAI6C;AAC7C,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAC5D,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAErB;AAoFD;;;;;gEAKgE;AAChE,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;AAC3B;;iFAEiF;AACjF,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAC5D,MAAM,EAAE,EAAE,CA+BZ;AAED;;;;;;;;;;;;;;;;;;4DAkB4D;AAC5D,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAC5D,MAAM,EAAE,EAAE,CA+CZ;AAED;;;;;;kCAMkC;AAClC,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEpD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;;;;+DAuB+D;AAC/D,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAC5D,kBAAkB,EAAE,CAoCtB"}

package/dist/invocation-contract.js

@@ -241,6 +241,80 @@ resolveRef) {
     walk(schema, [], []);
     return out;
 }
+/** Every path in `schema` the author marked `x-telo-sensitive: true` — the
+ *  values a trace payload must carry as `[redacted]` rather than verbatim.
+ *
+ *  It exists because making a credential a dispatched `Telo.Invocable` turns its
+ *  material into an invoke OUTPUT, and invoke inputs and outputs ride the debug
+ *  wire on every call under `--inspect` — which is every watch session. The
+ *  kernel's substring scrubbing does not reach them: it has one call site, the
+ *  resource-Created event's properties.
+ *
+ *  Declared by the kind that OWNS the contract, so the kernel names no kind and
+ *  any module opts in — the `x-telo-eval` shape. Exempting "an Http.Credential
+ *  result" directly would be kind-knowledge in the kernel, and would stop at
+ *  that one kind while the same token surfaces wherever else a contract carries
+ *  it.
+ *
+ *  Bounded by the schema's declarations exactly as {@link defaultBearingPaths}
+ *  is: a contract marking nothing walks nothing at dispatch. The key is kept and
+ *  only the value replaced, per the logging spec §14 — a payload that silently
+ *  loses a key reads as a value that was never produced. */
+export function sensitivePaths(schema, resolveRef) {
+    const out = [];
+    const walk = (node, path, chain) => {
+        if (!node || typeof node !== "object")
+            return;
+        let s = node;
+        if (chain.includes(s))
+            return;
+        if (resolveRef && typeof s.$ref === "string") {
+            const target = resolveRef(s.$ref);
+            if (!target || chain.includes(target))
+                return;
+            s = { ...target, ...s, $ref: undefined };
+        }
+        const here = [...chain, node];
+        // A marked node is redacted WHOLE, so there is nothing below it to mark:
+        // descending would emit paths into a value that is already gone. The EMPTY
+        // path is legal and means the whole value — a contract whose entire output
+        // is the secret is the simplest shape there is, and refusing it silently
+        // (which `path.length > 0` did) left exactly that case unredacted.
+        if (s["x-telo-sensitive"] === true) {
+            out.push(path);
+            return;
+        }
+        const properties = s.properties;
+        if (properties) {
+            for (const [key, child] of Object.entries(properties))
+                walk(child, [...path, key], here);
+        }
+        // A map whose VALUES are secrets — `additionalProperties: {x-telo-sensitive}`
+        // — is the shape a headers or query bag takes, and it carries no property
+        // names to walk. `{}` is the wildcard segment, the `[]` precedent one axis
+        // over.
+        for (const key of ["additionalProperties", "patternProperties"]) {
+            const node = s[key];
+            if (!node || typeof node !== "object")
+                continue;
+            if (key === "additionalProperties")
+                walk(node, [...path, "{}"], here);
+            else
+                for (const child of Object.values(node))
+                    walk(child, [...path, "{}"], here);
+        }
+        for (const branch of ["allOf", "anyOf", "oneOf"]) {
+            const list = s[branch];
+            if (Array.isArray(list))
+                for (const child of list)
+                    walk(child, path, here);
+        }
+        if (s.items)
+            walk(s.items, [...path, "[]"], here);
+    };
+    walk(schema, [], []);
+    return out;
+}
 /** Every path in `schema` whose declared type fixes a scalar representation —
  *  the leaves a value must carry in that form for the contract to be TRUE, not
  *  merely to pass.

package/dist/schema-keywords.d.ts

@@ -26,6 +26,8 @@
  * Browser-safe: no Node built-ins.
  */
 import { X_TELO_TYPE } from "@telorun/sdk";
+/** The one annotation read from a DATA schema rather than a kind schema. */
+declare const X_TELO_SENSITIVE: "x-telo-sensitive";
 import { ANNOTATION_KEYWORDS } from "./value-type-keyword.js";
 /** A keyword entry: the JSON Schema its VALUE must satisfy, carrying the title
  *  and description completion and hover show. */
@@ -64,5 +66,18 @@ export declare function jsonSchemaKeywords(self: string): SchemaKeywords;
  * neither validation nor completion. Closing it needs the walkers to distinguish
  * a schema describing an annotation from an annotation, which nothing does yet.
  */
-export declare const TELO_SCHEMA_ANNOTATIONS: Record<(typeof ANNOTATION_KEYWORDS)[number] | typeof X_TELO_TYPE, Record<string, unknown>>;
+export declare const TELO_SCHEMA_ANNOTATIONS: Record<Exclude<(typeof ANNOTATION_KEYWORDS)[number], typeof X_TELO_SENSITIVE> | typeof X_TELO_TYPE, Record<string, unknown>>;
+/**
+ * Annotations that belong on a DATA schema — an `inputType` / `outputType`
+ * contract — rather than on a kind's own `schema:`.
+ *
+ * Split out because {@link TELO_SCHEMA_ANNOTATIONS} is offered only where the
+ * fragment is `KindSchema`, which is a kind's CONFIGURATION. `x-telo-sensitive`
+ * is read from the opposite place: the kernel resolves it off a bound contract,
+ * which stamps `JsonSchema7`. Offering it from the kind vocabulary alone put it
+ * on the one schema where nothing reads it and withheld it from the two where it
+ * is the whole mechanism.
+ */
+export declare const TELO_DATA_SCHEMA_ANNOTATIONS: Record<typeof X_TELO_SENSITIVE, Record<string, unknown>>;
+export {};
 //# sourceMappingURL=schema-keywords.d.ts.map

package/dist/schema-keywords.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-keywords.d.ts","sourceRoot":"","sources":["../src/schema-keywords.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D;iDACiD;AACjD,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AASrE;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAuJ/D;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAC1C,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,GAAG,OAAO,WAAW,EACzD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAwJxB,CAAC"}
+{"version":3,"file":"schema-keywords.d.ts","sourceRoot":"","sources":["../src/schema-keywords.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,4EAA4E;AAC5E,QAAA,MAAM,gBAAgB,EAAG,kBAA2B,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D;iDACiD;AACjD,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AASrE;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAuJ/D;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAMxC,OAAO,CAAC,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,gBAAgB,CAAC,GACtE,OAAO,WAAW,EACpB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAwJxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,EAAE,MAAM,CAC/C,OAAO,gBAAgB,EACvB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQxB,CAAC"}

package/dist/schema-keywords.js

@@ -25,6 +25,8 @@
  *
  * Browser-safe: no Node built-ins.
  */
+/** The one annotation read from a DATA schema rather than a kind schema. */
+const X_TELO_SENSITIVE = "x-telo-sensitive";
 /** A JSON type name, as `type:` accepts it — one, or a list (`[string, "null"]`,
  *  the spelling `CEL_NULLABLE_ACCESS` guards). */
 const TYPE_NAME = {
@@ -342,3 +344,21 @@ export const TELO_SCHEMA_ANNOTATIONS = {
         type: "string",
     },
 };
+/**
+ * Annotations that belong on a DATA schema — an `inputType` / `outputType`
+ * contract — rather than on a kind's own `schema:`.
+ *
+ * Split out because {@link TELO_SCHEMA_ANNOTATIONS} is offered only where the
+ * fragment is `KindSchema`, which is a kind's CONFIGURATION. `x-telo-sensitive`
+ * is read from the opposite place: the kernel resolves it off a bound contract,
+ * which stamps `JsonSchema7`. Offering it from the kind vocabulary alone put it
+ * on the one schema where nothing reads it and withheld it from the two where it
+ * is the whole mechanism.
+ */
+export const TELO_DATA_SCHEMA_ANNOTATIONS = {
+    [X_TELO_SENSITIVE]: {
+        title: "Sensitive",
+        description: "This value is auth material or equivalent: carry it as `[redacted]` in trace payloads and on the debug wire rather than verbatim. Read only from a resource's declared `inputType` / `outputType`.",
+        type: "boolean",
+    },
+};

package/dist/telo-version.d.ts

@@ -1,3 +1,3 @@
 /** The surface generation this analyzer implements. */
-export declare const TELO_SURFACE_VERSION = "0.83.0";
+export declare const TELO_SURFACE_VERSION = "0.84.0";
 //# sourceMappingURL=telo-version.d.ts.map

package/dist/telo-version.js

@@ -5,4 +5,4 @@
 // its release identity, this is the scale a module's `requires.telo` range is
 // written against, and every kernel in every language reports the same scale.
 /** The surface generation this analyzer implements. */
-export const TELO_SURFACE_VERSION = "0.83.0";
+export const TELO_SURFACE_VERSION = "0.84.0";

package/dist/validate-extends.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-extends.d.ts","sourceRoot":"","sources":["../src/validate-extends.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AA8BzE,wBAAgB,eAAe,CAC7B,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,GACrB,kBAAkB,EAAE,CA4JtB"}
+{"version":3,"file":"validate-extends.d.ts","sourceRoot":"","sources":["../src/validate-extends.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAQnE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAiCzE,wBAAgB,eAAe,CAC7B,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,aAAa,GACrB,kBAAkB,EAAE,CAqMtB"}

package/dist/validate-extends.js

@@ -1,4 +1,4 @@
-import { inheritedCapability } from "./extends-resolution.js";
+import { controllerBearingAncestor, effectiveAuthorSchema, inheritedCapability, isInheritedDelegation, } from "./extends-resolution.js";
 import { DiagnosticSeverity } from "./types.js";
 const SOURCE = "telo-analyzer";
 /** Alias-form pattern for `extends`: "<Alias>.<AbstractName>", two PascalCase segments. */
@@ -19,6 +19,9 @@ const EXTENDS_ALIAS_RE = /^[A-Z][A-Za-z0-9_]*\.[A-Z][A-Za-z0-9_]*$/;
  *  - EXTENDS_UNKNOWN_TARGET: alias resolves to a module, but that module has no
  *    registered definition with the target name.
  *  - EXTENDS_NON_ABSTRACT: target resolves to a Telo.Definition, not a Telo.Abstract.
+ *  - EXTENDS_CLOSED_PARENT_ADDS_FIELD: a child with no `base:` declares a property its
+ *    controller-bearing ancestor's closed schema rejects — the runtime counterpart is a
+ *    create-time failure phrased against the ancestor kind.
  *  - CAPABILITY_SHADOWS_EXTENDS (warning): `capability` names a user-declared abstract
  *    (metadata.module !== "Telo"). Builtin lifecycle capabilities (Telo.Invocable, etc.)
  *    never trigger this — they're lifecycle roles by design.
@@ -140,6 +143,44 @@ export function validateExtends(manifests, registry, aliases) {
                                     data: { resource, filePath, path: "capability" },
                                 });
                             }
+                            // A merge-form child (no `base:`) forwards its WHOLE config to the
+                            // inherited controller as the parent's config, so a field the
+                            // parent's schema closes out is rejected at the parent's own
+                            // create-time validation — phrased against the parent kind, at the
+                            // instance's line, about a resource the author never wrote.
+                            // Reported here instead, at the property that has to change.
+                            if (m.base == null &&
+                                isInheritedDelegation(m, resolveDef)) {
+                                const ancestor = controllerBearingAncestor(m, resolveDef);
+                                const ancestorSchema = ancestor
+                                    ? effectiveAuthorSchema(ancestor, resolveDef)
+                                    : undefined;
+                                if (ancestorSchema?.additionalProperties === false) {
+                                    const inherited = new Set(Object.keys(ancestorSchema.properties ?? {}));
+                                    const ownProps = (m
+                                        .schema?.properties ?? {});
+                                    const ancestorKind = `${ancestor?.metadata.module}.${ancestor?.metadata.name}`;
+                                    for (const prop of Object.keys(ownProps)) {
+                                        if (inherited.has(prop))
+                                            continue;
+                                        diagnostics.push({
+                                            severity: DiagnosticSeverity.Error,
+                                            code: "EXTENDS_CLOSED_PARENT_ADDS_FIELD",
+                                            source: SOURCE,
+                                            message: `${label}: declares '${prop}', but '${ancestorKind}' closes its schema ` +
+                                                `(additionalProperties: false) and a child without 'base:' forwards its whole ` +
+                                                `config as that kind's config — so '${prop}' is rejected when the resource is ` +
+                                                `created. Add a 'base:' mapping, which makes this kind's fields construction ` +
+                                                `inputs and builds the parent's config explicitly.`,
+                                            data: {
+                                                resource,
+                                                filePath,
+                                                path: `schema.properties.${prop}`,
+                                            },
+                                        });
+                                    }
+                                }
+                            }
                         }
                     }
                 }

package/dist/validate-sensitive-slots.d.ts

@@ -0,0 +1,28 @@
+import type { ResourceManifest } from "@telorun/sdk";
+/**
+ * `x-telo-sensitive` where nothing reads it.
+ *
+ * The annotation has exactly one consumer: the kernel resolves it from a
+ * resource's bound CONTRACT — `inputType` / `outputType` — and carries the
+ * marked value as `[redacted]` in trace payloads. Written anywhere else it is an
+ * unknown keyword in an open schema, which is to say it validates, ships, and
+ * does nothing.
+ *
+ * For a security control that is the worst available failure: an author marks a
+ * token, sees no error, and puts it on the debug wire anyway. So a misplacement
+ * is reported rather than ignored — the same posture `X_TELO_REF_UNRESOLVED`
+ * takes toward a reference constraint that resolves to nothing, and for the same
+ * reason: silence reads as protection.
+ *
+ * Scoped by the caller to the entry's own modules, since a dependency's schema
+ * is not the consumer's to fix.
+ */
+export interface SensitiveSlotIssue {
+    code: "SENSITIVE_ANNOTATION_MISPLACED" | "SENSITIVE_ANNOTATION_INVALID";
+    manifest: ResourceManifest;
+    /** Dotted path to the annotated schema node. */
+    path: string;
+    message: string;
+}
+export declare function validateSensitiveSlots(manifest: ResourceManifest): SensitiveSlotIssue[];
+//# sourceMappingURL=validate-sensitive-slots.d.ts.map

package/dist/validate-sensitive-slots.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-sensitive-slots.d.ts","sourceRoot":"","sources":["../src/validate-sensitive-slots.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,gCAAgC,GAAG,8BAA8B,CAAC;IACxE,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAOD,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,kBAAkB,EAAE,CAqDvF"}

package/dist/validate-sensitive-slots.js

@@ -0,0 +1,75 @@
+import { SCHEMA_REGION_KEYS } from "./schema-region.js";
+const ANNOTATION = "x-telo-sensitive";
+/** The only regions the kernel reads the annotation from. */
+const CONTRACT_KEYS = new Set(["inputType", "outputType"]);
+export function validateSensitiveSlots(manifest) {
+    const issues = [];
+    const walk = (node, path, seen) => {
+        if (!node || typeof node !== "object")
+            return;
+        if (seen.has(node))
+            return;
+        seen.add(node);
+        if (Array.isArray(node)) {
+            node.forEach((child, i) => walk(child, [...path, i], seen));
+            return;
+        }
+        const record = node;
+        if (Object.hasOwn(record, ANNOTATION)) {
+            const dotted = path.join(".");
+            if (record[ANNOTATION] !== true) {
+                issues.push({
+                    code: "SENSITIVE_ANNOTATION_INVALID",
+                    manifest,
+                    path: dotted,
+                    message: `'${ANNOTATION}' must be \`true\`; got ${JSON.stringify(record[ANNOTATION])}. ` +
+                        `It is a marker, not a level — a value other than \`true\` reads as "not sensitive".`,
+                });
+            }
+            else {
+                const region = enclosingSchemaRegion(path);
+                if (region === undefined || !CONTRACT_KEYS.has(region)) {
+                    issues.push({
+                        code: "SENSITIVE_ANNOTATION_MISPLACED",
+                        manifest,
+                        path: dotted,
+                        message: `'${ANNOTATION}' is only read from a resource's declared contract ` +
+                            `(\`inputType\` / \`outputType\`), and this node is ` +
+                            (region === undefined
+                                ? "not inside a schema at all"
+                                : `inside \`${region}\``) +
+                            `. The kernel will not redact it, so the value would still reach trace ` +
+                            `payloads and the debug wire. Move the mark onto the contract property ` +
+                            `that carries the value.`,
+                    });
+                }
+            }
+        }
+        for (const [key, child] of Object.entries(record)) {
+            walk(child, [...path, key], seen);
+        }
+    };
+    walk(manifest, [], new Set());
+    return issues;
+}
+/**
+ * The OUTERMOST segment naming a schema-valued key, or `undefined` when the node
+ * is not inside a schema.
+ *
+ * Outermost, not nearest, because a contract is routinely written in the inline
+ * `{kind: Telo.JsonSchema, schema: …}` form — so the path to a marked property is
+ * `outputType.schema.properties.headers`, and the nearest region key is that
+ * wrapper's own `schema`. Reading it as a kind's configuration would report every
+ * correctly-marked contract as misplaced, which is how this check first behaved.
+ *
+ * It is the same reasoning `expandManifestFragments` uses when it keys on the
+ * top-level slot: the object a contract resolver is handed is the one under
+ * `inputType` / `outputType`, whatever nesting the authoring form adds beneath.
+ */
+function enclosingSchemaRegion(path) {
+    for (const segment of path) {
+        if (typeof segment === "string" && SCHEMA_REGION_KEYS.includes(segment))
+            return segment;
+    }
+    return undefined;
+}

package/dist/value-type-keyword.d.ts

@@ -28,7 +28,7 @@ import type { KeywordDefinition } from "ajv";
  *
  * `x-telo-type` is deliberately absent — it is the one that emits code.
  */
-export declare const ANNOTATION_KEYWORDS: readonly ["x-telo-bindings-from", "x-telo-catches-for", "x-telo-context", "x-telo-context-collection-from", "x-telo-context-element-from", "x-telo-context-from", "x-telo-context-from-ref-kind", "x-telo-context-from-root", "x-telo-context-ref-from", "x-telo-error-context", "x-telo-eval", "x-telo-inline", "x-telo-outcome-list", "x-telo-provides-zone", "x-telo-ref", "x-telo-requires-zone", "x-telo-resource-rules", "x-telo-schema-from", "x-telo-schema-map", "x-telo-schema-projection", "x-telo-schema-projection-from", "x-telo-scope", "x-telo-step-context", "x-telo-topology-role", "x-telo-value-schema-from", "x-telo-widget"];
+export declare const ANNOTATION_KEYWORDS: readonly ["x-telo-bindings-from", "x-telo-catches-for", "x-telo-context", "x-telo-context-collection-from", "x-telo-context-element-from", "x-telo-context-from", "x-telo-context-from-ref-kind", "x-telo-context-from-root", "x-telo-context-ref-from", "x-telo-error-context", "x-telo-eval", "x-telo-inline", "x-telo-outcome-list", "x-telo-provides-zone", "x-telo-ref", "x-telo-requires-zone", "x-telo-resource-rules", "x-telo-schema-from", "x-telo-schema-map", "x-telo-schema-projection", "x-telo-schema-projection-from", "x-telo-scope", "x-telo-sensitive", "x-telo-step-context", "x-telo-topology-role", "x-telo-value-schema-from", "x-telo-widget"];
 /**
  * The `x-telo-type` keyword.
  *

package/dist/value-type-keyword.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"value-type-keyword.d.ts","sourceRoot":"","sources":["../src/value-type-keyword.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;+EAqB+E;AAG/E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,KAAK,CAAC;AAiB7C;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,onBA2BtB,CAAC;AAEX;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,IAAI,iBAAiB,CA+BpD;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE;IACxC,UAAU,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC;CACzD,GAAG,IAAI,CAGP"}
+{"version":3,"file":"value-type-keyword.d.ts","sourceRoot":"","sources":["../src/value-type-keyword.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;+EAqB+E;AAG/E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,KAAK,CAAC;AAiB7C;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,woBA4BtB,CAAC;AAEX;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,IAAI,iBAAiB,CA+BpD;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE;IACxC,UAAU,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC;CACzD,GAAG,IAAI,CAGP"}

package/dist/value-type-keyword.js

@@ -54,6 +54,7 @@ export const ANNOTATION_KEYWORDS = [
     "x-telo-schema-projection",
     "x-telo-schema-projection-from",
     "x-telo-scope",
+    "x-telo-sensitive",
     "x-telo-step-context",
     "x-telo-topology-role",
     "x-telo-value-schema-from",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.67.0",
+  "version": "0.68.0",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",

package/src/analyzer.ts

@@ -108,6 +108,10 @@ import {
   validateValueTypeSlots,
   type ValueTypeSlotIssue,
 } from "./validate-value-type-slots.js";
+import {
+  validateSensitiveSlots,
+  type SensitiveSlotIssue,
+} from "./validate-sensitive-slots.js";
 import { resolveSchemaTypeRefs } from "./resolve-schema-type-refs.js";
 import { validateSchemaTypeRefs } from "./validate-schema-type-refs.js";
 import { rewriteSyntheticOrigins } from "./rewrite-synthetic-origins.js";
@@ -979,10 +983,16 @@ export class StaticAnalyzer {
     // definition's `schema:` does. Same scoping as every other schema issue —
     // the entry's own modules, since a dependency is not the consumer's to fix.
     const valueTypeSlotIssues: ValueTypeSlotIssue[] = [];
+    // `x-telo-sensitive` rides the same walk and the same scoping. It is read by
+    // ONE consumer — the kernel, off a bound contract — so an occurrence outside
+    // `inputType` / `outputType` is inert; for a security control, inert-and-
+    // silent is the failure worth reporting.
+    const sensitiveSlotIssues: SensitiveSlotIssue[] = [];
     for (const m of manifests) {
       const declaringModule = (m.metadata as { module?: string } | undefined)?.module;
       if (!declaringModule || rootModules.has(declaringModule)) {
         valueTypeSlotIssues.push(...validateValueTypeSlots(m as unknown as ResourceManifest));
+        sensitiveSlotIssues.push(...validateSensitiveSlots(m as unknown as ResourceManifest));
       }
     }
     for (const m of manifests) {
@@ -1212,6 +1222,22 @@ export class StaticAnalyzer {
           },
         });
       }
+      for (const issue of sensitiveSlotIssues) {
+        diagnostics.push({
+          severity: DiagnosticSeverity.Error,
+          code: issue.code,
+          source: SOURCE,
+          message: issue.message,
+          data: {
+            resource: {
+              kind: issue.manifest.kind,
+              name: issue.manifest.metadata?.name as string,
+            },
+            filePath: (issue.manifest.metadata as { source?: string } | undefined)?.source,
+            path: issue.path,
+          },
+        });
+      }
       // Same split for the two zone annotations. Unreadable ones fail in
       // OPPOSITE directions — a dropped requirement is silently unenforced, a
       // dropped provision invents failures — so neither can be left to

package/src/extends-resolution.ts

@@ -137,6 +137,39 @@ export function effectiveAuthorSchema(
   return mergeTypeSchemas([parentSchema, own]) as Record<string, any>;
 }
 
+/**
+ * The fields a merge-form inheriting child publishes over its parent's reading.
+ *
+ * A child that inherits its controller by delegation and declares no `base:` IS
+ * the parent instance, so `resources.<child>` is the parent's `snapshot()` — and
+ * a field the parent has never heard of would be readable from nowhere. These
+ * are exactly those fields: the ones the effective (merged) schema declares that
+ * the controller-bearing ancestor's does not.
+ *
+ * A REDECLARED name is deliberately excluded. Narrowing an inherited field (a
+ * description, a pattern, a widget hint) is ordinary in an additive extension and
+ * says nothing about publication, while the parent's `snapshot()` is the sole
+ * authority on what a parent instance publishes — its normalizations, its
+ * deliberate omissions, and its redactions. Republishing such a field from raw
+ * config would silently undo a provider's decision to keep it out.
+ *
+ * Empty for the `base:` form, whose fields are construction inputs consumed by
+ * the mapping, and for a child with its own controller, which publishes itself.
+ */
+export function publishedOwnFields(
+  def: ResourceDefinition | undefined,
+  resolve: DefResolver,
+): string[] {
+  if (body(def).base || !isInheritedDelegation(def, resolve)) return [];
+  const ancestor = controllerBearingAncestor(def, resolve);
+  if (!ancestor) return [];
+  const inherited = new Set(
+    Object.keys((effectiveAuthorSchema(ancestor, resolve).properties ?? {}) as object),
+  );
+  const own = (effectiveAuthorSchema(def, resolve).properties ?? {}) as Record<string, unknown>;
+  return Object.keys(own).filter((name) => !inherited.has(name));
+}
+
 /** The two directions of a kind's invocation contract. `inputType` is what a
  *  caller sends to `invoke()`; `outputType` is what `invoke()` / `provide()`
  *  returns. */

package/src/index.ts

@@ -84,15 +84,19 @@ export {
   isInheritedDelegation,
   mappingFieldFor,
   needsContractMapping,
+  publishedOwnFields,
   resolveParent,
 } from "./extends-resolution.js";
 export type { ContractDirection, DefResolver } from "./extends-resolution.js";
+export { validateSensitiveSlots } from "./validate-sensitive-slots.js";
+export type { SensitiveSlotIssue } from "./validate-sensitive-slots.js";
 export {
   defaultBearingPaths,
   declaredScalarPaths,
   PERMISSIVE_CONTRACT,
   resolveContract,
   resolveContractSchema,
+  sensitivePaths,
   withLiveValuesSkipped,
 } from "./invocation-contract.js";
 export type {

package/src/invocation-contract.ts

@@ -334,6 +334,77 @@ export function defaultBearingPaths(
   return out;
 }
 
+/** Every path in `schema` the author marked `x-telo-sensitive: true` — the
+ *  values a trace payload must carry as `[redacted]` rather than verbatim.
+ *
+ *  It exists because making a credential a dispatched `Telo.Invocable` turns its
+ *  material into an invoke OUTPUT, and invoke inputs and outputs ride the debug
+ *  wire on every call under `--inspect` — which is every watch session. The
+ *  kernel's substring scrubbing does not reach them: it has one call site, the
+ *  resource-Created event's properties.
+ *
+ *  Declared by the kind that OWNS the contract, so the kernel names no kind and
+ *  any module opts in — the `x-telo-eval` shape. Exempting "an Http.Credential
+ *  result" directly would be kind-knowledge in the kernel, and would stop at
+ *  that one kind while the same token surfaces wherever else a contract carries
+ *  it.
+ *
+ *  Bounded by the schema's declarations exactly as {@link defaultBearingPaths}
+ *  is: a contract marking nothing walks nothing at dispatch. The key is kept and
+ *  only the value replaced, per the logging spec §14 — a payload that silently
+ *  loses a key reads as a value that was never produced. */
+export function sensitivePaths(
+  schema: Record<string, any>,
+  resolveRef?: (ref: string) => Record<string, any> | undefined,
+): string[][] {
+  const out: string[][] = [];
+
+  const walk = (node: unknown, path: string[], chain: readonly object[]): void => {
+    if (!node || typeof node !== "object") return;
+    let s = node as Record<string, any>;
+    if (chain.includes(s)) return;
+    if (resolveRef && typeof s.$ref === "string") {
+      const target = resolveRef(s.$ref);
+      if (!target || chain.includes(target)) return;
+      s = { ...target, ...s, $ref: undefined };
+    }
+    const here = [...chain, node as object];
+
+    // A marked node is redacted WHOLE, so there is nothing below it to mark:
+    // descending would emit paths into a value that is already gone. The EMPTY
+    // path is legal and means the whole value — a contract whose entire output
+    // is the secret is the simplest shape there is, and refusing it silently
+    // (which `path.length > 0` did) left exactly that case unredacted.
+    if (s["x-telo-sensitive"] === true) {
+      out.push(path);
+      return;
+    }
+
+    const properties = s.properties as Record<string, any> | undefined;
+    if (properties) {
+      for (const [key, child] of Object.entries(properties)) walk(child, [...path, key], here);
+    }
+    // A map whose VALUES are secrets — `additionalProperties: {x-telo-sensitive}`
+    // — is the shape a headers or query bag takes, and it carries no property
+    // names to walk. `{}` is the wildcard segment, the `[]` precedent one axis
+    // over.
+    for (const key of ["additionalProperties", "patternProperties"] as const) {
+      const node = s[key];
+      if (!node || typeof node !== "object") continue;
+      if (key === "additionalProperties") walk(node, [...path, "{}"], here);
+      else for (const child of Object.values(node)) walk(child, [...path, "{}"], here);
+    }
+    for (const branch of ["allOf", "anyOf", "oneOf"] as const) {
+      const list = s[branch];
+      if (Array.isArray(list)) for (const child of list) walk(child, path, here);
+    }
+    if (s.items) walk(s.items, [...path, "[]"], here);
+  };
+
+  walk(schema, [], []);
+  return out;
+}
+
 /** The scalar form a declared node's value takes at runtime. `int64` and
  *  `double` are the two JSON scalars whose runtime representation is NOT decided
  *  by the value that arrives: a CEL integer is a BigInt and a CEL double a JS

package/src/schema-keywords.ts

@@ -27,6 +27,9 @@
  */
 
 import { X_TELO_TYPE } from "@telorun/sdk";
+
+/** The one annotation read from a DATA schema rather than a kind schema. */
+const X_TELO_SENSITIVE = "x-telo-sensitive" as const;
 import { ANNOTATION_KEYWORDS } from "./value-type-keyword.js";
 
 /** A keyword entry: the JSON Schema its VALUE must satisfy, carrying the title
@@ -227,7 +230,13 @@ export function jsonSchemaKeywords(self: string): SchemaKeywords {
  * a schema describing an annotation from an annotation, which nothing does yet.
  */
 export const TELO_SCHEMA_ANNOTATIONS: Record<
-  (typeof ANNOTATION_KEYWORDS)[number] | typeof X_TELO_TYPE,
+  // Exhaustive over the kind vocabulary, so adding a keyword without an entry is
+  // a compile error. `x-telo-sensitive` is excluded because it belongs to the
+  // DATA vocabulary below — it is read from a contract, not from a kind's own
+  // `schema:` — and offering it here would put it on the one schema where
+  // nothing reads it.
+  | Exclude<(typeof ANNOTATION_KEYWORDS)[number], typeof X_TELO_SENSITIVE>
+  | typeof X_TELO_TYPE,
   Record<string, unknown>
 > = {
   "x-telo-eval": {
@@ -381,3 +390,26 @@ export const TELO_SCHEMA_ANNOTATIONS: Record<
     type: "string",
   },
 };
+
+/**
+ * Annotations that belong on a DATA schema — an `inputType` / `outputType`
+ * contract — rather than on a kind's own `schema:`.
+ *
+ * Split out because {@link TELO_SCHEMA_ANNOTATIONS} is offered only where the
+ * fragment is `KindSchema`, which is a kind's CONFIGURATION. `x-telo-sensitive`
+ * is read from the opposite place: the kernel resolves it off a bound contract,
+ * which stamps `JsonSchema7`. Offering it from the kind vocabulary alone put it
+ * on the one schema where nothing reads it and withheld it from the two where it
+ * is the whole mechanism.
+ */
+export const TELO_DATA_SCHEMA_ANNOTATIONS: Record<
+  typeof X_TELO_SENSITIVE,
+  Record<string, unknown>
+> = {
+  [X_TELO_SENSITIVE]: {
+    title: "Sensitive",
+    description:
+      "This value is auth material or equivalent: carry it as `[redacted]` in trace payloads and on the debug wire rather than verbatim. Read only from a resource's declared `inputType` / `outputType`.",
+    type: "boolean",
+  },
+};

package/src/telo-version.ts

@@ -6,4 +6,4 @@
 // written against, and every kernel in every language reports the same scale.
 
 /** The surface generation this analyzer implements. */
-export const TELO_SURFACE_VERSION = "0.83.0";
+export const TELO_SURFACE_VERSION = "0.84.0";

package/src/validate-extends.ts

@@ -1,7 +1,13 @@
 import type { ResourceDefinition, ResourceManifest } from "@telorun/sdk";
 import type { AliasResolver } from "./alias-resolver.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
-import { inheritedCapability, type DefResolver } from "./extends-resolution.js";
+import {
+  controllerBearingAncestor,
+  effectiveAuthorSchema,
+  inheritedCapability,
+  isInheritedDelegation,
+  type DefResolver,
+} from "./extends-resolution.js";
 import { DiagnosticSeverity, type AnalysisDiagnostic } from "./types.js";
 
 const SOURCE = "telo-analyzer";
@@ -25,6 +31,9 @@ const EXTENDS_ALIAS_RE = /^[A-Z][A-Za-z0-9_]*\.[A-Z][A-Za-z0-9_]*$/;
  *  - EXTENDS_UNKNOWN_TARGET: alias resolves to a module, but that module has no
  *    registered definition with the target name.
  *  - EXTENDS_NON_ABSTRACT: target resolves to a Telo.Definition, not a Telo.Abstract.
+ *  - EXTENDS_CLOSED_PARENT_ADDS_FIELD: a child with no `base:` declares a property its
+ *    controller-bearing ancestor's closed schema rejects — the runtime counterpart is a
+ *    create-time failure phrased against the ancestor kind.
  *  - CAPABILITY_SHADOWS_EXTENDS (warning): `capability` names a user-declared abstract
  *    (metadata.module !== "Telo"). Builtin lifecycle capabilities (Telo.Invocable, etc.)
  *    never trigger this — they're lifecycle roles by design.
@@ -149,6 +158,47 @@ export function validateExtends(
                   data: { resource, filePath, path: "capability" },
                 });
               }
+
+              // A merge-form child (no `base:`) forwards its WHOLE config to the
+              // inherited controller as the parent's config, so a field the
+              // parent's schema closes out is rejected at the parent's own
+              // create-time validation — phrased against the parent kind, at the
+              // instance's line, about a resource the author never wrote.
+              // Reported here instead, at the property that has to change.
+              if (
+                (m as { base?: unknown }).base == null &&
+                isInheritedDelegation(m as ResourceDefinition, resolveDef)
+              ) {
+                const ancestor = controllerBearingAncestor(m as ResourceDefinition, resolveDef);
+                const ancestorSchema = ancestor
+                  ? effectiveAuthorSchema(ancestor, resolveDef)
+                  : undefined;
+                if (ancestorSchema?.additionalProperties === false) {
+                  const inherited = new Set(Object.keys(ancestorSchema.properties ?? {}));
+                  const ownProps = ((m as { schema?: { properties?: Record<string, unknown> } })
+                    .schema?.properties ?? {}) as Record<string, unknown>;
+                  const ancestorKind = `${ancestor?.metadata.module}.${ancestor?.metadata.name}`;
+                  for (const prop of Object.keys(ownProps)) {
+                    if (inherited.has(prop)) continue;
+                    diagnostics.push({
+                      severity: DiagnosticSeverity.Error,
+                      code: "EXTENDS_CLOSED_PARENT_ADDS_FIELD",
+                      source: SOURCE,
+                      message:
+                        `${label}: declares '${prop}', but '${ancestorKind}' closes its schema ` +
+                        `(additionalProperties: false) and a child without 'base:' forwards its whole ` +
+                        `config as that kind's config — so '${prop}' is rejected when the resource is ` +
+                        `created. Add a 'base:' mapping, which makes this kind's fields construction ` +
+                        `inputs and builds the parent's config explicitly.`,
+                      data: {
+                        resource,
+                        filePath,
+                        path: `schema.properties.${prop}`,
+                      },
+                    });
+                  }
+                }
+              }
             }
           }
         }

package/src/validate-sensitive-slots.ts

@@ -0,0 +1,109 @@
+import type { ResourceManifest } from "@telorun/sdk";
+import { SCHEMA_REGION_KEYS } from "./schema-region.js";
+
+/**
+ * `x-telo-sensitive` where nothing reads it.
+ *
+ * The annotation has exactly one consumer: the kernel resolves it from a
+ * resource's bound CONTRACT — `inputType` / `outputType` — and carries the
+ * marked value as `[redacted]` in trace payloads. Written anywhere else it is an
+ * unknown keyword in an open schema, which is to say it validates, ships, and
+ * does nothing.
+ *
+ * For a security control that is the worst available failure: an author marks a
+ * token, sees no error, and puts it on the debug wire anyway. So a misplacement
+ * is reported rather than ignored — the same posture `X_TELO_REF_UNRESOLVED`
+ * takes toward a reference constraint that resolves to nothing, and for the same
+ * reason: silence reads as protection.
+ *
+ * Scoped by the caller to the entry's own modules, since a dependency's schema
+ * is not the consumer's to fix.
+ */
+export interface SensitiveSlotIssue {
+  code: "SENSITIVE_ANNOTATION_MISPLACED" | "SENSITIVE_ANNOTATION_INVALID";
+  manifest: ResourceManifest;
+  /** Dotted path to the annotated schema node. */
+  path: string;
+  message: string;
+}
+
+const ANNOTATION = "x-telo-sensitive";
+
+/** The only regions the kernel reads the annotation from. */
+const CONTRACT_KEYS = new Set(["inputType", "outputType"]);
+
+export function validateSensitiveSlots(manifest: ResourceManifest): SensitiveSlotIssue[] {
+  const issues: SensitiveSlotIssue[] = [];
+
+  const walk = (node: unknown, path: (string | number)[], seen: Set<object>): void => {
+    if (!node || typeof node !== "object") return;
+    if (seen.has(node as object)) return;
+    seen.add(node as object);
+
+    if (Array.isArray(node)) {
+      node.forEach((child, i) => walk(child, [...path, i], seen));
+      return;
+    }
+
+    const record = node as Record<string, unknown>;
+    if (Object.hasOwn(record, ANNOTATION)) {
+      const dotted = path.join(".");
+      if (record[ANNOTATION] !== true) {
+        issues.push({
+          code: "SENSITIVE_ANNOTATION_INVALID",
+          manifest,
+          path: dotted,
+          message:
+            `'${ANNOTATION}' must be \`true\`; got ${JSON.stringify(record[ANNOTATION])}. ` +
+            `It is a marker, not a level — a value other than \`true\` reads as "not sensitive".`,
+        });
+      } else {
+        const region = enclosingSchemaRegion(path);
+        if (region === undefined || !CONTRACT_KEYS.has(region)) {
+          issues.push({
+            code: "SENSITIVE_ANNOTATION_MISPLACED",
+            manifest,
+            path: dotted,
+            message:
+              `'${ANNOTATION}' is only read from a resource's declared contract ` +
+              `(\`inputType\` / \`outputType\`), and this node is ` +
+              (region === undefined
+                ? "not inside a schema at all"
+                : `inside \`${region}\``) +
+              `. The kernel will not redact it, so the value would still reach trace ` +
+              `payloads and the debug wire. Move the mark onto the contract property ` +
+              `that carries the value.`,
+          });
+        }
+      }
+    }
+
+    for (const [key, child] of Object.entries(record)) {
+      walk(child, [...path, key], seen);
+    }
+  };
+
+  walk(manifest as unknown as Record<string, unknown>, [], new Set());
+  return issues;
+}
+
+/**
+ * The OUTERMOST segment naming a schema-valued key, or `undefined` when the node
+ * is not inside a schema.
+ *
+ * Outermost, not nearest, because a contract is routinely written in the inline
+ * `{kind: Telo.JsonSchema, schema: …}` form — so the path to a marked property is
+ * `outputType.schema.properties.headers`, and the nearest region key is that
+ * wrapper's own `schema`. Reading it as a kind's configuration would report every
+ * correctly-marked contract as misplaced, which is how this check first behaved.
+ *
+ * It is the same reasoning `expandManifestFragments` uses when it keys on the
+ * top-level slot: the object a contract resolver is handed is the one under
+ * `inputType` / `outputType`, whatever nesting the authoring form adds beneath.
+ */
+function enclosingSchemaRegion(path: readonly (string | number)[]): string | undefined {
+  for (const segment of path) {
+    if (typeof segment === "string" && SCHEMA_REGION_KEYS.includes(segment)) return segment;
+  }
+  return undefined;
+}

package/src/value-type-keyword.ts

@@ -69,6 +69,7 @@ export const ANNOTATION_KEYWORDS = [
   "x-telo-schema-projection",
   "x-telo-schema-projection-from",
   "x-telo-scope",
+  "x-telo-sensitive",
   "x-telo-step-context",
   "x-telo-topology-role",
   "x-telo-value-schema-from",