@telorun/kernel 0.48.0 → 0.50.0

package/src/controller-loaders/bundle-builder.ts

@@ -1,3 +1,4 @@
+import { NOOP_LOGGER, type Logger } from "@telorun/sdk";
 import { existsSync } from "node:fs";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
@@ -140,6 +141,7 @@ async function loadEsbuild(): Promise<typeof import("esbuild") | null> {
 export async function tryBuildControllerBundle(
   installRoot: string,
   entryFile: string,
+  log: Logger = NOOP_LOGGER,
 ): Promise<string | null> {
   if (!bundlingEnabled()) return null;
 
@@ -174,7 +176,7 @@ export async function tryBuildControllerBundle(
   // would otherwise each launch an esbuild over the same output.
   const inFlight = buildsInFlight.get(bundleFile);
   if (inFlight) return inFlight;
-  const work = buildBundle(bundleFile, entryFile).finally(() =>
+  const work = buildBundle(bundleFile, entryFile, log).finally(() =>
     buildsInFlight.delete(bundleFile),
   );
   buildsInFlight.set(bundleFile, work);
@@ -216,7 +218,11 @@ function okMarker(bundleFile: string): string {
   return `${bundleFile}.ok`;
 }
 
-async function buildBundle(bundleFile: string, entryFile: string): Promise<string | null> {
+async function buildBundle(
+  bundleFile: string,
+  entryFile: string,
+  log: Logger,
+): Promise<string | null> {
   if (await usableCachedBundle(bundleFile)) return bundleFile;
 
   const esbuild = await loadEsbuild();
@@ -245,9 +251,10 @@ async function buildBundle(bundleFile: string, entryFile: string): Promise<strin
     // location. esbuild rewrites `__dirname`/`__filename` to `import.meta.url`,
     // so its presence flags this — fall back to the loose import for those.
     if (DIR_RELATIVE.test(out.text)) {
-      if (hostEnv().TELO_BUNDLE_DEBUG) {
-        process.stderr.write(`[bundle] skipped ${entryFile}: directory-relative asset resolution\n`);
-      }
+      log.trace("controller bundling skipped", {
+        "telo.bundle.entry": entryFile,
+        "telo.bundle.reason": "directory-relative asset resolution",
+      });
       return null;
     }
     await fs.writeFile(tmpFile, REQUIRE_BANNER + out.text);
@@ -257,11 +264,12 @@ async function buildBundle(bundleFile: string, entryFile: string): Promise<strin
     await fs.writeFile(okMarker(bundleFile), "").catch(() => {});
     return bundleFile;
   } catch (err) {
-    if (hostEnv().TELO_BUNDLE_DEBUG) {
-      process.stderr.write(
-        `[bundle] skipped ${entryFile}: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}\n`,
-      );
-    }
+    // Previously gated behind an ad-hoc TELO_BUNDLE_DEBUG env var — a second,
+    // undeclared configuration channel of exactly the kind D6 forbids. It is now
+    // an ordinary trace-level record, so raising `logging.level` reveals it.
+    log.trace("controller bundling skipped", {
+      "telo.bundle.entry": entryFile,
+    }, { error: err });
     await fs.rm(tmpFile, { force: true }).catch(() => {});
     return null; // unbundleable controller → loose import
   }

package/src/controller-loaders/npm-loader.ts

@@ -1,4 +1,4 @@
-import { ControllerInstance } from "@telorun/sdk";
+import { ControllerInstance, NOOP_LOGGER, type Logger } from "@telorun/sdk";
 import { execFile } from "child_process";
 import * as crypto from "crypto";
 import * as fs from "fs/promises";
@@ -153,6 +153,16 @@ export interface NpmControllerLoaderOptions {
  * cross-process safety is provided by a filesystem lock on `<root>/.lock`.
  */
 export class NpmControllerLoader {
+  /** Where install-lock diagnostics go. Injected rather than written to
+   *  `process.stderr`: this loader runs outside the kernel's stdio scope, and
+   *  §13.1 routes every kernel diagnostic through the logger. */
+  private log: Logger = NOOP_LOGGER;
+
+  /** Route this loader's diagnostics through the kernel's logger. */
+  setLogger(log: Logger): void {
+    this.log = log;
+  }
+
   private readonly entryUrl?: string;
   /** Threaded install root (`<cache-root>/npm`); overrides `computeInstallRoot`. */
   private readonly installRootOverride?: string;
@@ -233,7 +243,7 @@ export class NpmControllerLoader {
     const subpath = parsed.subpath ?? null;
     return {
       source,
-      importInstance: () => loadFromInstall(installRoot, alias, subpath, purl),
+      importInstance: () => loadFromInstall(installRoot, alias, subpath, purl, this.log),
     };
   }
 
@@ -332,7 +342,7 @@ export class NpmControllerLoader {
         ...PEER_INSTALL_FLAGS,
       ]);
       await fs.writeFile(stateFile, JSON.stringify({ rootHash: newHash }, null, 2) + "\n");
-    });
+    }, this.log);
 
     await this.seedDepCaches(installRoot, dependencies);
     return installRoot;
@@ -480,7 +490,7 @@ export class NpmControllerLoader {
         const written = await readDepSpec(installRoot, alias);
         if (written !== undefined) this.rootDeps[alias] = written;
         else this.rootDeps[alias] = spec;
-      });
+      }, this.log);
     })();
 
     this.inFlight.set(cacheKey, work);
@@ -589,8 +599,12 @@ function withLocalInstallQueue<T>(installRoot: string, fn: () => Promise<T>): Pr
  * Acquire the install lock for `installRoot` and run `fn` under it: first the
  * in-process queue above, then the cross-process filesystem lock.
  */
-async function withInstallLock<T>(installRoot: string, fn: () => Promise<T>): Promise<T> {
-  return withLocalInstallQueue(installRoot, () => withFileInstallLock(installRoot, fn));
+async function withInstallLock<T>(
+  installRoot: string,
+  fn: () => Promise<T>,
+  log: Logger = NOOP_LOGGER,
+): Promise<T> {
+  return withLocalInstallQueue(installRoot, () => withFileInstallLock(installRoot, fn, log));
 }
 
 /**
@@ -611,7 +625,11 @@ async function withInstallLock<T>(installRoot: string, fn: () => Promise<T>): Pr
  * invocation, and any state-file writes. It does NOT serialize *reads* of
  * already-installed controllers — those run lock-free against a stable tree.
  */
-async function withFileInstallLock<T>(installRoot: string, fn: () => Promise<T>): Promise<T> {
+async function withFileInstallLock<T>(
+  installRoot: string,
+  fn: () => Promise<T>,
+  log: Logger = NOOP_LOGGER,
+): Promise<T> {
   const lockPath = path.join(installRoot, ".lock");
 
   await fs.mkdir(installRoot, { recursive: true });
@@ -639,7 +657,7 @@ async function withFileInstallLock<T>(installRoot: string, fn: () => Promise<T>)
       }
       if (!noticed && waited > LOCK_WAIT_NOTICE_MS) {
         noticed = true;
-        process.stderr.write(`[telo] waiting for controller install lock at ${lockPath}…\n`);
+        log.info("waiting for controller install lock", { "telo.install.lock_path": lockPath });
       }
       await sleep(LOCK_RETRY_MS);
     }
@@ -667,8 +685,10 @@ async function withFileInstallLock<T>(installRoot: string, fn: () => Promise<T>)
       await fs.rm(lockPath, { force: true });
     } catch (err: any) {
       if (err?.code !== "ENOENT") {
-        process.stderr.write(
-          `[telo] failed to release install lock at ${lockPath}: ${err?.message ?? err}\n`,
+        log.warn(
+          "failed to release install lock",
+          { "telo.install.lock_path": lockPath },
+          { error: err },
         );
       }
     }
@@ -950,6 +970,7 @@ async function loadFromInstall(
   alias: string,
   subpath: string | null,
   purl: string,
+  log: Logger = NOOP_LOGGER,
 ): Promise<ControllerInstance> {
   // The package lives under its version-scoped alias folder (see installAlias),
   // not its bare scoped name.
@@ -959,7 +980,7 @@ async function loadFromInstall(
   // Transparent bundling: import a single esbuild bundle of the entry (one file
   // vs a cold loose `node_modules` tree) when available; otherwise the loose
   // entry. Pure accelerator — `null` on any miss, so behavior is unchanged.
-  const target = (await tryBuildControllerBundle(installRoot, entryFile)) ?? entryFile;
+  const target = (await tryBuildControllerBundle(installRoot, entryFile, log)) ?? entryFile;
   // ESM dynamic `import()` accepts either a relative specifier or a `file://`
   // URL — but NOT a bare absolute filesystem path. On POSIX the `/abs/path`
   // form works by happy accident; on Windows `C:\path\to\file.js` is rejected

package/src/controllers/logging/console-sink-controller.ts

@@ -0,0 +1,46 @@
+import { TEARDOWN_LAST, type ResourceInstance } from "@telorun/sdk";
+import type { BuiltinControllerContext } from "../../internal-context.js";
+import { ConsoleSink } from "../../logging/console-sink.js";
+import { sinkIdFor } from "./sink-identity.js";
+
+/**
+ * Controller for the `Telo.ConsoleSink` kernel built-in (§10.2).
+ *
+ * Dependency-free by construction — it needs nothing but a descriptor — which is
+ * what qualifies it for eager instantiation before the init loop, so a runtime
+ * never has zero destinations.
+ *
+ * The instance exposes the sink contract directly on itself rather than behind
+ * `invoke()`: the logger writes to it through that contract, never through
+ * dispatch (§12.1).
+ */
+export async function create(
+  resource: any,
+  ctx: BuiltinControllerContext,
+): Promise<ResourceInstance> {
+  const sink = new ConsoleSink({
+    sinkId: sinkIdFor(resource),
+    level: ctx.logging.levelFor(resource.level),
+    destination: resource.destination,
+    encoding: resource.encoding,
+    color: resource.color,
+    env: ctx.env,
+    stdout: ctx.stdout,
+    stderr: ctx.stderr,
+  });
+
+  ctx.logging.attach(sink);
+
+  return {
+    sink,
+    teardownPriority: TEARDOWN_LAST,
+    // Sinks are ordinary resources, so the final flush is their own teardown —
+    // they are simply pinned to run after every other resource, so anything
+    // logging during its own shutdown still reaches a live destination.
+    teardown: async () => {
+      await sink.flush();
+      ctx.logging.detach(sink);
+      await sink.close();
+    },
+  } as unknown as ResourceInstance;
+}

package/src/controllers/logging/file-sink-controller.ts

@@ -0,0 +1,40 @@
+import { TEARDOWN_LAST, type ResourceInstance } from "@telorun/sdk";
+import type { BuiltinControllerContext } from "../../internal-context.js";
+import { FileSink } from "../../logging/file-sink.js";
+import { bufferPolicyFor, sinkIdFor } from "./sink-identity.js";
+
+/**
+ * Controller for the `Telo.FileSink` kernel built-in (§10.2). Dependency-free —
+ * a path is all it needs — so it joins the console sink in the eager tier.
+ *
+ * `on_full: block` is rejected at construction with an actionable diagnostic
+ * naming the sink; see `sink-identity.ts` for why degrading is the wrong call.
+ */
+export async function create(
+  resource: any,
+  ctx: BuiltinControllerContext,
+): Promise<ResourceInstance> {
+  const sinkId = sinkIdFor(resource);
+  const policy = bufferPolicyFor(resource);
+
+  const sink = new FileSink({
+    sinkId,
+    level: ctx.logging.levelFor(resource.level),
+    destination: resource.destination,
+    encoding: resource.encoding,
+    policy,
+    onDrop: () => ctx.logging.recordDrop(sinkId, "buffer_full"),
+  });
+
+  ctx.logging.attach(sink);
+
+  return {
+    sink,
+    teardownPriority: TEARDOWN_LAST,
+    teardown: async () => {
+      await sink.flush();
+      ctx.logging.detach(sink);
+      await sink.close();
+    },
+  } as unknown as ResourceInstance;
+}

package/src/controllers/logging/sink-identity.ts

@@ -0,0 +1,53 @@
+import { parseDurationMs } from "@telorun/sdk";
+import { blockUnsupportedMessage, DEFAULT_BUFFER_POLICY, type SinkBufferPolicy } from "../../logging/log-sink.js";
+import { RuntimeError } from "@telorun/sdk";
+
+/**
+ * Shared sink-manifest reading — `kernel/specs/logging.md` §10.3, §12.1.
+ */
+
+/** Sink identity for drop accounting (§10.4): the resource name for a `!ref`,
+ *  or the synthetic name inline extraction assigned, which already encodes kind
+ *  plus position. */
+export function sinkIdFor(resource: { metadata?: { name?: string }; kind?: string }): string {
+  return resource.metadata?.name ?? resource.kind ?? "<sink>";
+}
+
+/**
+ * Read the buffering policy an async sink inherits from `Telo.LogSink`.
+ *
+ * `on_full: block` is rejected here rather than silently degraded. Blocking
+ * means suspending the producer until the buffer drains, which requires the
+ * drain to progress *while* the producer is suspended — true on a runtime with
+ * real threads, false on a single-threaded event loop, where suspending the
+ * producer suspends the consumer too. There, `block` is a deadlock.
+ *
+ * Degrading to `drop_new` would be worse than erroring: someone who writes
+ * `block` on an audit sink is saying "I would rather go slow than lose a
+ * record", and silently handing back the opposite guarantee means they discover
+ * it from a gap in an audit trail rather than from a diagnostic.
+ */
+export function bufferPolicyFor(resource: {
+  metadata?: { name?: string };
+  kind?: string;
+  buffer?: number;
+  on_full?: string;
+  flush_interval?: string;
+}): SinkBufferPolicy {
+  const onFull = resource.on_full ?? DEFAULT_BUFFER_POLICY.onFull;
+
+  if (onFull === "block") {
+    throw new RuntimeError(
+      "ERR_LOG_SINK_ON_FULL_UNSUPPORTED",
+      blockUnsupportedMessage(sinkIdFor(resource)),
+    );
+  }
+
+  return {
+    buffer: resource.buffer ?? DEFAULT_BUFFER_POLICY.buffer,
+    onFull: onFull as SinkBufferPolicy["onFull"],
+    flushIntervalMs: resource.flush_interval
+      ? parseDurationMs(resource.flush_interval, DEFAULT_BUFFER_POLICY.flushIntervalMs)
+      : DEFAULT_BUFFER_POLICY.flushIntervalMs,
+  };
+}

package/src/controllers/module/import-controller.ts

@@ -2,6 +2,7 @@ import { AnalysisRegistry, DiagnosticSeverity, foldIntegrity, parseExportEntry,
 import type { ResourceInstance } from "@telorun/sdk";
 import { RuntimeError } from "@telorun/sdk";
 import type { BuiltinControllerContext } from "../../internal-context.js";
+import { buildScopeConfig, type LoggingManifestBlock } from "../../logging/kernel-logging.js";
 import { ModuleContext } from "../../module-context.js";
 import { isDefaultPolicy, normalizeRuntime } from "../../runtime-registry.js";
 
@@ -171,6 +172,32 @@ export async function create(
     }
   }
 
+  // Resolve this import's effective logging configuration once, here, and stamp
+  // it as a plain value on the child context — the same shape as the controller
+  // policy above.
+  //
+  // The threshold attaches to the *import* rather than to a map keyed by module
+  // name because module names collide (`std/sql` and `acme/sql` share
+  // `metadata.name: sql`; the same module imported twice is two subsystems with
+  // one name), while an alias is already uniqueness-enforced as a hard
+  // DUPLICATE_IMPORT_ALIAS diagnostic. Resolving here means a leaf reads its
+  // threshold as an O(1) lookup with no walk up the import chain at emit time —
+  // and it is the same scalar a guest runtime caches across an FFI boundary, so
+  // scoping and the FFI threshold cache are one mechanism. See §9 and §12.2.
+  const parentScope =
+    (ctx.moduleContext as unknown as ModuleContext).getLoggingConfig?.() ??
+    ctx.kernelLoggingRootScope();
+  const scopePath = parentScope.scope ? `${parentScope.scope}.${alias}` : alias;
+  const importLogging = resource.logging
+    ? (ctx.expandValue(resource.logging, {}) as LoggingManifestBlock)
+    : undefined;
+  (child as ModuleContext).setLoggingConfig({
+    ...buildScopeConfig(importLogging, parentScope),
+    scope: scopePath,
+    module: targetModule,
+    secretValues: child.secretValues,
+  });
+
   for (const manifest of manifests) {
     child.registerManifest(manifest);
   }

package/src/controllers/resource-definition/resource-definition-controller.ts

@@ -142,6 +142,7 @@ class ResourceDefinition implements ResourceInstance {
     const loader = new ControllerLoader({
       entryUrl: ctx.getEntryUrl(),
       installRoot: ctx.getInstallRoot(),
+      log: ctx.log,
     });
     // Eager resolve — verify the controller is hostable now (so a broken
     // `controllers:` candidate fails fast at boot), but defer the expensive

package/src/evaluation-context.ts

@@ -1,4 +1,5 @@
 import { AsyncLocalStorage } from "node:async_hooks";
+import { formatSpanCounter } from "./logging/span-id.js";
 import {
   getRefIdentity,
   isCompiledValue,
@@ -164,6 +165,19 @@ export function buildResolvedProperties(
  */
 const cancellationStore = new AsyncLocalStorage<InvokeContext>();
 
+/**
+ * The ambient dispatch context, for §7.2's automatic trace correlation: a record
+ * emitted inside an active span carries that span's ids without the controller
+ * passing anything.
+ *
+ * `AsyncLocalStorage.run()` is used throughout rather than `enterWith()`, which
+ * transitions for the remainder of the entire synchronous execution and leaks
+ * context into subsequent event handlers on the same tick (§9.1).
+ */
+export function ambientInvokeContext(): InvokeContext | undefined {
+  return cancellationStore.getStore();
+}
+
 type Walker = (ctx: Record<string, unknown>) => unknown;
 
 /** Compile a manifest subtree into a tightly-bound walker closure. The returned
@@ -687,25 +701,83 @@ export class EvaluationContext implements IEvaluationContext {
    *   2. Tear down own resource instances in reverse registration order,
    *      emitting a Teardown event for each via the injected emit callback.
    */
+  // eslint-disable-next-line @typescript-eslint/member-ordering
   async teardownResources(): Promise<void> {
     this.state = "Draining";
+    const failures: Array<{ resource: string; error: unknown }> = [];
+
     for (const child of [...this.children].reverse()) {
-      await child.teardownResources();
+      try {
+        await child.teardownResources();
+      } catch (err) {
+        failures.push({ resource: "(child context)", error: err });
+      }
     }
-    const entries = [...this.resourceInstances.entries()].reverse();
-    for (const [key, { resource, instance }] of entries) {
-      if (instance.teardown) await instance.teardown();
-      await this.emit(`${resource.kind}.${resource.metadata.name}.Teardown`, {
-        resource: {
-          kind: resource.kind,
-          name: resource.metadata.name,
-          id: this.resourceId(resource.kind, resource.metadata.name),
-        },
-        ...(this.owner ? { owner: this.owner } : {}),
-      });
+
+    for (const [key, { resource, instance }] of this.teardownOrder()) {
+      const label = `${resource.kind}.${resource.metadata.name}`;
+      try {
+        if (instance.teardown) await instance.teardown();
+      } catch (err) {
+        // Aggregate rather than abort. A single throwing resource used to
+        // abandon every resource after it in the cascade — including the log
+        // sinks, which are pinned last precisely so they outlive everything that
+        // might log while shutting down. Losing the shutdown flush to an
+        // unrelated failure is exactly the silent loss §10.5 forbids.
+        failures.push({ resource: label, error: err });
+      }
+      try {
+        await this.emit(`${label}.Teardown`, {
+          resource: {
+            kind: resource.kind,
+            name: resource.metadata.name,
+            id: this.resourceId(resource.kind, resource.metadata.name),
+          },
+          ...(this.owner ? { owner: this.owner } : {}),
+        });
+      } catch (err) {
+        failures.push({ resource: `${label} (Teardown event)`, error: err });
+      }
       this.resourceInstances.delete(key);
     }
+
     this.state = "Teardown";
+
+    if (failures.length > 0) {
+      throw new RuntimeError(
+        "ERR_TEARDOWN_FAILED",
+        `${failures.length} resource(s) failed during teardown`,
+        failures.map(({ resource, error }) => ({
+          severity: "error" as const,
+          message: error instanceof Error ? error.message : String(error),
+          resource,
+        })),
+      );
+    }
+  }
+
+  /**
+   * Resource instances in teardown order: ascending `teardownPriority`, with the
+   * base reverse-insertion order preserved within each priority tier.
+   *
+   * The base order is reverse *insertion*, which is reverse init order in the
+   * happy path — but the init loop is a multi-pass retry, so a resource that
+   * failed its first pass lands later in the map than its topological rank
+   * implies. That makes the dependency graph an unreliable way to say "last".
+   * A resource that must reliably outlive the rest declares it directly via
+   * `teardownPriority` (log sinks set `TEARDOWN_LAST`), so the generic teardown
+   * path orders by a declared number rather than sniffing any one subsystem's
+   * instance shape.
+   */
+  private teardownOrder(): Array<[string, { resource: any; instance: any }]> {
+    const entries = [...this.resourceInstances.entries()].reverse();
+    // Stable sort by priority (default 0); Array.prototype.sort is stable, so
+    // the reverse-insertion order survives within each tier.
+    return entries.sort(
+      ([, a], [, b]) =>
+        ((a.instance as { teardownPriority?: number })?.teardownPriority ?? 0) -
+        ((b.instance as { teardownPriority?: number })?.teardownPriority ?? 0),
+    );
   }
 
   transientChild(context: Record<string, any>): EvaluationContext {
@@ -785,7 +857,9 @@ export class EvaluationContext implements IEvaluationContext {
    * event *name* stays human-meaningful (`<name>.Invoked`) for bus subscribers;
    * everything a debug consumer needs to rebuild the call tree rides here, so the
    * consumer never parses the dotted name. `spanId`/`parentSpanId` are the
-   * tracer's `invocationId`/`parentInvocationId` (present only while tracing);
+   * tracer's `invocationId`/`parentInvocationId`, rendered as 16 lowercase hex
+   * characters at this boundary (present only while tracing) so a span joins its
+   * log records by string equality — see kernel/specs/logging.md §7.1;
    * `ref` carries the kind+name the name no longer encodes; `detail` is the
    * per-capability data (inputs/outputs, error fields, cancellation reason).
    */
@@ -813,8 +887,12 @@ export class EvaluationContext implements IEvaluationContext {
   ): Record<string, unknown> {
     return {
       traceId,
-      spanId,
-      parentSpanId,
+      // The counter stays a cheap integer internally; hex is a fixed-width
+      // render performed only here, at the encoding boundary, and only for
+      // spans actually being emitted (§7.1 forbids formatting eagerly at span
+      // creation). The salt keeps ids unique across processes in one trace.
+      spanId: spanId === undefined ? undefined : formatSpanCounter(spanId),
+      parentSpanId: parentSpanId === undefined ? undefined : formatSpanCounter(parentSpanId),
       capability,
       phase,
       ...(outcome !== undefined ? { outcome } : {}),

package/src/index.ts

@@ -40,3 +40,57 @@ export { ManifestRegistry as Registry } from "./registry.js";
 export { ResourceURI } from "./resource-uri.js";
 export type { RuntimeDiagnostic } from "@telorun/sdk";
 
+// Structured logging — the runtime half of kernel/specs/logging.md. The record
+// model, severity scale, and `Logger` surface live in `@telorun/sdk`; these are
+// the pipeline, the encodings, the sinks, and the policies that gate emission.
+export {
+  BOOTSTRAP_SINK_ID,
+  ConsoleSink,
+  DEBUG_WIRE_SINK_ID,
+  DebugWireSink,
+  DEFAULT_ATTRIBUTE_LIMITS,
+  DEFAULT_BUFFER_POLICY,
+  DEFAULT_CENSOR,
+  DropRegistry,
+  FileSink,
+  LoggingPipeline,
+  PIPELINE_SINK_ID,
+  RecordBuffer,
+  Sampler,
+  base64Bytes,
+  blockUnsupportedMessage,
+  compileRedactionPolicy,
+  createBootstrapWriter,
+  decideColor,
+  encodeJson,
+  encodeJsonLine,
+  encodePretty,
+  encodePrettyLine,
+  formatSpanCounter,
+  formatSpanId,
+  formatTraceParent,
+  normalizeAttributes,
+  normalizeSpanId,
+  normalizeTraceId,
+  parseTraceParent,
+  redactAttributes,
+  redactError,
+  saltSpanId,
+  toErrorValue,
+  toJsonProfile,
+} from "./logging/index.js";
+export type {
+  AttributeLimits,
+  ColorSetting,
+  DropCause,
+  DropReport,
+  LogSinkInstance,
+  OnFull,
+  RedactionPolicy,
+  SamplingConfig,
+  ScopeConfig,
+  SinkBufferPolicy,
+  TraceContext,
+} from "./logging/index.js";
+export { KernelLogging } from "./logging/kernel-logging.js";
+export type { LoggingHost } from "./logging/logging-host.js";

package/src/internal-context.ts

@@ -1,4 +1,5 @@
 import type { ResourceContext } from "@telorun/sdk";
+import type { ScopeConfig } from "./logging/scope-config.js";
 
 /**
  * Context interface used by built-in kernel controllers (Telo.Application /
@@ -22,4 +23,7 @@ export interface BuiltinControllerContext extends ResourceContext {
    *  source-chain `resolveRelative`. Identical to what `loadGraph` used
    *  internally — so the produced URL agrees with the loader's caches. */
   resolveImportUrl(fromSource: string, importSource: string): string;
+  /** The root Application's resolved logging configuration — the base an
+   *  import's own `logging:` block cascades over (§12.2). */
+  kernelLoggingRootScope(): ScopeConfig;
 }