@rytass/bpm-core-nestjs-module 0.19.0 → 0.20.0

package/src/lib/template/template.service.d.ts

@@ -1,6 +1,9 @@
 import { ModuleRef } from '@nestjs/core';
+import { ExpressionUsagePoint } from '@rytass/bpm-core-shared';
+import { WorkflowDefinition } from '@rytass/bpm-core-shared/workflow';
 import { EntityManager, Repository } from 'typeorm';
 import { ConditionService } from '../condition/condition.service';
+import { BPMExpressionFunctionRegistry } from '../expression-function/expression-function.types';
 import { FormDefinitionVersionEntity } from '../form/form-definition-version.entity';
 import { FormService } from '../form/form.service';
 import { ComposeApprovalTemplateWithFormInput } from './dto/compose-approval-template.input';
@@ -32,8 +35,9 @@ export declare class TemplateService {
     private readonly conditionService;
     private readonly formService;
     private readonly moduleRef;
+    private readonly expressionFunctionRegistry?;
     private readonly logger;
-    constructor(templateRepository: Repository<ApprovalTemplateEntity>, templateCategoryRepository: Repository<ApprovalTemplateCategoryEntity>, templateVersionRepository: Repository<ApprovalTemplateVersionEntity>, formDefinitionVersionRepository: Repository<FormDefinitionVersionEntity>, conditionService: ConditionService, formService: FormService, moduleRef: ModuleRef);
+    constructor(templateRepository: Repository<ApprovalTemplateEntity>, templateCategoryRepository: Repository<ApprovalTemplateCategoryEntity>, templateVersionRepository: Repository<ApprovalTemplateVersionEntity>, formDefinitionVersionRepository: Repository<FormDefinitionVersionEntity>, conditionService: ConditionService, formService: FormService, moduleRef: ModuleRef, expressionFunctionRegistry?: (BPMExpressionFunctionRegistry | null) | undefined);
     createApprovalTemplate(input: CreateApprovalTemplateInput, manager?: EntityManager): Promise<ApprovalTemplateEntity>;
     private createApprovalTemplateWithManager;
     /**
@@ -87,6 +91,21 @@ export declare class TemplateService {
     private notifyTemplateObserver;
     private readHostObserver;
     private validatePublishableVersion;
+    /** The cel-legacy publish lint, unchanged (docs/24 §1). */
+    private lintCelLegacyExpressions;
+    /**
+     * The cel-v2 publish lint (ADR 22 §3.4, §5): every expression on its AST
+     * with its use point's roots, the bound form's fields and types and the
+     * function registry, plus the `SET_FORM_FIELD` write targets. Warnings do
+     * not refuse a publish; the designer reads them through
+     * `ConditionService.lintExpressionIssues`.
+     */
+    private lintCelV2Expressions;
+    /**
+     * The functions a version calls that the registry no longer has, as lint
+     * lines. Only cel-v2 can call registered functions at all.
+     */
+    private lintRegisteredFunctions;
     /**
      * Publish rules that need the webhook endpoint catalog (ADR 18 §4).
      *
@@ -110,4 +129,21 @@ export declare class TemplateService {
     private readNextVersionNumber;
     private parseWorkflowDefinitionOrThrow;
 }
+export interface ExpressionSource {
+    readonly expression: string | null | undefined;
+    readonly label: string;
+}
+export interface UsagePointExpression extends ExpressionSource {
+    /** The top-level field a `SET_FORM_FIELD` value is written to. */
+    readonly targetFieldKey: string | null;
+    readonly usagePoint: ExpressionUsagePoint;
+}
+/**
+ * Every expression of a version with its use point (docs/24 §2.3). Unlike
+ * the cel-legacy readers this includes the NOTIFY recipients expression,
+ * which is evaluated like an approver expression. A draft is not
+ * shape-checked, so every read is guarded. Also read by the designer's
+ * expression analysis and dialect upgrade check (Phase 23 P4).
+ */
+export declare function readUsagePointExpressions(definition: WorkflowDefinition, initiatorPolicyCel: string | null): readonly UsagePointExpression[];
 export {};

package/src/lib/template/template.service.js

@@ -2,6 +2,7 @@
 var TemplateService_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TemplateService = void 0;
+exports.readUsagePointExpressions = readUsagePointExpressions;
 const tslib_1 = require("tslib");
 const common_1 = require("@nestjs/common");
 const core_1 = require("@nestjs/core");
@@ -11,6 +12,9 @@ const form_1 = require("@rytass/bpm-core-shared/form");
 const workflow_graph_1 = require("@rytass/bpm-core-shared/workflow-graph");
 const typeorm_2 = require("typeorm");
 const condition_service_1 = require("../condition/condition.service");
+const expression_dialect_1 = require("../condition/expression-dialect");
+const expression_ast_1 = require("../condition/expression-ast");
+const expression_function_types_1 = require("../expression-function/expression-function.types");
 const form_table_reference_1 = require("../form/form-table-reference");
 const form_definition_entity_1 = require("../form/form-definition.entity");
 const form_definition_version_entity_1 = require("../form/form-definition-version.entity");
@@ -43,7 +47,7 @@ const WORKFLOW_EXPRESSION_ROOT_IDENTIFIERS = [
     'instance',
 ];
 let TemplateService = TemplateService_1 = class TemplateService {
-    constructor(templateRepository, templateCategoryRepository, templateVersionRepository, formDefinitionVersionRepository, conditionService, formService, moduleRef) {
+    constructor(templateRepository, templateCategoryRepository, templateVersionRepository, formDefinitionVersionRepository, conditionService, formService, moduleRef, expressionFunctionRegistry) {
         this.templateRepository = templateRepository;
         this.templateCategoryRepository = templateCategoryRepository;
         this.templateVersionRepository = templateVersionRepository;
@@ -51,6 +55,7 @@ let TemplateService = TemplateService_1 = class TemplateService {
         this.conditionService = conditionService;
         this.formService = formService;
         this.moduleRef = moduleRef;
+        this.expressionFunctionRegistry = expressionFunctionRegistry;
         this.logger = new common_1.Logger(TemplateService_1.name);
     }
     async createApprovalTemplate(input, manager) {
@@ -89,7 +94,7 @@ let TemplateService = TemplateService_1 = class TemplateService {
             status: template_enums_1.ApprovalTemplateVersionStatusEnum.DRAFT,
             templateId: template.id,
             version: 1,
-            workflowDefinition: workflow_definition_validator_1.EMPTY_WORKFLOW_DEFINITION,
+            workflowDefinition: workflow_definition_validator_1.NEW_TEMPLATE_WORKFLOW_DEFINITION,
         }));
         // As in `updateApprovalTemplate`: `categoryId` is no longer written by
         // `save()`, so the in-memory entity would come back without it even though
@@ -477,6 +482,14 @@ let TemplateService = TemplateService_1 = class TemplateService {
         if (target.status === template_enums_1.ApprovalTemplateVersionStatusEnum.DRAFT) {
             throw new common_1.ConflictException('Draft approval template versions cannot be rollback targets');
         }
+        // A rollback is a recovery path: the version passed the lint of its day
+        // and is not linted again, since a rule tightened since could refuse it
+        // (ADR 22 §5, docs/24 §1). The one check is that every function it calls
+        // is still registered; without it every case would fail on evaluation.
+        const unregisteredFunctionErrors = this.lintRegisteredFunctions(target.workflowDefinition, target.initiatorPolicyCel);
+        if (unregisteredFunctionErrors.length) {
+            throw new common_1.BadRequestException(unregisteredFunctionErrors.join('; '));
+        }
         const rolledBack = await this.templateRepository.manager.transaction(async (manager) => {
             const templateRepository = manager.getRepository(approval_template_entity_1.ApprovalTemplateEntity);
             const versionRepository = manager.getRepository(approval_template_version_entity_1.ApprovalTemplateVersionEntity);
@@ -562,24 +575,22 @@ let TemplateService = TemplateService_1 = class TemplateService {
             throw new common_1.BadRequestException('Approval template can only bind a published form definition version');
         }
         const workflowResult = (0, workflow_definition_validator_1.lintWorkflowDefinition)(version.workflowDefinition);
-        const conditionErrors = [
-            ...this.conditionService.lintExpressions([
-                {
-                    expression: version.initiatorPolicyCel,
-                    label: 'initiatorPolicyCel',
-                },
-            ], { allowedRootIdentifiers: INITIATOR_POLICY_ROOT_IDENTIFIERS }),
-            ...this.conditionService.lintExpressions(readNodeConditionExpressions(version.workflowDefinition), { allowedRootIdentifiers: WORKFLOW_EXPRESSION_ROOT_IDENTIFIERS }),
-            // Edge conditions also see the decision just made on the node they
-            // leave (workflow-engine `evaluateWorkflowEdge` and its dry-run twin).
-            ...this.conditionService.lintExpressions(readEdgeConditionExpressions(version.workflowDefinition), {
-                allowedRootIdentifiers: [
-                    ...WORKFLOW_EXPRESSION_ROOT_IDENTIFIERS,
-                    'lastDecision',
-                ],
-            }),
-        ];
-        const tableReferenceErrors = lintWorkflowTableReferences(version.workflowDefinition, version.initiatorPolicyCel, formVersion.schema);
+        // An unknown dialect is refused by `lintWorkflowDefinition`; its
+        // expressions are not parsed with a guessed engine.
+        const dialect = readPublishDialect(version.workflowDefinition);
+        const fieldReader = createExpressionFieldReader(dialect ?? expression_dialect_1.DEFAULT_EXPRESSION_DIALECT);
+        const conditionErrors = dialect === 'cel-v2'
+            ? this.lintCelV2Expressions(version, formVersion.schema)
+            : dialect === null
+                ? []
+                : this.lintCelLegacyExpressions(version);
+        // ADR 22 §5.5 names no dialect, and a write path is not CEL: its reserved
+        // segments are refused in either. That it names a declared field is
+        // checked for cel-v2 only (`lintCelV2Expressions`).
+        const setFormFieldPathErrors = dialect === null
+            ? []
+            : lintSetFormFieldReservedSegments(version.workflowDefinition);
+        const tableReferenceErrors = lintWorkflowTableReferences(version.workflowDefinition, version.initiatorPolicyCel, formVersion.schema, fieldReader);
         const memberReferenceErrors = lintWorkflowMemberReferences(version.workflowDefinition, formVersion.schema);
         const orgUnitReferenceErrors = lintWorkflowOrgUnitReferences(version.workflowDefinition, formVersion.schema);
         // The graph checks read a sound graph (the publish lint refuses cycles
@@ -589,11 +600,12 @@ let TemplateService = TemplateService_1 = class TemplateService {
             ? lintWorkflowNodeActorSources(version.workflowDefinition)
             : [];
         const approverFilledFieldErrors = (0, bpm_core_shared_1.readFormFieldAccessIssues)(version.workflowDefinition, formVersion.schema).map((issue) => issue.message);
-        const approverFilledReadErrors = lintApproverFilledFieldReads(version.workflowDefinition);
+        const approverFilledReadErrors = lintApproverFilledFieldReads(version.workflowDefinition, fieldReader);
         const webhookErrors = await this.lintWorkflowWebhooks(version.workflowDefinition, formVersion.schema);
         const errors = [
             ...workflowResult.errors,
             ...conditionErrors,
+            ...setFormFieldPathErrors,
             ...tableReferenceErrors,
             ...memberReferenceErrors,
             ...orgUnitReferenceErrors,
@@ -606,6 +618,69 @@ let TemplateService = TemplateService_1 = class TemplateService {
             throw new common_1.BadRequestException(errors.join('; '));
         }
     }
+    /** The cel-legacy publish lint, unchanged (docs/24 §1). */
+    lintCelLegacyExpressions(version) {
+        return [
+            ...this.conditionService.lintExpressions([
+                {
+                    expression: version.initiatorPolicyCel,
+                    label: 'initiatorPolicyCel',
+                },
+            ], { allowedRootIdentifiers: INITIATOR_POLICY_ROOT_IDENTIFIERS }),
+            ...this.conditionService.lintExpressions(readNodeConditionExpressions(version.workflowDefinition), { allowedRootIdentifiers: WORKFLOW_EXPRESSION_ROOT_IDENTIFIERS }),
+            // Edge conditions also see the decision just made on the node they
+            // leave (workflow-engine `evaluateWorkflowEdge` and its dry-run twin).
+            ...this.conditionService.lintExpressions(readEdgeConditionExpressions(version.workflowDefinition), {
+                allowedRootIdentifiers: [
+                    ...WORKFLOW_EXPRESSION_ROOT_IDENTIFIERS,
+                    'lastDecision',
+                ],
+            }),
+        ];
+    }
+    /**
+     * The cel-v2 publish lint (ADR 22 §3.4, §5): every expression on its AST
+     * with its use point's roots, the bound form's fields and types and the
+     * function registry, plus the `SET_FORM_FIELD` write targets. Warnings do
+     * not refuse a publish; the designer reads them through
+     * `ConditionService.lintExpressionIssues`.
+     */
+    lintCelV2Expressions(version, formSchema) {
+        const fields = new Map((formSchema?.fields ?? []).map((entry) => [entry.fieldKey, entry]));
+        return [
+            ...readUsagePointExpressions(version.workflowDefinition, version.initiatorPolicyCel).flatMap(({ expression, label, targetFieldKey, usagePoint }) => this.conditionService.lintExpression(expression, label, {
+                dialect: 'cel-v2',
+                formSchema,
+                functionRegistry: this.expressionFunctionRegistry ?? null,
+                targetField: targetFieldKey === null ? null : (fields.get(targetFieldKey) ?? null),
+                usagePoint,
+            })),
+            ...lintSetFormFieldDeclaredFields(version.workflowDefinition, formSchema),
+        ];
+    }
+    /**
+     * The functions a version calls that the registry no longer has, as lint
+     * lines. Only cel-v2 can call registered functions at all.
+     */
+    lintRegisteredFunctions(definition, initiatorPolicyCel) {
+        if (readPublishDialect(definition) !== 'cel-v2') {
+            return [];
+        }
+        const registry = this.expressionFunctionRegistry ?? null;
+        return readUsagePointExpressions(definition, initiatorPolicyCel).flatMap(({ expression, label }) => {
+            const names = typeof expression === 'string'
+                ? ((0, expression_ast_1.readExpressionHostFunctionNames)(expression.trim(), 'cel-v2') ?? [])
+                : [];
+            // Same name rule and registry isolation as the publish lint.
+            const missing = (0, expression_ast_1.readUnavailableExpressionFunctions)(names, registry);
+            return missing.map((name) => (0, bpm_core_shared_1.formatExpressionLintIssue)({
+                code: 'EXPR_FUNCTION_NOT_REGISTERED',
+                label,
+                severity: 'ERROR',
+                subject: name,
+            }));
+        });
+    }
     /**
      * Publish rules that need the webhook endpoint catalog (ADR 18 §4).
      *
@@ -624,6 +699,9 @@ let TemplateService = TemplateService_1 = class TemplateService {
             }
         })();
         return (0, workflow_webhook_validator_1.lintWorkflowWebhookTargets)({
+            // The injected service: the NOTIFY `EXPRESSION` lint sees the same
+            // function registry the engine evaluates with (docs/23 P4／P5 交接).
+            conditionService: this.conditionService,
             definition,
             formSchema,
             hasEndpointSources: Boolean(webhookService?.hasEndpointSources()),
@@ -737,13 +815,15 @@ exports.TemplateService = TemplateService = TemplateService_1 = tslib_1.__decora
     tslib_1.__param(1, (0, typeorm_1.InjectRepository)(approval_template_category_entity_1.ApprovalTemplateCategoryEntity)),
     tslib_1.__param(2, (0, typeorm_1.InjectRepository)(approval_template_version_entity_1.ApprovalTemplateVersionEntity)),
     tslib_1.__param(3, (0, typeorm_1.InjectRepository)(form_definition_version_entity_1.FormDefinitionVersionEntity)),
+    tslib_1.__param(7, (0, common_1.Optional)()),
+    tslib_1.__param(7, (0, common_1.Inject)(expression_function_types_1.BPM_EXPRESSION_FUNCTION_REGISTRY)),
     tslib_1.__metadata("design:paramtypes", [typeorm_2.Repository,
         typeorm_2.Repository,
         typeorm_2.Repository,
         typeorm_2.Repository,
         condition_service_1.ConditionService,
         form_service_1.FormService,
-        core_1.ModuleRef])
+        core_1.ModuleRef, Object])
 ], TemplateService);
 function parseOptionalJsonObject(value) {
     if (!value) {
@@ -835,14 +915,14 @@ function createApprovalTemplateCategoryWhere(options) {
  * a `conditionFieldKey` of `items.qty` simply resolves to `undefined` at
  * runtime. Both would fail silently rather than loudly.
  */
-function lintWorkflowTableReferences(definition, initiatorPolicyCel, schema) {
+function lintWorkflowTableReferences(definition, initiatorPolicyCel, schema, fieldReader) {
     const tableFieldKeys = (0, form_table_reference_1.readTableFieldKeys)(schema);
     if (!tableFieldKeys.size) {
         return [];
     }
     const expressionErrors = readConditionExpressions(definition, initiatorPolicyCel).flatMap(({ expression, label }) => typeof expression === 'string'
         ? [...tableFieldKeys]
-            .filter((tableKey) => (0, form_table_reference_1.referencesTableInternals)(expression, tableKey))
+            .filter((tableKey) => fieldReader.readsTableInternals(expression, tableKey))
             .map((tableKey) => `${label} must not reference table field internals: ${tableKey}`)
         : []);
     const structuredErrors = definition.edges
@@ -997,7 +1077,7 @@ function lintWorkflowNodeActorSources(definition) {
  * The definition may hold a cycle (the cycle lint reports it in the same
  * pass), which the visited set in `readReachableWorkflowNodeIds` copes with.
  */
-function lintApproverFilledFieldReads(definition) {
+function lintApproverFilledFieldReads(definition, fieldReader) {
     const fieldKeys = [...(0, bpm_core_shared_1.readApproverFilledFieldKeys)(definition)];
     if (!fieldKeys.length) {
         return [];
@@ -1026,11 +1106,11 @@ function lintApproverFilledFieldReads(definition) {
         const nodeLabels = nodeSources
             .filter(({ expression, nodeId }) => nodeIdsReadingEarly.has(nodeId) &&
             typeof expression === 'string' &&
-            (0, form_table_reference_1.referencesFormField)(expression, fieldKey))
+            fieldReader.readsField(expression, fieldKey))
             .map(({ label }) => label);
         const edgeLabels = definition.edges
             .filter((edge) => earlyNodeIds.has(edge.source))
-            .flatMap((edge) => readEdgeFieldReadLabels(edge, fieldKey));
+            .flatMap((edge) => readEdgeFieldReadLabels(edge, fieldKey, fieldReader));
         return [...nodeLabels, ...edgeLabels].map((label) => workflow_graph_1.WORKFLOW_LINT_MESSAGES.approverFilledFieldReadEarly(label, fieldKey));
     });
 }
@@ -1040,12 +1120,13 @@ function hasEntryCondition(node) {
 }
 // The label of the one line an edge earns for `fieldKey`: the CEL condition
 // wins over the structured condition, so an edge carrying both reads once.
-function readEdgeFieldReadLabels(edge, fieldKey) {
+function readEdgeFieldReadLabels(edge, fieldKey, fieldReader) {
     // A draft's edge may carry no `data` at all.
     const data = edge.data;
     const condition = data?.condition;
     const conditionFieldKey = data?.conditionFieldKey;
-    if (typeof condition === 'string' && (0, form_table_reference_1.referencesFormField)(condition, fieldKey)) {
+    if (typeof condition === 'string' &&
+        fieldReader.readsField(condition, fieldKey)) {
         return [workflow_graph_1.WORKFLOW_EXPRESSION_LABELS.edgeCondition(edge.id)];
     }
     return typeof conditionFieldKey === 'string' &&
@@ -1143,6 +1224,213 @@ function readNodeExpressions(node) {
     }
     return [];
 }
+/**
+ * The dialect a definition is published with: the default when it names
+ * none, `null` when it names one this version does not know (refused by
+ * `lintWorkflowDefinition`).
+ */
+function readPublishDialect(definition) {
+    const value = definition?.expressionDialect;
+    if (value === undefined || value === null) {
+        return expression_dialect_1.DEFAULT_EXPRESSION_DIALECT;
+    }
+    return (0, expression_dialect_1.isExpressionDialect)(value) ? value : null;
+}
+const TEXTUAL_FIELD_READER = {
+    readsField: form_table_reference_1.referencesFormField,
+    readsTableInternals: form_table_reference_1.referencesTableInternals,
+};
+function createExpressionFieldReader(dialect) {
+    if (dialect !== 'cel-v2') {
+        return TEXTUAL_FIELD_READER;
+    }
+    const cache = new Map();
+    const read = (expression) => {
+        if (!cache.has(expression)) {
+            const result = (0, expression_ast_1.readExpressionReferences)(expression.trim(), 'cel-v2');
+            cache.set(expression, result.status === 'OK' ? result.references : null);
+        }
+        return cache.get(expression) ?? null;
+    };
+    return {
+        readsField: (expression, fieldKey) => {
+            const references = read(expression);
+            return references
+                ? (0, expression_ast_1.readsFormField)(references, fieldKey)
+                : (0, form_table_reference_1.referencesFormField)(expression, fieldKey);
+        },
+        readsTableInternals: (expression, tableKey) => {
+            const references = read(expression);
+            return references
+                ? (0, expression_ast_1.readsTableInternals)(references, tableKey)
+                : (0, form_table_reference_1.referencesTableInternals)(expression, tableKey);
+        },
+    };
+}
+/**
+ * Every expression of a version with its use point (docs/24 §2.3). Unlike
+ * the cel-legacy readers this includes the NOTIFY recipients expression,
+ * which is evaluated like an approver expression. A draft is not
+ * shape-checked, so every read is guarded. Also read by the designer's
+ * expression analysis and dialect upgrade check (Phase 23 P4).
+ */
+function readUsagePointExpressions(definition, initiatorPolicyCel) {
+    const nodes = Array.isArray(definition?.nodes)
+        ? definition.nodes
+        : [];
+    const edges = Array.isArray(definition?.edges)
+        ? definition.edges
+        : [];
+    const entry = (expression, label, usagePoint, targetFieldKey = null) => ({ expression, label, targetFieldKey, usagePoint });
+    return [
+        entry(initiatorPolicyCel, 'initiatorPolicyCel', 'INITIATOR_POLICY'),
+        ...nodes.flatMap((node) => {
+            const data = node?.data;
+            if (!isRecord(data) || typeof node.id !== 'string') {
+                return [];
+            }
+            const entryCondition = entry(readOptionalString(data['entryCondition']), workflow_graph_1.WORKFLOW_EXPRESSION_LABELS.nodeEntryCondition(node.id), 'ENTRY_CONDITION');
+            if (node.type === 'userTask') {
+                const resolver = data['approverResolver'];
+                return [
+                    entryCondition,
+                    ...(isRecord(resolver) && resolver['type'] === 'EXPRESSION'
+                        ? [
+                            entry(readOptionalString(resolver['expression']), workflow_graph_1.WORKFLOW_EXPRESSION_LABELS.nodeApproverResolverExpression(node.id), 'APPROVER_RESOLVER'),
+                        ]
+                        : []),
+                ];
+            }
+            if (node.type !== 'serviceTask') {
+                return [];
+            }
+            const action = data['action'];
+            if (!isRecord(action)) {
+                return [entryCondition];
+            }
+            if (action['type'] === 'WEBHOOK') {
+                return [
+                    entryCondition,
+                    entry(readOptionalString(action['payload']), workflow_graph_1.WORKFLOW_EXPRESSION_LABELS.nodeActionPayload(node.id), 'WEBHOOK_PAYLOAD'),
+                ];
+            }
+            if (action['type'] === 'SET_FORM_FIELD') {
+                const fieldPath = action['fieldPath'];
+                return [
+                    entryCondition,
+                    entry(readOptionalString(action['value']), workflow_graph_1.WORKFLOW_EXPRESSION_LABELS.nodeActionValue(node.id), 'SERVICE_FORM_FIELD_VALUE', typeof fieldPath === 'string' ? readWholeFieldTarget(fieldPath) : null),
+                ];
+            }
+            const recipients = action['recipients'];
+            return action['type'] === 'NOTIFY' &&
+                isRecord(recipients) &&
+                recipients['type'] === 'EXPRESSION'
+                ? [
+                    entryCondition,
+                    entry(readOptionalString(recipients['expression']), workflow_graph_1.WORKFLOW_EXPRESSION_LABELS.nodeActionRecipientsExpression(node.id), 'APPROVER_RESOLVER'),
+                ]
+                : [entryCondition];
+        }),
+        ...edges.flatMap((edge) => {
+            const data = edge?.data;
+            return typeof edge?.id === 'string' && isRecord(data)
+                ? [
+                    entry(readOptionalString(data['condition']), workflow_graph_1.WORKFLOW_EXPRESSION_LABELS.edgeCondition(edge.id), 'FLOW_CONDITION'),
+                ]
+                : [];
+        }),
+    ];
+}
+/**
+ * The field a `SET_FORM_FIELD` path writes as a whole: `amount`, `form.amount`.
+ * A deeper path (`meta.code`) writes inside a field, whose declared type then
+ * says nothing about the value, so it has no target.
+ */
+function readWholeFieldTarget(fieldPath) {
+    const segments = fieldPath
+        .split('.')
+        .map((segment) => segment.trim())
+        .filter(Boolean);
+    const fieldSegments = segments[0] === 'form' || segments[0] === 'formData'
+        ? segments.slice(1)
+        : segments;
+    return fieldSegments.length === 1 && !/[[\]]/u.test(fieldSegments[0])
+        ? fieldSegments[0]
+        : null;
+}
+function readOptionalString(value) {
+    return typeof value === 'string' || value === null ? value : undefined;
+}
+/**
+ * Every non-blank `SET_FORM_FIELD` write path in a definition. A blank path is
+ * reported by the structural lint already.
+ */
+function readSetFormFieldPaths(definition) {
+    const nodes = Array.isArray(definition?.nodes)
+        ? definition.nodes
+        : [];
+    return nodes.flatMap((node) => {
+        const data = node?.data;
+        const action = isRecord(data) ? data['action'] : undefined;
+        const fieldPath = isRecord(action) && action['type'] === 'SET_FORM_FIELD'
+            ? action['fieldPath']
+            : undefined;
+        if (typeof fieldPath !== 'string' || !fieldPath.trim()) {
+            return [];
+        }
+        return [
+            {
+                fieldPath,
+                label: `workflow.nodes.${node.id}.action.fieldPath`,
+                reserved: [
+                    ...new Set(fieldPath
+                        .split(/[.[\]"']/u)
+                        .map((segment) => segment.trim())
+                        .filter((segment) => expression_ast_1.RESERVED_PATH_SEGMENTS.has(segment))),
+                ],
+            },
+        ];
+    });
+}
+/**
+ * ADR 22 §5.5, the half that holds in both dialects: a `SET_FORM_FIELD` path
+ * has no `__proto__`, `constructor` or `prototype` segment.
+ */
+function lintSetFormFieldReservedSegments(definition) {
+    return readSetFormFieldPaths(definition).flatMap(({ label, reserved }) => reserved.map((segment) => (0, bpm_core_shared_1.formatExpressionLintIssue)({
+        code: 'EXPR_RESERVED_PATH_SEGMENT',
+        label,
+        severity: 'ERROR',
+        subject: segment,
+    })));
+}
+/**
+ * ADR 22 §3.4 / §5.5 for cel-v2 definitions: a `SET_FORM_FIELD` writes a
+ * field the bound form declares. A path with a reserved segment is reported
+ * by `lintSetFormFieldReservedSegments` instead. cel-legacy does not get this
+ * half yet: a fork of an older version may write a field its form dropped.
+ */
+function lintSetFormFieldDeclaredFields(definition, schema) {
+    if (!schema) {
+        return [];
+    }
+    const fieldKeys = new Set((schema.fields ?? []).map((entry) => entry.fieldKey));
+    return readSetFormFieldPaths(definition)
+        .filter(({ reserved }) => reserved.length === 0)
+        .flatMap(({ fieldPath, label }) => {
+        const fieldKey = (0, bpm_core_shared_1.readFormFieldPathTopLevelKey)(fieldPath);
+        return fieldKeys.has(fieldKey)
+            ? []
+            : [
+                (0, bpm_core_shared_1.formatExpressionLintIssue)({
+                    code: 'EXPR_FIELD_UNKNOWN',
+                    label,
+                    severity: 'ERROR',
+                    subject: fieldKey,
+                }),
+            ];
+    });
+}
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }