@shipfox/expression 1.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Shipfox
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,117 @@
+# Expression
+
+CEL checks and run-time evaluation for Shipfox workflow expressions.
+
+## What it does
+
+- **`createWorkflowExpression`**: Checks source text in `syntax` or `typed`
+  mode.
+- **`WorkflowExpression`**: Stores the CEL tag, source, and check level.
+- **`ExpressionTypeEnvironment`**: Lists names and field types for typed checks.
+- **`evaluateWorkflowExpression`**: Runs a checked value against caller data.
+- **`evaluateWorkflowPredicate`**: Returns `true` only for the boolean `true`.
+- **`parseWorkflowTemplate`**: Splits strings with `${{ ... }}` spans into
+  ordered literal and expression segments.
+- **`extractCelContextRoots`**: Returns the sorted top-level CEL identifiers mentioned
+  by an expression for downstream context and trust checks.
+- **Typed errors**: Reports bad text and run failures with stable error classes.
+- **`workflowContextDefinitions`**: Names the workflow contexts (`run`,
+  `trigger`, `event`, `inputs`, `job`, `executions`, `execution`, `jobs`, `step`) and
+  gives each a shape, trust tier, availability site, sensitivity, and host.
+  Known-shape contexts ship a typed environment; open ones use `syntax`.
+- **`workflowInterpolationFieldPolicies`**: Says which trust tier each
+  interpolatable field accepts, and whether its value needs sanitizing before
+  display. Use `workflowInterpolationFieldAcceptsContext` and
+  `workflowInterpolationFieldAcceptsTrustTier` to run those checks.
+
+Use this package where workflow code accepts or runs expression text. It keeps
+the CEL parser behind a Shipfox API. Other packages do not need to depend on the
+vendor parser.
+
+Call it near the place where a person, file, or tool gives us text. If the text
+is wrong, stop there and show the error near that field. If the text is good,
+save the small value this package returns. Later, pass that value and plain data
+back to this package to get the result for one run.
+
+## Installation / Setup
+
+```sh
+pnpm add @shipfox/expression
+```
+
+## Usage
+
+```ts
+import {
+  createWorkflowExpression,
+  evaluateWorkflowPredicate,
+} from '@shipfox/expression';
+
+const expression = createWorkflowExpression({
+  source: 'event.conclusion == "success"',
+  check: {
+    mode: 'typed',
+    typeEnvironment: {
+      event: {kind: 'object', fields: {conclusion: 'string'}},
+    },
+  },
+});
+
+const passed = evaluateWorkflowPredicate(expression, {
+  event: {conclusion: 'success'},
+});
+```
+
+## Behavior Notes
+
+- Use `syntax` when fields are not known yet.
+- Use `typed` when the caller knows the names and field types in scope.
+- Treat the `event`, `inputs`, and open `jobs` contexts as untrusted.
+  Interpolation field policies decide what untrusted data may reach each field.
+- Evaluation is deterministic and has no side effects.
+- The caller must pass values that match the checked data shape.
+- The evaluator does not read secrets, database rows, events, files, or external
+  services.
+- Template parsing throws only `InvalidWorkflowTemplateError`. The error includes
+  the full source, the span `offset`, and a reason; invalid inner CEL is wrapped
+  with the inner expression error available as `cause`.
+- Write a literal `${{` in template text as `$${{`. The escape is greedy from
+  left to right, so `$$${{` emits literal `$${{`; there is no separate way to
+  write literal `$$` immediately before a real expression opener.
+  Put the dollar inside the expression when it must be dynamic, such as
+  `${{ "$" + string(inputs.amount) }}`.
+- Template closing scans are string-aware, line-comment-aware, and brace-aware,
+  so `}}` inside CEL strings, `//` comments, or map literals does not close the
+  expression span.
+- Context root extraction fails closed for trust decisions. It skips only identifiers
+  that are provably not context roots and may over-include comprehension variables or
+  struct keys; downstream code maps context roots to the known workflow contexts.
+- Run command interpolation hoists expression values into generated environment
+  variables and references them through double-quoted shell expansion. This keeps
+  interpolated values from being parsed as shell syntax, but it does not make
+  commands and shell positions that deliberately re-evaluate their arguments
+  safe, such as `eval`, `sh -c "$value"`, `let`, `declare -i`, arithmetic
+  expressions, or array subscripts like `array[$value]`.
+Trigger filters can use `syntax` while integration event payloads are still open.
+Gate expressions can use `typed` because their local fields are known.
+
+The stored value does not include vendor ASTs, checked data, protobuf bytes, or
+compiled objects. It stores only the CEL tag, source, and check level.
+
+Keep this package free of state. Code that needs a database row, event payload,
+secret, file, or network call must load that data first. Then it can pass the
+data in one object. This keeps tests small and makes each run easy to reason
+about.
+
+## Development
+
+```sh
+turbo build --filter=@shipfox/expression
+turbo check --filter=@shipfox/expression
+turbo type --filter=@shipfox/expression
+turbo test --filter=@shipfox/expression
+```
+
+## License
+
+MIT

package/dist/evaluator/errors.d.ts

@@ -0,0 +1,8 @@
+export declare const workflowExpressionEvaluationErrorCode = "workflow-expression-evaluation-failed";
+export type WorkflowExpressionEvaluationFailureReason = 'missing-path' | 'evaluation-error';
+export declare class WorkflowExpressionEvaluationError extends Error {
+    readonly code = "workflow-expression-evaluation-failed";
+    readonly reason: WorkflowExpressionEvaluationFailureReason;
+    constructor(cause: unknown);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/evaluator/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/evaluator/errors.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,qCAAqC,0CAA0C,CAAC;AAE7F,MAAM,MAAM,yCAAyC,GAAG,cAAc,GAAG,kBAAkB,CAAC;AAE5F,qBAAa,iCAAkC,SAAQ,KAAK;IAC1D,QAAQ,CAAC,IAAI,2CAAyC;IACtD,QAAQ,CAAC,MAAM,EAAE,yCAAyC,CAAC;gBAE/C,KAAK,EAAE,OAAO;CAS3B"}

package/dist/evaluator/errors.js

@@ -0,0 +1,13 @@
+import { EvaluationError } from '@marcbachmann/cel-js';
+export const workflowExpressionEvaluationErrorCode = 'workflow-expression-evaluation-failed';
+export class WorkflowExpressionEvaluationError extends Error {
+    constructor(cause){
+        super('Workflow expression evaluation failed', {
+            cause
+        }), this.code = workflowExpressionEvaluationErrorCode;
+        this.name = 'WorkflowExpressionEvaluationError';
+        this.reason = cause instanceof EvaluationError && (cause.code === 'no_such_key' || cause.code === 'unknown_variable') ? 'missing-path' : 'evaluation-error';
+    }
+}
+
+//# sourceMappingURL=errors.js.map

package/dist/evaluator/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/evaluator/errors.ts"],"sourcesContent":["import {EvaluationError} from '@marcbachmann/cel-js';\n\nexport const workflowExpressionEvaluationErrorCode = 'workflow-expression-evaluation-failed';\n\nexport type WorkflowExpressionEvaluationFailureReason = 'missing-path' | 'evaluation-error';\n\nexport class WorkflowExpressionEvaluationError extends Error {\n  readonly code = workflowExpressionEvaluationErrorCode;\n  readonly reason: WorkflowExpressionEvaluationFailureReason;\n\n  constructor(cause: unknown) {\n    super('Workflow expression evaluation failed', {cause});\n    this.name = 'WorkflowExpressionEvaluationError';\n    this.reason =\n      cause instanceof EvaluationError &&\n      (cause.code === 'no_such_key' || cause.code === 'unknown_variable')\n        ? 'missing-path'\n        : 'evaluation-error';\n  }\n}\n"],"names":["EvaluationError","workflowExpressionEvaluationErrorCode","WorkflowExpressionEvaluationError","Error","cause","code","name","reason"],"mappings":"AAAA,SAAQA,eAAe,QAAO,uBAAuB;AAErD,OAAO,MAAMC,wCAAwC,wCAAwC;AAI7F,OAAO,MAAMC,0CAA0CC;IAIrD,YAAYC,KAAc,CAAE;QAC1B,KAAK,CAAC,yCAAyC;YAACA;QAAK,SAJ9CC,OAAOJ;QAKd,IAAI,CAACK,IAAI,GAAG;QACZ,IAAI,CAACC,MAAM,GACTH,iBAAiBJ,mBAChBI,CAAAA,MAAMC,IAAI,KAAK,iBAAiBD,MAAMC,IAAI,KAAK,kBAAiB,IAC7D,iBACA;IACR;AACF"}

package/dist/evaluator/evaluate-workflow-expression.d.ts

@@ -0,0 +1,11 @@
+import type { WorkflowExpression } from '../expression/workflow-expression.js';
+export type WorkflowExpressionEvaluationContext = Readonly<Record<string, unknown>>;
+export type WorkflowExpressionEvaluationValue = unknown;
+export declare function evaluateWorkflowExpression(expression: WorkflowExpression, context: WorkflowExpressionEvaluationContext): WorkflowExpressionEvaluationValue;
+export declare function evaluateWorkflowPredicate(expression: WorkflowExpression, context: WorkflowExpressionEvaluationContext): boolean;
+export interface FailClosedPredicateOutcome {
+    readonly value: boolean;
+    readonly evaluationFailed: boolean;
+}
+export declare function evaluateWorkflowPredicateFailClosed(expression: WorkflowExpression, context: WorkflowExpressionEvaluationContext): FailClosedPredicateOutcome;
+//# sourceMappingURL=evaluate-workflow-expression.d.ts.map

package/dist/evaluator/evaluate-workflow-expression.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-workflow-expression.d.ts","sourceRoot":"","sources":["../../src/evaluator/evaluate-workflow-expression.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,sCAAsC,CAAC;AAG7E,MAAM,MAAM,mCAAmC,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AACpF,MAAM,MAAM,iCAAiC,GAAG,OAAO,CAAC;AAExD,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,kBAAkB,EAC9B,OAAO,EAAE,mCAAmC,GAC3C,iCAAiC,CAMnC;AAED,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,kBAAkB,EAC9B,OAAO,EAAE,mCAAmC,GAC3C,OAAO,CAET;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACpC;AAED,wBAAgB,mCAAmC,CACjD,UAAU,EAAE,kBAAkB,EAC9B,OAAO,EAAE,mCAAmC,GAC3C,0BAA0B,CAS5B"}

package/dist/evaluator/evaluate-workflow-expression.js

@@ -0,0 +1,30 @@
+import { evaluate } from '@marcbachmann/cel-js';
+import { WorkflowExpressionEvaluationError } from './errors.js';
+export function evaluateWorkflowExpression(expression, context) {
+    try {
+        return evaluate(expression.source, context);
+    } catch (error) {
+        throw new WorkflowExpressionEvaluationError(error);
+    }
+}
+export function evaluateWorkflowPredicate(expression, context) {
+    return evaluateWorkflowExpression(expression, context) === true;
+}
+export function evaluateWorkflowPredicateFailClosed(expression, context) {
+    try {
+        return {
+            value: evaluateWorkflowPredicate(expression, context),
+            evaluationFailed: false
+        };
+    } catch (error) {
+        if (error instanceof WorkflowExpressionEvaluationError) {
+            return {
+                value: false,
+                evaluationFailed: true
+            };
+        }
+        throw error;
+    }
+}
+
+//# sourceMappingURL=evaluate-workflow-expression.js.map

package/dist/evaluator/evaluate-workflow-expression.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/evaluator/evaluate-workflow-expression.ts"],"sourcesContent":["import {evaluate} from '@marcbachmann/cel-js';\nimport type {WorkflowExpression} from '../expression/workflow-expression.js';\nimport {WorkflowExpressionEvaluationError} from './errors.js';\n\nexport type WorkflowExpressionEvaluationContext = Readonly<Record<string, unknown>>;\nexport type WorkflowExpressionEvaluationValue = unknown;\n\nexport function evaluateWorkflowExpression(\n  expression: WorkflowExpression,\n  context: WorkflowExpressionEvaluationContext,\n): WorkflowExpressionEvaluationValue {\n  try {\n    return evaluate(expression.source, context);\n  } catch (error) {\n    throw new WorkflowExpressionEvaluationError(error);\n  }\n}\n\nexport function evaluateWorkflowPredicate(\n  expression: WorkflowExpression,\n  context: WorkflowExpressionEvaluationContext,\n): boolean {\n  return evaluateWorkflowExpression(expression, context) === true;\n}\n\nexport interface FailClosedPredicateOutcome {\n  readonly value: boolean;\n  readonly evaluationFailed: boolean;\n}\n\nexport function evaluateWorkflowPredicateFailClosed(\n  expression: WorkflowExpression,\n  context: WorkflowExpressionEvaluationContext,\n): FailClosedPredicateOutcome {\n  try {\n    return {value: evaluateWorkflowPredicate(expression, context), evaluationFailed: false};\n  } catch (error) {\n    if (error instanceof WorkflowExpressionEvaluationError) {\n      return {value: false, evaluationFailed: true};\n    }\n    throw error;\n  }\n}\n"],"names":["evaluate","WorkflowExpressionEvaluationError","evaluateWorkflowExpression","expression","context","source","error","evaluateWorkflowPredicate","evaluateWorkflowPredicateFailClosed","value","evaluationFailed"],"mappings":"AAAA,SAAQA,QAAQ,QAAO,uBAAuB;AAE9C,SAAQC,iCAAiC,QAAO,cAAc;AAK9D,OAAO,SAASC,2BACdC,UAA8B,EAC9BC,OAA4C;IAE5C,IAAI;QACF,OAAOJ,SAASG,WAAWE,MAAM,EAAED;IACrC,EAAE,OAAOE,OAAO;QACd,MAAM,IAAIL,kCAAkCK;IAC9C;AACF;AAEA,OAAO,SAASC,0BACdJ,UAA8B,EAC9BC,OAA4C;IAE5C,OAAOF,2BAA2BC,YAAYC,aAAa;AAC7D;AAOA,OAAO,SAASI,oCACdL,UAA8B,EAC9BC,OAA4C;IAE5C,IAAI;QACF,OAAO;YAACK,OAAOF,0BAA0BJ,YAAYC;YAAUM,kBAAkB;QAAK;IACxF,EAAE,OAAOJ,OAAO;QACd,IAAIA,iBAAiBL,mCAAmC;YACtD,OAAO;gBAACQ,OAAO;gBAAOC,kBAAkB;YAAI;QAC9C;QACA,MAAMJ;IACR;AACF"}

package/dist/evaluator/index.d.ts

@@ -0,0 +1,3 @@
+export { WorkflowExpressionEvaluationError, type WorkflowExpressionEvaluationFailureReason, workflowExpressionEvaluationErrorCode, } from './errors.js';
+export { evaluateWorkflowExpression, evaluateWorkflowPredicate, evaluateWorkflowPredicateFailClosed, type FailClosedPredicateOutcome, type WorkflowExpressionEvaluationContext, type WorkflowExpressionEvaluationValue, } from './evaluate-workflow-expression.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/evaluator/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/evaluator/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iCAAiC,EACjC,KAAK,yCAAyC,EAC9C,qCAAqC,GACtC,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,mCAAmC,EACnC,KAAK,0BAA0B,EAC/B,KAAK,mCAAmC,EACxC,KAAK,iCAAiC,GACvC,MAAM,mCAAmC,CAAC"}

package/dist/evaluator/index.js

@@ -0,0 +1,4 @@
+export { WorkflowExpressionEvaluationError, workflowExpressionEvaluationErrorCode } from './errors.js';
+export { evaluateWorkflowExpression, evaluateWorkflowPredicate, evaluateWorkflowPredicateFailClosed } from './evaluate-workflow-expression.js';
+
+//# sourceMappingURL=index.js.map

package/dist/evaluator/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/evaluator/index.ts"],"sourcesContent":["export {\n  WorkflowExpressionEvaluationError,\n  type WorkflowExpressionEvaluationFailureReason,\n  workflowExpressionEvaluationErrorCode,\n} from './errors.js';\nexport {\n  evaluateWorkflowExpression,\n  evaluateWorkflowPredicate,\n  evaluateWorkflowPredicateFailClosed,\n  type FailClosedPredicateOutcome,\n  type WorkflowExpressionEvaluationContext,\n  type WorkflowExpressionEvaluationValue,\n} from './evaluate-workflow-expression.js';\n"],"names":["WorkflowExpressionEvaluationError","workflowExpressionEvaluationErrorCode","evaluateWorkflowExpression","evaluateWorkflowPredicate","evaluateWorkflowPredicateFailClosed"],"mappings":"AAAA,SACEA,iCAAiC,EAEjCC,qCAAqC,QAChC,cAAc;AACrB,SACEC,0BAA0B,EAC1BC,yBAAyB,EACzBC,mCAAmC,QAI9B,oCAAoC"}

package/dist/expression/create-workflow-expression.d.ts

@@ -0,0 +1,7 @@
+import type { CreateWorkflowExpressionParams, WorkflowExpression } from './workflow-expression.js';
+export declare function createWorkflowExpression(params: CreateWorkflowExpressionParams): WorkflowExpression;
+export declare function unsafeWorkflowExpressionFromSource(params: {
+    source: string;
+    check: WorkflowExpression['check'];
+}): WorkflowExpression;
+//# sourceMappingURL=create-workflow-expression.d.ts.map

package/dist/expression/create-workflow-expression.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-workflow-expression.d.ts","sourceRoot":"","sources":["../../src/expression/create-workflow-expression.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,8BAA8B,EAI9B,kBAAkB,EACnB,MAAM,0BAA0B,CAAC;AAelC,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,8BAA8B,GACrC,kBAAkB,CAuDpB;AAED,wBAAgB,kCAAkC,CAAC,MAAM,EAAE;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC;CACpC,GAAG,kBAAkB,CAOrB"}

package/dist/expression/create-workflow-expression.js

@@ -0,0 +1,156 @@
+import { Environment, parse as parseCel } from '@marcbachmann/cel-js';
+import { InvalidWorkflowExpressionError } from './errors.js';
+const scalarTypeToCelType = {
+    string: 'string',
+    int: 'int',
+    double: 'double',
+    bool: 'bool',
+    null: 'null',
+    timestamp: 'google.protobuf.Timestamp'
+};
+export function createWorkflowExpression(params) {
+    const source = params.source.trim();
+    let resultType;
+    if (source.length === 0) {
+        throw new InvalidWorkflowExpressionError({
+            source: params.source,
+            reason: 'Expression source must not be empty.'
+        });
+    }
+    try {
+        parseCel(source);
+    } catch (error) {
+        throw new InvalidWorkflowExpressionError({
+            source,
+            reason: error instanceof Error ? error.message : 'Expression source could not be parsed.'
+        });
+    }
+    if (params.check.mode === 'typed') {
+        const environment = new Environment({
+            unlistedVariablesAreDyn: false
+        });
+        for (const [name, type] of Object.entries(params.check.typeEnvironment ?? {})){
+            const celType = toCelType(type, environment, name);
+            if (typeof celType === 'string') {
+                environment.registerVariable(name, celType);
+            } else {
+                environment.registerVariable({
+                    name,
+                    schema: celType.schema
+                });
+            }
+        }
+        const typeCheckResult = environment.check(source);
+        if (!typeCheckResult.valid) {
+            throw new InvalidWorkflowExpressionError({
+                source,
+                reason: typeCheckResult.error?.message ?? 'Expression source did not type-check.'
+            });
+        }
+        if (params.check.expectedResultType !== undefined && typeCheckResult.type !== scalarTypeToCelType[params.check.expectedResultType]) {
+            throw new InvalidWorkflowExpressionError({
+                source,
+                reason: `Expression source must return ${scalarTypeToCelType[params.check.expectedResultType]}; got ${typeCheckResult.type ?? 'unknown'}.`
+            });
+        }
+        resultType = fromCelType(typeCheckResult.type);
+    }
+    return {
+        language: 'cel',
+        source: source,
+        check: params.check.mode,
+        ...resultType === undefined ? {} : {
+            resultType
+        }
+    };
+}
+export function unsafeWorkflowExpressionFromSource(params) {
+    // Use only when rehydrating a source that was already validated before storage.
+    return {
+        language: 'cel',
+        source: params.source,
+        check: params.check
+    };
+}
+function toCelType(type, environment, variableName) {
+    if (typeof type === 'string') return scalarTypeToCelType[type];
+    if (type.kind === 'list') {
+        return `list<${toCelListElementType(type.element, environment, variableName)}>`;
+    }
+    if (type.kind === 'map') return 'map';
+    return {
+        schema: Object.fromEntries(Object.entries(type.fields).map(([name, field])=>[
+                name,
+                toCelSchemaType(field)
+            ]))
+    };
+}
+function toCelSchemaType(type) {
+    if (typeof type === 'string') return scalarTypeToCelType[type];
+    if (type.kind === 'list') return `list<${toCelSchemaListElementType(type.element)}>`;
+    if (type.kind === 'map') return 'map';
+    return Object.fromEntries(Object.entries(type.fields).map(([name, field])=>[
+            name,
+            toCelSchemaType(field)
+        ]));
+}
+function toCelSchemaListElementType(type) {
+    if (typeof type === 'string') return scalarTypeToCelType[type];
+    if (type.kind === 'map') return 'map';
+    if (type.kind === 'object') return 'dyn';
+    return `list<${toCelSchemaListElementType(type.element)}>`;
+}
+function toCelListElementType(type, environment, variableName) {
+    if (typeof type === 'string') return scalarTypeToCelType[type];
+    if (type.kind === 'map') return 'map';
+    if (type.kind === 'object') {
+        const typeName = `$${variableName}.item`;
+        environment.registerType({
+            name: typeName,
+            schema: Object.fromEntries(Object.entries(type.fields).map(([name, field])=>[
+                    name,
+                    toCelSchemaType(field)
+                ]))
+        });
+        return typeName;
+    }
+    return 'dyn';
+}
+function fromCelType(type) {
+    if (type === undefined) return undefined;
+    switch(type){
+        case 'string':
+            return 'string';
+        case 'int':
+            return 'int';
+        case 'double':
+            return 'double';
+        case 'bool':
+            return 'bool';
+        case 'null':
+            return 'null';
+        case 'google.protobuf.Timestamp':
+            return 'timestamp';
+        case 'map':
+            return {
+                kind: 'map'
+            };
+        case 'dyn':
+            return 'string';
+        default:
+            // cel-js currently exposes custom/list element result types as opaque strings.
+            // Keep the outer list shape when present, but erase element detail rather than
+            // pretending we can round-trip the original schema.
+            if (type.startsWith('list<')) return {
+                kind: 'list',
+                element: {
+                    kind: 'map'
+                }
+            };
+            return {
+                kind: 'map'
+            };
+    }
+}
+
+//# sourceMappingURL=create-workflow-expression.js.map

package/dist/expression/create-workflow-expression.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/expression/create-workflow-expression.ts"],"sourcesContent":["import {Environment, parse as parseCel} from '@marcbachmann/cel-js';\nimport {InvalidWorkflowExpressionError} from './errors.js';\nimport type {\n  CreateWorkflowExpressionParams,\n  ExpressionScalarType,\n  ExpressionType,\n  ValidCelExpression,\n  WorkflowExpression,\n} from './workflow-expression.js';\n\nconst scalarTypeToCelType = {\n  string: 'string',\n  int: 'int',\n  double: 'double',\n  bool: 'bool',\n  null: 'null',\n  timestamp: 'google.protobuf.Timestamp',\n} satisfies Record<ExpressionScalarType, string>;\n\ntype CelSchema = {\n  [field: string]: string | CelSchema;\n};\n\nexport function createWorkflowExpression(\n  params: CreateWorkflowExpressionParams,\n): WorkflowExpression {\n  const source = params.source.trim();\n  let resultType: ExpressionType | undefined;\n  if (source.length === 0) {\n    throw new InvalidWorkflowExpressionError({\n      source: params.source,\n      reason: 'Expression source must not be empty.',\n    });\n  }\n\n  try {\n    parseCel(source);\n  } catch (error) {\n    throw new InvalidWorkflowExpressionError({\n      source,\n      reason: error instanceof Error ? error.message : 'Expression source could not be parsed.',\n    });\n  }\n\n  if (params.check.mode === 'typed') {\n    const environment = new Environment({unlistedVariablesAreDyn: false});\n    for (const [name, type] of Object.entries(params.check.typeEnvironment ?? {})) {\n      const celType = toCelType(type, environment, name);\n      if (typeof celType === 'string') {\n        environment.registerVariable(name, celType);\n      } else {\n        environment.registerVariable({name, schema: celType.schema});\n      }\n    }\n\n    const typeCheckResult = environment.check(source);\n    if (!typeCheckResult.valid) {\n      throw new InvalidWorkflowExpressionError({\n        source,\n        reason: typeCheckResult.error?.message ?? 'Expression source did not type-check.',\n      });\n    }\n    if (\n      params.check.expectedResultType !== undefined &&\n      typeCheckResult.type !== scalarTypeToCelType[params.check.expectedResultType]\n    ) {\n      throw new InvalidWorkflowExpressionError({\n        source,\n        reason: `Expression source must return ${scalarTypeToCelType[params.check.expectedResultType]}; got ${typeCheckResult.type ?? 'unknown'}.`,\n      });\n    }\n    resultType = fromCelType(typeCheckResult.type);\n  }\n\n  return {\n    language: 'cel',\n    source: source as ValidCelExpression,\n    check: params.check.mode,\n    ...(resultType === undefined ? {} : {resultType}),\n  };\n}\n\nexport function unsafeWorkflowExpressionFromSource(params: {\n  source: string;\n  check: WorkflowExpression['check'];\n}): WorkflowExpression {\n  // Use only when rehydrating a source that was already validated before storage.\n  return {\n    language: 'cel',\n    source: params.source as ValidCelExpression,\n    check: params.check,\n  };\n}\n\nfunction toCelType(\n  type: ExpressionType,\n  environment: Environment,\n  variableName: string,\n): string | {schema: CelSchema} {\n  if (typeof type === 'string') return scalarTypeToCelType[type];\n  if (type.kind === 'list') {\n    return `list<${toCelListElementType(type.element, environment, variableName)}>`;\n  }\n  if (type.kind === 'map') return 'map';\n\n  return {\n    schema: Object.fromEntries(\n      Object.entries(type.fields).map(([name, field]) => [name, toCelSchemaType(field)]),\n    ),\n  };\n}\n\nfunction toCelSchemaType(type: ExpressionType): string | CelSchema {\n  if (typeof type === 'string') return scalarTypeToCelType[type];\n  if (type.kind === 'list') return `list<${toCelSchemaListElementType(type.element)}>`;\n  if (type.kind === 'map') return 'map';\n  return Object.fromEntries(\n    Object.entries(type.fields).map(([name, field]) => [name, toCelSchemaType(field)]),\n  );\n}\n\nfunction toCelSchemaListElementType(type: ExpressionType): string {\n  if (typeof type === 'string') return scalarTypeToCelType[type];\n  if (type.kind === 'map') return 'map';\n  if (type.kind === 'object') return 'dyn';\n  return `list<${toCelSchemaListElementType(type.element)}>`;\n}\n\nfunction toCelListElementType(\n  type: ExpressionType,\n  environment: Environment,\n  variableName: string,\n): string {\n  if (typeof type === 'string') return scalarTypeToCelType[type];\n  if (type.kind === 'map') return 'map';\n  if (type.kind === 'object') {\n    const typeName = `$${variableName}.item`;\n    environment.registerType({\n      name: typeName,\n      schema: Object.fromEntries(\n        Object.entries(type.fields).map(([name, field]) => [name, toCelSchemaType(field)]),\n      ),\n    });\n    return typeName;\n  }\n  return 'dyn';\n}\n\nfunction fromCelType(type: string | undefined): ExpressionType | undefined {\n  if (type === undefined) return undefined;\n\n  switch (type) {\n    case 'string':\n      return 'string';\n    case 'int':\n      return 'int';\n    case 'double':\n      return 'double';\n    case 'bool':\n      return 'bool';\n    case 'null':\n      return 'null';\n    case 'google.protobuf.Timestamp':\n      return 'timestamp';\n    case 'map':\n      return {kind: 'map'};\n    case 'dyn':\n      return 'string';\n    default:\n      // cel-js currently exposes custom/list element result types as opaque strings.\n      // Keep the outer list shape when present, but erase element detail rather than\n      // pretending we can round-trip the original schema.\n      if (type.startsWith('list<')) return {kind: 'list', element: {kind: 'map'}};\n      return {kind: 'map'};\n  }\n}\n"],"names":["Environment","parse","parseCel","InvalidWorkflowExpressionError","scalarTypeToCelType","string","int","double","bool","null","timestamp","createWorkflowExpression","params","source","trim","resultType","length","reason","error","Error","message","check","mode","environment","unlistedVariablesAreDyn","name","type","Object","entries","typeEnvironment","celType","toCelType","registerVariable","schema","typeCheckResult","valid","expectedResultType","undefined","fromCelType","language","unsafeWorkflowExpressionFromSource","variableName","kind","toCelListElementType","element","fromEntries","fields","map","field","toCelSchemaType","toCelSchemaListElementType","typeName","registerType","startsWith"],"mappings":"AAAA,SAAQA,WAAW,EAAEC,SAASC,QAAQ,QAAO,uBAAuB;AACpE,SAAQC,8BAA8B,QAAO,cAAc;AAS3D,MAAMC,sBAAsB;IAC1BC,QAAQ;IACRC,KAAK;IACLC,QAAQ;IACRC,MAAM;IACNC,MAAM;IACNC,WAAW;AACb;AAMA,OAAO,SAASC,yBACdC,MAAsC;IAEtC,MAAMC,SAASD,OAAOC,MAAM,CAACC,IAAI;IACjC,IAAIC;IACJ,IAAIF,OAAOG,MAAM,KAAK,GAAG;QACvB,MAAM,IAAIb,+BAA+B;YACvCU,QAAQD,OAAOC,MAAM;YACrBI,QAAQ;QACV;IACF;IAEA,IAAI;QACFf,SAASW;IACX,EAAE,OAAOK,OAAO;QACd,MAAM,IAAIf,+BAA+B;YACvCU;YACAI,QAAQC,iBAAiBC,QAAQD,MAAME,OAAO,GAAG;QACnD;IACF;IAEA,IAAIR,OAAOS,KAAK,CAACC,IAAI,KAAK,SAAS;QACjC,MAAMC,cAAc,IAAIvB,YAAY;YAACwB,yBAAyB;QAAK;QACnE,KAAK,MAAM,CAACC,MAAMC,KAAK,IAAIC,OAAOC,OAAO,CAAChB,OAAOS,KAAK,CAACQ,eAAe,IAAI,CAAC,GAAI;YAC7E,MAAMC,UAAUC,UAAUL,MAAMH,aAAaE;YAC7C,IAAI,OAAOK,YAAY,UAAU;gBAC/BP,YAAYS,gBAAgB,CAACP,MAAMK;YACrC,OAAO;gBACLP,YAAYS,gBAAgB,CAAC;oBAACP;oBAAMQ,QAAQH,QAAQG,MAAM;gBAAA;YAC5D;QACF;QAEA,MAAMC,kBAAkBX,YAAYF,KAAK,CAACR;QAC1C,IAAI,CAACqB,gBAAgBC,KAAK,EAAE;YAC1B,MAAM,IAAIhC,+BAA+B;gBACvCU;gBACAI,QAAQiB,gBAAgBhB,KAAK,EAAEE,WAAW;YAC5C;QACF;QACA,IACER,OAAOS,KAAK,CAACe,kBAAkB,KAAKC,aACpCH,gBAAgBR,IAAI,KAAKtB,mBAAmB,CAACQ,OAAOS,KAAK,CAACe,kBAAkB,CAAC,EAC7E;YACA,MAAM,IAAIjC,+BAA+B;gBACvCU;gBACAI,QAAQ,CAAC,8BAA8B,EAAEb,mBAAmB,CAACQ,OAAOS,KAAK,CAACe,kBAAkB,CAAC,CAAC,MAAM,EAAEF,gBAAgBR,IAAI,IAAI,UAAU,CAAC,CAAC;YAC5I;QACF;QACAX,aAAauB,YAAYJ,gBAAgBR,IAAI;IAC/C;IAEA,OAAO;QACLa,UAAU;QACV1B,QAAQA;QACRQ,OAAOT,OAAOS,KAAK,CAACC,IAAI;QACxB,GAAIP,eAAesB,YAAY,CAAC,IAAI;YAACtB;QAAU,CAAC;IAClD;AACF;AAEA,OAAO,SAASyB,mCAAmC5B,MAGlD;IACC,gFAAgF;IAChF,OAAO;QACL2B,UAAU;QACV1B,QAAQD,OAAOC,MAAM;QACrBQ,OAAOT,OAAOS,KAAK;IACrB;AACF;AAEA,SAASU,UACPL,IAAoB,EACpBH,WAAwB,EACxBkB,YAAoB;IAEpB,IAAI,OAAOf,SAAS,UAAU,OAAOtB,mBAAmB,CAACsB,KAAK;IAC9D,IAAIA,KAAKgB,IAAI,KAAK,QAAQ;QACxB,OAAO,CAAC,KAAK,EAAEC,qBAAqBjB,KAAKkB,OAAO,EAAErB,aAAakB,cAAc,CAAC,CAAC;IACjF;IACA,IAAIf,KAAKgB,IAAI,KAAK,OAAO,OAAO;IAEhC,OAAO;QACLT,QAAQN,OAAOkB,WAAW,CACxBlB,OAAOC,OAAO,CAACF,KAAKoB,MAAM,EAAEC,GAAG,CAAC,CAAC,CAACtB,MAAMuB,MAAM,GAAK;gBAACvB;gBAAMwB,gBAAgBD;aAAO;IAErF;AACF;AAEA,SAASC,gBAAgBvB,IAAoB;IAC3C,IAAI,OAAOA,SAAS,UAAU,OAAOtB,mBAAmB,CAACsB,KAAK;IAC9D,IAAIA,KAAKgB,IAAI,KAAK,QAAQ,OAAO,CAAC,KAAK,EAAEQ,2BAA2BxB,KAAKkB,OAAO,EAAE,CAAC,CAAC;IACpF,IAAIlB,KAAKgB,IAAI,KAAK,OAAO,OAAO;IAChC,OAAOf,OAAOkB,WAAW,CACvBlB,OAAOC,OAAO,CAACF,KAAKoB,MAAM,EAAEC,GAAG,CAAC,CAAC,CAACtB,MAAMuB,MAAM,GAAK;YAACvB;YAAMwB,gBAAgBD;SAAO;AAErF;AAEA,SAASE,2BAA2BxB,IAAoB;IACtD,IAAI,OAAOA,SAAS,UAAU,OAAOtB,mBAAmB,CAACsB,KAAK;IAC9D,IAAIA,KAAKgB,IAAI,KAAK,OAAO,OAAO;IAChC,IAAIhB,KAAKgB,IAAI,KAAK,UAAU,OAAO;IACnC,OAAO,CAAC,KAAK,EAAEQ,2BAA2BxB,KAAKkB,OAAO,EAAE,CAAC,CAAC;AAC5D;AAEA,SAASD,qBACPjB,IAAoB,EACpBH,WAAwB,EACxBkB,YAAoB;IAEpB,IAAI,OAAOf,SAAS,UAAU,OAAOtB,mBAAmB,CAACsB,KAAK;IAC9D,IAAIA,KAAKgB,IAAI,KAAK,OAAO,OAAO;IAChC,IAAIhB,KAAKgB,IAAI,KAAK,UAAU;QAC1B,MAAMS,WAAW,CAAC,CAAC,EAAEV,aAAa,KAAK,CAAC;QACxClB,YAAY6B,YAAY,CAAC;YACvB3B,MAAM0B;YACNlB,QAAQN,OAAOkB,WAAW,CACxBlB,OAAOC,OAAO,CAACF,KAAKoB,MAAM,EAAEC,GAAG,CAAC,CAAC,CAACtB,MAAMuB,MAAM,GAAK;oBAACvB;oBAAMwB,gBAAgBD;iBAAO;QAErF;QACA,OAAOG;IACT;IACA,OAAO;AACT;AAEA,SAASb,YAAYZ,IAAwB;IAC3C,IAAIA,SAASW,WAAW,OAAOA;IAE/B,OAAQX;QACN,KAAK;YACH,OAAO;QACT,KAAK;YACH,OAAO;QACT,KAAK;YACH,OAAO;QACT,KAAK;YACH,OAAO;QACT,KAAK;YACH,OAAO;QACT,KAAK;YACH,OAAO;QACT,KAAK;YACH,OAAO;gBAACgB,MAAM;YAAK;QACrB,KAAK;YACH,OAAO;QACT;YACE,+EAA+E;YAC/E,+EAA+E;YAC/E,oDAAoD;YACpD,IAAIhB,KAAK2B,UAAU,CAAC,UAAU,OAAO;gBAACX,MAAM;gBAAQE,SAAS;oBAACF,MAAM;gBAAK;YAAC;YAC1E,OAAO;gBAACA,MAAM;YAAK;IACvB;AACF"}

package/dist/expression/errors.d.ts

@@ -0,0 +1,12 @@
+export declare const invalidWorkflowExpressionErrorCode = "invalid-workflow-expression";
+export declare class InvalidWorkflowExpressionError extends Error {
+    readonly code = "invalid-workflow-expression";
+    readonly source: string;
+    readonly reason: string;
+    constructor(params: {
+        source: string;
+        reason: string;
+        cause?: unknown;
+    });
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/expression/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/expression/errors.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,kCAAkC,gCAAgC,CAAC;AAEhF,qBAAa,8BAA+B,SAAQ,KAAK;IACvD,QAAQ,CAAC,IAAI,iCAAsC;IACnD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,MAAM,EAAE;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAC;CAMtE"}

package/dist/expression/errors.js

@@ -0,0 +1,13 @@
+export const invalidWorkflowExpressionErrorCode = 'invalid-workflow-expression';
+export class InvalidWorkflowExpressionError extends Error {
+    constructor(params){
+        super('Invalid workflow expression', {
+            cause: params.cause
+        }), this.code = invalidWorkflowExpressionErrorCode;
+        this.name = 'InvalidWorkflowExpressionError';
+        this.source = params.source;
+        this.reason = params.reason;
+    }
+}
+
+//# sourceMappingURL=errors.js.map

package/dist/expression/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/expression/errors.ts"],"sourcesContent":["export const invalidWorkflowExpressionErrorCode = 'invalid-workflow-expression';\n\nexport class InvalidWorkflowExpressionError extends Error {\n  readonly code = invalidWorkflowExpressionErrorCode;\n  readonly source: string;\n  readonly reason: string;\n\n  constructor(params: {source: string; reason: string; cause?: unknown}) {\n    super('Invalid workflow expression', {cause: params.cause});\n    this.name = 'InvalidWorkflowExpressionError';\n    this.source = params.source;\n    this.reason = params.reason;\n  }\n}\n"],"names":["invalidWorkflowExpressionErrorCode","InvalidWorkflowExpressionError","Error","params","cause","code","name","source","reason"],"mappings":"AAAA,OAAO,MAAMA,qCAAqC,8BAA8B;AAEhF,OAAO,MAAMC,uCAAuCC;IAKlD,YAAYC,MAAyD,CAAE;QACrE,KAAK,CAAC,+BAA+B;YAACC,OAAOD,OAAOC,KAAK;QAAA,SALlDC,OAAOL;QAMd,IAAI,CAACM,IAAI,GAAG;QACZ,IAAI,CAACC,MAAM,GAAGJ,OAAOI,MAAM;QAC3B,IAAI,CAACC,MAAM,GAAGL,OAAOK,MAAM;IAC7B;AACF"}

package/dist/expression/index.d.ts

@@ -0,0 +1,4 @@
+export { createWorkflowExpression, unsafeWorkflowExpressionFromSource, } from './create-workflow-expression.js';
+export { InvalidWorkflowExpressionError, invalidWorkflowExpressionErrorCode } from './errors.js';
+export type { CreateWorkflowExpressionParams, ExpressionScalarType, ExpressionType, ExpressionTypeEnvironment, ValidCelExpression, WorkflowExpression, WorkflowExpressionCheck, WorkflowExpressionCheckOptions, } from './workflow-expression.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/expression/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/expression/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,kCAAkC,GACnC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAC,8BAA8B,EAAE,kCAAkC,EAAC,MAAM,aAAa,CAAC;AAC/F,YAAY,EACV,8BAA8B,EAC9B,oBAAoB,EACpB,cAAc,EACd,yBAAyB,EACzB,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC"}

package/dist/expression/index.js

@@ -0,0 +1,4 @@
+export { createWorkflowExpression, unsafeWorkflowExpressionFromSource } from './create-workflow-expression.js';
+export { InvalidWorkflowExpressionError, invalidWorkflowExpressionErrorCode } from './errors.js';
+
+//# sourceMappingURL=index.js.map

package/dist/expression/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/expression/index.ts"],"sourcesContent":["export {\n  createWorkflowExpression,\n  unsafeWorkflowExpressionFromSource,\n} from './create-workflow-expression.js';\nexport {InvalidWorkflowExpressionError, invalidWorkflowExpressionErrorCode} from './errors.js';\nexport type {\n  CreateWorkflowExpressionParams,\n  ExpressionScalarType,\n  ExpressionType,\n  ExpressionTypeEnvironment,\n  ValidCelExpression,\n  WorkflowExpression,\n  WorkflowExpressionCheck,\n  WorkflowExpressionCheckOptions,\n} from './workflow-expression.js';\n"],"names":["createWorkflowExpression","unsafeWorkflowExpressionFromSource","InvalidWorkflowExpressionError","invalidWorkflowExpressionErrorCode"],"mappings":"AAAA,SACEA,wBAAwB,EACxBC,kCAAkC,QAC7B,kCAAkC;AACzC,SAAQC,8BAA8B,EAAEC,kCAAkC,QAAO,cAAc"}

package/dist/expression/workflow-expression.d.ts

@@ -0,0 +1,33 @@
+export type ValidCelExpression = string & {
+    readonly __validCelExpression: unique symbol;
+};
+export interface WorkflowExpression {
+    language: 'cel';
+    source: ValidCelExpression;
+    check: WorkflowExpressionCheck;
+    resultType?: ExpressionType;
+}
+export type WorkflowExpressionCheck = 'syntax' | 'typed';
+export type ExpressionScalarType = 'string' | 'int' | 'double' | 'bool' | 'null' | 'timestamp';
+export type ExpressionType = ExpressionScalarType | {
+    kind: 'object';
+    fields: Readonly<Record<string, ExpressionType>>;
+} | {
+    kind: 'map';
+} | {
+    kind: 'list';
+    element: ExpressionType;
+};
+export type ExpressionTypeEnvironment = Readonly<Record<string, ExpressionType>>;
+export type WorkflowExpressionCheckOptions = {
+    mode: 'syntax';
+} | {
+    mode: 'typed';
+    typeEnvironment?: ExpressionTypeEnvironment;
+    expectedResultType?: ExpressionScalarType;
+};
+export interface CreateWorkflowExpressionParams {
+    source: string;
+    check: WorkflowExpressionCheckOptions;
+}
+//# sourceMappingURL=workflow-expression.d.ts.map

package/dist/expression/workflow-expression.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-expression.d.ts","sourceRoot":"","sources":["../../src/expression/workflow-expression.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG;IAAC,QAAQ,CAAC,oBAAoB,EAAE,OAAO,MAAM,CAAA;CAAC,CAAC;AAEzF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,KAAK,CAAC;IAChB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,KAAK,EAAE,uBAAuB,CAAC;IAC/B,UAAU,CAAC,EAAE,cAAc,CAAC;CAC7B;AAED,MAAM,MAAM,uBAAuB,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEzD,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,WAAW,CAAC;AAE/F,MAAM,MAAM,cAAc,GACtB,oBAAoB,GACpB;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;CAClD,GACD;IACE,IAAI,EAAE,KAAK,CAAC;CACb,GACD;IACE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,cAAc,CAAC;CACzB,CAAC;AAEN,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;AAEjF,MAAM,MAAM,8BAA8B,GACtC;IACE,IAAI,EAAE,QAAQ,CAAC;CAChB,GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,eAAe,CAAC,EAAE,yBAAyB,CAAC;IAC5C,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;CAC3C,CAAC;AAEN,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,8BAA8B,CAAC;CACvC"}

package/dist/expression/workflow-expression.js

@@ -0,0 +1,3 @@
+export { };
+
+//# sourceMappingURL=workflow-expression.js.map

package/dist/expression/workflow-expression.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/expression/workflow-expression.ts"],"sourcesContent":["export type ValidCelExpression = string & {readonly __validCelExpression: unique symbol};\n\nexport interface WorkflowExpression {\n  language: 'cel';\n  source: ValidCelExpression;\n  check: WorkflowExpressionCheck;\n  resultType?: ExpressionType;\n}\n\nexport type WorkflowExpressionCheck = 'syntax' | 'typed';\n\nexport type ExpressionScalarType = 'string' | 'int' | 'double' | 'bool' | 'null' | 'timestamp';\n\nexport type ExpressionType =\n  | ExpressionScalarType\n  | {\n      kind: 'object';\n      fields: Readonly<Record<string, ExpressionType>>;\n    }\n  | {\n      kind: 'map';\n    }\n  | {\n      kind: 'list';\n      element: ExpressionType;\n    };\n\nexport type ExpressionTypeEnvironment = Readonly<Record<string, ExpressionType>>;\n\nexport type WorkflowExpressionCheckOptions =\n  | {\n      mode: 'syntax';\n    }\n  | {\n      mode: 'typed';\n      typeEnvironment?: ExpressionTypeEnvironment;\n      expectedResultType?: ExpressionScalarType;\n    };\n\nexport interface CreateWorkflowExpressionParams {\n  source: string;\n  check: WorkflowExpressionCheckOptions;\n}\n"],"names":[],"mappings":"AAuCA,WAGC"}

package/dist/index.d.ts

@@ -0,0 +1,27 @@
+export { WorkflowExpressionEvaluationError, type WorkflowExpressionEvaluationFailureReason, workflowExpressionEvaluationErrorCode, } from './evaluator/errors.js';
+export { evaluateWorkflowExpression, evaluateWorkflowPredicate, evaluateWorkflowPredicateFailClosed, type FailClosedPredicateOutcome, type WorkflowExpressionEvaluationContext, type WorkflowExpressionEvaluationValue, } from './evaluator/evaluate-workflow-expression.js';
+export { createWorkflowExpression, unsafeWorkflowExpressionFromSource, } from './expression/create-workflow-expression.js';
+export { InvalidWorkflowExpressionError, invalidWorkflowExpressionErrorCode, } from './expression/errors.js';
+export type { CreateWorkflowExpressionParams, ExpressionScalarType, ExpressionType, ExpressionTypeEnvironment, ValidCelExpression, WorkflowExpression, WorkflowExpressionCheck, WorkflowExpressionCheckOptions, } from './expression/workflow-expression.js';
+export { type CoerceStepOutputsResult, coerceStepOutputs, type JsonSchemaValidationResult, jsonSchemaToExpressionType, type OutputDeclarations, type OutputType, type OutputTypeDeclaration, outputDeclarationsToExpressionFields, outputDeclarationToExpressionType, outputTypes, type StepOutputCoercionError, type StepOutputCoercionErrorReason, validateJsonSchema, } from './outputs/index.js';
+export { isBareContextReference } from './plan/bare-reference.js';
+export { analyzeContextKeyAccess, analyzeContextRootKeyAccess, type ContextKeyAccessAnalysis, type ContextKeyAccessReference, type ContextKeyAccessViolation, type ContextRootKeyAccessAnalysis, type ContextRootKeyAccessReference, } from './plan/context-key-access.js';
+export { evaluatePlannedPredicateAtSite } from './plan/evaluate-planned-predicate.js';
+export { capTraceEntries, capTraceValue, EVALUATION_TRACE_MAX_ENTRIES, EVALUATION_TRACE_VALUE_CAP_BYTES, type EvaluationTraceEntry, type EvaluationTraceLimitEntry, type EvaluationTraceRowEntry, evaluationTraceEntry, predicateTraceEntry, } from './plan/evaluation-trace.js';
+export { extractExactContextRoots } from './plan/extract-exact-context-roots.js';
+export { type FrozenResolvedField, freezeResolvedFieldAtSite, resolveFieldAtSite, type SiteResolvedField, type WorkflowTemplateDiagnostic, type WorkflowTemplateFailurePolicy, } from './plan/freeze.js';
+export { type FrozenPlannedRunCommand, freezePlannedRunCommandAtSite, } from './plan/freeze-run-command.js';
+export { type FieldPlan, type FieldPlanResult, type PlanViolation, planInterpolationField, } from './plan/plan-field.js';
+export { predicateSourceIsBooleanShaped } from './plan/predicate-shape.js';
+export type { ResolvedField, ResolvedFieldDeferredSegment, ResolvedFieldLiteralSegment, ResolvedFieldSegment, } from './plan/resolved-field.js';
+export { type RoutedExpression, routeExpression } from './plan/route-expression.js';
+export { type ServerEvaluabilityResult, type ServerEvaluabilityViolation, validateServerEvaluable, } from './plan/validate-server-evaluable.js';
+export { WorkflowTemplateResolutionError, workflowTemplateResolutionErrorCode, } from './resolver/errors.js';
+export { type HoistedPlannedRunCommand, hoistPlannedRunCommand, type PlannedRunCommandBinding, type RunCommandHoistOptions, UnsafeRunInterpolationError, unsafeRunInterpolationErrorCode, } from './run/hoist-run-command.js';
+export { InvalidWorkflowTemplateError, invalidWorkflowTemplateErrorCode, } from './template/errors.js';
+export { extractCelContextRoots } from './template/extract-cel-context-roots.js';
+export { extractCelUntrustedPathAccesses } from './template/extract-cel-untrusted-path-accesses.js';
+export { parseWorkflowTemplate } from './template/parse-workflow-template.js';
+export type { WorkflowTemplateExprSegment, WorkflowTemplateLiteralSegment, WorkflowTemplateSegment, } from './template/template-segment.js';
+export { type AvailabilitySite, availabilitySites, buildTypedRootsEnvironment, type FillTarget, getWorkflowContextAvailability, getWorkflowContextDefinition, getWorkflowContextHost, getWorkflowContextSensitivity, getWorkflowContextTypeEnvironment, getWorkflowContextUntrustedPaths, getWorkflowInterpolationFieldFailurePolicy, getWorkflowPredicateFieldMinimumFillTarget, type OpenWorkflowContextDefinition, type ReservedRootDefinition, type RunnerWorkflowContextDefinition, resolveContextRootAvailability, resolveContextRootHost, rootsAvailableAt, runnerFillTarget, type TypedWorkflowContextDefinition, unavailableRootsAt, type WorkflowContextAvailabilityReferenceEntry, type WorkflowContextDefinition, type WorkflowContextHost, type WorkflowContextName, type WorkflowContextReservedRoot, type WorkflowContextSensitivity, type WorkflowContextShape, type WorkflowContextTrustTier, type WorkflowFieldFailurePolicy, type WorkflowInterpolationFailurePolicy, type WorkflowInterpolationField, type WorkflowInterpolationFieldPolicy, type WorkflowJobTypeOverlay, type WorkflowPredicateField, type WorkflowStepTypeOverlay, workflowContextAvailabilityReference, workflowContextDefinitions, workflowContextHosts, workflowContextNames, workflowContextReservedRoots, workflowContextRootRequiresLiteralKey, workflowContextSensitivities, workflowContextTrustTiers, workflowFieldFailurePolicies, workflowInterpolationFieldAcceptsContext, workflowInterpolationFieldAcceptsHost, workflowInterpolationFieldAcceptsTrustTier, workflowInterpolationFieldPolicies, workflowInterpolationFields, workflowPredicateFieldFailurePolicy, workflowPredicateFields, } from './workflow-context/workflow-context.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iCAAiC,EACjC,KAAK,yCAAyC,EAC9C,qCAAqC,GACtC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,mCAAmC,EACnC,KAAK,0BAA0B,EAC/B,KAAK,mCAAmC,EACxC,KAAK,iCAAiC,GACvC,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,wBAAwB,EACxB,kCAAkC,GACnC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,8BAA8B,EAC9B,kCAAkC,GACnC,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,8BAA8B,EAC9B,oBAAoB,EACpB,cAAc,EACd,yBAAyB,EACzB,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,KAAK,uBAAuB,EAC5B,iBAAiB,EACjB,KAAK,0BAA0B,EAC/B,0BAA0B,EAC1B,KAAK,kBAAkB,EACvB,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC1B,oCAAoC,EACpC,iCAAiC,EACjC,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,6BAA6B,EAClC,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAC,sBAAsB,EAAC,MAAM,0BAA0B,CAAC;AAChE,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,4BAA4B,EACjC,KAAK,6BAA6B,GACnC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAC,8BAA8B,EAAC,MAAM,sCAAsC,CAAC;AACpF,OAAO,EACL,eAAe,EACf,aAAa,EACb,4BAA4B,EAC5B,gCAAgC,EAChC,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAC,wBAAwB,EAAC,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EACL,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,KAAK,0BAA0B,EAC/B,KAAK,6BAA6B,GACnC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,KAAK,uBAAuB,EAC5B,6BAA6B,GAC9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAC,8BAA8B,EAAC,MAAM,2BAA2B,CAAC;AACzE,YAAY,EACV,aAAa,EACb,4BAA4B,EAC5B,2BAA2B,EAC3B,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAC,KAAK,gBAAgB,EAAE,eAAe,EAAC,MAAM,4BAA4B,CAAC;AAClF,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,2BAA2B,EAChC,uBAAuB,GACxB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,wBAAwB,EAC7B,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,2BAA2B,EAC3B,+BAA+B,GAChC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAC,sBAAsB,EAAC,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EAAC,+BAA+B,EAAC,MAAM,mDAAmD,CAAC;AAClG,OAAO,EAAC,qBAAqB,EAAC,MAAM,uCAAuC,CAAC;AAC5E,YAAY,EACV,2BAA2B,EAC3B,8BAA8B,EAC9B,uBAAuB,GACxB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,KAAK,gBAAgB,EACrB,iBAAiB,EACjB,0BAA0B,EAC1B,KAAK,UAAU,EACf,8BAA8B,EAC9B,4BAA4B,EAC5B,sBAAsB,EACtB,6BAA6B,EAC7B,iCAAiC,EACjC,gCAAgC,EAChC,0CAA0C,EAC1C,0CAA0C,EAC1C,KAAK,6BAA6B,EAClC,KAAK,sBAAsB,EAC3B,KAAK,+BAA+B,EACpC,8BAA8B,EAC9B,sBAAsB,EACtB,gBAAgB,EAChB,gBAAgB,EAChB,KAAK,8BAA8B,EACnC,kBAAkB,EAClB,KAAK,yCAAyC,EAC9C,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,EAC/B,KAAK,kCAAkC,EACvC,KAAK,0BAA0B,EAC/B,KAAK,gCAAgC,EACrC,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,oCAAoC,EACpC,0BAA0B,EAC1B,oBAAoB,EACpB,oBAAoB,EACpB,4BAA4B,EAC5B,qCAAqC,EACrC,4BAA4B,EAC5B,yBAAyB,EACzB,4BAA4B,EAC5B,wCAAwC,EACxC,qCAAqC,EACrC,0CAA0C,EAC1C,kCAAkC,EAClC,2BAA2B,EAC3B,mCAAmC,EACnC,uBAAuB,GACxB,MAAM,wCAAwC,CAAC"}

package/dist/index.js

@@ -0,0 +1,25 @@
+export { WorkflowExpressionEvaluationError, workflowExpressionEvaluationErrorCode } from './evaluator/errors.js';
+export { evaluateWorkflowExpression, evaluateWorkflowPredicate, evaluateWorkflowPredicateFailClosed } from './evaluator/evaluate-workflow-expression.js';
+export { createWorkflowExpression, unsafeWorkflowExpressionFromSource } from './expression/create-workflow-expression.js';
+export { InvalidWorkflowExpressionError, invalidWorkflowExpressionErrorCode } from './expression/errors.js';
+export { coerceStepOutputs, jsonSchemaToExpressionType, outputDeclarationsToExpressionFields, outputDeclarationToExpressionType, outputTypes, validateJsonSchema } from './outputs/index.js';
+export { isBareContextReference } from './plan/bare-reference.js';
+export { analyzeContextKeyAccess, analyzeContextRootKeyAccess } from './plan/context-key-access.js';
+export { evaluatePlannedPredicateAtSite } from './plan/evaluate-planned-predicate.js';
+export { capTraceEntries, capTraceValue, EVALUATION_TRACE_MAX_ENTRIES, EVALUATION_TRACE_VALUE_CAP_BYTES, evaluationTraceEntry, predicateTraceEntry } from './plan/evaluation-trace.js';
+export { extractExactContextRoots } from './plan/extract-exact-context-roots.js';
+export { freezeResolvedFieldAtSite, resolveFieldAtSite } from './plan/freeze.js';
+export { freezePlannedRunCommandAtSite } from './plan/freeze-run-command.js';
+export { planInterpolationField } from './plan/plan-field.js';
+export { predicateSourceIsBooleanShaped } from './plan/predicate-shape.js';
+export { routeExpression } from './plan/route-expression.js';
+export { validateServerEvaluable } from './plan/validate-server-evaluable.js';
+export { WorkflowTemplateResolutionError, workflowTemplateResolutionErrorCode } from './resolver/errors.js';
+export { hoistPlannedRunCommand, UnsafeRunInterpolationError, unsafeRunInterpolationErrorCode } from './run/hoist-run-command.js';
+export { InvalidWorkflowTemplateError, invalidWorkflowTemplateErrorCode } from './template/errors.js';
+export { extractCelContextRoots } from './template/extract-cel-context-roots.js';
+export { extractCelUntrustedPathAccesses } from './template/extract-cel-untrusted-path-accesses.js';
+export { parseWorkflowTemplate } from './template/parse-workflow-template.js';
+export { availabilitySites, buildTypedRootsEnvironment, getWorkflowContextAvailability, getWorkflowContextDefinition, getWorkflowContextHost, getWorkflowContextSensitivity, getWorkflowContextTypeEnvironment, getWorkflowContextUntrustedPaths, getWorkflowInterpolationFieldFailurePolicy, getWorkflowPredicateFieldMinimumFillTarget, resolveContextRootAvailability, resolveContextRootHost, rootsAvailableAt, runnerFillTarget, unavailableRootsAt, workflowContextAvailabilityReference, workflowContextDefinitions, workflowContextHosts, workflowContextNames, workflowContextReservedRoots, workflowContextRootRequiresLiteralKey, workflowContextSensitivities, workflowContextTrustTiers, workflowFieldFailurePolicies, workflowInterpolationFieldAcceptsContext, workflowInterpolationFieldAcceptsHost, workflowInterpolationFieldAcceptsTrustTier, workflowInterpolationFieldPolicies, workflowInterpolationFields, workflowPredicateFieldFailurePolicy, workflowPredicateFields } from './workflow-context/workflow-context.js';
+
+//# sourceMappingURL=index.js.map