@telorun/analyzer 0.28.1 → 0.29.0

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAmB9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA4hB/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAgvBvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAmBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAmB9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAwjB/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAkyBvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAmBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -16,7 +16,8 @@ import { validateSchemaTypeRefs } from "./validate-schema-type-refs.js";
 import { rewriteSyntheticOrigins } from "./rewrite-synthetic-origins.js";
 import { celTypeSatisfiesJsonSchema, substituteCelFields, validateAgainstSchema, } from "./schema-compat.js";
 import { DiagnosticSeverity } from "./types.js";
-import { extractContextsFromSchema, getManifestItem, pathMatchesScope, resolveContextAnnotations, resolveTypeFieldToSchema, } from "./validate-cel-context.js";
+import { extractCelRegionScopes, extractContextsFromSchema, getManifestItem, pathMatchesScope, resolveContextAnnotations, resolveTypeFieldToSchema, } from "./validate-cel-context.js";
+import { buildEvalPaths, evalPathsCover } from "./eval-paths.js";
 import { validateExtends } from "./validate-extends.js";
 import { validateNestedInlineResources } from "./validate-nested-inline.js";
 import { validateProviderCoherence } from "./validate-provider-coherence.js";
@@ -320,6 +321,29 @@ function buildStepContextSchema(manifest, defSchema, allManifests, defs, aliases
  * specific field name (or `Run.Sequence`) is hardcoded; any composer that tags
  * its error-bearing branch fields opts in the same way.
  */
+/**
+ * True when a `walkCelExpressions` path (`with[0].handler.inputs.x`) crosses an
+ * inline nested resource — an `{ kind: … }` object below the host root — before
+ * reaching the leaf. Such CEL belongs to the nested resource's kind (validated
+ * when that resource is analyzed), not the host's schema, so the
+ * non-eval-field check must not attribute it to the host.
+ */
+function pathCrossesNestedResource(root, path) {
+    const segments = path.match(/[^.[\]]+/g) ?? [];
+    let node = root;
+    for (let i = 0; i < segments.length - 1; i++) {
+        node = Array.isArray(node)
+            ? node[Number(segments[i])]
+            : node?.[segments[i]];
+        if (node !== null &&
+            typeof node === "object" &&
+            !Array.isArray(node) &&
+            typeof node.kind === "string") {
+            return true;
+        }
+    }
+    return false;
+}
 function collectErrorContextScopes(defSchema) {
     const out = new Map();
     if (!defSchema || typeof defSchema !== "object")
@@ -995,6 +1019,13 @@ export class StaticAnalyzer {
         let celStepContextSchema;
         let celInvocationContext;
         let celErrorScopes = new Map();
+        // Region coverage for the "CEL in a non-eval field" check: the union of
+        // `x-telo-eval` paths (own + capability) and `x-telo-context` /
+        // `x-telo-step-context` / `x-telo-error-context` scopes. A `!cel` outside
+        // every region is read as a literal — the runtime never evaluates it.
+        let celEvalPaths = [];
+        let celRegionScopes = [];
+        let celRuleApplies = false;
         visitManifest(allManifests, defs, {
             onResourceEnter: (e) => {
                 const m = e.source;
@@ -1003,12 +1034,52 @@ export class StaticAnalyzer {
                     ? buildStepContextSchema(m, e.definition.schema, allManifests, defs, aliases)
                     : undefined;
                 celErrorScopes = collectErrorContextScopes(e.definition?.schema);
+                // The non-eval-field check only applies to runtime resource instances:
+                // structural / templating kinds (capability `Telo.Template`, or no
+                // definition) carry CEL the kernel evaluates by other rules.
+                const capability = e.definition?.capability;
+                celRuleApplies =
+                    !!e.definition?.schema && capability !== undefined && capability !== "Telo.Template";
+                if (celRuleApplies) {
+                    const ownSchema = e.definition.schema;
+                    const own = buildEvalPaths(ownSchema);
+                    const capabilityDef = capability ? defs.resolve(capability) : undefined;
+                    const parent = capabilityDef?.schema
+                        ? buildEvalPaths(capabilityDef.schema)
+                        : { compile: [], runtime: [] };
+                    celEvalPaths = [...own.compile, ...own.runtime, ...parent.compile, ...parent.runtime];
+                    celRegionScopes = extractCelRegionScopes(ownSchema);
+                }
+                else {
+                    celEvalPaths = [];
+                    celRegionScopes = [];
+                }
             },
             onCel: (e) => {
                 const m = e.source;
                 const resource = { kind: m.kind, name: m.metadata?.name };
                 const filePath = m.metadata?.source;
                 const { expr, path, engineName, matchedScope } = e;
+                // A `!cel` (or `${{ }}`) in a field with no `x-telo-eval` / `x-telo-context`
+                // is never evaluated — the runtime reads it as a literal (e.g. a
+                // `concurrency` `!cel` that silently degraded to a sparse `[null, …]`).
+                // Flag it rather than letting it pass as valid CEL. Inline resources
+                // (resource-wide invocation context) carry CEL the kernel evaluates.
+                if (celRuleApplies &&
+                    engineName === "cel" &&
+                    celInvocationContext === undefined &&
+                    !evalPathsCover(celEvalPaths, path) &&
+                    !celRegionScopes.some((scope) => pathMatchesScope(path, scope)) &&
+                    !pathCrossesNestedResource(m, path)) {
+                    diagnostics.push({
+                        severity: DiagnosticSeverity.Error,
+                        code: "CEL_IN_NON_EVAL_FIELD",
+                        source: SOURCE,
+                        message: `${m.kind}/${resource.name}: CEL at '${path}' is never evaluated — the field has no x-telo-eval / x-telo-context annotation, so its value is read as a literal. Annotate the field as a CEL slot or remove the !cel tag.`,
+                        data: { resource, filePath, path },
+                    });
+                    return;
+                }
                 let matchedContext = e.contextSchema ?? celInvocationContext;
                 if (celStepContextSchema) {
                     const base = matchedContext ?? { type: "object", properties: {}, additionalProperties: true };

package/dist/eval-paths.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The single containment rule for `x-telo-eval` paths, shared by every matcher so
+ * the analyzer's coverage decision and the kernel's expansion/exclusion can't
+ * drift. True when `target` lies in the subtree rooted at `evalPath`: `"**"`
+ * covers everything; a dotted path covers itself and any descendant — `"handler"`
+ * covers `handler`, `handler.body`, `handler[0]`. Targets use `walkCelExpressions`
+ * form (`a.b[0].c`); eval paths are property-only (no array segments —
+ * `buildEvalPaths` does not descend into `items`), so `.`/`[` boundary prefixing
+ * is exact. Consumers: the analyzer's `evalPathsCover`, the kernel's `isExcluded`
+ * (applied in both directions), and — structurally — `expandPaths`' navigation.
+ */
+export declare function evalPathCovers(evalPath: string, target: string): boolean;
+/** True when any `x-telo-eval` path in the set covers `exprPath` (see
+ *  {@link evalPathCovers}). */
+export declare function evalPathsCover(evalPaths: readonly string[], exprPath: string): boolean;
+/**
+ * Traverses a definition schema and collects all paths annotated with `x-telo-eval`.
+ * Root-level `x-telo-eval` produces the `"**"` wildcard (expand all fields).
+ * Property-level annotations produce the dot-notation path to that property.
+ */
+export declare function buildEvalPaths(schema: Record<string, any>): {
+    compile: string[];
+    runtime: string[];
+};
+//# sourceMappingURL=eval-paths.d.ts.map

package/dist/eval-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eval-paths.d.ts","sourceRoot":"","sources":["../src/eval-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAKxE;AAED;+BAC+B;AAC/B,wBAAgB,cAAc,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEtF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG;IAC3D,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAcA"}

package/dist/eval-paths.js

@@ -0,0 +1,55 @@
+/**
+ * The single containment rule for `x-telo-eval` paths, shared by every matcher so
+ * the analyzer's coverage decision and the kernel's expansion/exclusion can't
+ * drift. True when `target` lies in the subtree rooted at `evalPath`: `"**"`
+ * covers everything; a dotted path covers itself and any descendant — `"handler"`
+ * covers `handler`, `handler.body`, `handler[0]`. Targets use `walkCelExpressions`
+ * form (`a.b[0].c`); eval paths are property-only (no array segments —
+ * `buildEvalPaths` does not descend into `items`), so `.`/`[` boundary prefixing
+ * is exact. Consumers: the analyzer's `evalPathsCover`, the kernel's `isExcluded`
+ * (applied in both directions), and — structurally — `expandPaths`' navigation.
+ */
+export function evalPathCovers(evalPath, target) {
+    if (evalPath === "**")
+        return true;
+    return (target === evalPath || target.startsWith(`${evalPath}.`) || target.startsWith(`${evalPath}[`));
+}
+/** True when any `x-telo-eval` path in the set covers `exprPath` (see
+ *  {@link evalPathCovers}). */
+export function evalPathsCover(evalPaths, exprPath) {
+    return evalPaths.some((p) => evalPathCovers(p, exprPath));
+}
+/**
+ * Traverses a definition schema and collects all paths annotated with `x-telo-eval`.
+ * Root-level `x-telo-eval` produces the `"**"` wildcard (expand all fields).
+ * Property-level annotations produce the dot-notation path to that property.
+ */
+export function buildEvalPaths(schema) {
+    const compile = [];
+    const runtime = [];
+    if (schema["x-telo-eval"] === "compile")
+        compile.push("**");
+    else if (schema["x-telo-eval"] === "runtime")
+        runtime.push("**");
+    if (schema.properties) {
+        for (const [key, propSchema] of Object.entries(schema.properties)) {
+            collectEvalPathsNode(propSchema, key, compile, runtime);
+        }
+    }
+    return { compile, runtime };
+}
+function collectEvalPathsNode(node, path, compile, runtime) {
+    if (node["x-telo-eval"] === "compile") {
+        compile.push(path);
+        return;
+    }
+    if (node["x-telo-eval"] === "runtime") {
+        runtime.push(path);
+        return;
+    }
+    if (node.properties) {
+        for (const [key, propSchema] of Object.entries(node.properties)) {
+            collectEvalPathsNode(propSchema, `${path}.${key}`, compile, runtime);
+        }
+    }
+}

package/dist/index.d.ts

@@ -3,6 +3,7 @@ export type { RefFieldInfo } from "./analysis-registry.js";
 export { StaticAnalyzer } from "./analyzer.js";
 export type { GraphLoadError, ImportEdge, LoadedFile, LoadedGraph, LoadedModule, ParseError, } from "./loaded-types.js";
 export { flattenForAnalyzer, flattenLoadedModule, forwardReExportManifests, parseExportEntry, reExportSpecsFromExports, resolveExportedKinds, selectModuleManifestsForAnalysis, stampReExportedKinds, type ParsedExportEntry, type ReExportSpec, } from "./flatten-for-analyzer.js";
+export { buildEvalPaths, evalPathCovers } from "./eval-paths.js";
 export { visitManifest } from "./manifest-visitor.js";
 export type { CelSiteEvent, ManifestVisitor, RefSiteEvent, ResourceEnterEvent, ResourceExitEvent, ScopeBoundaryEvent, SchemaFromSiteEvent, VisitOptions, } from "./manifest-visitor.js";
 export { Loader } from "./manifest-loader.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,6 +1,7 @@
 export { AnalysisRegistry } from "./analysis-registry.js";
 export { StaticAnalyzer } from "./analyzer.js";
 export { flattenForAnalyzer, flattenLoadedModule, forwardReExportManifests, parseExportEntry, reExportSpecsFromExports, resolveExportedKinds, selectModuleManifestsForAnalysis, stampReExportedKinds, } from "./flatten-for-analyzer.js";
+export { buildEvalPaths, evalPathCovers } from "./eval-paths.js";
 export { visitManifest } from "./manifest-visitor.js";
 export { Loader } from "./manifest-loader.js";
 export { isModuleKind, MODULE_KINDS } from "./module-kinds.js";

package/dist/validate-cel-context.d.ts

@@ -97,4 +97,13 @@ export declare function extractContextsFromSchema(schema: Record<string, any>, p
     scope: string;
     schema: Record<string, any>;
 }>;
+/**
+ * Walk a JSON Schema tree and collect the JSONPath scopes of every field that
+ * declares a CEL-bearing region (`x-telo-context` / `x-telo-step-context` /
+ * `x-telo-error-context`). Used — alongside `x-telo-eval` paths — to decide
+ * whether a `!cel` expression sits in a slot the runtime actually evaluates.
+ * Scopes use the same `$.a.b[*]` form as `extractContextsFromSchema`, matched
+ * against expression paths with `pathMatchesScope`.
+ */
+export declare function extractCelRegionScopes(schema: Record<string, any>, path?: string): string[];
 //# sourceMappingURL=validate-cel-context.d.ts.map

package/dist/validate-cel-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAGtF,MAAM,WAAW,kBAAkB;IACjC;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC;;kDAE8C;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;KACxD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CA0CjC;AAuFD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAChD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAgHrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB;AAWD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,SAAM,GACT,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAC,CAGvD"}
+{"version":3,"file":"validate-cel-context.d.ts","sourceRoot":"","sources":["../src/validate-cel-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAGtF,MAAM,WAAW,kBAAkB;IACjC;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC;;kDAE8C;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;KACxD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EACnC,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CA0CjC;AAuFD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBzE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAChD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAgHrB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAQrB;AAWD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,SAAM,GACT,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAC,CAGvD;AAUD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,SAAM,GAAG,MAAM,EAAE,CAqBxF"}

package/dist/validate-cel-context.js

@@ -334,6 +334,43 @@ export function extractContextsFromSchema(schema, path = "$") {
     const all = collectContexts(schema, path);
     return all.sort((a, b) => b.scope.length - a.scope.length);
 }
+/** Schema keys that declare a CEL-bearing region: a field carrying any of these
+ *  is evaluated at runtime, so a `!cel` inside it (or a descendant) is live. */
+const CEL_REGION_KEYS = [
+    "x-telo-context",
+    "x-telo-step-context",
+    "x-telo-error-context",
+];
+/**
+ * Walk a JSON Schema tree and collect the JSONPath scopes of every field that
+ * declares a CEL-bearing region (`x-telo-context` / `x-telo-step-context` /
+ * `x-telo-error-context`). Used — alongside `x-telo-eval` paths — to decide
+ * whether a `!cel` expression sits in a slot the runtime actually evaluates.
+ * Scopes use the same `$.a.b[*]` form as `extractContextsFromSchema`, matched
+ * against expression paths with `pathMatchesScope`.
+ */
+export function extractCelRegionScopes(schema, path = "$") {
+    if (!schema || typeof schema !== "object")
+        return [];
+    const out = [];
+    if (CEL_REGION_KEYS.some((k) => schema[k]))
+        out.push(path);
+    if (schema.properties) {
+        for (const [key, value] of Object.entries(schema.properties)) {
+            out.push(...extractCelRegionScopes(value, `${path}.${key}`));
+        }
+    }
+    if (schema.items && typeof schema.items === "object") {
+        out.push(...extractCelRegionScopes(schema.items, `${path}[*]`));
+    }
+    for (const key of ["oneOf", "anyOf", "allOf"]) {
+        if (Array.isArray(schema[key])) {
+            for (const subschema of schema[key])
+                out.push(...extractCelRegionScopes(subschema, path));
+        }
+    }
+    return out;
+}
 function collectContexts(schema, path) {
     if (!schema || typeof schema !== "object")
         return [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.28.1",
+  "version": "0.29.0",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",

package/src/analyzer.ts

@@ -30,12 +30,14 @@ import {
 } from "./schema-compat.js";
 import { DiagnosticSeverity, type AnalysisDiagnostic, type AnalysisOptions } from "./types.js";
 import {
+  extractCelRegionScopes,
   extractContextsFromSchema,
   getManifestItem,
   pathMatchesScope,
   resolveContextAnnotations,
   resolveTypeFieldToSchema,
 } from "./validate-cel-context.js";
+import { buildEvalPaths, evalPathsCover } from "./eval-paths.js";
 import { validateExtends } from "./validate-extends.js";
 import { validateNestedInlineResources } from "./validate-nested-inline.js";
 import { validateProviderCoherence } from "./validate-provider-coherence.js";
@@ -393,6 +395,32 @@ function buildStepContextSchema(
  * specific field name (or `Run.Sequence`) is hardcoded; any composer that tags
  * its error-bearing branch fields opts in the same way.
  */
+/**
+ * True when a `walkCelExpressions` path (`with[0].handler.inputs.x`) crosses an
+ * inline nested resource — an `{ kind: … }` object below the host root — before
+ * reaching the leaf. Such CEL belongs to the nested resource's kind (validated
+ * when that resource is analyzed), not the host's schema, so the
+ * non-eval-field check must not attribute it to the host.
+ */
+function pathCrossesNestedResource(root: unknown, path: string): boolean {
+  const segments = path.match(/[^.[\]]+/g) ?? [];
+  let node: unknown = root;
+  for (let i = 0; i < segments.length - 1; i++) {
+    node = Array.isArray(node)
+      ? node[Number(segments[i])]
+      : (node as Record<string, unknown> | undefined)?.[segments[i]!];
+    if (
+      node !== null &&
+      typeof node === "object" &&
+      !Array.isArray(node) &&
+      typeof (node as { kind?: unknown }).kind === "string"
+    ) {
+      return true;
+    }
+  }
+  return false;
+}
+
 function collectErrorContextScopes(
   defSchema: Record<string, any> | undefined,
 ): Map<string, Record<string, any>> {
@@ -1189,6 +1217,13 @@ export class StaticAnalyzer {
     let celStepContextSchema: Record<string, any> | undefined;
     let celInvocationContext: Record<string, any> | undefined;
     let celErrorScopes: Map<string, Record<string, any>> = new Map();
+    // Region coverage for the "CEL in a non-eval field" check: the union of
+    // `x-telo-eval` paths (own + capability) and `x-telo-context` /
+    // `x-telo-step-context` / `x-telo-error-context` scopes. A `!cel` outside
+    // every region is read as a literal — the runtime never evaluates it.
+    let celEvalPaths: string[] = [];
+    let celRegionScopes: string[] = [];
+    let celRuleApplies = false;
 
     visitManifest(
       allManifests,
@@ -1211,6 +1246,26 @@ export class StaticAnalyzer {
           celErrorScopes = collectErrorContextScopes(
             e.definition?.schema as Record<string, any> | undefined,
           );
+
+          // The non-eval-field check only applies to runtime resource instances:
+          // structural / templating kinds (capability `Telo.Template`, or no
+          // definition) carry CEL the kernel evaluates by other rules.
+          const capability = e.definition?.capability;
+          celRuleApplies =
+            !!e.definition?.schema && capability !== undefined && capability !== "Telo.Template";
+          if (celRuleApplies) {
+            const ownSchema = e.definition!.schema as Record<string, any>;
+            const own = buildEvalPaths(ownSchema);
+            const capabilityDef = capability ? defs.resolve(capability) : undefined;
+            const parent = capabilityDef?.schema
+              ? buildEvalPaths(capabilityDef.schema as Record<string, any>)
+              : { compile: [], runtime: [] };
+            celEvalPaths = [...own.compile, ...own.runtime, ...parent.compile, ...parent.runtime];
+            celRegionScopes = extractCelRegionScopes(ownSchema);
+          } else {
+            celEvalPaths = [];
+            celRegionScopes = [];
+          }
         },
         onCel: (e) => {
           const m = e.source;
@@ -1218,6 +1273,29 @@ export class StaticAnalyzer {
           const filePath = (m.metadata as { source?: string } | undefined)?.source;
           const { expr, path, engineName, matchedScope } = e;
 
+          // A `!cel` (or `${{ }}`) in a field with no `x-telo-eval` / `x-telo-context`
+          // is never evaluated — the runtime reads it as a literal (e.g. a
+          // `concurrency` `!cel` that silently degraded to a sparse `[null, …]`).
+          // Flag it rather than letting it pass as valid CEL. Inline resources
+          // (resource-wide invocation context) carry CEL the kernel evaluates.
+          if (
+            celRuleApplies &&
+            engineName === "cel" &&
+            celInvocationContext === undefined &&
+            !evalPathsCover(celEvalPaths, path) &&
+            !celRegionScopes.some((scope) => pathMatchesScope(path, scope)) &&
+            !pathCrossesNestedResource(m, path)
+          ) {
+            diagnostics.push({
+              severity: DiagnosticSeverity.Error,
+              code: "CEL_IN_NON_EVAL_FIELD",
+              source: SOURCE,
+              message: `${m.kind}/${resource.name}: CEL at '${path}' is never evaluated — the field has no x-telo-eval / x-telo-context annotation, so its value is read as a literal. Annotate the field as a CEL slot or remove the !cel tag.`,
+              data: { resource, filePath, path },
+            });
+            return;
+          }
+
           let matchedContext: Record<string, any> | undefined =
             e.contextSchema ?? celInvocationContext;
 

package/src/eval-paths.ts

@@ -0,0 +1,68 @@
+/**
+ * The single containment rule for `x-telo-eval` paths, shared by every matcher so
+ * the analyzer's coverage decision and the kernel's expansion/exclusion can't
+ * drift. True when `target` lies in the subtree rooted at `evalPath`: `"**"`
+ * covers everything; a dotted path covers itself and any descendant — `"handler"`
+ * covers `handler`, `handler.body`, `handler[0]`. Targets use `walkCelExpressions`
+ * form (`a.b[0].c`); eval paths are property-only (no array segments —
+ * `buildEvalPaths` does not descend into `items`), so `.`/`[` boundary prefixing
+ * is exact. Consumers: the analyzer's `evalPathsCover`, the kernel's `isExcluded`
+ * (applied in both directions), and — structurally — `expandPaths`' navigation.
+ */
+export function evalPathCovers(evalPath: string, target: string): boolean {
+  if (evalPath === "**") return true;
+  return (
+    target === evalPath || target.startsWith(`${evalPath}.`) || target.startsWith(`${evalPath}[`)
+  );
+}
+
+/** True when any `x-telo-eval` path in the set covers `exprPath` (see
+ *  {@link evalPathCovers}). */
+export function evalPathsCover(evalPaths: readonly string[], exprPath: string): boolean {
+  return evalPaths.some((p) => evalPathCovers(p, exprPath));
+}
+
+/**
+ * Traverses a definition schema and collects all paths annotated with `x-telo-eval`.
+ * Root-level `x-telo-eval` produces the `"**"` wildcard (expand all fields).
+ * Property-level annotations produce the dot-notation path to that property.
+ */
+export function buildEvalPaths(schema: Record<string, any>): {
+  compile: string[];
+  runtime: string[];
+} {
+  const compile: string[] = [];
+  const runtime: string[] = [];
+
+  if (schema["x-telo-eval"] === "compile") compile.push("**");
+  else if (schema["x-telo-eval"] === "runtime") runtime.push("**");
+
+  if (schema.properties) {
+    for (const [key, propSchema] of Object.entries(schema.properties as Record<string, any>)) {
+      collectEvalPathsNode(propSchema, key, compile, runtime);
+    }
+  }
+
+  return { compile, runtime };
+}
+
+function collectEvalPathsNode(
+  node: Record<string, any>,
+  path: string,
+  compile: string[],
+  runtime: string[],
+): void {
+  if (node["x-telo-eval"] === "compile") {
+    compile.push(path);
+    return;
+  }
+  if (node["x-telo-eval"] === "runtime") {
+    runtime.push(path);
+    return;
+  }
+  if (node.properties) {
+    for (const [key, propSchema] of Object.entries(node.properties as Record<string, any>)) {
+      collectEvalPathsNode(propSchema, `${path}.${key}`, compile, runtime);
+    }
+  }
+}

package/src/index.ts

@@ -21,6 +21,7 @@ export {
     type ParsedExportEntry,
     type ReExportSpec,
 } from "./flatten-for-analyzer.js";
+export { buildEvalPaths, evalPathCovers } from "./eval-paths.js";
 export { visitManifest } from "./manifest-visitor.js";
 export type {
     CelSiteEvent,

package/src/validate-cel-context.ts

@@ -396,6 +396,45 @@ export function extractContextsFromSchema(
   return all.sort((a, b) => b.scope.length - a.scope.length);
 }
 
+/** Schema keys that declare a CEL-bearing region: a field carrying any of these
+ *  is evaluated at runtime, so a `!cel` inside it (or a descendant) is live. */
+const CEL_REGION_KEYS = [
+  "x-telo-context",
+  "x-telo-step-context",
+  "x-telo-error-context",
+] as const;
+
+/**
+ * Walk a JSON Schema tree and collect the JSONPath scopes of every field that
+ * declares a CEL-bearing region (`x-telo-context` / `x-telo-step-context` /
+ * `x-telo-error-context`). Used — alongside `x-telo-eval` paths — to decide
+ * whether a `!cel` expression sits in a slot the runtime actually evaluates.
+ * Scopes use the same `$.a.b[*]` form as `extractContextsFromSchema`, matched
+ * against expression paths with `pathMatchesScope`.
+ */
+export function extractCelRegionScopes(schema: Record<string, any>, path = "$"): string[] {
+  if (!schema || typeof schema !== "object") return [];
+  const out: string[] = [];
+
+  if (CEL_REGION_KEYS.some((k) => schema[k])) out.push(path);
+
+  if (schema.properties) {
+    for (const [key, value] of Object.entries(schema.properties as Record<string, any>)) {
+      out.push(...extractCelRegionScopes(value, `${path}.${key}`));
+    }
+  }
+  if (schema.items && typeof schema.items === "object") {
+    out.push(...extractCelRegionScopes(schema.items, `${path}[*]`));
+  }
+  for (const key of ["oneOf", "anyOf", "allOf"] as const) {
+    if (Array.isArray(schema[key])) {
+      for (const subschema of schema[key]) out.push(...extractCelRegionScopes(subschema, path));
+    }
+  }
+
+  return out;
+}
+
 function collectContexts(
   schema: Record<string, any>,
   path: string,