@telorun/analyzer 0.50.0 → 0.52.0

package/README.md

@@ -48,7 +48,9 @@ See [examples/](./examples/) for a list of working applications.
 
 ## Status
 
-Telo is under **active development**. The core runtime, module system, and standard library are functional, but the API surface — including YAML shapes — may change without notice. Not yet recommended for production use.
+Telo is under heavy development. While it is pre-1.0, breaking changes ship in **minor** releases — manifest shapes, kind schemas, and APIs can change between versions. Pin your imports and expect to update manifests when you upgrade. The core runtime, module system, and standard library are functional, but Telo is not yet recommended for production use.
+
+**1.0 lands when the Rust kernel reaches feature parity with the Node.js implementation** — that is the milestone that freezes the manifest contract across runtimes.
 
 ## The Meaning of Telo
 

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIzE,OAAO,EACL,aAAa,EAEb,KAAK,YAAY,EAElB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EACL,KAAK,aAAa,EAGnB,MAAM,0BAA0B,CAAC;AA2BlC,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AA0E/F;;;;;uDAKuD;AACvD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,aAAa,GAAG;IAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAA;CAAE,CAO9F;AA6FD;0CAC0C;AAC1C,eAAO,MAAM,eAAe,GAAI,OAAO;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OACT,CAAC;AAErD;8EAC8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhD;AAuBD;2DAC2D;AAC3D,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACvC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CASjC;AAED;4EAC4E;AAC5E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAmBvG;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,OAAO,EAAE,EAChB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EAC/C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,GAC3D,IAAI,CAiDN;AAqgBD,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAikCvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAyBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIzE,OAAO,EACL,aAAa,EAEb,KAAK,YAAY,EAElB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EACL,KAAK,aAAa,EAGnB,MAAM,0BAA0B,CAAC;AA+BlC,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAoF/F;;;;;uDAKuD;AACvD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,aAAa,GAAG;IAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAA;CAAE,CAO9F;AA6FD;0CAC0C;AAC1C,eAAO,MAAM,eAAe,GAAI,OAAO;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OACT,CAAC;AAErD;8EAC8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhD;AAuBD;2DAC2D;AAC3D,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACvC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CASjC;AAED;4EAC4E;AAC5E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAmBvG;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,OAAO,EAAE,EAChB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EAC/C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,GAC3D,IAAI,CAiDN;AA2jBD,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IA4oCvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAyBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -6,7 +6,7 @@ import { DefinitionRegistry } from "./definition-registry.js";
 import { effectiveAuthorSchema } from "./extends-resolution.js";
 import { PERMISSIVE_CONTRACT, resolveContract, } from "./invocation-contract.js";
 import { buildDependencyGraph, formatCycle } from "./dependency-graph.js";
-import { buildKernelGlobalsSchema, mergeKernelGlobalsIntoContext } from "./kernel-globals.js";
+import { buildKernelGlobalsSchema, KERNEL_GLOBAL_NAMES, mergeKernelGlobalsIntoContext, } from "./kernel-globals.js";
 import { buildObservedStateIndex, buildObservedStateResourcesSchema, collectRunReachableNames, observedStateRead, validateObservedStateDeclarations, } from "./validate-observed-state.js";
 import { computeSuggestKind } from "./kind-suggest.js";
 import { visitManifest } from "./manifest-visitor.js";
@@ -21,8 +21,9 @@ import { rewriteSyntheticOrigins } from "./rewrite-synthetic-origins.js";
 import { celTypeSatisfiesJsonSchema, substituteCelFields, validateAgainstSchema, } from "./schema-compat.js";
 import { collectValueSchemaIssues } from "./validate-value-schema.js";
 import { DiagnosticSeverity } from "./types.js";
-import { extractAccessChains, extractCelRegionScopes, extractContextsFromSchema, getManifestItem, pathMatchesScope, resolveContextAnnotations, } from "./validate-cel-context.js";
+import { extractAccessChains, extractCelRegionScopes, extractContextsFromSchema, getManifestItem, pathMatchesScope, resolveContextAnnotations, resolveTypeFieldToSchema, } from "./validate-cel-context.js";
 import { buildEvalPaths, evalPathsCover } from "./eval-paths.js";
+import { BINDINGS_ANNOTATION, bindingContextProperties, bindingPathChain, CEL_RESERVED_WORDS, findBindingSites, resolveBindingOrder, schemaAtChain, } from "./cel-bindings.js";
 import { validateExtends } from "./validate-extends.js";
 import { validateLogging } from "./validate-logging.js";
 import { validateModuleArtifact } from "./validate-module-artifact.js";
@@ -307,12 +308,18 @@ function buildStepContextSchema(manifest, defSchema, allManifests, defs, aliases
             continue;
         const invokeField = stepCtx.invoke;
         const outputTypeField = stepCtx.outputType;
+        // Optional: the field a step uses to produce a result without dispatching.
+        // Only a kind that declares one has pure steps at all.
+        const valueField = stepCtx.value;
         if (!invokeField || !outputTypeField)
             continue;
         const steps = manifest[fieldName];
         if (!Array.isArray(steps))
             continue;
         const stepItemSchema = resolveLocalRef(fieldSchema.items, defSchema);
+        // The instance's own input contract, for typing a pure step that just
+        // forwards one of its values.
+        const ownInputs = resolveTypeFieldToSchema(manifest.inputType, allManifests);
         const stepProperties = {};
         walkStepArray(steps, stepItemSchema, defSchema, fieldName, (s) => {
             const name = s.name;
@@ -321,8 +328,29 @@ function buildStepContextSchema(manifest, defSchema, allManifests, defs, aliases
             // wrappers (try/if/while/switch/throw) don't produce a result and must
             // not shadow real entries with a permissive `additionalProperties: true`,
             // or unknown step references slip through chain validation.
-            if (typeof name !== "string" || !invoke || typeof invoke !== "object")
+            if (typeof name !== "string")
                 return;
+            if (!invoke || typeof invoke !== "object") {
+                // A pure step dispatches nothing, so there is no contract to resolve.
+                // Where its expression is a plain chain into something already typed —
+                // an earlier step's result, or the kind's own inputs — that type carries
+                // through; anything else (arithmetic, a call, a comprehension) stays
+                // permissive rather than guessed. Same rule as a named binding's.
+                if (valueField && valueField in s) {
+                    const scopeRoot = {
+                        properties: {
+                            steps: { type: "object", properties: { ...stepProperties } },
+                            ...(ownInputs ? { inputs: ownInputs } : {}),
+                        },
+                    };
+                    const chained = schemaAtChain(bindingPathChain(s[valueField]), scopeRoot);
+                    stepProperties[name] = {
+                        type: "object",
+                        properties: { result: chained ?? PERMISSIVE_CONTRACT },
+                    };
+                }
+                return;
+            }
             const invokedKind = invoke.kind;
             const invokedName = invoke.name;
             // A named `!ref` carries the target's own manifest (which may narrow the
@@ -618,6 +646,26 @@ function errorContextForPath(path, scopes) {
     }
     return best?.schema;
 }
+/** Add a kind's named bindings to a resolved context, when the context declares
+ *  a bindings region. They go UNDER the context's own properties: a scope
+ *  variable wins over a same-named binding at runtime, so static typing has to
+ *  agree (the collision itself is `BINDING_NAME_RESERVED`). */
+function withBindingNames(contextSchema, resource) {
+    const field = contextSchema[BINDINGS_ANNOTATION];
+    if (typeof field !== "string")
+        return contextSchema;
+    const bindings = resource[field];
+    if (bindings === null || typeof bindings !== "object" || Array.isArray(bindings)) {
+        return contextSchema;
+    }
+    return {
+        ...contextSchema,
+        properties: {
+            ...bindingContextProperties(bindings, contextSchema),
+            ...(contextSchema.properties ?? {}),
+        },
+    };
+}
 /** Member-access chains in a CEL expression, or none when it doesn't parse.
  *  Best-effort: a syntax error is reported by the engine pass, not here. */
 function celAccessChains(env, expr) {
@@ -1414,6 +1462,9 @@ export class StaticAnalyzer {
         // `x-telo-step-context` / `x-telo-error-context` scopes. A `!cel` outside
         // every region is read as a literal — the runtime never evaluates it.
         let celEvalPaths = [];
+        // The bindings field this kind declares (if any), read by the CEL sites that
+        // see the names it introduces.
+        let celBindingSites;
         // The compile half alone: a field that resolves at startup, where observed
         // state cannot exist yet.
         let celCompilePaths = [];
@@ -1444,6 +1495,72 @@ export class StaticAnalyzer {
                     }
                 }
                 celErrorScopes = collectErrorContextScopes(e.definition?.schema);
+                celBindingSites = findBindingSites(e.definition?.schema);
+                if (celBindingSites) {
+                    const declared = m[celBindingSites.field];
+                    const bindingsName = m.metadata?.name;
+                    const bindingsFile = m.metadata?.source;
+                    const resourceRef = { kind: m.kind, name: bindingsName ?? "" };
+                    // Which field holds the bindings would otherwise be decided by
+                    // schema walk order, silently.
+                    if (celBindingSites.fields.length > 1) {
+                        diagnostics.push({
+                            severity: DiagnosticSeverity.Error,
+                            code: "BINDING_FIELD_AMBIGUOUS",
+                            source: SOURCE,
+                            message: `${m.kind}/${bindingsName}: the kind's schema points '${BINDINGS_ANNOTATION}' at more than one field (${celBindingSites.fields.join(", ")}). Every annotated context must name the same bindings field.`,
+                            data: { resource: resourceRef, filePath: bindingsFile, path: celBindingSites.field },
+                        });
+                    }
+                    if (declared !== null && typeof declared === "object" && !Array.isArray(declared)) {
+                        for (const cycle of resolveBindingOrder(declared).cycles) {
+                            diagnostics.push({
+                                severity: DiagnosticSeverity.Error,
+                                code: "BINDING_CYCLE",
+                                source: SOURCE,
+                                message: `${m.kind}/${bindingsName}: '${celBindingSites.field}' has a cycle — ${cycle.join(" → ")}. A binding is resolved from the ones it references, so it cannot reference itself, directly or through others.`,
+                                data: {
+                                    resource: resourceRef,
+                                    filePath: bindingsFile,
+                                    path: `${celBindingSites.field}.${cycle[0]}`,
+                                },
+                            });
+                        }
+                        // Every name the CEL environment already binds at this site: the
+                        // kernel globals (registered straight onto the environment, not
+                        // contributed by any annotation), the scope the annotated contexts
+                        // declare, and the two the analyzer merges per site. Shadowing one
+                        // would leave the binding silently unreachable there — as would
+                        // naming it after a CEL keyword, which never lexes as a reference.
+                        const inScope = new Set([
+                            ...KERNEL_GLOBAL_NAMES,
+                            ...celBindingSites.scopeNames,
+                        ]);
+                        if (celStepContextSchema)
+                            inScope.add("steps");
+                        if (celErrorScopes.size > 0)
+                            inScope.add("error");
+                        const keywords = new Set(CEL_RESERVED_WORDS);
+                        for (const name of Object.keys(declared)) {
+                            const shadows = inScope.has(name);
+                            if (!shadows && !keywords.has(name))
+                                continue;
+                            diagnostics.push({
+                                severity: DiagnosticSeverity.Error,
+                                code: "BINDING_NAME_RESERVED",
+                                source: SOURCE,
+                                message: shadows
+                                    ? `${m.kind}/${bindingsName}: binding '${name}' shadows a variable already in scope here (${[...inScope].sort().join(", ")}). Rename the binding — a scope variable always wins, so this one would never be read.`
+                                    : `${m.kind}/${bindingsName}: binding '${name}' is a CEL keyword, so no expression can read it as a reference. Rename the binding.`,
+                                data: {
+                                    resource: resourceRef,
+                                    filePath: bindingsFile,
+                                    path: `${celBindingSites.field}.${name}`,
+                                },
+                            });
+                        }
+                    }
+                }
                 // The non-eval-field check only applies to runtime resource instances:
                 // structural / templating kinds (capability `Telo.Template`, or no
                 // definition) carry CEL the kernel evaluates by other rules.
@@ -1565,7 +1682,7 @@ export class StaticAnalyzer {
                         aliases,
                         allManifests: allManifests,
                     });
-                    effectiveContext = mergeKernelGlobalsIntoContext(resolvedContext, kernelGlobals);
+                    effectiveContext = mergeKernelGlobalsIntoContext(withBindingNames(resolvedContext, m), kernelGlobals);
                 }
                 else if (observedStateContext) {
                     // No `x-telo-context` matched, so nothing was chain-validated here

package/dist/cel-ast.d.ts

@@ -1,4 +1,14 @@
 import { type ASTNode as CelJsNode } from "@marcbachmann/cel-js";
+/** A CEL body that does not parse — an author's expression, mid-typing or
+ *  malformed. Owned here so a consumer can be lenient about author syntax
+ *  (navigation, completion) without also swallowing a defect in the wrapper
+ *  below, and so the third-party parser's error type stays internal, exactly as
+ *  its AST type does. */
+export declare class CelParseError extends Error {
+    readonly source: string;
+    readonly cause: unknown;
+    constructor(source: string, cause: unknown);
+}
 /** Read-only CEL expression tree owned by the analyzer. The third-party
  *  `@marcbachmann/cel-js` `ASTNode` stays an internal detail — `wrapCelAst`
  *  translates it into this union so no external AST type leaks through the
@@ -79,7 +89,9 @@ export interface CelSegment {
     source: string;
     /** True when a `${{` has no matching `}}` yet (the user is mid-typing). */
     open: boolean;
-    /** Lazily parse + wrap; ranges are already absolute. */
+    /** Lazily parse + wrap; ranges are already absolute. Throws `CelParseError`
+     *  when the body doesn't parse — an `open` segment recovers to its longest
+     *  parseable prefix instead, so only a closed one can throw. */
     ast(): CelNode;
 }
 /** Maps a `@marcbachmann/cel-js` node into the analyzer `CelNode`, translating

package/dist/cel-ast.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cel-ast.d.ts","sourceRoot":"","sources":["../src/cel-ast.ts"],"names":[],"mappings":"AAAA,OAAO,EAAS,KAAK,OAAO,IAAI,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAExE;;;;qDAIqD;AACrD,MAAM,MAAM,OAAO,GACf;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAC5D;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACxD;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,mCAAmC;IACnC,QAAQ,EAAE,OAAO,CAAC;CACnB,GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,4BAA4B;IAC5B,QAAQ,EAAE,OAAO,CAAC;CACnB,GACD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,EAAE,CAAA;CAAE,GACxE;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,OAAO,EAAE,CAAC;CACjB,GACD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,KAAK,EAAE,OAAO,EAAE,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,OAAO,EAAE;QAAE,GAAG,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,EAAE,CAAA;CAAE,GACrF;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;CACf,GACD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GACxE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAE3F;;;6CAG6C;AAC7C,MAAM,WAAW,UAAU;IACzB,kFAAkF;IAClF,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,IAAI,EAAE,OAAO,CAAC;IACd,wDAAwD;IACxD,GAAG,IAAI,OAAO,CAAC;CAChB;AAmBD;;6BAE6B;AAC7B,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAiFzE;AA0BD;;;;;;;uCAOuC;AACvC,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,UAAU,EAAE,CAuDd"}
+{"version":3,"file":"cel-ast.d.ts","sourceRoot":"","sources":["../src/cel-ast.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,OAAO,IAAI,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEpF;;;;yBAIyB;AACzB,qBAAa,aAAc,SAAQ,KAAK;IAEpC,QAAQ,CAAC,MAAM,EAAE,MAAM;aACL,KAAK,EAAE,OAAO;gBADvB,MAAM,EAAE,MAAM,EACL,KAAK,EAAE,OAAO;CAKnC;AAaD;;;;qDAIqD;AACrD,MAAM,MAAM,OAAO,GACf;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAC5D;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACxD;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,mCAAmC;IACnC,QAAQ,EAAE,OAAO,CAAC;CACnB,GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,4BAA4B;IAC5B,QAAQ,EAAE,OAAO,CAAC;CACnB,GACD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,EAAE,CAAA;CAAE,GACxE;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,OAAO,EAAE,CAAC;CACjB,GACD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,KAAK,EAAE,OAAO,EAAE,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,OAAO,EAAE;QAAE,GAAG,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,EAAE,CAAA;CAAE,GACrF;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;CACf,GACD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GACxE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAE3F;;;6CAG6C;AAC7C,MAAM,WAAW,UAAU;IACzB,kFAAkF;IAClF,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,IAAI,EAAE,OAAO,CAAC;IACd;;oEAEgE;IAChE,GAAG,IAAI,OAAO,CAAC;CAChB;AAmBD;;6BAE6B;AAC7B,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAiFzE;AA4BD;;;;;;;uCAOuC;AACvC,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,UAAU,EAAE,CAuDd"}

package/dist/cel-ast.js

@@ -1,4 +1,31 @@
-import { parse } from "@marcbachmann/cel-js";
+import { ParseError, parse } from "@marcbachmann/cel-js";
+/** A CEL body that does not parse — an author's expression, mid-typing or
+ *  malformed. Owned here so a consumer can be lenient about author syntax
+ *  (navigation, completion) without also swallowing a defect in the wrapper
+ *  below, and so the third-party parser's error type stays internal, exactly as
+ *  its AST type does. */
+export class CelParseError extends Error {
+    source;
+    cause;
+    constructor(source, cause) {
+        super(cause instanceof Error ? cause.message : String(cause));
+        this.source = source;
+        this.cause = cause;
+        this.name = "CelParseError";
+    }
+}
+/** Parse a CEL body, translating the parser's own failure into `CelParseError`.
+ *  Anything else (a bug in `wrapCelAst`) propagates untouched. */
+function parseCel(source) {
+    try {
+        return parse(source).ast;
+    }
+    catch (error) {
+        if (error instanceof ParseError)
+            throw new CelParseError(source, error);
+        throw error;
+    }
+}
 const BINARY_OPS = new Set([
     "!=",
     "==",
@@ -115,10 +142,13 @@ function parseLenient(source, segmentStart, range) {
         if (!trimmed)
             break;
         try {
-            return wrapCelAst(parse(trimmed).ast, segmentStart);
+            return wrapCelAst(parseCel(trimmed), segmentStart);
         }
-        catch {
-            // try the next-shorter prefix
+        catch (error) {
+            // Only a body that doesn't parse warrants the next-shorter prefix; a
+            // wrapper defect is not something a shorter prefix fixes.
+            if (!(error instanceof CelParseError))
+                throw error;
         }
     }
     return { kind: "ident", range, name: source.trim() };
@@ -142,7 +172,7 @@ export function buildCelSegments(scalarText, scalarStart, tag, taggedSource) {
                 range,
                 source: taggedSource,
                 open: false,
-                ast: () => wrapCelAst(parse(taggedSource).ast, bodyStart),
+                ast: () => wrapCelAst(parseCel(taggedSource), bodyStart),
             },
         ];
     }
@@ -160,7 +190,7 @@ export function buildCelSegments(scalarText, scalarStart, tag, taggedSource) {
             range: [scalarStart + match.index, scalarStart + match.index + whole.length],
             source,
             open: false,
-            ast: () => wrapCelAst(parse(source).ast, bodyStart),
+            ast: () => wrapCelAst(parseCel(source), bodyStart),
         });
         lastClosedEnd = match.index + whole.length;
     }

package/dist/cel-bindings.d.ts

@@ -0,0 +1,57 @@
+/** Annotation on an `x-telo-context` node naming the resource field that holds
+ *  the kind's named CEL bindings. The field is read from the RESOURCE ROOT, not
+ *  the per-scope manifest item: a bindings map belongs to the resource, while the
+ *  contexts that see it may be anchored anywhere (a decision table annotates both
+ *  `choices` and `default`). */
+export declare const BINDINGS_ANNOTATION = "x-telo-bindings-from";
+export interface BindingSites {
+    /** Resource field holding the bindings map. */
+    field: string;
+    /** Every field named by an annotation on this kind. More than one is a
+     *  kind-authoring mistake: which of them holds the bindings would be decided
+     *  by schema walk order. */
+    fields: string[];
+    /** Variable names the annotated contexts declare — a binding may not shadow one. */
+    scopeNames: Set<string>;
+}
+/**
+ * CEL keywords. A binding named after one is unreachable — `true` lexes as a
+ * literal, `in` as an operator — so it is reserved alongside the scope names,
+ * which turns silence into a diagnostic.
+ */
+export declare const CEL_RESERVED_WORDS: readonly string[];
+/** Locate a kind's bindings field and the scope names its annotated contexts
+ *  declare. Returns undefined for a kind that declares no bindings region. */
+export declare function findBindingSites(definitionSchema: Record<string, any> | undefined): BindingSites | undefined;
+/** Each binding's dependencies, restricted to its siblings — an identifier that
+ *  names something else in scope (`inputs`, `item`) is not an edge. */
+export declare function bindingDependencies(bindings: Record<string, unknown>): Map<string, Set<string>>;
+/** Member-access chain for a binding whose value is one bare dotted identifier
+ *  expression (`inputs.user.name`). Null for anything else — a literal, a call,
+ *  a comprehension, a structured value — none of which reduces to a typed path. */
+export declare function bindingPathChain(value: unknown): string[] | null;
+/**
+ * The context properties a bindings map contributes: each name typed from its
+ * expression where that expression is a chain into an already-typed scope
+ * variable, and left open otherwise.
+ *
+ * Gradual by design — the same stance `x-telo-context-element-from` takes. An
+ * open schema costs a missed `CEL_UNKNOWN_FIELD` under that name; inventing a
+ * type would cost a false one.
+ */
+export declare function bindingContextProperties(bindings: Record<string, unknown>, contextSchema: Record<string, any>): Record<string, any>;
+/** Walk a member-access chain through a schema's `properties`, returning the
+ *  terminal node or undefined once the path leaves typed schema. */
+export declare function schemaAtChain(chain: string[] | null, root: Record<string, any>): Record<string, any> | undefined;
+/**
+ * Evaluation order derived from the reference graph, plus any cycles found.
+ *
+ * Order is what the editor and diagnostics show; the runtime does not need it,
+ * since lazy evaluation reaches a binding's dependencies by construction. A
+ * cycle is reported as the path that closes it (`a → b → a`).
+ */
+export declare function resolveBindingOrder(bindings: Record<string, unknown>): {
+    order: string[];
+    cycles: string[][];
+};
+//# sourceMappingURL=cel-bindings.d.ts.map

package/dist/cel-bindings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cel-bindings.d.ts","sourceRoot":"","sources":["../src/cel-bindings.ts"],"names":[],"mappings":"AAIA;;;;gCAIgC;AAChC,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAE1D,MAAM,WAAW,YAAY;IAC3B,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd;;gCAE4B;IAC5B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,oFAAoF;IACpF,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACzB;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAsB/C,CAAC;AAEF;8EAC8E;AAC9E,wBAAgB,gBAAgB,CAC9B,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAChD,YAAY,GAAG,SAAS,CAW1B;AAuDD;uEACuE;AACvE,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAW1B;AAED;;mFAEmF;AACnF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,GAAG,IAAI,CAQhE;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACjC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAMrB;AAED;oEACoE;AACpE,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EACtB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CASjC;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IACtE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;CACpB,CAwBA"}

package/dist/cel-bindings.js

@@ -0,0 +1,207 @@
+import { isCompiledValue } from "@telorun/sdk";
+import { buildCelEnvironment, extractAccessChains } from "@telorun/templating";
+import { extractContextsFromSchema } from "./validate-cel-context.js";
+/** Annotation on an `x-telo-context` node naming the resource field that holds
+ *  the kind's named CEL bindings. The field is read from the RESOURCE ROOT, not
+ *  the per-scope manifest item: a bindings map belongs to the resource, while the
+ *  contexts that see it may be anchored anywhere (a decision table annotates both
+ *  `choices` and `default`). */
+export const BINDINGS_ANNOTATION = "x-telo-bindings-from";
+/**
+ * CEL keywords. A binding named after one is unreachable — `true` lexes as a
+ * literal, `in` as an operator — so it is reserved alongside the scope names,
+ * which turns silence into a diagnostic.
+ */
+export const CEL_RESERVED_WORDS = [
+    "as",
+    "break",
+    "const",
+    "continue",
+    "else",
+    "false",
+    "for",
+    "function",
+    "if",
+    "import",
+    "in",
+    "let",
+    "loop",
+    "namespace",
+    "null",
+    "package",
+    "return",
+    "true",
+    "var",
+    "void",
+    "while",
+];
+/** Locate a kind's bindings field and the scope names its annotated contexts
+ *  declare. Returns undefined for a kind that declares no bindings region. */
+export function findBindingSites(definitionSchema) {
+    if (!definitionSchema)
+        return undefined;
+    const fields = [];
+    const scopeNames = new Set();
+    for (const { schema } of extractContextsFromSchema(definitionSchema)) {
+        const declared = schema?.[BINDINGS_ANNOTATION];
+        if (typeof declared !== "string" || declared.length === 0)
+            continue;
+        if (!fields.includes(declared))
+            fields.push(declared);
+        for (const name of Object.keys(schema.properties ?? {}))
+            scopeNames.add(name);
+    }
+    return fields.length > 0 ? { field: fields[0], fields, scopeNames } : undefined;
+}
+const TEMPLATE_RE = /\$\{\{\s*([^}]+?)\s*\}\}/g;
+const EXACT_TEMPLATE_RE = /^\s*\$\{\{\s*([^}]+?)\s*\}\}\s*$/;
+/** Parser for expressions that reach here uncompiled. Built once; the base
+ *  environment is stateless and shared with the runtime's own. */
+let parseEnv;
+/**
+ * Root identifiers an expression source reads — the first element of every
+ * member-access chain, which is what a dependency edge is made of.
+ *
+ * Parsed, never lexed: `inputs.total` reads `inputs`, not `total`, and a name
+ * inside a string literal reads nothing. A token scan would make two bindings
+ * named after each other's *fields* look mutually recursive and reject a correct
+ * manifest — the worst outcome a static check has. An expression that does not
+ * parse contributes no edges; its syntax error is the engine pass's to report.
+ */
+function addRootIdentifiers(source, out) {
+    try {
+        parseEnv ??= buildCelEnvironment();
+        for (const chain of extractAccessChains(parseEnv.parse(source).ast)) {
+            if (chain.length > 0)
+                out.add(chain[0]);
+        }
+    }
+    catch {
+        // Unparseable — see above.
+    }
+}
+/** Root identifiers a binding's value reads. Walks the whole value so a
+ *  structured binding (a map with `!cel` leaves) is covered, and reads both a
+ *  compiled expression and a still-raw `${{ }}` string — the editor's
+ *  round-trip view never compiles. An untagged plain string is a literal, not
+ *  an expression, and contributes nothing. */
+function collectRefs(value, out) {
+    if (isCompiledValue(value)) {
+        const refs = value.refs;
+        if (refs)
+            for (const ref of refs)
+                out.add(ref);
+        else
+            addRootIdentifiers(value.source ?? "", out);
+        return;
+    }
+    if (typeof value === "string") {
+        for (const match of value.matchAll(TEMPLATE_RE))
+            addRootIdentifiers(match[1], out);
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (const entry of value)
+            collectRefs(entry, out);
+        return;
+    }
+    if (value !== null && typeof value === "object") {
+        for (const entry of Object.values(value))
+            collectRefs(entry, out);
+    }
+}
+/** Each binding's dependencies, restricted to its siblings — an identifier that
+ *  names something else in scope (`inputs`, `item`) is not an edge. */
+export function bindingDependencies(bindings) {
+    const names = new Set(Object.keys(bindings));
+    const deps = new Map();
+    for (const [name, value] of Object.entries(bindings)) {
+        const refs = new Set();
+        collectRefs(value, refs);
+        const own = new Set();
+        for (const ref of refs)
+            if (names.has(ref))
+                own.add(ref);
+        deps.set(name, own);
+    }
+    return deps;
+}
+/** Member-access chain for a binding whose value is one bare dotted identifier
+ *  expression (`inputs.user.name`). Null for anything else — a literal, a call,
+ *  a comprehension, a structured value — none of which reduces to a typed path. */
+export function bindingPathChain(value) {
+    let source;
+    if (isCompiledValue(value))
+        source = value.source;
+    else if (typeof value === "string")
+        source = value.match(EXACT_TEMPLATE_RE)?.[1];
+    if (source === undefined)
+        return null;
+    const expr = source.trim();
+    if (!/^[A-Za-z_]\w*(\.[A-Za-z_]\w*)*$/.test(expr))
+        return null;
+    return expr.split(".");
+}
+/**
+ * The context properties a bindings map contributes: each name typed from its
+ * expression where that expression is a chain into an already-typed scope
+ * variable, and left open otherwise.
+ *
+ * Gradual by design — the same stance `x-telo-context-element-from` takes. An
+ * open schema costs a missed `CEL_UNKNOWN_FIELD` under that name; inventing a
+ * type would cost a false one.
+ */
+export function bindingContextProperties(bindings, contextSchema) {
+    const props = {};
+    for (const [name, value] of Object.entries(bindings)) {
+        props[name] = schemaAtChain(bindingPathChain(value), contextSchema) ?? {};
+    }
+    return props;
+}
+/** Walk a member-access chain through a schema's `properties`, returning the
+ *  terminal node or undefined once the path leaves typed schema. */
+export function schemaAtChain(chain, root) {
+    if (!chain)
+        return undefined;
+    let current = root;
+    for (const key of chain) {
+        const props = current?.properties;
+        if (!props || !(key in props))
+            return undefined;
+        current = props[key];
+    }
+    return current && typeof current === "object" ? current : undefined;
+}
+/**
+ * Evaluation order derived from the reference graph, plus any cycles found.
+ *
+ * Order is what the editor and diagnostics show; the runtime does not need it,
+ * since lazy evaluation reaches a binding's dependencies by construction. A
+ * cycle is reported as the path that closes it (`a → b → a`).
+ */
+export function resolveBindingOrder(bindings) {
+    const deps = bindingDependencies(bindings);
+    const order = [];
+    const cycles = [];
+    const state = new Map();
+    const path = [];
+    const visit = (name) => {
+        const seen = state.get(name);
+        if (seen === "done")
+            return;
+        if (seen === "visiting") {
+            cycles.push([...path.slice(path.indexOf(name)), name]);
+            return;
+        }
+        state.set(name, "visiting");
+        path.push(name);
+        for (const dep of deps.get(name) ?? [])
+            visit(dep);
+        path.pop();
+        state.set(name, "done");
+        order.push(name);
+    };
+    for (const name of Object.keys(bindings))
+        visit(name);
+    return { order, cycles };
+}

package/dist/index.d.ts

@@ -5,6 +5,8 @@ export { importResolutionDiagnostics } from "./import-resolution-diagnostics.js"
 export type { GraphLoadError, ImportEdge, LoadedFile, LoadedGraph, LoadedModule, ParseError, } from "./loaded-types.js";
 export { flattenForAnalyzer, flattenLoadedModule, forwardReExportManifests, parseExportEntry, reExportSpecsFromExports, resolveExportedKinds, selectModuleManifestsForAnalysis, stampExportedKinds, stampReExportedKinds, type ParsedExportEntry, type ReExportSpec, } from "./flatten-for-analyzer.js";
 export { buildEvalPaths, evalPathCovers } from "./eval-paths.js";
+export { BINDINGS_ANNOTATION, bindingContextProperties, bindingDependencies, findBindingSites, resolveBindingOrder, } from "./cel-bindings.js";
+export type { BindingSites } from "./cel-bindings.js";
 export { applyObservedStateNode, buildObservedStateIndex, buildObservedStateResourcesSchema, collectRunReachableNames, observedStateRead, validateObservedStateDeclarations, OBSERVED_STATE_SCHEMA, } from "./validate-observed-state.js";
 export type { AnalyzedResource, ObservedStateRead } from "./validate-observed-state.js";
 export { moduleScopedDefResolver, scopeResolverForModule } from "./alias-resolver.js";
@@ -36,7 +38,7 @@ export type { DocumentPosition } from "./position-metadata.js";
 export { HttpSource } from "./sources/http-source.js";
 export { RegistrySource } from "./sources/registry-source.js";
 export { defaultSources } from "./sources/default-sources.js";
-export { splitIntegrity, foldIntegrity, verifyIntegrity, verifiedFetch, sha256Base64Url, IntegrityError, } from "./sources/integrity.js";
+export { splitIntegrity, foldIntegrity, isCanonicalIntegrity, verifyIntegrity, verifiedFetch, sha256Base64Url, IntegrityError, } from "./sources/integrity.js";
 export { parseModuleRef, isRegistryRef } from "./sources/module-ref.js";
 export type { ParsedModuleRef } from "./sources/module-ref.js";
 export { OCI_SCHEME, isOciRef, parseOciRef } from "./sources/oci-ref.js";
@@ -54,7 +56,7 @@ export { validateModuleArtifact } from "./validate-module-artifact.js";
 export { withSyntheticPositions } from "./with-synthetic-positions.js";
 export { documentToAst, parseToAst } from "./yaml-ast.js";
 export type { AstDocument, AstMap, AstNode, AstPair, AstScalar, AstSeq } from "./yaml-ast.js";
-export { buildCelSegments, wrapCelAst } from "./cel-ast.js";
+export { CelParseError, buildCelSegments, wrapCelAst } from "./cel-ast.js";
 export type { CelNode, CelSegment } from "./cel-ast.js";
 export { DEFAULT_MANIFEST_FILENAME, DiagnosticSeverity } from "./types.js";
 export type { AnalysisDiagnostic, AnalysisOptions, LoaderInitOptions, LoadOptions, ManifestSource, Position, PositionIndex, Range } from "./types.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACjF,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,iCAAiC,EACjC,wBAAwB,EACxB,iBAAiB,EACjB,iCAAiC,EACjC,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACxF,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACtF,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,oBAAoB,EACpB,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAChG,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC5F,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACnB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,aAAa,EACb,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC/E,YAAY,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EACL,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,sBAAsB,EACtB,WAAW,EACX,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,SAAS,EACT,YAAY,EACZ,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,eAAe,EACf,cAAc,GACf,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC9F,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC5D,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACjF,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,iCAAiC,EACjC,wBAAwB,EACxB,iBAAiB,EACjB,iCAAiC,EACjC,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACxF,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACtF,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,oBAAoB,EACpB,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAChG,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC5F,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACnB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC/E,YAAY,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EACL,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,sBAAsB,EACtB,WAAW,EACX,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,SAAS,EACT,YAAY,EACZ,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,eAAe,EACf,cAAc,GACf,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC3E,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}