@telorun/templating 0.15.0 → 0.17.0

package/dist/cel/catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/cel/catalog.ts"],"names":[],"mappings":"AAGA;;;0DAG0D;AAC1D,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9B,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9B,IAAI,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC;IAClE,YAAY,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IACpC,YAAY,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IACpC,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;CAClC;AA2CD,MAAM,MAAM,mBAAmB,GAC3B,YAAY,GACZ,MAAM,GACN,MAAM,GACN,QAAQ,GACR,MAAM,GACN,YAAY,GACZ,MAAM,GACN,UAAU,GACV,SAAS,GACT,MAAM,CAAC;AAEX;;;qBAGqB;AACrB,MAAM,WAAW,cAAc;IAC7B,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;0EACsE;IACtE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;yDAIqD;IACrD,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;wBACoB;IACpB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;2EACuE;IACvE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,WAAW,KAAK,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC;CACjE;AAED,wEAAwE;AACxE,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;AAwH5D,eAAO,MAAM,aAAa,EAAE,SAAS,cAAc,EAslBlD,CAAC;AAEF,oEAAoE;AACpE,wBAAgB,kBAAkB,IAAI,eAAe,EAAE,CAEtD"}
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/cel/catalog.ts"],"names":[],"mappings":"AAGA;;;0DAG0D;AAC1D,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9B,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9B,IAAI,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC;IAClE,YAAY,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IACpC,YAAY,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IACpC,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;CAClC;AA2CD,MAAM,MAAM,mBAAmB,GAC3B,YAAY,GACZ,MAAM,GACN,MAAM,GACN,QAAQ,GACR,MAAM,GACN,YAAY,GACZ,MAAM,GACN,UAAU,GACV,SAAS,GACT,MAAM,CAAC;AAEX;;;qBAGqB;AACrB,MAAM,WAAW,cAAc;IAC7B,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;0EACsE;IACtE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;yDAIqD;IACrD,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;wBACoB;IACpB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;2EACuE;IACvE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,WAAW,KAAK,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC;CACjE;AAED,wEAAwE;AACxE,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;AAwH5D,eAAO,MAAM,aAAa,EAAE,SAAS,cAAc,EA8lBlD,CAAC;AAEF,oEAAoE;AACpE,wBAAgB,kBAAkB,IAAI,eAAe,EAAE,CAEtD"}

package/dist/cel/catalog.js

@@ -352,17 +352,25 @@ export const CEL_FUNCTIONS = [
     // already treats `size()` that way, and the alternative teaches an author that
     // slicing bytes is a different operation from slicing a string.
     //
-    // ONE `dyn` signature rather than a concrete overload per element type. The
-    // concrete set is more precise, but cel-js refuses overloads that overlap, so
-    // it cannot also carry the `dyn` case — and a step result whose producer
-    // declares no output type IS `dyn`, which is the common receiver. With only the
-    // concrete set the checker resolves such a call to whichever overload it tries
-    // first and pins the result to that type, so slicing an untyped byte buffer
-    // came back typed `string`. Precision here would be lost at the CEL boundary
-    // anyway, where type arguments are erased.
+    // OVERLOADED BY PARAMETER TYPE, so a wrong receiver is rejected — `slice(42, 0,
+    // 1)` matches nothing. What cannot ALSO be registered is a `dyn` parameter
+    // variant: cel-js refuses overloads that overlap, and a `dyn` first parameter
+    // overlaps all three. That is why the RETURN is `dyn` rather than the input's
+    // own type. A step result whose producer declares no output type is `dyn`, and
+    // with concrete returns the checker resolves such a call to whichever overload
+    // was registered first and pins the result to it — so slicing an untyped byte
+    // buffer came back typed `string`, and a byte consumer downstream reported a
+    // mismatch against perfectly valid CEL. Precision on the way out would be lost
+    // at the CEL boundary anyway, where type arguments are erased; being wrong
+    // about an untyped receiver would not be.
     {
         name: "slice",
         signature: "slice(dyn, int, int): dyn",
+        register: [
+            "slice(bytes, int, int): dyn",
+            "slice(string, int, int): dyn",
+            "slice(list, int, int): dyn",
+        ],
         // Not "string": it is the one function over strings, bytes AND lists, and the
         // category is what groups it in the generated reference — filing it under
         // strings hides it from the byte and list readers who need it most.

package/dist/engine.d.ts

@@ -19,6 +19,18 @@ export interface CompileEnv {
 export interface AnalyzeEnv {
     readonly celEnv: Environment;
     readonly contextSchema: Record<string, unknown> | null;
+    /**
+     * The caller vouches that `celEnv` declares EVERY name legal at this site, so
+     * a root identifier it does not know is undeclared rather than merely
+     * unmodelled.
+     *
+     * Opt-in because the environment is only that complete when someone built it
+     * for a specific site: the base environment declares CEL's own type names and
+     * nothing else, so checking roots against it would report `variables` itself
+     * as unknown. Absent means the check is skipped, which is what every caller
+     * did before it existed.
+     */
+    readonly rootsDeclared?: boolean;
 }
 /** A mechanically applicable repair for a diagnostic. `replacement` is the
  *  **whole analyzed source**, corrected — never a fragment — so a consumer can

package/dist/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../src/engine.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD;;wEAEwE;AACxE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED;;;;;;;;;eASe;AACf,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;;;0EAa0E;AAC1E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;oDAEoD;AACpD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC;CAC9B;AAED;;;;yBAIyB;AACzB,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,UAAU,CAAC;IACrC,wDAAwD;IACxD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;oDAEgD;IAChD,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;AAED;;;iFAGiF;AACjF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAClD,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;4CAgB4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;wBAEwB;AACxB,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;;;;2EAKuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B;;;yDAGqD;IACrD,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,aAAa,GAAG,OAAO,CAAC;IAElE;;iEAE6D;IAC7D,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,aAAa,CAAC;IAExD;;;;;;;;;;;;uBAYmB;IACnB,UAAU,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,eAAe,EAAE,CAAC;IAExD;;;;;;;;;;;;;;;;;2CAiBuC;IACvC,YAAY,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../src/engine.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD;;wEAEwE;AACxE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED;;;;;;;;;eASe;AACf,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACvD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;AAED;;;;;;;;;;;;;0EAa0E;AAC1E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;oDAEoD;AACpD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC;CAC9B;AAED;;;;yBAIyB;AACzB,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,UAAU,CAAC;IACrC,wDAAwD;IACxD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;oDAEgD;IAChD,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;AAED;;;iFAGiF;AACjF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAClD,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;4CAgB4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;wBAEwB;AACxB,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;;;;2EAKuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B;;;yDAGqD;IACrD,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,aAAa,GAAG,OAAO,CAAC;IAElE;;iEAE6D;IAC7D,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,aAAa,CAAC;IAExD;;;;;;;;;;;;uBAYmB;IACnB,UAAU,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,eAAe,EAAE,CAAC;IAExD;;;;;;;;;;;;;;;;;2CAiBuC;IACvC,YAAY,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C"}

package/dist/engines/cel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cel.d.ts","sourceRoot":"","sources":["../../src/engines/cel.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAoB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAElG;;;;;;;;;;2BAU2B;AAC3B,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,aAAa,CAgFnF;AAYD;yCACyC;AACzC,eAAO,MAAM,SAAS,EAAE,gBAWvB,CAAC"}
+{"version":3,"file":"cel.d.ts","sourceRoot":"","sources":["../../src/engines/cel.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAoB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAElG;;;;;;;;;;2BAU2B;AAC3B,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,aAAa,CAqGnF;AAYD;yCACyC;AACzC,eAAO,MAAM,SAAS,EAAE,gBAWvB,CAAC"}

package/dist/engines/cel.js

@@ -69,6 +69,27 @@ export function analyzeCelExpression(source, env) {
             });
         }
     }
+    // An undeclared ROOT identifier. cel-js types an unknown name as `dyn` and
+    // accepts it, so `!cel "fff"` type-checked, reached the runtime and resolved
+    // to nothing — the one CEL mistake with no static report at all. Member
+    // access on a KNOWN root was already covered ("No such key"), which is why a
+    // typo one level in was caught and a typo at the root was not.
+    //
+    // Comprehension variables are not roots: `extractAccessChains` drops the
+    // names a `.all(x, …)` binds, so the check never sees them.
+    if (env.rootsDeclared) {
+        const reported = new Set();
+        for (const chain of extractAccessChains(parsed.ast)) {
+            const root = chain[0];
+            if (!root || reported.has(root) || env.celEnv.hasVariable(root))
+                continue;
+            reported.add(root);
+            out.push({
+                code: "CEL_UNKNOWN_IDENTIFIER",
+                message: `unknown identifier '${root}' — nothing by that name is in scope here.`,
+            });
+        }
+    }
     if (env.contextSchema) {
         const contextSchema = env.contextSchema;
         for (const chain of extractAccessChains(parsed.ast)) {

package/dist/engines/literal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"literal.d.ts","sourceRoot":"","sources":["../../src/engines/literal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD;;+CAE+C;AAC/C,eAAO,MAAM,aAAa,EAAE,gBAU3B,CAAC"}
+{"version":3,"file":"literal.d.ts","sourceRoot":"","sources":["../../src/engines/literal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD;;+CAE+C;AAC/C,eAAO,MAAM,aAAa,EAAE,gBAyB3B,CAAC"}

package/dist/engines/literal.js

@@ -6,6 +6,20 @@ export const literalEngine = {
     compile(source) {
         return source;
     },
+    /**
+     * Opaque text is TEXT — the type is a constant of the tag, exactly as an
+     * embed's is, not a function of the slot.
+     *
+     * Declaring nothing put `!literal` in the other category, the one `!cel` and
+     * `!ref` belong to, and everything downstream then treated it as producing
+     * whatever the slot asked for. So the editor offered it at a boolean
+     * predicate — where opaque text cannot satisfy the slot and `Run.Choice` has
+     * a runtime error saying so — and the analyzer type-checked one against a
+     * slot-shaped placeholder instead of the string it will actually be.
+     */
+    producedType() {
+        return { type: "string" };
+    },
     analyze() {
         return { diagnostics: [], calls: [] };
     },

package/dist/index.d.ts

@@ -14,5 +14,4 @@ export { builtinEngines, createDefaultRegistry, defaultRegistry, producedTypeOf,
 export type { AnalyzeEnv, AnalyzeResult, CallSite, CompileEnv, DiagnosticFix, EngineDiagnostic, EngineFileClaim, TemplatingEngine, } from "./engine.js";
 export { CEL_ENGINE, INCLUDE_BYTES_ENGINE, INCLUDE_ENGINE_NAMES, INCLUDE_TEXT_ENGINE, isIncludeSentinel, isRefSentinel, isTaggedSentinel, makeTaggedSentinel, plainChainOf, type TaggedSentinel, } from "./sentinel.js";
 export { buildCustomTags, defaultCustomTags } from "./yaml-tags.js";
-export { MANIFEST_SCHEMA_URI, ManifestRootSchema, ResourceRefSchema, } from "./manifest-schemas.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,WAAW,GACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,mBAAmB,GACzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,eAAe,EACf,cAAc,EACd,oBAAoB,GACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,aAAa,EACb,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACjG,OAAO,EAAE,kBAAkB,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAEpE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,KAAK,qBAAqB,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAExF,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,eAAe,EACf,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,UAAU,EACV,aAAa,EACb,QAAQ,EACR,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,UAAU,EACV,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,KAAK,cAAc,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,WAAW,GACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,mBAAmB,GACzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,eAAe,EACf,cAAc,EACd,oBAAoB,GACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,aAAa,EACb,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACjG,OAAO,EAAE,kBAAkB,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAEpE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,KAAK,qBAAqB,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAExF,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,eAAe,EACf,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,UAAU,EACV,aAAa,EACb,QAAQ,EACR,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,UAAU,EACV,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,KAAK,cAAc,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -13,4 +13,3 @@ export { TemplatingEngineRegistry } from "./registry.js";
 export { builtinEngines, createDefaultRegistry, defaultRegistry, producedTypeOf, } from "./builtins.js";
 export { CEL_ENGINE, INCLUDE_BYTES_ENGINE, INCLUDE_ENGINE_NAMES, INCLUDE_TEXT_ENGINE, isIncludeSentinel, isRefSentinel, isTaggedSentinel, makeTaggedSentinel, plainChainOf, } from "./sentinel.js";
 export { buildCustomTags, defaultCustomTags } from "./yaml-tags.js";
-export { MANIFEST_SCHEMA_URI, ManifestRootSchema, ResourceRefSchema, } from "./manifest-schemas.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/templating",
-  "version": "0.15.0",
+  "version": "0.17.0",
   "description": "Telo Templating - Engine registry and shared CEL core for Telo manifests.",
   "keywords": [
     "telo",
@@ -44,7 +44,7 @@
     "@types/node": "^20.0.0",
     "typescript": "^5.0.0",
     "vitest": "^2.1.8",
-    "@telorun/sdk": "0.74.0"
+    "@telorun/sdk": "0.82.1"
   },
   "peerDependencies": {
     "@telorun/sdk": "*"

package/src/cel/catalog.ts

@@ -424,17 +424,25 @@ export const CEL_FUNCTIONS: readonly CelFunctionDoc[] = [
   // already treats `size()` that way, and the alternative teaches an author that
   // slicing bytes is a different operation from slicing a string.
   //
-  // ONE `dyn` signature rather than a concrete overload per element type. The
-  // concrete set is more precise, but cel-js refuses overloads that overlap, so
-  // it cannot also carry the `dyn` case — and a step result whose producer
-  // declares no output type IS `dyn`, which is the common receiver. With only the
-  // concrete set the checker resolves such a call to whichever overload it tries
-  // first and pins the result to that type, so slicing an untyped byte buffer
-  // came back typed `string`. Precision here would be lost at the CEL boundary
-  // anyway, where type arguments are erased.
+  // OVERLOADED BY PARAMETER TYPE, so a wrong receiver is rejected — `slice(42, 0,
+  // 1)` matches nothing. What cannot ALSO be registered is a `dyn` parameter
+  // variant: cel-js refuses overloads that overlap, and a `dyn` first parameter
+  // overlaps all three. That is why the RETURN is `dyn` rather than the input's
+  // own type. A step result whose producer declares no output type is `dyn`, and
+  // with concrete returns the checker resolves such a call to whichever overload
+  // was registered first and pins the result to it — so slicing an untyped byte
+  // buffer came back typed `string`, and a byte consumer downstream reported a
+  // mismatch against perfectly valid CEL. Precision on the way out would be lost
+  // at the CEL boundary anyway, where type arguments are erased; being wrong
+  // about an untyped receiver would not be.
   {
     name: "slice",
     signature: "slice(dyn, int, int): dyn",
+    register: [
+      "slice(bytes, int, int): dyn",
+      "slice(string, int, int): dyn",
+      "slice(list, int, int): dyn",
+    ],
     // Not "string": it is the one function over strings, bytes AND lists, and the
     // category is what groups it in the generated reference — filing it under
     // strings hides it from the byte and list readers who need it most.

package/src/engine.ts

@@ -21,6 +21,18 @@ export interface CompileEnv {
 export interface AnalyzeEnv {
   readonly celEnv: Environment;
   readonly contextSchema: Record<string, unknown> | null;
+  /**
+   * The caller vouches that `celEnv` declares EVERY name legal at this site, so
+   * a root identifier it does not know is undeclared rather than merely
+   * unmodelled.
+   *
+   * Opt-in because the environment is only that complete when someone built it
+   * for a specific site: the base environment declares CEL's own type names and
+   * nothing else, so checking roots against it would report `variables` itself
+   * as unknown. Absent means the check is skipped, which is what every caller
+   * did before it existed.
+   */
+  readonly rootsDeclared?: boolean;
 }
 
 /** A mechanically applicable repair for a diagnostic. `replacement` is the

package/src/engines/cel.ts

@@ -79,6 +79,27 @@ export function analyzeCelExpression(source: string, env: AnalyzeEnv): AnalyzeRe
     }
   }
 
+  // An undeclared ROOT identifier. cel-js types an unknown name as `dyn` and
+  // accepts it, so `!cel "fff"` type-checked, reached the runtime and resolved
+  // to nothing — the one CEL mistake with no static report at all. Member
+  // access on a KNOWN root was already covered ("No such key"), which is why a
+  // typo one level in was caught and a typo at the root was not.
+  //
+  // Comprehension variables are not roots: `extractAccessChains` drops the
+  // names a `.all(x, …)` binds, so the check never sees them.
+  if (env.rootsDeclared) {
+    const reported = new Set<string>();
+    for (const chain of extractAccessChains(parsed.ast)) {
+      const root = chain[0];
+      if (!root || reported.has(root) || env.celEnv.hasVariable(root)) continue;
+      reported.add(root);
+      out.push({
+        code: "CEL_UNKNOWN_IDENTIFIER",
+        message: `unknown identifier '${root}' — nothing by that name is in scope here.`,
+      });
+    }
+  }
+
   if (env.contextSchema) {
     const contextSchema = env.contextSchema as Record<string, any>;
     for (const chain of extractAccessChains(parsed.ast)) {

package/src/engines/literal.ts

@@ -10,6 +10,21 @@ export const literalEngine: TemplatingEngine = {
     return source;
   },
 
+  /**
+   * Opaque text is TEXT — the type is a constant of the tag, exactly as an
+   * embed's is, not a function of the slot.
+   *
+   * Declaring nothing put `!literal` in the other category, the one `!cel` and
+   * `!ref` belong to, and everything downstream then treated it as producing
+   * whatever the slot asked for. So the editor offered it at a boolean
+   * predicate — where opaque text cannot satisfy the slot and `Run.Choice` has
+   * a runtime error saying so — and the analyzer type-checked one against a
+   * slot-shaped placeholder instead of the string it will actually be.
+   */
+  producedType() {
+    return { type: "string" };
+  },
+
   analyze() {
     return { diagnostics: [], calls: [] };
   },

package/src/index.ts

@@ -69,8 +69,3 @@ export {
   type TaggedSentinel,
 } from "./sentinel.js";
 export { buildCustomTags, defaultCustomTags } from "./yaml-tags.js";
-export {
-  MANIFEST_SCHEMA_URI,
-  ManifestRootSchema,
-  ResourceRefSchema,
-} from "./manifest-schemas.js";

package/dist/manifest-schemas.d.ts

@@ -1,122 +0,0 @@
-/** Shared JSON-Schema fragments referenced from every module's `telo.yaml`
- *  via `$ref: "telo://manifest#/$defs/<Name>"`. Lives in the templating
- *  package (alongside the YAML tag mechanism) because the analyzer cannot
- *  depend on the kernel — both consume this package, so this is the only
- *  layer where a single source of truth can sit. The kernel re-exports
- *  these symbols from its own `manifest-schemas` surface for downstream
- *  ergonomics. */
-/** Schema fragment for a resource-reference slot. The only form a manifest
- *  author writes is the `!ref <name>` (or `!ref <Alias>.<name>`) YAML tag,
- *  which parses to a `TaggedSentinel` (engine "ref") whose `source` is the
- *  bare resource name. In practice module schemas mark a ref slot with a bare
- *  `x-telo-ref` annotation (plus, where the slot only ever holds a reference,
- *  `type: object` to reject a stray scalar); the analyzer's reference walker
- *  reads `x-telo-ref` to look the name up against that constraint, independent
- *  of this fragment. A slot opts into `$ref:
- *  "telo://manifest#/$defs/ResourceRef"` only when it wants this exact
- *  two-branch shape enforced at the AJV layer too — it is not required, and
- *  slots that also accept an inline value (e.g. `inputType` / `outputType`)
- *  deliberately do not use it (an inline JSON Schema has no `kind`).
- *
- *  Two `anyOf` branches because the value's shape depends on the phase at
- *  which it is validated:
- *
- *   1. The raw `!ref` sentinel — what survives to AJV when a cross-module
- *      reference can't be resolved in standalone single-file analysis (the
- *      imported module isn't loaded). `substituteCelFields` deliberately
- *      keeps the sentinel so this branch matches.
- *   2. A resolved reference object — `{kind, name, alias?}` substituted in
- *      place of a sentinel (or an inline definition `{kind, ...config}`
- *      reached through a local `$ref` that escapes extraction). Both the
- *      kernel and the analyzer validate ref slots *after* sentinel
- *      resolution, so this is the shape AJV usually sees.
- *
- *  The object-form `{kind, name}` reference a user could once type directly
- *  is gone: a plain object at a ref slot is only ever an inline definition
- *  or the resolver's own substitution, never an author-written reference.
- *  That removal is enforced by the analyzer (it rejects an author-written
- *  `{kind, name}` before normalization), not by this schema — branch 2
- *  cannot distinguish an author's `{kind, name}` from the resolver's. */
-export declare const ResourceRefSchema: {
-    title: string;
-    anyOf: ({
-        type: string;
-        required: string[];
-        properties: {
-            __tagged: {
-                const: boolean;
-            };
-            engine: {
-                const: string;
-            };
-            source: {
-                type: string;
-                minLength: number;
-            };
-            kind?: undefined;
-        };
-        additionalProperties: boolean;
-    } | {
-        type: string;
-        required: string[];
-        properties: {
-            kind: {
-                type: string;
-            };
-            __tagged?: undefined;
-            engine?: undefined;
-            source?: undefined;
-        };
-        additionalProperties: boolean;
-    })[];
-};
-/** Stable URI under which the shared manifest root schema is registered
- *  with module-side AJV instances. Module YAMLs reach the fragments via
- *  `$ref: "telo://manifest#/$defs/<Name>"`. The URI is the contract;
- *  the symbol names intentionally omit a host-specific prefix since the
- *  fragments live in `@telorun/templating` (the only layer both kernel
- *  and analyzer depend on). */
-export declare const MANIFEST_SCHEMA_URI = "telo://manifest";
-/** Root schema registered with AJV under `MANIFEST_SCHEMA_URI`. Carries
- *  `$defs` only — it isn't validated against directly. Adding a new
- *  shared fragment means putting it under `$defs` here and `$ref`-ing
- *  it from module schemas. */
-export declare const ManifestRootSchema: {
-    $id: string;
-    $defs: {
-        ResourceRef: {
-            title: string;
-            anyOf: ({
-                type: string;
-                required: string[];
-                properties: {
-                    __tagged: {
-                        const: boolean;
-                    };
-                    engine: {
-                        const: string;
-                    };
-                    source: {
-                        type: string;
-                        minLength: number;
-                    };
-                    kind?: undefined;
-                };
-                additionalProperties: boolean;
-            } | {
-                type: string;
-                required: string[];
-                properties: {
-                    kind: {
-                        type: string;
-                    };
-                    __tagged?: undefined;
-                    engine?: undefined;
-                    source?: undefined;
-                };
-                additionalProperties: boolean;
-            })[];
-        };
-    };
-};
-//# sourceMappingURL=manifest-schemas.d.ts.map

package/dist/manifest-schemas.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"manifest-schemas.d.ts","sourceRoot":"","sources":["../src/manifest-schemas.ts"],"names":[],"mappings":"AAAA;;;;;;kBAMkB;AAElB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEA+ByE;AACzE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoB7B,CAAC;AAGF;;;;;+BAK+B;AAC/B,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAErD;;;8BAG8B;AAC9B,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAK9B,CAAC"}

package/dist/manifest-schemas.js

@@ -1,77 +0,0 @@
-/** Shared JSON-Schema fragments referenced from every module's `telo.yaml`
- *  via `$ref: "telo://manifest#/$defs/<Name>"`. Lives in the templating
- *  package (alongside the YAML tag mechanism) because the analyzer cannot
- *  depend on the kernel — both consume this package, so this is the only
- *  layer where a single source of truth can sit. The kernel re-exports
- *  these symbols from its own `manifest-schemas` surface for downstream
- *  ergonomics. */
-/** Schema fragment for a resource-reference slot. The only form a manifest
- *  author writes is the `!ref <name>` (or `!ref <Alias>.<name>`) YAML tag,
- *  which parses to a `TaggedSentinel` (engine "ref") whose `source` is the
- *  bare resource name. In practice module schemas mark a ref slot with a bare
- *  `x-telo-ref` annotation (plus, where the slot only ever holds a reference,
- *  `type: object` to reject a stray scalar); the analyzer's reference walker
- *  reads `x-telo-ref` to look the name up against that constraint, independent
- *  of this fragment. A slot opts into `$ref:
- *  "telo://manifest#/$defs/ResourceRef"` only when it wants this exact
- *  two-branch shape enforced at the AJV layer too — it is not required, and
- *  slots that also accept an inline value (e.g. `inputType` / `outputType`)
- *  deliberately do not use it (an inline JSON Schema has no `kind`).
- *
- *  Two `anyOf` branches because the value's shape depends on the phase at
- *  which it is validated:
- *
- *   1. The raw `!ref` sentinel — what survives to AJV when a cross-module
- *      reference can't be resolved in standalone single-file analysis (the
- *      imported module isn't loaded). `substituteCelFields` deliberately
- *      keeps the sentinel so this branch matches.
- *   2. A resolved reference object — `{kind, name, alias?}` substituted in
- *      place of a sentinel (or an inline definition `{kind, ...config}`
- *      reached through a local `$ref` that escapes extraction). Both the
- *      kernel and the analyzer validate ref slots *after* sentinel
- *      resolution, so this is the shape AJV usually sees.
- *
- *  The object-form `{kind, name}` reference a user could once type directly
- *  is gone: a plain object at a ref slot is only ever an inline definition
- *  or the resolver's own substitution, never an author-written reference.
- *  That removal is enforced by the analyzer (it rejects an author-written
- *  `{kind, name}` before normalization), not by this schema — branch 2
- *  cannot distinguish an author's `{kind, name}` from the resolver's. */
-export const ResourceRefSchema = {
-    title: "Resource reference",
-    anyOf: [
-        {
-            type: "object",
-            required: ["__tagged", "engine", "source"],
-            properties: {
-                __tagged: { const: true },
-                engine: { const: "ref" },
-                source: { type: "string", minLength: 1 },
-            },
-            additionalProperties: false,
-        },
-        {
-            type: "object",
-            required: ["kind"],
-            properties: { kind: { type: "string" } },
-            additionalProperties: true,
-        },
-    ],
-};
-/** Stable URI under which the shared manifest root schema is registered
- *  with module-side AJV instances. Module YAMLs reach the fragments via
- *  `$ref: "telo://manifest#/$defs/<Name>"`. The URI is the contract;
- *  the symbol names intentionally omit a host-specific prefix since the
- *  fragments live in `@telorun/templating` (the only layer both kernel
- *  and analyzer depend on). */
-export const MANIFEST_SCHEMA_URI = "telo://manifest";
-/** Root schema registered with AJV under `MANIFEST_SCHEMA_URI`. Carries
- *  `$defs` only — it isn't validated against directly. Adding a new
- *  shared fragment means putting it under `$defs` here and `$ref`-ing
- *  it from module schemas. */
-export const ManifestRootSchema = {
-    $id: MANIFEST_SCHEMA_URI,
-    $defs: {
-        ResourceRef: ResourceRefSchema,
-    },
-};

package/src/manifest-schemas.ts

@@ -1,81 +0,0 @@
-/** Shared JSON-Schema fragments referenced from every module's `telo.yaml`
- *  via `$ref: "telo://manifest#/$defs/<Name>"`. Lives in the templating
- *  package (alongside the YAML tag mechanism) because the analyzer cannot
- *  depend on the kernel — both consume this package, so this is the only
- *  layer where a single source of truth can sit. The kernel re-exports
- *  these symbols from its own `manifest-schemas` surface for downstream
- *  ergonomics. */
-
-/** Schema fragment for a resource-reference slot. The only form a manifest
- *  author writes is the `!ref <name>` (or `!ref <Alias>.<name>`) YAML tag,
- *  which parses to a `TaggedSentinel` (engine "ref") whose `source` is the
- *  bare resource name. In practice module schemas mark a ref slot with a bare
- *  `x-telo-ref` annotation (plus, where the slot only ever holds a reference,
- *  `type: object` to reject a stray scalar); the analyzer's reference walker
- *  reads `x-telo-ref` to look the name up against that constraint, independent
- *  of this fragment. A slot opts into `$ref:
- *  "telo://manifest#/$defs/ResourceRef"` only when it wants this exact
- *  two-branch shape enforced at the AJV layer too — it is not required, and
- *  slots that also accept an inline value (e.g. `inputType` / `outputType`)
- *  deliberately do not use it (an inline JSON Schema has no `kind`).
- *
- *  Two `anyOf` branches because the value's shape depends on the phase at
- *  which it is validated:
- *
- *   1. The raw `!ref` sentinel — what survives to AJV when a cross-module
- *      reference can't be resolved in standalone single-file analysis (the
- *      imported module isn't loaded). `substituteCelFields` deliberately
- *      keeps the sentinel so this branch matches.
- *   2. A resolved reference object — `{kind, name, alias?}` substituted in
- *      place of a sentinel (or an inline definition `{kind, ...config}`
- *      reached through a local `$ref` that escapes extraction). Both the
- *      kernel and the analyzer validate ref slots *after* sentinel
- *      resolution, so this is the shape AJV usually sees.
- *
- *  The object-form `{kind, name}` reference a user could once type directly
- *  is gone: a plain object at a ref slot is only ever an inline definition
- *  or the resolver's own substitution, never an author-written reference.
- *  That removal is enforced by the analyzer (it rejects an author-written
- *  `{kind, name}` before normalization), not by this schema — branch 2
- *  cannot distinguish an author's `{kind, name}` from the resolver's. */
-export const ResourceRefSchema = {
-  title: "Resource reference",
-  anyOf: [
-    {
-      type: "object",
-      required: ["__tagged", "engine", "source"],
-      properties: {
-        __tagged: { const: true },
-        engine: { const: "ref" },
-        source: { type: "string", minLength: 1 },
-      },
-      additionalProperties: false,
-    },
-    {
-      type: "object",
-      required: ["kind"],
-      properties: { kind: { type: "string" } },
-      additionalProperties: true,
-    },
-  ],
-};
-
-
-/** Stable URI under which the shared manifest root schema is registered
- *  with module-side AJV instances. Module YAMLs reach the fragments via
- *  `$ref: "telo://manifest#/$defs/<Name>"`. The URI is the contract;
- *  the symbol names intentionally omit a host-specific prefix since the
- *  fragments live in `@telorun/templating` (the only layer both kernel
- *  and analyzer depend on). */
-export const MANIFEST_SCHEMA_URI = "telo://manifest";
-
-/** Root schema registered with AJV under `MANIFEST_SCHEMA_URI`. Carries
- *  `$defs` only — it isn't validated against directly. Adding a new
- *  shared fragment means putting it under `$defs` here and `$ref`-ing
- *  it from module schemas. */
-export const ManifestRootSchema = {
-  $id: MANIFEST_SCHEMA_URI,
-  $defs: {
-    ResourceRef: ResourceRefSchema,
-  },
-};