@telorun/templating 0.18.0 → 0.20.0

package/dist/cel/diagnose.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"diagnose.d.ts","sourceRoot":"","sources":["../../src/cel/diagnose.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEjE,OAAO,KAAK,EAAE,QAAQ,EAAiB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAE9E;;;;;;;;;;;;;;;4DAe4D;AAE5D,sEAAsE;AACtE,UAAU,OAAO;IACf,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,UAAU,CAAC;IACrC,mEAAmE;IACnE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,OAAO,EAAE,CAAC,CAAC;CAC1D;AAWD;uDACuD;AACvD,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,GAAG,aAAa,CAiB7D;AAuJD,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAClD,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAC;IACpC;;6BAEyB;IACzB,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED;;;yBAGyB;AACzB,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,GAAG,SAAS,CA0DpF;AAED;;6BAE6B;AAC7B,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,EAAE,WAAW,GAAG,MAAM,CAIpF"}
+{"version":3,"file":"diagnose.d.ts","sourceRoot":"","sources":["../../src/cel/diagnose.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEjE,OAAO,KAAK,EAAE,QAAQ,EAAiB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAE9E;;;;;;;;;;;;;;;4DAe4D;AAE5D,sEAAsE;AACtE,UAAU,OAAO;IACf,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,UAAU,CAAC;IACrC,mEAAmE;IACnE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,OAAO,EAAE,CAAC,CAAC;CAC1D;AAWD;uDACuD;AACvD,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,GAAG,aAAa,CAiB7D;AA4KD,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAClD,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAC;IACpC;;;2CAGuC;IACvC,QAAQ,CAAC,cAAc,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACrD;;6BAEyB;IACzB,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED;;;yBAGyB;AACzB,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,GAAG,SAAS,CA0EpF;AAED;;6BAE6B;AAC7B,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,EAAE,WAAW,GAAG,MAAM,CAIpF"}

package/dist/cel/diagnose.js

@@ -33,7 +33,7 @@ export function functionIndex(env) {
  *  missing from here degrades to "no extra explanation" rather than to a false
  *  error on valid CEL. That is what keeps a cel-js upgrade from turning a new
  *  macro into a manifest this analyzer refuses. */
-const MACROS = new Set(["optMap", "optFlatMap"]);
+const MACROS = new Set(["optMap", "optFlatMap", "bind"]);
 function isNode(v) {
     return typeof v === "object" && v !== null && "op" in v;
 }
@@ -159,6 +159,26 @@ function signaturesOf(name, index) {
 /** Spread-friendly optional `fix`, so an undecidable rewrite simply omits the
  *  field rather than carrying `undefined` into the diagnostic. */
 const withFix = (fix) => (fix ? { fix } : {});
+/** The literal value of an argument, or `undefined` when it is an expression
+ *  whose value is not statically known. A negated numeric literal is one node
+ *  out (`-1` parses as unary minus over a value), and reading it is what lets a
+ *  bound like "0–10" catch the below-range case as well as the above. */
+function literalOf(node) {
+    if (node.op === "value")
+        return node.args;
+    if (node.op === "-_") {
+        const inner = node.args;
+        if (isNode(inner) && inner.op === "value") {
+            const v = inner.args;
+            if (typeof v === "number")
+                return -v;
+            if (typeof v === "bigint")
+                return -v;
+        }
+    }
+    return undefined;
+}
+const ARG_CHECKS = new Map(CEL_FUNCTIONS.flatMap((f) => (f.checkArgs ? [[f.name, f.checkArgs]] : [])));
 /** Classify every call in `ast`. Runs unconditionally rather than only after a
  *  failed type-check, because a type-check reports its first error and stops:
  *  an expression with two bad calls would otherwise fix one, re-run, and
@@ -207,10 +227,26 @@ export function auditCalls(source, ast, env) {
         }
         unresolved.push(call.name);
     }
+    const argumentIssues = [];
+    for (const call of calls) {
+        const check = ARG_CHECKS.get(call.name);
+        if (!check)
+            continue;
+        const message = check(call.args.map(literalOf));
+        // No span on an EngineDiagnostic, so the written call goes in the message —
+        // an expression with two calls to the same function is otherwise ambiguous.
+        if (message) {
+            argumentIssues.push({
+                code: "CEL_INVALID_ARGUMENT",
+                message: `${message} (in \`${source.slice(call.start, call.end)}\`)`,
+            });
+        }
+    }
     return {
         diagnostics,
         calls: calls.map(({ receiver: _receiver, args: _args, ...site }) => site),
         unresolved,
+        argumentIssues,
     };
 }
 /** Registered signatures for names a type-check failure mentions, so the

package/dist/engines/cel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cel.d.ts","sourceRoot":"","sources":["../../src/engines/cel.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAoB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAElG;;;;;;;;;;2BAU2B;AAC3B,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,aAAa,CAqGnF;AAYD;yCACyC;AACzC,eAAO,MAAM,SAAS,EAAE,gBAWvB,CAAC"}
+{"version":3,"file":"cel.d.ts","sourceRoot":"","sources":["../../src/engines/cel.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAoB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAElG;;;;;;;;;;2BAU2B;AAC3B,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,aAAa,CA2GnF;AAYD;yCACyC;AACzC,eAAO,MAAM,SAAS,EAAE,gBAWvB,CAAC"}

package/dist/engines/cel.js

@@ -25,6 +25,11 @@ export function analyzeCelExpression(source, env) {
         };
     }
     const audit = auditCalls(source, parsed.ast, env.celEnv);
+    // Reported whatever the type-checker concludes. A literal argument a guard
+    // will refuse is a defect the manifest states outright, and leaving it to the
+    // run is the thing static analysis exists to prevent — so it is not gated on
+    // `checkError` the way the call audit is.
+    out.push(...audit.argumentIssues);
     let type;
     let checkError;
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/templating",
-  "version": "0.18.0",
+  "version": "0.20.0",
   "description": "Telo Templating - Engine registry and shared CEL core for Telo manifests.",
   "keywords": [
     "telo",
@@ -36,15 +36,17 @@
   ],
   "dependencies": {
     "@marcbachmann/cel-js": "^7.6.1",
+    "d3-format": "3.1.2",
     "re2js": "^2.8.3",
     "uuid": "^14.0.1",
     "yaml": "^2.8.3"
   },
   "devDependencies": {
+    "@types/d3-format": "^3.0.4",
     "@types/node": "^20.0.0",
     "typescript": "^5.0.0",
     "vitest": "^2.1.8",
-    "@telorun/sdk": "0.83.0"
+    "@telorun/sdk": "0.87.0"
   },
   "peerDependencies": {
     "@telorun/sdk": "*"

package/src/cel/analyze.ts

@@ -15,6 +15,25 @@ export function extractAccessChains(node: ASTNode): string[][] {
 
 const COMPREHENSION_METHODS = new Set(["filter", "map", "exists", "all", "exists_one"]);
 
+/** `cel.bind(name, init, body)` — CEL's only binding form, and the one the
+ *  parser expands rather than dispatching, so it appears as a receiver call on a
+ *  bare `cel` identifier that is in no scope and never will be. Both walks below
+ *  need the same three facts out of it, so the shape is read once here.
+ *
+ *  The receiver is deliberately not returned: it contributes no chain, and
+ *  descending into it is what produced a `CEL_UNKNOWN_FIELD` for `cel` itself. */
+function bindCall(node: ASTNode): { name: string; init: ASTNode; body: ASTNode } | null {
+  if (node.op !== "rcall" || !Array.isArray(node.args)) return null;
+  const [method, receiver, callArgs] = node.args as [unknown, unknown, unknown];
+  if (method !== "bind") return null;
+  if (!isASTNode(receiver) || receiver.op !== "id" || receiver.args !== "cel") return null;
+  if (!Array.isArray(callArgs) || callArgs.length !== 3) return null;
+  const [nameNode, init, body] = callArgs as [unknown, unknown, unknown];
+  if (!isASTNode(nameNode) || nameNode.op !== "id") return null;
+  if (!isASTNode(init) || !isASTNode(body)) return null;
+  return { name: nameNode.args as string, init, body };
+}
+
 function visitNode(node: ASTNode, chains: string[][], boundVars: Set<string>): void {
   const chain = extractChain(node, boundVars);
   if (chain !== null) {
@@ -22,6 +41,15 @@ function visitNode(node: ASTNode, chains: string[][], boundVars: Set<string>): v
     return;
   }
 
+  // The bound name is in scope for the body ONLY; `init` is evaluated in the
+  // enclosing scope, so a name used there still has to resolve there.
+  const bind = bindCall(node);
+  if (bind) {
+    visitNode(bind.init, chains, boundVars);
+    visitNode(bind.body, chains, new Set(boundVars).add(bind.name));
+    return;
+  }
+
   if (
     node.op === "rcall" &&
     Array.isArray(node.args) &&
@@ -246,6 +274,15 @@ function walkNullable(
     return;
   }
 
+  // `cel.bind` binds a name for its body; mirror extractAccessChains so a bound
+  // name is never read as a nullable context field.
+  const bind = bindCall(node);
+  if (bind) {
+    walkNullable(bind.init, nonNull, boundVars, issues, schema);
+    walkNullable(bind.body, nonNull, new Set(boundVars).add(bind.name), issues, schema);
+    return;
+  }
+
   // Comprehension macros bind a loop variable; mirror extractAccessChains so a
   // bound var is never mistaken for a nullable context field.
   if (