@telorun/templating 0.2.0

package/LICENSE

@@ -0,0 +1,17 @@
+# SUSTAINABLE USE LICENSE (Fair-code)
+
+Copyright (c) 2026 DiglyAI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to use, copy, modify, and distribute the Software for any purpose—including commercial purposes—subject to the following conditions:
+
+1. ANTI-COMPETITION RESTRICTION: The Software may not be provided to third parties as a managed service, commercial SaaS (Software-as-a-Service), PaaS (Platform-as-a-Service), BaaS (Backend-as-a-Service), or similar offering where the primary value provided to the user is the functionality of the Software itself, without a separate commercial license from the copyright holder.
+
+2. PERMITTED COMMERCIAL USE: You are free to use the Software to build, host, and monetize your own commercial applications, products, and services, provided such use does not violate Clause 1.
+
+3. ATTRIBUTION: This copyright notice and license must be included in all copies or substantial portions of the Software.
+
+4. CONTRIBUTIONS: Contributions to the Software are welcome and encouraged. By contributing, you agree that your contributions may be incorporated into the Software and distributed under this license.
+
+5. DISCLAIMER: The Software is provided "as is", without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose and noninfringement. In no event shall the authors or copyright holders be liable for any claim, damages or other liability, whether in an action of contract, tort or otherwise, arising from, out of or in connection with the Software or the use or other dealings in the Software.
+
+For commercial licensing, managed hosting exemptions, or enterprise inquiries, please contact DiglyAI.

package/README.md

@@ -0,0 +1,246 @@
+<p align="center">
+  <img src="./assets/telo.png" alt="Telo" width="200" />
+</p>
+
+<h1 align="center">Telo</h1>
+
+<p align="center">Runtime for declarative backends.</p>
+
+<p align="center">
+  <a href="https://github.com/telorun/telo/actions/workflows/test.yml"><img alt="Tests" src="https://github.com/telorun/telo/actions/workflows/test.yml/badge.svg" /></a>
+  <a href="https://www.npmjs.com/package/@telorun/cli"><img alt="node" src="https://img.shields.io/node/v/@telorun/cli" /></a>
+  <br />
+  <a href="https://github.com/telorun/telo/commits/main"><img alt="Last commit" src="https://img.shields.io/github/last-commit/telorun/telo" /></a>
+  <a href="https://github.com/telorun/telo/issues"><img alt="Issues" src="https://img.shields.io/github/issues/telorun/telo" /></a>
+  <a href="https://github.com/telorun/telo/pulls"><img alt="Pull requests" src="https://img.shields.io/github/issues-pr/telorun/telo" /></a>
+  <br />
+  <img alt="Changesets" src="https://img.shields.io/badge/maintained%20with-changesets-176de3" />
+</p>
+
+Telo is an execution engine (Micro-Kernel) that runs logic defined entirely in YAML manifests. Instead of writing imperative backend code, you define your routes, databases, schemas, and AI workflows as atomic, interconnected YAML documents. Telo takes those manifests and runs them.
+
+Built to be language-agnostic and infinitely extensible.
+
+```bash
+# Reconcile your manifest into a running backend
+$ telo ./examples/hello-api.yaml
+
+{"level":30,"time":1771610393008,"pid":1310178,"hostname":"dev","msg":"Server listening at http://127.0.0.1:8844"}
+```
+
+## Why use Telo?
+
+- **Open Standards:** Built on YAML, JSON Schema, and CEL — no proprietary DSL.
+- **Static Analysis:** CEL type checking, reference validation, and IDE diagnostics catch errors before runtime.
+- **Micro-Kernel Architecture:** Telo itself knows nothing about HTTP or SQL. Everything is a module you import, scope, and compose with typed variable and secret contracts.
+- **Language Agnostic:** Available as a Node.js runtime today, with a shared YAML runtime contract that allows for future Rust or Go implementations without changing your manifests.
+
+## What It Does
+
+- **Loads** YAML resources and compiles CEL expressions (`${{ }}`) into an in-memory registry.
+- **Resolves** resource dependencies via a multi-pass init loop, handling ordering automatically.
+- **Indexes** resources by Kind and Name for constant-time lookup.
+- **Dispatches** execution to the controller that owns each Kind.
+
+## Example manifest
+
+Here is an example Telo application that defines a simple HTTP API:
+
+```yaml
+kind: Telo.Application
+metadata:
+  name: feedback
+  version: 1.0.0
+  description: |
+    A complete feedback collection REST API — no code, pure YAML.
+    Persists entries to SQLite and serves them over HTTP.
+targets:
+  - Migrations
+  - Server
+---
+kind: Telo.Import
+metadata:
+  name: Http
+source: ../modules/http-server
+---
+kind: Telo.Import
+metadata:
+  name: Sql
+source: ../modules/sql
+---
+# SQLite database — swap driver/host/database for PostgreSQL with zero YAML changes
+kind: Sql.Connection
+metadata:
+  name: Db
+driver: sqlite
+file: ./tmp/feedback.db
+---
+# Migrations: applied automatically before the server starts
+kind: Sql.Migrations
+metadata:
+  name: Migrations
+connection:
+  kind: Sql.Connection
+  name: Db
+---
+kind: Sql.Migration
+metadata:
+  name: Migration_20260413_182154_CreateFeedback
+version: 20260413_182154_CreateFeedback
+sql: |
+  CREATE TABLE IF NOT EXISTS feedback (
+    id        INTEGER PRIMARY KEY AUTOINCREMENT,
+    text      TEXT    NOT NULL,
+    source    TEXT,
+    score     INTEGER NOT NULL DEFAULT 0,
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+  )
+---
+kind: Http.Server
+metadata:
+  name: Server
+baseUrl: http://localhost:8844
+port: 8844
+logger: true
+openapi:
+  info:
+    title: Feedback API
+    version: 1.0.0
+mounts:
+  - path: /v1
+    type: Http.Api.FeedbackRoutes
+---
+kind: Http.Api
+metadata:
+  name: FeedbackRoutes
+routes:
+  # POST /v1/feedback — insert a new entry, score derived from body length heuristic
+  - request:
+      path: /feedback
+      method: POST
+      schema:
+        body:
+          type: object
+          properties:
+            text:
+              type: string
+              minLength: 1
+            source:
+              type: string
+          required: [text]
+    handler:
+      kind: Sql.Exec
+      connection:
+        kind: Sql.Connection
+        name: Db
+    inputs:
+      sql: "INSERT INTO feedback (text, source, score) VALUES (?, ?, ?)"
+      bindings:
+        - "${{ request.body.text }}"
+        - "${{ request.body.source }}"
+        - "${{ size(request.body.text) }}"
+    response:
+      - status: 201
+        headers:
+          Content-Type: application/json
+        body:
+          ok: true
+          message: Feedback received
+
+  # GET /v1/feedback — list all entries, newest first
+  - request:
+      path: /feedback
+      method: GET
+    handler:
+      kind: Sql.Select
+      connection:
+        kind: Sql.Connection
+        name: Db
+      from: feedback
+      columns: [id, text, source, score, created_at]
+      orderBy:
+        - { column: created_at, direction: desc }
+    response:
+      - status: 200
+        headers:
+          Content-Type: application/json
+        body: "${{ result.rows }}"
+
+  # GET /v1/feedback/{id} — fetch a single entry
+  - request:
+      path: /feedback/{id}
+      method: GET
+      schema:
+        params:
+          type: object
+          properties:
+            id:
+              type: integer
+          required: [id]
+    handler:
+      kind: Sql.Select
+      connection:
+        kind: Sql.Connection
+        name: Db
+      from: feedback
+      columns: [id, text, source, score, created_at]
+      where:
+        - { column: id, op: "=", value: "${{ request.params.id }}" }
+    response:
+      - status: 200
+        when: "size(result.rows) > 0"
+        headers:
+          Content-Type: application/json
+        body: "${{ result.rows[0] }}"
+      - status: 404
+        headers:
+          Content-Type: application/json
+        body:
+          ok: false
+          message: Not found
+```
+
+## Status
+
+Telo is under **active development**. The core runtime, module system, and standard library are functional, but the API surface — including YAML shapes — may change without notice. Not yet recommended for production use.
+
+## The Meaning of Telo
+
+The name Telo is derived from the Greek root Telos - meaning the "end goal", "purpose", or "final state". That is exactly the philosophy behind this runtime. In standard imperative programming, you have to write thousands of lines of code to tell a server exactly how to start. With Telo, you simply declare your desired final state.
+
+You define the end state. Telo makes it real.
+
+## Philosophy
+
+Modern platforms often spend disproportionate effort on technical mechanics-wiring frameworks, managing infrastructure, and negotiating toolchains-while the original business problem gets delayed or diluted. Telo pushes in the opposite direction: it treats kernel execution as a stable, predictable host so teams can concentrate on the **business logic and outcomes** instead of the plumbing.
+
+By separating "what the system should do" from "how it is hosted", the runtime reduces friction for domain‑level changes. Teams can move faster on product requirements, experiment more safely, and keep conversations centered on value delivered rather than implementation trivia.
+
+Telo also aims to **join forces across all programming language communities**, so the best ideas, patterns, and implementations can converge into a shared kernel truth without forcing everyone into a single stack.
+
+YAML also makes the system more **AI‑friendly** than traditional programming languages: it is explicit, structured, and easier for tools to generate, review, and transform without losing intent.
+
+## Modularity
+
+Telo is built around **modules** that own specific resource kinds. A module is loaded from a manifest, declares which kinds it implements, and then receives only the resources of those kinds. This keeps concerns isolated and lets teams compose systems from focused building blocks rather than monolithic services.
+
+At kernel execution time, execution is always routed by **Kind.Name**. The kernel resolves the Kind to its owning module and hands off execution. Modules can call back into the kernel to execute other resources, enabling composition without tight coupling.
+
+## Architecture
+
+The architecture is inspired by Kubernetes-style manifests: declarative resources, explicit kinds, and a control plane that routes work based on those definitions.
+Those manifests were taken to the next level by allowing them to run inside a standalone runtime host.
+
+## See more at
+
+- [Telo Kernel](./kernel/README.md)
+- [Telo SDK for module authors](sdk/README.md)
+- [Modules](modules/README.md)
+
+## License
+
+See [LICENSE](https://github.com/telorun/telo/blob/main/LICENSE).
+
+## Contribution Note
+
+By contributing, you agree that code and examples in this repository may be translated or re‑implemented in other programming languages (including by AI systems) to support the project’s polyglot goals.

package/dist/builtins.d.ts

@@ -0,0 +1,16 @@
+import { TemplatingEngineRegistry } from "./registry.js";
+import type { TemplatingEngine } from "./engine.js";
+/** Single source of truth for the built-in templating engines. Every host
+ *  (kernel, analyzer, editor, vscode extension) calls `createDefaultRegistry`
+ *  so the parse-side YAML tag set, the precompile dispatch, and the analyzer
+ *  agree on which engines exist. Per-host à-la-carte registration would let
+ *  a manifest validate clean in one host (e.g. `cel` only) and crash in
+ *  another (e.g. `cel + literal`); always ship the same set. */
+export declare const builtinEngines: readonly TemplatingEngine[];
+export declare function createDefaultRegistry(): TemplatingEngineRegistry;
+/** Memoized singleton: returns the default registry. Hosts that don't need
+ *  per-instance isolation (precompile, the analyzer's tagged-value walker)
+ *  should use this so they share the same registry instance the YAML tag
+ *  factory uses. */
+export declare function defaultRegistry(): TemplatingEngineRegistry;
+//# sourceMappingURL=builtins.d.ts.map

package/dist/builtins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD;;;;;gEAKgE;AAChE,eAAO,MAAM,cAAc,EAAE,SAAS,gBAAgB,EAA+B,CAAC;AAEtF,wBAAgB,qBAAqB,IAAI,wBAAwB,CAMhE;AAID;;;oBAGoB;AACpB,wBAAgB,eAAe,IAAI,wBAAwB,CAK1D"}

package/dist/builtins.js

@@ -0,0 +1,28 @@
+import { celEngine } from "./engines/cel.js";
+import { literalEngine } from "./engines/literal.js";
+import { TemplatingEngineRegistry } from "./registry.js";
+/** Single source of truth for the built-in templating engines. Every host
+ *  (kernel, analyzer, editor, vscode extension) calls `createDefaultRegistry`
+ *  so the parse-side YAML tag set, the precompile dispatch, and the analyzer
+ *  agree on which engines exist. Per-host à-la-carte registration would let
+ *  a manifest validate clean in one host (e.g. `cel` only) and crash in
+ *  another (e.g. `cel + literal`); always ship the same set. */
+export const builtinEngines = [celEngine, literalEngine];
+export function createDefaultRegistry() {
+    const registry = new TemplatingEngineRegistry();
+    for (const engine of builtinEngines) {
+        registry.register(engine);
+    }
+    return registry;
+}
+let defaultRegistryCache;
+/** Memoized singleton: returns the default registry. Hosts that don't need
+ *  per-instance isolation (precompile, the analyzer's tagged-value walker)
+ *  should use this so they share the same registry instance the YAML tag
+ *  factory uses. */
+export function defaultRegistry() {
+    if (!defaultRegistryCache) {
+        defaultRegistryCache = createDefaultRegistry();
+    }
+    return defaultRegistryCache;
+}

package/dist/cel/analyze.d.ts

@@ -0,0 +1,17 @@
+import type { ASTNode } from "@marcbachmann/cel-js";
+/**
+ * Extract all member-access chains from a CEL AST.
+ * Returns arrays like ["request", "query", "name"] for `request.query.name`.
+ * Chains that start with a call or non-identifier root are ignored.
+ * Bound variables in comprehension macros (filter, map, exists, all, exists_one) are excluded.
+ */
+export declare function extractAccessChains(node: ASTNode): string[][];
+/**
+ * Check whether a member-access chain accesses only fields declared in a JSON Schema.
+ * Returns an error string if a field is unknown in a schema that declares explicit
+ * properties without `additionalProperties: true`, or if the chain attempts to
+ * reach inside an `x-telo-stream: true` property.
+ * Returns null when the chain is valid or the schema is too open to judge.
+ */
+export declare function validateChainAgainstSchema(chain: string[], schema: Record<string, any>): string | null;
+//# sourceMappingURL=analyze.d.ts.map

package/dist/cel/analyze.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyze.d.ts","sourceRoot":"","sources":["../../src/cel/analyze.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAEpD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,EAAE,EAAE,CAI7D;AA2ED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,EAAE,EACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC1B,MAAM,GAAG,IAAI,CA2Bf"}

package/dist/cel/analyze.js

@@ -0,0 +1,116 @@
+/**
+ * Extract all member-access chains from a CEL AST.
+ * Returns arrays like ["request", "query", "name"] for `request.query.name`.
+ * Chains that start with a call or non-identifier root are ignored.
+ * Bound variables in comprehension macros (filter, map, exists, all, exists_one) are excluded.
+ */
+export function extractAccessChains(node) {
+    const chains = [];
+    visitNode(node, chains, new Set());
+    return chains;
+}
+const COMPREHENSION_METHODS = new Set(["filter", "map", "exists", "all", "exists_one"]);
+function visitNode(node, chains, boundVars) {
+    const chain = extractChain(node, boundVars);
+    if (chain !== null) {
+        chains.push(chain);
+        return;
+    }
+    if (node.op === "rcall" &&
+        Array.isArray(node.args) &&
+        typeof node.args[0] === "string" &&
+        COMPREHENSION_METHODS.has(node.args[0])) {
+        const receiver = node.args[1];
+        const comprehensionArgs = node.args[2];
+        if (isASTNode(receiver))
+            visitNode(receiver, chains, boundVars);
+        if (Array.isArray(comprehensionArgs) &&
+            comprehensionArgs.length >= 2 &&
+            isASTNode(comprehensionArgs[0]) &&
+            comprehensionArgs[0].op === "id") {
+            const newBoundVars = new Set(boundVars);
+            newBoundVars.add(comprehensionArgs[0].args);
+            for (let i = 1; i < comprehensionArgs.length; i++) {
+                const arg = comprehensionArgs[i];
+                if (isASTNode(arg))
+                    visitNode(arg, chains, newBoundVars);
+            }
+        }
+        return;
+    }
+    const args = node.args;
+    if (Array.isArray(args)) {
+        for (const arg of args) {
+            if (isASTNode(arg)) {
+                visitNode(arg, chains, boundVars);
+            }
+            else if (Array.isArray(arg)) {
+                for (const item of arg) {
+                    if (isASTNode(item))
+                        visitNode(item, chains, boundVars);
+                }
+            }
+        }
+    }
+}
+function isASTNode(v) {
+    return v !== null && typeof v === "object" && "op" in v;
+}
+const INDEX_SEGMENT = "[*]";
+function extractChain(node, boundVars) {
+    if (node.op === "id") {
+        const name = node.args;
+        if (boundVars.has(name))
+            return null;
+        return [name];
+    }
+    if (node.op === ".") {
+        const [obj, field] = node.args;
+        const parent = extractChain(obj, boundVars);
+        if (parent !== null)
+            return [...parent, field];
+    }
+    if (node.op === "[]") {
+        const [obj] = node.args;
+        const parent = extractChain(obj, boundVars);
+        if (parent !== null)
+            return [...parent, INDEX_SEGMENT];
+    }
+    return null;
+}
+/**
+ * Check whether a member-access chain accesses only fields declared in a JSON Schema.
+ * Returns an error string if a field is unknown in a schema that declares explicit
+ * properties without `additionalProperties: true`, or if the chain attempts to
+ * reach inside an `x-telo-stream: true` property.
+ * Returns null when the chain is valid or the schema is too open to judge.
+ */
+export function validateChainAgainstSchema(chain, schema) {
+    let current = schema;
+    for (let i = 0; i < chain.length; i++) {
+        const key = chain[i];
+        if (!current || typeof current !== "object")
+            return null;
+        const props = current.properties;
+        if (!props)
+            return null;
+        if (key in props) {
+            const propSchema = props[key];
+            if (propSchema &&
+                typeof propSchema === "object" &&
+                propSchema["x-telo-stream"] === true &&
+                i < chain.length - 1) {
+                const path = chain.slice(0, i + 1).join(".");
+                return `'${path}' yields a stream — pipe it through an Encoder or iterate in a JS.Script step (no member access on stream-typed values)`;
+            }
+            current = propSchema;
+            continue;
+        }
+        if (current.additionalProperties === true)
+            return null;
+        const path = chain.slice(0, i + 1).join(".");
+        const available = Object.keys(props).join(", ");
+        return `'${path}' is not defined (available: ${available})`;
+    }
+    return null;
+}

package/dist/cel/compile.d.ts

@@ -0,0 +1,15 @@
+import type { CompiledValue } from "@telorun/sdk";
+import type { Environment } from "@marcbachmann/cel-js";
+export declare const TEMPLATE_REGEX: RegExp;
+export declare const EXACT_TEMPLATE_REGEX: RegExp;
+/** Compile a single CEL expression (no `${{ }}` wrapping) into a CompiledValue.
+ *  Throws on syntax errors. Used by the `!cel` engine where the entire tagged
+ *  scalar is treated as one expression. */
+export declare function compileExpression(expr: string, env: Environment): CompiledValue;
+/** Compile a string that may contain `${{ }}`-delimited CEL segments. If the
+ *  string is exactly one expression, returns a single CompiledValue. If it
+ *  contains interpolations, returns a CompiledValue that joins literal parts
+ *  with stringified expression results. If no expressions are present, returns
+ *  the input string unchanged. Throws on CEL syntax errors. */
+export declare function compileString(s: string, env: Environment): unknown;
+//# sourceMappingURL=compile.d.ts.map

package/dist/cel/compile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compile.d.ts","sourceRoot":"","sources":["../../src/cel/compile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAExD,eAAO,MAAM,cAAc,QAA8B,CAAC;AAC1D,eAAO,MAAM,oBAAoB,QAAqC,CAAC;AAEvE;;2CAE2C;AAC3C,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,GAAG,aAAa,CAO/E;AAED;;;;+DAI+D;AAC/D,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAuBlE"}

package/dist/cel/compile.js

@@ -0,0 +1,41 @@
+export const TEMPLATE_REGEX = /\$\{\{\s*([^}]+?)\s*\}\}/g;
+export const EXACT_TEMPLATE_REGEX = /^\s*\$\{\{\s*([^}]+?)\s*\}\}\s*$/;
+/** Compile a single CEL expression (no `${{ }}` wrapping) into a CompiledValue.
+ *  Throws on syntax errors. Used by the `!cel` engine where the entire tagged
+ *  scalar is treated as one expression. */
+export function compileExpression(expr, env) {
+    const fn = env.parse(expr);
+    return {
+        __compiled: true,
+        source: expr,
+        call: (ctx) => fn(ctx),
+    };
+}
+/** Compile a string that may contain `${{ }}`-delimited CEL segments. If the
+ *  string is exactly one expression, returns a single CompiledValue. If it
+ *  contains interpolations, returns a CompiledValue that joins literal parts
+ *  with stringified expression results. If no expressions are present, returns
+ *  the input string unchanged. Throws on CEL syntax errors. */
+export function compileString(s, env) {
+    if (!s.includes("${{"))
+        return s;
+    const exact = s.match(EXACT_TEMPLATE_REGEX);
+    if (exact) {
+        return compileExpression(exact[1].trim(), env);
+    }
+    const parts = [];
+    let last = 0;
+    for (const m of s.matchAll(TEMPLATE_REGEX)) {
+        if (m.index > last)
+            parts.push(s.slice(last, m.index));
+        parts.push(compileExpression(m[1].trim(), env));
+        last = m.index + m[0].length;
+    }
+    if (last < s.length)
+        parts.push(s.slice(last));
+    return {
+        __compiled: true,
+        source: s,
+        call: (ctx) => parts.map((p) => (typeof p === "string" ? p : String(p.call(ctx) ?? ""))).join(""),
+    };
+}

package/dist/cel/environment.d.ts

@@ -0,0 +1,20 @@
+import { Environment } from "@marcbachmann/cel-js";
+export interface CelHandlers {
+    sha256: (s: string) => string;
+    json: (value: unknown) => string;
+}
+/** Build a CEL `Environment` with Telo's stdlib of functions. Always registers the
+ *  same function signatures (so `env.check()` succeeds for type-inference) — the
+ *  handlers govern what the function does when called at runtime. Analyzer-only
+ *  callers can omit handlers; runtime callers (kernel) must supply real ones.
+ *
+ *  Also registers the `Stream` object type, backed by the `Stream` class from
+ *  `@telorun/sdk`. CEL's type-checker rejects values whose constructor isn't
+ *  Object/Map/Array/Set/registered; producers that need to expose an
+ *  `AsyncIterable` through a stream-typed property must wrap the iterable in
+ *  `new Stream(...)` so its constructor is the registered class. The type has
+ *  no fields, so terminal access (passing the value through CEL) succeeds but
+ *  member access raises a CEL error at runtime — matching the analyzer's
+ *  static check on `x-telo-stream`-marked properties. */
+export declare function buildCelEnvironment(handlers?: CelHandlers): Environment;
+//# sourceMappingURL=environment.d.ts.map

package/dist/cel/environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment.d.ts","sourceRoot":"","sources":["../../src/cel/environment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAGnD,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9B,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;CAClC;AAcD;;;;;;;;;;;;yDAYyD;AACzD,wBAAgB,mBAAmB,CAAC,QAAQ,GAAE,WAA2B,GAAG,WAAW,CAgBtF"}

package/dist/cel/environment.js

@@ -0,0 +1,40 @@
+import { Environment } from "@marcbachmann/cel-js";
+import { Stream } from "@telorun/sdk";
+const stub = (name) => () => {
+    throw new Error(`${name}() is not available in this environment. ` +
+        `Construct StaticAnalyzer or Loader with celHandlers to enable it.`);
+};
+const STUB_HANDLERS = {
+    sha256: stub("sha256"),
+    json: stub("json"),
+};
+/** Build a CEL `Environment` with Telo's stdlib of functions. Always registers the
+ *  same function signatures (so `env.check()` succeeds for type-inference) — the
+ *  handlers govern what the function does when called at runtime. Analyzer-only
+ *  callers can omit handlers; runtime callers (kernel) must supply real ones.
+ *
+ *  Also registers the `Stream` object type, backed by the `Stream` class from
+ *  `@telorun/sdk`. CEL's type-checker rejects values whose constructor isn't
+ *  Object/Map/Array/Set/registered; producers that need to expose an
+ *  `AsyncIterable` through a stream-typed property must wrap the iterable in
+ *  `new Stream(...)` so its constructor is the registered class. The type has
+ *  no fields, so terminal access (passing the value through CEL) succeeds but
+ *  member access raises a CEL error at runtime — matching the analyzer's
+ *  static check on `x-telo-stream`-marked properties. */
+export function buildCelEnvironment(handlers = STUB_HANDLERS) {
+    return new Environment({ unlistedVariablesAreDyn: true, enableOptionalTypes: true })
+        .registerFunction("join(list, string): string", (list, sep) => list.map(String).join(sep))
+        .registerFunction("keys(map): list", (map) => {
+        if (map instanceof Map)
+            return [...map.keys()];
+        return Object.keys(map);
+    })
+        .registerFunction("values(map): list", (map) => {
+        if (map instanceof Map)
+            return [...map.values()];
+        return Object.values(map);
+    })
+        .registerFunction("sha256(string): string", (s) => handlers.sha256(s))
+        .registerFunction("json(dyn): string", (value) => handlers.json(value))
+        .registerType("Stream", Stream);
+}

package/dist/cel/walk.d.ts

@@ -0,0 +1,13 @@
+/** Walks `value` and emits each templated source segment with its dotted
+ *  path (e.g. `routes[0].handler.body`) and the engine that owns it.
+ *
+ *  - Untagged strings: every `${{ ... }}` segment is emitted with
+ *    `engineName = "cel"` (the implicit engine for the legacy interpolation
+ *    syntax).
+ *  - Tagged sentinels: emitted once with the sentinel's declared engine.
+ *    This includes engines that may produce no diagnostics (`literal`) —
+ *    routing through the registry stays generic so adding a third engine
+ *    that wants real analysis doesn't require touching the walker.
+ *  - Compiled values are skipped so a precompiled tree won't be re-walked. */
+export declare function walkCelExpressions(value: unknown, path: string, cb: (source: string, path: string, engineName: string) => void): void;
+//# sourceMappingURL=walk.d.ts.map

package/dist/cel/walk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"walk.d.ts","sourceRoot":"","sources":["../../src/cel/walk.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;8EAU8E;AAC9E,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,IAAI,GAC7D,IAAI,CAwBN"}

package/dist/cel/walk.js

@@ -0,0 +1,36 @@
+import { isTaggedSentinel } from "../sentinel.js";
+import { TEMPLATE_REGEX } from "./compile.js";
+/** Walks `value` and emits each templated source segment with its dotted
+ *  path (e.g. `routes[0].handler.body`) and the engine that owns it.
+ *
+ *  - Untagged strings: every `${{ ... }}` segment is emitted with
+ *    `engineName = "cel"` (the implicit engine for the legacy interpolation
+ *    syntax).
+ *  - Tagged sentinels: emitted once with the sentinel's declared engine.
+ *    This includes engines that may produce no diagnostics (`literal`) —
+ *    routing through the registry stays generic so adding a third engine
+ *    that wants real analysis doesn't require touching the walker.
+ *  - Compiled values are skipped so a precompiled tree won't be re-walked. */
+export function walkCelExpressions(value, path, cb) {
+    if (isTaggedSentinel(value)) {
+        cb(value.source, path, value.engine);
+        return;
+    }
+    if (typeof value === "string") {
+        for (const m of value.matchAll(TEMPLATE_REGEX)) {
+            cb(m[1].trim(), path, "cel");
+        }
+        return;
+    }
+    if (Array.isArray(value)) {
+        value.forEach((v, i) => walkCelExpressions(v, `${path}[${i}]`, cb));
+        return;
+    }
+    if (value !== null &&
+        typeof value === "object" &&
+        !value.__compiled) {
+        for (const [k, v] of Object.entries(value)) {
+            walkCelExpressions(v, path ? `${path}.${k}` : k, cb);
+        }
+    }
+}