@telorun/templating 0.9.0 → 0.10.0

package/dist/cel/catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/cel/catalog.ts"],"names":[],"mappings":"AAEA;;;0DAG0D;AAC1D,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9B,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9B,IAAI,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC;IAClE,YAAY,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IACpC,YAAY,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IACpC,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;CAClC;AAED,MAAM,MAAM,mBAAmB,GAC3B,YAAY,GACZ,MAAM,GACN,MAAM,GACN,QAAQ,GACR,MAAM,GACN,YAAY,GACZ,MAAM,GACN,UAAU,GACV,SAAS,GACT,MAAM,CAAC;AAEX;;;qBAGqB;AACrB,MAAM,WAAW,cAAc;IAC7B,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;0EACsE;IACtE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;yDAIqD;IACrD,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;wBACoB;IACpB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;2EACuE;IACvE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,WAAW,KAAK,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC;CACjE;AAED,wEAAwE;AACxE,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;AA8E5D,eAAO,MAAM,aAAa,EAAE,SAAS,cAAc,EAoelD,CAAC;AAEF,oEAAoE;AACpE,wBAAgB,kBAAkB,IAAI,eAAe,EAAE,CAEtD"}
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/cel/catalog.ts"],"names":[],"mappings":"AAGA;;;0DAG0D;AAC1D,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9B,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9B,IAAI,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC;IAClE,YAAY,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IACpC,YAAY,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IACpC,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;CAClC;AA2CD,MAAM,MAAM,mBAAmB,GAC3B,YAAY,GACZ,MAAM,GACN,MAAM,GACN,QAAQ,GACR,MAAM,GACN,YAAY,GACZ,MAAM,GACN,UAAU,GACV,SAAS,GACT,MAAM,CAAC;AAEX;;;qBAGqB;AACrB,MAAM,WAAW,cAAc;IAC7B,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;0EACsE;IACtE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;yDAIqD;IACrD,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;wBACoB;IACpB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;2EACuE;IACvE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,WAAW,KAAK,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC;CACjE;AAED,wEAAwE;AACxE,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;AAyE5D,eAAO,MAAM,aAAa,EAAE,SAAS,cAAc,EA8elD,CAAC;AAEF,oEAAoE;AACpE,wBAAgB,kBAAkB,IAAI,eAAe,EAAE,CAEtD"}

package/dist/cel/catalog.js

@@ -1,4 +1,45 @@
+import { RE2JS } from "re2js";
 import { v1, v3, v4, v5, v6, v7, validate as uuidValidate, version as uuidVersion } from "uuid";
+/** RE2 regex engine for the CEL `regex*` functions — `re2js`, a pure-JS port of
+ *  Google's RE2. The dialect is RE2 (linear-time, no backtracking, ReDoS-safe) —
+ *  never JS `RegExp` — so a manifest's regex behaves the same across runtimes.
+ *  Flags map a trailing option string to RE2 flags; inline `(?s)` etc. work in
+ *  the pattern too.
+ *
+ *  Why pure-JS and not a native RE2:
+ *  - The Rust `regex` crate via napi (N-API) is faster, but shipping it means a
+ *    cross-platform prebuild matrix + per-triple npm packages — a whole release
+ *    subsystem for one function family.
+ *  - The `re2` npm package (Google's C++ RE2) is simpler to depend on, but it's a
+ *    nan/V8 addon and **does not load under Bun** (incomplete V8 C++ ABI →
+ *    `undefined symbol`). Telo's CLI and test suite run on Bun, so that's a
+ *    non-starter.
+ *  `re2js` is pure JS: zero native addons, runs identically on Node, Bun, and the
+ *  browser (keeps this package — and the analyzer — browser-safe), and needs no
+ *  prebuilds. The cost is throughput vs. native, which is irrelevant for the
+ *  small strings CEL manifests run regex over. */
+const RE2_FLAG = {
+    i: RE2JS.CASE_INSENSITIVE,
+    m: RE2JS.MULTILINE,
+    s: RE2JS.DOTALL,
+};
+const compileRe2 = (fn, pattern, flags) => {
+    let bits = 0;
+    for (const c of flags ?? "") {
+        if (c === "g")
+            continue; // global is implicit in replaceAll / find-loop
+        const bit = RE2_FLAG[c];
+        if (bit === undefined)
+            throw new Error(`${fn}: unknown regex flag '${c}' (supported: i, m, s)`);
+        bits |= bit;
+    }
+    try {
+        return RE2JS.compile(pattern, bits);
+    }
+    catch (e) {
+        throw new Error(`${fn}: invalid RE2 pattern ${JSON.stringify(pattern)}: ${e instanceof Error ? e.message : String(e)}`);
+    }
+};
 const num = (x) => Number(x);
 const minMax = (list, isMin) => {
     if (!Array.isArray(list) || list.length === 0)
@@ -14,9 +55,6 @@ const minMax = (list, isMin) => {
     }
     return best;
 };
-/** Ensure a regex replaces every match: append the global flag unless the
- *  caller already passed it. */
-const withGlobal = (flags) => flags && flags.includes("g") ? flags : `${flags ?? ""}g`;
 const sortList = (list) => [...list].sort((a, b) => {
     if (typeof a === "number" || typeof a === "bigint") {
         const d = num(a) - num(b);
@@ -201,39 +239,50 @@ export const CEL_FUNCTIONS = [
         name: "regexReplace",
         signature: "regexReplace(string, string, string, string?): string",
         category: "string",
-        summary: "Replace every regex match with a replacement ($1 backrefs); flags like 'i', 'm', 's'.",
+        summary: "Replace every regex match (RE2 syntax) with a replacement ($1 backrefs); flags like 'i', 'm', 's'.",
         deterministic: true,
         hostBacked: false,
-        build: () => (s, pattern, replacement, flags) => s.replace(new RegExp(pattern, withGlobal(flags)), replacement),
+        build: () => (s, pattern, replacement, flags) => compileRe2("regexReplace", pattern, flags).matcher(s).replaceAll(replacement),
     },
     {
         name: "regexExtract",
-        signature: "regexExtract(string, string): string",
+        signature: "regexExtract(string, string, string?): string",
         category: "string",
-        summary: "First whole match of a regex, or '' when there is none.",
+        summary: "First whole match of a regex (RE2 syntax), or '' when there is none.",
         deterministic: true,
         hostBacked: false,
-        build: () => (s, pattern) => s.match(new RegExp(pattern))?.[0] ?? "",
+        build: () => (s, pattern, flags) => {
+            const m = compileRe2("regexExtract", pattern, flags).matcher(s);
+            return m.find() ? (m.group() ?? "") : "";
+        },
     },
     {
         name: "regexExtractAll",
-        signature: "regexExtractAll(string, string): list<string>",
+        signature: "regexExtractAll(string, string, string?): list<string>",
         category: "string",
-        summary: "Every whole match of a regex, in order.",
+        summary: "Every whole match of a regex (RE2 syntax), in order.",
         deterministic: true,
         hostBacked: false,
-        build: () => (s, pattern) => [...s.matchAll(new RegExp(pattern, "g"))].map((m) => m[0]),
+        build: () => (s, pattern, flags) => {
+            const m = compileRe2("regexExtractAll", pattern, flags).matcher(s);
+            const out = [];
+            while (m.find())
+                out.push(m.group() ?? "");
+            return out;
+        },
     },
     {
         name: "regexGroups",
-        signature: "regexGroups(string, string): list<string>",
+        signature: "regexGroups(string, string, string?): list<string>",
         category: "string",
-        summary: "Capture groups of the first regex match (empty list when there is no match).",
+        summary: "Capture groups of the first regex match (RE2 syntax); empty list when there is no match.",
         deterministic: true,
         hostBacked: false,
-        build: () => (s, pattern) => {
-            const m = s.match(new RegExp(pattern));
-            return m ? m.slice(1).map((g) => g ?? "") : [];
+        build: () => (s, pattern, flags) => {
+            const m = compileRe2("regexGroups", pattern, flags).matcher(s);
+            if (!m.find())
+                return [];
+            return Array.from({ length: m.groupCount() }, (_unused, i) => m.group(i + 1) ?? "");
         },
     },
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/templating",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Telo Templating - Engine registry and shared CEL core for Telo manifests.",
   "keywords": [
     "telo",
@@ -36,6 +36,7 @@
   ],
   "dependencies": {
     "@marcbachmann/cel-js": "^7.6.1",
+    "re2js": "^2.8.3",
     "uuid": "^10.0.0",
     "yaml": "^2.8.3"
   },

package/src/cel/catalog.ts

@@ -1,3 +1,4 @@
+import { RE2JS } from "re2js";
 import { v1, v3, v4, v5, v6, v7, validate as uuidValidate, version as uuidVersion } from "uuid";
 
 /** Host-injected functions that need platform APIs the templating package must
@@ -15,6 +16,47 @@ export interface CelHandlers {
   json: (value: unknown) => string;
 }
 
+/** RE2 regex engine for the CEL `regex*` functions — `re2js`, a pure-JS port of
+ *  Google's RE2. The dialect is RE2 (linear-time, no backtracking, ReDoS-safe) —
+ *  never JS `RegExp` — so a manifest's regex behaves the same across runtimes.
+ *  Flags map a trailing option string to RE2 flags; inline `(?s)` etc. work in
+ *  the pattern too.
+ *
+ *  Why pure-JS and not a native RE2:
+ *  - The Rust `regex` crate via napi (N-API) is faster, but shipping it means a
+ *    cross-platform prebuild matrix + per-triple npm packages — a whole release
+ *    subsystem for one function family.
+ *  - The `re2` npm package (Google's C++ RE2) is simpler to depend on, but it's a
+ *    nan/V8 addon and **does not load under Bun** (incomplete V8 C++ ABI →
+ *    `undefined symbol`). Telo's CLI and test suite run on Bun, so that's a
+ *    non-starter.
+ *  `re2js` is pure JS: zero native addons, runs identically on Node, Bun, and the
+ *  browser (keeps this package — and the analyzer — browser-safe), and needs no
+ *  prebuilds. The cost is throughput vs. native, which is irrelevant for the
+ *  small strings CEL manifests run regex over. */
+const RE2_FLAG: Record<string, number> = {
+  i: RE2JS.CASE_INSENSITIVE,
+  m: RE2JS.MULTILINE,
+  s: RE2JS.DOTALL,
+};
+
+const compileRe2 = (fn: string, pattern: string, flags?: string): RE2JS => {
+  let bits = 0;
+  for (const c of flags ?? "") {
+    if (c === "g") continue; // global is implicit in replaceAll / find-loop
+    const bit = RE2_FLAG[c];
+    if (bit === undefined) throw new Error(`${fn}: unknown regex flag '${c}' (supported: i, m, s)`);
+    bits |= bit;
+  }
+  try {
+    return RE2JS.compile(pattern, bits);
+  } catch (e) {
+    throw new Error(
+      `${fn}: invalid RE2 pattern ${JSON.stringify(pattern)}: ${e instanceof Error ? e.message : String(e)}`,
+    );
+  }
+};
+
 export type CelFunctionCategory =
   | "conversion"
   | "time"
@@ -73,11 +115,6 @@ const minMax = (list: unknown[], isMin: boolean): unknown => {
   return best;
 };
 
-/** Ensure a regex replaces every match: append the global flag unless the
- *  caller already passed it. */
-const withGlobal = (flags?: string): string =>
-  flags && flags.includes("g") ? flags : `${flags ?? ""}g`;
-
 const sortList = (list: unknown[]): unknown[] =>
   [...list].sort((a, b) => {
     if (typeof a === "number" || typeof a === "bigint") {
@@ -270,41 +307,51 @@ export const CEL_FUNCTIONS: readonly CelFunctionDoc[] = [
     name: "regexReplace",
     signature: "regexReplace(string, string, string, string?): string",
     category: "string",
-    summary: "Replace every regex match with a replacement ($1 backrefs); flags like 'i', 'm', 's'.",
+    summary:
+      "Replace every regex match (RE2 syntax) with a replacement ($1 backrefs); flags like 'i', 'm', 's'.",
     deterministic: true,
     hostBacked: false,
     build: () => (s: string, pattern: string, replacement: string, flags?: string) =>
-      s.replace(new RegExp(pattern, withGlobal(flags)), replacement),
+      compileRe2("regexReplace", pattern, flags).matcher(s).replaceAll(replacement),
   },
   {
     name: "regexExtract",
-    signature: "regexExtract(string, string): string",
+    signature: "regexExtract(string, string, string?): string",
     category: "string",
-    summary: "First whole match of a regex, or '' when there is none.",
+    summary: "First whole match of a regex (RE2 syntax), or '' when there is none.",
     deterministic: true,
     hostBacked: false,
-    build: () => (s: string, pattern: string) => s.match(new RegExp(pattern))?.[0] ?? "",
+    build: () => (s: string, pattern: string, flags?: string) => {
+      const m = compileRe2("regexExtract", pattern, flags).matcher(s);
+      return m.find() ? (m.group() ?? "") : "";
+    },
   },
   {
     name: "regexExtractAll",
-    signature: "regexExtractAll(string, string): list<string>",
+    signature: "regexExtractAll(string, string, string?): list<string>",
     category: "string",
-    summary: "Every whole match of a regex, in order.",
+    summary: "Every whole match of a regex (RE2 syntax), in order.",
     deterministic: true,
     hostBacked: false,
-    build: () => (s: string, pattern: string) =>
-      [...s.matchAll(new RegExp(pattern, "g"))].map((m) => m[0]),
+    build: () => (s: string, pattern: string, flags?: string) => {
+      const m = compileRe2("regexExtractAll", pattern, flags).matcher(s);
+      const out: string[] = [];
+      while (m.find()) out.push(m.group() ?? "");
+      return out;
+    },
   },
   {
     name: "regexGroups",
-    signature: "regexGroups(string, string): list<string>",
+    signature: "regexGroups(string, string, string?): list<string>",
     category: "string",
-    summary: "Capture groups of the first regex match (empty list when there is no match).",
+    summary:
+      "Capture groups of the first regex match (RE2 syntax); empty list when there is no match.",
     deterministic: true,
     hostBacked: false,
-    build: () => (s: string, pattern: string) => {
-      const m = s.match(new RegExp(pattern));
-      return m ? m.slice(1).map((g) => g ?? "") : [];
+    build: () => (s: string, pattern: string, flags?: string) => {
+      const m = compileRe2("regexGroups", pattern, flags).matcher(s);
+      if (!m.find()) return [];
+      return Array.from({ length: m.groupCount() }, (_unused, i) => m.group(i + 1) ?? "");
     },
   },
   {