Add Validator and update Compiler to support.

compiler/BUILD

@@ -27,6 +27,7 @@ cc_library(
         "//checker:validation_result",
         "//parser:options",
         "//parser:parser_interface",
+        "//validator",
         "@com_google_absl//absl/status",
         "@com_google_absl//absl/status:statusor",
         "@com_google_absl//absl/strings:string_view",
@@ -48,6 +49,7 @@ cc_library(
         "//internal:status_macros",
         "//parser",
         "//parser:parser_interface",
+        "//validator",
         "@com_google_absl//absl/base:nullability",
         "@com_google_absl//absl/container:flat_hash_set",
         "@com_google_absl//absl/status",
@@ -78,6 +80,7 @@ cc_test(
         "//parser:macro",
         "//parser:parser_interface",
         "//testutil:baseline_tests",
+        "//validator:timestamp_literal_validator",
         "@com_google_absl//absl/status",
         "@com_google_absl//absl/status:status_matchers",
         "@com_google_absl//absl/strings",

compiler/compiler.h

@@ -28,6 +28,7 @@
 #include "checker/validation_result.h"
 #include "parser/options.h"
 #include "parser/parser_interface.h"
+#include "validator/validator.h"
 
 namespace cel {
 
@@ -109,6 +110,7 @@ class CompilerBuilder {
 
   virtual TypeCheckerBuilder& GetCheckerBuilder() = 0;
   virtual ParserBuilder& GetParserBuilder() = 0;
+  virtual Validator& GetValidator() = 0;
 
   virtual absl::StatusOr<std::unique_ptr<Compiler>> Build() = 0;
 };
@@ -135,6 +137,9 @@ class Compiler {
 
   // Accessor for the underlying parser.
   virtual const Parser& GetParser() const = 0;
+
+  // Accessor for the underlying validator.
+  virtual const Validator& GetValidator() const = 0;
 };
 
 }  // namespace cel

compiler/compiler_factory.cc

@@ -32,6 +32,7 @@
 #include "internal/status_macros.h"
 #include "parser/parser.h"
 #include "parser/parser_interface.h"
+#include "validator/validator.h"
 #include "google/protobuf/descriptor.h"
 
 namespace cel {
@@ -41,8 +42,12 @@ namespace {
 class CompilerImpl : public Compiler {
  public:
   CompilerImpl(std::unique_ptr<TypeChecker> type_checker,
-               std::unique_ptr<Parser> parser)
-      : type_checker_(std::move(type_checker)), parser_(std::move(parser)) {}
+               std::unique_ptr<Parser> parser,
+               // Copy the validator in case builder is reused.
+               Validator validator)
+      : type_checker_(std::move(type_checker)),
+        parser_(std::move(parser)),
+        validator_(std::move(validator)) {}
 
   absl::StatusOr<ValidationResult> Compile(
       absl::string_view expression,
@@ -54,15 +59,20 @@ class CompilerImpl : public Compiler {
                          type_checker_->Check(std::move(ast)));
 
     result.SetSource(std::move(source));
+    if (!validator_.validations().empty()) {
+      validator_.UpdateValidationResult(result);
+    }
     return result;
   }
 
   const TypeChecker& GetTypeChecker() const override { return *type_checker_; }
   const Parser& GetParser() const override { return *parser_; }
+  const Validator& GetValidator() const override { return validator_; }
 
  private:
   std::unique_ptr<TypeChecker> type_checker_;
   std::unique_ptr<Parser> parser_;
+  Validator validator_;
 };
 
 class CompilerBuilderImpl : public CompilerBuilder {
@@ -126,17 +136,19 @@ class CompilerBuilderImpl : public CompilerBuilder {
   TypeCheckerBuilder& GetCheckerBuilder() override {
     return *type_checker_builder_;
   }
+  Validator& GetValidator() override { return validator_; }
 
   absl::StatusOr<std::unique_ptr<Compiler>> Build() override {
     CEL_ASSIGN_OR_RETURN(auto parser, parser_builder_->Build());
     CEL_ASSIGN_OR_RETURN(auto type_checker, type_checker_builder_->Build());
     return std::make_unique<CompilerImpl>(std::move(type_checker),
-                                          std::move(parser));
+                                          std::move(parser), validator_);
   }
 
  private:
   std::unique_ptr<TypeCheckerBuilder> type_checker_builder_;
   std::unique_ptr<ParserBuilder> parser_builder_;
+  Validator validator_;
 
   absl::flat_hash_set<std::string> library_ids_;
   absl::flat_hash_set<std::string> subsets_;

compiler/compiler_factory_test.cc

@@ -35,6 +35,7 @@
 #include "parser/macro.h"
 #include "parser/parser_interface.h"
 #include "testutil/baseline_tests.h"
+#include "validator/timestamp_literal_validator.h"
 #include "google/protobuf/descriptor.h"
 
 namespace cel {
@@ -287,6 +288,23 @@ TEST(CompilerFactoryTest, DisableStandardMacrosWithStdlib) {
   EXPECT_TRUE(result.IsValid());
 }
 
+TEST(CompilerFactoryTest, AddValidator) {
+  ASSERT_OK_AND_ASSIGN(
+      auto builder,
+      NewCompilerBuilder(cel::internal::GetSharedTestingDescriptorPool()));
+
+  ASSERT_THAT(builder->AddLibrary(StandardCompilerLibrary()), IsOk());
+  builder->GetValidator().AddValidation(TimestampLiteralValidator());
+
+  ASSERT_OK_AND_ASSIGN(auto compiler, builder->Build());
+  ASSERT_OK_AND_ASSIGN(ValidationResult result,
+                       compiler->Compile("timestamp('invalid')"));
+  EXPECT_FALSE(result.IsValid());
+  ASSERT_OK_AND_ASSIGN(result,
+                       compiler->Compile("timestamp('2024-01-01T00:00:00Z')"));
+  EXPECT_TRUE(result.IsValid());
+}
+
 TEST(CompilerFactoryTest, FailsIfLibraryAddedTwice) {
   ASSERT_OK_AND_ASSIGN(
       auto builder,

validator/BUILD

@@ -0,0 +1,89 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+load("@rules_cc//cc:cc_library.bzl", "cc_library")
+load("@rules_cc//cc:cc_test.bzl", "cc_test")
+
+package(default_visibility = ["//visibility:public"])
+
+cc_library(
+    name = "validator",
+    srcs = ["validator.cc"],
+    hdrs = ["validator.h"],
+    deps = [
+        "//checker:type_check_issue",
+        "//checker:validation_result",
+        "//common:ast",
+        "//common:navigable_ast",
+        "//common:source",
+        "@com_google_absl//absl/base:core_headers",
+        "@com_google_absl//absl/functional:any_invocable",
+        "@com_google_absl//absl/log:absl_check",
+        "@com_google_absl//absl/strings:string_view",
+        "@com_google_absl//absl/types:span",
+    ],
+)
+
+cc_test(
+    name = "validator_test",
+    srcs = ["validator_test.cc"],
+    deps = [
+        ":validator",
+        "//checker:type_check_issue",
+        "//common:ast",
+        "//common:expr",
+        "//common:source",
+        "//internal:testing",
+        "@com_google_absl//absl/strings:string_view",
+    ],
+)
+
+cc_test(
+    name = "timestamp_literal_validator_test",
+    srcs = ["timestamp_literal_validator_test.cc"],
+    deps = [
+        ":timestamp_literal_validator",
+        ":validator",
+        "//checker:validation_result",
+        "//compiler",
+        "//compiler:compiler_factory",
+        "//compiler:standard_library",
+        "//internal:testing",
+        "//internal:testing_descriptor_pool",
+        "@com_google_absl//absl/status",
+        "@com_google_absl//absl/status:statusor",
+        "@com_google_absl//absl/strings:string_view",
+    ],
+)
+
+cc_library(
+    name = "timestamp_literal_validator",
+    srcs = ["timestamp_literal_validator.cc"],
+    hdrs = ["timestamp_literal_validator.h"],
+    deps = [
+        ":validator",
+        "//common:constant",
+        "//common:navigable_ast",
+        "//common:standard_definitions",
+        "//internal:time",
+        "//tools:navigable_ast",
+        "@com_google_absl//absl/base:no_destructor",
+        "@com_google_absl//absl/status",
+        "@com_google_absl//absl/strings",
+        "@com_google_absl//absl/strings:string_view",
+        "@com_google_absl//absl/time",
+    ],
+)
+
+licenses(["notice"])

validator/timestamp_literal_validator.cc

@@ -0,0 +1,134 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "validator/timestamp_literal_validator.h"
+
+#include "absl/base/no_destructor.h"
+#include "absl/status/status.h"
+#include "absl/strings/str_cat.h"
+#include "absl/strings/string_view.h"
+#include "absl/time/time.h"
+#include "common/constant.h"
+#include "common/navigable_ast.h"
+#include "common/standard_definitions.h"
+#include "internal/time.h"
+#include "tools/navigable_ast.h"
+#include "validator/validator.h"
+
+namespace cel {
+namespace {
+
+bool ValidateTimestamps(ValidationContext& context) {
+  bool valid = true;
+  for (const auto& node :
+       context.navigable_ast().Root().DescendantsPostorder()) {
+    if (node.node_kind() != NodeKind::kCall ||
+        node.expr()->call_expr().function() != StandardFunctions::kTimestamp) {
+      continue;
+    }
+    if (node.children().size() != 1) {
+      // Checker should have already reported an error.
+      continue;
+    }
+    const NavigableAstNode& child = *node.children()[0];
+    if (child.node_kind() != NodeKind::kConstant) {
+      // Not a literal, so nothing to do.
+      continue;
+    }
+    absl::Time ts;
+    const Constant& constant = child.expr()->const_expr();
+    if (constant.has_string_value()) {
+      absl::string_view timestamp_str =
+          child.expr()->const_expr().string_value();
+      if (!absl::ParseTime(absl::RFC3339_full, timestamp_str, &ts, nullptr)) {
+        context.ReportErrorAt(child.expr()->id(), "invalid timestamp literal");
+        valid = false;
+        continue;
+      }
+    } else if (constant.has_int_value()) {
+      ts = absl::FromUnixSeconds(constant.int_value());
+    } else {
+      // Checker should have already reported an error.
+      continue;
+    }
+
+    if (absl::Status status = internal::ValidateTimestamp(ts); !status.ok()) {
+      context.ReportErrorAt(
+          child.expr()->id(),
+          absl::StrCat("invalid timestamp literal: ", status.message()));
+      valid = false;
+    }
+  }
+
+  return valid;
+}
+
+bool ValidateDurations(ValidationContext& context) {
+  bool valid = true;
+  for (const auto& node :
+       context.navigable_ast().Root().DescendantsPostorder()) {
+    if (node.node_kind() != NodeKind::kCall ||
+        node.expr()->call_expr().function() != StandardFunctions::kDuration) {
+      continue;
+    }
+    if (node.children().size() != 1) {
+      // Checker should have already reported an error.
+      continue;
+    }
+    const NavigableAstNode& child = *node.children()[0];
+    if (child.node_kind() != NodeKind::kConstant) {
+      // Not a literal, so nothing to do.
+      continue;
+    }
+    const Constant& constant = child.expr()->const_expr();
+    if (!constant.has_string_value()) {
+      continue;
+    }
+    absl::Duration duration;
+
+    absl::string_view duration_str = child.expr()->const_expr().string_value();
+    if (!absl::ParseDuration(duration_str, &duration)) {
+      context.ReportErrorAt(child.expr()->id(), "invalid duration literal");
+      valid = false;
+      continue;
+    }
+
+    if (absl::Status status = internal::ValidateDuration(duration);
+        !status.ok()) {
+      context.ReportErrorAt(
+          child.expr()->id(),
+          absl::StrCat("invalid duration literal: ", status.message()));
+      valid = false;
+    }
+  }
+
+  return valid;
+}
+
+}  // namespace
+
+const Validation& TimestampLiteralValidator() {
+  static const absl::NoDestructor<Validation> kInstance(
+      ValidateTimestamps, "cel.validator.timestamp");
+  return *kInstance;
+}
+
+// Returns a validator that checks duration literals.
+const Validation& DurationLiteralValidator() {
+  static const absl::NoDestructor<Validation> kInstance(
+      ValidateDurations, "cel.validator.duration");
+  return *kInstance;
+}
+
+}  // namespace cel