@flyingrobots/graft 0.4.0 → 0.6.0

package/src/parser/outline.ts

@@ -1,25 +1,12 @@
-import Parser from "web-tree-sitter";
-import { createRequire } from "node:module";
+import { detectStructuredFormat } from "./lang.js";
+import type { SupportedStructuredFormat } from "./lang.js";
 import { OutlineEntry, JumpEntry } from "./types.js";
 import type { OutlineResult } from "./types.js";
+import { parseStructuredTree } from "./runtime.js";
+import { extractMarkdownOutline } from "./markdown.js";
 
 const MAX_SIGNATURE_LENGTH = 199;
 
-// ---------------------------------------------------------------------------
-// WASM initialisation (top-level await — ESM only)
-// ---------------------------------------------------------------------------
-
-const esmRequire = createRequire(import.meta.url);
-
-await Parser.init();
-
-const tsLang = await Parser.Language.load(
-  esmRequire.resolve("tree-sitter-wasms/out/tree-sitter-typescript.wasm"),
-);
-const jsLang = await Parser.Language.load(
-  esmRequire.resolve("tree-sitter-wasms/out/tree-sitter-javascript.wasm"),
-);
-
 // ---------------------------------------------------------------------------
 // Signature helpers
 // ---------------------------------------------------------------------------
@@ -42,16 +29,7 @@ function boundSignature(raw: string): string {
 // Tree-sitter node interface (avoids importing the Node class directly)
 // ---------------------------------------------------------------------------
 
-interface TSNode {
-  readonly type: string;
-  readonly text: string;
-  readonly startPosition: { readonly row: number; readonly column: number };
-  readonly endPosition: { readonly row: number; readonly column: number };
-  readonly children: TSNode[];
-  readonly namedChildren: TSNode[];
-  readonly hasError: boolean;
-  childForFieldName(name: string): TSNode | null;
-}
+type TSNode = import("web-tree-sitter").SyntaxNode;
 
 // ---------------------------------------------------------------------------
 // Node kind mapping
@@ -80,7 +58,7 @@ function nodeKind(nodeType: string): EntryKind | undefined {
 }
 
 // ---------------------------------------------------------------------------
-// Extraction helpers
+// Tree-sitter extraction helpers
 // ---------------------------------------------------------------------------
 
 function extractFunctionSignature(node: TSNode): string | undefined {
@@ -218,22 +196,22 @@ function buildJumpEntry(
  * Extract a structural outline from source code.
  *
  * @param source - The source code text.
- * @param lang - Language identifier: `"ts"` or `"js"`. Defaults to `"ts"`.
+ * @param lang - Structured format identifier. Defaults to `"ts"`.
  * @returns An {@link OutlineResult} with entries, jump table, and partial flag.
  */
 export function extractOutline(
   source: string,
-  lang: "ts" | "js" = "ts",
+  lang: SupportedStructuredFormat = "ts",
 ): OutlineResult {
-  const parser = new Parser();
-  parser.setLanguage(lang === "ts" ? tsLang : jsLang);
-
-  const tree = parser.parse(source);
-  const root = tree.rootNode as unknown as TSNode;
+  if (lang === "md") {
+    return extractMarkdownOutline(source);
+  }
+  const parsed = parseStructuredTree(lang, source);
+  const root = parsed.root;
 
   const entries: OutlineEntry[] = [];
   const jumpTable: JumpEntry[] = [];
-  const hasError = root.hasError;
+  const hasError = root.hasError();
 
   for (const child of root.children) {
     if (child.type === "export_statement") {
@@ -311,8 +289,7 @@ export function extractOutline(
     }
   }
 
-  parser.delete();
-  tree.delete();
+  parsed.delete();
 
   const result: OutlineResult = {
     entries,
@@ -325,3 +302,15 @@ export function extractOutline(
 
   return result;
 }
+
+export function extractOutlineForFile(
+  filePath: string,
+  source: string,
+): OutlineResult | null {
+  const lang = detectStructuredFormat(filePath);
+  if (lang === null) {
+    return null;
+  }
+
+  return extractOutline(source, lang);
+}

package/src/parser/runtime.ts

@@ -0,0 +1,71 @@
+import Parser from "web-tree-sitter";
+import { createRequire } from "node:module";
+import { detectLang } from "./lang.js";
+import type { SupportedLang } from "./lang.js";
+
+const esmRequire = createRequire(import.meta.url);
+
+await Parser.init();
+
+const tsLang = await Parser.Language.load(
+  esmRequire.resolve("tree-sitter-wasms/out/tree-sitter-typescript.wasm"),
+);
+const tsxLang = await Parser.Language.load(
+  esmRequire.resolve("tree-sitter-wasms/out/tree-sitter-tsx.wasm"),
+);
+const jsLang = await Parser.Language.load(
+  esmRequire.resolve("tree-sitter-wasms/out/tree-sitter-javascript.wasm"),
+);
+
+function languageFor(format: SupportedLang): Parser.Language {
+  switch (format) {
+    case "ts":
+      return tsLang;
+    case "tsx":
+      return tsxLang;
+    case "js":
+      return jsLang;
+  }
+}
+
+export interface ParsedTree {
+  readonly format: SupportedLang;
+  readonly parser: Parser;
+  readonly tree: Parser.Tree;
+  readonly root: Parser.SyntaxNode;
+  readonly source: string;
+  delete(): void;
+}
+
+export function parseStructuredTree(
+  format: SupportedLang,
+  source: string,
+): ParsedTree {
+  const parser = new Parser();
+  parser.setLanguage(languageFor(format));
+  const tree = parser.parse(source);
+  const root = tree.rootNode;
+
+  return {
+    format,
+    parser,
+    tree,
+    root,
+    source,
+    delete() {
+      tree.delete();
+      parser.delete();
+    },
+  };
+}
+
+export function parseStructuredTreeForFile(
+  filePath: string,
+  source: string,
+): ParsedTree | null {
+  const format = detectLang(filePath);
+  if (format === null) {
+    return null;
+  }
+  return parseStructuredTree(format, source);
+}

package/src/parser/types.ts

@@ -1,5 +1,13 @@
 /** The kind of a top-level or member declaration. */
-export type EntryKind = "function" | "class" | "method" | "interface" | "type" | "enum" | "export";
+export type EntryKind =
+  | "function"
+  | "class"
+  | "method"
+  | "interface"
+  | "type"
+  | "enum"
+  | "export"
+  | "heading";
 
 /** A single entry in a file outline. */
 export class OutlineEntry {

package/src/policy/evaluate.ts

@@ -1,5 +1,5 @@
 import picomatch from "picomatch";
-import type { PolicyInput, PolicyOptions, ReasonCode, SessionDepth } from "./types.js";
+import type { PolicyInput, PolicyOptions, ReasonCode, GovernorDepth } from "./types.js";
 import { ContentResult, OutlineResult, RefusedResult } from "./types.js";
 import type { PolicyResult } from "./types.js";
 
@@ -97,7 +97,7 @@ export function evaluatePolicy(input: PolicyInput, options?: PolicyOptions): Pol
   const { path, lines, bytes } = input;
   const actual = { lines, bytes };
   const thresholds = { ...STATIC_THRESHOLDS };
-  const sessionDepth: SessionDepth | undefined = options?.sessionDepth;
+  const sessionDepth: GovernorDepth | undefined = options?.sessionDepth;
 
   // 1. Bans first
   const ban = checkBan(path);

package/src/policy/types.ts

@@ -8,9 +8,10 @@ export type ReasonCode =
   | "BUILD_OUTPUT"
   | "SECRET"
   | "GRAFTIGNORE"
-  | "BUDGET_CAP";
+  | "BUDGET_CAP"
+  | "UNSUPPORTED_LANGUAGE";
 
-export type SessionDepth = "early" | "mid" | "late" | "unknown";
+export type GovernorDepth = "early" | "mid" | "late" | "unknown";
 
 export interface PolicyInput {
   path: string;
@@ -20,7 +21,7 @@ export interface PolicyInput {
 
 export interface PolicyOptions {
   graftignorePatterns?: string[] | undefined;
-  sessionDepth?: SessionDepth | undefined;
+  sessionDepth?: GovernorDepth | undefined;
   budgetRemaining?: number | undefined;
 }
 
@@ -28,7 +29,7 @@ export interface PolicyOptions {
 interface PolicyResultBase {
   readonly thresholds: { readonly lines: number; readonly bytes: number };
   readonly actual: { readonly lines: number; readonly bytes: number };
-  readonly sessionDepth?: SessionDepth | undefined;
+  readonly sessionDepth?: GovernorDepth | undefined;
 }
 
 export class ContentResult implements PolicyResultBase {
@@ -36,9 +37,9 @@ export class ContentResult implements PolicyResultBase {
   readonly reason = "CONTENT" as const;
   readonly thresholds: { readonly lines: number; readonly bytes: number };
   readonly actual: { readonly lines: number; readonly bytes: number };
-  readonly sessionDepth?: SessionDepth | undefined;
+  readonly sessionDepth?: GovernorDepth | undefined;
 
-  constructor(opts: { thresholds: { lines: number; bytes: number }; actual: { lines: number; bytes: number }; sessionDepth?: SessionDepth | undefined }) {
+  constructor(opts: { thresholds: { lines: number; bytes: number }; actual: { lines: number; bytes: number }; sessionDepth?: GovernorDepth | undefined }) {
     this.thresholds = Object.freeze({ ...opts.thresholds });
     this.actual = Object.freeze({ ...opts.actual });
     if (opts.sessionDepth !== undefined) this.sessionDepth = opts.sessionDepth;
@@ -48,12 +49,12 @@ export class ContentResult implements PolicyResultBase {
 
 export class OutlineResult implements PolicyResultBase {
   readonly projection = "outline" as const;
-  readonly reason: "OUTLINE" | "SESSION_CAP" | "BUDGET_CAP";
+  readonly reason: "OUTLINE" | "SESSION_CAP" | "BUDGET_CAP" | "UNSUPPORTED_LANGUAGE";
   readonly thresholds: { readonly lines: number; readonly bytes: number };
   readonly actual: { readonly lines: number; readonly bytes: number };
-  readonly sessionDepth?: SessionDepth | undefined;
+  readonly sessionDepth?: GovernorDepth | undefined;
 
-  constructor(opts: { reason: "OUTLINE" | "SESSION_CAP" | "BUDGET_CAP"; thresholds: { lines: number; bytes: number }; actual: { lines: number; bytes: number }; sessionDepth?: SessionDepth | undefined }) {
+  constructor(opts: { reason: "OUTLINE" | "SESSION_CAP" | "BUDGET_CAP" | "UNSUPPORTED_LANGUAGE"; thresholds: { lines: number; bytes: number }; actual: { lines: number; bytes: number }; sessionDepth?: GovernorDepth | undefined }) {
     this.reason = opts.reason;
     this.thresholds = Object.freeze({ ...opts.thresholds });
     this.actual = Object.freeze({ ...opts.actual });
@@ -69,9 +70,9 @@ export class RefusedResult implements PolicyResultBase {
   readonly next: readonly string[];
   readonly thresholds: { readonly lines: number; readonly bytes: number };
   readonly actual: { readonly lines: number; readonly bytes: number };
-  readonly sessionDepth?: SessionDepth | undefined;
+  readonly sessionDepth?: GovernorDepth | undefined;
 
-  constructor(opts: { reason: ReasonCode; reasonDetail: string; next: string[]; thresholds: { lines: number; bytes: number }; actual: { lines: number; bytes: number }; sessionDepth?: SessionDepth | undefined }) {
+  constructor(opts: { reason: ReasonCode; reasonDetail: string; next: string[]; thresholds: { lines: number; bytes: number }; actual: { lines: number; bytes: number }; sessionDepth?: GovernorDepth | undefined }) {
     this.reason = opts.reason;
     this.reasonDetail = opts.reasonDetail;
     this.next = Object.freeze([...opts.next]);

package/src/ports/filesystem.ts

@@ -9,6 +9,7 @@
 export interface FileSystem {
   readFile(path: string, encoding: "utf-8"): Promise<string>;
   readFile(path: string): Promise<Buffer>;
+  readdir(path: string): Promise<string[]>;
   writeFile(path: string, data: string, encoding: "utf-8"): Promise<void>;
   appendFile(path: string, data: string, encoding: "utf-8"): Promise<void>;
   mkdir(path: string, options: { recursive: true }): Promise<void>;

package/src/ports/git.ts

@@ -0,0 +1,16 @@
+// ---------------------------------------------------------------------------
+// GitClient port — hexagonal boundary for git command execution
+// ---------------------------------------------------------------------------
+
+import type { ProcessRunResult } from "./process-runner.js";
+
+export interface GitRunRequest {
+  readonly args: readonly string[];
+  readonly cwd: string;
+  readonly timeoutMs?: number;
+  readonly maxBufferBytes?: number;
+}
+
+export interface GitClient {
+  run(request: GitRunRequest): Promise<ProcessRunResult>;
+}

package/src/ports/guards.ts

@@ -0,0 +1,68 @@
+// ---------------------------------------------------------------------------
+// Port runtime guards — construction-time validation for port adapters
+// ---------------------------------------------------------------------------
+
+import type { FileSystem } from "./filesystem.js";
+import type { JsonCodec } from "./codec.js";
+
+const FILESYSTEM_METHODS = [
+  "readFile",
+  "readdir",
+  "writeFile",
+  "appendFile",
+  "mkdir",
+  "stat",
+  "readFileSync",
+] as const;
+
+const CODEC_METHODS = ["encode", "decode"] as const;
+
+function assertMethodsPresent(
+  portName: string,
+  impl: Record<string, unknown>,
+  methods: readonly string[],
+): void {
+  for (const method of methods) {
+    if (typeof impl[method] !== "function") {
+      throw new TypeError(
+        `${portName} adapter missing method: ${method} (got ${typeof impl[method]})`,
+      );
+    }
+  }
+}
+
+/**
+ * Validate that an object satisfies the FileSystem port contract at
+ * runtime. Call this at adapter construction boundaries to catch
+ * broken mocks and incomplete implementations early.
+ */
+export function assertFileSystem(impl: unknown): asserts impl is FileSystem {
+  if (impl === null || typeof impl !== "object") {
+    throw new TypeError(
+      `FileSystem adapter must be an object (got ${impl === null ? "null" : typeof impl})`,
+    );
+  }
+  assertMethodsPresent(
+    "FileSystem",
+    impl as Record<string, unknown>,
+    FILESYSTEM_METHODS,
+  );
+}
+
+/**
+ * Validate that an object satisfies the JsonCodec port contract at
+ * runtime. Call this at adapter construction boundaries to catch
+ * broken mocks and incomplete implementations early.
+ */
+export function assertJsonCodec(impl: unknown): asserts impl is JsonCodec {
+  if (impl === null || typeof impl !== "object") {
+    throw new TypeError(
+      `JsonCodec adapter must be an object (got ${impl === null ? "null" : typeof impl})`,
+    );
+  }
+  assertMethodsPresent(
+    "JsonCodec",
+    impl as Record<string, unknown>,
+    CODEC_METHODS,
+  );
+}

package/src/ports/process-runner.ts

@@ -0,0 +1,22 @@
+// ---------------------------------------------------------------------------
+// ProcessRunner port — hexagonal boundary for command execution
+// ---------------------------------------------------------------------------
+
+export interface ProcessRunRequest {
+  readonly command: string;
+  readonly args: readonly string[];
+  readonly cwd: string;
+  readonly timeoutMs?: number;
+  readonly maxBufferBytes?: number;
+}
+
+export interface ProcessRunResult {
+  readonly status: number | null;
+  readonly stdout: string;
+  readonly stderr: string;
+  readonly error?: Error;
+}
+
+export interface ProcessRunner {
+  run(request: ProcessRunRequest): ProcessRunResult;
+}

package/src/ports/warp.ts

@@ -0,0 +1,55 @@
+// ---------------------------------------------------------------------------
+// WARP port — hexagonal boundary for graph reads and writes
+// ---------------------------------------------------------------------------
+
+export interface WarpObserverLens {
+  readonly match: string | readonly string[];
+  readonly expose?: readonly string[] | undefined;
+  readonly redact?: readonly string[] | undefined;
+}
+
+export interface WarpObserverOptions {
+  readonly source?: {
+    readonly kind: "live";
+    readonly ceiling: number | null;
+  } | undefined;
+}
+
+export interface WarpEdge {
+  readonly from: string;
+  readonly to: string;
+  readonly label: string;
+}
+
+export interface WarpObserver {
+  getNodes(): Promise<string[]>;
+  getNodeProps(nodeId: string): Promise<Record<string, unknown> | null>;
+  getEdges(): Promise<readonly WarpEdge[]>;
+}
+
+export interface WarpPatchBuilder {
+  addNode(id: string): unknown;
+  setProperty(id: string, key: string, value: unknown): unknown;
+  addEdge(from: string, to: string, label: string): unknown;
+  removeNode(id: string): unknown;
+  removeEdge(from: string, to: string, label: string): unknown;
+}
+
+export interface WarpMaterializeReceiptOp {
+  readonly op: string;
+  readonly result: string;
+  readonly target: string;
+}
+
+export interface WarpMaterializeReceipt {
+  readonly lamport: number;
+  readonly ops: readonly WarpMaterializeReceiptOp[];
+}
+
+export interface WarpHandle {
+  hasNode(nodeId: string): Promise<boolean>;
+  observer(lens: WarpObserverLens, options?: WarpObserverOptions): Promise<WarpObserver>;
+  patch(build: (patch: WarpPatchBuilder) => void | Promise<void>): Promise<string>;
+  materialize(): Promise<void>;
+  materializeReceipts(): Promise<readonly WarpMaterializeReceipt[]>;
+}

package/src/release/security-gate.ts

@@ -0,0 +1,102 @@
+import { z } from "zod";
+
+const severitySchema = z.enum([ "info", "low", "moderate", "high", "critical" ]);
+
+const auditReportSchema = z.object({
+  metadata: z.object({
+    vulnerabilities: z.object({
+      info: z.number().int().nonnegative(),
+      low: z.number().int().nonnegative(),
+      moderate: z.number().int().nonnegative(),
+      high: z.number().int().nonnegative(),
+      critical: z.number().int().nonnegative(),
+    }),
+  }),
+  advisories: z.record(z.string(), z.object({
+    id: z.number().int().nonnegative(),
+    module_name: z.string(),
+    severity: severitySchema,
+    title: z.string(),
+    recommendation: z.string(),
+    github_advisory_id: z.string().nullable().optional(),
+    findings: z.array(z.object({
+      version: z.string(),
+      paths: z.array(z.string()),
+    })).optional(),
+  })),
+});
+
+export interface SecurityGateViolation {
+  readonly id: number;
+  readonly moduleName: string;
+  readonly severity: "high" | "critical";
+  readonly title: string;
+  readonly advisoryId: string | null;
+  readonly recommendation: string;
+  readonly paths: readonly string[];
+  readonly versions: readonly string[];
+}
+
+export interface SecurityGateResult {
+  readonly blocking: boolean;
+  readonly counts: {
+    readonly info: number;
+    readonly low: number;
+    readonly moderate: number;
+    readonly high: number;
+    readonly critical: number;
+  };
+  readonly blockingFindings: readonly SecurityGateViolation[];
+}
+
+export function evaluateSecurityGate(report: unknown): SecurityGateResult {
+  const parsed = auditReportSchema.parse(report);
+  const blockingFindings: SecurityGateViolation[] = [];
+
+  for (const advisory of Object.values(parsed.advisories)) {
+    if (advisory.severity !== "high" && advisory.severity !== "critical") {
+      continue;
+    }
+    blockingFindings.push({
+      id: advisory.id,
+      moduleName: advisory.module_name,
+      severity: advisory.severity,
+      title: advisory.title,
+      advisoryId: advisory.github_advisory_id ?? null,
+      recommendation: advisory.recommendation,
+      paths: advisory.findings?.flatMap((finding) => finding.paths) ?? [],
+      versions: advisory.findings?.map((finding) => finding.version) ?? [],
+    });
+  }
+
+  return {
+    blocking: blockingFindings.length > 0,
+    counts: parsed.metadata.vulnerabilities,
+    blockingFindings,
+  };
+}
+
+export function formatSecurityGateResult(result: SecurityGateResult): string {
+  const lines = [
+    `audit summary: critical=${String(result.counts.critical)} high=${String(result.counts.high)} moderate=${String(result.counts.moderate)} low=${String(result.counts.low)} info=${String(result.counts.info)}`,
+  ];
+
+  if (!result.blocking) {
+    lines.push("release security gate: pass");
+    return lines.join("\n");
+  }
+
+  lines.push("release security gate: fail");
+  for (const finding of result.blockingFindings) {
+    const advisoryId = finding.advisoryId ?? `npm:${String(finding.id)}`;
+    const paths = finding.paths.length > 0 ? finding.paths.join(", ") : "unknown path";
+    const versions = finding.versions.length > 0 ? finding.versions.join(", ") : "unknown version";
+    lines.push(
+      `- ${finding.severity.toUpperCase()} ${advisoryId} ${finding.moduleName}@${versions} via ${paths}`,
+    );
+    lines.push(`  ${finding.title}`);
+    lines.push(`  ${finding.recommendation}`);
+  }
+
+  return lines.join("\n");
+}

package/src/session/tracker.ts

@@ -1,11 +1,20 @@
 import { Tripwire } from "./types.js";
-import type { SessionDepth } from "./types.js";
+import type { GovernorDepth } from "./types.js";
 
 const EDIT_BASH_TOOLS = new Set(["Edit", "Bash"]);
 const LATE_READ_BYTE_THRESHOLD = 20480;
 const LATE_READ_MESSAGE_THRESHOLD = 300;
 
-export class SessionTracker {
+export interface GovernorTrackerSnapshot {
+  readonly totalMessages: number;
+  readonly toolCallsSinceUser: number;
+  readonly editBashTransitions: number;
+  readonly lastEditBashTool: string | null;
+  readonly budgetBytes: number | null;
+  readonly consumedBytes: number;
+}
+
+export class GovernorTracker {
   private totalMessages = 0;
   private toolCallsSinceUser = 0;
   private editBashTransitions = 0;
@@ -13,6 +22,17 @@ export class SessionTracker {
   private budgetBytes: number | null = null;
   private consumedBytes = 0;
 
+  static fromSnapshot(snapshot: GovernorTrackerSnapshot): GovernorTracker {
+    const tracker = new GovernorTracker();
+    tracker.totalMessages = snapshot.totalMessages;
+    tracker.toolCallsSinceUser = snapshot.toolCallsSinceUser;
+    tracker.editBashTransitions = snapshot.editBashTransitions;
+    tracker.lastEditBashTool = snapshot.lastEditBashTool;
+    tracker.budgetBytes = snapshot.budgetBytes;
+    tracker.consumedBytes = snapshot.consumedBytes;
+    return tracker;
+  }
+
   getMessageCount(): number {
     return this.totalMessages;
   }
@@ -102,7 +122,18 @@ export class SessionTracker {
     };
   }
 
-  getSessionDepth(): SessionDepth {
+  snapshot(): GovernorTrackerSnapshot {
+    return {
+      totalMessages: this.totalMessages,
+      toolCallsSinceUser: this.toolCallsSinceUser,
+      editBashTransitions: this.editBashTransitions,
+      lastEditBashTool: this.lastEditBashTool,
+      budgetBytes: this.budgetBytes,
+      consumedBytes: this.consumedBytes,
+    };
+  }
+
+  getGovernorDepth(): GovernorDepth {
     if (this.totalMessages < 100) {
       return "early";
     }

package/src/session/types.ts

@@ -17,4 +17,7 @@ export class Tripwire {
   }
 }
 
-export type SessionDepth = "early" | "mid" | "late";
+export type GovernorDepth = "early" | "mid" | "late";
+
+/** @deprecated Use {@link GovernorDepth}. Kept as a wire-format alias. */
+export type SessionDepth = GovernorDepth;

package/src/version.ts

@@ -0,0 +1,3 @@
+import packageJson from "../package.json";
+
+export const GRAFT_VERSION = packageJson.version;

package/src/warp/identity-resolver.ts

@@ -0,0 +1,35 @@
+/**
+ * WARP Identity Resolver — creates an IdentityResolver backed by
+ * the WARP graph. Reads symbol identityId properties through the
+ * observer lens system.
+ */
+
+import type { WarpHandle } from "../ports/warp.js";
+import type { IdentityResolver } from "../operations/diff-identity.js";
+import { fileSymbolsLens, observe } from "./observers.js";
+
+/**
+ * Create an IdentityResolver that queries WARP for canonical symbol
+ * identities. Each call reads the current frontier snapshot — the
+ * resolver is stateless between calls.
+ */
+export function createWarpIdentityResolver(warp: WarpHandle): IdentityResolver {
+  return async (filePath: string) => {
+    const lens = fileSymbolsLens(filePath);
+    const obs = await observe(warp, lens);
+    const nodes = await obs.getNodes();
+    const identities = new Map<string, string>();
+
+    for (const nodeId of nodes) {
+      const props = await obs.getNodeProps(nodeId);
+      if (props === null) continue;
+      const name = props["name"];
+      const identityId = props["identityId"];
+      if (typeof name === "string" && typeof identityId === "string") {
+        identities.set(name, identityId);
+      }
+    }
+
+    return identities;
+  };
+}