@shipfox/api-definitions 2.0.0

package/src/core/workflow-model/normalize-agent-integrations.ts

@@ -0,0 +1,208 @@
+import type {AgentToolSelector} from '@shipfox/api-integration-core-dto';
+import type {WorkflowDocumentStepIntegration} from '@shipfox/workflow-document';
+import type {IntegrationValidationContext} from '../entities/integration-context.js';
+import type {WorkflowModelStepIntegration} from '../entities/workflow-model.js';
+import type {WorkflowModelValidationIssue} from './invalid-workflow-model-error.js';
+import {issue} from './validation-issue.js';
+
+export function normalizeAgentIntegrations(params: {
+  integrations: readonly WorkflowDocumentStepIntegration[] | undefined;
+  sourceName: string;
+  stepIndex: number;
+  issues: WorkflowModelValidationIssue[];
+  integrationValidationContext?: IntegrationValidationContext | undefined;
+}): readonly WorkflowModelStepIntegration[] | undefined {
+  if (params.integrations === undefined) return undefined;
+
+  return params.integrations.map((integration, integrationIndex) => {
+    const normalized = normalizeIntegration(integration);
+    validateIntegration({...params, integration, normalized, integrationIndex});
+    return normalized;
+  });
+}
+
+function normalizeIntegration(
+  integration: WorkflowDocumentStepIntegration,
+): WorkflowModelStepIntegration {
+  return {
+    ...(integration.connection === undefined ? {} : {connection: integration.connection}),
+    include: dedupe(integration.include),
+    ...(integration.exclude === undefined ? {} : {exclude: dedupe(integration.exclude)}),
+    allowWrite: integration.allow_write ?? false,
+  };
+}
+
+function validateIntegration(params: {
+  integration: WorkflowDocumentStepIntegration;
+  normalized: WorkflowModelStepIntegration;
+  sourceName: string;
+  stepIndex: number;
+  integrationIndex: number;
+  issues: WorkflowModelValidationIssue[];
+  integrationValidationContext?: IntegrationValidationContext | undefined;
+}): void {
+  const context = params.integrationValidationContext;
+  if (context === undefined) return;
+
+  const connectionSlug = params.normalized.connection ?? context.defaultConnectionSlug;
+  if (connectionSlug === undefined) {
+    params.issues.push(
+      issue({
+        code: 'missing-connection-for-integration',
+        message: 'Agent step integration requires a connection or a default source connection.',
+        path: integrationPath(params),
+        details: {integrationIndex: params.integrationIndex},
+      }),
+    );
+    return;
+  }
+
+  const connection = context.workspaceConnectionSnapshot.get(connectionSlug);
+  if (connection === undefined) {
+    params.issues.push(
+      issue({
+        code: 'integration-connection-not-found',
+        message: `Integration connection "${connectionSlug}" was not found in the workspace.`,
+        path: integrationConnectionPath(params),
+        details: {
+          connection: connectionSlug,
+          integrationIndex: params.integrationIndex,
+        },
+      }),
+    );
+    return;
+  }
+
+  const catalog = context.agentToolSelectionCatalogs.get(connection.provider);
+  if (catalog === undefined || !connection.capabilities.includes('agent_tools')) {
+    params.issues.push(
+      issue({
+        code: 'integration-connection-not-capable',
+        message: `Integration connection "${connectionSlug}" does not support agent tools.`,
+        path: integrationConnectionPath(params),
+        details: {
+          connection: connectionSlug,
+          provider: connection.provider,
+          capabilities: connection.capabilities,
+          integrationIndex: params.integrationIndex,
+        },
+      }),
+    );
+    return;
+  }
+
+  const selectorsByToken = new Map(catalog.selectors.map((selector) => [selector.token, selector]));
+  validateSelection({
+    ...params,
+    field: 'include',
+    tokens: params.integration.include,
+    selectorsByToken,
+  });
+  if (params.integration.exclude !== undefined) {
+    validateSelection({
+      ...params,
+      field: 'exclude',
+      tokens: params.integration.exclude,
+      selectorsByToken,
+    });
+  }
+  validateWriteSelection({...params, selectorsByToken});
+}
+
+function validateSelection(params: {
+  field: 'include' | 'exclude';
+  tokens: readonly string[];
+  selectorsByToken: ReadonlyMap<string, AgentToolSelector>;
+  sourceName: string;
+  stepIndex: number;
+  integrationIndex: number;
+  issues: WorkflowModelValidationIssue[];
+}): void {
+  params.tokens.forEach((token, tokenIndex) => {
+    if (params.selectorsByToken.has(token)) return;
+
+    const code = classifyUnknownSelection(token, params.selectorsByToken);
+    params.issues.push(
+      issue({
+        code,
+        message:
+          code === 'unknown-integration-method'
+            ? `Unknown integration tool method: ${token}.`
+            : `Unknown integration tool: ${token}.`,
+        path: [...integrationPath(params), params.field, tokenIndex],
+        details: {token},
+      }),
+    );
+  });
+}
+
+function validateWriteSelection(params: {
+  integration: WorkflowDocumentStepIntegration;
+  normalized: WorkflowModelStepIntegration;
+  selectorsByToken: ReadonlyMap<string, AgentToolSelector>;
+  sourceName: string;
+  stepIndex: number;
+  integrationIndex: number;
+  issues: WorkflowModelValidationIssue[];
+}): void {
+  if (params.normalized.allowWrite) return;
+
+  const writeTokens = dedupe(
+    params.integration.include.filter(
+      (token) => params.selectorsByToken.get(token)?.sensitivity === 'write',
+    ),
+  );
+  if (writeTokens.length === 0) return;
+
+  params.issues.push(
+    issue({
+      code: 'integration-write-not-allowed',
+      message: `Integration selection includes write-capable tools but allow_write is not true: ${writeTokens.join(', ')}.`,
+      path: [...integrationPath(params), 'include'],
+      details: {tokens: writeTokens},
+    }),
+  );
+}
+
+function classifyUnknownSelection(
+  token: string,
+  selectorsByToken: ReadonlyMap<string, AgentToolSelector>,
+): 'unknown-integration-method' | 'unknown-integration-tool' {
+  const dotIndex = token.indexOf('.');
+  if (dotIndex < 1) return 'unknown-integration-tool';
+
+  const family = token.slice(0, dotIndex);
+  return selectorsByToken.get(family)?.kind === 'family'
+    ? 'unknown-integration-method'
+    : 'unknown-integration-tool';
+}
+
+function integrationConnectionPath(params: {
+  sourceName: string;
+  stepIndex: number;
+  integrationIndex: number;
+  integration: WorkflowDocumentStepIntegration;
+}): readonly (string | number)[] {
+  const path = integrationPath(params);
+  if (params.integration.connection === undefined) return path;
+  return [...path, 'connection'];
+}
+
+function integrationPath(params: {
+  sourceName: string;
+  stepIndex: number;
+  integrationIndex: number;
+}): readonly (string | number)[] {
+  return [
+    'jobs',
+    params.sourceName,
+    'steps',
+    params.stepIndex,
+    'integrations',
+    params.integrationIndex,
+  ];
+}
+
+function dedupe(values: readonly string[]): readonly string[] {
+  return [...new Set(values)];
+}

package/src/core/workflow-model/normalize-dependencies.ts

@@ -0,0 +1,139 @@
+import type {WorkflowDocumentJob} from '@shipfox/workflow-document';
+import type {WorkflowModelDependency} from '../entities/workflow-model.js';
+import type {WorkflowModelValidationIssue} from './invalid-workflow-model-error.js';
+import {normalizeNeeds} from './normalize-needs.js';
+import {issue} from './validation-issue.js';
+
+export function normalizeDependencies(
+  jobs: Readonly<Record<string, WorkflowDocumentJob>>,
+  jobIdBySourceName: ReadonlyMap<string, string>,
+  issues: WorkflowModelValidationIssue[],
+): readonly WorkflowModelDependency[] {
+  const dependencies: WorkflowModelDependency[] = [];
+
+  for (const [sourceName, job] of Object.entries(jobs)) {
+    const to = jobIdBySourceName.get(sourceName);
+    if (to === undefined) continue;
+
+    for (const dependencySourceName of normalizeNeeds(job.needs)) {
+      if (!jobIdBySourceName.has(dependencySourceName)) {
+        issues.push(
+          issue({
+            code: 'unknown-job-dependency',
+            message: `Job "${sourceName}" depends on unknown job "${dependencySourceName}".`,
+            path: ['jobs', sourceName, 'needs'],
+            details: {job: sourceName, dependency: dependencySourceName},
+          }),
+        );
+        continue;
+      }
+
+      if (dependencySourceName === sourceName) {
+        issues.push(
+          issue({
+            code: 'self-job-dependency',
+            message: `Job "${sourceName}" depends on itself.`,
+            path: ['jobs', sourceName, 'needs'],
+            details: {job: sourceName},
+          }),
+        );
+        continue;
+      }
+
+      dependencies.push({from: jobIdBySourceName.get(dependencySourceName) as string, to});
+    }
+  }
+
+  return dependencies;
+}
+
+export function validateCycles(
+  jobs: Readonly<Record<string, WorkflowDocumentJob>>,
+  jobIdBySourceName: ReadonlyMap<string, string>,
+  issues: WorkflowModelValidationIssue[],
+): void {
+  const jobNames = Object.keys(jobs);
+  const adjacency = new Map<string, string[]>();
+
+  for (const name of jobNames) {
+    adjacency.set(name, []);
+  }
+
+  for (const [name, job] of Object.entries(jobs)) {
+    for (const dependency of normalizeNeeds(job.needs)) {
+      if (!jobIdBySourceName.has(dependency) || dependency === name) continue;
+
+      adjacency.get(dependency)?.push(name);
+    }
+  }
+
+  const cyclicNames = findCyclicSourceNames(jobNames, adjacency);
+  if (cyclicNames.length > 0) {
+    issues.push(
+      issue({
+        code: 'job-dependency-cycle',
+        message: `Circular dependency detected among jobs: ${cyclicNames.join(', ')}.`,
+        path: ['jobs'],
+        details: {
+          cycleSourceNames: cyclicNames,
+          cycleJobIds: cyclicNames.flatMap((name) => {
+            const id = jobIdBySourceName.get(name);
+            return id === undefined ? [] : [id];
+          }),
+        },
+      }),
+    );
+  }
+}
+
+function findCyclicSourceNames(
+  jobNames: readonly string[],
+  adjacency: ReadonlyMap<string, readonly string[]>,
+): readonly string[] {
+  const indexes = new Map<string, number>();
+  const lowLinks = new Map<string, number>();
+  const stack: string[] = [];
+  const onStack = new Set<string>();
+  const cyclicNames = new Set<string>();
+  let index = 0;
+
+  const visit = (node: string) => {
+    indexes.set(node, index);
+    lowLinks.set(node, index);
+    index += 1;
+    stack.push(node);
+    onStack.add(node);
+
+    for (const neighbor of adjacency.get(node) ?? []) {
+      if (!indexes.has(neighbor)) {
+        visit(neighbor);
+        lowLinks.set(
+          node,
+          Math.min(lowLinks.get(node) as number, lowLinks.get(neighbor) as number),
+        );
+      } else if (onStack.has(neighbor)) {
+        lowLinks.set(node, Math.min(lowLinks.get(node) as number, indexes.get(neighbor) as number));
+      }
+    }
+
+    if (lowLinks.get(node) !== indexes.get(node)) return;
+
+    const component: string[] = [];
+    while (stack.length > 0) {
+      const member = stack.pop() as string;
+      onStack.delete(member);
+      component.push(member);
+      if (member === node) break;
+    }
+
+    if (component.length > 1) {
+      for (const member of component) cyclicNames.add(member);
+    }
+  };
+
+  for (const name of jobNames) {
+    if (!indexes.has(name)) visit(name);
+  }
+
+  return jobNames.filter((name) => cyclicNames.has(name));
+}

package/src/core/workflow-model/normalize-env.ts

@@ -0,0 +1,48 @@
+import type {AvailabilitySite, ExpressionTypeEnvironment} from '@shipfox/expression';
+import type {WorkflowEnvTemplates, WorkflowFieldTemplate} from '../entities/workflow-model.js';
+import type {
+  WorkflowModelValidationIssue,
+  WorkflowModelValidationIssuePathSegment,
+} from './invalid-workflow-model-error.js';
+import {parseInterpolationField} from './parse-interpolation-field.js';
+
+export function normalizeEnv(params: {
+  env: Readonly<Record<string, string | number | boolean>> | undefined;
+  path: readonly WorkflowModelValidationIssuePathSegment[];
+  issues: WorkflowModelValidationIssue[];
+  fillSite?: AvailabilitySite;
+  allowedJobReferences?: ReadonlySet<string>;
+  typeOverlay?: ExpressionTypeEnvironment | undefined;
+}): {env?: Readonly<Record<string, string>>; templates?: {env: WorkflowEnvTemplates}} {
+  const env = params.env;
+  if (env === undefined || Object.keys(env).length === 0) return {};
+
+  const normalizedEnv: Record<string, string> = Object.create(null) as Record<string, string>;
+  const templates: Record<string, WorkflowFieldTemplate> = Object.create(null) as Record<
+    string,
+    WorkflowFieldTemplate
+  >;
+
+  for (const [key, value] of Object.entries(env)) {
+    normalizedEnv[key] = String(value);
+    if (typeof value !== 'string') continue;
+
+    const template = parseInterpolationField({
+      field: 'env.value',
+      source: value,
+      path: [...params.path, key],
+      issues: params.issues,
+      ...(params.fillSite === undefined ? {} : {fillSite: params.fillSite}),
+      ...(params.allowedJobReferences === undefined
+        ? {}
+        : {allowedJobReferences: params.allowedJobReferences}),
+      ...(params.typeOverlay === undefined ? {} : {typeOverlay: params.typeOverlay}),
+    });
+    if (template !== undefined) templates[key] = template;
+  }
+
+  return {
+    env: normalizedEnv,
+    ...(Object.keys(templates).length === 0 ? {} : {templates: {env: templates}}),
+  };
+}

package/src/core/workflow-model/normalize-if-condition.ts

@@ -0,0 +1,126 @@
+import {
+  type ExpressionTypeEnvironment,
+  extractExactContextRoots,
+  InvalidWorkflowTemplateError,
+  parseWorkflowTemplate,
+  type WorkflowExpression,
+  type WorkflowPredicateField,
+  type WorkflowTemplateExprSegment,
+} from '@shipfox/expression';
+import type {
+  WorkflowModelValidationIssue,
+  WorkflowModelValidationIssueCode,
+  WorkflowModelValidationIssuePathSegment,
+} from './invalid-workflow-model-error.js';
+import {validatePredicateExpression} from './validate-predicate-expression.js';
+import {issue} from './validation-issue.js';
+import {workflowFieldLabel} from './workflow-field-label.js';
+
+const ifExpressionSyntax = `\${{ }}`;
+
+export function normalizeIfCondition(params: {
+  readonly field: Extract<WorkflowPredicateField, 'job.if' | 'step.if'>;
+  readonly source: string | undefined;
+  readonly site: 'job-activation' | 'step-dispatch';
+  readonly path: readonly WorkflowModelValidationIssuePathSegment[];
+  readonly invalidCode: Extract<
+    WorkflowModelValidationIssueCode,
+    'invalid-job-if' | 'invalid-step-if'
+  >;
+  readonly invalidMessage: string;
+  readonly issues: WorkflowModelValidationIssue[];
+  readonly allowedJobReferences: ReadonlySet<string>;
+  readonly typeOverlay: ExpressionTypeEnvironment;
+}): WorkflowExpression | undefined {
+  if (params.source === undefined) return undefined;
+  const source = params.source;
+
+  const expressionSegment = parseSingleExpression({...params, source});
+  if (expressionSegment === undefined) return undefined;
+
+  const roots = extractExactContextRoots(expressionSegment.expression.source);
+  if (roots.includes('needs') && params.allowedJobReferences.size === 0) {
+    params.issues.push(
+      issue({
+        code: params.invalidCode,
+        message: `${workflowFieldLabel(params.field)} cannot reference needs because the job has no direct needs.`,
+        path: params.path,
+        details: {
+          field: params.field,
+          source: params.source,
+          contextRoots: roots,
+          rejectedRoots: ['needs'],
+        },
+      }),
+    );
+    return undefined;
+  }
+
+  return validatePredicateExpression({
+    field: params.field,
+    source: expressionSegment.expression.source,
+    site: params.site,
+    path: params.path,
+    invalidCode: params.invalidCode,
+    invalidMessage: params.invalidMessage,
+    issues: params.issues,
+    allowedJobReferences: params.allowedJobReferences,
+    typeOverlay: params.typeOverlay,
+  });
+}
+
+function parseSingleExpression(params: {
+  readonly field: WorkflowPredicateField;
+  readonly source: string;
+  readonly path: readonly WorkflowModelValidationIssuePathSegment[];
+  readonly invalidCode: WorkflowModelValidationIssueCode;
+  readonly invalidMessage: string;
+  readonly issues: WorkflowModelValidationIssue[];
+}): WorkflowTemplateExprSegment | undefined {
+  let segments: ReturnType<typeof parseWorkflowTemplate>;
+  try {
+    segments = parseWorkflowTemplate(params.source);
+  } catch (error) {
+    params.issues.push(
+      invalidIfIssue({
+        ...params,
+        reason:
+          error instanceof InvalidWorkflowTemplateError
+            ? error.reason
+            : 'Template source did not parse.',
+      }),
+    );
+    return undefined;
+  }
+
+  const [segment] = segments;
+  if (segment?.kind === 'expr' && segments.length === 1) return segment;
+
+  params.issues.push(
+    invalidIfIssue({
+      ...params,
+      reason: `${workflowFieldLabel(params.field)} must be exactly one ${ifExpressionSyntax} expression.`,
+    }),
+  );
+  return undefined;
+}
+
+function invalidIfIssue(params: {
+  readonly field: WorkflowPredicateField;
+  readonly source: string;
+  readonly path: readonly WorkflowModelValidationIssuePathSegment[];
+  readonly invalidCode: WorkflowModelValidationIssueCode;
+  readonly invalidMessage: string;
+  readonly reason: string;
+}): WorkflowModelValidationIssue {
+  return issue({
+    code: params.invalidCode,
+    message: params.invalidMessage,
+    path: params.path,
+    details: {
+      field: params.field,
+      source: params.source,
+      reason: params.reason,
+    },
+  });
+}

package/src/core/workflow-model/normalize-job-checkout.ts

@@ -0,0 +1,19 @@
+import type {WorkflowDocumentJobCheckout} from '@shipfox/workflow-document';
+import type {WorkflowModelJobCheckout} from '../entities/workflow-model.js';
+
+export const DEFAULT_JOB_CHECKOUT: WorkflowModelJobCheckout = {
+  permissions: {contents: 'read'},
+  persistCredentials: true,
+};
+
+export function normalizeJobCheckout(
+  checkout: WorkflowDocumentJobCheckout | undefined,
+): WorkflowModelJobCheckout {
+  return {
+    permissions: {
+      contents: checkout?.permissions?.contents ?? DEFAULT_JOB_CHECKOUT.permissions.contents,
+    },
+    persistCredentials:
+      checkout?.['persist-credentials'] ?? DEFAULT_JOB_CHECKOUT.persistCredentials,
+  };
+}

package/src/core/workflow-model/normalize-job-listening.ts

@@ -0,0 +1,121 @@
+import type {WorkflowDocumentJob} from '@shipfox/workflow-document';
+import type {WorkflowModelJobListening} from '../entities/workflow-model.js';
+import {DEFAULT_RUN_TIMEOUT_MS} from './constants.js';
+import type {WorkflowModelValidationIssue} from './invalid-workflow-model-error.js';
+import {normalizeTriggerEntry} from './normalize-triggers.js';
+import {parseDurationMs} from './parse-duration-ms.js';
+import {validatePredicateExpression} from './validate-predicate-expression.js';
+import {issue} from './validation-issue.js';
+
+export function normalizeJobListening(params: {
+  job: WorkflowDocumentJob;
+  sourceName: string;
+  issues: WorkflowModelValidationIssue[];
+  allowedJobReferences: ReadonlySet<string>;
+}): WorkflowModelJobListening | undefined {
+  const path = ['jobs', params.sourceName] as const;
+  const listening = params.job.listening;
+
+  if (listening === undefined) {
+    return undefined;
+  }
+
+  const timeoutMs = parseDurationMs({
+    source: listening.timeout,
+    path: [...path, 'listening', 'timeout'],
+    issues: params.issues,
+    maxMs: DEFAULT_RUN_TIMEOUT_MS,
+    outOfRangeCode: 'listening-timeout-exceeds-run-timeout',
+    outOfRangeMessage: 'Listening job timeout must be between 1s and the workflow run timeout.',
+  });
+  const debounceMs = parseDurationMs({
+    source: listening.batch?.debounce,
+    path: [...path, 'listening', 'batch', 'debounce'],
+    issues: params.issues,
+  });
+  const maxWaitMs = parseDurationMs({
+    source: listening.batch?.max_wait,
+    path: [...path, 'listening', 'batch', 'max_wait'],
+    issues: params.issues,
+  });
+
+  if (
+    listening.until === undefined &&
+    listening.timeout === undefined &&
+    listening.max_executions === undefined
+  ) {
+    params.issues.push(
+      issue({
+        code: 'listening-job-missing-resolution-source',
+        message: `Listening job "${params.sourceName}" must declare until, timeout, or max_executions.`,
+        path: [...path, 'listening'],
+      }),
+    );
+  }
+
+  const batch =
+    debounceMs === undefined && listening.batch?.max_size === undefined && maxWaitMs === undefined
+      ? undefined
+      : {
+          ...(debounceMs === undefined ? {} : {debounceMs}),
+          ...(listening.batch?.max_size === undefined ? {} : {maxSize: listening.batch.max_size}),
+          ...(maxWaitMs === undefined ? {} : {maxWaitMs}),
+        };
+
+  return {
+    on: listening.on.map((trigger, index) =>
+      normalizeListeningTrigger({
+        trigger,
+        field: 'listener.on',
+        path: [...path, 'listening', 'on', index, 'filter'],
+        issues: params.issues,
+        allowedJobReferences: params.allowedJobReferences,
+      }),
+    ),
+    ...(listening.until === undefined
+      ? {}
+      : {
+          until: listening.until.map((trigger, index) =>
+            normalizeListeningTrigger({
+              trigger,
+              field: 'listener.until',
+              path: [...path, 'listening', 'until', index, 'filter'],
+              issues: params.issues,
+              allowedJobReferences: params.allowedJobReferences,
+            }),
+          ),
+        }),
+    ...(timeoutMs === undefined ? {} : {timeoutMs}),
+    ...(listening.max_executions === undefined ? {} : {maxExecutions: listening.max_executions}),
+    ...(batch === undefined ? {} : {batch}),
+    onResolve: listening.on_resolve ?? 'finish',
+  };
+}
+
+function normalizeListeningTrigger(params: {
+  trigger: {
+    readonly source: string;
+    readonly event: string;
+    readonly with?: Readonly<Record<string, unknown>> | undefined;
+    readonly filter?: string | undefined;
+  };
+  field: 'listener.on' | 'listener.until';
+  path: readonly (string | number)[];
+  issues: WorkflowModelValidationIssue[];
+  allowedJobReferences: ReadonlySet<string>;
+}): WorkflowModelJobListening['on'][number] {
+  if (params.trigger.filter !== undefined) {
+    validatePredicateExpression({
+      field: params.field,
+      source: params.trigger.filter,
+      site: 'job-activation',
+      path: params.path,
+      invalidCode: 'invalid-listener-filter',
+      invalidMessage: `${params.field === 'listener.on' ? 'Listener on' : 'Listener until'} filter must be a valid CEL boolean expression.`,
+      issues: params.issues,
+      allowedJobReferences: params.allowedJobReferences,
+    });
+  }
+
+  return normalizeTriggerEntry(params.trigger);
+}

package/src/core/workflow-model/normalize-job-success.ts

@@ -0,0 +1,28 @@
+import type {ExpressionTypeEnvironment} from '@shipfox/expression';
+import type {WorkflowModelValidationIssue} from './invalid-workflow-model-error.js';
+import {validatePredicateExpression} from './validate-predicate-expression.js';
+
+export const DEFAULT_JOB_SUCCESS = "!executions.exists(e, e.status == 'failed')";
+
+export function normalizeJobSuccess(params: {
+  source: string | undefined;
+  sourceName: string;
+  issues: WorkflowModelValidationIssue[];
+  allowedJobReferences: ReadonlySet<string>;
+  typeOverlay?: ExpressionTypeEnvironment | undefined;
+}): string | undefined {
+  if (params.source === undefined) return undefined;
+
+  const expression = validatePredicateExpression({
+    field: 'job.success',
+    source: params.source,
+    site: 'job-resolution',
+    path: ['jobs', params.sourceName, 'success'],
+    invalidCode: 'invalid-job-success',
+    invalidMessage: 'Job success must be a valid CEL boolean expression.',
+    issues: params.issues,
+    allowedJobReferences: params.allowedJobReferences,
+    typeOverlay: params.typeOverlay,
+  });
+  return expression?.source;
+}