@shipfox/api-definitions 2.0.0

package/dist/core/workflow-model/parse-duration-ms.js

@@ -0,0 +1,47 @@
+import { issue } from './validation-issue.js';
+const UNIT_MS = {
+    ms: 1,
+    s: 1000,
+    m: 60 * 1000,
+    h: 60 * 60 * 1000,
+    d: 24 * 60 * 60 * 1000
+};
+const MIN_DURATION_MS = 1000;
+const MAX_DURATION_MS = 24 * 60 * 60 * 1000;
+const DURATION_PATTERN = /^(\d+)(ms|s|m|h|d)$/;
+export function parseDurationMs(params) {
+    if (params.source === undefined) return undefined;
+    const match = DURATION_PATTERN.exec(params.source.trim());
+    if (!match) {
+        params.issues.push(issue({
+            code: 'invalid-duration',
+            message: 'Duration must be an integer followed by ms, s, m, h, or d.',
+            path: params.path,
+            details: {
+                source: params.source
+            }
+        }));
+        return undefined;
+    }
+    const value = Number(match[1]);
+    const unit = match[2];
+    const ms = value * UNIT_MS[unit];
+    const minMs = params.minMs ?? MIN_DURATION_MS;
+    const maxMs = params.maxMs ?? MAX_DURATION_MS;
+    if (!Number.isSafeInteger(ms) || ms < minMs || ms > maxMs) {
+        params.issues.push(issue({
+            code: params.outOfRangeCode ?? 'invalid-duration',
+            message: params.outOfRangeMessage ?? 'Duration must be between 1s and 24h.',
+            path: params.path,
+            details: {
+                source: params.source,
+                min_ms: minMs,
+                max_ms: maxMs
+            }
+        }));
+        return undefined;
+    }
+    return ms;
+}
+
+//# sourceMappingURL=parse-duration-ms.js.map

package/dist/core/workflow-model/parse-duration-ms.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/core/workflow-model/parse-duration-ms.ts"],"sourcesContent":["import type {WorkflowModelValidationIssue} from './invalid-workflow-model-error.js';\nimport {issue} from './validation-issue.js';\n\nconst UNIT_MS = {\n  ms: 1,\n  s: 1000,\n  m: 60 * 1000,\n  h: 60 * 60 * 1000,\n  d: 24 * 60 * 60 * 1000,\n} as const;\n\nconst MIN_DURATION_MS = 1000;\nconst MAX_DURATION_MS = 24 * 60 * 60 * 1000;\nconst DURATION_PATTERN = /^(\\d+)(ms|s|m|h|d)$/;\n\nexport function parseDurationMs(params: {\n  source: string | undefined;\n  path: Array<string | number>;\n  issues: WorkflowModelValidationIssue[];\n  minMs?: number | undefined;\n  maxMs?: number | undefined;\n  outOfRangeCode?: 'invalid-duration' | 'listening-timeout-exceeds-run-timeout' | undefined;\n  outOfRangeMessage?: string | undefined;\n}): number | undefined {\n  if (params.source === undefined) return undefined;\n\n  const match = DURATION_PATTERN.exec(params.source.trim());\n  if (!match) {\n    params.issues.push(\n      issue({\n        code: 'invalid-duration',\n        message: 'Duration must be an integer followed by ms, s, m, h, or d.',\n        path: params.path,\n        details: {source: params.source},\n      }),\n    );\n    return undefined;\n  }\n\n  const value = Number(match[1]);\n  const unit = match[2] as keyof typeof UNIT_MS;\n  const ms = value * UNIT_MS[unit];\n  const minMs = params.minMs ?? MIN_DURATION_MS;\n  const maxMs = params.maxMs ?? MAX_DURATION_MS;\n  if (!Number.isSafeInteger(ms) || ms < minMs || ms > maxMs) {\n    params.issues.push(\n      issue({\n        code: params.outOfRangeCode ?? 'invalid-duration',\n        message: params.outOfRangeMessage ?? 'Duration must be between 1s and 24h.',\n        path: params.path,\n        details: {source: params.source, min_ms: minMs, max_ms: maxMs},\n      }),\n    );\n    return undefined;\n  }\n\n  return ms;\n}\n"],"names":["issue","UNIT_MS","ms","s","m","h","d","MIN_DURATION_MS","MAX_DURATION_MS","DURATION_PATTERN","parseDurationMs","params","source","undefined","match","exec","trim","issues","push","code","message","path","details","value","Number","unit","minMs","maxMs","isSafeInteger","outOfRangeCode","outOfRangeMessage","min_ms","max_ms"],"mappings":"AACA,SAAQA,KAAK,QAAO,wBAAwB;AAE5C,MAAMC,UAAU;IACdC,IAAI;IACJC,GAAG;IACHC,GAAG,KAAK;IACRC,GAAG,KAAK,KAAK;IACbC,GAAG,KAAK,KAAK,KAAK;AACpB;AAEA,MAAMC,kBAAkB;AACxB,MAAMC,kBAAkB,KAAK,KAAK,KAAK;AACvC,MAAMC,mBAAmB;AAEzB,OAAO,SAASC,gBAAgBC,MAQ/B;IACC,IAAIA,OAAOC,MAAM,KAAKC,WAAW,OAAOA;IAExC,MAAMC,QAAQL,iBAAiBM,IAAI,CAACJ,OAAOC,MAAM,CAACI,IAAI;IACtD,IAAI,CAACF,OAAO;QACVH,OAAOM,MAAM,CAACC,IAAI,CAChBlB,MAAM;YACJmB,MAAM;YACNC,SAAS;YACTC,MAAMV,OAAOU,IAAI;YACjBC,SAAS;gBAACV,QAAQD,OAAOC,MAAM;YAAA;QACjC;QAEF,OAAOC;IACT;IAEA,MAAMU,QAAQC,OAAOV,KAAK,CAAC,EAAE;IAC7B,MAAMW,OAAOX,KAAK,CAAC,EAAE;IACrB,MAAMZ,KAAKqB,QAAQtB,OAAO,CAACwB,KAAK;IAChC,MAAMC,QAAQf,OAAOe,KAAK,IAAInB;IAC9B,MAAMoB,QAAQhB,OAAOgB,KAAK,IAAInB;IAC9B,IAAI,CAACgB,OAAOI,aAAa,CAAC1B,OAAOA,KAAKwB,SAASxB,KAAKyB,OAAO;QACzDhB,OAAOM,MAAM,CAACC,IAAI,CAChBlB,MAAM;YACJmB,MAAMR,OAAOkB,cAAc,IAAI;YAC/BT,SAAST,OAAOmB,iBAAiB,IAAI;YACrCT,MAAMV,OAAOU,IAAI;YACjBC,SAAS;gBAACV,QAAQD,OAAOC,MAAM;gBAAEmB,QAAQL;gBAAOM,QAAQL;YAAK;QAC/D;QAEF,OAAOd;IACT;IAEA,OAAOX;AACT"}

package/dist/core/workflow-model/parse-interpolation-field.d.ts

@@ -0,0 +1,14 @@
+import { type AvailabilitySite, type ExpressionTypeEnvironment } from '@shipfox/expression';
+import type { WorkflowFieldTemplate } from '../entities/workflow-model.js';
+import type { WorkflowModelValidationIssue, WorkflowModelValidationIssuePathSegment } from './invalid-workflow-model-error.js';
+export type StoredInterpolationField = 'run' | 'env.value' | 'agent.prompt' | 'agent.model' | 'agent.provider' | 'job.outputs' | 'job.name' | 'job.runner' | 'step.name' | 'step.feedback';
+export declare function parseInterpolationField(params: {
+    field: StoredInterpolationField;
+    source: string;
+    path: readonly WorkflowModelValidationIssuePathSegment[];
+    issues: WorkflowModelValidationIssue[];
+    fillSite?: AvailabilitySite;
+    allowedJobReferences?: ReadonlySet<string>;
+    typeOverlay?: ExpressionTypeEnvironment | undefined;
+}): WorkflowFieldTemplate | undefined;
+//# sourceMappingURL=parse-interpolation-field.d.ts.map

package/dist/core/workflow-model/parse-interpolation-field.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-interpolation-field.d.ts","sourceRoot":"","sources":["../../../src/core/workflow-model/parse-interpolation-field.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,gBAAgB,EAGrB,KAAK,yBAAyB,EAqB/B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAC,qBAAqB,EAAC,MAAM,+BAA+B,CAAC;AACzE,OAAO,KAAK,EACV,4BAA4B,EAE5B,uCAAuC,EACxC,MAAM,mCAAmC,CAAC;AAG3C,MAAM,MAAM,wBAAwB,GAChC,KAAK,GACL,WAAW,GACX,cAAc,GACd,aAAa,GACb,gBAAgB,GAChB,aAAa,GACb,UAAU,GACV,YAAY,GACZ,WAAW,GACX,eAAe,CAAC;AAEpB,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,KAAK,EAAE,wBAAwB,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,SAAS,uCAAuC,EAAE,CAAC;IACzD,MAAM,EAAE,4BAA4B,EAAE,CAAC;IACvC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,oBAAoB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3C,WAAW,CAAC,EAAE,yBAAyB,GAAG,SAAS,CAAC;CACrD,GAAG,qBAAqB,GAAG,SAAS,CAuBpC"}

package/dist/core/workflow-model/parse-interpolation-field.js

@@ -0,0 +1,377 @@
+import { secretKeySchema, secretStoreSchema } from '@shipfox/api-secrets-dto';
+import { analyzeContextKeyAccess, createWorkflowExpression, extractCelUntrustedPathAccesses, getWorkflowContextAvailability, getWorkflowContextDefinition, getWorkflowContextHost, getWorkflowContextTypeEnvironment, getWorkflowContextUntrustedPaths, InvalidWorkflowExpressionError, InvalidWorkflowTemplateError, parseWorkflowTemplate, planInterpolationField, unavailableRootsAt, workflowContextNames, workflowInterpolationFieldAcceptsContext, workflowInterpolationFieldAcceptsHost, workflowInterpolationFieldAcceptsTrustTier } from '@shipfox/expression';
+import { validateDirectJobReferences } from './validate-job-references.js';
+export function parseInterpolationField(params) {
+    const segments = parseTemplate(params);
+    if (segments === undefined) return undefined;
+    const expressionSegments = segments.filter(isExpressionSegment);
+    if (expressionSegments.length === 0) return undefined;
+    const checkedSegments = segments.map((segment)=>{
+        if (segment.kind === 'literal') return segment;
+        const validatedSegment = validateExpressionSegment({
+            ...params,
+            segment
+        });
+        return validatedSegment ?? segment;
+    });
+    const plan = planInterpolationField({
+        field: params.field,
+        segments: checkedSegments
+    });
+    if (!plan.ok) {
+        params.issues.push(...plan.violations.map((violation)=>planViolationIssue(params, violation)));
+        return undefined;
+    }
+    return plan.plan.field.segments;
+}
+function parseTemplate(params) {
+    try {
+        return parseWorkflowTemplate(params.source);
+    } catch (error) {
+        params.issues.push(issue({
+            code: 'invalid-interpolation-template',
+            message: `${fieldLabel(params.field)} must use valid $${'{{ }}'} interpolation syntax.`,
+            path: params.path,
+            details: {
+                field: params.field,
+                source: params.source,
+                reason: error instanceof InvalidWorkflowTemplateError ? error.reason : 'Template source did not parse.'
+            }
+        }));
+        return undefined;
+    }
+}
+function validateExpressionSegment(params) {
+    const contextRoots = uniqueStrings(params.segment.contextRoots);
+    const knownRoots = contextRoots.filter(isWorkflowContextName);
+    const unknownRoots = contextRoots.filter((root)=>!isWorkflowContextName(root));
+    const rejectedRoots = knownRoots.filter((root)=>!workflowInterpolationFieldAcceptsContext(params.field, root));
+    if (rejectedRoots.length > 0) {
+        params.issues.push(untrustedContextIssue({
+            ...params,
+            contextRoots,
+            rejectedRoots
+        }));
+        return undefined;
+    }
+    const rejectedHostRoots = knownRoots.filter((root)=>!workflowInterpolationFieldAcceptsHost(params.field, getWorkflowContextHost(root)));
+    if (rejectedHostRoots.length > 0) {
+        params.issues.push(runnerContextInFieldIssue({
+            ...params,
+            contextRoots,
+            rejectedHostRoots
+        }));
+        return undefined;
+    }
+    const keyAccess = analyzeContextKeyAccess(params.segment.expression);
+    if (keyAccess.violations.length > 0) {
+        params.issues.push(...keyAccess.violations.map((violation)=>computedContextKeyIssue({
+                ...params,
+                contextRoots,
+                root: violation.root,
+                expression: violation.source
+            })));
+        return undefined;
+    }
+    const invalidReferenceIssue = validateContextKeyReferences({
+        ...params,
+        contextRoots,
+        references: keyAccess.references
+    });
+    if (invalidReferenceIssue !== undefined) {
+        params.issues.push(invalidReferenceIssue);
+        return undefined;
+    }
+    const invalidJobReferenceIssue = params.allowedJobReferences === undefined ? undefined : validateDirectJobReferences({
+        source: params.source,
+        expression: params.segment.expression,
+        field: params.field,
+        path: params.path,
+        allowedJobReferences: params.allowedJobReferences
+    });
+    if (invalidJobReferenceIssue !== undefined) {
+        params.issues.push(invalidJobReferenceIssue);
+        return undefined;
+    }
+    const rejectedPathRoots = findUntrustedPathRoots(params.segment, params.field, knownRoots);
+    if (rejectedPathRoots.length > 0) {
+        params.issues.push(untrustedContextIssue({
+            ...params,
+            contextRoots,
+            rejectedRoots: rejectedPathRoots
+        }));
+        return undefined;
+    }
+    if (unknownRoots.length > 0) {
+        params.issues.push(issue({
+            code: 'unknown-interpolation-context',
+            message: `${fieldLabel(params.field)} interpolation references unknown context ${formatList(unknownRoots)}.`,
+            path: params.path,
+            details: {
+                field: params.field,
+                source: params.source,
+                expression: params.segment.expression.source,
+                contextRoots,
+                unknownRoots
+            }
+        }));
+        return undefined;
+    }
+    const fillSite = params.fillSite;
+    if (fillSite !== undefined) {
+        const serverRoots = knownRoots.filter((root)=>getWorkflowContextHost(root) === 'server');
+        const unavailableRoots = unavailableRootsAt(serverRoots, fillSite);
+        if (unavailableRoots.length > 0) {
+            params.issues.push(unavailableContextIssue({
+                ...params,
+                contextRoots,
+                unavailableRoots,
+                fillSite
+            }));
+            return undefined;
+        }
+    }
+    if (params.typeOverlay === undefined && (knownRoots.length === 0 || knownRoots.some((root)=>hasSyntaxOnlyCheckMode(root)))) {
+        return params.segment;
+    }
+    try {
+        return {
+            ...params.segment,
+            expression: createWorkflowExpression({
+                source: params.segment.expression.source,
+                check: {
+                    mode: 'typed',
+                    // `undefined` preserves the legacy syntax-only path above. `{}` means
+                    // callers intentionally requested typed checking with the standard roots.
+                    typeEnvironment: mergeTypeEnvironments(knownRoots, params.typeOverlay)
+                }
+            })
+        };
+    } catch (error) {
+        params.issues.push(issue({
+            code: 'invalid-interpolation-expression',
+            message: `${fieldLabel(params.field)} interpolation expression did not type-check.`,
+            path: params.path,
+            details: {
+                field: params.field,
+                source: params.source,
+                expression: params.segment.expression.source,
+                contextRoots,
+                reason: error instanceof InvalidWorkflowExpressionError ? error.reason : 'Expression source did not type-check.'
+            }
+        }));
+        return undefined;
+    }
+}
+function findUntrustedPathRoots(segment, field, knownRoots) {
+    if (!isTrustedOnlyField(field)) return [];
+    const untrustedPathsByRoot = new Map();
+    for (const root of knownRoots){
+        const paths = getWorkflowContextUntrustedPaths(root);
+        if (paths === undefined || paths.length === 0) continue;
+        untrustedPathsByRoot.set(root, paths);
+    }
+    if (knownRoots.includes('steps')) {
+        untrustedPathsByRoot.set('steps', [
+            ...new Set([
+                ...untrustedPathsByRoot.get('steps') ?? [],
+                'outputs'
+            ])
+        ]);
+    }
+    if (untrustedPathsByRoot.size === 0) return [];
+    return extractCelUntrustedPathAccesses({
+        source: segment.expression.source,
+        untrustedPathsByRoot
+    }).filter(isWorkflowContextName);
+}
+function isTrustedOnlyField(field) {
+    return !workflowInterpolationFieldAcceptsTrustTier(field, 'untrusted');
+}
+function untrustedContextIssue(params) {
+    return issue({
+        code: 'untrusted-context-in-field',
+        message: params.field === 'run' ? `Run command interpolation cannot use untrusted context ${formatList(params.rejectedRoots)}. Bind untrusted values to env and reference the shell variable from run instead.` : `${fieldLabel(params.field)} interpolation cannot use untrusted context ${formatList(params.rejectedRoots)}.`,
+        path: params.path,
+        details: {
+            field: params.field,
+            source: params.source,
+            contextRoots: params.contextRoots,
+            rejectedRoots: params.rejectedRoots
+        }
+    });
+}
+function runnerContextInFieldIssue(params) {
+    return issue({
+        code: 'runner-context-in-field',
+        message: `${fieldLabel(params.field)} interpolation cannot use runner context ${formatList(params.rejectedHostRoots)}. Bind secrets to a run-step env value instead.`,
+        path: params.path,
+        details: {
+            field: params.field,
+            source: params.source,
+            contextRoots: params.contextRoots,
+            rejectedRoots: params.rejectedHostRoots
+        }
+    });
+}
+function computedContextKeyIssue(params) {
+    return issue({
+        code: 'computed-context-key',
+        message: `${fieldLabel(params.field)} interpolation must reference ${params.root} with a literal dot key.`,
+        path: params.path,
+        details: {
+            field: params.field,
+            source: params.source,
+            expression: params.expression,
+            contextRoots: params.contextRoots,
+            root: params.root
+        }
+    });
+}
+function validateContextKeyReferences(params) {
+    for (const reference of params.references){
+        if (!secretKeySchema.safeParse(reference.key).success) {
+            return computedContextKeyIssue({
+                ...params,
+                root: reference.root,
+                expression: params.segment.expression.source
+            });
+        }
+        if (reference.root !== 'secrets' || reference.store === undefined) continue;
+        if (secretStoreSchema.safeParse(reference.store).success) continue;
+        return issue({
+            code: 'unknown-secret-store',
+            message: `${fieldLabel(params.field)} interpolation references unknown secret store "${reference.store}".`,
+            path: params.path,
+            details: {
+                field: params.field,
+                source: params.source,
+                expression: params.segment.expression.source,
+                contextRoots: params.contextRoots,
+                store: reference.store
+            }
+        });
+    }
+    return undefined;
+}
+const availabilitySiteLabels = {
+    ingest: 'ingest',
+    'run-creation': 'run creation',
+    'execution-creation': 'execution creation',
+    'job-activation': 'job activation',
+    'step-dispatch': 'step dispatch',
+    'step-report': 'step reporting',
+    'execution-resolution': 'execution resolution',
+    'job-resolution': 'job resolution'
+};
+function unavailableContextIssue(params) {
+    return issue({
+        code: 'context-unavailable-at-fill-site',
+        message: `${fieldLabel(params.field)} interpolation references ${contextNoun(params.unavailableRoots)} ${formatList(params.unavailableRoots)} that ${availabilityVerb(params.unavailableRoots)} not available at ${describeAvailabilitySite(params.fillSite)}. ${params.unavailableRoots.map(unavailableRootAvailabilityMessage).join(' ')}`,
+        path: params.path,
+        details: {
+            field: params.field,
+            source: params.source,
+            expression: params.segment.expression.source,
+            contextRoots: params.contextRoots,
+            unavailableRoots: params.unavailableRoots,
+            fillSite: params.fillSite
+        }
+    });
+}
+function planViolationIssue(params, violation) {
+    if (violation.reason === 'computed-context-key') {
+        return issue({
+            code: 'computed-context-key',
+            message: `${fieldLabel(params.field)} interpolation must reference ${formatList(violation.contextRoots ?? [])} with a literal dot key.`,
+            path: params.path,
+            details: {
+                field: params.field,
+                source: params.source,
+                expression: violation.source,
+                contextRoots: violation.contextRoots
+            }
+        });
+    }
+    return issue({
+        code: 'runner-context-not-bare',
+        message: `${fieldLabel(params.field)} interpolation references runner context in a larger expression; ${violation.hint}.`,
+        path: params.path,
+        details: {
+            field: params.field,
+            source: params.source,
+            expression: violation.source,
+            runnerRoots: violation.runnerRoots ?? []
+        }
+    });
+}
+function contextNoun(roots) {
+    return roots.length === 1 ? 'context' : 'contexts';
+}
+function availabilityVerb(roots) {
+    return roots.length === 1 ? 'is' : 'are';
+}
+function unavailableRootAvailabilityMessage(root) {
+    const availability = getWorkflowContextAvailability(root);
+    if (availability === undefined) return `"${root}" is not available at any server site.`;
+    return `"${root}" becomes available at ${describeAvailabilitySite(availability)}.`;
+}
+function describeAvailabilitySite(site) {
+    return availabilitySiteLabels[site];
+}
+function hasSyntaxOnlyCheckMode(root) {
+    return getWorkflowContextDefinition(root).checkMode === 'syntax';
+}
+function mergeTypeEnvironments(roots, typeOverlay) {
+    const typeEnvironment = {};
+    for (const root of roots){
+        const overlayType = typeOverlay?.[root];
+        if (overlayType !== undefined) {
+            typeEnvironment[root] = overlayType;
+            continue;
+        }
+        const contextTypeEnvironment = getWorkflowContextTypeEnvironment(root);
+        if (contextTypeEnvironment === undefined) {
+            if (typeOverlay !== undefined) typeEnvironment[root] = {
+                kind: 'map'
+            };
+            continue;
+        }
+        Object.assign(typeEnvironment, contextTypeEnvironment);
+    }
+    return typeEnvironment;
+}
+function isExpressionSegment(segment) {
+    return segment.kind === 'expr';
+}
+function isWorkflowContextName(root) {
+    return workflowContextNames.includes(root);
+}
+function uniqueStrings(values) {
+    return [
+        ...new Set(values)
+    ];
+}
+function formatList(values) {
+    return values.map((value)=>`"${value}"`).join(', ');
+}
+function fieldLabel(field) {
+    return `Workflow ${field}`;
+}
+function issue(params) {
+    if (params.details === undefined) {
+        return {
+            code: params.code,
+            message: params.message,
+            path: params.path
+        };
+    }
+    return {
+        code: params.code,
+        message: params.message,
+        path: params.path,
+        details: params.details
+    };
+}
+
+//# sourceMappingURL=parse-interpolation-field.js.map

package/dist/core/workflow-model/parse-interpolation-field.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/core/workflow-model/parse-interpolation-field.ts"],"sourcesContent":["import {secretKeySchema, secretStoreSchema} from '@shipfox/api-secrets-dto';\nimport {\n  type AvailabilitySite,\n  analyzeContextKeyAccess,\n  createWorkflowExpression,\n  type ExpressionTypeEnvironment,\n  extractCelUntrustedPathAccesses,\n  getWorkflowContextAvailability,\n  getWorkflowContextDefinition,\n  getWorkflowContextHost,\n  getWorkflowContextTypeEnvironment,\n  getWorkflowContextUntrustedPaths,\n  InvalidWorkflowExpressionError,\n  InvalidWorkflowTemplateError,\n  type PlanViolation,\n  parseWorkflowTemplate,\n  planInterpolationField,\n  unavailableRootsAt,\n  type WorkflowContextName,\n  type WorkflowInterpolationField,\n  type WorkflowTemplateExprSegment,\n  type WorkflowTemplateSegment,\n  workflowContextNames,\n  workflowInterpolationFieldAcceptsContext,\n  workflowInterpolationFieldAcceptsHost,\n  workflowInterpolationFieldAcceptsTrustTier,\n} from '@shipfox/expression';\nimport type {WorkflowFieldTemplate} from '../entities/workflow-model.js';\nimport type {\n  WorkflowModelValidationIssue,\n  WorkflowModelValidationIssueCode,\n  WorkflowModelValidationIssuePathSegment,\n} from './invalid-workflow-model-error.js';\nimport {validateDirectJobReferences} from './validate-job-references.js';\n\nexport type StoredInterpolationField =\n  | 'run'\n  | 'env.value'\n  | 'agent.prompt'\n  | 'agent.model'\n  | 'agent.provider'\n  | 'job.outputs'\n  | 'job.name'\n  | 'job.runner'\n  | 'step.name'\n  | 'step.feedback';\n\nexport function parseInterpolationField(params: {\n  field: StoredInterpolationField;\n  source: string;\n  path: readonly WorkflowModelValidationIssuePathSegment[];\n  issues: WorkflowModelValidationIssue[];\n  fillSite?: AvailabilitySite;\n  allowedJobReferences?: ReadonlySet<string>;\n  typeOverlay?: ExpressionTypeEnvironment | undefined;\n}): WorkflowFieldTemplate | undefined {\n  const segments = parseTemplate(params);\n  if (segments === undefined) return undefined;\n\n  const expressionSegments = segments.filter(isExpressionSegment);\n  if (expressionSegments.length === 0) return undefined;\n\n  const checkedSegments = segments.map((segment) => {\n    if (segment.kind === 'literal') return segment;\n\n    const validatedSegment = validateExpressionSegment({...params, segment});\n    return validatedSegment ?? segment;\n  });\n\n  const plan = planInterpolationField({field: params.field, segments: checkedSegments});\n  if (!plan.ok) {\n    params.issues.push(\n      ...plan.violations.map((violation) => planViolationIssue(params, violation)),\n    );\n    return undefined;\n  }\n\n  return plan.plan.field.segments;\n}\n\nfunction parseTemplate(params: {\n  field: WorkflowInterpolationField;\n  source: string;\n  path: readonly WorkflowModelValidationIssuePathSegment[];\n  issues: WorkflowModelValidationIssue[];\n}): WorkflowTemplateSegment[] | undefined {\n  try {\n    return parseWorkflowTemplate(params.source);\n  } catch (error) {\n    params.issues.push(\n      issue({\n        code: 'invalid-interpolation-template',\n        message: `${fieldLabel(params.field)} must use valid $${'{{ }}'} interpolation syntax.`,\n        path: params.path,\n        details: {\n          field: params.field,\n          source: params.source,\n          reason:\n            error instanceof InvalidWorkflowTemplateError\n              ? error.reason\n              : 'Template source did not parse.',\n        },\n      }),\n    );\n    return undefined;\n  }\n}\n\nfunction validateExpressionSegment(params: {\n  field: StoredInterpolationField;\n  source: string;\n  path: readonly WorkflowModelValidationIssuePathSegment[];\n  issues: WorkflowModelValidationIssue[];\n  segment: WorkflowTemplateExprSegment;\n  fillSite?: AvailabilitySite;\n  allowedJobReferences?: ReadonlySet<string>;\n  typeOverlay?: ExpressionTypeEnvironment | undefined;\n}): WorkflowTemplateExprSegment | undefined {\n  const contextRoots = uniqueStrings(params.segment.contextRoots);\n  const knownRoots = contextRoots.filter(isWorkflowContextName);\n  const unknownRoots = contextRoots.filter((root) => !isWorkflowContextName(root));\n\n  const rejectedRoots = knownRoots.filter(\n    (root) => !workflowInterpolationFieldAcceptsContext(params.field, root),\n  );\n  if (rejectedRoots.length > 0) {\n    params.issues.push(untrustedContextIssue({...params, contextRoots, rejectedRoots}));\n    return undefined;\n  }\n\n  const rejectedHostRoots = knownRoots.filter(\n    (root) => !workflowInterpolationFieldAcceptsHost(params.field, getWorkflowContextHost(root)),\n  );\n  if (rejectedHostRoots.length > 0) {\n    params.issues.push(runnerContextInFieldIssue({...params, contextRoots, rejectedHostRoots}));\n    return undefined;\n  }\n\n  const keyAccess = analyzeContextKeyAccess(params.segment.expression);\n  if (keyAccess.violations.length > 0) {\n    params.issues.push(\n      ...keyAccess.violations.map((violation) =>\n        computedContextKeyIssue({\n          ...params,\n          contextRoots,\n          root: violation.root,\n          expression: violation.source,\n        }),\n      ),\n    );\n    return undefined;\n  }\n\n  const invalidReferenceIssue = validateContextKeyReferences({\n    ...params,\n    contextRoots,\n    references: keyAccess.references,\n  });\n  if (invalidReferenceIssue !== undefined) {\n    params.issues.push(invalidReferenceIssue);\n    return undefined;\n  }\n\n  const invalidJobReferenceIssue =\n    params.allowedJobReferences === undefined\n      ? undefined\n      : validateDirectJobReferences({\n          source: params.source,\n          expression: params.segment.expression,\n          field: params.field,\n          path: params.path,\n          allowedJobReferences: params.allowedJobReferences,\n        });\n  if (invalidJobReferenceIssue !== undefined) {\n    params.issues.push(invalidJobReferenceIssue);\n    return undefined;\n  }\n\n  const rejectedPathRoots = findUntrustedPathRoots(params.segment, params.field, knownRoots);\n  if (rejectedPathRoots.length > 0) {\n    params.issues.push(\n      untrustedContextIssue({...params, contextRoots, rejectedRoots: rejectedPathRoots}),\n    );\n    return undefined;\n  }\n\n  if (unknownRoots.length > 0) {\n    params.issues.push(\n      issue({\n        code: 'unknown-interpolation-context',\n        message: `${fieldLabel(params.field)} interpolation references unknown context ${formatList(\n          unknownRoots,\n        )}.`,\n        path: params.path,\n        details: {\n          field: params.field,\n          source: params.source,\n          expression: params.segment.expression.source,\n          contextRoots,\n          unknownRoots,\n        },\n      }),\n    );\n    return undefined;\n  }\n\n  const fillSite = params.fillSite;\n  if (fillSite !== undefined) {\n    const serverRoots = knownRoots.filter((root) => getWorkflowContextHost(root) === 'server');\n    const unavailableRoots = unavailableRootsAt(serverRoots, fillSite);\n    if (unavailableRoots.length > 0) {\n      params.issues.push(\n        unavailableContextIssue({...params, contextRoots, unavailableRoots, fillSite}),\n      );\n      return undefined;\n    }\n  }\n\n  if (\n    params.typeOverlay === undefined &&\n    (knownRoots.length === 0 || knownRoots.some((root) => hasSyntaxOnlyCheckMode(root)))\n  ) {\n    return params.segment;\n  }\n\n  try {\n    return {\n      ...params.segment,\n      expression: createWorkflowExpression({\n        source: params.segment.expression.source,\n        check: {\n          mode: 'typed',\n          // `undefined` preserves the legacy syntax-only path above. `{}` means\n          // callers intentionally requested typed checking with the standard roots.\n          typeEnvironment: mergeTypeEnvironments(knownRoots, params.typeOverlay),\n        },\n      }),\n    };\n  } catch (error) {\n    params.issues.push(\n      issue({\n        code: 'invalid-interpolation-expression',\n        message: `${fieldLabel(params.field)} interpolation expression did not type-check.`,\n        path: params.path,\n        details: {\n          field: params.field,\n          source: params.source,\n          expression: params.segment.expression.source,\n          contextRoots,\n          reason:\n            error instanceof InvalidWorkflowExpressionError\n              ? error.reason\n              : 'Expression source did not type-check.',\n        },\n      }),\n    );\n    return undefined;\n  }\n}\n\nfunction findUntrustedPathRoots(\n  segment: WorkflowTemplateExprSegment,\n  field: StoredInterpolationField,\n  knownRoots: readonly WorkflowContextName[],\n): readonly WorkflowContextName[] {\n  if (!isTrustedOnlyField(field)) return [];\n\n  const untrustedPathsByRoot = new Map<string, readonly string[]>();\n  for (const root of knownRoots) {\n    const paths = getWorkflowContextUntrustedPaths(root);\n    if (paths === undefined || paths.length === 0) continue;\n    untrustedPathsByRoot.set(root, paths);\n  }\n  if (knownRoots.includes('steps')) {\n    untrustedPathsByRoot.set('steps', [\n      ...new Set([...(untrustedPathsByRoot.get('steps') ?? []), 'outputs']),\n    ]);\n  }\n  if (untrustedPathsByRoot.size === 0) return [];\n\n  return extractCelUntrustedPathAccesses({\n    source: segment.expression.source,\n    untrustedPathsByRoot,\n  }).filter(isWorkflowContextName);\n}\n\nfunction isTrustedOnlyField(field: StoredInterpolationField): boolean {\n  return !workflowInterpolationFieldAcceptsTrustTier(field, 'untrusted');\n}\n\nfunction untrustedContextIssue(params: {\n  field: WorkflowInterpolationField;\n  source: string;\n  path: readonly WorkflowModelValidationIssuePathSegment[];\n  contextRoots: readonly string[];\n  rejectedRoots: readonly WorkflowContextName[];\n}): WorkflowModelValidationIssue {\n  return issue({\n    code: 'untrusted-context-in-field',\n    message:\n      params.field === 'run'\n        ? `Run command interpolation cannot use untrusted context ${formatList(\n            params.rejectedRoots,\n          )}. Bind untrusted values to env and reference the shell variable from run instead.`\n        : `${fieldLabel(params.field)} interpolation cannot use untrusted context ${formatList(\n            params.rejectedRoots,\n          )}.`,\n    path: params.path,\n    details: {\n      field: params.field,\n      source: params.source,\n      contextRoots: params.contextRoots,\n      rejectedRoots: params.rejectedRoots,\n    },\n  });\n}\n\nfunction runnerContextInFieldIssue(params: {\n  field: WorkflowInterpolationField;\n  source: string;\n  path: readonly WorkflowModelValidationIssuePathSegment[];\n  contextRoots: readonly string[];\n  rejectedHostRoots: readonly WorkflowContextName[];\n}): WorkflowModelValidationIssue {\n  return issue({\n    code: 'runner-context-in-field',\n    message: `${fieldLabel(params.field)} interpolation cannot use runner context ${formatList(\n      params.rejectedHostRoots,\n    )}. Bind secrets to a run-step env value instead.`,\n    path: params.path,\n    details: {\n      field: params.field,\n      source: params.source,\n      contextRoots: params.contextRoots,\n      rejectedRoots: params.rejectedHostRoots,\n    },\n  });\n}\n\nfunction computedContextKeyIssue(params: {\n  field: WorkflowInterpolationField;\n  source: string;\n  path: readonly WorkflowModelValidationIssuePathSegment[];\n  contextRoots: readonly string[];\n  root: string;\n  expression: string;\n}): WorkflowModelValidationIssue {\n  return issue({\n    code: 'computed-context-key',\n    message: `${fieldLabel(params.field)} interpolation must reference ${params.root} with a literal dot key.`,\n    path: params.path,\n    details: {\n      field: params.field,\n      source: params.source,\n      expression: params.expression,\n      contextRoots: params.contextRoots,\n      root: params.root,\n    },\n  });\n}\n\nfunction validateContextKeyReferences(params: {\n  field: WorkflowInterpolationField;\n  source: string;\n  path: readonly WorkflowModelValidationIssuePathSegment[];\n  contextRoots: readonly string[];\n  segment: WorkflowTemplateExprSegment;\n  references: ReturnType<typeof analyzeContextKeyAccess>['references'];\n}): WorkflowModelValidationIssue | undefined {\n  for (const reference of params.references) {\n    if (!secretKeySchema.safeParse(reference.key).success) {\n      return computedContextKeyIssue({\n        ...params,\n        root: reference.root,\n        expression: params.segment.expression.source,\n      });\n    }\n\n    if (reference.root !== 'secrets' || reference.store === undefined) continue;\n    if (secretStoreSchema.safeParse(reference.store).success) continue;\n\n    return issue({\n      code: 'unknown-secret-store',\n      message: `${fieldLabel(params.field)} interpolation references unknown secret store \"${reference.store}\".`,\n      path: params.path,\n      details: {\n        field: params.field,\n        source: params.source,\n        expression: params.segment.expression.source,\n        contextRoots: params.contextRoots,\n        store: reference.store,\n      },\n    });\n  }\n\n  return undefined;\n}\n\nconst availabilitySiteLabels = {\n  ingest: 'ingest',\n  'run-creation': 'run creation',\n  'execution-creation': 'execution creation',\n  'job-activation': 'job activation',\n  'step-dispatch': 'step dispatch',\n  'step-report': 'step reporting',\n  'execution-resolution': 'execution resolution',\n  'job-resolution': 'job resolution',\n} as const satisfies Record<AvailabilitySite, string>;\n\nfunction unavailableContextIssue(params: {\n  field: WorkflowInterpolationField;\n  source: string;\n  path: readonly WorkflowModelValidationIssuePathSegment[];\n  segment: WorkflowTemplateExprSegment;\n  contextRoots: readonly string[];\n  unavailableRoots: readonly WorkflowContextName[];\n  fillSite: AvailabilitySite;\n}): WorkflowModelValidationIssue {\n  return issue({\n    code: 'context-unavailable-at-fill-site',\n    message: `${fieldLabel(params.field)} interpolation references ${contextNoun(\n      params.unavailableRoots,\n    )} ${formatList(params.unavailableRoots)} that ${availabilityVerb(\n      params.unavailableRoots,\n    )} not available at ${describeAvailabilitySite(params.fillSite)}. ${params.unavailableRoots\n      .map(unavailableRootAvailabilityMessage)\n      .join(' ')}`,\n    path: params.path,\n    details: {\n      field: params.field,\n      source: params.source,\n      expression: params.segment.expression.source,\n      contextRoots: params.contextRoots,\n      unavailableRoots: params.unavailableRoots,\n      fillSite: params.fillSite,\n    },\n  });\n}\n\nfunction planViolationIssue(\n  params: {\n    field: WorkflowInterpolationField;\n    source: string;\n    path: readonly WorkflowModelValidationIssuePathSegment[];\n  },\n  violation: PlanViolation,\n): WorkflowModelValidationIssue {\n  if (violation.reason === 'computed-context-key') {\n    return issue({\n      code: 'computed-context-key',\n      message: `${fieldLabel(params.field)} interpolation must reference ${formatList(\n        violation.contextRoots ?? [],\n      )} with a literal dot key.`,\n      path: params.path,\n      details: {\n        field: params.field,\n        source: params.source,\n        expression: violation.source,\n        contextRoots: violation.contextRoots,\n      },\n    });\n  }\n\n  return issue({\n    code: 'runner-context-not-bare',\n    message: `${fieldLabel(params.field)} interpolation references runner context in a larger expression; ${violation.hint}.`,\n    path: params.path,\n    details: {\n      field: params.field,\n      source: params.source,\n      expression: violation.source,\n      runnerRoots: violation.runnerRoots ?? [],\n    },\n  });\n}\n\nfunction contextNoun(roots: readonly WorkflowContextName[]): 'context' | 'contexts' {\n  return roots.length === 1 ? 'context' : 'contexts';\n}\n\nfunction availabilityVerb(roots: readonly WorkflowContextName[]): 'is' | 'are' {\n  return roots.length === 1 ? 'is' : 'are';\n}\n\nfunction unavailableRootAvailabilityMessage(root: WorkflowContextName): string {\n  const availability = getWorkflowContextAvailability(root);\n  if (availability === undefined) return `\"${root}\" is not available at any server site.`;\n  return `\"${root}\" becomes available at ${describeAvailabilitySite(availability)}.`;\n}\n\nfunction describeAvailabilitySite(site: AvailabilitySite): string {\n  return availabilitySiteLabels[site];\n}\n\nfunction hasSyntaxOnlyCheckMode(root: WorkflowContextName): boolean {\n  return getWorkflowContextDefinition(root).checkMode === 'syntax';\n}\n\nfunction mergeTypeEnvironments(\n  roots: readonly WorkflowContextName[],\n  typeOverlay?: ExpressionTypeEnvironment,\n): ExpressionTypeEnvironment {\n  const typeEnvironment: Record<string, ExpressionTypeEnvironment[string]> = {};\n\n  for (const root of roots) {\n    const overlayType = typeOverlay?.[root];\n    if (overlayType !== undefined) {\n      typeEnvironment[root] = overlayType;\n      continue;\n    }\n\n    const contextTypeEnvironment = getWorkflowContextTypeEnvironment(root);\n    if (contextTypeEnvironment === undefined) {\n      if (typeOverlay !== undefined) typeEnvironment[root] = {kind: 'map'};\n      continue;\n    }\n\n    Object.assign(typeEnvironment, contextTypeEnvironment);\n  }\n\n  return typeEnvironment;\n}\n\nfunction isExpressionSegment(\n  segment: WorkflowTemplateSegment,\n): segment is WorkflowTemplateExprSegment {\n  return segment.kind === 'expr';\n}\n\nfunction isWorkflowContextName(root: string): root is WorkflowContextName {\n  return (workflowContextNames as readonly string[]).includes(root);\n}\n\nfunction uniqueStrings(values: readonly string[]): readonly string[] {\n  return [...new Set(values)];\n}\n\nfunction formatList(values: readonly string[]): string {\n  return values.map((value) => `\"${value}\"`).join(', ');\n}\n\nfunction fieldLabel(field: WorkflowInterpolationField): string {\n  return `Workflow ${field}`;\n}\n\nfunction issue(params: {\n  code: WorkflowModelValidationIssueCode;\n  message: string;\n  path: readonly WorkflowModelValidationIssuePathSegment[];\n  details?: Readonly<Record<string, unknown>>;\n}): WorkflowModelValidationIssue {\n  if (params.details === undefined) {\n    return {\n      code: params.code,\n      message: params.message,\n      path: params.path,\n    };\n  }\n\n  return {\n    code: params.code,\n    message: params.message,\n    path: params.path,\n    details: params.details,\n  };\n}\n"],"names":["secretKeySchema","secretStoreSchema","analyzeContextKeyAccess","createWorkflowExpression","extractCelUntrustedPathAccesses","getWorkflowContextAvailability","getWorkflowContextDefinition","getWorkflowContextHost","getWorkflowContextTypeEnvironment","getWorkflowContextUntrustedPaths","InvalidWorkflowExpressionError","InvalidWorkflowTemplateError","parseWorkflowTemplate","planInterpolationField","unavailableRootsAt","workflowContextNames","workflowInterpolationFieldAcceptsContext","workflowInterpolationFieldAcceptsHost","workflowInterpolationFieldAcceptsTrustTier","validateDirectJobReferences","parseInterpolationField","params","segments","parseTemplate","undefined","expressionSegments","filter","isExpressionSegment","length","checkedSegments","map","segment","kind","validatedSegment","validateExpressionSegment","plan","field","ok","issues","push","violations","violation","planViolationIssue","source","error","issue","code","message","fieldLabel","path","details","reason","contextRoots","uniqueStrings","knownRoots","isWorkflowContextName","unknownRoots","root","rejectedRoots","untrustedContextIssue","rejectedHostRoots","runnerContextInFieldIssue","keyAccess","expression","computedContextKeyIssue","invalidReferenceIssue","validateContextKeyReferences","references","invalidJobReferenceIssue","allowedJobReferences","rejectedPathRoots","findUntrustedPathRoots","formatList","fillSite","serverRoots","unavailableRoots","unavailableContextIssue","typeOverlay","some","hasSyntaxOnlyCheckMode","check","mode","typeEnvironment","mergeTypeEnvironments","isTrustedOnlyField","untrustedPathsByRoot","Map","paths","set","includes","Set","get","size","reference","safeParse","key","success","store","availabilitySiteLabels","ingest","contextNoun","availabilityVerb","describeAvailabilitySite","unavailableRootAvailabilityMessage","join","hint","runnerRoots","roots","availability","site","checkMode","overlayType","contextTypeEnvironment","Object","assign","values","value"],"mappings":"AAAA,SAAQA,eAAe,EAAEC,iBAAiB,QAAO,2BAA2B;AAC5E,SAEEC,uBAAuB,EACvBC,wBAAwB,EAExBC,+BAA+B,EAC/BC,8BAA8B,EAC9BC,4BAA4B,EAC5BC,sBAAsB,EACtBC,iCAAiC,EACjCC,gCAAgC,EAChCC,8BAA8B,EAC9BC,4BAA4B,EAE5BC,qBAAqB,EACrBC,sBAAsB,EACtBC,kBAAkB,EAKlBC,oBAAoB,EACpBC,wCAAwC,EACxCC,qCAAqC,EACrCC,0CAA0C,QACrC,sBAAsB;AAO7B,SAAQC,2BAA2B,QAAO,+BAA+B;AAczE,OAAO,SAASC,wBAAwBC,MAQvC;IACC,MAAMC,WAAWC,cAAcF;IAC/B,IAAIC,aAAaE,WAAW,OAAOA;IAEnC,MAAMC,qBAAqBH,SAASI,MAAM,CAACC;IAC3C,IAAIF,mBAAmBG,MAAM,KAAK,GAAG,OAAOJ;IAE5C,MAAMK,kBAAkBP,SAASQ,GAAG,CAAC,CAACC;QACpC,IAAIA,QAAQC,IAAI,KAAK,WAAW,OAAOD;QAEvC,MAAME,mBAAmBC,0BAA0B;YAAC,GAAGb,MAAM;YAAEU;QAAO;QACtE,OAAOE,oBAAoBF;IAC7B;IAEA,MAAMI,OAAOtB,uBAAuB;QAACuB,OAAOf,OAAOe,KAAK;QAAEd,UAAUO;IAAe;IACnF,IAAI,CAACM,KAAKE,EAAE,EAAE;QACZhB,OAAOiB,MAAM,CAACC,IAAI,IACbJ,KAAKK,UAAU,CAACV,GAAG,CAAC,CAACW,YAAcC,mBAAmBrB,QAAQoB;QAEnE,OAAOjB;IACT;IAEA,OAAOW,KAAKA,IAAI,CAACC,KAAK,CAACd,QAAQ;AACjC;AAEA,SAASC,cAAcF,MAKtB;IACC,IAAI;QACF,OAAOT,sBAAsBS,OAAOsB,MAAM;IAC5C,EAAE,OAAOC,OAAO;QACdvB,OAAOiB,MAAM,CAACC,IAAI,CAChBM,MAAM;YACJC,MAAM;YACNC,SAAS,GAAGC,WAAW3B,OAAOe,KAAK,EAAE,iBAAiB,EAAE,QAAQ,sBAAsB,CAAC;YACvFa,MAAM5B,OAAO4B,IAAI;YACjBC,SAAS;gBACPd,OAAOf,OAAOe,KAAK;gBACnBO,QAAQtB,OAAOsB,MAAM;gBACrBQ,QACEP,iBAAiBjC,+BACbiC,MAAMO,MAAM,GACZ;YACR;QACF;QAEF,OAAO3B;IACT;AACF;AAEA,SAASU,0BAA0Bb,MASlC;IACC,MAAM+B,eAAeC,cAAchC,OAAOU,OAAO,CAACqB,YAAY;IAC9D,MAAME,aAAaF,aAAa1B,MAAM,CAAC6B;IACvC,MAAMC,eAAeJ,aAAa1B,MAAM,CAAC,CAAC+B,OAAS,CAACF,sBAAsBE;IAE1E,MAAMC,gBAAgBJ,WAAW5B,MAAM,CACrC,CAAC+B,OAAS,CAACzC,yCAAyCK,OAAOe,KAAK,EAAEqB;IAEpE,IAAIC,cAAc9B,MAAM,GAAG,GAAG;QAC5BP,OAAOiB,MAAM,CAACC,IAAI,CAACoB,sBAAsB;YAAC,GAAGtC,MAAM;YAAE+B;YAAcM;QAAa;QAChF,OAAOlC;IACT;IAEA,MAAMoC,oBAAoBN,WAAW5B,MAAM,CACzC,CAAC+B,OAAS,CAACxC,sCAAsCI,OAAOe,KAAK,EAAE7B,uBAAuBkD;IAExF,IAAIG,kBAAkBhC,MAAM,GAAG,GAAG;QAChCP,OAAOiB,MAAM,CAACC,IAAI,CAACsB,0BAA0B;YAAC,GAAGxC,MAAM;YAAE+B;YAAcQ;QAAiB;QACxF,OAAOpC;IACT;IAEA,MAAMsC,YAAY5D,wBAAwBmB,OAAOU,OAAO,CAACgC,UAAU;IACnE,IAAID,UAAUtB,UAAU,CAACZ,MAAM,GAAG,GAAG;QACnCP,OAAOiB,MAAM,CAACC,IAAI,IACbuB,UAAUtB,UAAU,CAACV,GAAG,CAAC,CAACW,YAC3BuB,wBAAwB;gBACtB,GAAG3C,MAAM;gBACT+B;gBACAK,MAAMhB,UAAUgB,IAAI;gBACpBM,YAAYtB,UAAUE,MAAM;YAC9B;QAGJ,OAAOnB;IACT;IAEA,MAAMyC,wBAAwBC,6BAA6B;QACzD,GAAG7C,MAAM;QACT+B;QACAe,YAAYL,UAAUK,UAAU;IAClC;IACA,IAAIF,0BAA0BzC,WAAW;QACvCH,OAAOiB,MAAM,CAACC,IAAI,CAAC0B;QACnB,OAAOzC;IACT;IAEA,MAAM4C,2BACJ/C,OAAOgD,oBAAoB,KAAK7C,YAC5BA,YACAL,4BAA4B;QAC1BwB,QAAQtB,OAAOsB,MAAM;QACrBoB,YAAY1C,OAAOU,OAAO,CAACgC,UAAU;QACrC3B,OAAOf,OAAOe,KAAK;QACnBa,MAAM5B,OAAO4B,IAAI;QACjBoB,sBAAsBhD,OAAOgD,oBAAoB;IACnD;IACN,IAAID,6BAA6B5C,WAAW;QAC1CH,OAAOiB,MAAM,CAACC,IAAI,CAAC6B;QACnB,OAAO5C;IACT;IAEA,MAAM8C,oBAAoBC,uBAAuBlD,OAAOU,OAAO,EAAEV,OAAOe,KAAK,EAAEkB;IAC/E,IAAIgB,kBAAkB1C,MAAM,GAAG,GAAG;QAChCP,OAAOiB,MAAM,CAACC,IAAI,CAChBoB,sBAAsB;YAAC,GAAGtC,MAAM;YAAE+B;YAAcM,eAAeY;QAAiB;QAElF,OAAO9C;IACT;IAEA,IAAIgC,aAAa5B,MAAM,GAAG,GAAG;QAC3BP,OAAOiB,MAAM,CAACC,IAAI,CAChBM,MAAM;YACJC,MAAM;YACNC,SAAS,GAAGC,WAAW3B,OAAOe,KAAK,EAAE,0CAA0C,EAAEoC,WAC/EhB,cACA,CAAC,CAAC;YACJP,MAAM5B,OAAO4B,IAAI;YACjBC,SAAS;gBACPd,OAAOf,OAAOe,KAAK;gBACnBO,QAAQtB,OAAOsB,MAAM;gBACrBoB,YAAY1C,OAAOU,OAAO,CAACgC,UAAU,CAACpB,MAAM;gBAC5CS;gBACAI;YACF;QACF;QAEF,OAAOhC;IACT;IAEA,MAAMiD,WAAWpD,OAAOoD,QAAQ;IAChC,IAAIA,aAAajD,WAAW;QAC1B,MAAMkD,cAAcpB,WAAW5B,MAAM,CAAC,CAAC+B,OAASlD,uBAAuBkD,UAAU;QACjF,MAAMkB,mBAAmB7D,mBAAmB4D,aAAaD;QACzD,IAAIE,iBAAiB/C,MAAM,GAAG,GAAG;YAC/BP,OAAOiB,MAAM,CAACC,IAAI,CAChBqC,wBAAwB;gBAAC,GAAGvD,MAAM;gBAAE+B;gBAAcuB;gBAAkBF;YAAQ;YAE9E,OAAOjD;QACT;IACF;IAEA,IACEH,OAAOwD,WAAW,KAAKrD,aACtB8B,CAAAA,WAAW1B,MAAM,KAAK,KAAK0B,WAAWwB,IAAI,CAAC,CAACrB,OAASsB,uBAAuBtB,MAAK,GAClF;QACA,OAAOpC,OAAOU,OAAO;IACvB;IAEA,IAAI;QACF,OAAO;YACL,GAAGV,OAAOU,OAAO;YACjBgC,YAAY5D,yBAAyB;gBACnCwC,QAAQtB,OAAOU,OAAO,CAACgC,UAAU,CAACpB,MAAM;gBACxCqC,OAAO;oBACLC,MAAM;oBACN,sEAAsE;oBACtE,0EAA0E;oBAC1EC,iBAAiBC,sBAAsB7B,YAAYjC,OAAOwD,WAAW;gBACvE;YACF;QACF;IACF,EAAE,OAAOjC,OAAO;QACdvB,OAAOiB,MAAM,CAACC,IAAI,CAChBM,MAAM;YACJC,MAAM;YACNC,SAAS,GAAGC,WAAW3B,OAAOe,KAAK,EAAE,6CAA6C,CAAC;YACnFa,MAAM5B,OAAO4B,IAAI;YACjBC,SAAS;gBACPd,OAAOf,OAAOe,KAAK;gBACnBO,QAAQtB,OAAOsB,MAAM;gBACrBoB,YAAY1C,OAAOU,OAAO,CAACgC,UAAU,CAACpB,MAAM;gBAC5CS;gBACAD,QACEP,iBAAiBlC,iCACbkC,MAAMO,MAAM,GACZ;YACR;QACF;QAEF,OAAO3B;IACT;AACF;AAEA,SAAS+C,uBACPxC,OAAoC,EACpCK,KAA+B,EAC/BkB,UAA0C;IAE1C,IAAI,CAAC8B,mBAAmBhD,QAAQ,OAAO,EAAE;IAEzC,MAAMiD,uBAAuB,IAAIC;IACjC,KAAK,MAAM7B,QAAQH,WAAY;QAC7B,MAAMiC,QAAQ9E,iCAAiCgD;QAC/C,IAAI8B,UAAU/D,aAAa+D,MAAM3D,MAAM,KAAK,GAAG;QAC/CyD,qBAAqBG,GAAG,CAAC/B,MAAM8B;IACjC;IACA,IAAIjC,WAAWmC,QAAQ,CAAC,UAAU;QAChCJ,qBAAqBG,GAAG,CAAC,SAAS;eAC7B,IAAIE,IAAI;mBAAKL,qBAAqBM,GAAG,CAAC,YAAY,EAAE;gBAAG;aAAU;SACrE;IACH;IACA,IAAIN,qBAAqBO,IAAI,KAAK,GAAG,OAAO,EAAE;IAE9C,OAAOxF,gCAAgC;QACrCuC,QAAQZ,QAAQgC,UAAU,CAACpB,MAAM;QACjC0C;IACF,GAAG3D,MAAM,CAAC6B;AACZ;AAEA,SAAS6B,mBAAmBhD,KAA+B;IACzD,OAAO,CAAClB,2CAA2CkB,OAAO;AAC5D;AAEA,SAASuB,sBAAsBtC,MAM9B;IACC,OAAOwB,MAAM;QACXC,MAAM;QACNC,SACE1B,OAAOe,KAAK,KAAK,QACb,CAAC,uDAAuD,EAAEoC,WACxDnD,OAAOqC,aAAa,EACpB,iFAAiF,CAAC,GACpF,GAAGV,WAAW3B,OAAOe,KAAK,EAAE,4CAA4C,EAAEoC,WACxEnD,OAAOqC,aAAa,EACpB,CAAC,CAAC;QACVT,MAAM5B,OAAO4B,IAAI;QACjBC,SAAS;YACPd,OAAOf,OAAOe,KAAK;YACnBO,QAAQtB,OAAOsB,MAAM;YACrBS,cAAc/B,OAAO+B,YAAY;YACjCM,eAAerC,OAAOqC,aAAa;QACrC;IACF;AACF;AAEA,SAASG,0BAA0BxC,MAMlC;IACC,OAAOwB,MAAM;QACXC,MAAM;QACNC,SAAS,GAAGC,WAAW3B,OAAOe,KAAK,EAAE,yCAAyC,EAAEoC,WAC9EnD,OAAOuC,iBAAiB,EACxB,+CAA+C,CAAC;QAClDX,MAAM5B,OAAO4B,IAAI;QACjBC,SAAS;YACPd,OAAOf,OAAOe,KAAK;YACnBO,QAAQtB,OAAOsB,MAAM;YACrBS,cAAc/B,OAAO+B,YAAY;YACjCM,eAAerC,OAAOuC,iBAAiB;QACzC;IACF;AACF;AAEA,SAASI,wBAAwB3C,MAOhC;IACC,OAAOwB,MAAM;QACXC,MAAM;QACNC,SAAS,GAAGC,WAAW3B,OAAOe,KAAK,EAAE,8BAA8B,EAAEf,OAAOoC,IAAI,CAAC,wBAAwB,CAAC;QAC1GR,MAAM5B,OAAO4B,IAAI;QACjBC,SAAS;YACPd,OAAOf,OAAOe,KAAK;YACnBO,QAAQtB,OAAOsB,MAAM;YACrBoB,YAAY1C,OAAO0C,UAAU;YAC7BX,cAAc/B,OAAO+B,YAAY;YACjCK,MAAMpC,OAAOoC,IAAI;QACnB;IACF;AACF;AAEA,SAASS,6BAA6B7C,MAOrC;IACC,KAAK,MAAMwE,aAAaxE,OAAO8C,UAAU,CAAE;QACzC,IAAI,CAACnE,gBAAgB8F,SAAS,CAACD,UAAUE,GAAG,EAAEC,OAAO,EAAE;YACrD,OAAOhC,wBAAwB;gBAC7B,GAAG3C,MAAM;gBACToC,MAAMoC,UAAUpC,IAAI;gBACpBM,YAAY1C,OAAOU,OAAO,CAACgC,UAAU,CAACpB,MAAM;YAC9C;QACF;QAEA,IAAIkD,UAAUpC,IAAI,KAAK,aAAaoC,UAAUI,KAAK,KAAKzE,WAAW;QACnE,IAAIvB,kBAAkB6F,SAAS,CAACD,UAAUI,KAAK,EAAED,OAAO,EAAE;QAE1D,OAAOnD,MAAM;YACXC,MAAM;YACNC,SAAS,GAAGC,WAAW3B,OAAOe,KAAK,EAAE,gDAAgD,EAAEyD,UAAUI,KAAK,CAAC,EAAE,CAAC;YAC1GhD,MAAM5B,OAAO4B,IAAI;YACjBC,SAAS;gBACPd,OAAOf,OAAOe,KAAK;gBACnBO,QAAQtB,OAAOsB,MAAM;gBACrBoB,YAAY1C,OAAOU,OAAO,CAACgC,UAAU,CAACpB,MAAM;gBAC5CS,cAAc/B,OAAO+B,YAAY;gBACjC6C,OAAOJ,UAAUI,KAAK;YACxB;QACF;IACF;IAEA,OAAOzE;AACT;AAEA,MAAM0E,yBAAyB;IAC7BC,QAAQ;IACR,gBAAgB;IAChB,sBAAsB;IACtB,kBAAkB;IAClB,iBAAiB;IACjB,eAAe;IACf,wBAAwB;IACxB,kBAAkB;AACpB;AAEA,SAASvB,wBAAwBvD,MAQhC;IACC,OAAOwB,MAAM;QACXC,MAAM;QACNC,SAAS,GAAGC,WAAW3B,OAAOe,KAAK,EAAE,0BAA0B,EAAEgE,YAC/D/E,OAAOsD,gBAAgB,EACvB,CAAC,EAAEH,WAAWnD,OAAOsD,gBAAgB,EAAE,MAAM,EAAE0B,iBAC/ChF,OAAOsD,gBAAgB,EACvB,kBAAkB,EAAE2B,yBAAyBjF,OAAOoD,QAAQ,EAAE,EAAE,EAAEpD,OAAOsD,gBAAgB,CACxF7C,GAAG,CAACyE,oCACJC,IAAI,CAAC,MAAM;QACdvD,MAAM5B,OAAO4B,IAAI;QACjBC,SAAS;YACPd,OAAOf,OAAOe,KAAK;YACnBO,QAAQtB,OAAOsB,MAAM;YACrBoB,YAAY1C,OAAOU,OAAO,CAACgC,UAAU,CAACpB,MAAM;YAC5CS,cAAc/B,OAAO+B,YAAY;YACjCuB,kBAAkBtD,OAAOsD,gBAAgB;YACzCF,UAAUpD,OAAOoD,QAAQ;QAC3B;IACF;AACF;AAEA,SAAS/B,mBACPrB,MAIC,EACDoB,SAAwB;IAExB,IAAIA,UAAUU,MAAM,KAAK,wBAAwB;QAC/C,OAAON,MAAM;YACXC,MAAM;YACNC,SAAS,GAAGC,WAAW3B,OAAOe,KAAK,EAAE,8BAA8B,EAAEoC,WACnE/B,UAAUW,YAAY,IAAI,EAAE,EAC5B,wBAAwB,CAAC;YAC3BH,MAAM5B,OAAO4B,IAAI;YACjBC,SAAS;gBACPd,OAAOf,OAAOe,KAAK;gBACnBO,QAAQtB,OAAOsB,MAAM;gBACrBoB,YAAYtB,UAAUE,MAAM;gBAC5BS,cAAcX,UAAUW,YAAY;YACtC;QACF;IACF;IAEA,OAAOP,MAAM;QACXC,MAAM;QACNC,SAAS,GAAGC,WAAW3B,OAAOe,KAAK,EAAE,iEAAiE,EAAEK,UAAUgE,IAAI,CAAC,CAAC,CAAC;QACzHxD,MAAM5B,OAAO4B,IAAI;QACjBC,SAAS;YACPd,OAAOf,OAAOe,KAAK;YACnBO,QAAQtB,OAAOsB,MAAM;YACrBoB,YAAYtB,UAAUE,MAAM;YAC5B+D,aAAajE,UAAUiE,WAAW,IAAI,EAAE;QAC1C;IACF;AACF;AAEA,SAASN,YAAYO,KAAqC;IACxD,OAAOA,MAAM/E,MAAM,KAAK,IAAI,YAAY;AAC1C;AAEA,SAASyE,iBAAiBM,KAAqC;IAC7D,OAAOA,MAAM/E,MAAM,KAAK,IAAI,OAAO;AACrC;AAEA,SAAS2E,mCAAmC9C,IAAyB;IACnE,MAAMmD,eAAevG,+BAA+BoD;IACpD,IAAImD,iBAAiBpF,WAAW,OAAO,CAAC,CAAC,EAAEiC,KAAK,sCAAsC,CAAC;IACvF,OAAO,CAAC,CAAC,EAAEA,KAAK,uBAAuB,EAAE6C,yBAAyBM,cAAc,CAAC,CAAC;AACpF;AAEA,SAASN,yBAAyBO,IAAsB;IACtD,OAAOX,sBAAsB,CAACW,KAAK;AACrC;AAEA,SAAS9B,uBAAuBtB,IAAyB;IACvD,OAAOnD,6BAA6BmD,MAAMqD,SAAS,KAAK;AAC1D;AAEA,SAAS3B,sBACPwB,KAAqC,EACrC9B,WAAuC;IAEvC,MAAMK,kBAAqE,CAAC;IAE5E,KAAK,MAAMzB,QAAQkD,MAAO;QACxB,MAAMI,cAAclC,aAAa,CAACpB,KAAK;QACvC,IAAIsD,gBAAgBvF,WAAW;YAC7B0D,eAAe,CAACzB,KAAK,GAAGsD;YACxB;QACF;QAEA,MAAMC,yBAAyBxG,kCAAkCiD;QACjE,IAAIuD,2BAA2BxF,WAAW;YACxC,IAAIqD,gBAAgBrD,WAAW0D,eAAe,CAACzB,KAAK,GAAG;gBAACzB,MAAM;YAAK;YACnE;QACF;QAEAiF,OAAOC,MAAM,CAAChC,iBAAiB8B;IACjC;IAEA,OAAO9B;AACT;AAEA,SAASvD,oBACPI,OAAgC;IAEhC,OAAOA,QAAQC,IAAI,KAAK;AAC1B;AAEA,SAASuB,sBAAsBE,IAAY;IACzC,OAAO,AAAC1C,qBAA2C0E,QAAQ,CAAChC;AAC9D;AAEA,SAASJ,cAAc8D,MAAyB;IAC9C,OAAO;WAAI,IAAIzB,IAAIyB;KAAQ;AAC7B;AAEA,SAAS3C,WAAW2C,MAAyB;IAC3C,OAAOA,OAAOrF,GAAG,CAAC,CAACsF,QAAU,CAAC,CAAC,EAAEA,MAAM,CAAC,CAAC,EAAEZ,IAAI,CAAC;AAClD;AAEA,SAASxD,WAAWZ,KAAiC;IACnD,OAAO,CAAC,SAAS,EAAEA,OAAO;AAC5B;AAEA,SAASS,MAAMxB,MAKd;IACC,IAAIA,OAAO6B,OAAO,KAAK1B,WAAW;QAChC,OAAO;YACLsB,MAAMzB,OAAOyB,IAAI;YACjBC,SAAS1B,OAAO0B,OAAO;YACvBE,MAAM5B,OAAO4B,IAAI;QACnB;IACF;IAEA,OAAO;QACLH,MAAMzB,OAAOyB,IAAI;QACjBC,SAAS1B,OAAO0B,OAAO;QACvBE,MAAM5B,OAAO4B,IAAI;QACjBC,SAAS7B,OAAO6B,OAAO;IACzB;AACF"}

package/dist/core/workflow-model/stable-id.d.ts

@@ -0,0 +1,2 @@
+export declare function stableId(sourceName: string): string;
+//# sourceMappingURL=stable-id.d.ts.map

package/dist/core/workflow-model/stable-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stable-id.d.ts","sourceRoot":"","sources":["../../../src/core/workflow-model/stable-id.ts"],"names":[],"mappings":"AAGA,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAQnD"}

package/dist/core/workflow-model/stable-id.js

@@ -0,0 +1,8 @@
+const nonStableIdPattern = /[^a-z0-9]+/g;
+const edgeDashPattern = /^-+|-+$/g;
+export function stableId(sourceName) {
+    const id = sourceName.trim().toLowerCase().replace(nonStableIdPattern, '-').replace(edgeDashPattern, '');
+    return id.length === 0 ? 'unnamed' : id;
+}
+
+//# sourceMappingURL=stable-id.js.map

package/dist/core/workflow-model/stable-id.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/core/workflow-model/stable-id.ts"],"sourcesContent":["const nonStableIdPattern = /[^a-z0-9]+/g;\nconst edgeDashPattern = /^-+|-+$/g;\n\nexport function stableId(sourceName: string): string {\n  const id = sourceName\n    .trim()\n    .toLowerCase()\n    .replace(nonStableIdPattern, '-')\n    .replace(edgeDashPattern, '');\n\n  return id.length === 0 ? 'unnamed' : id;\n}\n"],"names":["nonStableIdPattern","edgeDashPattern","stableId","sourceName","id","trim","toLowerCase","replace","length"],"mappings":"AAAA,MAAMA,qBAAqB;AAC3B,MAAMC,kBAAkB;AAExB,OAAO,SAASC,SAASC,UAAkB;IACzC,MAAMC,KAAKD,WACRE,IAAI,GACJC,WAAW,GACXC,OAAO,CAACP,oBAAoB,KAC5BO,OAAO,CAACN,iBAAiB;IAE5B,OAAOG,GAAGI,MAAM,KAAK,IAAI,YAAYJ;AACvC"}

package/dist/core/workflow-model/validate-job-references.d.ts

@@ -0,0 +1,10 @@
+import { type WorkflowExpression, type WorkflowInterpolationField, type WorkflowPredicateField } from '@shipfox/expression';
+import type { WorkflowModelValidationIssue, WorkflowModelValidationIssuePathSegment } from './invalid-workflow-model-error.js';
+export declare function validateDirectJobReferences(params: {
+    source: string;
+    expression: WorkflowExpression;
+    field: WorkflowInterpolationField | WorkflowPredicateField;
+    path: readonly WorkflowModelValidationIssuePathSegment[];
+    allowedJobReferences: ReadonlySet<string>;
+}): WorkflowModelValidationIssue | undefined;
+//# sourceMappingURL=validate-job-references.d.ts.map

package/dist/core/workflow-model/validate-job-references.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-job-references.d.ts","sourceRoot":"","sources":["../../../src/core/workflow-model/validate-job-references.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EACV,4BAA4B,EAC5B,uCAAuC,EACxC,MAAM,mCAAmC,CAAC;AAI3C,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,kBAAkB,CAAC;IAC/B,KAAK,EAAE,0BAA0B,GAAG,sBAAsB,CAAC;IAC3D,IAAI,EAAE,SAAS,uCAAuC,EAAE,CAAC;IACzD,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC3C,GAAG,4BAA4B,GAAG,SAAS,CAkC3C"}

package/dist/core/workflow-model/validate-job-references.js

@@ -0,0 +1,42 @@
+import { analyzeContextRootKeyAccess } from '@shipfox/expression';
+import { issue } from './validation-issue.js';
+import { workflowFieldLabel } from './workflow-field-label.js';
+export function validateDirectJobReferences(params) {
+    const access = analyzeContextRootKeyAccess(params.expression, [
+        'jobs'
+    ]);
+    const [computed] = access.violations;
+    if (computed !== undefined) {
+        return issue({
+            code: 'computed-context-key',
+            message: `${workflowFieldLabel(params.field)} must reference jobs with a literal dot key.`,
+            path: params.path,
+            details: {
+                field: params.field,
+                source: params.source,
+                expression: computed.source,
+                contextRoots: [
+                    'jobs'
+                ]
+            }
+        });
+    }
+    const missing = access.references.find((reference)=>!params.allowedJobReferences.has(reference.key));
+    if (missing === undefined) return undefined;
+    return issue({
+        code: 'missing-job-needs-edge',
+        message: `${workflowFieldLabel(params.field)} references job "${missing.key}" without a direct needs edge.`,
+        path: params.path,
+        details: {
+            field: params.field,
+            source: params.source,
+            expression: params.expression.source,
+            job: missing.key,
+            allowedJobs: [
+                ...params.allowedJobReferences
+            ]
+        }
+    });
+}
+
+//# sourceMappingURL=validate-job-references.js.map

package/dist/core/workflow-model/validate-job-references.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/core/workflow-model/validate-job-references.ts"],"sourcesContent":["import {\n  analyzeContextRootKeyAccess,\n  type WorkflowExpression,\n  type WorkflowInterpolationField,\n  type WorkflowPredicateField,\n} from '@shipfox/expression';\nimport type {\n  WorkflowModelValidationIssue,\n  WorkflowModelValidationIssuePathSegment,\n} from './invalid-workflow-model-error.js';\nimport {issue} from './validation-issue.js';\nimport {workflowFieldLabel} from './workflow-field-label.js';\n\nexport function validateDirectJobReferences(params: {\n  source: string;\n  expression: WorkflowExpression;\n  field: WorkflowInterpolationField | WorkflowPredicateField;\n  path: readonly WorkflowModelValidationIssuePathSegment[];\n  allowedJobReferences: ReadonlySet<string>;\n}): WorkflowModelValidationIssue | undefined {\n  const access = analyzeContextRootKeyAccess(params.expression, ['jobs']);\n  const [computed] = access.violations;\n  if (computed !== undefined) {\n    return issue({\n      code: 'computed-context-key',\n      message: `${workflowFieldLabel(params.field)} must reference jobs with a literal dot key.`,\n      path: params.path,\n      details: {\n        field: params.field,\n        source: params.source,\n        expression: computed.source,\n        contextRoots: ['jobs'],\n      },\n    });\n  }\n\n  const missing = access.references.find(\n    (reference) => !params.allowedJobReferences.has(reference.key),\n  );\n  if (missing === undefined) return undefined;\n\n  return issue({\n    code: 'missing-job-needs-edge',\n    message: `${workflowFieldLabel(params.field)} references job \"${missing.key}\" without a direct needs edge.`,\n    path: params.path,\n    details: {\n      field: params.field,\n      source: params.source,\n      expression: params.expression.source,\n      job: missing.key,\n      allowedJobs: [...params.allowedJobReferences],\n    },\n  });\n}\n"],"names":["analyzeContextRootKeyAccess","issue","workflowFieldLabel","validateDirectJobReferences","params","access","expression","computed","violations","undefined","code","message","field","path","details","source","contextRoots","missing","references","find","reference","allowedJobReferences","has","key","job","allowedJobs"],"mappings":"AAAA,SACEA,2BAA2B,QAItB,sBAAsB;AAK7B,SAAQC,KAAK,QAAO,wBAAwB;AAC5C,SAAQC,kBAAkB,QAAO,4BAA4B;AAE7D,OAAO,SAASC,4BAA4BC,MAM3C;IACC,MAAMC,SAASL,4BAA4BI,OAAOE,UAAU,EAAE;QAAC;KAAO;IACtE,MAAM,CAACC,SAAS,GAAGF,OAAOG,UAAU;IACpC,IAAID,aAAaE,WAAW;QAC1B,OAAOR,MAAM;YACXS,MAAM;YACNC,SAAS,GAAGT,mBAAmBE,OAAOQ,KAAK,EAAE,4CAA4C,CAAC;YAC1FC,MAAMT,OAAOS,IAAI;YACjBC,SAAS;gBACPF,OAAOR,OAAOQ,KAAK;gBACnBG,QAAQX,OAAOW,MAAM;gBACrBT,YAAYC,SAASQ,MAAM;gBAC3BC,cAAc;oBAAC;iBAAO;YACxB;QACF;IACF;IAEA,MAAMC,UAAUZ,OAAOa,UAAU,CAACC,IAAI,CACpC,CAACC,YAAc,CAAChB,OAAOiB,oBAAoB,CAACC,GAAG,CAACF,UAAUG,GAAG;IAE/D,IAAIN,YAAYR,WAAW,OAAOA;IAElC,OAAOR,MAAM;QACXS,MAAM;QACNC,SAAS,GAAGT,mBAAmBE,OAAOQ,KAAK,EAAE,iBAAiB,EAAEK,QAAQM,GAAG,CAAC,8BAA8B,CAAC;QAC3GV,MAAMT,OAAOS,IAAI;QACjBC,SAAS;YACPF,OAAOR,OAAOQ,KAAK;YACnBG,QAAQX,OAAOW,MAAM;YACrBT,YAAYF,OAAOE,UAAU,CAACS,MAAM;YACpCS,KAAKP,QAAQM,GAAG;YAChBE,aAAa;mBAAIrB,OAAOiB,oBAAoB;aAAC;QAC/C;IACF;AACF"}

package/dist/core/workflow-model/validate-predicate-expression.d.ts

@@ -0,0 +1,14 @@
+import { type AvailabilitySite, type ExpressionTypeEnvironment, type WorkflowExpression, type WorkflowPredicateField } from '@shipfox/expression';
+import type { WorkflowModelValidationIssue, WorkflowModelValidationIssueCode, WorkflowModelValidationIssuePathSegment } from './invalid-workflow-model-error.js';
+export declare function validatePredicateExpression(params: {
+    field: WorkflowPredicateField;
+    source: string;
+    site: AvailabilitySite;
+    path: readonly WorkflowModelValidationIssuePathSegment[];
+    invalidCode: WorkflowModelValidationIssueCode;
+    invalidMessage: string;
+    issues: WorkflowModelValidationIssue[];
+    allowedJobReferences?: ReadonlySet<string>;
+    typeOverlay?: ExpressionTypeEnvironment | undefined;
+}): WorkflowExpression | undefined;
+//# sourceMappingURL=validate-predicate-expression.d.ts.map

package/dist/core/workflow-model/validate-predicate-expression.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-predicate-expression.d.ts","sourceRoot":"","sources":["../../../src/core/workflow-model/validate-predicate-expression.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,gBAAgB,EAIrB,KAAK,yBAAyB,EAW9B,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAE5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EACV,4BAA4B,EAC5B,gCAAgC,EAChC,uCAAuC,EACxC,MAAM,mCAAmC,CAAC;AAK3C,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IAClD,KAAK,EAAE,sBAAsB,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,EAAE,SAAS,uCAAuC,EAAE,CAAC;IACzD,WAAW,EAAE,gCAAgC,CAAC;IAC9C,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,4BAA4B,EAAE,CAAC;IACvC,oBAAoB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3C,WAAW,CAAC,EAAE,yBAAyB,GAAG,SAAS,CAAC;CACrD,GAAG,kBAAkB,GAAG,SAAS,CAqHjC"}