@transitrix/diagrams 1.6.0 → 1.7.6

package/dist/codex/__tests__/example.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/codex/__tests__/example.test.js

@@ -0,0 +1,33 @@
+// Conformance test for CODEX worked examples under
+// `tests/fixtures/notation-corpus/codex/` — pins #518 Phase C2 corpus signal.
+import { describe, it, expect } from 'vitest';
+import { readFileSync, readdirSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+import yaml from 'js-yaml';
+import { validateCodex, folderJurisdictionFromPath } from '../validate.js';
+const corpusRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../../../../tests/fixtures/notation-corpus/codex');
+function codexFixturePaths() {
+    const out = [];
+    for (const zone of ['external/EU', 'internal']) {
+        const dir = path.join(corpusRoot, zone);
+        for (const f of readdirSync(dir).filter((x) => x.endsWith('.yaml'))) {
+            const rel = path.join('codex', zone, f).replace(/\\/g, '/');
+            out.push({
+                rel,
+                folderJurisdiction: folderJurisdictionFromPath(rel),
+            });
+        }
+    }
+    return out;
+}
+describe('codex worked examples (notation-corpus)', () => {
+    for (const { rel, folderJurisdiction } of codexFixturePaths()) {
+        it(`validates ${rel} without error`, () => {
+            const data = yaml.load(readFileSync(path.join(corpusRoot, rel.replace(/^codex\//, '')), 'utf-8'));
+            const v = validateCodex(data, { folderJurisdiction });
+            expect(v.valid, JSON.stringify(v.errors)).toBe(true);
+            expect(v.errors).toHaveLength(0);
+        });
+    }
+});

package/dist/codex/__tests__/validate.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/codex/__tests__/validate.test.js

@@ -0,0 +1,68 @@
+import { describe, it, expect } from 'vitest';
+import { validateCodex, isCodexDoc, folderJurisdictionFromPath, } from '../validate.js';
+const VALID_EXTERNAL = {
+    zone: 'codex',
+    id: 'LAW-GDPR-1',
+    name: 'General Data Protection Regulation',
+    type: 'LAW',
+    jurisdiction: 'eu',
+    effective_date: '2018-05-25',
+    admitted_at: '2026-06-01',
+    admitted_by: 'legal.team',
+    gate_checks: { uniqueness: 'pass' },
+};
+const VALID_INTERNAL = {
+    zone: 'codex',
+    id: 'INTERNAL_STANDARD-coding-conventions-1',
+    name: 'Engineering Coding Conventions',
+    type: 'INTERNAL_STANDARD',
+    issuing_authority: 'VP Engineering',
+    effective_date: '2026-01-01',
+    admitted_at: '2026-05-27',
+    admitted_by: 'vp.engineering',
+    gate_checks: { source_authority: 'VP Engineering' },
+};
+describe('validateCodex', () => {
+    it('accepts a valid external artefact', () => {
+        const r = validateCodex(VALID_EXTERNAL, { folderJurisdiction: 'eu' });
+        expect(r.valid, JSON.stringify(r.errors)).toBe(true);
+    });
+    it('accepts a valid internal artefact', () => {
+        expect(validateCodex(VALID_INTERNAL).valid).toBe(true);
+    });
+    it('CODEX-001 rejects non-mapping input', () => {
+        expect(validateCodex(null).errors.some((e) => e.code === 'CODEX-001')).toBe(true);
+    });
+    it('CODEX-001 rejects wrong zone', () => {
+        const r = validateCodex({ ...VALID_EXTERNAL, zone: 'canon' });
+        expect(r.errors.some((e) => e.code === 'CODEX-001' && e.path === 'zone')).toBe(true);
+    });
+    it('CODEX-002 rejects type/id prefix mismatch', () => {
+        const r = validateCodex({ ...VALID_EXTERNAL, type: 'REGULATION' });
+        expect(r.errors.some((e) => e.code === 'CODEX-002')).toBe(true);
+    });
+    it('CODEX-003 requires jurisdiction on external artefacts', () => {
+        const r = validateCodex({ ...VALID_EXTERNAL, jurisdiction: '' });
+        expect(r.errors.some((e) => e.code === 'CODEX-003' && e.path === 'jurisdiction')).toBe(true);
+    });
+    it('CODEX-005 enforces folder jurisdiction match', () => {
+        const r = validateCodex(VALID_EXTERNAL, { folderJurisdiction: 'ge' });
+        expect(r.errors.some((e) => e.code === 'CODEX-005')).toBe(true);
+    });
+    it('CODEX-004 requires issuing_authority on internal artefacts', () => {
+        const r = validateCodex({ ...VALID_INTERNAL, issuing_authority: '' });
+        expect(r.errors.some((e) => e.code === 'CODEX-004')).toBe(true);
+    });
+});
+describe('isCodexDoc', () => {
+    it('detects zone: codex', () => {
+        expect(isCodexDoc({ zone: 'codex', id: 'LAW-1' })).toBe(true);
+        expect(isCodexDoc({ zone: 'canon' })).toBe(false);
+    });
+});
+describe('folderJurisdictionFromPath', () => {
+    it('parses codex/external/<jurisdiction>/ paths', () => {
+        expect(folderJurisdictionFromPath('codex/external/eu/LAW-GDPR-1.yaml')).toBe('eu');
+        expect(folderJurisdictionFromPath('codex/internal/POLICY-1.yaml')).toBeUndefined();
+    });
+});

package/dist/codex/index.d.ts

@@ -0,0 +1,4 @@
+export { CODEX_ARTEFACT_TYPES, EXTERNAL_CODEX_TYPES, INTERNAL_CODEX_TYPES } from './types.js';
+export type { CodexArtefactType } from './types.js';
+export { validateCodex, isCodexDoc, folderJurisdictionFromPath } from './validate.js';
+export type { CodexValidateOptions } from './validate.js';

package/dist/codex/index.js

@@ -0,0 +1,2 @@
+export { CODEX_ARTEFACT_TYPES, EXTERNAL_CODEX_TYPES, INTERNAL_CODEX_TYPES } from './types.js';
+export { validateCodex, isCodexDoc, folderJurisdictionFromPath } from './validate.js';

package/dist/codex/types.d.ts

@@ -0,0 +1,7 @@
+/** TYPE prefixes admitted in the codex zone (REQ-003 / 14-codex.md). */
+export declare const CODEX_ARTEFACT_TYPES: readonly ["LAW", "REGULATION", "POLICY", "INTERNAL_STANDARD"];
+export type CodexArtefactType = (typeof CODEX_ARTEFACT_TYPES)[number];
+/** External codex artefacts (codex/external/<jurisdiction>/). */
+export declare const EXTERNAL_CODEX_TYPES: readonly CodexArtefactType[];
+/** Internal codex artefacts (codex/internal/). */
+export declare const INTERNAL_CODEX_TYPES: readonly CodexArtefactType[];

package/dist/codex/types.js

@@ -0,0 +1,8 @@
+// Codex artefact — external laws/regulations and internal policies/standards.
+// Schema: methodology notations/elements/14-codex.md §3–§4.
+/** TYPE prefixes admitted in the codex zone (REQ-003 / 14-codex.md). */
+export const CODEX_ARTEFACT_TYPES = ['LAW', 'REGULATION', 'POLICY', 'INTERNAL_STANDARD'];
+/** External codex artefacts (codex/external/<jurisdiction>/). */
+export const EXTERNAL_CODEX_TYPES = ['LAW', 'REGULATION'];
+/** Internal codex artefacts (codex/internal/). */
+export const INTERNAL_CODEX_TYPES = ['POLICY', 'INTERNAL_STANDARD'];

package/dist/codex/validate.d.ts

@@ -0,0 +1,11 @@
+import type { ValidationResult } from '../validation-types.js';
+export interface CodexValidateOptions {
+    /** Lowercased jurisdiction folder segment from `codex/external/<jurisdiction>/`. */
+    folderJurisdiction?: string;
+}
+export declare function validateCodex(input: unknown, options?: CodexValidateOptions): ValidationResult;
+/** True when a parsed document is a codex-zone artefact candidate. */
+export declare function isCodexDoc(data: unknown): boolean;
+/** Infer codex folder jurisdiction from a repo-relative path such as
+ *  `codex/external/eu/LAW-GDPR-1.yaml` → `eu`. */
+export declare function folderJurisdictionFromPath(filePath: string): string | undefined;

package/dist/codex/validate.js

@@ -0,0 +1,103 @@
+// CODEX validator — methodology notations/elements/14-codex.md §4.
+//
+// CODEX-001 — shape, zone, id grammar, admission envelope.
+// CODEX-002 — `type` field matches the id TYPE prefix when present.
+// CODEX-003 — external artefact frontmatter (jurisdiction, effective_date).
+// CODEX-004 — internal artefact frontmatter (issuing_authority, effective_date).
+// CODEX-005 — jurisdiction must match the parent folder under codex/external/
+//             (when `folderJurisdiction` is supplied by the repo sweep).
+import { isCanonicalId, typeOfId } from '../typed-id.js';
+import { CODEX_ARTEFACT_TYPES, EXTERNAL_CODEX_TYPES, INTERNAL_CODEX_TYPES, } from './types.js';
+function isCodexType(type) {
+    return type !== null && CODEX_ARTEFACT_TYPES.includes(type);
+}
+function normalizeType(value) {
+    if (typeof value !== 'string' || value.trim() === '')
+        return undefined;
+    return value.trim().toUpperCase();
+}
+export function validateCodex(input, options = {}) {
+    const errors = [];
+    const warnings = [];
+    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+        errors.push({ code: 'CODEX-001', message: 'Codex artefact must be a YAML mapping.' });
+        return { valid: false, errors, warnings };
+    }
+    const c = input;
+    if (c.zone !== 'codex') {
+        errors.push({ code: 'CODEX-001', message: 'zone must be the fixed value "codex".', path: 'zone' });
+    }
+    const idType = typeOfId(c.id);
+    if (!isCanonicalId(c.id) || !isCodexType(idType)) {
+        errors.push({
+            code: 'CODEX-001',
+            message: `id "${String(c.id)}" must be a typed codex id (LAW, REGULATION, POLICY, or INTERNAL_STANDARD).`,
+            path: 'id',
+        });
+    }
+    if (typeof c.name !== 'string' || c.name.trim() === '') {
+        errors.push({ code: 'CODEX-001', message: 'name is required.', path: 'name' });
+    }
+    for (const field of ['admitted_at', 'admitted_by']) {
+        const v = c[field];
+        if (typeof v !== 'string' || v.trim() === '') {
+            errors.push({ code: 'CODEX-001', message: `${field} is required.`, path: field });
+        }
+    }
+    if (c.gate_checks === null || typeof c.gate_checks !== 'object' || Array.isArray(c.gate_checks)) {
+        errors.push({ code: 'CODEX-001', message: 'gate_checks is required and must be a mapping.', path: 'gate_checks' });
+    }
+    const declaredType = normalizeType(c.type);
+    if (declaredType !== undefined && idType && declaredType !== idType) {
+        errors.push({
+            code: 'CODEX-002',
+            message: `type "${String(c.type)}" does not match the id TYPE prefix "${idType}".`,
+            path: 'type',
+        });
+    }
+    const artefactType = (declaredType ?? idType);
+    if (artefactType && EXTERNAL_CODEX_TYPES.includes(artefactType)) {
+        const jurisdiction = typeof c.jurisdiction === 'string' ? c.jurisdiction.trim() : '';
+        if (!jurisdiction) {
+            errors.push({ code: 'CODEX-003', message: 'jurisdiction is required for external codex artefacts.', path: 'jurisdiction' });
+        }
+        else if (options.folderJurisdiction && jurisdiction.toLowerCase() !== options.folderJurisdiction.toLowerCase()) {
+            errors.push({
+                code: 'CODEX-005',
+                message: `jurisdiction "${jurisdiction}" must match the parent folder "${options.folderJurisdiction}" (CODEX-001).`,
+                path: 'jurisdiction',
+            });
+        }
+        if (typeof c.effective_date !== 'string' || c.effective_date.trim() === '') {
+            errors.push({ code: 'CODEX-003', message: 'effective_date is required for external codex artefacts.', path: 'effective_date' });
+        }
+    }
+    if (artefactType && INTERNAL_CODEX_TYPES.includes(artefactType)) {
+        if (typeof c.issuing_authority !== 'string' || c.issuing_authority.trim() === '') {
+            errors.push({
+                code: 'CODEX-004',
+                message: 'issuing_authority is required for internal codex artefacts.',
+                path: 'issuing_authority',
+            });
+        }
+        if (typeof c.effective_date !== 'string' || c.effective_date.trim() === '') {
+            errors.push({ code: 'CODEX-004', message: 'effective_date is required for internal codex artefacts.', path: 'effective_date' });
+        }
+    }
+    return { valid: errors.length === 0, errors, warnings };
+}
+/** True when a parsed document is a codex-zone artefact candidate. */
+export function isCodexDoc(data) {
+    if (data === null || typeof data !== 'object' || Array.isArray(data))
+        return false;
+    return data.zone === 'codex';
+}
+/** Infer codex folder jurisdiction from a repo-relative path such as
+ *  `codex/external/eu/LAW-GDPR-1.yaml` → `eu`. */
+export function folderJurisdictionFromPath(filePath) {
+    const parts = filePath.replace(/\\/g, '/').toLowerCase().split('/');
+    const extIdx = parts.indexOf('external');
+    if (extIdx < 0 || extIdx + 1 >= parts.length)
+        return undefined;
+    return parts[extIdx + 1] || undefined;
+}

package/dist/compliance/__tests__/canon-catalog.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/compliance/__tests__/canon-catalog.test.js

@@ -0,0 +1,60 @@
+import { describe, it, expect } from 'vitest';
+import { admitDocumentToCatalog, buildComplianceScan, catalogFromMap, } from '../canon-catalog.js';
+describe('buildComplianceScan', () => {
+    it('admits codex, requirement, and assertion ids into the catalogue', () => {
+        const docs = [
+            {
+                path: 'codex/external/ge/LAW-PERSONAL-DATA-2017-1.yaml',
+                data: {
+                    zone: 'codex',
+                    id: 'LAW-PERSONAL-DATA-2017-1',
+                    name: 'Law',
+                    type: 'LAW',
+                },
+            },
+            {
+                path: 'canon/elements/01_motivation/requirements/REQUIREMENT-DATA-ERASURE-1.yaml',
+                data: {
+                    notation: 'requirement',
+                    id: 'REQUIREMENT-DATA-ERASURE-1',
+                    name: 'Erasure',
+                    derived_from: ['LAW-PERSONAL-DATA-2017-1'],
+                },
+            },
+            {
+                path: 'canon/elements/02_business/products/PRODUCT-MOBILE-1.yaml',
+                data: { notation: 'product', id: 'PRODUCT-MOBILE-1', name: 'Mobile' },
+            },
+            {
+                path: 'canon/assertions/ASSERTION-MOBILE-DATA-ERASURE-1.yaml',
+                data: {
+                    notation: 'assertion',
+                    id: 'ASSERTION-MOBILE-DATA-ERASURE-1',
+                    about: 'REQUIREMENT-DATA-ERASURE-1',
+                    subject: 'PRODUCT-MOBILE-1',
+                    status: 'compliant',
+                },
+            },
+        ];
+        const { catalog, complianceCanon, pathById } = buildComplianceScan(docs);
+        expect(catalog.typeOf('LAW-PERSONAL-DATA-2017-1')).toBe('LAW');
+        expect(catalog.typeOf('REQUIREMENT-DATA-ERASURE-1')).toBe('REQUIREMENT');
+        expect(catalog.typeOf('PRODUCT-MOBILE-1')).toBe('PRODUCT');
+        expect(complianceCanon.requirements).toHaveLength(1);
+        expect(complianceCanon.assertions).toHaveLength(1);
+        expect(complianceCanon.codex).toHaveLength(1);
+        expect(pathById.get('REQUIREMENT-DATA-ERASURE-1')).toContain('requirements/');
+    });
+});
+describe('admitDocumentToCatalog', () => {
+    it('uses explicit codex type when the id prefix is ambiguous', () => {
+        const map = new Map();
+        admitDocumentToCatalog(map, {
+            zone: 'codex',
+            id: 'INTERNAL_STANDARD-coding-conventions-1',
+            type: 'INTERNAL_STANDARD',
+        });
+        const catalog = catalogFromMap(map);
+        expect(catalog.typeOf('INTERNAL_STANDARD-coding-conventions-1')).toBe('INTERNAL_STANDARD');
+    });
+});

package/dist/compliance/__tests__/view-resolution.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/compliance/__tests__/view-resolution.test.js

@@ -0,0 +1,59 @@
+import { describe, it, expect } from 'vitest';
+import { emptyCanon } from '../classify.js';
+import { catalogFromMap } from '../canon-catalog.js';
+import { collectImpactViewResolutionFindings } from '../impact.js';
+import { collectCoverageViewResolutionFindings } from '../coverage-metric.js';
+const catalog = catalogFromMap(new Map([
+    ['PRODUCT-ECOMM-1', 'PRODUCT'],
+    ['REQUIREMENT-GDPR-1', 'REQUIREMENT'],
+    ['LAW-GDPR-1', 'LAW'],
+]));
+const complianceCanon = emptyCanon();
+complianceCanon.products.push({ id: 'PRODUCT-ECOMM-1', name: 'E-Commerce' });
+complianceCanon.requirements.push({ id: 'REQUIREMENT-GDPR-1', name: 'GDPR req' });
+complianceCanon.codex.push({ id: 'LAW-GDPR-1', name: 'GDPR' });
+describe('collectImpactViewResolutionFindings', () => {
+    const base = {
+        id: 'test-impact',
+        name: 'Test',
+        subjects: { products: ['PRODUCT-ECOMM-1'], processes: [], capabilities: [] },
+        obligations: { filter: { derived_from_codex: ['LAW-GDPR-1'] } },
+        status_display: { show: ['compliant'] },
+        empty_cells: {},
+        order_rows_by: 'id',
+    };
+    it('passes when subjects and regimes resolve', () => {
+        expect(collectImpactViewResolutionFindings(base, catalog, complianceCanon)).toEqual([]);
+    });
+    it('flags unresolved subjects and regimes', () => {
+        const findings = collectImpactViewResolutionFindings({
+            ...base,
+            subjects: { products: ['PRODUCT-MISSING-1'], processes: [], capabilities: [] },
+            obligations: { include: ['REQUIREMENT-MISSING-1'], filter: { derived_from_codex: ['LAW-MISSING-1'] } },
+        }, catalog, complianceCanon);
+        expect(findings.some((f) => f.code === 'COMPIMP-REF' && f.message.includes('PRODUCT-MISSING-1'))).toBe(true);
+        expect(findings.some((f) => f.message.includes('REQUIREMENT-MISSING-1'))).toBe(true);
+        expect(findings.some((f) => f.message.includes('LAW-MISSING-1'))).toBe(true);
+    });
+});
+describe('collectCoverageViewResolutionFindings', () => {
+    const base = {
+        id: 'test-coverage',
+        name: 'Test',
+        thresholds: { green: 0.9, amber: 0.7 },
+        subjects: { products: ['PRODUCT-ECOMM-1'] },
+        regimes: { include: ['LAW-GDPR-1'] },
+    };
+    it('passes when products and regimes resolve', () => {
+        expect(collectCoverageViewResolutionFindings(base, catalog, complianceCanon)).toEqual([]);
+    });
+    it('flags unresolved product and regime refs', () => {
+        const findings = collectCoverageViewResolutionFindings({
+            ...base,
+            subjects: { products: ['PRODUCT-MISSING-1'] },
+            regimes: { include: ['LAW-MISSING-1'] },
+        }, catalog, complianceCanon);
+        expect(findings.some((f) => f.code === 'COVMET-REF')).toBe(true);
+        expect(findings).toHaveLength(2);
+    });
+});

package/dist/compliance/canon-catalog.d.ts

@@ -0,0 +1,19 @@
+import { type CanonCatalog } from '../typed-id.js';
+import { type ComplianceCanon } from './classify.js';
+export interface ScannedYamlDoc {
+    path: string;
+    data: unknown;
+}
+export interface ComplianceScanResult {
+    complianceCanon: ComplianceCanon;
+    catalog: CanonCatalog;
+    /** First path where each admitted id was seen (for gap-dashboard warnings). */
+    pathById: Map<string, string>;
+}
+/** Admit one parsed document into the id → TYPE map. */
+export declare function admitDocumentToCatalog(map: Map<string, string>, doc: unknown): string | undefined;
+/** Build a read-only `CanonCatalog` from a populated id → TYPE map. */
+export declare function catalogFromMap(map: Map<string, string>): CanonCatalog;
+/** Ingest compliance projections and admit cross-reference targets from a batch
+ *  of already-parsed YAML documents (no IO). */
+export declare function buildComplianceScan(docs: ScannedYamlDoc[]): ComplianceScanResult;

package/dist/compliance/canon-catalog.js

@@ -0,0 +1,59 @@
+// CanonCatalog builder — repo-scope cross-reference resolution (#518 Phase C3).
+//
+// Scans admitted YAML documents and builds the `{ typeOf }` catalogue that
+// `validateRequirement` / `validateAssertion` accept for REQ-002 and
+// ASSERT-002..005 resolution.
+import { typeOfId } from '../typed-id.js';
+import { emptyCanon, ingestComplianceDoc } from './classify.js';
+function strId(doc) {
+    if (doc === null || typeof doc !== 'object' || Array.isArray(doc))
+        return undefined;
+    const id = doc.id;
+    return typeof id === 'string' && id.trim() !== '' ? id.trim() : undefined;
+}
+/** Admit one parsed document into the id → TYPE map. */
+export function admitDocumentToCatalog(map, doc) {
+    const id = strId(doc);
+    if (!id)
+        return undefined;
+    const fromPrefix = typeOfId(id);
+    if (fromPrefix) {
+        map.set(id, fromPrefix);
+        return id;
+    }
+    if (doc !== null && typeof doc === 'object' && !Array.isArray(doc)) {
+        const d = doc;
+        if (d.zone === 'codex') {
+            const explicit = typeof d.type === 'string' ? d.type.trim().toUpperCase() : undefined;
+            if (explicit) {
+                map.set(id, explicit);
+                return id;
+            }
+        }
+    }
+    return undefined;
+}
+/** Build a read-only `CanonCatalog` from a populated id → TYPE map. */
+export function catalogFromMap(map) {
+    return { typeOf: (id) => map.get(id) };
+}
+/** Ingest compliance projections and admit cross-reference targets from a batch
+ *  of already-parsed YAML documents (no IO). */
+export function buildComplianceScan(docs) {
+    const complianceCanon = emptyCanon();
+    const catalogMap = new Map();
+    const pathById = new Map();
+    for (const { path, data } of docs) {
+        const ingested = ingestComplianceDoc(complianceCanon, data);
+        if (ingested)
+            pathById.set(ingested, path);
+        const admitted = admitDocumentToCatalog(catalogMap, data);
+        if (admitted && !pathById.has(admitted))
+            pathById.set(admitted, path);
+    }
+    return {
+        complianceCanon,
+        catalog: catalogFromMap(catalogMap),
+        pathById,
+    };
+}

package/dist/compliance/coverage-metric.d.ts

@@ -1,4 +1,5 @@
 import type { ComplianceCanon } from './classify.js';
+import type { CanonCatalog } from '../typed-id.js';
 /** Declarative filter resolved at build time from the canon's codex catalogue. */
 export interface CoverageMetricRegimesFilter {
     jurisdiction?: string[];
@@ -73,6 +74,17 @@ export interface CoverageMatrix {
     rows: CoverageRow[];
     thresholds: CoverageMetricThresholds;
 }
+/** Repo-scope cross-reference finding for a coverage-metric view (#518 C3). */
+export interface CoverageViewFinding {
+    code: string;
+    severity: 'error' | 'warning';
+    message: string;
+}
+/**
+ * Repo-scope cross-reference checks for a parsed coverage-metric view config.
+ * Surfaces unresolved product and regime ids before `buildCoverageMatrix` runs.
+ */
+export declare function collectCoverageViewResolutionFindings(config: CoverageMetricConfig, catalog: CanonCatalog, complianceCanon: ComplianceCanon): CoverageViewFinding[];
 /**
  * Parse and validate a raw (YAML-parsed) document into a `CoverageMetricConfig`.
  *

package/dist/compliance/coverage-metric.js

@@ -5,6 +5,41 @@
 // across the scoped products, and what is the RAG status against the configured
 // thresholds.
 import { buildComplianceIndex } from './reverse-index.js';
+/**
+ * Repo-scope cross-reference checks for a parsed coverage-metric view config.
+ * Surfaces unresolved product and regime ids before `buildCoverageMatrix` runs.
+ */
+export function collectCoverageViewResolutionFindings(config, catalog, complianceCanon) {
+    const findings = [];
+    const codexIds = new Set(complianceCanon.codex.map((c) => c.id));
+    for (const id of config.subjects?.products ?? []) {
+        const t = catalog.typeOf(id);
+        if (t === undefined) {
+            findings.push({
+                code: 'COVMET-REF',
+                severity: 'error',
+                message: `subjects.products: "${id}" does not resolve to an admitted artefact.`,
+            });
+        }
+        else if (t !== 'PRODUCT') {
+            findings.push({
+                code: 'COVMET-REF',
+                severity: 'error',
+                message: `subjects.products: "${id}" resolves to ${t}, not PRODUCT.`,
+            });
+        }
+    }
+    for (const id of config.regimes?.include ?? []) {
+        if (!codexIds.has(id)) {
+            findings.push({
+                code: 'COVMET-REF',
+                severity: 'error',
+                message: `regimes.include: "${id}" does not resolve to an admitted codex artefact.`,
+            });
+        }
+    }
+    return findings;
+}
 // ── Parser ───────────────────────────────────────────────────────────────────
 function parseRegimes(raw) {
     const warnings = [];

package/dist/compliance/impact.d.ts

@@ -1,5 +1,6 @@
 import type { AssertionStatus } from '../assertion/types.js';
 import type { ComplianceCanon } from './classify.js';
+import type { CanonCatalog } from '../typed-id.js';
 import type { IndexAssertion, IndexRequirement, ObjectDetailInput, DeadlineStatus } from './types.js';
 /** Filter selecting REQUIREMENTs by codex source (jurisdiction / regime keys
  *  are accepted for forward compatibility but not yet honoured — the canon
@@ -57,12 +58,17 @@ export interface ImpactColumn {
      *  Used to enforce the subject type label invariant (§5.2, COMPIMP-010). */
     subjectType: 'product' | 'process' | 'capability';
 }
-/** A structural validation finding emitted by the matrix builder. */
 export interface ImpactFinding {
     code: string;
     severity: 'error' | 'warning';
     message: string;
 }
+/**
+ * Repo-scope cross-reference checks for a parsed compliance-impact view config
+ * (#518 Phase C3). Surfaces unresolved subject, obligation, and regime ids before
+ * `buildImpactMatrix` runs.
+ */
+export declare function collectImpactViewResolutionFindings(config: ImpactViewConfig, catalog: CanonCatalog, complianceCanon: ComplianceCanon): ImpactFinding[];
 /**
  * Grouping options for matrix columns.
  *

package/dist/compliance/impact.js

@@ -7,6 +7,59 @@
 // (`product` columns × `obligation` rows). Stage / task grouping is planned
 // for CV-3a and intentionally out of scope here.
 import { buildComplianceIndex } from './reverse-index.js';
+/**
+ * Repo-scope cross-reference checks for a parsed compliance-impact view config
+ * (#518 Phase C3). Surfaces unresolved subject, obligation, and regime ids before
+ * `buildImpactMatrix` runs.
+ */
+export function collectImpactViewResolutionFindings(config, catalog, complianceCanon) {
+    const findings = [];
+    const codexIds = new Set(complianceCanon.codex.map((c) => c.id));
+    const subjectChecks = [
+        { ids: config.subjects.products, expectedType: 'PRODUCT', path: 'subjects.products' },
+        { ids: config.subjects.processes, expectedType: 'PROCESS', path: 'subjects.processes' },
+        { ids: config.subjects.capabilities, expectedType: 'CAPABILITY', path: 'subjects.capabilities' },
+    ];
+    for (const { ids, expectedType, path } of subjectChecks) {
+        for (const id of ids ?? []) {
+            const t = catalog.typeOf(id);
+            if (t === undefined) {
+                findings.push({
+                    code: 'COMPIMP-REF',
+                    severity: 'error',
+                    message: `${path}: "${id}" does not resolve to an admitted artefact.`,
+                });
+            }
+            else if (t !== expectedType) {
+                findings.push({
+                    code: 'COMPIMP-REF',
+                    severity: 'error',
+                    message: `${path}: "${id}" resolves to ${t}, not ${expectedType}.`,
+                });
+            }
+        }
+    }
+    for (const id of config.obligations.include ?? []) {
+        const t = catalog.typeOf(id);
+        if (t === undefined || t !== 'REQUIREMENT') {
+            findings.push({
+                code: 'COMPIMP-REF',
+                severity: 'error',
+                message: `obligations.include: "${id}" does not resolve to an admitted REQUIREMENT.`,
+            });
+        }
+    }
+    for (const id of config.obligations.filter?.derived_from_codex ?? []) {
+        if (!codexIds.has(id)) {
+            findings.push({
+                code: 'COMPIMP-REF',
+                severity: 'error',
+                message: `obligations.filter.derived_from_codex: "${id}" does not resolve to an admitted codex artefact.`,
+            });
+        }
+    }
+    return findings;
+}
 // ── Pinned defaults ─────────────────────────────────────────────────────────
 /**
  * Explicit defaults for every optional field in ImpactViewConfig.

package/dist/compliance/index.d.ts

@@ -5,13 +5,15 @@ export { buildGapReport } from './gap-report.js';
 export type { GapReport, GapReportOptions } from './gap-report.js';
 export { emptyCanon, ingestComplianceDoc } from './classify.js';
 export type { ComplianceCanon, ComplianceProduct, ComplianceCodexDoc } from './classify.js';
+export { admitDocumentToCatalog, buildComplianceScan, catalogFromMap, } from './canon-catalog.js';
+export type { ComplianceScanResult, ScannedYamlDoc } from './canon-catalog.js';
 export { renderComplianceMarkdown } from './markdown.js';
 export type { ReportScope, MarkdownOptions } from './markdown.js';
 export { renderComplianceHtml, renderImpactMatrixHtml } from './html.js';
 export type { HtmlOptions, ImpactMatrixHtmlOptions } from './html.js';
-export { buildImpactMatrix, renderImpactMarkdown, parseImpactViewConfig, COMPLIANCE_IMPACT_DEFAULTS, extractObjectDetails, extractProcessFlowTasks, mergeStageTaskDetails, computeDeadlineStatus } from './impact.js';
-export type { ImpactCell, ImpactColumn, ImpactEmptyCellLabels, ImpactGrouping, ImpactMatrix, ImpactObligationFilter, ImpactStatusDisplay, ImpactSubjects, ImpactViewConfig, ParseImpactViewConfigResult, } from './impact.js';
+export { buildImpactMatrix, renderImpactMarkdown, parseImpactViewConfig, collectImpactViewResolutionFindings, COMPLIANCE_IMPACT_DEFAULTS, extractObjectDetails, extractProcessFlowTasks, mergeStageTaskDetails, computeDeadlineStatus } from './impact.js';
+export type { ImpactCell, ImpactColumn, ImpactEmptyCellLabels, ImpactFinding, ImpactGrouping, ImpactMatrix, ImpactObligationFilter, ImpactStatusDisplay, ImpactSubjects, ImpactViewConfig, ParseImpactViewConfigResult, } from './impact.js';
 export { assertionToScoringElement, complianceConfidenceHeader, requirementToScoringElement, scoreComplianceView, } from './confidence.js';
-export { parseCoverageMetricConfig, buildCoverageMatrix, } from './coverage-metric.js';
-export type { CoverageMetricConfig, CoverageMetricRegimes, CoverageMetricRegimesFilter, CoverageMetricSubjects, CoverageMetricThresholds, CoverageMatrix, CoverageRow, ParseCoverageMetricResult, RagStatus, } from './coverage-metric.js';
+export { parseCoverageMetricConfig, buildCoverageMatrix, collectCoverageViewResolutionFindings, } from './coverage-metric.js';
+export type { CoverageMetricConfig, CoverageMetricRegimes, CoverageMetricRegimesFilter, CoverageMetricSubjects, CoverageMetricThresholds, CoverageMatrix, CoverageRow, CoverageViewFinding, ParseCoverageMetricResult, RagStatus, } from './coverage-metric.js';
 export type { ComplianceIndex, ComplianceIndexInput, DeadlineStatus, IndexRequirement, IndexAssertion, LawTree, LawTreeRequirement, ProductView, ProductRequirementStatus, ObjectDetailDef, ObjectDetailInput, RequirementTrace, TraceAssertionRow, TraceElementCatalog, TraceElementRef, TraceSourceRef, } from './types.js';

package/dist/compliance/index.js

@@ -3,8 +3,9 @@ export { buildLawTree, buildProductView } from './views.js';
 export { buildRequirementTrace, buildTraceElementCatalog } from './trace.js';
 export { buildGapReport } from './gap-report.js';
 export { emptyCanon, ingestComplianceDoc } from './classify.js';
+export { admitDocumentToCatalog, buildComplianceScan, catalogFromMap, } from './canon-catalog.js';
 export { renderComplianceMarkdown } from './markdown.js';
 export { renderComplianceHtml, renderImpactMatrixHtml } from './html.js';
-export { buildImpactMatrix, renderImpactMarkdown, parseImpactViewConfig, COMPLIANCE_IMPACT_DEFAULTS, extractObjectDetails, extractProcessFlowTasks, mergeStageTaskDetails, computeDeadlineStatus } from './impact.js';
+export { buildImpactMatrix, renderImpactMarkdown, parseImpactViewConfig, collectImpactViewResolutionFindings, COMPLIANCE_IMPACT_DEFAULTS, extractObjectDetails, extractProcessFlowTasks, mergeStageTaskDetails, computeDeadlineStatus } from './impact.js';
 export { assertionToScoringElement, complianceConfidenceHeader, requirementToScoringElement, scoreComplianceView, } from './confidence.js';
-export { parseCoverageMetricConfig, buildCoverageMatrix, } from './coverage-metric.js';
+export { parseCoverageMetricConfig, buildCoverageMatrix, collectCoverageViewResolutionFindings, } from './coverage-metric.js';