@transitrix/diagrams 1.6.0 → 1.8.1

package/src/codex/validate.ts

@@ -0,0 +1,125 @@
+// CODEX validator — methodology notations/elements/14-codex.md §4.
+//
+// CODEX-001 — shape, zone, id grammar, admission envelope.
+// CODEX-002 — `type` field matches the id TYPE prefix when present.
+// CODEX-003 — external artefact frontmatter (jurisdiction, effective_date).
+// CODEX-004 — internal artefact frontmatter (issuing_authority, effective_date).
+// CODEX-005 — jurisdiction must match the parent folder under codex/external/
+//             (when `folderJurisdiction` is supplied by the repo sweep).
+
+import type { ValidationError, ValidationWarning, ValidationResult } from '../validation-types.js';
+import { isCanonicalId, typeOfId } from '../typed-id.js';
+import {
+  CODEX_ARTEFACT_TYPES,
+  EXTERNAL_CODEX_TYPES,
+  INTERNAL_CODEX_TYPES,
+  type CodexArtefactType,
+} from './types.js';
+
+export interface CodexValidateOptions {
+  /** Lowercased jurisdiction folder segment from `codex/external/<jurisdiction>/`. */
+  folderJurisdiction?: string;
+}
+
+function isCodexType(type: string | null): type is CodexArtefactType {
+  return type !== null && (CODEX_ARTEFACT_TYPES as readonly string[]).includes(type);
+}
+
+function normalizeType(value: unknown): string | undefined {
+  if (typeof value !== 'string' || value.trim() === '') return undefined;
+  return value.trim().toUpperCase();
+}
+
+export function validateCodex(input: unknown, options: CodexValidateOptions = {}): ValidationResult {
+  const errors: ValidationError[] = [];
+  const warnings: ValidationWarning[] = [];
+
+  if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+    errors.push({ code: 'CODEX-001', message: 'Codex artefact must be a YAML mapping.' });
+    return { valid: false, errors, warnings };
+  }
+  const c = input as Record<string, unknown>;
+
+  if (c.zone !== 'codex') {
+    errors.push({ code: 'CODEX-001', message: 'zone must be the fixed value "codex".', path: 'zone' });
+  }
+
+  const idType = typeOfId(c.id);
+  if (!isCanonicalId(c.id) || !isCodexType(idType)) {
+    errors.push({
+      code: 'CODEX-001',
+      message: `id "${String(c.id)}" must be a typed codex id (LAW, REGULATION, POLICY, or INTERNAL_STANDARD).`,
+      path: 'id',
+    });
+  }
+
+  if (typeof c.name !== 'string' || c.name.trim() === '') {
+    errors.push({ code: 'CODEX-001', message: 'name is required.', path: 'name' });
+  }
+  for (const field of ['admitted_at', 'admitted_by'] as const) {
+    const v = c[field];
+    if (typeof v !== 'string' || v.trim() === '') {
+      errors.push({ code: 'CODEX-001', message: `${field} is required.`, path: field });
+    }
+  }
+  if (c.gate_checks === null || typeof c.gate_checks !== 'object' || Array.isArray(c.gate_checks)) {
+    errors.push({ code: 'CODEX-001', message: 'gate_checks is required and must be a mapping.', path: 'gate_checks' });
+  }
+
+  const declaredType = normalizeType(c.type);
+  if (declaredType !== undefined && idType && declaredType !== idType) {
+    errors.push({
+      code: 'CODEX-002',
+      message: `type "${String(c.type)}" does not match the id TYPE prefix "${idType}".`,
+      path: 'type',
+    });
+  }
+
+  const artefactType = (declaredType ?? idType) as CodexArtefactType | null;
+
+  if (artefactType && (EXTERNAL_CODEX_TYPES as readonly string[]).includes(artefactType)) {
+    const jurisdiction = typeof c.jurisdiction === 'string' ? c.jurisdiction.trim() : '';
+    if (!jurisdiction) {
+      errors.push({ code: 'CODEX-003', message: 'jurisdiction is required for external codex artefacts.', path: 'jurisdiction' });
+    } else if (options.folderJurisdiction && jurisdiction.toLowerCase() !== options.folderJurisdiction.toLowerCase()) {
+      errors.push({
+        code: 'CODEX-005',
+        message: `jurisdiction "${jurisdiction}" must match the parent folder "${options.folderJurisdiction}" (CODEX-001).`,
+        path: 'jurisdiction',
+      });
+    }
+    if (typeof c.effective_date !== 'string' || c.effective_date.trim() === '') {
+      errors.push({ code: 'CODEX-003', message: 'effective_date is required for external codex artefacts.', path: 'effective_date' });
+    }
+  }
+
+  if (artefactType && (INTERNAL_CODEX_TYPES as readonly string[]).includes(artefactType)) {
+    if (typeof c.issuing_authority !== 'string' || c.issuing_authority.trim() === '') {
+      errors.push({
+        code: 'CODEX-004',
+        message: 'issuing_authority is required for internal codex artefacts.',
+        path: 'issuing_authority',
+      });
+    }
+    if (typeof c.effective_date !== 'string' || c.effective_date.trim() === '') {
+      errors.push({ code: 'CODEX-004', message: 'effective_date is required for internal codex artefacts.', path: 'effective_date' });
+    }
+  }
+
+  return { valid: errors.length === 0, errors, warnings };
+}
+
+/** True when a parsed document is a codex-zone artefact candidate. */
+export function isCodexDoc(data: unknown): boolean {
+  if (data === null || typeof data !== 'object' || Array.isArray(data)) return false;
+  return (data as Record<string, unknown>).zone === 'codex';
+}
+
+/** Infer codex folder jurisdiction from a repo-relative path such as
+ *  `codex/external/eu/LAW-GDPR-1.yaml` → `eu`. */
+export function folderJurisdictionFromPath(filePath: string): string | undefined {
+  const parts = filePath.replace(/\\/g, '/').toLowerCase().split('/');
+  const extIdx = parts.indexOf('external');
+  if (extIdx < 0 || extIdx + 1 >= parts.length) return undefined;
+  return parts[extIdx + 1] || undefined;
+}

package/src/compliance/__tests__/canon-catalog.test.ts

@@ -0,0 +1,68 @@
+import { describe, it, expect } from 'vitest';
+
+import {
+  admitDocumentToCatalog,
+  buildComplianceScan,
+  catalogFromMap,
+} from '../canon-catalog.js';
+
+describe('buildComplianceScan', () => {
+  it('admits codex, requirement, and assertion ids into the catalogue', () => {
+    const docs = [
+      {
+        path: 'codex/external/ge/LAW-PERSONAL-DATA-2017-1.yaml',
+        data: {
+          zone: 'codex',
+          id: 'LAW-PERSONAL-DATA-2017-1',
+          name: 'Law',
+          type: 'LAW',
+        },
+      },
+      {
+        path: 'canon/elements/01_motivation/requirements/REQUIREMENT-DATA-ERASURE-1.yaml',
+        data: {
+          notation: 'requirement',
+          id: 'REQUIREMENT-DATA-ERASURE-1',
+          name: 'Erasure',
+          derived_from: ['LAW-PERSONAL-DATA-2017-1'],
+        },
+      },
+      {
+        path: 'canon/elements/02_business/products/PRODUCT-MOBILE-1.yaml',
+        data: { notation: 'product', id: 'PRODUCT-MOBILE-1', name: 'Mobile' },
+      },
+      {
+        path: 'canon/assertions/ASSERTION-MOBILE-DATA-ERASURE-1.yaml',
+        data: {
+          notation: 'assertion',
+          id: 'ASSERTION-MOBILE-DATA-ERASURE-1',
+          about: 'REQUIREMENT-DATA-ERASURE-1',
+          subject: 'PRODUCT-MOBILE-1',
+          status: 'compliant',
+        },
+      },
+    ];
+
+    const { catalog, complianceCanon, pathById } = buildComplianceScan(docs);
+    expect(catalog.typeOf('LAW-PERSONAL-DATA-2017-1')).toBe('LAW');
+    expect(catalog.typeOf('REQUIREMENT-DATA-ERASURE-1')).toBe('REQUIREMENT');
+    expect(catalog.typeOf('PRODUCT-MOBILE-1')).toBe('PRODUCT');
+    expect(complianceCanon.requirements).toHaveLength(1);
+    expect(complianceCanon.assertions).toHaveLength(1);
+    expect(complianceCanon.codex).toHaveLength(1);
+    expect(pathById.get('REQUIREMENT-DATA-ERASURE-1')).toContain('requirements/');
+  });
+});
+
+describe('admitDocumentToCatalog', () => {
+  it('uses explicit codex type when the id prefix is ambiguous', () => {
+    const map = new Map<string, string>();
+    admitDocumentToCatalog(map, {
+      zone: 'codex',
+      id: 'INTERNAL_STANDARD-coding-conventions-1',
+      type: 'INTERNAL_STANDARD',
+    });
+    const catalog = catalogFromMap(map);
+    expect(catalog.typeOf('INTERNAL_STANDARD-coding-conventions-1')).toBe('INTERNAL_STANDARD');
+  });
+});

package/src/compliance/__tests__/view-resolution.test.ts

@@ -0,0 +1,80 @@
+import { describe, it, expect } from 'vitest';
+
+import { emptyCanon } from '../classify.js';
+import { catalogFromMap } from '../canon-catalog.js';
+import { collectImpactViewResolutionFindings } from '../impact.js';
+import { collectCoverageViewResolutionFindings } from '../coverage-metric.js';
+import type { ImpactViewConfig } from '../impact.js';
+import type { CoverageMetricConfig } from '../coverage-metric.js';
+
+const catalog = catalogFromMap(
+  new Map([
+    ['PRODUCT-ECOMM-1', 'PRODUCT'],
+    ['REQUIREMENT-GDPR-1', 'REQUIREMENT'],
+    ['LAW-GDPR-1', 'LAW'],
+  ]),
+);
+
+const complianceCanon = emptyCanon();
+complianceCanon.products.push({ id: 'PRODUCT-ECOMM-1', name: 'E-Commerce' });
+complianceCanon.requirements.push({ id: 'REQUIREMENT-GDPR-1', name: 'GDPR req' });
+complianceCanon.codex.push({ id: 'LAW-GDPR-1', name: 'GDPR' });
+
+describe('collectImpactViewResolutionFindings', () => {
+  const base: ImpactViewConfig = {
+    id: 'test-impact',
+    name: 'Test',
+    subjects: { products: ['PRODUCT-ECOMM-1'], processes: [], capabilities: [] },
+    obligations: { filter: { derived_from_codex: ['LAW-GDPR-1'] } },
+    status_display: { show: ['compliant'] },
+    empty_cells: {},
+    order_rows_by: 'id',
+  };
+
+  it('passes when subjects and regimes resolve', () => {
+    expect(collectImpactViewResolutionFindings(base, catalog, complianceCanon)).toEqual([]);
+  });
+
+  it('flags unresolved subjects and regimes', () => {
+    const findings = collectImpactViewResolutionFindings(
+      {
+        ...base,
+        subjects: { products: ['PRODUCT-MISSING-1'], processes: [], capabilities: [] },
+        obligations: { include: ['REQUIREMENT-MISSING-1'], filter: { derived_from_codex: ['LAW-MISSING-1'] } },
+      },
+      catalog,
+      complianceCanon,
+    );
+    expect(findings.some((f) => f.code === 'COMPIMP-REF' && f.message.includes('PRODUCT-MISSING-1'))).toBe(true);
+    expect(findings.some((f) => f.message.includes('REQUIREMENT-MISSING-1'))).toBe(true);
+    expect(findings.some((f) => f.message.includes('LAW-MISSING-1'))).toBe(true);
+  });
+});
+
+describe('collectCoverageViewResolutionFindings', () => {
+  const base: CoverageMetricConfig = {
+    id: 'test-coverage',
+    name: 'Test',
+    thresholds: { green: 0.9, amber: 0.7 },
+    subjects: { products: ['PRODUCT-ECOMM-1'] },
+    regimes: { include: ['LAW-GDPR-1'] },
+  };
+
+  it('passes when products and regimes resolve', () => {
+    expect(collectCoverageViewResolutionFindings(base, catalog, complianceCanon)).toEqual([]);
+  });
+
+  it('flags unresolved product and regime refs', () => {
+    const findings = collectCoverageViewResolutionFindings(
+      {
+        ...base,
+        subjects: { products: ['PRODUCT-MISSING-1'] },
+        regimes: { include: ['LAW-MISSING-1'] },
+      },
+      catalog,
+      complianceCanon,
+    );
+    expect(findings.some((f) => f.code === 'COVMET-REF')).toBe(true);
+    expect(findings).toHaveLength(2);
+  });
+});

package/src/compliance/canon-catalog.ts

@@ -0,0 +1,76 @@
+// CanonCatalog builder — repo-scope cross-reference resolution (#518 Phase C3).
+//
+// Scans admitted YAML documents and builds the `{ typeOf }` catalogue that
+// `validateRequirement` / `validateAssertion` accept for REQ-002 and
+// ASSERT-002..005 resolution.
+
+import { typeOfId, type CanonCatalog } from '../typed-id.js';
+import { emptyCanon, ingestComplianceDoc, type ComplianceCanon } from './classify.js';
+
+export interface ScannedYamlDoc {
+  path: string;
+  data: unknown;
+}
+
+export interface ComplianceScanResult {
+  complianceCanon: ComplianceCanon;
+  catalog: CanonCatalog;
+  /** First path where each admitted id was seen (for gap-dashboard warnings). */
+  pathById: Map<string, string>;
+}
+
+function strId(doc: unknown): string | undefined {
+  if (doc === null || typeof doc !== 'object' || Array.isArray(doc)) return undefined;
+  const id = (doc as Record<string, unknown>).id;
+  return typeof id === 'string' && id.trim() !== '' ? id.trim() : undefined;
+}
+
+/** Admit one parsed document into the id → TYPE map. */
+export function admitDocumentToCatalog(map: Map<string, string>, doc: unknown): string | undefined {
+  const id = strId(doc);
+  if (!id) return undefined;
+
+  const fromPrefix = typeOfId(id);
+  if (fromPrefix) {
+    map.set(id, fromPrefix);
+    return id;
+  }
+
+  if (doc !== null && typeof doc === 'object' && !Array.isArray(doc)) {
+    const d = doc as Record<string, unknown>;
+    if (d.zone === 'codex') {
+      const explicit = typeof d.type === 'string' ? d.type.trim().toUpperCase() : undefined;
+      if (explicit) {
+        map.set(id, explicit);
+        return id;
+      }
+    }
+  }
+  return undefined;
+}
+
+/** Build a read-only `CanonCatalog` from a populated id → TYPE map. */
+export function catalogFromMap(map: Map<string, string>): CanonCatalog {
+  return { typeOf: (id: string) => map.get(id) };
+}
+
+/** Ingest compliance projections and admit cross-reference targets from a batch
+ *  of already-parsed YAML documents (no IO). */
+export function buildComplianceScan(docs: ScannedYamlDoc[]): ComplianceScanResult {
+  const complianceCanon = emptyCanon();
+  const catalogMap = new Map<string, string>();
+  const pathById = new Map<string, string>();
+
+  for (const { path, data } of docs) {
+    const ingested = ingestComplianceDoc(complianceCanon, data);
+    if (ingested) pathById.set(ingested, path);
+    const admitted = admitDocumentToCatalog(catalogMap, data);
+    if (admitted && !pathById.has(admitted)) pathById.set(admitted, path);
+  }
+
+  return {
+    complianceCanon,
+    catalog: catalogFromMap(catalogMap),
+    pathById,
+  };
+}

package/src/compliance/coverage-metric.ts

@@ -8,6 +8,7 @@
 import type { AssertionStatus } from '../assertion/types.js';
 import type { ComplianceCanon } from './classify.js';
 import { buildComplianceIndex } from './reverse-index.js';
+import type { CanonCatalog } from '../typed-id.js';
 import type { IndexAssertion } from './types.js';
 
 // ── Config types ─────────────────────────────────────────────────────────────
@@ -93,6 +94,55 @@ export interface CoverageMatrix {
   thresholds: CoverageMetricThresholds;
 }
 
+/** Repo-scope cross-reference finding for a coverage-metric view (#518 C3). */
+export interface CoverageViewFinding {
+  code: string;
+  severity: 'error' | 'warning';
+  message: string;
+}
+
+/**
+ * Repo-scope cross-reference checks for a parsed coverage-metric view config.
+ * Surfaces unresolved product and regime ids before `buildCoverageMatrix` runs.
+ */
+export function collectCoverageViewResolutionFindings(
+  config: CoverageMetricConfig,
+  catalog: CanonCatalog,
+  complianceCanon: ComplianceCanon,
+): CoverageViewFinding[] {
+  const findings: CoverageViewFinding[] = [];
+  const codexIds = new Set(complianceCanon.codex.map((c) => c.id));
+
+  for (const id of config.subjects?.products ?? []) {
+    const t = catalog.typeOf(id);
+    if (t === undefined) {
+      findings.push({
+        code: 'COVMET-REF',
+        severity: 'error',
+        message: `subjects.products: "${id}" does not resolve to an admitted artefact.`,
+      });
+    } else if (t !== 'PRODUCT') {
+      findings.push({
+        code: 'COVMET-REF',
+        severity: 'error',
+        message: `subjects.products: "${id}" resolves to ${t}, not PRODUCT.`,
+      });
+    }
+  }
+
+  for (const id of config.regimes?.include ?? []) {
+    if (!codexIds.has(id)) {
+      findings.push({
+        code: 'COVMET-REF',
+        severity: 'error',
+        message: `regimes.include: "${id}" does not resolve to an admitted codex artefact.`,
+      });
+    }
+  }
+
+  return findings;
+}
+
 // ── Parser ───────────────────────────────────────────────────────────────────
 
 function parseRegimes(raw: Record<string, unknown>): { regimes?: CoverageMetricRegimes; warnings: string[] } {

package/src/compliance/impact.ts

@@ -10,6 +10,7 @@
 import type { AssertionStatus } from '../assertion/types.js';
 import type { ComplianceCanon } from './classify.js';
 import { buildComplianceIndex } from './reverse-index.js';
+import type { CanonCatalog } from '../typed-id.js';
 import type { ComplianceIndex, IndexAssertion, IndexRequirement, ObjectDetailInput, ObjectDetailDef, DeadlineStatus } from './types.js';
 
 /** Filter selecting REQUIREMENTs by codex source (jurisdiction / regime keys
@@ -75,13 +76,78 @@ export interface ImpactColumn {
   subjectType: 'product' | 'process' | 'capability';
 }
 
-/** A structural validation finding emitted by the matrix builder. */
 export interface ImpactFinding {
   code: string;
   severity: 'error' | 'warning';
   message: string;
 }
 
+/**
+ * Repo-scope cross-reference checks for a parsed compliance-impact view config
+ * (#518 Phase C3). Surfaces unresolved subject, obligation, and regime ids before
+ * `buildImpactMatrix` runs.
+ */
+export function collectImpactViewResolutionFindings(
+  config: ImpactViewConfig,
+  catalog: CanonCatalog,
+  complianceCanon: ComplianceCanon,
+): ImpactFinding[] {
+  const findings: ImpactFinding[] = [];
+  const codexIds = new Set(complianceCanon.codex.map((c) => c.id));
+
+  const subjectChecks: Array<{
+    ids: string[] | undefined;
+    expectedType: string;
+    path: string;
+  }> = [
+    { ids: config.subjects.products, expectedType: 'PRODUCT', path: 'subjects.products' },
+    { ids: config.subjects.processes, expectedType: 'PROCESS', path: 'subjects.processes' },
+    { ids: config.subjects.capabilities, expectedType: 'CAPABILITY', path: 'subjects.capabilities' },
+  ];
+
+  for (const { ids, expectedType, path } of subjectChecks) {
+    for (const id of ids ?? []) {
+      const t = catalog.typeOf(id);
+      if (t === undefined) {
+        findings.push({
+          code: 'COMPIMP-REF',
+          severity: 'error',
+          message: `${path}: "${id}" does not resolve to an admitted artefact.`,
+        });
+      } else if (t !== expectedType) {
+        findings.push({
+          code: 'COMPIMP-REF',
+          severity: 'error',
+          message: `${path}: "${id}" resolves to ${t}, not ${expectedType}.`,
+        });
+      }
+    }
+  }
+
+  for (const id of config.obligations.include ?? []) {
+    const t = catalog.typeOf(id);
+    if (t === undefined || t !== 'REQUIREMENT') {
+      findings.push({
+        code: 'COMPIMP-REF',
+        severity: 'error',
+        message: `obligations.include: "${id}" does not resolve to an admitted REQUIREMENT.`,
+      });
+    }
+  }
+
+  for (const id of config.obligations.filter?.derived_from_codex ?? []) {
+    if (!codexIds.has(id)) {
+      findings.push({
+        code: 'COMPIMP-REF',
+        severity: 'error',
+        message: `obligations.filter.derived_from_codex: "${id}" does not resolve to an admitted codex artefact.`,
+      });
+    }
+  }
+
+  return findings;
+}
+
 /**
  * Grouping options for matrix columns.
  *

package/src/compliance/index.ts

@@ -5,15 +5,22 @@ export { buildGapReport } from './gap-report.js';
 export type { GapReport, GapReportOptions } from './gap-report.js';
 export { emptyCanon, ingestComplianceDoc } from './classify.js';
 export type { ComplianceCanon, ComplianceProduct, ComplianceCodexDoc } from './classify.js';
+export {
+  admitDocumentToCatalog,
+  buildComplianceScan,
+  catalogFromMap,
+} from './canon-catalog.js';
+export type { ComplianceScanResult, ScannedYamlDoc } from './canon-catalog.js';
 export { renderComplianceMarkdown } from './markdown.js';
 export type { ReportScope, MarkdownOptions } from './markdown.js';
 export { renderComplianceHtml, renderImpactMatrixHtml } from './html.js';
 export type { HtmlOptions, ImpactMatrixHtmlOptions } from './html.js';
-export { buildImpactMatrix, renderImpactMarkdown, parseImpactViewConfig, COMPLIANCE_IMPACT_DEFAULTS, extractObjectDetails, extractProcessFlowTasks, mergeStageTaskDetails, computeDeadlineStatus } from './impact.js';
+export { buildImpactMatrix, renderImpactMarkdown, parseImpactViewConfig, collectImpactViewResolutionFindings, COMPLIANCE_IMPACT_DEFAULTS, extractObjectDetails, extractProcessFlowTasks, mergeStageTaskDetails, computeDeadlineStatus } from './impact.js';
 export type {
   ImpactCell,
   ImpactColumn,
   ImpactEmptyCellLabels,
+  ImpactFinding,
   ImpactGrouping,
   ImpactMatrix,
   ImpactObligationFilter,
@@ -31,6 +38,7 @@ export {
 export {
   parseCoverageMetricConfig,
   buildCoverageMatrix,
+  collectCoverageViewResolutionFindings,
 } from './coverage-metric.js';
 export type {
   CoverageMetricConfig,
@@ -40,6 +48,7 @@ export type {
   CoverageMetricThresholds,
   CoverageMatrix,
   CoverageRow,
+  CoverageViewFinding,
   ParseCoverageMetricResult,
   RagStatus,
 } from './coverage-metric.js';

package/src/constraint/__tests__/example.test.ts

@@ -0,0 +1,19 @@
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+import yaml from 'js-yaml';
+import { validateConstraint } from '../validate.js';
+
+const dir = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  '../../../../../tests/fixtures/notation-corpus/constraint',
+);
+
+describe('constraint worked example (notation-corpus)', () => {
+  it('validates CONSTRAINT-GDPR-RESIDENCY-1.yaml without error', () => {
+    const data = yaml.load(readFileSync(path.join(dir, 'CONSTRAINT-GDPR-RESIDENCY-1.yaml'), 'utf-8'));
+    const v = validateConstraint(data);
+    expect(v.valid, JSON.stringify(v.errors)).toBe(true);
+  });
+});

package/src/constraint/__tests__/validate.test.ts

@@ -0,0 +1,68 @@
+import { describe, it, expect } from 'vitest';
+import { validateConstraint } from '../validate.js';
+import type { CanonCatalog } from '../../typed-id.js';
+
+function valid(): Record<string, unknown> {
+  return {
+    notation: 'constraint',
+    id: 'CONSTRAINT-GDPR-RESIDENCY-1',
+    name: 'EU customer personal data must be stored within EU/EEA jurisdictions',
+    statement: 'Personal data of EU customers MUST NOT be persisted outside EU / EEA jurisdictions.',
+    status: 'active',
+    zone: 'canon',
+    admitted_at: '2026-05-29',
+    admitted_by: 'v.korobeinikov',
+    gate_checks: { uniqueness: 'pass', consistency: 'pass', completeness: 'pass' },
+    valid_from: '2018-05-25',
+    valid_to: null,
+    severity: 'mandatory',
+    owner_role: 'ROLE-DPO-1',
+    applies_to: ['APPLICATION-CRM-1'],
+  };
+}
+
+const codes = (input: unknown, opts?: Parameters<typeof validateConstraint>[1]): string[] =>
+  validateConstraint(input, opts).errors.map((e) => e.code);
+
+describe('validateConstraint — positive', () => {
+  it('accepts a well-formed constraint', () => {
+    const r = validateConstraint(valid());
+    expect(r.valid, JSON.stringify(r.errors)).toBe(true);
+  });
+});
+
+describe('validateConstraint — CONST-001', () => {
+  it('flags missing required fields and wrong notation', () => {
+    const r = valid();
+    delete r.statement;
+    expect(codes(r)).toContain('CONST-001');
+    expect(codes({ ...valid(), notation: 'requirement' })).toContain('CONST-001');
+    expect(codes({ ...valid(), id: 'CONSTRAINT-001' })).toContain('CONST-001');
+  });
+});
+
+describe('validateConstraint — CONST-002/003', () => {
+  it('flags invalid status and severity', () => {
+    expect(codes({ ...valid(), status: 'enabled' })).toContain('CONST-002');
+    expect(codes({ ...valid(), severity: 'critical' })).toContain('CONST-003');
+  });
+});
+
+describe('validateConstraint — CONST-004/005 (catalog)', () => {
+  it('flags unresolved applies_to and owner_role with catalog', () => {
+    const catalog: CanonCatalog = { typeOf: () => undefined };
+    expect(codes(valid(), { catalog })).toContain('CONST-004');
+    expect(codes(valid(), { catalog })).toContain('CONST-005');
+  });
+
+  it('does not flag CONST-004 without catalog for well-formed applies_to', () => {
+    expect(codes(valid())).not.toContain('CONST-004');
+  });
+
+  it('resolves applies_to when catalogue admits the target', () => {
+    const catalog: CanonCatalog = {
+      typeOf: (id) => (id === 'APPLICATION-CRM-1' ? 'APPLICATION' : id === 'ROLE-DPO-1' ? 'ROLE' : undefined),
+    };
+    expect(validateConstraint(valid(), { catalog }).valid).toBe(true);
+  });
+});

package/src/constraint/index.ts

@@ -0,0 +1,4 @@
+export { CONSTRAINT_STATUSES, CONSTRAINT_SEVERITIES } from './types.js';
+export type { ConstraintStatus, ConstraintSeverity } from './types.js';
+export { validateConstraint } from './validate.js';
+export type { ConstraintValidateOptions } from './validate.js';

package/src/constraint/types.ts

@@ -0,0 +1,5 @@
+export const CONSTRAINT_STATUSES = ['active', 'proposed', 'deprecated', 'retired'] as const;
+export type ConstraintStatus = (typeof CONSTRAINT_STATUSES)[number];
+
+export const CONSTRAINT_SEVERITIES = ['mandatory', 'recommended', 'advisory'] as const;
+export type ConstraintSeverity = (typeof CONSTRAINT_SEVERITIES)[number];