@ykdz/template 0.0.42 → 0.1.0-experimental.0

package/node_modules/@ykdz/template-core/dist/template-boundary-check.js

@@ -1,839 +0,0 @@
-import { readdir, readFile, stat } from "node:fs/promises";
-import path from "node:path";
-import ts from "typescript";
-import { resolveTemplateSource } from "./renderer.js";
-const inlineOperationKinds = new Set([
-    "writeText",
-    "writeJson",
-    "mergeJson",
-]);
-async function listTemplateSourceFiles(root) {
-    const entries = await readdir(root, { withFileTypes: true });
-    const files = [];
-    for (const entry of entries) {
-        const entryPath = path.join(root, entry.name);
-        if (entry.isDirectory()) {
-            files.push(...(await listTemplateSourceFiles(entryPath)));
-            continue;
-        }
-        if (!entry.isFile())
-            continue;
-        await readFile(entryPath);
-        files.push(path.resolve(entryPath));
-    }
-    return files;
-}
-/**
- * Reads each registered Template Source context before any plan is inspected.
- * The resulting file sets are an independent proof consumed by the boundary check.
- */
-export async function checkTemplateSourceContexts(contexts) {
-    return await Promise.all(contexts.map(async (context) => {
-        const root = path.resolve(context.root);
-        const rootStats = await stat(root);
-        if (!rootStats.isDirectory()) {
-            throw new Error(`Template Source context ${context.name} root is not a directory: ${root}`);
-        }
-        return {
-            ...context,
-            root,
-            checkedFiles: await listTemplateSourceFiles(root),
-        };
-    }));
-}
-function operationTarget(operation) {
-    if ("to" in operation) {
-        return operation.to;
-    }
-    return undefined;
-}
-function isInlineProtectedOperation(operation) {
-    const generatedPath = operationTarget(operation);
-    return (generatedPath !== undefined &&
-        inlineOperationKinds.has(operation.kind) &&
-        isProtectedGeneratedPath(generatedPath));
-}
-function isProtectedSourceBackedOperation(operation) {
-    const generatedPath = operationTarget(operation);
-    return (generatedPath !== undefined &&
-        (operation.kind === "copyFile" ||
-            operation.kind === "mergeJsonTemplate" ||
-            operation.kind === "writeTextTemplate" ||
-            operation.kind === "writeTextFromFragments") &&
-        isProtectedGeneratedPath(generatedPath));
-}
-export function isProtectedGeneratedPath(generatedPath) {
-    const normalizedPath = generatedPath.split("\\").join("/");
-    const fileName = normalizedPath.split("/").at(-1);
-    return (normalizedPath === "scripts/check-standalone-deployment.ts" ||
-        normalizedPath === "scripts/container-entrypoint.sh" ||
-        normalizedPath === ".devcontainer/devcontainer.json" ||
-        normalizedPath === ".github/dependabot.yml" ||
-        normalizedPath.startsWith(".github/workflows/") ||
-        normalizedPath.startsWith(".vscode/") ||
-        normalizedPath.startsWith("scripts/npm-publication/") ||
-        normalizedPath.startsWith("scripts/npm-publication-setup/") ||
-        fileName === "CHANGELOG.md" ||
-        fileName === ".dockerignore" ||
-        fileName === "Dockerfile" ||
-        fileName === "LICENSE" ||
-        fileName === "README.md" ||
-        fileName === "RELEASING.md" ||
-        fileName === "oxfmt.config.ts" ||
-        fileName === "oxlint.config.ts" ||
-        fileName === "playwright.config.ts" ||
-        fileName === "rustfmt.toml" ||
-        fileName === "rust-toolchain.toml" ||
-        fileName === "turbo.json" ||
-        fileName === "tsconfig.config.json" ||
-        fileName === "vite.config.ts" ||
-        fileName === "vitest.config.ts");
-}
-function expressionStringValue(expression) {
-    if (ts.isParenthesizedExpression(expression) ||
-        ts.isAsExpression(expression) ||
-        ts.isSatisfiesExpression(expression) ||
-        ts.isTypeAssertionExpression(expression)) {
-        return expressionStringValue(expression.expression);
-    }
-    if (ts.isStringLiteralLike(expression)) {
-        return expression.text;
-    }
-    if (ts.isNoSubstitutionTemplateLiteral(expression) ||
-        ts.isTemplateExpression(expression)) {
-        return expression.getText();
-    }
-    return undefined;
-}
-function propertyStringValue(objectLiteral, name) {
-    const initializer = propertyInitializer(objectLiteral, name);
-    return initializer === undefined
-        ? undefined
-        : expressionStringValue(initializer);
-}
-function propertyInitializer(objectLiteral, name) {
-    const property = objectLiteral.properties.find((candidate) => {
-        return (ts.isPropertyAssignment(candidate) &&
-            ts.isIdentifier(candidate.name) &&
-            candidate.name.text === name);
-    });
-    if (!property || !ts.isPropertyAssignment(property)) {
-        return undefined;
-    }
-    return property.initializer;
-}
-function propertyPathMatches(objectLiteral, name, expectedPath) {
-    const initializer = propertyInitializer(objectLiteral, name);
-    if (!initializer) {
-        return false;
-    }
-    if (ts.isStringLiteralLike(initializer)) {
-        return initializer.text === expectedPath;
-    }
-    if (ts.isNoSubstitutionTemplateLiteral(initializer)) {
-        return initializer.text === expectedPath;
-    }
-    if (ts.isTemplateExpression(initializer)) {
-        const literalParts = [
-            initializer.head.text,
-            ...initializer.templateSpans.map((span) => span.literal.text),
-        ].filter((part) => part.length > 0);
-        let searchStart = 0;
-        return literalParts.every((part, index) => {
-            const foundAt = expectedPath.indexOf(part, searchStart);
-            if (foundAt === -1) {
-                return false;
-            }
-            const isFirst = index === 0;
-            const isLast = index === literalParts.length - 1;
-            if (isFirst && initializer.head.text.length > 0 && foundAt !== 0) {
-                return false;
-            }
-            if (isLast && !expectedPath.endsWith(part)) {
-                return false;
-            }
-            searchStart = foundAt + part.length;
-            return true;
-        });
-    }
-    return false;
-}
-function owningFunctionName(node) {
-    let current = node;
-    while (current) {
-        if ((ts.isFunctionDeclaration(current) ||
-            ts.isFunctionExpression(current) ||
-            ts.isArrowFunction(current) ||
-            ts.isMethodDeclaration(current)) &&
-            current.name) {
-            return current.name.getText();
-        }
-        if (ts.isPropertyAssignment(current) &&
-            (ts.isFunctionExpression(current.initializer) ||
-                ts.isArrowFunction(current.initializer))) {
-            return current.name.getText();
-        }
-        current = current.parent;
-    }
-    return "<module>";
-}
-function propertyNameText(name) {
-    if (ts.isIdentifier(name) || ts.isStringLiteralLike(name)) {
-        return name.text;
-    }
-    if (ts.isNumericLiteral(name)) {
-        return name.text;
-    }
-    return undefined;
-}
-function expressionLiteralJsonValue(expression) {
-    if (ts.isParenthesizedExpression(expression)) {
-        return expressionLiteralJsonValue(expression.expression);
-    }
-    if (ts.isAsExpression(expression) ||
-        ts.isSatisfiesExpression(expression) ||
-        ts.isTypeAssertionExpression(expression)) {
-        return expressionLiteralJsonValue(expression.expression);
-    }
-    if (ts.isStringLiteralLike(expression)) {
-        return { known: true, value: expression.text };
-    }
-    if (ts.isNoSubstitutionTemplateLiteral(expression)) {
-        return { known: true, value: expression.text };
-    }
-    if (ts.isNumericLiteral(expression)) {
-        return { known: true, value: Number(expression.text) };
-    }
-    if (expression.kind === ts.SyntaxKind.TrueKeyword) {
-        return { known: true, value: true };
-    }
-    if (expression.kind === ts.SyntaxKind.FalseKeyword) {
-        return { known: true, value: false };
-    }
-    if (expression.kind === ts.SyntaxKind.NullKeyword) {
-        return { known: true, value: null };
-    }
-    if (ts.isPrefixUnaryExpression(expression)) {
-        const operand = expressionLiteralJsonValue(expression.operand);
-        if (!operand.known || typeof operand.value !== "number") {
-            return { known: false };
-        }
-        if (expression.operator === ts.SyntaxKind.MinusToken) {
-            return { known: true, value: -operand.value };
-        }
-        if (expression.operator === ts.SyntaxKind.PlusToken) {
-            return { known: true, value: operand.value };
-        }
-        return { known: false };
-    }
-    if (ts.isArrayLiteralExpression(expression)) {
-        const values = [];
-        for (const element of expression.elements) {
-            if (ts.isSpreadElement(element)) {
-                return { known: false };
-            }
-            const value = expressionLiteralJsonValue(element);
-            if (!value.known) {
-                return { known: false };
-            }
-            values.push(value.value);
-        }
-        return { known: true, value: values };
-    }
-    if (ts.isObjectLiteralExpression(expression)) {
-        const value = {};
-        for (const property of expression.properties) {
-            if (!ts.isPropertyAssignment(property)) {
-                return { known: false };
-            }
-            const name = propertyNameText(property.name);
-            if (name === undefined) {
-                return { known: false };
-            }
-            const initializer = expressionLiteralJsonValue(property.initializer);
-            if (!initializer.known) {
-                return { known: false };
-            }
-            value[name] = initializer.value;
-        }
-        return { known: true, value };
-    }
-    return { known: false };
-}
-function jsonValuesEqual(left, right) {
-    if (Object.is(left, right)) {
-        return true;
-    }
-    if (Array.isArray(left) || Array.isArray(right)) {
-        return (Array.isArray(left) &&
-            Array.isArray(right) &&
-            left.length === right.length &&
-            left.every((entry, index) => jsonValuesEqual(entry, right[index])));
-    }
-    if (typeof left !== "object" ||
-        left === null ||
-        typeof right !== "object" ||
-        right === null) {
-        return false;
-    }
-    const leftEntries = Object.entries(left);
-    const rightEntries = Object.entries(right);
-    const rightValues = new Map(rightEntries);
-    return (leftEntries.length === rightEntries.length &&
-        leftEntries.every(([key, value]) => {
-            return (rightValues.has(key) && jsonValuesEqual(value, rightValues.get(key)));
-        }));
-}
-function expressionMatchesJsonValue(expression, expectedValue) {
-    const literalValue = expressionLiteralJsonValue(expression);
-    return (literalValue.known && jsonValuesEqual(literalValue.value, expectedValue));
-}
-function isExactOperationAstMatch(node, operation) {
-    if (operation.kind === "writeText") {
-        return propertyStringValue(node, "text") === operation.text;
-    }
-    const value = propertyInitializer(node, "value");
-    return (value !== undefined && expressionMatchesJsonValue(value, operation.value));
-}
-function findAstMatchesForOperation(sourceFile, operation) {
-    const exactMatches = [];
-    const candidateMatches = [];
-    function visit(node) {
-        if (!ts.isObjectLiteralExpression(node)) {
-            ts.forEachChild(node, visit);
-            return;
-        }
-        if (propertyStringValue(node, "kind") === operation.kind &&
-            propertyPathMatches(node, "to", operation.to)) {
-            const match = {
-                node,
-                owningFunction: owningFunctionName(node),
-            };
-            candidateMatches.push(match);
-            if (isExactOperationAstMatch(node, operation)) {
-                exactMatches.push(match);
-            }
-        }
-        ts.forEachChild(node, visit);
-    }
-    visit(sourceFile);
-    if (exactMatches.length > 0) {
-        return exactMatches;
-    }
-    return candidateMatches;
-}
-function findOwningFunctionsForOperation(sourceFile, operation) {
-    const owners = new Set(findAstMatchesForOperation(sourceFile, operation).map((match) => match.owningFunction));
-    if (owners.size > 0) {
-        return [...owners];
-    }
-    return ["<unknown>"];
-}
-function findOwningFunctionsForProtectedOperation(sourceFile, operation) {
-    const generatedPath = operationTarget(operation);
-    if (generatedPath === undefined) {
-        return ["<unknown>"];
-    }
-    const targetPath = generatedPath;
-    const owners = new Set();
-    function visit(node) {
-        if (!ts.isObjectLiteralExpression(node)) {
-            ts.forEachChild(node, visit);
-            return;
-        }
-        if (propertyStringValue(node, "kind") === operation.kind &&
-            propertyPathMatches(node, "to", targetPath)) {
-            owners.add(owningFunctionName(node));
-        }
-        ts.forEachChild(node, visit);
-    }
-    visit(sourceFile);
-    if (owners.size > 0) {
-        return [...owners];
-    }
-    return ["<unknown>"];
-}
-function isPropertyAccess(expression, objectName, propertyName) {
-    return (ts.isPropertyAccessExpression(expression) &&
-        ts.isIdentifier(expression.expression) &&
-        expression.expression.text === objectName &&
-        expression.name.text === propertyName);
-}
-function isEditorExtensionsProjectionValue(expression) {
-    if (!ts.isObjectLiteralExpression(expression)) {
-        return false;
-    }
-    const [property] = expression.properties;
-    return (expression.properties.length === 1 &&
-        property !== undefined &&
-        ts.isPropertyAssignment(property) &&
-        ts.isIdentifier(property.name) &&
-        property.name.text === "recommendations" &&
-        isPropertyAccess(property.initializer, "editorCustomization", "extensions"));
-}
-function isStructuredEditorCustomizationOperation(sourceFile, operation) {
-    if (operation.kind !== "writeJson") {
-        return false;
-    }
-    if (operation.to !== ".vscode/extensions.json" &&
-        operation.to !== ".vscode/settings.json") {
-        return false;
-    }
-    const matches = findAstMatchesForOperation(sourceFile, operation);
-    if (matches.length === 0) {
-        return false;
-    }
-    return matches.every((match) => {
-        const value = propertyInitializer(match.node, "value");
-        return (value !== undefined &&
-            (operation.to === ".vscode/settings.json"
-                ? isPropertyAccess(value, "editorCustomization", "settings")
-                : isEditorExtensionsProjectionValue(value)));
-    });
-}
-function isStringArray(value) {
-    return (Array.isArray(value) && value.every((entry) => typeof entry === "string"));
-}
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function hasExactKeys(value, expectedKeys) {
-    const keys = Object.keys(value);
-    const expectedKeySet = new Set(expectedKeys);
-    return (keys.length === expectedKeySet.size &&
-        keys.every((key) => expectedKeySet.has(key)));
-}
-function isStructuralTurboValue(value) {
-    if (!isRecord(value) ||
-        !(hasExactKeys(value, ["tasks"]) ||
-            hasExactKeys(value, ["tasks", "boundaries"])) ||
-        !isRecord(value.tasks)) {
-        return false;
-    }
-    if (!Object.values(value.tasks).every(isStructuralTurboTaskValue)) {
-        return false;
-    }
-    return (value.boundaries === undefined ||
-        isStructuralTurboBoundariesValue(value.boundaries));
-}
-function isStructuralTurboTaskValue(task) {
-    if (!isRecord(task)) {
-        return false;
-    }
-    return Object.entries(task).every(([key, entryValue]) => {
-        if (key === "dependsOn" || key === "outputs") {
-            return isStringArray(entryValue);
-        }
-        if (key === "cache" || key === "persistent") {
-            return typeof entryValue === "boolean";
-        }
-        return false;
-    });
-}
-function isStructuralTurboBoundariesValue(value) {
-    if (!isRecord(value) || !hasExactKeys(value, ["tags"])) {
-        return false;
-    }
-    if (!isRecord(value.tags)) {
-        return false;
-    }
-    return Object.values(value.tags).every((tagRule) => {
-        if (!isRecord(tagRule)) {
-            return false;
-        }
-        return Object.entries(tagRule).every(([key, entryValue]) => {
-            if (key !== "dependencies" && key !== "dependents") {
-                return false;
-            }
-            return isStructuralTurboBoundaryDirectionValue(entryValue);
-        });
-    });
-}
-function isStructuralTurboBoundaryDirectionValue(value) {
-    if (!isRecord(value)) {
-        return false;
-    }
-    return Object.entries(value).every(([key, entryValue]) => {
-        if (key !== "allow" && key !== "deny") {
-            return false;
-        }
-        return isStringArray(entryValue);
-    });
-}
-const rootTsconfigConfigCompilerOptions = {
-    module: "nodenext",
-    moduleResolution: "nodenext",
-    noEmitOnError: true,
-    skipLibCheck: false,
-    strict: true,
-    target: "es2024",
-};
-const rootTsconfigConfigIncludes = new Set([
-    "oxlint.config.ts",
-    "oxfmt.config.ts",
-    "playwright.config.ts",
-    "vite.config.ts",
-    "vitest.config.ts",
-]);
-function isStructuralTsconfigConfigValue(value) {
-    if (!isRecord(value) ||
-        !hasExactKeys(value, ["compilerOptions", "include"]) ||
-        !isRecord(value.compilerOptions) ||
-        !isStringArray(value.include)) {
-        return false;
-    }
-    return (jsonValuesEqual(value.compilerOptions, rootTsconfigConfigCompilerOptions) &&
-        value.include.every((entry) => rootTsconfigConfigIncludes.has(entry)));
-}
-function isDevelopmentContainerPlanValue(expression) {
-    return isPropertyAccess(expression, "developmentContainer", "devcontainer");
-}
-function isDevelopmentContainerToolLayerMergeValue(value) {
-    if (!isRecord(value) ||
-        !(hasExactKeys(value, ["build"]) || hasExactKeys(value, ["build", "mounts"])) ||
-        !isRecord(value.build) ||
-        !hasExactKeys(value.build, ["args"]) ||
-        !isRecord(value.build.args) ||
-        !Object.values(value.build.args).every((argument) => typeof argument === "string")) {
-        return false;
-    }
-    return (value.mounts === undefined ||
-        (Array.isArray(value.mounts) &&
-            value.mounts.every((mount) => isRecord(mount) &&
-                hasExactKeys(mount, ["type", "source", "target"]) &&
-                (mount.type === "bind" || mount.type === "volume") &&
-                typeof mount.source === "string" &&
-                typeof mount.target === "string")));
-}
-function isAllowedStructuralMachineDeclaration(sourceFile, operation) {
-    if (operation.kind === "mergeJson" &&
-        operation.to === ".devcontainer/devcontainer.json") {
-        return isDevelopmentContainerToolLayerMergeValue(operation.value);
-    }
-    if ((operation.kind === "writeJson" || operation.kind === "mergeJson") &&
-        operation.to === "turbo.json") {
-        return isStructuralTurboValue(operation.value);
-    }
-    if (operation.kind !== "writeJson") {
-        return false;
-    }
-    if (operation.to === "tsconfig.config.json") {
-        return isStructuralTsconfigConfigValue(operation.value);
-    }
-    if (operation.to !== ".devcontainer/devcontainer.json") {
-        return false;
-    }
-    const matches = findAstMatchesForOperation(sourceFile, operation);
-    return (matches.length > 0 &&
-        matches.every((match) => {
-            const value = propertyInitializer(match.node, "value");
-            return value !== undefined && isDevelopmentContainerPlanValue(value);
-        }));
-}
-function sourceBackedOperationSourceFiles(projection, operation) {
-    if (operation.kind === "writeTextFromFragments") {
-        return operation.fragments.map((fragment) => {
-            try {
-                return resolveTemplateSource(fragment.source, fragment.from);
-            }
-            catch (error) {
-                return `invalid-source:${error instanceof Error ? error.message : String(error)}`;
-            }
-        });
-    }
-    try {
-        return [resolveTemplateSource(operation.source, operation.from)];
-    }
-    catch (error) {
-        return [
-            `invalid-source:${error instanceof Error ? error.message : String(error)}`,
-        ];
-    }
-}
-async function operationUsesCheckedTemplateSource(projection, operation, templateSourceContexts, manifestReferencedSourceFiles) {
-    const sourceFiles = sourceBackedOperationSourceFiles(projection, operation);
-    const results = await Promise.all(sourceFiles.map(async (sourceFile) => {
-        const context = templateSourceContexts.find((candidate) => {
-            const root = path.resolve(candidate.root);
-            return (sourceFile.startsWith(`${root}${path.sep}`) || sourceFile === root);
-        });
-        if (context === undefined) {
-            return manifestReferencedSourceFiles.has(sourceFile);
-        }
-        const relativePath = path.relative(path.resolve(context.root), sourceFile);
-        if (relativePath.length === 0 ||
-            relativePath === ".." ||
-            relativePath.startsWith(`..${path.sep}`) ||
-            path.isAbsolute(relativePath)) {
-            return false;
-        }
-        return context.checkedFiles?.includes(sourceFile) ?? false;
-    }));
-    return results.every(Boolean);
-}
-function pushSourceBackedOperationViolations(options) {
-    const generatedPath = operationTarget(options.operation);
-    if (generatedPath === undefined) {
-        return;
-    }
-    const owningFunctions = findOwningFunctionsForProtectedOperation(options.sourceFile, options.operation);
-    for (const owningFunction of owningFunctions) {
-        options.violations.push({
-            preset: options.projection.name,
-            generatedPath,
-            owningFunction,
-            operationKind: options.operation.kind,
-            sourceFilePath: options.operation.provenance?.plannerSourceFile ??
-                options.projection.sourceFilePath,
-            ...(options.operation.provenance === undefined &&
-                options.projection.definitionName === undefined
-                ? {}
-                : {
-                    definitionName: options.operation.provenance?.definitionName ??
-                        options.projection.definitionName,
-                    planningContribution: options.operation.provenance?.planningContribution ??
-                        options.projection.planningContribution,
-                    ownershipRule: options.operation.provenance?.ownershipRule ??
-                        "source-backed protected output must use declared, contained Template Source",
-                }),
-        });
-    }
-}
-const workflowTemplateVariants = new Map([
-    [
-        ".github/workflows/check.yml",
-        { operationKind: "copyFile", replacementKeys: [] },
-    ],
-    [
-        ".github/workflows/check-deployment.yml",
-        { operationKind: "copyFile", replacementKeys: [] },
-    ],
-    [
-        ".github/workflows/check-diagnostics.yml",
-        {
-            operationKind: "writeTextTemplate",
-            replacementKeys: [
-                "PLAYWRIGHT_DIAGNOSTIC_OWNER_PATHS",
-                "VITEST_BROWSER_DIAGNOSTIC_OWNER_PATHS",
-            ],
-        },
-    ],
-    [
-        ".github/workflows/check-deployment-diagnostics.yml",
-        {
-            operationKind: "writeTextTemplate",
-            replacementKeys: [
-                "PLAYWRIGHT_DIAGNOSTIC_OWNER_PATHS",
-                "VITEST_BROWSER_DIAGNOSTIC_OWNER_PATHS",
-            ],
-        },
-    ],
-]);
-function hasExactReplacementKeys(replacements, expectedKeys) {
-    const keys = Object.keys(replacements).toSorted();
-    const expected = [...expectedKeys].toSorted();
-    return (keys.length === expected.length &&
-        keys.every((key, index) => key === expected[index]));
-}
-const reservedWorkspaceCollections = new Set([
-    ".git",
-    ".github",
-    ".devcontainer",
-    ".template",
-    "node_modules",
-    "dist",
-    "target",
-]);
-function isSafePackageBoundaryPath(value) {
-    return (/^[a-z0-9][a-z0-9-]*\/[a-z0-9][a-z0-9-]*$/u.test(value) &&
-        !reservedWorkspaceCollections.has(value.split("/", 1)[0]));
-}
-/**
- * Independent oracle for the Foundation workflow's limited substitution.
- * It deliberately consumes raw Blueprint and Package Contribution facts rather
- * than the production CI artifact composer or its composed plan output.
- */
-function expectedDiagnosticOwnerPaths(options) {
-    const blueprintPackagePaths = options.blueprint.packages.map((packageDefinition) => packageDefinition.path);
-    if (!blueprintPackagePaths.every(isSafePackageBoundaryPath)) {
-        return { valid: false, playwright: "", vitestBrowser: "" };
-    }
-    const blueprintOwners = new Set(blueprintPackagePaths);
-    const owners = {
-        playwright: new Set(),
-        "vitest-browser": new Set(),
-    };
-    for (const declaration of options.diagnosticArtifactDeclarations) {
-        if (!isRecord(declaration) ||
-            !hasExactKeys(declaration, ["kind", "owner"])) {
-            return { valid: false, playwright: "", vitestBrowser: "" };
-        }
-        if ((declaration.kind !== "playwright" &&
-            declaration.kind !== "vitest-browser") ||
-            !isRecord(declaration.owner)) {
-            return { valid: false, playwright: "", vitestBrowser: "" };
-        }
-        if (!hasExactKeys(declaration.owner, ["kind", "path"])) {
-            return { valid: false, playwright: "", vitestBrowser: "" };
-        }
-        const ownerPath = declaration.owner.path;
-        const workspaceOwner = declaration.owner.kind === "workspace-orchestration" && ownerPath === ".";
-        const packageOwner = declaration.owner.kind === "package-boundary" &&
-            typeof ownerPath === "string" &&
-            isSafePackageBoundaryPath(ownerPath) &&
-            blueprintOwners.has(ownerPath);
-        if (!workspaceOwner && !packageOwner) {
-            return { valid: false, playwright: "", vitestBrowser: "" };
-        }
-        owners[declaration.kind].add(ownerPath);
-    }
-    return {
-        valid: true,
-        playwright: [...owners.playwright].toSorted().join("\n            "),
-        vitestBrowser: [...owners["vitest-browser"]]
-            .toSorted()
-            .join("\n            "),
-    };
-}
-function sourceFileForWorkflowOperation(options) {
-    return options.operation?.provenance?.plannerSourceFile ?? options.fallback;
-}
-function findWorkflowOperationOwners(sourceFile, operation) {
-    if (operation === undefined)
-        return ["<unknown>"];
-    const targetPath = operationTarget(operation);
-    if (targetPath === undefined)
-        return ["<unknown>"];
-    const expectedTargetPath = targetPath;
-    const operationKind = operation.kind;
-    const owners = new Set();
-    function visit(node) {
-        if (ts.isObjectLiteralExpression(node)) {
-            if (propertyStringValue(node, "kind") === operationKind &&
-                propertyPathMatches(node, "to", expectedTargetPath)) {
-                owners.add(owningFunctionName(node));
-            }
-        }
-        ts.forEachChild(node, visit);
-    }
-    visit(sourceFile);
-    return owners.size === 0 ? ["<unknown>"] : [...owners];
-}
-async function protectedWorkflowProjectionViolations(plans) {
-    const violations = [];
-    for (const plan of plans) {
-        const matchingOperations = plan.operations.filter((operation) => operationTarget(operation) === plan.generatedPath);
-        const operation = matchingOperations[0];
-        const sourceFilePath = sourceFileForWorkflowOperation({
-            operation,
-            fallback: plan.sourceFilePath,
-        });
-        const sourceText = await readFile(sourceFilePath, "utf8");
-        const sourceFile = ts.createSourceFile(sourceFilePath, sourceText, ts.ScriptTarget.Latest, true, ts.ScriptKind.TS);
-        const expectedDiagnosticOwners = expectedDiagnosticOwnerPaths(plan);
-        const variant = operation !== undefined &&
-            (operation.kind === "copyFile" || operation.kind === "writeTextTemplate")
-            ? workflowTemplateVariants.get(operation.from)
-            : undefined;
-        const replacementValid = operation?.kind === "writeTextTemplate" &&
-            hasExactReplacementKeys(operation.replacements, [
-                "PLAYWRIGHT_DIAGNOSTIC_OWNER_PATHS",
-                "VITEST_BROWSER_DIAGNOSTIC_OWNER_PATHS",
-            ]) &&
-            operation.replacements.PLAYWRIGHT_DIAGNOSTIC_OWNER_PATHS ===
-                expectedDiagnosticOwners.playwright &&
-            operation.replacements.VITEST_BROWSER_DIAGNOSTIC_OWNER_PATHS ===
-                expectedDiagnosticOwners.vitestBrowser;
-        const sourceBackedExactlyOnce = matchingOperations.length === 1 &&
-            operation !== undefined &&
-            (operation.kind === "copyFile" || operation.kind === "writeTextTemplate");
-        const diagnosticsExpected = expectedDiagnosticOwners.playwright !== "" ||
-            expectedDiagnosticOwners.vitestBrowser !== "";
-        const operationValid = expectedDiagnosticOwners.valid &&
-            sourceBackedExactlyOnce &&
-            variant !== undefined &&
-            operation?.kind === variant.operationKind &&
-            (operation.kind === "copyFile"
-                ? variant.replacementKeys.length === 0 && !diagnosticsExpected
-                : variant.replacementKeys.length === 2 &&
-                    diagnosticsExpected &&
-                    replacementValid);
-        if (operationValid)
-            continue;
-        for (const owningFunction of findWorkflowOperationOwners(sourceFile, operation)) {
-            violations.push({
-                preset: plan.name,
-                generatedPath: plan.generatedPath,
-                owningFunction,
-                operationKind: operation?.kind ?? "writeTextTemplate",
-                sourceFilePath,
-                ...(plan.definitionName === undefined
-                    ? {}
-                    : { definitionName: plan.definitionName }),
-                ...(plan.planningContribution === undefined
-                    ? {}
-                    : { planningContribution: plan.planningContribution }),
-                ownershipRule: "Foundation workflow projections require exactly one source-backed template operation with closed diagnostic owner facts",
-            });
-        }
-    }
-    return violations;
-}
-export async function checkTemplateSourceBoundary({ projections, templateSourceContexts = [], manifestReferencedSourceFiles = [], protectedWorkflowPlans = [], }) {
-    const manifestReferencedSourceFileSet = new Set(manifestReferencedSourceFiles.map((sourceFile) => path.resolve(sourceFile)));
-    const violations = [];
-    violations.push(...(await protectedWorkflowProjectionViolations(protectedWorkflowPlans)));
-    for (const projection of projections) {
-        const sourceText = await readFile(projection.sourceFilePath, "utf8");
-        const sourceFile = ts.createSourceFile(projection.sourceFilePath, sourceText, ts.ScriptTarget.Latest, true, ts.ScriptKind.TS);
-        for (const operation of projection.plan.operations) {
-            if (isProtectedSourceBackedOperation(operation)) {
-                if (!(await operationUsesCheckedTemplateSource(projection, operation, templateSourceContexts, manifestReferencedSourceFileSet))) {
-                    pushSourceBackedOperationViolations({
-                        projection,
-                        sourceFile,
-                        operation,
-                        violations,
-                    });
-                }
-                continue;
-            }
-            if (!isInlineProtectedOperation(operation)) {
-                continue;
-            }
-            if (isStructuredEditorCustomizationOperation(sourceFile, operation)) {
-                continue;
-            }
-            if (isAllowedStructuralMachineDeclaration(sourceFile, operation)) {
-                continue;
-            }
-            const owningFunctions = findOwningFunctionsForOperation(sourceFile, operation);
-            for (const owningFunction of owningFunctions) {
-                const diagnostic = {
-                    preset: projection.name,
-                    generatedPath: operation.to,
-                    owningFunction,
-                    operationKind: operation.kind,
-                    sourceFilePath: operation.provenance?.plannerSourceFile ??
-                        projection.sourceFilePath,
-                    ...(operation.provenance === undefined &&
-                        projection.definitionName === undefined
-                        ? {}
-                        : {
-                            definitionName: operation.provenance?.definitionName ??
-                                projection.definitionName,
-                            planningContribution: operation.provenance?.planningContribution ??
-                                projection.planningContribution,
-                            ownershipRule: operation.provenance?.ownershipRule ??
-                                "protected generated output must be Template Source-backed",
-                        }),
-                };
-                violations.push(diagnostic);
-            }
-        }
-    }
-    return {
-        ok: violations.length === 0,
-        violations,
-    };
-}