mdkg 0.1.1 → 0.1.3

package/dist/graph/sqlite_index.js

@@ -0,0 +1,293 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SQLITE_SCHEMA_VERSION = void 0;
+exports.isSqliteBackend = isSqliteBackend;
+exports.resolveSqlitePath = resolveSqlitePath;
+exports.writeSqliteIndex = writeSqliteIndex;
+exports.reserveSqliteNumericId = reserveSqliteNumericId;
+exports.sqliteHealth = sqliteHealth;
+const crypto_1 = __importDefault(require("crypto"));
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const staleness_1 = require("./staleness");
+exports.SQLITE_SCHEMA_VERSION = 1;
+function loadDatabaseCtor() {
+    try {
+        const loaded = require("node:sqlite");
+        if (!loaded.DatabaseSync) {
+            throw new Error("node:sqlite DatabaseSync is unavailable");
+        }
+        return loaded.DatabaseSync;
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`node:sqlite is required for mdkg SQLite index support: ${message}`);
+    }
+}
+function toPosixPath(value) {
+    return value.split(path_1.default.sep).join("/");
+}
+function sha256File(filePath) {
+    return `sha256:${crypto_1.default.createHash("sha256").update(fs_1.default.readFileSync(filePath)).digest("hex")}`;
+}
+function stripVolatileCacheFields(value) {
+    if (Array.isArray(value)) {
+        return value.map((item) => stripVolatileCacheFields(item));
+    }
+    if (value && typeof value === "object") {
+        const input = value;
+        const output = {};
+        for (const key of Object.keys(input).sort()) {
+            if (key === "generated_at" || key === "indexed_at") {
+                continue;
+            }
+            output[key] = stripVolatileCacheFields(input[key]);
+        }
+        return output;
+    }
+    return value;
+}
+function stableCacheJson(value) {
+    return JSON.stringify(stripVolatileCacheFields(value));
+}
+function isSqliteBackend(config) {
+    return config.index.backend === "sqlite";
+}
+function resolveSqlitePath(root, config) {
+    return path_1.default.resolve(root, config.index.sqlite_path);
+}
+function sqliteTempPath(sqlitePath) {
+    return path_1.default.join(path_1.default.dirname(sqlitePath), `.${path_1.default.basename(sqlitePath)}.${process.pid}.${Date.now()}.tmp`);
+}
+function createSchema(db) {
+    db.exec(`
+    PRAGMA journal_mode = DELETE;
+    PRAGMA synchronous = FULL;
+    CREATE TABLE meta (key TEXT PRIMARY KEY, value TEXT NOT NULL);
+    CREATE TABLE nodes (
+      qid TEXT PRIMARY KEY,
+      id TEXT NOT NULL,
+      ws TEXT NOT NULL,
+      type TEXT NOT NULL,
+      title TEXT NOT NULL,
+      path TEXT NOT NULL,
+      status TEXT,
+      priority INTEGER,
+      updated TEXT,
+      source_hash TEXT,
+      json TEXT NOT NULL
+    );
+    CREATE TABLE edges (
+      source_qid TEXT NOT NULL,
+      kind TEXT NOT NULL,
+      target_qid TEXT NOT NULL,
+      PRIMARY KEY (source_qid, kind, target_qid)
+    );
+    CREATE TABLE skills (
+      qid TEXT PRIMARY KEY,
+      slug TEXT NOT NULL,
+      ws TEXT NOT NULL,
+      name TEXT NOT NULL,
+      path TEXT NOT NULL,
+      json TEXT NOT NULL
+    );
+    CREATE TABLE capabilities (
+      qid TEXT NOT NULL,
+      kind TEXT NOT NULL,
+      workspace TEXT NOT NULL,
+      visibility TEXT NOT NULL,
+      id TEXT NOT NULL,
+      path TEXT NOT NULL,
+      source_hash TEXT NOT NULL,
+      json TEXT NOT NULL,
+      PRIMARY KEY (qid, kind, path)
+    );
+    CREATE TABLE archives (
+      qid TEXT PRIMARY KEY,
+      visibility TEXT NOT NULL,
+      compressed_path TEXT,
+      compressed_sha256 TEXT,
+      json TEXT NOT NULL
+    );
+    CREATE TABLE bundle_imports (
+      alias TEXT PRIMARY KEY,
+      enabled INTEGER NOT NULL,
+      stale INTEGER NOT NULL,
+      error_count INTEGER NOT NULL,
+      warning_count INTEGER NOT NULL,
+      json TEXT NOT NULL
+    );
+    CREATE TABLE id_allocations (
+      ws TEXT NOT NULL,
+      prefix TEXT NOT NULL,
+      next_value INTEGER NOT NULL,
+      PRIMARY KEY (ws, prefix)
+    );
+  `);
+}
+function insertMeta(db, key, value) {
+    db.prepare("INSERT INTO meta (key, value) VALUES (?, ?)").run(key, value);
+}
+function nodeSourceHash(root, nodePath) {
+    const fullPath = path_1.default.resolve(root, nodePath);
+    if (!fs_1.default.existsSync(fullPath) || !fs_1.default.statSync(fullPath).isFile()) {
+        return undefined;
+    }
+    return sha256File(fullPath);
+}
+function buildSourceFingerprint(options) {
+    const payload = {
+        nodes: Object.values(options.nodeIndex.nodes)
+            .sort((a, b) => a.qid.localeCompare(b.qid))
+            .map((node) => ({
+            qid: node.qid,
+            path: node.path,
+            hash: options.nodeHashes.get(node.qid) ?? "",
+        })),
+        skills: Object.values(options.skillsIndex.skills).sort((a, b) => a.qid.localeCompare(b.qid)),
+        capabilities: options.capabilitiesIndex.records,
+        imports: options.importsIndex.imports,
+    };
+    return `sha256:${crypto_1.default.createHash("sha256").update(stableCacheJson(payload)).digest("hex")}`;
+}
+function writeSqliteIndex(options) {
+    const sqlitePath = resolveSqlitePath(options.root, options.config);
+    fs_1.default.mkdirSync(path_1.default.dirname(sqlitePath), { recursive: true });
+    const tempPath = sqliteTempPath(sqlitePath);
+    fs_1.default.rmSync(tempPath, { force: true });
+    const DatabaseSync = loadDatabaseCtor();
+    const db = new DatabaseSync(tempPath);
+    try {
+        const nodeHashes = new Map();
+        for (const node of Object.values(options.nodeIndex.nodes)) {
+            nodeHashes.set(node.qid, nodeSourceHash(options.root, node.path));
+        }
+        createSchema(db);
+        insertMeta(db, "tool", "mdkg");
+        insertMeta(db, "schema_version", String(exports.SQLITE_SCHEMA_VERSION));
+        insertMeta(db, "package_schema_version", String(options.config.schema_version));
+        insertMeta(db, "backend", options.config.index.backend);
+        insertMeta(db, "source_fingerprint", buildSourceFingerprint({ ...options, nodeHashes }));
+        insertMeta(db, "root", ".");
+        const insertNode = db.prepare("INSERT INTO nodes (qid, id, ws, type, title, path, status, priority, updated, source_hash, json) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)");
+        const insertEdge = db.prepare("INSERT OR IGNORE INTO edges (source_qid, kind, target_qid) VALUES (?, ?, ?)");
+        for (const node of Object.values(options.nodeIndex.nodes).sort((a, b) => a.qid.localeCompare(b.qid))) {
+            insertNode.run(node.qid, node.id, node.ws, node.type, node.title, toPosixPath(node.path), node.status ?? null, node.priority ?? null, node.updated ?? null, nodeHashes.get(node.qid) ?? null, stableCacheJson(node));
+            for (const [kind, values] of [
+                ["relates", node.edges.relates],
+                ["blocked_by", node.edges.blocked_by],
+                ["blocks", node.edges.blocks],
+            ]) {
+                for (const target of values) {
+                    insertEdge.run(node.qid, kind, target);
+                }
+            }
+            for (const [kind, target] of [
+                ["epic", node.edges.epic],
+                ["parent", node.edges.parent],
+                ["prev", node.edges.prev],
+                ["next", node.edges.next],
+            ]) {
+                if (target) {
+                    insertEdge.run(node.qid, kind, target);
+                }
+            }
+        }
+        const insertSkill = db.prepare("INSERT INTO skills (qid, slug, ws, name, path, json) VALUES (?, ?, ?, ?, ?, ?)");
+        for (const skill of Object.values(options.skillsIndex.skills).sort((a, b) => a.qid.localeCompare(b.qid))) {
+            insertSkill.run(skill.qid, skill.slug, skill.ws, skill.name, skill.path, stableCacheJson(skill));
+        }
+        const insertCapability = db.prepare("INSERT INTO capabilities (qid, kind, workspace, visibility, id, path, source_hash, json) VALUES (?, ?, ?, ?, ?, ?, ?, ?)");
+        for (const record of options.capabilitiesIndex.records) {
+            insertCapability.run(record.qid, record.kind, record.workspace, record.visibility, record.id, record.path, record.source_hash, stableCacheJson(record));
+        }
+        const insertArchive = db.prepare("INSERT INTO archives (qid, visibility, compressed_path, compressed_sha256, json) VALUES (?, ?, ?, ?, ?)");
+        for (const node of Object.values(options.nodeIndex.nodes).filter((item) => item.type === "archive")) {
+            insertArchive.run(node.qid, String(node.attributes.visibility ?? "private"), String(node.attributes.compressed_path ?? ""), String(node.attributes.compressed_sha256 ?? ""), stableCacheJson(node));
+        }
+        const insertImport = db.prepare("INSERT INTO bundle_imports (alias, enabled, stale, error_count, warning_count, json) VALUES (?, ?, ?, ?, ?, ?)");
+        for (const item of options.importsIndex.imports) {
+            insertImport.run(item.alias, item.enabled ? 1 : 0, item.stale ? 1 : 0, item.error_count, item.warning_count, stableCacheJson(item));
+        }
+    }
+    finally {
+        db.close();
+    }
+    fs_1.default.renameSync(tempPath, sqlitePath);
+    return sqlitePath;
+}
+function reserveSqliteNumericId(options) {
+    if (!isSqliteBackend(options.config)) {
+        return undefined;
+    }
+    const sqlitePath = resolveSqlitePath(options.root, options.config);
+    fs_1.default.mkdirSync(path_1.default.dirname(sqlitePath), { recursive: true });
+    const DatabaseSync = loadDatabaseCtor();
+    const db = new DatabaseSync(sqlitePath);
+    try {
+        db.exec("CREATE TABLE IF NOT EXISTS id_allocations (ws TEXT NOT NULL, prefix TEXT NOT NULL, next_value INTEGER NOT NULL, PRIMARY KEY (ws, prefix));");
+        db.exec("BEGIN IMMEDIATE");
+        const row = db
+            .prepare("SELECT next_value FROM id_allocations WHERE ws = ? AND prefix = ?")
+            .get(options.ws, options.prefix);
+        const existing = typeof row?.next_value === "number" ? row.next_value : undefined;
+        const nextValue = Math.max(existing ?? 1, options.currentMax + 1);
+        db.prepare("INSERT INTO id_allocations (ws, prefix, next_value) VALUES (?, ?, ?) ON CONFLICT(ws, prefix) DO UPDATE SET next_value = excluded.next_value").run(options.ws, options.prefix, nextValue + 1);
+        db.exec("COMMIT");
+        return `${options.prefix}-${nextValue}`;
+    }
+    catch (err) {
+        try {
+            db.exec("ROLLBACK");
+        }
+        catch {
+            // ignore rollback failures when no transaction is active
+        }
+        throw err;
+    }
+    finally {
+        db.close();
+    }
+}
+function sqliteHealth(root, config) {
+    const sqlitePath = resolveSqlitePath(root, config);
+    const warnings = [];
+    const errors = [];
+    if (!fs_1.default.existsSync(sqlitePath)) {
+        warnings.push(`SQLite cache missing at ${toPosixPath(path_1.default.relative(root, sqlitePath))}; run mdkg index`);
+        return { path: sqlitePath, exists: false, size: 0, warnings, errors };
+    }
+    const size = fs_1.default.statSync(sqlitePath).size;
+    if (config.index.sqlite_commit_warning_bytes > 0 && size > config.index.sqlite_commit_warning_bytes) {
+        warnings.push(`SQLite cache exceeds ${config.index.sqlite_commit_warning_bytes} bytes: ${toPosixPath(path_1.default.relative(root, sqlitePath))} (${size} bytes)`);
+    }
+    for (const suffix of ["-wal", "-shm", "-journal"]) {
+        const transient = `${sqlitePath}${suffix}`;
+        if (fs_1.default.existsSync(transient)) {
+            warnings.push(`transient SQLite file present: ${toPosixPath(path_1.default.relative(root, transient))}`);
+        }
+    }
+    try {
+        const DatabaseSync = loadDatabaseCtor();
+        const db = new DatabaseSync(sqlitePath);
+        try {
+            const row = db.prepare("SELECT value FROM meta WHERE key = 'schema_version'").get();
+            if (String(row?.value ?? "") !== String(exports.SQLITE_SCHEMA_VERSION)) {
+                errors.push(`SQLite schema mismatch; run mdkg index`);
+            }
+        }
+        finally {
+            db.close();
+        }
+    }
+    catch (err) {
+        errors.push(`failed to read SQLite cache: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if ((0, staleness_1.isIndexStale)(root, config)) {
+        warnings.push("SQLite cache may be stale because source graph files or config changed; run mdkg index");
+    }
+    return { path: sqlitePath, exists: true, size, warnings, errors };
+}

package/dist/graph/validate_graph.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.collectGraphErrors = collectGraphErrors;
 exports.validateGraph = validateGraph;
+const refs_1 = require("../util/refs");
 function pushError(errors, message) {
     if (errors) {
         errors.push(message);
@@ -9,7 +10,7 @@ function pushError(errors, message) {
     }
     throw new Error(message);
 }
-function validateEdgeTargets(index, allowMissing, knownSkillSlugs, errors) {
+function validateEdgeTargets(index, allowMissing, knownSkillSlugs, externalWorkspaces, errors) {
     const nodes = index.nodes;
     for (const [qid, node] of Object.entries(nodes)) {
         const edges = node.edges;
@@ -33,6 +34,10 @@ function validateEdgeTargets(index, allowMissing, knownSkillSlugs, errors) {
         for (const [edgeKey, values] of edgeLists) {
             for (const value of values) {
                 if (!nodes[value]) {
+                    const [workspace] = value.split(":");
+                    if (workspace && externalWorkspaces?.has(workspace)) {
+                        continue;
+                    }
                     if (edgeKey === "relates" &&
                         node.type === "proposal" &&
                         node.attributes.proposal_kind === "skill_update" &&
@@ -320,7 +325,11 @@ function buildNodeIdsByWorkspace(index) {
     }
     return nodeIdsByWorkspace;
 }
-function validateAgentWorkflowNodeIdRef(qid, ws, field, value, nodeIdsByWorkspace, allowSkillRef, knownSkillSlugs, allowMissing, errors) {
+function validateAgentWorkflowNodeIdRef(qid, ws, field, value, nodeIdsByWorkspace, allowSkillRef, knownSkillSlugs, externalWorkspaces, allowMissing, errors) {
+    const [workspace] = value.split(":");
+    if (workspace && value.includes(":") && externalWorkspaces?.has(workspace)) {
+        return;
+    }
     if (nodeIdsByWorkspace[ws]?.has(value)) {
         return;
     }
@@ -333,7 +342,7 @@ function validateAgentWorkflowNodeIdRef(qid, ws, field, value, nodeIdsByWorkspac
     }
     pushError(errors, `${qid}: ${field} references missing node ${value}`);
 }
-function validateAgentWorkflowFeedbackProposalRefs(index, allowMissing, knownSkillSlugs, errors) {
+function validateAgentWorkflowFeedbackProposalRefs(index, allowMissing, knownSkillSlugs, externalWorkspaces, errors) {
     const nodeIdsByWorkspace = buildNodeIdsByWorkspace(index);
     for (const [qid, node] of Object.entries(index.nodes)) {
         if (node.type !== "feedback" && node.type !== "proposal") {
@@ -342,7 +351,7 @@ function validateAgentWorkflowFeedbackProposalRefs(index, allowMissing, knownSki
         const targetId = node.attributes.target_id;
         if (typeof targetId === "string") {
             const allowSkillTarget = node.type === "proposal" && node.attributes.proposal_kind === "skill_update";
-            validateAgentWorkflowNodeIdRef(qid, node.ws, "target_id", targetId, nodeIdsByWorkspace, allowSkillTarget, knownSkillSlugs, allowMissing, errors);
+            validateAgentWorkflowNodeIdRef(qid, node.ws, "target_id", targetId, nodeIdsByWorkspace, allowSkillTarget, knownSkillSlugs, externalWorkspaces, allowMissing, errors);
         }
         if (node.type !== "proposal") {
             continue;
@@ -355,7 +364,72 @@ function validateAgentWorkflowFeedbackProposalRefs(index, allowMissing, knownSki
             if (typeof value !== "string") {
                 continue;
             }
-            validateAgentWorkflowNodeIdRef(qid, node.ws, `evidence_refs[${indexValue}]`, value, nodeIdsByWorkspace, true, knownSkillSlugs, allowMissing, errors);
+            validateAgentWorkflowNodeIdRef(qid, node.ws, `evidence_refs[${indexValue}]`, value, nodeIdsByWorkspace, true, knownSkillSlugs, externalWorkspaces, allowMissing, errors);
+        }
+    }
+}
+function buildArchiveIdsByWorkspace(index) {
+    const archiveIdsByWorkspace = {};
+    for (const node of Object.values(index.nodes)) {
+        if (node.type !== "archive") {
+            continue;
+        }
+        if (!archiveIdsByWorkspace[node.ws]) {
+            archiveIdsByWorkspace[node.ws] = new Set();
+        }
+        archiveIdsByWorkspace[node.ws].add(node.id);
+    }
+    return archiveIdsByWorkspace;
+}
+function validateArchiveUriValue(qid, ws, field, value, archiveIdsByWorkspace, allowMissing, errors) {
+    if (!value.startsWith("archive://")) {
+        return;
+    }
+    const archiveId = (0, refs_1.archiveIdFromUri)(value);
+    if (!archiveId) {
+        pushError(errors, `${qid}: ${field} has malformed archive ref ${value}`);
+        return;
+    }
+    if (archiveIdsByWorkspace[ws]?.has(archiveId)) {
+        return;
+    }
+    if (allowMissing) {
+        return;
+    }
+    pushError(errors, `${qid}: ${field} references missing archive ${value}`);
+}
+function validateArchiveUriRefs(index, allowMissing, errors) {
+    const archiveIdsByWorkspace = buildArchiveIdsByWorkspace(index);
+    const attributeListFields = [
+        "input_refs",
+        "constraint_refs",
+        "proof_refs",
+        "attestation_refs",
+    ];
+    const attributeScalarFields = ["request_ref", "cost_ref"];
+    for (const [qid, node] of Object.entries(index.nodes)) {
+        for (const [indexValue, value] of node.artifacts.entries()) {
+            validateArchiveUriValue(qid, node.ws, `artifacts[${indexValue}]`, value, archiveIdsByWorkspace, allowMissing, errors);
+        }
+        const attributes = node.attributes ?? {};
+        for (const field of attributeListFields) {
+            const values = attributes[field];
+            if (!Array.isArray(values)) {
+                continue;
+            }
+            for (const [indexValue, value] of values.entries()) {
+                if (typeof value !== "string") {
+                    continue;
+                }
+                validateArchiveUriValue(qid, node.ws, `${field}[${indexValue}]`, value, archiveIdsByWorkspace, allowMissing, errors);
+            }
+        }
+        for (const field of attributeScalarFields) {
+            const value = attributes[field];
+            if (typeof value !== "string") {
+                continue;
+            }
+            validateArchiveUriValue(qid, node.ws, field, value, archiveIdsByWorkspace, allowMissing, errors);
         }
     }
 }
@@ -396,14 +470,16 @@ function collectGraphErrors(index, options = {}) {
     const errors = [];
     const allowMissing = options.allowMissing ?? false;
     const knownSkillSlugs = options.knownSkillSlugs;
-    validateEdgeTargets(index, allowMissing, knownSkillSlugs, errors);
+    const externalWorkspaces = options.externalWorkspaces;
+    validateEdgeTargets(index, allowMissing, knownSkillSlugs, externalWorkspaces, errors);
     validatePrevNextSymmetry(index, allowMissing, errors);
     validateAgentWorkflowSpecWorkContracts(index, allowMissing, errors);
     validateAgentWorkflowWorkOrderWorkRefs(index, allowMissing, errors);
     validateAgentWorkflowReceiptWorkOrderRefs(index, allowMissing, errors);
     validateAgentWorkflowSubagentRefs(index, allowMissing, errors);
     validateAgentWorkflowDisputeRefs(index, allowMissing, errors);
-    validateAgentWorkflowFeedbackProposalRefs(index, allowMissing, knownSkillSlugs, errors);
+    validateAgentWorkflowFeedbackProposalRefs(index, allowMissing, knownSkillSlugs, externalWorkspaces, errors);
+    validateArchiveUriRefs(index, allowMissing, errors);
     detectPrevNextCycles(index, errors);
     return errors;
 }

package/dist/graph/visibility.js

@@ -0,0 +1,214 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VISIBILITY_VALUES = void 0;
+exports.isVisibility = isVisibility;
+exports.normalizeVisibility = normalizeVisibility;
+exports.isVisibleAt = isVisibleAt;
+exports.isLessVisibleThan = isLessVisibleThan;
+exports.effectiveNodeVisibility = effectiveNodeVisibility;
+exports.collectNodeVisibilityReferences = collectNodeVisibilityReferences;
+exports.collectVisibilityViolations = collectVisibilityViolations;
+exports.visibilityViolationMessages = visibilityViolationMessages;
+const errors_1 = require("../util/errors");
+const refs_1 = require("../util/refs");
+exports.VISIBILITY_VALUES = ["public", "internal", "private"];
+const VISIBILITY_RANK = {
+    public: 0,
+    internal: 1,
+    private: 2,
+};
+function isVisibility(value) {
+    return typeof value === "string" && exports.VISIBILITY_VALUES.includes(value);
+}
+function normalizeVisibility(value, label = "--visibility", fallback = "private") {
+    const normalized = (value ?? fallback).toLowerCase();
+    if (isVisibility(normalized)) {
+        return normalized;
+    }
+    throw new errors_1.UsageError(`${label} must be public, internal, or private`);
+}
+function isVisibleAt(recordVisibility, scope) {
+    return VISIBILITY_RANK[recordVisibility] <= VISIBILITY_RANK[scope];
+}
+function isLessVisibleThan(targetVisibility, sourceVisibility) {
+    return VISIBILITY_RANK[targetVisibility] > VISIBILITY_RANK[sourceVisibility];
+}
+function effectiveNodeVisibility(node, config) {
+    if (node.source?.imported && isVisibility(node.source.visibility)) {
+        return node.source.visibility;
+    }
+    const archiveVisibility = node.attributes.visibility;
+    if (node.type === "archive" && isVisibility(archiveVisibility)) {
+        return archiveVisibility;
+    }
+    const workspaceVisibility = config.workspaces[node.ws]?.visibility;
+    if (isVisibility(workspaceVisibility)) {
+        return workspaceVisibility;
+    }
+    const importVisibility = config.bundle_imports[node.ws]?.visibility;
+    if (isVisibility(importVisibility)) {
+        return importVisibility;
+    }
+    return "private";
+}
+function collectStringValues(value, prefix, out) {
+    if (typeof value === "string") {
+        out.push({ field: prefix, value });
+        return;
+    }
+    if (Array.isArray(value)) {
+        value.forEach((item, index) => collectStringValues(item, `${prefix}[${index}]`, out));
+        return;
+    }
+    if (typeof value === "object" && value !== null) {
+        for (const [key, child] of Object.entries(value)) {
+            collectStringValues(child, prefix ? `${prefix}.${key}` : key, out);
+        }
+    }
+}
+function collectNodeStringReferences(node) {
+    const values = [];
+    const edgeFields = [
+        ["epic", node.edges.epic],
+        ["parent", node.edges.parent],
+        ["prev", node.edges.prev],
+        ["next", node.edges.next],
+    ];
+    for (const [field, value] of edgeFields) {
+        if (value) {
+            values.push({ field, value });
+        }
+    }
+    for (const [index, value] of node.edges.relates.entries()) {
+        values.push({ field: `relates[${index}]`, value });
+    }
+    for (const [index, value] of node.edges.blocked_by.entries()) {
+        values.push({ field: `blocked_by[${index}]`, value });
+    }
+    for (const [index, value] of node.edges.blocks.entries()) {
+        values.push({ field: `blocks[${index}]`, value });
+    }
+    for (const [index, value] of node.links.entries()) {
+        values.push({ field: `links[${index}]`, value });
+    }
+    for (const [index, value] of node.artifacts.entries()) {
+        values.push({ field: `artifacts[${index}]`, value });
+    }
+    for (const [index, value] of node.refs.entries()) {
+        values.push({ field: `refs[${index}]`, value });
+    }
+    collectStringValues(node.attributes, "attributes", values);
+    return values;
+}
+function archiveNodeById(index, workspace, archiveId) {
+    const sameWorkspace = index.nodes[`${workspace}:${archiveId}`];
+    if (sameWorkspace?.type === "archive") {
+        return sameWorkspace;
+    }
+    const matches = Object.values(index.nodes).filter((candidate) => candidate.type === "archive" && candidate.id === archiveId);
+    return matches.length === 1 ? matches[0] : undefined;
+}
+function resolveReferenceTarget(index, source, value) {
+    const archiveId = (0, refs_1.archiveIdFromUri)(value);
+    if (archiveId) {
+        return archiveNodeById(index, source.ws, archiveId);
+    }
+    if ((0, refs_1.isUriRef)(value)) {
+        return undefined;
+    }
+    const exact = index.nodes[value];
+    if (exact) {
+        return exact;
+    }
+    if (!value.includes(":")) {
+        return index.nodes[`${source.ws}:${value}`];
+    }
+    return undefined;
+}
+function collectNodeVisibilityReferences(index, config, node) {
+    const references = [];
+    const seen = new Set();
+    for (const ref of collectNodeStringReferences(node)) {
+        const target = resolveReferenceTarget(index, node, ref.value);
+        if (!target || target.qid === node.qid) {
+            continue;
+        }
+        const key = `${ref.field}\0${ref.value}\0${target.qid}`;
+        if (seen.has(key)) {
+            continue;
+        }
+        seen.add(key);
+        references.push({
+            field: ref.field,
+            value: ref.value,
+            targetQid: target.qid,
+            targetVisibility: effectiveNodeVisibility(target, config),
+        });
+    }
+    return references;
+}
+function collectVisibilityViolations(index, config, options = {}) {
+    const violations = [];
+    const qids = options.includedQids
+        ? Object.keys(index.nodes).filter((qid) => options.includedQids?.has(qid))
+        : Object.keys(index.nodes);
+    for (const qid of qids.sort()) {
+        const node = index.nodes[qid];
+        if (!node) {
+            continue;
+        }
+        const sourceVisibility = effectiveNodeVisibility(node, config);
+        if (options.scope && !isVisibleAt(sourceVisibility, options.scope)) {
+            continue;
+        }
+        for (const ref of collectNodeVisibilityReferences(index, config, node)) {
+            if (options.includedQids && !options.includedQids.has(ref.targetQid)) {
+                const target = index.nodes[ref.targetQid];
+                if (!target) {
+                    continue;
+                }
+                const targetVisibility = effectiveNodeVisibility(target, config);
+                if (options.scope && isVisibleAt(targetVisibility, options.scope)) {
+                    continue;
+                }
+                violations.push({
+                    qid: node.qid,
+                    visibility: sourceVisibility,
+                    field: ref.field,
+                    value: ref.value,
+                    target_qid: ref.targetQid,
+                    target_visibility: targetVisibility,
+                    message: `${node.qid} references ${targetVisibility} ${ref.targetQid} through ${ref.field}`,
+                });
+                continue;
+            }
+            if (isLessVisibleThan(ref.targetVisibility, sourceVisibility)) {
+                violations.push({
+                    qid: node.qid,
+                    visibility: sourceVisibility,
+                    field: ref.field,
+                    value: ref.value,
+                    target_qid: ref.targetQid,
+                    target_visibility: ref.targetVisibility,
+                    message: `${node.qid} (${sourceVisibility}) references ${ref.targetVisibility} ${ref.targetQid} through ${ref.field}`,
+                });
+                continue;
+            }
+            if (options.scope && !isVisibleAt(ref.targetVisibility, options.scope)) {
+                violations.push({
+                    qid: node.qid,
+                    visibility: sourceVisibility,
+                    field: ref.field,
+                    value: ref.value,
+                    target_qid: ref.targetQid,
+                    target_visibility: ref.targetVisibility,
+                    message: `${node.qid} references ${ref.targetVisibility} ${ref.targetQid} through ${ref.field}, which is excluded by ${options.scope} visibility`,
+                });
+            }
+        }
+    }
+    return violations;
+}
+function visibilityViolationMessages(violations) {
+    return Array.from(new Set(violations.map((violation) => violation.message))).sort();
+}