vouchington-tooling 0.34.0 → 0.35.0

package/dist/finite-enum-ripple/compare.mjs

@@ -13,8 +13,6 @@ export function checkUnionCreatePageTypes(errors, routeConfigs, pages, readTrack
         }
         const content = readTracked(page.file);
         const actualTypes = collectCreatePageLiterals(content, page.file, createPageTypeProperties);
-        if (actualTypes.length === 0)
-            errors.push(finiteEnumError(page.file, `${label} create page has no inspectable type literal`));
         for (const actualType of actualTypes) {
             if (actualType === expectedType)
                 continue;
@@ -28,7 +26,7 @@ export function checkCollectionPagePathLiterals(pages, errors, group, routeSlugs
             continue;
         const content = readTracked(page.file);
         for (const literalPath of collectActivePatternCaptures(content, pathPattern, page.file)) {
-            if (literalPath === page.slug || literalPath.startsWith(`${page.slug}/`))
+            if (!literalPath || literalPath === page.slug || literalPath.startsWith(`${page.slug}/`))
                 continue;
             errors.push(finiteEnumError(page.file, `${group} collection path literal "/${literalPath}" does not match route directory "${page.slug}"`));
         }

package/dist/finite-enum-ripple/model.d.mts

@@ -44,6 +44,8 @@ export interface FiniteEnumRippleConfig {
             collection: string;
         };
         collectionLabel: string;
+        /** Wording for collection path diagnostics; defaults to collectionLabel. */
+        collectionPathLabel?: string;
         ignoredNavigationPaths: readonly string[];
         collectionPathLiteralPattern: RegExp;
         navigationPathLiteralPattern: RegExp;
@@ -68,6 +70,8 @@ export interface FiniteEnumRippleConfig {
             factory: string;
         };
         collectionLabel: string;
+        /** Wording for collection path diagnostics; defaults to collectionLabel. */
+        collectionPathLabel?: string;
         createPageTypeProperties: readonly string[];
         collectionPathLiteralPattern: RegExp;
     };

package/dist/finite-enum-ripple/parser-support.mjs

@@ -42,7 +42,7 @@ export function parseRouteConfigEntries(content, name, file, pluralPathProperty,
 }
 export function parseStringArray(content, property, file) {
     const array = getPropertyValue(content, property);
-    if (!array)
+    if (!array || isIntrinsicUndefined(array))
         return [];
     if (!ts.isArrayLiteralExpression(array))
         throw new Error(`${file}: ${property} must be a literal string array`);
@@ -84,3 +84,16 @@ function unwrapTypeNode(type) {
         current = current.type;
     return current;
 }
+function isIntrinsicUndefined(expression) {
+    if (!ts.isIdentifier(expression))
+        return false;
+    const source = expression.getSourceFile();
+    const options = { noLib: true, noResolve: true };
+    const host = ts.createCompilerHost(options);
+    host.getSourceFile = () => source;
+    const checker = ts.createProgram([source.fileName], options, host).getTypeChecker();
+    const symbol = checker.getSymbolAtLocation(expression);
+    return (symbol !== undefined &&
+        symbol.declarations?.length === 0 &&
+        checker.getTypeAtLocation(expression).flags === ts.TypeFlags.Undefined);
+}

package/dist/finite-enum-ripple/parsers.mjs

@@ -104,6 +104,8 @@ export function parseStructuredRouteFactoryArgs(content, file, callPattern) {
         matcher.lastIndex = 0;
         if (!matcher.test(getCallExpressionName(call.expression) ?? ''))
             continue;
+        if (call.arguments.length === 0)
+            continue;
         const slug = getStringLiteralValue(call.arguments[0]);
         if (!slug)
             throw new Error(`${file}: configured route factory call needs a string literal slug`);

package/dist/finite-enum-ripple/structured-route-check.mjs

@@ -87,7 +87,7 @@ export function checkStructuredRouteConfigs(errors, files, readTracked, config,
                 expectedFile: routeConfigsPath,
                 expectedValues: routeConfigs.map((routeConfig) => routeConfig.pluralPath),
             });
-            checkCollectionPagePathLiterals(files.structuredCollectionPages, errors, config.collectionLabel, new Set(routeConfigs.map((routeConfig) => routeConfig.pluralPath)), readTracked, config.collectionPathLiteralPattern);
+            checkCollectionPagePathLiterals(files.structuredCollectionPages, errors, config.collectionPathLabel ?? config.collectionLabel, new Set(routeConfigs.map((routeConfig) => routeConfig.pluralPath)), readTracked, config.collectionPathLiteralPattern);
             checkStructuredCollectionComponentPathLiterals(errors, routeConfigs, files.structuredComponentFiles, new Set(config.ignoredNavigationPaths), readTracked, config.collectionLabel, config.navigationPathLiteralPattern);
         }
     }

package/dist/finite-enum-ripple/union-types.mjs

@@ -123,7 +123,7 @@ export function checkUnionTypes(errors, files, readTracked, config) {
             expectedValues: routeConfigs.map((routeConfig) => routeConfig.pluralPath),
         });
         checkUnionCreatePageTypes(errors, effectiveSingleTypeRouteConfigs, files.unionCreatePages, readTracked, config.createPageTypeProperties, config.collectionLabel);
-        checkCollectionPagePathLiterals(files.unionCollectionPages, errors, config.collectionLabel, new Set(effectiveSingleTypeRouteConfigs.map((routeConfig) => routeConfig.pluralPath)), readTracked, config.collectionPathLiteralPattern);
+        checkCollectionPagePathLiterals(files.unionCollectionPages, errors, config.collectionPathLabel ?? config.collectionLabel, new Set(effectiveSingleTypeRouteConfigs.map((routeConfig) => routeConfig.pluralPath)), readTracked, config.collectionPathLiteralPattern);
     }
     checkUnionFactories(errors, files.unionDetailPages, readTracked, config, slugToType, routeSlugs);
 }

package/dist/workflow-policy/index.d.mts

@@ -1,7 +1,5 @@
-export { evaluateGraphPolicy } from './graph.mts';
-export { evaluateLockPolicy, type ConcurrencyPolicy } from './concurrency.mts';
 export { conditionEntails } from './condition-entailment.mts';
 export { unprovisionedSecretsWithoutReadinessStep } from './secret-readiness.mts';
 export { callerCalleePermissionMismatches, type CallerCalleePermissionPolicy, } from './permission-mismatches.mts';
 export { missingTopLevelPermissionPaths, parsePermissions, parseWorkflow, requiredWorkflowPermissions, type Workflow, } from './permissions.mts';
-export type { WorkflowTopology, WorkflowTopologyIndex, WorkflowTopologyPolicy, WorkflowNode, WorkflowJobNode, WorkflowStep, } from './types.mts';
+export type { WorkflowTopology, WorkflowTopologyIndex, WorkflowNode, WorkflowJobNode, WorkflowStep, } from './types.mts';

package/dist/workflow-policy/index.mjs

@@ -1,5 +1,3 @@
-export { evaluateGraphPolicy } from './graph.mjs';
-export { evaluateLockPolicy } from './concurrency.mjs';
 export { conditionEntails } from './condition-entailment.mjs';
 export { unprovisionedSecretsWithoutReadinessStep } from './secret-readiness.mjs';
 export { callerCalleePermissionMismatches, } from './permission-mismatches.mjs';

package/dist/workflow-policy/types.d.mts

@@ -9,7 +9,7 @@ export interface WorkflowStep {
     run?: string;
     secretReferences?: readonly string[];
 }
-export interface WorkflowConcurrency {
+interface WorkflowConcurrency {
     effective: {
         group: string;
         cancelInProgress: boolean | string;
@@ -61,30 +61,4 @@ export interface WorkflowTopologyIndex {
         match?: string;
     }[];
 }
-export type EdgeRule = readonly [from: string, to: string];
-export type StepSelector = {
-    id?: string;
-    uses?: string;
-    name?: string;
-};
-export type WorkflowTopologyPolicy = {
-    jobInventory: Readonly<Record<string, readonly string[]>>;
-    requiredJobs: readonly string[];
-    forbiddenJobs: readonly string[];
-    requiredDirectEdges: readonly EdgeRule[];
-    forbiddenDirectEdges: readonly EdgeRule[];
-    requiredTransitiveEdges: readonly EdgeRule[];
-    forbiddenTransitiveEdges: readonly EdgeRule[];
-    requiredArtifactEdges: readonly {
-        from: string;
-        to: string;
-        name: string;
-        match?: string;
-    }[];
-    exactFanIns: Readonly<Record<string, readonly string[]>>;
-    exactCallerJobs: Readonly<Record<string, readonly string[]>>;
-    stepOrders: readonly {
-        jobId: string;
-        steps: readonly StepSelector[];
-    }[];
-};
+export {};

package/docs/workflow-and-compiler.md

@@ -1,33 +1,24 @@
 # Workflow and compiler primitives
 
-`workflow-policy` evaluates parsed GitHub Actions topology against policy supplied by the
-consumer. It has no workflow inventory or secret names of its own. Supply a topology and an index
-with the structural methods described by `WorkflowTopologyIndex`; a parser may expose additional
-fields. `evaluateGraphPolicy` checks inventory, job and edge presence, artifact flow, fan-in,
-reusable callers, and step order. `evaluateLockPolicy` takes the consumer's unlocked reasons and
-concurrency intent separately. Its scope classifier recognizes GitHub expression references and
-reports unsupported contexts.
-
-Inventory compares workflow `jobIds` against each corresponding job's `key`; job IDs may use any
-format. Fan-in and caller comparisons ignore ordering of index results.
+`workflow-policy` checks parsed GitHub Actions topology against data supplied by the consumer. It
+has no workflow inventory or secret names of its own. Supply a topology shaped like
+`WorkflowTopology`; a parser may expose additional fields. Topology, job-graph and concurrency
+policy lives in the `no-mistakes` `workflow-topology-policy` rule, not here. This breaking minor removed `evaluateGraphPolicy`, `evaluateLockPolicy`,
+`ConcurrencyPolicy` and `WorkflowTopologyPolicy`; migrate to that rule.
 
 ```ts
 import {
   conditionEntails,
-  evaluateGraphPolicy,
-  evaluateLockPolicy,
   callerCalleePermissionMismatches,
   parseWorkflow,
   unprovisionedSecretsWithoutReadinessStep,
 } from 'vouchington-tooling/workflow-policy'
 
-const diagnostics = evaluateGraphPolicy(topology, index, policy)
-diagnostics.push(...evaluateLockPolicy(topology, unlockedReasons, concurrencyIntent))
-diagnostics.push(
+const diagnostics = [
   ...unprovisionedSecretsWithoutReadinessStep(topology, {
     RELEASE_KEY: { provisioned: false },
   }),
-)
+]
 const documents = Object.fromEntries(
   Object.entries(workflowSources).map(([path, yaml]) => [path, parseWorkflow(yaml)]),
 )

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vouchington-tooling",
-  "version": "0.34.0",
+  "version": "0.35.0",
   "description": "Vouchington CLI and extractable tooling libraries.",
   "homepage": "https://github.com/vouchington/vouchington-tooling/tree/main/packages/vouchington-tooling#readme",
   "bugs": {

package/dist/workflow-policy/concurrency-scope.d.mts

@@ -1,4 +0,0 @@
-export type ConcurrencyScope = 'fixed-resource' | 'pull-request' | 'ref' | 'sha' | 'run' | 'event' | 'input-resource';
-export type NormalizedConcurrencyScope = Exclude<ConcurrencyScope, 'fixed-resource'> | `unsupported:${string}`;
-export declare function extractConcurrencyScopes(group: string): NormalizedConcurrencyScope[];
-export declare function normalizePolicyScopes(scopes: readonly ConcurrencyScope[]): NormalizedConcurrencyScope[];

package/dist/workflow-policy/concurrency-scope.mjs

@@ -1,66 +0,0 @@
-const scopeOrder = [
-    'pull-request',
-    'ref',
-    'sha',
-    'run',
-    'event',
-    'input-resource',
-];
-const ignoredOwnerContexts = new Set(['github.workflow', 'github.run_attempt']);
-const eventPayloadContexts = new Set([
-    'github.event_name',
-    'github.event.action',
-    'github.event.label.name',
-    'github.event.issue.number',
-    'github.event.schedule',
-    'github.event.workflow_run.event',
-    'github.event.workflow_run.id',
-    'github.event.workflow_run.workflow_id',
-]);
-function classifyContext(reference) {
-    if (ignoredOwnerContexts.has(reference))
-        return undefined;
-    if (reference === 'github.event.pull_request.number' ||
-        reference === 'github.event.workflow_run.pull_requests')
-        return 'pull-request';
-    if (reference === 'github.event.pull_request.head.sha' ||
-        reference === 'github.event.workflow_run.head_sha' ||
-        reference === 'github.sha')
-        return 'sha';
-    if (reference === 'github.ref' ||
-        reference === 'github.ref_name' ||
-        reference === 'github.event.workflow_run.head_branch')
-        return 'ref';
-    if (reference === 'github.run_id')
-        return 'run';
-    if (reference.startsWith('inputs.') ||
-        reference === 'github.event.inputs' ||
-        reference.startsWith('github.event.inputs.')) {
-        return 'input-resource';
-    }
-    if (eventPayloadContexts.has(reference))
-        return 'event';
-    return `unsupported:${reference}`;
-}
-function sortScopes(scopes) {
-    return [...new Set(scopes)].toSorted((left, right) => {
-        const leftIndex = scopeOrder.indexOf(left);
-        const rightIndex = scopeOrder.indexOf(right);
-        if (leftIndex === -1 || rightIndex === -1) {
-            if (leftIndex === rightIndex)
-                return left.localeCompare(right);
-            return leftIndex === -1 ? 1 : -1;
-        }
-        return leftIndex - rightIndex;
-    });
-}
-export function extractConcurrencyScopes(group) {
-    const references = group.match(/\b(?:github|inputs)(?:\.[A-Za-z_][\w-]*)+/gu) ?? [];
-    return sortScopes(references.flatMap((reference) => classifyContext(reference) ?? []));
-}
-export function normalizePolicyScopes(scopes) {
-    if (scopes.includes('fixed-resource')) {
-        return scopes.length === 1 ? [] : ['unsupported:fixed-resource-combination'];
-    }
-    return sortScopes(scopes.filter((scope) => scope !== 'fixed-resource'));
-}

package/dist/workflow-policy/concurrency.d.mts

@@ -1,10 +0,0 @@
-import type { WorkflowTopology } from './types.mts';
-import { type ConcurrencyScope } from './concurrency-scope.mts';
-type ConcurrencyCancellationBehavior = 'cancel-running' | 'retain-running' | 'conditional';
-export type ConcurrencyPolicy = {
-    pending: 'coalesce-latest' | 'fifo';
-    cancellation: ConcurrencyCancellationBehavior;
-    scope: readonly ConcurrencyScope[];
-};
-export declare function evaluateLockPolicy(topology: WorkflowTopology, unlockedWorkflowReasons: Readonly<Record<string, string>>, semanticPolicy: Readonly<Record<string, ConcurrencyPolicy>>): string[];
-export {};

package/dist/workflow-policy/concurrency.mjs

@@ -1,77 +0,0 @@
-import { extractConcurrencyScopes, normalizePolicyScopes, } from './concurrency-scope.mjs';
-function cancellation(value) {
-    return typeof value === 'string' ? 'conditional' : value ? 'cancel-running' : 'retain-running';
-}
-export function evaluateLockPolicy(topology, unlockedWorkflowReasons, semanticPolicy) {
-    const diagnostics = [];
-    const owners = [...topology.workflows, ...topology.jobs].filter((owner) => owner.concurrency);
-    const actualOwnerIds = new Set(owners.map((owner) => owner.id));
-    const declaredOwnerIds = new Set(Object.keys(semanticPolicy));
-    for (const id of [...actualOwnerIds].toSorted()) {
-        if (!declaredOwnerIds.has(id))
-            diagnostics.push(`lock intent missing: ${id}`);
-    }
-    for (const id of [...declaredOwnerIds].toSorted()) {
-        if (!actualOwnerIds.has(id))
-            diagnostics.push(`lock intent stale: ${id}`);
-    }
-    const jobsById = new Map(topology.jobs.map((job) => [job.id, job]));
-    for (const workflow of topology.workflows) {
-        const unlockedReason = unlockedWorkflowReasons[workflow.path];
-        const hasUnlockedJob = !workflow.concurrency &&
-            workflow.jobIds.some((jobId) => jobsById.get(jobId)?.concurrency === undefined);
-        if (hasUnlockedJob && !unlockedReason)
-            diagnostics.push(`lock intent missing: ${workflow.path}`);
-        if (!hasUnlockedJob && unlockedReason)
-            diagnostics.push(`unlocked reason stale: ${workflow.path}`);
-        if (unlockedReason !== undefined && unlockedReason.trim() === '')
-            diagnostics.push(`unlocked reason empty: ${workflow.path}`);
-    }
-    for (const path of Object.keys(unlockedWorkflowReasons).toSorted()) {
-        if (!topology.workflows.some((workflow) => workflow.path === path))
-            diagnostics.push(`unlocked reason stale: ${path}`);
-    }
-    for (const owner of owners) {
-        const declared = semanticPolicy[owner.id];
-        if (!declared || !owner.concurrency)
-            continue;
-        const cancelInProgress = owner.concurrency.effective.cancelInProgress;
-        if (typeof cancelInProgress === 'string' &&
-            !/^\$\{\{\s*\S[\s\S]*\}\}$/.test(cancelInProgress.trim()))
-            diagnostics.push(`conditional cancel-in-progress expression invalid: ${owner.id}: ${cancelInProgress}`);
-        const actualPending = owner.concurrency.effective.queue === 'max' ? 'fifo' : 'coalesce-latest';
-        if (actualPending !== declared.pending)
-            diagnostics.push(`concurrency pending mismatch: ${owner.id}: expected ${declared.pending}, got ${actualPending}`);
-        const actualCancellation = cancellation(owner.concurrency.effective.cancelInProgress);
-        if (actualCancellation !== declared.cancellation)
-            diagnostics.push(`concurrency cancellation mismatch: ${owner.id}: expected ${declared.cancellation}, got ${actualCancellation}`);
-        const actualScopes = extractConcurrencyScopes(owner.concurrency.effective.group);
-        const expectedScopes = normalizePolicyScopes(declared.scope);
-        if (JSON.stringify(actualScopes) !== JSON.stringify(expectedScopes))
-            diagnostics.push(`concurrency scope mismatch: ${owner.id}: expected ${expectedScopes.join(',')}, got ${actualScopes.join(',')}`);
-    }
-    diagnostics.push(...collisionDiagnostics(owners, topology));
-    return [...new Set(diagnostics)].toSorted();
-}
-function collisionDiagnostics(owners, topology) {
-    const workflowPathsById = new Map(topology.workflows.map((workflow) => [workflow.id, workflow.path]));
-    const ownerWorkflowPaths = new Map([
-        ...topology.workflows.map((workflow) => [workflow.id, workflow.path]),
-        ...topology.jobs.map((job) => [job.id, workflowPathsById.get(job.workflowId) ?? job.workflowId]),
-    ]);
-    const groups = new Map();
-    for (const owner of owners) {
-        const group = owner.concurrency?.effective.group;
-        if (!group)
-            continue;
-        const normalizedGroup = group.toLocaleLowerCase('en-US');
-        const workflowPartition = /\$\{\{\s*github\.workflow\s*\}\}/.test(group)
-            ? ownerWorkflowPaths.get(owner.id)
-            : '';
-        const key = `${normalizedGroup}\0${workflowPartition}`;
-        const entry = groups.get(key) ?? { group: normalizedGroup, ids: [] };
-        entry.ids.push(owner.id);
-        groups.set(key, entry);
-    }
-    return [...groups.values()].flatMap(({ group, ids }) => ids.length > 1 ? [`concurrency group collision: ${group}: ${ids.toSorted().join(', ')}`] : []);
-}

package/dist/workflow-policy/graph.d.mts

@@ -1,2 +0,0 @@
-import type { WorkflowTopology, WorkflowTopologyIndex, WorkflowTopologyPolicy } from './types.mts';
-export declare function evaluateGraphPolicy(topology: WorkflowTopology, index: WorkflowTopologyIndex, policy: WorkflowTopologyPolicy): string[];

package/dist/workflow-policy/graph.mjs

@@ -1,138 +0,0 @@
-export function evaluateGraphPolicy(topology, index, policy) {
-    const diagnostics = [
-        ...inventoryDiagnostics(topology, policy),
-        ...jobPresenceDiagnostics(index, policy),
-        ...edgeDiagnostics(index, policy.requiredDirectEdges, true, true),
-        ...edgeDiagnostics(index, policy.forbiddenDirectEdges, true, false),
-        ...edgeDiagnostics(index, policy.requiredTransitiveEdges, false, true),
-        ...edgeDiagnostics(index, policy.forbiddenTransitiveEdges, false, false),
-        ...artifactEdgeDiagnostics(index, policy),
-        ...fanInDiagnostics(index, policy),
-        ...callerDiagnostics(index, policy),
-        ...stepOrderDiagnostics(index, policy),
-    ];
-    return diagnostics.toSorted();
-}
-function artifactEdgeDiagnostics(index, policy) {
-    return policy.requiredArtifactEdges.flatMap((rule) => {
-        const label = `${rule.from} -> ${rule.to}: ${rule.name}${rule.match ? ` [${rule.match}]` : ''}`;
-        if (!index.jobsById.has(rule.from) || !index.jobsById.has(rule.to))
-            return [`required artifact edge missing: ${label}`];
-        const present = index
-            .artifactConsumersForProducerJob(rule.from)
-            .some((edge) => edge.to === rule.to &&
-            edge.name === rule.name &&
-            (rule.match === undefined || edge.match === rule.match));
-        return present ? [] : [`required artifact edge missing: ${label}`];
-    });
-}
-function inventoryDiagnostics(topology, policy) {
-    const jobsById = new Map(topology.jobs.map((job) => [job.id, job]));
-    const actual = new Map(topology.workflows.map((workflow) => [
-        workflow.path,
-        workflow.jobIds
-            .map((id) => jobsById.get(id)?.key ?? id)
-            .toSorted((a, b) => a.localeCompare(b)),
-    ]));
-    const diagnostics = [];
-    for (const [path, keys] of actual) {
-        const expected = policy.jobInventory[path];
-        if (!expected)
-            diagnostics.push(`workflow inventory missing: ${path}`);
-        else if (JSON.stringify(keys) !== JSON.stringify([...expected].toSorted()))
-            diagnostics.push(`job inventory mismatch: ${path}: expected ${[...expected].toSorted().join(', ')}, got ${keys.join(', ')}`);
-    }
-    for (const path of Object.keys(policy.jobInventory).toSorted()) {
-        if (!actual.has(path))
-            diagnostics.push(`workflow inventory stale: ${path}`);
-    }
-    return diagnostics;
-}
-function jobPresenceDiagnostics(index, policy) {
-    const diagnostics = [];
-    for (const id of policy.requiredJobs)
-        if (!index.jobsById.has(id))
-            diagnostics.push(`required job missing: ${id}`);
-    for (const id of policy.forbiddenJobs)
-        if (index.jobsById.has(id))
-            diagnostics.push(`forbidden job present: ${id}`);
-    return diagnostics;
-}
-function edgeDiagnostics(index, rules, direct, required) {
-    return rules.flatMap(([from, to]) => {
-        if (!index.jobsById.has(from) || !index.jobsById.has(to))
-            return required
-                ? [`required ${direct ? 'direct' : 'transitive'} edge missing: ${from} -> ${to}`]
-                : [];
-        const downstream = direct
-            ? index.directDownstreamJobIds(from)
-            : index.transitiveDownstreamJobIds(from);
-        const present = downstream.includes(to);
-        return present === required
-            ? []
-            : [
-                `${required ? 'required' : 'forbidden'} ${direct ? 'direct' : 'transitive'} edge ${required ? 'missing' : 'present'}: ${from} -> ${to}`,
-            ];
-    });
-}
-function fanInDiagnostics(index, policy) {
-    return Object.entries(policy.exactFanIns).flatMap(([jobId, expected]) => {
-        if (!index.jobsById.has(jobId))
-            return [`exact fan-in target missing: ${jobId}`];
-        const actual = [...index.directUpstreamJobIds(jobId)].toSorted();
-        return JSON.stringify(actual) === JSON.stringify([...expected].toSorted())
-            ? []
-            : [
-                `exact fan-in mismatch: ${jobId}: expected ${[...expected].toSorted().join(', ')}, got ${actual.join(', ')}`,
-            ];
-    });
-}
-function callerDiagnostics(index, policy) {
-    const callablePaths = [];
-    for (const workflow of index.workflowsByPath.values())
-        if (workflow.callable)
-            callablePaths.push(workflow.path);
-    callablePaths.sort((left, right) => left.localeCompare(right));
-    const declaredPaths = Object.keys(policy.exactCallerJobs).toSorted();
-    const diagnostics = [];
-    for (const path of callablePaths)
-        if (!policy.exactCallerJobs[path])
-            diagnostics.push(`caller allowlist missing: ${path}`);
-    for (const path of declaredPaths)
-        if (!callablePaths.includes(path))
-            diagnostics.push(`caller allowlist stale: ${path}`);
-    diagnostics.push(...Object.entries(policy.exactCallerJobs).flatMap(([path, expected]) => {
-        if (!index.workflowsByPath.get(path)?.callable)
-            return [];
-        const actual = [...index.directCallerJobIds(path)].toSorted();
-        return JSON.stringify(actual) === JSON.stringify([...expected].toSorted())
-            ? []
-            : [
-                `caller allowlist mismatch: ${path}: expected ${[...expected].toSorted().join(', ')}, got ${actual.join(', ')}`,
-            ];
-    }));
-    return diagnostics;
-}
-function matches(selector, step) {
-    return ((selector.id === undefined || selector.id === step.id) &&
-        (selector.uses === undefined || selector.uses === step.uses) &&
-        (selector.name === undefined || selector.name === step.name));
-}
-function stepOrderDiagnostics(index, policy) {
-    return policy.stepOrders.flatMap((rule) => {
-        const job = index.jobsById.get(rule.jobId);
-        if (!job)
-            return [`step-order job missing: ${rule.jobId}`];
-        let prior = -1;
-        for (const selector of rule.steps) {
-            const step = job.steps.find((candidate) => matches(selector, candidate));
-            const label = selector.id ?? selector.uses ?? selector.name ?? '<step>';
-            if (!step)
-                return [`required ordered step missing: ${rule.jobId}: ${label}`];
-            if (step.index <= prior)
-                return [`required step order invalid: ${rule.jobId}: ${label}`];
-            prior = step.index;
-        }
-        return [];
-    });
-}