vouchington-tooling 0.34.0 → 0.36.0

package/dist/api-contract-discovery/response-contract-route-syntax.mjs

@@ -1,41 +0,0 @@
-import ts from '../contract-schema/typescript-api.mjs';
-export const HTTP_METHODS = new Set(['GET', 'POST', 'PUT', 'PATCH', 'DELETE']);
-export function isInlineRouteHandler(node) {
-    if ((!ts.isArrowFunction(node) && !ts.isFunctionExpression(node)) ||
-        !ts.isCallExpression(node.parent))
-        return false;
-    const method = propertyName(node.parent.expression)?.toUpperCase();
-    return (!!method && HTTP_METHODS.has(method) && !!routeTemplateFromExpression(node.parent.expression));
-}
-export function routeTemplateFromExpression(expression) {
-    if (!ts.isPropertyAccessExpression(expression))
-        return undefined;
-    return findRouteCall(expression.expression);
-}
-function findRouteCall(expression) {
-    if (!ts.isCallExpression(expression))
-        return undefined;
-    if (!ts.isPropertyAccessExpression(expression.expression))
-        return undefined;
-    if (expression.expression.name.text === 'route') {
-        const route = expression.arguments[0];
-        return route && ts.isStringLiteral(route) ? route.text : undefined;
-    }
-    return findRouteCall(expression.expression.expression);
-}
-export function propertyName(expression) {
-    return ts.isPropertyAccessExpression(expression) ? expression.name.text : undefined;
-}
-export function unwrapTransparentExpression(expression) {
-    while (ts.isParenthesizedExpression(expression) ||
-        ts.isAsExpression(expression) ||
-        ts.isTypeAssertionExpression(expression) ||
-        ts.isSatisfiesExpression(expression) ||
-        ts.isNonNullExpression(expression))
-        expression = expression.expression;
-    return expression;
-}
-export function visit(node, callback) {
-    callback(node);
-    node.forEachChild((child) => visit(child, callback));
-}

package/dist/api-contract-discovery/response-contract-status.d.mts

@@ -1,27 +0,0 @@
-import ts from '../contract-schema/typescript-api.mts';
-import type { BackendResponseContract } from './response-contract-types.mts';
-export declare function responseStatusCodesForContract(contract: BackendResponseContract): number[];
-/**
- * Maps `METHOD:/route` to the non-error static `ctx.setStatus(NNN)` literal(s) found for that
- * route binding: a plain literal contributes one status; `ctx.setStatus(cond ? A : B)` with both
- * branches numeric contributes both (the doc can't know which branch fires at request time, so
- * both are valid statuses for the operation). Statuses >= 400 are dropped per-branch: they mark
- * hand-rolled error branches (the shared `default` -> `components/responses/Error` already
- * documents error responses), and capturing them here would misattribute an error status to the
- * whole operation. A route absent from the map never sets a non-error status explicitly (callers
- * fall back to 200, or 204 when the response schema's root is `null`).
- */
-/**
- * Resolves the status documented for one specific `apiResponse`/`apiNoContent` marker call: the
- * nearest preceding sibling `ctx.setStatus(NNN)` literal, walking outward through enclosing
- * blocks (mirroring `response-contract-implicit.mts`'s `precededByErrorStatus` walk). Unlike
- * `collectRouteStatusCodes`, this has no `>=400` filter: an explicit `#variant` marker is a
- * deliberate author opt-in to document that exact status (e.g. 422 for a `#validation` variant),
- * and the route-wide map (keyed only on `method:routeTemplate`) can't tell two markers in the
- * same route apart when they're preceded by different statuses.
- */
-export declare function resolveEmissionStatus(call: ts.CallExpression | ts.NewExpression, matchesContext?: (expression: ts.Expression) => boolean): {
-    statusCodes?: readonly [number, ...number[]];
-    statusKnowledge: 'default' | 'explicit' | 'unknown';
-    unavailableReason?: string;
-};

package/dist/api-contract-discovery/response-contract-status.mjs

@@ -1,82 +0,0 @@
-import ts from '../contract-schema/typescript-api.mjs';
-import { isContextMethod } from './response-contract-route-analysis.mjs';
-export function responseStatusCodesForContract(contract) {
-    if (contract.statusKnowledge === 'unknown')
-        return [];
-    if (contract.statusCodes)
-        return [...new Set(contract.statusCodes)].toSorted((a, b) => a - b);
-    const bodyKind = contract.bodyKind ?? (contract.schema.root.type === 'null' ? 'none' : 'content');
-    return [bodyKind === 'none' ? 204 : 200];
-}
-/**
- * Maps `METHOD:/route` to the non-error static `ctx.setStatus(NNN)` literal(s) found for that
- * route binding: a plain literal contributes one status; `ctx.setStatus(cond ? A : B)` with both
- * branches numeric contributes both (the doc can't know which branch fires at request time, so
- * both are valid statuses for the operation). Statuses >= 400 are dropped per-branch: they mark
- * hand-rolled error branches (the shared `default` -> `components/responses/Error` already
- * documents error responses), and capturing them here would misattribute an error status to the
- * whole operation. A route absent from the map never sets a non-error status explicitly (callers
- * fall back to 200, or 204 when the response schema's root is `null`).
- */
-/**
- * Resolves the status documented for one specific `apiResponse`/`apiNoContent` marker call: the
- * nearest preceding sibling `ctx.setStatus(NNN)` literal, walking outward through enclosing
- * blocks (mirroring `response-contract-implicit.mts`'s `precededByErrorStatus` walk). Unlike
- * `collectRouteStatusCodes`, this has no `>=400` filter: an explicit `#variant` marker is a
- * deliberate author opt-in to document that exact status (e.g. 422 for a `#validation` variant),
- * and the route-wide map (keyed only on `method:routeTemplate`) can't tell two markers in the
- * same route apart when they're preceded by different statuses.
- */
-export function resolveEmissionStatus(call, matchesContext = (expression) => isContextMethod(expression, 'setStatus')) {
-    if (ts.isCallExpression(call) && matchesContext(call.expression))
-        return statusArgument(call.arguments[0]);
-    let statement = call;
-    while (!ts.isStatement(statement))
-        statement = statement.parent;
-    return precedingStatus(statement, matchesContext);
-}
-function precedingStatus(statement, matchesContext) {
-    const block = statement.parent;
-    if (!ts.isBlock(block))
-        return { statusKnowledge: 'default' };
-    const index = block.statements.indexOf(statement);
-    for (let i = index - 1; i >= 0; i--) {
-        const status = statusStatement(block.statements[i], matchesContext);
-        if (status)
-            return status;
-    }
-    const enclosing = block.parent;
-    return ts.isStatement(enclosing)
-        ? precedingStatus(enclosing, matchesContext)
-        : { statusKnowledge: 'default' };
-}
-function statusStatement(statement, matchesContext) {
-    if (!ts.isExpressionStatement(statement))
-        return undefined;
-    const expression = statement.expression;
-    if (!ts.isCallExpression(expression) || !matchesContext(expression.expression))
-        return undefined;
-    return statusArgument(expression.arguments[0]);
-}
-/** A `ctx.setStatus` argument's possible numeric literal value(s): one for a bare literal, up to two (sorted ascending) for `cond ? A : B` when both branches are numeric literals. */
-function statusArgument(argument) {
-    if (!argument)
-        return {
-            statusKnowledge: 'unknown',
-            unavailableReason: 'ctx.setStatus has no statically known status',
-        };
-    if (ts.isNumericLiteral(argument))
-        return { statusCodes: [Number(argument.text)], statusKnowledge: 'explicit' };
-    if (ts.isConditionalExpression(argument) &&
-        ts.isNumericLiteral(argument.whenTrue) &&
-        ts.isNumericLiteral(argument.whenFalse)) {
-        const values = [
-            ...new Set([Number(argument.whenTrue.text), Number(argument.whenFalse.text)]),
-        ].toSorted((a, b) => a - b);
-        return { statusCodes: values, statusKnowledge: 'explicit' };
-    }
-    return {
-        statusKnowledge: 'unknown',
-        unavailableReason: 'nearest ctx.setStatus value is dynamic',
-    };
-}

package/dist/api-contract-discovery/response-contract-symbols.d.mts

@@ -1,5 +0,0 @@
-import ts from '../contract-schema/typescript-api.mts';
-export declare function functionSymbol(node: ts.Node, checker: ts.TypeChecker): ts.Symbol | undefined;
-export declare function attributionFunctionSymbol(node: ts.Node, checker: ts.TypeChecker): ts.Symbol | undefined;
-export declare function resolveSymbol(symbol: ts.Symbol, checker: ts.TypeChecker): ts.Symbol;
-export declare function attributionSymbol(symbol: ts.Symbol, checker: ts.TypeChecker): ts.Symbol;

package/dist/api-contract-discovery/response-contract-symbols.mjs

@@ -1,82 +0,0 @@
-import ts from '../contract-schema/typescript-api.mjs';
-export function functionSymbol(node, checker) {
-    if (ts.isFunctionDeclaration(node) && node.name)
-        return checker.getSymbolAtLocation(node.name);
-    if ((ts.isArrowFunction(node) || ts.isFunctionExpression(node)) &&
-        ts.isVariableDeclaration(node.parent) &&
-        ts.isIdentifier(node.parent.name)) {
-        return checker.getSymbolAtLocation(node.parent.name);
-    }
-    return undefined;
-}
-export function attributionFunctionSymbol(node, checker) {
-    const existing = functionSymbol(node, checker);
-    if (existing)
-        return existing;
-    if (ts.isMethodDeclaration(node) && node.name)
-        return checker.getSymbolAtLocation(node.name);
-    if (ts.isArrowFunction(node) || ts.isFunctionExpression(node)) {
-        const owner = wrappedFunctionOwner(node);
-        if (owner &&
-            (ts.isVariableDeclaration(owner) ||
-                ts.isPropertyAssignment(owner) ||
-                ts.isPropertyDeclaration(owner))) {
-            return checker.getSymbolAtLocation(owner.name);
-        }
-    }
-    if (ts.isFunctionDeclaration(node) &&
-        !node.name &&
-        ts.getCombinedModifierFlags(node) & ts.ModifierFlags.Default)
-        return defaultExportSymbol(node.getSourceFile(), checker);
-    if ((ts.isArrowFunction(node) || ts.isFunctionExpression(node)) &&
-        isDefaultExportExpression(node))
-        return defaultExportSymbol(node.getSourceFile(), checker);
-    return undefined;
-}
-function wrappedFunctionOwner(node) {
-    let current = node;
-    let parent = current.parent;
-    while (ts.isParenthesizedExpression(parent) ||
-        ts.isAsExpression(parent) ||
-        ts.isTypeAssertionExpression(parent) ||
-        ts.isSatisfiesExpression(parent) ||
-        ts.isNonNullExpression(parent)) {
-        current = parent;
-        parent = current.parent;
-    }
-    if ((ts.isVariableDeclaration(parent) ||
-        ts.isPropertyAssignment(parent) ||
-        ts.isPropertyDeclaration(parent)) &&
-        parent.initializer === current)
-        return parent;
-    return undefined;
-}
-function isDefaultExportExpression(node) {
-    let current = node;
-    let parent = current.parent;
-    while ((ts.isParenthesizedExpression(parent) ||
-        ts.isAsExpression(parent) ||
-        ts.isTypeAssertionExpression(parent) ||
-        ts.isSatisfiesExpression(parent) ||
-        ts.isNonNullExpression(parent)) &&
-        parent.expression === current) {
-        current = parent;
-        parent = current.parent;
-    }
-    return ts.isExportAssignment(parent) && !parent.isExportEquals && parent.expression === current;
-}
-function defaultExportSymbol(sourceFile, checker) {
-    const moduleSymbol = checker.getSymbolAtLocation(sourceFile);
-    return (moduleSymbol &&
-        checker.getExportsOfModule(moduleSymbol).find((symbol) => symbol.getName() === 'default'));
-}
-export function resolveSymbol(symbol, checker) {
-    return symbol.flags & ts.SymbolFlags.Alias ? checker.getAliasedSymbol(symbol) : symbol;
-}
-export function attributionSymbol(symbol, checker) {
-    const resolved = resolveSymbol(symbol, checker);
-    const name = resolved.valueDeclaration?.name;
-    if (!name || !ts.isIdentifier(name))
-        return resolved;
-    return checker.getSymbolAtLocation(name) ?? resolved;
-}

package/dist/api-contract-discovery/response-contract-types.d.mts

@@ -1,23 +0,0 @@
-import type { ExtractedResponseContract } from '../contract-schema/index.mts';
-export type BackendResponseContract = ExtractedResponseContract & {
-    method: string;
-    routeTemplate: string;
-    /** Statuses owned by this response emission. Defaults to 200, or 204 for an unannotated empty emission. */
-    statusCodes?: readonly [number, ...number[]];
-    /** Distinguishes a known framework default from an explicitly set or genuinely unknown status. */
-    statusKnowledge?: 'default' | 'explicit' | 'unknown';
-    bodyKind?: 'content' | 'none';
-    /** Required for content emissions and absent for bodyless emissions. */
-    mediaType?: string;
-    /** Raw buffers and arbitrary streams have an unknown media type; bodyless emissions have none. */
-    mediaTypeKnowledge?: 'known' | 'none' | 'unknown';
-    /** Named SSE frames carried by the string stream body. */
-    sseEvents?: readonly {
-        eventName: string;
-        contract: ExtractedResponseContract;
-    }[];
-    /** A concrete error status can also be produced by the framework before dispatch. */
-    includeDefaultError?: boolean;
-    /** Set when the route's response schema could not be extracted (lenient discovery mode). */
-    unavailableReason?: string;
-};

package/dist/api-contract-discovery/response-contract-types.mjs

@@ -1 +0,0 @@
-export {};

package/dist/api-contract-discovery/test-setup.test-helpers.d.mts

@@ -1,3 +0,0 @@
-export { buildVirtualProgramMatrix } from '../contract-schema/virtual-program.mts';
-export type { VirtualProgramMatrix } from '../contract-schema/virtual-program.mts';
-export declare const COLD_VIRTUAL_PROGRAM_TIMEOUT_MS = 15000;

package/dist/api-contract-discovery/test-setup.test-helpers.mjs

@@ -1,2 +0,0 @@
-export { buildVirtualProgramMatrix } from '../contract-schema/virtual-program.mjs';
-export const COLD_VIRTUAL_PROGRAM_TIMEOUT_MS = 15_000;

package/dist/workflow-policy/concurrency-scope.d.mts

@@ -1,4 +0,0 @@
-export type ConcurrencyScope = 'fixed-resource' | 'pull-request' | 'ref' | 'sha' | 'run' | 'event' | 'input-resource';
-export type NormalizedConcurrencyScope = Exclude<ConcurrencyScope, 'fixed-resource'> | `unsupported:${string}`;
-export declare function extractConcurrencyScopes(group: string): NormalizedConcurrencyScope[];
-export declare function normalizePolicyScopes(scopes: readonly ConcurrencyScope[]): NormalizedConcurrencyScope[];

package/dist/workflow-policy/concurrency-scope.mjs

@@ -1,66 +0,0 @@
-const scopeOrder = [
-    'pull-request',
-    'ref',
-    'sha',
-    'run',
-    'event',
-    'input-resource',
-];
-const ignoredOwnerContexts = new Set(['github.workflow', 'github.run_attempt']);
-const eventPayloadContexts = new Set([
-    'github.event_name',
-    'github.event.action',
-    'github.event.label.name',
-    'github.event.issue.number',
-    'github.event.schedule',
-    'github.event.workflow_run.event',
-    'github.event.workflow_run.id',
-    'github.event.workflow_run.workflow_id',
-]);
-function classifyContext(reference) {
-    if (ignoredOwnerContexts.has(reference))
-        return undefined;
-    if (reference === 'github.event.pull_request.number' ||
-        reference === 'github.event.workflow_run.pull_requests')
-        return 'pull-request';
-    if (reference === 'github.event.pull_request.head.sha' ||
-        reference === 'github.event.workflow_run.head_sha' ||
-        reference === 'github.sha')
-        return 'sha';
-    if (reference === 'github.ref' ||
-        reference === 'github.ref_name' ||
-        reference === 'github.event.workflow_run.head_branch')
-        return 'ref';
-    if (reference === 'github.run_id')
-        return 'run';
-    if (reference.startsWith('inputs.') ||
-        reference === 'github.event.inputs' ||
-        reference.startsWith('github.event.inputs.')) {
-        return 'input-resource';
-    }
-    if (eventPayloadContexts.has(reference))
-        return 'event';
-    return `unsupported:${reference}`;
-}
-function sortScopes(scopes) {
-    return [...new Set(scopes)].toSorted((left, right) => {
-        const leftIndex = scopeOrder.indexOf(left);
-        const rightIndex = scopeOrder.indexOf(right);
-        if (leftIndex === -1 || rightIndex === -1) {
-            if (leftIndex === rightIndex)
-                return left.localeCompare(right);
-            return leftIndex === -1 ? 1 : -1;
-        }
-        return leftIndex - rightIndex;
-    });
-}
-export function extractConcurrencyScopes(group) {
-    const references = group.match(/\b(?:github|inputs)(?:\.[A-Za-z_][\w-]*)+/gu) ?? [];
-    return sortScopes(references.flatMap((reference) => classifyContext(reference) ?? []));
-}
-export function normalizePolicyScopes(scopes) {
-    if (scopes.includes('fixed-resource')) {
-        return scopes.length === 1 ? [] : ['unsupported:fixed-resource-combination'];
-    }
-    return sortScopes(scopes.filter((scope) => scope !== 'fixed-resource'));
-}

package/dist/workflow-policy/concurrency.d.mts

@@ -1,10 +0,0 @@
-import type { WorkflowTopology } from './types.mts';
-import { type ConcurrencyScope } from './concurrency-scope.mts';
-type ConcurrencyCancellationBehavior = 'cancel-running' | 'retain-running' | 'conditional';
-export type ConcurrencyPolicy = {
-    pending: 'coalesce-latest' | 'fifo';
-    cancellation: ConcurrencyCancellationBehavior;
-    scope: readonly ConcurrencyScope[];
-};
-export declare function evaluateLockPolicy(topology: WorkflowTopology, unlockedWorkflowReasons: Readonly<Record<string, string>>, semanticPolicy: Readonly<Record<string, ConcurrencyPolicy>>): string[];
-export {};

package/dist/workflow-policy/concurrency.mjs

@@ -1,77 +0,0 @@
-import { extractConcurrencyScopes, normalizePolicyScopes, } from './concurrency-scope.mjs';
-function cancellation(value) {
-    return typeof value === 'string' ? 'conditional' : value ? 'cancel-running' : 'retain-running';
-}
-export function evaluateLockPolicy(topology, unlockedWorkflowReasons, semanticPolicy) {
-    const diagnostics = [];
-    const owners = [...topology.workflows, ...topology.jobs].filter((owner) => owner.concurrency);
-    const actualOwnerIds = new Set(owners.map((owner) => owner.id));
-    const declaredOwnerIds = new Set(Object.keys(semanticPolicy));
-    for (const id of [...actualOwnerIds].toSorted()) {
-        if (!declaredOwnerIds.has(id))
-            diagnostics.push(`lock intent missing: ${id}`);
-    }
-    for (const id of [...declaredOwnerIds].toSorted()) {
-        if (!actualOwnerIds.has(id))
-            diagnostics.push(`lock intent stale: ${id}`);
-    }
-    const jobsById = new Map(topology.jobs.map((job) => [job.id, job]));
-    for (const workflow of topology.workflows) {
-        const unlockedReason = unlockedWorkflowReasons[workflow.path];
-        const hasUnlockedJob = !workflow.concurrency &&
-            workflow.jobIds.some((jobId) => jobsById.get(jobId)?.concurrency === undefined);
-        if (hasUnlockedJob && !unlockedReason)
-            diagnostics.push(`lock intent missing: ${workflow.path}`);
-        if (!hasUnlockedJob && unlockedReason)
-            diagnostics.push(`unlocked reason stale: ${workflow.path}`);
-        if (unlockedReason !== undefined && unlockedReason.trim() === '')
-            diagnostics.push(`unlocked reason empty: ${workflow.path}`);
-    }
-    for (const path of Object.keys(unlockedWorkflowReasons).toSorted()) {
-        if (!topology.workflows.some((workflow) => workflow.path === path))
-            diagnostics.push(`unlocked reason stale: ${path}`);
-    }
-    for (const owner of owners) {
-        const declared = semanticPolicy[owner.id];
-        if (!declared || !owner.concurrency)
-            continue;
-        const cancelInProgress = owner.concurrency.effective.cancelInProgress;
-        if (typeof cancelInProgress === 'string' &&
-            !/^\$\{\{\s*\S[\s\S]*\}\}$/.test(cancelInProgress.trim()))
-            diagnostics.push(`conditional cancel-in-progress expression invalid: ${owner.id}: ${cancelInProgress}`);
-        const actualPending = owner.concurrency.effective.queue === 'max' ? 'fifo' : 'coalesce-latest';
-        if (actualPending !== declared.pending)
-            diagnostics.push(`concurrency pending mismatch: ${owner.id}: expected ${declared.pending}, got ${actualPending}`);
-        const actualCancellation = cancellation(owner.concurrency.effective.cancelInProgress);
-        if (actualCancellation !== declared.cancellation)
-            diagnostics.push(`concurrency cancellation mismatch: ${owner.id}: expected ${declared.cancellation}, got ${actualCancellation}`);
-        const actualScopes = extractConcurrencyScopes(owner.concurrency.effective.group);
-        const expectedScopes = normalizePolicyScopes(declared.scope);
-        if (JSON.stringify(actualScopes) !== JSON.stringify(expectedScopes))
-            diagnostics.push(`concurrency scope mismatch: ${owner.id}: expected ${expectedScopes.join(',')}, got ${actualScopes.join(',')}`);
-    }
-    diagnostics.push(...collisionDiagnostics(owners, topology));
-    return [...new Set(diagnostics)].toSorted();
-}
-function collisionDiagnostics(owners, topology) {
-    const workflowPathsById = new Map(topology.workflows.map((workflow) => [workflow.id, workflow.path]));
-    const ownerWorkflowPaths = new Map([
-        ...topology.workflows.map((workflow) => [workflow.id, workflow.path]),
-        ...topology.jobs.map((job) => [job.id, workflowPathsById.get(job.workflowId) ?? job.workflowId]),
-    ]);
-    const groups = new Map();
-    for (const owner of owners) {
-        const group = owner.concurrency?.effective.group;
-        if (!group)
-            continue;
-        const normalizedGroup = group.toLocaleLowerCase('en-US');
-        const workflowPartition = /\$\{\{\s*github\.workflow\s*\}\}/.test(group)
-            ? ownerWorkflowPaths.get(owner.id)
-            : '';
-        const key = `${normalizedGroup}\0${workflowPartition}`;
-        const entry = groups.get(key) ?? { group: normalizedGroup, ids: [] };
-        entry.ids.push(owner.id);
-        groups.set(key, entry);
-    }
-    return [...groups.values()].flatMap(({ group, ids }) => ids.length > 1 ? [`concurrency group collision: ${group}: ${ids.toSorted().join(', ')}`] : []);
-}

package/dist/workflow-policy/graph.d.mts

@@ -1,2 +0,0 @@
-import type { WorkflowTopology, WorkflowTopologyIndex, WorkflowTopologyPolicy } from './types.mts';
-export declare function evaluateGraphPolicy(topology: WorkflowTopology, index: WorkflowTopologyIndex, policy: WorkflowTopologyPolicy): string[];

package/dist/workflow-policy/graph.mjs

@@ -1,138 +0,0 @@
-export function evaluateGraphPolicy(topology, index, policy) {
-    const diagnostics = [
-        ...inventoryDiagnostics(topology, policy),
-        ...jobPresenceDiagnostics(index, policy),
-        ...edgeDiagnostics(index, policy.requiredDirectEdges, true, true),
-        ...edgeDiagnostics(index, policy.forbiddenDirectEdges, true, false),
-        ...edgeDiagnostics(index, policy.requiredTransitiveEdges, false, true),
-        ...edgeDiagnostics(index, policy.forbiddenTransitiveEdges, false, false),
-        ...artifactEdgeDiagnostics(index, policy),
-        ...fanInDiagnostics(index, policy),
-        ...callerDiagnostics(index, policy),
-        ...stepOrderDiagnostics(index, policy),
-    ];
-    return diagnostics.toSorted();
-}
-function artifactEdgeDiagnostics(index, policy) {
-    return policy.requiredArtifactEdges.flatMap((rule) => {
-        const label = `${rule.from} -> ${rule.to}: ${rule.name}${rule.match ? ` [${rule.match}]` : ''}`;
-        if (!index.jobsById.has(rule.from) || !index.jobsById.has(rule.to))
-            return [`required artifact edge missing: ${label}`];
-        const present = index
-            .artifactConsumersForProducerJob(rule.from)
-            .some((edge) => edge.to === rule.to &&
-            edge.name === rule.name &&
-            (rule.match === undefined || edge.match === rule.match));
-        return present ? [] : [`required artifact edge missing: ${label}`];
-    });
-}
-function inventoryDiagnostics(topology, policy) {
-    const jobsById = new Map(topology.jobs.map((job) => [job.id, job]));
-    const actual = new Map(topology.workflows.map((workflow) => [
-        workflow.path,
-        workflow.jobIds
-            .map((id) => jobsById.get(id)?.key ?? id)
-            .toSorted((a, b) => a.localeCompare(b)),
-    ]));
-    const diagnostics = [];
-    for (const [path, keys] of actual) {
-        const expected = policy.jobInventory[path];
-        if (!expected)
-            diagnostics.push(`workflow inventory missing: ${path}`);
-        else if (JSON.stringify(keys) !== JSON.stringify([...expected].toSorted()))
-            diagnostics.push(`job inventory mismatch: ${path}: expected ${[...expected].toSorted().join(', ')}, got ${keys.join(', ')}`);
-    }
-    for (const path of Object.keys(policy.jobInventory).toSorted()) {
-        if (!actual.has(path))
-            diagnostics.push(`workflow inventory stale: ${path}`);
-    }
-    return diagnostics;
-}
-function jobPresenceDiagnostics(index, policy) {
-    const diagnostics = [];
-    for (const id of policy.requiredJobs)
-        if (!index.jobsById.has(id))
-            diagnostics.push(`required job missing: ${id}`);
-    for (const id of policy.forbiddenJobs)
-        if (index.jobsById.has(id))
-            diagnostics.push(`forbidden job present: ${id}`);
-    return diagnostics;
-}
-function edgeDiagnostics(index, rules, direct, required) {
-    return rules.flatMap(([from, to]) => {
-        if (!index.jobsById.has(from) || !index.jobsById.has(to))
-            return required
-                ? [`required ${direct ? 'direct' : 'transitive'} edge missing: ${from} -> ${to}`]
-                : [];
-        const downstream = direct
-            ? index.directDownstreamJobIds(from)
-            : index.transitiveDownstreamJobIds(from);
-        const present = downstream.includes(to);
-        return present === required
-            ? []
-            : [
-                `${required ? 'required' : 'forbidden'} ${direct ? 'direct' : 'transitive'} edge ${required ? 'missing' : 'present'}: ${from} -> ${to}`,
-            ];
-    });
-}
-function fanInDiagnostics(index, policy) {
-    return Object.entries(policy.exactFanIns).flatMap(([jobId, expected]) => {
-        if (!index.jobsById.has(jobId))
-            return [`exact fan-in target missing: ${jobId}`];
-        const actual = [...index.directUpstreamJobIds(jobId)].toSorted();
-        return JSON.stringify(actual) === JSON.stringify([...expected].toSorted())
-            ? []
-            : [
-                `exact fan-in mismatch: ${jobId}: expected ${[...expected].toSorted().join(', ')}, got ${actual.join(', ')}`,
-            ];
-    });
-}
-function callerDiagnostics(index, policy) {
-    const callablePaths = [];
-    for (const workflow of index.workflowsByPath.values())
-        if (workflow.callable)
-            callablePaths.push(workflow.path);
-    callablePaths.sort((left, right) => left.localeCompare(right));
-    const declaredPaths = Object.keys(policy.exactCallerJobs).toSorted();
-    const diagnostics = [];
-    for (const path of callablePaths)
-        if (!policy.exactCallerJobs[path])
-            diagnostics.push(`caller allowlist missing: ${path}`);
-    for (const path of declaredPaths)
-        if (!callablePaths.includes(path))
-            diagnostics.push(`caller allowlist stale: ${path}`);
-    diagnostics.push(...Object.entries(policy.exactCallerJobs).flatMap(([path, expected]) => {
-        if (!index.workflowsByPath.get(path)?.callable)
-            return [];
-        const actual = [...index.directCallerJobIds(path)].toSorted();
-        return JSON.stringify(actual) === JSON.stringify([...expected].toSorted())
-            ? []
-            : [
-                `caller allowlist mismatch: ${path}: expected ${[...expected].toSorted().join(', ')}, got ${actual.join(', ')}`,
-            ];
-    }));
-    return diagnostics;
-}
-function matches(selector, step) {
-    return ((selector.id === undefined || selector.id === step.id) &&
-        (selector.uses === undefined || selector.uses === step.uses) &&
-        (selector.name === undefined || selector.name === step.name));
-}
-function stepOrderDiagnostics(index, policy) {
-    return policy.stepOrders.flatMap((rule) => {
-        const job = index.jobsById.get(rule.jobId);
-        if (!job)
-            return [`step-order job missing: ${rule.jobId}`];
-        let prior = -1;
-        for (const selector of rule.steps) {
-            const step = job.steps.find((candidate) => matches(selector, candidate));
-            const label = selector.id ?? selector.uses ?? selector.name ?? '<step>';
-            if (!step)
-                return [`required ordered step missing: ${rule.jobId}: ${label}`];
-            if (step.index <= prior)
-                return [`required step order invalid: ${rule.jobId}: ${label}`];
-            prior = step.index;
-        }
-        return [];
-    });
-}