Module expand 

Compile-time expansion of supernode instances into flat policies.

A policy node of type: supernode (config { name: <supernode> }) is replaced by the referenced definition’s inner nodes, ids namespaced <instance-id>/<inner-id>. Boundary pseudo-nodes (input/output/ error) are spliced onto the instance’s outer edges. Runs after validate_policy and before compile_policy; the engine never sees a supernode node type.

A definition may declare one or more output boundary nodes and one or more error boundary nodes; each boundary node’s id names an instance port. For output boundaries this goes through port_for_output_boundary — the special id output keeps the historical success mapping, any other id IS the port name. For error boundaries the id IS the port name directly, with no such special-case mapping — except that the id error is also the one the black-box rule targets by default. So an instance’s exit map is per-boundary: each output/error boundary has its own exit_to target (the to of the matching outer inst.<port> edge). Every output-derived port is mandatory-wired — an unwired one is a hard compile error naming the instance and port, because the instance node is gone before post-expansion port validation runs and nothing downstream could catch it otherwise. Error-kind boundaries stay optional: an unwired one just drops the corresponding edges (the policy catch-all, or the generic 500, takes over). The black-box guarantee — every inner node with no error edge of its own gets an implicit error edge — follows ONLY the error-id boundary; other named error boundaries carry no such default.

Constants

BOUNDARY_TYPES 🔒

Reserved boundary pseudo-node types (and required ids) in a definition. Consumed by expand_policy and downstream tasks.

Functions

expand_policy

Inlines every type: supernode node of policy using supernodes.

port_for_output_boundary 🔒

Instance port name exposed by an output boundary node: the special id output keeps the historical success mapping; any other id is the port name itself. Consumed by expansion and its tests; the UI mirrors this mapping in ui/src/policyGraph.ts::supernodePortSpec.

split_endpoint 🔒

Splits node_id.port on the last dot, defaulting the port to out. Mirror of engine::parse_edge_endpoint — the two must agree. Consumed by expand_policy and downstream tasks.