@acpus/core 0.6.0 → 0.7.0-alpha.0

package/dist/ir/validator.js

@@ -0,0 +1,671 @@
+import { validateExprIR } from "@acpus/expression/validator";
+export function validateWorkflowIR(ir) {
+    const diagnostics = [];
+    if (!isRecord(ir)) {
+        addError(diagnostics, "IR002", "WorkflowIR must be an object.", "");
+        return diagnostics;
+    }
+    validateKnownFields(ir, ["irVersion", "name", "description", "inputSchema", "agents", "root", "outputs", "lock", "diagnostics"], diagnostics, "");
+    if (ir.irVersion !== 2)
+        addError(diagnostics, "IR002", "WorkflowIR irVersion must be 2.", "irVersion");
+    if (!ir.name || !/^[A-Za-z_][A-Za-z0-9_-]*$/.test(ir.name)) {
+        addWarning(diagnostics, "W002", `Workflow name '${ir.name}' is not identifier-like. This is allowed but discouraged.`);
+    }
+    if (ir.description !== undefined && typeof ir.description !== "string") {
+        addError(diagnostics, "IR002", "WorkflowIR description must be a string.", "description");
+    }
+    validateSchema(ir.inputSchema, diagnostics, "inputSchema");
+    const agents = isRecord(ir.agents) ? ir.agents : undefined;
+    if (!agents)
+        addError(diagnostics, "IR002", "WorkflowIR agents must be an object.", "agents");
+    else
+        validateAgents(agents, diagnostics);
+    validateLock(ir.lock, diagnostics, "lock");
+    validateDiagnostics(ir.diagnostics, diagnostics, "diagnostics");
+    validateExprObject(ir.outputs, diagnostics, "outputs");
+    const ids = new Set();
+    validateScope(ir.root, diagnostics, {
+        path: "root",
+        ids,
+        agents: new Set(agents ? Object.keys(agents) : []),
+    });
+    return diagnostics;
+}
+function validateLock(lock, diagnostics, path) {
+    if (!requireRecord(lock, diagnostics, path, "IR002", "WorkflowIR lock must be an object."))
+        return;
+    validateKnownFields(lock, ["acpusCoreVersion", "workflowSource", "workflowSourceDigest", "generatedAt", "notes"], diagnostics, path);
+    validateRequiredNonEmptyString(lock.acpusCoreVersion, diagnostics, `${path}.acpusCoreVersion`, "IR002", "WorkflowIR lock acpusCoreVersion must be a non-empty string.");
+    validateRequiredNonEmptyString(lock.generatedAt, diagnostics, `${path}.generatedAt`, "IR002", "WorkflowIR lock generatedAt must be a non-empty string.");
+    const notes = requireArray(lock.notes, diagnostics, `${path}.notes`, "IR002", "WorkflowIR lock notes must be an array.");
+    if (!notes)
+        return;
+    forEachDense(notes, diagnostics, `${path}.notes`, (note, index) => {
+        if (typeof note !== "string")
+            addError(diagnostics, "IR002", "WorkflowIR lock notes must be a string array.", `${path}.notes.${index}`);
+    }, { code: "IR002" });
+}
+function validateDiagnostics(value, diagnostics, path) {
+    const items = requireArray(value, diagnostics, path, "IR002", "WorkflowIR diagnostics must be an array.");
+    if (!items)
+        return;
+    forEachDense(items, diagnostics, path, (diagnostic, index) => {
+        if (!requireRecord(diagnostic, diagnostics, `${path}.${index}`, "IR002", "WorkflowIR diagnostic entries must be objects.")) {
+            return;
+        }
+        validateKnownFields(diagnostic, ["code", "severity", "message", "path", "source", "hint"], diagnostics, `${path}.${index}`);
+        validateRequiredNonEmptyString(diagnostic.code, diagnostics, `${path}.${index}.code`, "IR002", "WorkflowIR diagnostic code must be a non-empty string.");
+        validateRequiredEnum(diagnostic.severity, ["error", "warning", "info"], diagnostics, `${path}.${index}.severity`, "IR002", "WorkflowIR diagnostic severity must be error, warning, or info.");
+        validateRequiredNonEmptyString(diagnostic.message, diagnostics, `${path}.${index}.message`, "IR002", "WorkflowIR diagnostic message must be a non-empty string.");
+    }, { code: "IR002" });
+}
+function validateAgents(agents, diagnostics) {
+    for (const [name, agent] of Object.entries(agents)) {
+        const path = `agents.${name}`;
+        if (!requireRecord(agent, diagnostics, path, "A002", `Agent '${name}' definition must be an object.`))
+            continue;
+        if (agent.kind === "agent_definition") {
+            validateKnownFields(agent, ["kind", "use", "model", "permissionMode", "agentMode", "cwd", "env"], diagnostics, path);
+            validateRequiredNonEmptyString(agent.use, diagnostics, `${path}.use`, "A002", `Agent '${name}' use must be a non-empty string.`);
+            validatePermissionMode(agent.permissionMode, diagnostics, `${path}.permissionMode`);
+            validateAgentMode(agent.agentMode, diagnostics, `${path}.agentMode`);
+            if (agent.cwd)
+                validateExpr(agent.cwd, diagnostics, `${path}.cwd`);
+            validateEnv(agent.env, diagnostics, `${path}.env`);
+            continue;
+        }
+        if (agent.kind === "agent_command") {
+            validateKnownFields(agent, ["kind", "command", "model", "permissionMode", "agentMode", "cwd", "env"], diagnostics, path);
+            validateRequiredNonEmptyString(agent.command, diagnostics, `${path}.command`, "A002", `Command-backed agent '${name}' command must be a non-empty string.`);
+            validatePermissionMode(agent.permissionMode, diagnostics, `${path}.permissionMode`);
+            validateAgentMode(agent.agentMode, diagnostics, `${path}.agentMode`);
+            if (agent.cwd)
+                validateExpr(agent.cwd, diagnostics, `${path}.cwd`);
+            validateEnv(agent.env, diagnostics, `${path}.env`);
+            continue;
+        }
+        addError(diagnostics, "A002", `Agent '${name}' kind must be agent_definition or agent_command.`, path);
+    }
+}
+function validateScope(scope, diagnostics, ctx) {
+    if (!requireRecord(scope, diagnostics, ctx.path, "IR002", "Scope must be an object."))
+        return;
+    validateKnownFields(scope, ["nodes", "outputs"], diagnostics, ctx.path);
+    const nodes = requireArray(scope.nodes, diagnostics, `${ctx.path}.nodes`, "IR002", "Scope nodes must be an array.");
+    if (!nodes)
+        return;
+    forEachDense(nodes, diagnostics, `${ctx.path}.nodes`, node => validateNode(node, diagnostics, ctx), { code: "IR002" });
+    if (scope.outputs !== undefined) {
+        validateExprObject(scope.outputs, diagnostics, `${ctx.path}.outputs`);
+    }
+}
+function validateNode(node, diagnostics, ctx) {
+    if (!requireRecord(node, diagnostics, `${ctx.path}.nodes`, "IR002", "Node must be an object."))
+        return;
+    const id = typeof node.id === "string" ? node.id : "<unknown>";
+    const path = `${ctx.path}.nodes.${id}`;
+    if (!/^[A-Za-z_][A-Za-z0-9_-]*$/.test(id))
+        addError(diagnostics, "ID001", `Invalid node id '${id}'.`, path);
+    if (ctx.ids.has(id))
+        addError(diagnostics, "ID002", `Duplicate node id '${id}'.`, path);
+    ctx.ids.add(id);
+    switch (node.kind) {
+        case "agent": {
+            validateKnownFields(node, ["id", "source", "kind", "outputSchema", "run", "timeout", "retry"], diagnostics, path);
+            validateDuration(node.timeout, diagnostics, `${path}.timeout`, `Agent node '${node.id}' timeout`, "IR002");
+            validateAgentRun(node.run, diagnostics, `${path}.run`);
+            validateRetry(node.retry, diagnostics, `${path}.retry`, node.outputSchema !== undefined);
+            const agentKey = isRecord(node.run) && typeof node.run.agent === "string" ? node.run.agent : undefined;
+            if (agentKey && !ctx.agents.has(agentKey)) {
+                diagnostics.push({
+                    code: "A001",
+                    severity: "error",
+                    message: `Agent node '${node.id}' references undeclared agent '${agentKey}'.`,
+                    path: `${path}.run.agent`,
+                    hint: "Declare the agent under defineWorkflow({ agents }) and reference it with agents.<key>.",
+                });
+            }
+            validateSchema(node.outputSchema, diagnostics, `${path}.outputSchema`);
+            break;
+        }
+        case "task": {
+            validateKnownFields(node, ["id", "source", "kind", "run", "timeout"], diagnostics, path);
+            validateDuration(node.timeout, diagnostics, `${path}.timeout`, `Task node '${node.id}' timeout`, "IR002");
+            validateTaskRun(node.run, diagnostics, `${path}.run`);
+            break;
+        }
+        case "signal": {
+            validateKnownFields(node, ["id", "source", "kind", "outputSchema", "run", "timeout", "onTimeout"], diagnostics, path);
+            validateDuration(node.timeout, diagnostics, `${path}.timeout`, `Signal node '${node.id}' timeout`, "IR002");
+            if (node.onTimeout && node.timeout === undefined)
+                addError(diagnostics, "S001", `Signal node '${node.id}' onTimeout requires timeout.`, `${path}.onTimeout`);
+            validateSignalRun(node.run, diagnostics, `${path}.run`);
+            validateSignalTimeout(node.onTimeout, diagnostics, `${path}.onTimeout`, node.id);
+            validateSchema(node.outputSchema, diagnostics, `${path}.outputSchema`);
+            break;
+        }
+        case "assert": {
+            validateKnownFields(node, ["id", "source", "kind", "condition", "message"], diagnostics, path);
+            validateExpr(node.condition, diagnostics, `${path}.condition`);
+            if (node.message)
+                validateTemplate(node.message, diagnostics, `${path}.message`);
+            break;
+        }
+        case "if": {
+            validateKnownFields(node, ["id", "source", "kind", "condition", "then", "else"], diagnostics, path);
+            validateExpr(node.condition, diagnostics, `${path}.condition`);
+            validateScope(node.then, diagnostics, { ...ctx, path: `${path}.then` });
+            if (!node.else) {
+                diagnostics.push({
+                    code: "G002",
+                    severity: "error",
+                    message: `If node '${node.id}' must declare else.`,
+                    path: `${path}.else`,
+                    hint: "Add an else branch. Use else: () => ({}) for control-only branching.",
+                });
+            }
+            else {
+                validateScope(node.else, diagnostics, { ...ctx, path: `${path}.else` });
+            }
+            break;
+        }
+        case "switch": {
+            validateKnownFields(node, ["id", "source", "kind", "cases", "default"], diagnostics, path);
+            if (!Array.isArray(node.cases)) {
+                addError(diagnostics, "IR002", "Switch cases must be an array.", `${path}.cases`);
+            }
+            else {
+                forEachDense(node.cases, diagnostics, `${path}.cases`, (c, i) => {
+                    const casePath = `${path}.cases.${i}`;
+                    if (!requireRecord(c, diagnostics, casePath, "IR002", "Switch case must be an object."))
+                        return;
+                    validateKnownFields(c, ["when", "then"], diagnostics, casePath);
+                    validateExpr(c.when, diagnostics, `${casePath}.when`);
+                    validateScope(c.then, diagnostics, { ...ctx, path: `${casePath}.then` });
+                }, { code: "IR002" });
+            }
+            if (!node.default) {
+                diagnostics.push({
+                    code: "G003",
+                    severity: "error",
+                    message: `Switch node '${node.id}' must declare default.`,
+                    path: `${path}.default`,
+                    hint: "Add a default branch. Use default: () => ({}) for control-only routing.",
+                });
+            }
+            else {
+                validateScope(node.default, diagnostics, { ...ctx, path: `${path}.default` });
+            }
+            break;
+        }
+        case "parallel": {
+            validateKnownFields(node, ["id", "source", "kind", "branches", "strategy", "maxConcurrency"], diagnostics, path);
+            if (node.strategy !== "all" && node.strategy !== "race")
+                addError(diagnostics, "P001", `Parallel node '${node.id}' strategy must be 'all' or 'race'.`, `${path}.strategy`);
+            if (!isRecord(node.branches)) {
+                addError(diagnostics, "IR002", "Parallel branches must be an object.", `${path}.branches`);
+                break;
+            }
+            if (node.strategy === "race" && Object.keys(node.branches).length === 0)
+                addError(diagnostics, "P002", `Parallel race node '${node.id}' must declare at least one branch.`, `${path}.branches`);
+            for (const [name, branch] of Object.entries(node.branches)) {
+                const branchPath = `${path}.branches.${name}`;
+                if (!requireRecord(branch, diagnostics, branchPath, "IR002", "Parallel branch must be an object."))
+                    continue;
+                validateKnownFields(branch, ["scope"], diagnostics, branchPath);
+                validateScope(branch.scope, diagnostics, { ...ctx, path: `${branchPath}.scope` });
+            }
+            break;
+        }
+        case "fanout": {
+            validateKnownFields(node, ["id", "source", "kind", "over", "key", "do", "maxConcurrency", "strategy", "count"], diagnostics, path);
+            const strategy = node.strategy;
+            const count = node.count;
+            if (strategy !== "all" && strategy !== "quorum")
+                addError(diagnostics, "F001", `Fanout node '${node.id}' strategy must be 'all' or 'quorum'.`, `${path}.strategy`);
+            if (strategy === "quorum" && (!Number.isInteger(count) || (count ?? 0) <= 0))
+                addError(diagnostics, "F002", `Fanout node '${node.id}' quorum count must be a positive integer.`, `${path}.count`);
+            if (strategy !== "quorum" && count !== undefined)
+                addError(diagnostics, "F003", `Fanout node '${node.id}' count is only valid with quorum strategy.`, `${path}.count`);
+            const validOver = validateExpr(node.over, diagnostics, `${path}.over`);
+            if (validOver)
+                validateFanoutOver(node.over, diagnostics, `${path}.over`);
+            if (node.key)
+                validateTemplate(node.key, diagnostics, `${path}.key`);
+            validateScope(node.do, diagnostics, { ...ctx, path: `${path}.do` });
+            break;
+        }
+        case "loop": {
+            validateKnownFields(node, ["id", "source", "kind", "initial", "maxIterations", "do", "stopWhen", "onExhausted"], diagnostics, path);
+            validateExpr(node.initial, diagnostics, `${path}.initial`);
+            validateExpr(node.maxIterations, diagnostics, `${path}.maxIterations`);
+            if (node.onExhausted !== undefined && node.onExhausted !== "fail" && node.onExhausted !== "returnLast")
+                addError(diagnostics, "L002", `Loop node '${node.id}' onExhausted must be 'fail' or 'returnLast'.`, `${path}.onExhausted`);
+            validateExpr(node.stopWhen, diagnostics, `${path}.stopWhen`);
+            validateScope(node.do, diagnostics, { ...ctx, path: `${path}.do` });
+            break;
+        }
+        default:
+            addError(diagnostics, "N001", `Unknown node kind '${String(node.kind)}'.`, `${path}.kind`);
+    }
+}
+function validateAgentRun(run, diagnostics, path) {
+    if (!requireRecord(run, diagnostics, path, "A003", "Agent run must be an object."))
+        return;
+    validateKnownFields(run, ["kind", "agent", "prompt", "permissionMode", "sessionKey", "cwd", "env"], diagnostics, path);
+    if (run.kind !== "agent_run")
+        addError(diagnostics, "A003", "Agent run kind must be agent_run.", `${path}.kind`);
+    validateRequiredNonEmptyString(run.agent, diagnostics, `${path}.agent`, "A003", "Agent run agent must be a non-empty string.");
+    validateTemplate(run.prompt, diagnostics, `${path}.prompt`);
+    validatePermissionMode(run.permissionMode, diagnostics, `${path}.permissionMode`);
+    if (run.sessionKey)
+        validateTemplate(run.sessionKey, diagnostics, `${path}.sessionKey`);
+    if (run.cwd)
+        validateExpr(run.cwd, diagnostics, `${path}.cwd`);
+    validateEnv(run.env, diagnostics, `${path}.env`);
+}
+function validatePermissionMode(value, diagnostics, path) {
+    validateOptionalEnum(value, ["approve-reads", "approve-all", "deny-all"], diagnostics, path, "A002", "Agent permissionMode must be approve-reads, approve-all, or deny-all.");
+}
+function validateAgentMode(value, diagnostics, path) {
+    if (value === undefined)
+        return;
+    if (typeof value !== "string" || value.length === 0) {
+        addError(diagnostics, "A002", "Agent agentMode must be a non-empty string.", path);
+    }
+}
+function validateRetry(value, diagnostics, path, allowed) {
+    if (value === undefined)
+        return;
+    if (!allowed) {
+        addError(diagnostics, "IR001", "Agent retry is only valid when outputSchema is declared.", path);
+        return;
+    }
+    if (!requireRecord(value, diagnostics, path, "IR001", "Retry must be an object."))
+        return;
+    validateKnownFields(value, ["max"], diagnostics, path);
+    const max = value.max;
+    if (max !== undefined && (typeof max !== "number" || !Number.isInteger(max) || max < 0)) {
+        addError(diagnostics, "IR001", "Retry max must be a non-negative integer.", `${path}.max`);
+    }
+}
+function validateDuration(value, diagnostics, path, label, code) {
+    if (value === undefined)
+        return;
+    if (typeof value !== "string" || !/^\d+(ms|s|m|h)?$/.test(value)) {
+        addError(diagnostics, code, `${label} must be a duration string like 500ms, 30s, 5m, 1h, or 1000.`, path);
+    }
+}
+function validateTaskRun(run, diagnostics, path) {
+    if (!requireRecord(run, diagnostics, path, "T007", "Task run must be an object."))
+        return;
+    validateKnownFields(run, ["kind", "input", "target", "cwd", "env", "execution"], diagnostics, path);
+    if (run.kind !== "task_run")
+        addError(diagnostics, "T007", "Task run kind must be task_run.", `${path}.kind`);
+    validateExprObject(run.input, diagnostics, `${path}.input`);
+    validateTaskTarget(run.target, diagnostics, `${path}.target`);
+    if (run.cwd)
+        validateExpr(run.cwd, diagnostics, `${path}.cwd`);
+    validateEnv(run.env, diagnostics, `${path}.env`);
+    validateTaskExecution(run.execution, diagnostics, `${path}.execution`);
+}
+function validateTaskTarget(target, diagnostics, path) {
+    if (!requireRecord(target, diagnostics, path, "T007", "Task run target must be an object."))
+        return;
+    if (target.kind === "inline") {
+        validateKnownFields(target, ["kind", "runtime", "source"], diagnostics, path);
+        if (target.runtime !== "node")
+            addError(diagnostics, "T007", "Inline task target runtime must be node.", `${path}.runtime`);
+        validateRequiredNonEmptyString(target.source, diagnostics, `${path}.source`, "T007", "Inline task target source must be a non-empty string.");
+        return;
+    }
+    if (target.kind === "module") {
+        validateKnownFields(target, ["kind", "runtime", "specifier", "exportName", "referrer"], diagnostics, path);
+        if (target.runtime !== "node")
+            addError(diagnostics, "T007", "Module task target runtime must be node.", `${path}.runtime`);
+        validateRequiredNonEmptyString(target.specifier, diagnostics, `${path}.specifier`, "T007", "Module task target specifier must be a non-empty string.");
+        validateRequiredNonEmptyString(target.exportName, diagnostics, `${path}.exportName`, "T007", "Module task target exportName must be a non-empty string.");
+        validateTaskReferrer(target.referrer, diagnostics, `${path}.referrer`);
+        return;
+    }
+    addError(diagnostics, "T007", "Task run target kind must be inline or module.", `${path}.kind`);
+}
+function validateTaskReferrer(referrer, diagnostics, path) {
+    if (!requireRecord(referrer, diagnostics, path, "T007", "Module task target referrer must be an object."))
+        return;
+    validateKnownFields(referrer, ["kind", "path"], diagnostics, path);
+    if (referrer.kind !== "workflow")
+        addError(diagnostics, "T007", "Module task target referrer kind must be workflow.", `${path}.kind`);
+    if (typeof referrer.path !== "string" || referrer.path.length === 0) {
+        addError(diagnostics, "T007", "Module task target referrer path must be a non-empty string.", `${path}.path`);
+    }
+    else if (referrer.path.startsWith("/") || /^[A-Za-z]:[\\/]/.test(referrer.path)) {
+        addError(diagnostics, "T007", "Module task target referrer path must be workspace-relative.", `${path}.path`);
+    }
+    else if (referrer.path.split(/[\\/]/).includes("..")) {
+        addError(diagnostics, "T007", "Module task target referrer path must stay inside the workspace.", `${path}.path`);
+    }
+}
+function validateSignalRun(run, diagnostics, path) {
+    if (!requireRecord(run, diagnostics, path, "S002", "Signal run must be an object."))
+        return;
+    validateKnownFields(run, ["kind", "prompt"], diagnostics, path);
+    if (run.kind !== "signal_run")
+        addError(diagnostics, "S002", "Signal run kind must be signal_run.", `${path}.kind`);
+    validateTemplate(run.prompt, diagnostics, `${path}.prompt`);
+}
+function validateSignalTimeout(onTimeout, diagnostics, path, id) {
+    if (!onTimeout)
+        return;
+    if (!requireRecord(onTimeout, diagnostics, path, "S001", `Signal node '${id}' onTimeout must be an object.`))
+        return;
+    validateKnownFields(onTimeout, ["action", "message"], diagnostics, path);
+    if (onTimeout.action !== "fail")
+        addError(diagnostics, "S001", `Signal node '${id}' onTimeout action must be 'fail'.`, `${path}.action`);
+    if (onTimeout.message !== undefined && typeof onTimeout.message !== "string") {
+        addError(diagnostics, "S001", `Signal node '${id}' onTimeout message must be a string.`, `${path}.message`);
+    }
+}
+function validateFanoutOver(expr, diagnostics, path) {
+    if (expr.kind === "literal" && !Array.isArray(expr.value)) {
+        addError(diagnostics, "F004", "Fanout over literal must be an array.", path);
+    }
+    if (expr.kind === "object") {
+        addError(diagnostics, "F004", "Fanout over object expression must be an array value.", path);
+    }
+}
+function validateExprObject(values, diagnostics, path) {
+    if (!values) {
+        addError(diagnostics, "E000", "Expression object is required.", path);
+        return;
+    }
+    if (!requireRecord(values, diagnostics, path, "E004", "Expression object fields must be an object."))
+        return;
+    for (const [key, expr] of Object.entries(values))
+        validateExpr(expr, diagnostics, `${path}.${key}`);
+}
+function validateEnv(values, diagnostics, path) {
+    if (values === undefined)
+        return;
+    if (!requireRecord(values, diagnostics, path, "E004", "Env must be an object."))
+        return;
+    for (const [key, value] of Object.entries(values)) {
+        if (isSecretRef(value)) {
+            validateSecretRef(value, diagnostics, `${path}.${key}`);
+            continue;
+        }
+        validateExpr(value, diagnostics, `${path}.${key}`);
+    }
+}
+function validateSecretRef(value, diagnostics, path) {
+    validateKnownFields(value, ["kind", "name"], diagnostics, path);
+    if (typeof value.name !== "string" || value.name.length === 0) {
+        addError(diagnostics, "SEC001", "Secret ref name must be a non-empty string.", `${path}.name`);
+    }
+}
+function validateTemplate(template, diagnostics, path) {
+    if (!template) {
+        addError(diagnostics, "TM001", "Template is required.", path);
+        return false;
+    }
+    if (!isRecord(template) || template.kind !== "template" || !Array.isArray(template.parts)) {
+        addError(diagnostics, "TM001", "Template must be a template object with parts.", path);
+        return false;
+    }
+    validateKnownFields(template, ["kind", "parts"], diagnostics, path);
+    forEachDense(template.parts, diagnostics, `${path}.parts`, (part, index) => {
+        const partPath = `${path}.parts.${index}`;
+        if (!requireRecord(part, diagnostics, partPath, "TM002", "Template part must be an object."))
+            return;
+        if (part.kind === "text") {
+            validateKnownFields(part, ["kind", "value"], diagnostics, partPath);
+            if (typeof part.value !== "string")
+                addError(diagnostics, "TM002", "Template text value must be a string.", `${partPath}.value`);
+            return;
+        }
+        if (part.kind === "expr") {
+            validateKnownFields(part, ["kind", "expr"], diagnostics, partPath);
+            validateExpr(part.expr, diagnostics, `${partPath}.expr`);
+            return;
+        }
+        addError(diagnostics, "TM002", `Unknown template part kind '${String(part.kind)}'.`, `${partPath}.kind`);
+    }, { code: "TM002" });
+    return true;
+}
+function validateTaskExecution(execution, diagnostics, path) {
+    if (!execution)
+        return;
+    if (!requireRecord(execution, diagnostics, path, "T006", "Task execution must be an object."))
+        return;
+    validateKnownFields(execution, ["shell", "defaultCommandTimeout", "commandRunner"], diagnostics, path);
+    validateOptionalEnum(execution.shell, ["bash", "powershell", "pwsh"], diagnostics, `${path}.shell`, "T006", "Task execution shell must be bash, powershell, or pwsh.");
+    validateDuration(execution.defaultCommandTimeout, diagnostics, `${path}.defaultCommandTimeout`, "Task defaultCommandTimeout", "T006");
+    validateOptionalEnum(execution.commandRunner, ["acpus-zx-core", "custom"], diagnostics, `${path}.commandRunner`, "T006", "Task commandRunner must be acpus-zx-core or custom.");
+}
+function validateExpr(expr, diagnostics, path) {
+    if (expr === undefined || expr === null) {
+        addError(diagnostics, "E000", "Expression is required.", path);
+        return false;
+    }
+    if (!isRecord(expr) || typeof expr.kind !== "string") {
+        addError(diagnostics, "E004", "Expression must be an object with kind.", path);
+        return false;
+    }
+    if (expr.kind === "literal" && !Object.prototype.hasOwnProperty.call(expr, "value")) {
+        addError(diagnostics, "E003", "Expression literal must include value.", `${path}.value`);
+        return true;
+    }
+    const issues = validateExprIR(expr);
+    diagnostics.push(...issues.map(issue => expressionDiagnostic(issue, path)));
+    return issues.length === 0;
+}
+function expressionDiagnostic(issue, basePath) {
+    return {
+        code: expressionCode(issue.code),
+        severity: issue.severity,
+        message: issue.message,
+        path: expressionPath(basePath, issue.path),
+    };
+}
+function expressionCode(code) {
+    if (code === "EX006")
+        return "E001";
+    if (code === "EX001" || code === "EX003")
+        return "E002";
+    return "E004";
+}
+function expressionPath(basePath, path) {
+    if (!path || path === "$")
+        return basePath;
+    return `${basePath}${path.slice(1).replaceAll("[", ".").replaceAll("]", "")}`;
+}
+function validateSchema(schema, diagnostics, path) {
+    if (!schema)
+        return;
+    if (!isRecord(schema) || typeof schema.kind !== "string") {
+        addError(diagnostics, "SC002", "Schema must be an object with kind.", path);
+        return;
+    }
+    validateSchemaMetadata(schema, diagnostics, path);
+    switch (schema.kind) {
+        case "unknown":
+        case "string":
+        case "number":
+        case "boolean":
+        case "null":
+        case "path":
+            validateKnownFields(schema, ["kind", "description", "default", "optional", "nullable"], diagnostics, path);
+            break;
+        case "literal":
+            validateKnownFields(schema, ["kind", "value", "description", "default", "optional", "nullable"], diagnostics, path);
+            if (!Object.prototype.hasOwnProperty.call(schema, "value") || !isJsonPrimitive(schema.value))
+                addError(diagnostics, "SC002", "Literal schema value must be a JSON primitive.", `${path}.value`);
+            break;
+        case "enum":
+            validateKnownFields(schema, ["kind", "values", "description", "default", "optional", "nullable"], diagnostics, path);
+            if (!Array.isArray(schema.values)) {
+                addError(diagnostics, "SC002", "Enum schema values must be an array.", `${path}.values`);
+            }
+            else {
+                forEachDense(schema.values, diagnostics, `${path}.values`, (value, index) => {
+                    if (!isJsonPrimitive(value))
+                        addError(diagnostics, "SC002", "Enum schema values must be JSON primitives.", `${path}.values.${index}`);
+                });
+            }
+            break;
+        case "object": {
+            validateKnownFields(schema, ["kind", "fields", "required", "additionalProperties", "description", "default", "optional", "nullable"], diagnostics, path);
+            if (!isRecord(schema.fields))
+                addError(diagnostics, "SC002", "Object schema fields must be an object.", `${path}.fields`);
+            const fields = isRecord(schema.fields) ? schema.fields : {};
+            const required = Array.isArray(schema.required) ? schema.required : [];
+            if (!Array.isArray(schema.required))
+                addError(diagnostics, "SC002", "Object schema required must be an array.", `${path}.required`);
+            else
+                forEachDense(required, diagnostics, `${path}.required`, (req, index) => {
+                    if (typeof req !== "string" || !(req in fields))
+                        addError(diagnostics, "SC001", `Required field '${String(req)}' is not present in object fields.`, `${path}.required.${index}`);
+                });
+            if (typeof schema.additionalProperties !== "boolean")
+                addError(diagnostics, "SC002", "Object schema additionalProperties must be a boolean.", `${path}.additionalProperties`);
+            for (const [key, field] of Object.entries(fields))
+                validateSchema(field, diagnostics, `${path}.fields.${key}`);
+            break;
+        }
+        case "array":
+            validateKnownFields(schema, ["kind", "item", "description", "default", "optional", "nullable"], diagnostics, path);
+            validateRequiredNestedSchema(schema.item, diagnostics, `${path}.item`);
+            break;
+        case "record":
+            validateKnownFields(schema, ["kind", "value", "description", "default", "optional", "nullable"], diagnostics, path);
+            validateRequiredNestedSchema(schema.value, diagnostics, `${path}.value`);
+            break;
+        case "union": {
+            validateKnownFields(schema, ["kind", "variants", "description", "default", "optional", "nullable"], diagnostics, path);
+            if (!Array.isArray(schema.variants)) {
+                addError(diagnostics, "SC002", "Union schema variants must be an array.", `${path}.variants`);
+                break;
+            }
+            forEachDense(schema.variants, diagnostics, `${path}.variants`, (variant, index) => validateSchema(variant, diagnostics, `${path}.variants.${index}`));
+            break;
+        }
+        default:
+            addError(diagnostics, "SC002", `Unknown schema kind '${schema.kind}'.`, `${path}.kind`);
+    }
+}
+function validateSchemaMetadata(schema, diagnostics, path) {
+    if (schema.description !== undefined && typeof schema.description !== "string")
+        addError(diagnostics, "SC002", "Schema description must be a string.", `${path}.description`);
+    if (schema.optional !== undefined && typeof schema.optional !== "boolean")
+        addError(diagnostics, "SC002", "Schema optional must be a boolean.", `${path}.optional`);
+    if (schema.nullable !== undefined && typeof schema.nullable !== "boolean")
+        addError(diagnostics, "SC002", "Schema nullable must be a boolean.", `${path}.nullable`);
+    if (schema.default !== undefined && !isJsonValue(schema.default))
+        addError(diagnostics, "SC002", "Schema default must be JSON-compatible.", `${path}.default`);
+}
+function validateRequiredNestedSchema(schema, diagnostics, path) {
+    if (!schema) {
+        addError(diagnostics, "SC002", "Nested schema is required.", path);
+        return;
+    }
+    validateSchema(schema, diagnostics, path);
+}
+function validateRequiredSchema(schema, diagnostics, path) {
+    if (!schema) {
+        addError(diagnostics, "SC000", "Schema is required.", path);
+        return;
+    }
+    validateSchema(schema, diagnostics, path);
+}
+function addError(diagnostics, code, message, path) {
+    diagnostics.push({ code, severity: "error", message, ...(path === undefined ? {} : { path }) });
+}
+function addWarning(diagnostics, code, message, path) {
+    diagnostics.push({ code, severity: "warning", message, ...(path === undefined ? {} : { path }) });
+}
+function requireRecord(value, diagnostics, path, code, message) {
+    if (isRecord(value))
+        return true;
+    addError(diagnostics, code, message, path);
+    return false;
+}
+function requireArray(value, diagnostics, path, code, message) {
+    if (Array.isArray(value))
+        return value;
+    addError(diagnostics, code, message, path);
+    return undefined;
+}
+function validateRequiredNonEmptyString(value, diagnostics, path, code, message) {
+    if (typeof value !== "string" || value.length === 0)
+        addError(diagnostics, code, message, path);
+}
+function validateRequiredEnum(value, allowed, diagnostics, path, code, message) {
+    if (!allowed.includes(value))
+        addError(diagnostics, code, message, path);
+}
+function validateOptionalEnum(value, allowed, diagnostics, path, code, message) {
+    if (value !== undefined)
+        validateRequiredEnum(value, allowed, diagnostics, path, code, message);
+}
+function validateKnownFields(value, allowed, diagnostics, path) {
+    if (!isRecord(value))
+        return;
+    const allowedSet = new Set(allowed);
+    for (const key of Object.keys(value)) {
+        if (!allowedSet.has(key)) {
+            diagnostics.push({
+                code: "IR001",
+                severity: "error",
+                message: `Unexpected field '${key}'.`,
+                path: path ? `${path}.${key}` : key,
+            });
+        }
+    }
+}
+function forEachDense(items, diagnostics, path, run, options = {}) {
+    for (let index = 0; index < items.length; index++) {
+        if (!Object.prototype.hasOwnProperty.call(items, index)) {
+            diagnostics.push({ code: options.code ?? "SC002", severity: "error", message: options.message ?? "Array values must not contain sparse holes.", path: `${path}.${index}` });
+            continue;
+        }
+        run(items[index], index);
+    }
+}
+function isSecretRef(value) {
+    return isRecord(value) && value.kind === "secret";
+}
+function isRecord(value) {
+    return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function isJsonPrimitive(value) {
+    return value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+}
+function isJsonValue(value, seen = new Set()) {
+    if (isJsonPrimitive(value))
+        return true;
+    if (Array.isArray(value)) {
+        if (seen.has(value))
+            return false;
+        seen.add(value);
+        for (let index = 0; index < value.length; index++) {
+            if (!Object.prototype.hasOwnProperty.call(value, index) || !isJsonValue(value[index], seen))
+                return false;
+        }
+        seen.delete(value);
+        return true;
+    }
+    if (!isRecord(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null)
+        return false;
+    if (seen.has(value))
+        return false;
+    seen.add(value);
+    for (const item of Object.values(value))
+        if (!isJsonValue(item, seen))
+            return false;
+    seen.delete(value);
+    return true;
+}
+//# sourceMappingURL=validator.js.map