@cynodia/axiom-core 0.14.0-alpha.1 → 0.14.0-alpha.3

package/dist/semantic-identity.d.ts

@@ -33,6 +33,14 @@ import type { ApplicationGraph } from './graph.js';
  * - `StorageDef` — `readAuthorization` / `uploadAuthorization` expressions, `retry`.
  * - `RelationshipDef` — endpoints and cardinality (also in the schema fingerprint; repeated
  *   here so a semantic-only comparison is self-contained).
+ * - `WorkflowDef` — `inputs`, `bindings`, `entry`, and every step's kind, control-flow edges
+ *   and step-specific executable semantics (the `ActionDef` / `EventDef` a step targets, an
+ *   `action` step's argument expressions / `retry` policy, a `wait-event` step's correlation
+ *   `where` / `bind` / `timeout`, a `timer` step's `after` / `at`, a `branch` step's `when`
+ *   and edges, `complete` / `fail` output/error expressions). A workflow's referenced
+ *   `ActionDef` / `EventDef` bodies are covered transitively — they are their own executable
+ *   nodes in this same projection (spec14pt3 §5, §7, §30-§33). Presentation-only fields
+ *   (`name` / `description` / `label`) are stripped exactly as elsewhere.
  * - `graph.schemaVersion`.
  *
  * ### Exclusions (what does NOT change it)
@@ -49,6 +57,16 @@ import type { ApplicationGraph } from './graph.js';
  */
 /** The projection algorithm's own version, mixed into the hash (spec12 §46). */
 export declare const SEMANTIC_FINGERPRINT_VERSION = 1;
+/**
+ * Every graph node kind that carries executable meaning — the single source of truth for
+ * "which graph changes alter executable semantic meaning" (spec14pt3 §5 G1). Both the
+ * graph-level {@link semanticFingerprint} and the ServerIR-side authority-compatibility
+ * fingerprint MUST derive from this same list; a `packages/server` test pins that they do,
+ * so a future primitive cannot be added to one and silently omitted from the other
+ * (spec14pt3 §189, §190 — the deeper architectural correction behind Phase 22 F3).
+ */
+export declare const EXECUTABLE_KINDS: readonly ["action", "integration", "integration-operation", "trigger", "event", "subscription", "read-policy", "query", "expression", "constraint", "transition-constraint", "storage", "relationship", "workflow"];
+export type ExecutableKind = (typeof EXECUTABLE_KINDS)[number];
 export interface SemanticProjection {
     fingerprintVersion: number;
     schemaVersion: number;

package/dist/semantic-identity.js

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { canonicalJSON } from './schema-identity.js';
 import { AUTHORING_METADATA_KEY } from './authoring-metadata.js';
+import { canonicalWorkflowForFingerprint } from './workflows.js';
 /**
  * Application **semantic** identity (spec12 §45, §46).
  *
@@ -35,6 +36,14 @@ import { AUTHORING_METADATA_KEY } from './authoring-metadata.js';
  * - `StorageDef` — `readAuthorization` / `uploadAuthorization` expressions, `retry`.
  * - `RelationshipDef` — endpoints and cardinality (also in the schema fingerprint; repeated
  *   here so a semantic-only comparison is self-contained).
+ * - `WorkflowDef` — `inputs`, `bindings`, `entry`, and every step's kind, control-flow edges
+ *   and step-specific executable semantics (the `ActionDef` / `EventDef` a step targets, an
+ *   `action` step's argument expressions / `retry` policy, a `wait-event` step's correlation
+ *   `where` / `bind` / `timeout`, a `timer` step's `after` / `at`, a `branch` step's `when`
+ *   and edges, `complete` / `fail` output/error expressions). A workflow's referenced
+ *   `ActionDef` / `EventDef` bodies are covered transitively — they are their own executable
+ *   nodes in this same projection (spec14pt3 §5, §7, §30-§33). Presentation-only fields
+ *   (`name` / `description` / `label`) are stripped exactly as elsewhere.
  * - `graph.schemaVersion`.
  *
  * ### Exclusions (what does NOT change it)
@@ -51,7 +60,15 @@ import { AUTHORING_METADATA_KEY } from './authoring-metadata.js';
  */
 /** The projection algorithm's own version, mixed into the hash (spec12 §46). */
 export const SEMANTIC_FINGERPRINT_VERSION = 1;
-const EXECUTABLE_KINDS = [
+/**
+ * Every graph node kind that carries executable meaning — the single source of truth for
+ * "which graph changes alter executable semantic meaning" (spec14pt3 §5 G1). Both the
+ * graph-level {@link semanticFingerprint} and the ServerIR-side authority-compatibility
+ * fingerprint MUST derive from this same list; a `packages/server` test pins that they do,
+ * so a future primitive cannot be added to one and silently omitted from the other
+ * (spec14pt3 §189, §190 — the deeper architectural correction behind Phase 22 F3).
+ */
+export const EXECUTABLE_KINDS = [
     'action',
     'integration',
     'integration-operation',
@@ -96,7 +113,7 @@ export function semanticProjection(graph) {
         if (group.length === 0) {
             continue;
         }
-        nodes[kind] = byId(group).map((node) => stripNonSemantic(node));
+        nodes[kind] = byId(group).map((node) => stripNonSemantic(kind === 'workflow' ? canonicalWorkflowForFingerprint(node) : node));
     }
     return {
         fingerprintVersion: SEMANTIC_FINGERPRINT_VERSION,

package/dist/validate.js

@@ -1052,10 +1052,11 @@ function validateWorkflow(workflow, context) {
     // Reachability + acyclicity + terminal reachability.
     const reachable = workflowReachableSteps(workflow);
     for (const step of steps) {
-        if (typeof step.id === 'string' && !reachable.has(String(step.id))) {
+        const sid = step && typeof step === 'object' ? step.id : undefined;
+        if (typeof sid === 'string' && !reachable.has(sid)) {
             context.errors.push({
                 code: VALIDATION_CODES.workflowUnreachableStep,
-                message: `Workflow ${workflow.id} step ${String(step.id)} is unreachable from entry`,
+                message: `Workflow ${workflow.id} step ${sid} is unreachable from entry`,
                 nodeId: workflow.id,
             });
         }

package/dist/workflows.d.ts

@@ -109,11 +109,18 @@ export interface WorkflowDef extends NodeBase {
     entry: NodeId;
     steps: WorkflowStep[];
 }
+/**
+ * Whether a value is a structurally recognizable workflow step — an object with an `id` and
+ * one of the six {@link WORKFLOW_STEP_TYPES}. The accessors below are total over *any* input
+ * (a malformed graph, a hand-tampered Server IR) precisely so a bad step produces a
+ * structured diagnostic rather than a native `TypeError` (spec14pt3 F1 / F2 §39-§48).
+ */
+export declare function isWorkflowStep(step: unknown): step is WorkflowStep;
 export declare function workflowStepById(workflow: WorkflowDef, stepId: NodeId | string): WorkflowStep | undefined;
-/** Every step id a step can hand control to (control-flow successors). */
+/** Every step id a step can hand control to (control-flow successors). Total over bad input. */
 export declare function workflowStepSuccessors(step: WorkflowStep): NodeId[];
 export declare function workflowIsTerminalStep(step: WorkflowStep): boolean;
-/** Every `Expression` embedded in a step — the leaves dependency / scope analysis walks. */
+/** Every `Expression` embedded in a step — the leaves dependency / scope analysis walks. Total over bad input. */
 export declare function workflowStepExpressions(step: WorkflowStep): Expression[];
 /** Every `Expression` in a workflow — inputs carry none, so this is the step leaves. */
 export declare function workflowExpressions(workflow: WorkflowDef): Expression[];
@@ -121,6 +128,46 @@ export declare function workflowExpressions(workflow: WorkflowDef): Expression[]
 export declare function workflowActionIds(workflow: WorkflowDef): NodeId[];
 /** The `EventDef` ids a workflow waits on. */
 export declare function workflowEventIds(workflow: WorkflowDef): NodeId[];
+/**
+ * A `WorkflowDef` reduced to a form where **authoring order is not semantic** (spec14pt3
+ * §19, §64): `steps`, `inputs` and `bindings` are ordered by id. Control flow is by explicit
+ * `entry` / `next` / `then` / `else` / `onError` / `onTimeout` edges, never by array
+ * position, so two workflows that differ only in the order their steps were declared are the
+ * same executable meaning. Both the graph-level `semanticFingerprint` and the ServerIR-side
+ * authority-compatibility fingerprint pass workflows through this before hashing, so they
+ * agree (spec14pt3 §5 G1). Non-`id` fields are untouched; human metadata is stripped by the
+ * caller's projection exactly as elsewhere.
+ */
+export declare function canonicalWorkflowForFingerprint<T extends Partial<WorkflowDef>>(workflow: T): T;
+export interface WorkflowStructuralProblem {
+    code: 'WORKFLOW_INVALID_STEP' | 'WORKFLOW_ENTRY_NOT_FOUND' | 'WORKFLOW_STEP_NOT_FOUND' | 'WORKFLOW_INVALID_TIMER' | 'WORKFLOW_BINDING_NOT_FOUND' | 'WORKFLOW_EXPRESSION_SCOPE' | 'WORKFLOW_NONDETERMINISTIC';
+    message: string;
+}
+/**
+ * The complete **runtime-boundary** admission check on a `WorkflowDef` — total over *any*
+ * value, including a hand-tampered `ServerIR` where `workflows`, `steps`, `inputs` or
+ * `bindings` are the wrong shape entirely (spec14pt3 §44-§49, spec14pt4 §11-§19, §31).
+ * `validateGraph` remains the authoring-time authority; this is what the authoritative
+ * runtime runs on a `ServerIR` it did not compile itself, so a structurally invalid or
+ * referentially inconsistent workflow fails closed with a structured result instead of
+ * reaching a native exception, a silently dropped binding or a permanently wedged
+ * `running` instance.
+ *
+ * It checks, in order (never traverse before proving shape):
+ *   1. container shape — `workflow` is an object; `steps` / `inputs` / `bindings` are arrays
+ *      of the right element shape;
+ *   2. step shape + control-flow edges (`entry` / `next` / `then` / `else` / `onError` /
+ *      `onTimeout` resolve; `action` / `event` targets present; timer / terminal shape);
+ *   3. reference integrity — a `wait-event` `bind` key is a declared `WorkflowBinding`; a
+ *      `WorkflowBinding.producedBy` resolves to a step; every workflow expression `ref`
+ *      resolves in that location's closed scope (inputs / bindings / `PRINCIPAL`, plus
+ *      `EVENT` only inside a `wait-event` `where` / `bind`); no `now` / `uuid` / `random`.
+ *
+ * Cross-node references (`ActionDef` / `EventDef` *existence in the graph*) stay a
+ * compile-time concern — a missing target id surfaces as a structured `UNKNOWN_SERVER_ACTION`
+ * refusal at invoke time, not a wedge.
+ */
+export declare function workflowStructuralProblems(workflow: unknown): WorkflowStructuralProblem[];
 /**
  * Step ids reachable from `entry` by control flow (spec14 §122). A step not in this set is
  * unreachable and an authoring mistake.

package/dist/workflows.js

@@ -25,11 +25,27 @@ export const WORKFLOW_STEP_TYPES = [
     'fail',
 ];
 // ---------------------------------------------------------------------------- accessors
+/**
+ * Whether a value is a structurally recognizable workflow step — an object with an `id` and
+ * one of the six {@link WORKFLOW_STEP_TYPES}. The accessors below are total over *any* input
+ * (a malformed graph, a hand-tampered Server IR) precisely so a bad step produces a
+ * structured diagnostic rather than a native `TypeError` (spec14pt3 F1 / F2 §39-§48).
+ */
+export function isWorkflowStep(step) {
+    return (!!step &&
+        typeof step === 'object' &&
+        !Array.isArray(step) &&
+        typeof step.id === 'string' &&
+        WORKFLOW_STEP_TYPES.includes(step.type));
+}
 export function workflowStepById(workflow, stepId) {
-    return workflow.steps.find((step) => String(step.id) === String(stepId));
+    const steps = Array.isArray(workflow?.steps) ? workflow.steps : [];
+    return steps.find((step) => !!step && typeof step === 'object' && String(step.id) === String(stepId));
 }
-/** Every step id a step can hand control to (control-flow successors). */
+/** Every step id a step can hand control to (control-flow successors). Total over bad input. */
 export function workflowStepSuccessors(step) {
+    if (!isWorkflowStep(step))
+        return [];
     switch (step.type) {
         case 'action':
             return step.onError ? [step.next, step.onError] : [step.next];
@@ -42,13 +58,17 @@ export function workflowStepSuccessors(step) {
         case 'complete':
         case 'fail':
             return [];
+        default:
+            return [];
     }
 }
 export function workflowIsTerminalStep(step) {
-    return step.type === 'complete' || step.type === 'fail';
+    return isWorkflowStep(step) && (step.type === 'complete' || step.type === 'fail');
 }
-/** Every `Expression` embedded in a step — the leaves dependency / scope analysis walks. */
+/** Every `Expression` embedded in a step — the leaves dependency / scope analysis walks. Total over bad input. */
 export function workflowStepExpressions(step) {
+    if (!isWorkflowStep(step))
+        return [];
     switch (step.type) {
         case 'action':
             return Object.values(step.arguments ?? {});
@@ -62,19 +82,261 @@ export function workflowStepExpressions(step) {
             return Object.values(step.output ?? {});
         case 'fail':
             return Object.values(step.error ?? {});
+        default:
+            return [];
     }
 }
 /** Every `Expression` in a workflow — inputs carry none, so this is the step leaves. */
 export function workflowExpressions(workflow) {
-    return workflow.steps.flatMap(workflowStepExpressions);
+    return (Array.isArray(workflow?.steps) ? workflow.steps : []).flatMap(workflowStepExpressions);
 }
 /** The `ActionDef` ids a workflow invokes. */
 export function workflowActionIds(workflow) {
-    return workflow.steps.filter((s) => s.type === 'action').map((s) => s.action);
+    return (Array.isArray(workflow?.steps) ? workflow.steps : [])
+        .filter((s) => isWorkflowStep(s) && s.type === 'action')
+        .map((s) => s.action);
 }
 /** The `EventDef` ids a workflow waits on. */
 export function workflowEventIds(workflow) {
-    return workflow.steps.filter((s) => s.type === 'wait-event').map((s) => s.event);
+    return (Array.isArray(workflow?.steps) ? workflow.steps : [])
+        .filter((s) => isWorkflowStep(s) && s.type === 'wait-event')
+        .map((s) => s.event);
+}
+// ----------------------------------------------------- canonical form for fingerprinting
+/**
+ * A `WorkflowDef` reduced to a form where **authoring order is not semantic** (spec14pt3
+ * §19, §64): `steps`, `inputs` and `bindings` are ordered by id. Control flow is by explicit
+ * `entry` / `next` / `then` / `else` / `onError` / `onTimeout` edges, never by array
+ * position, so two workflows that differ only in the order their steps were declared are the
+ * same executable meaning. Both the graph-level `semanticFingerprint` and the ServerIR-side
+ * authority-compatibility fingerprint pass workflows through this before hashing, so they
+ * agree (spec14pt3 §5 G1). Non-`id` fields are untouched; human metadata is stripped by the
+ * caller's projection exactly as elsewhere.
+ */
+export function canonicalWorkflowForFingerprint(workflow) {
+    // Total over a hand-tampered slice: a non-object workflow value is returned unchanged and
+    // the engine's admission validator refuses it structurally (spec14pt4 §31).
+    if (!workflow || typeof workflow !== 'object' || Array.isArray(workflow))
+        return workflow;
+    const byId = (list) => [...(list ?? [])].sort((a, b) => {
+        const ai = String(a?.id ?? '');
+        const bi = String(b?.id ?? '');
+        return ai < bi ? -1 : ai > bi ? 1 : 0;
+    });
+    return {
+        ...workflow,
+        ...(Array.isArray(workflow.steps) ? { steps: byId(workflow.steps) } : {}),
+        ...(Array.isArray(workflow.inputs) ? { inputs: byId(workflow.inputs) } : {}),
+        ...(Array.isArray(workflow.bindings) ? { bindings: byId(workflow.bindings) } : {}),
+    };
+}
+const WORKFLOW_NONDETERMINISTIC_BUILTINS = new Set(['now', 'uuid', 'random']);
+function isPlainObject(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+/**
+ * Walk an expression tree, total over arbitrary input, collecting every scope `ref` target
+ * id and every non-deterministic builtin call. `literal` node payloads are not recursed
+ * into (a literal object value that happens to look like a `ref` is data, not a reference).
+ */
+function walkExpression(expression, refs, nondeterministic, seen = new Set()) {
+    if (!isPlainObject(expression) || seen.has(expression))
+        return;
+    seen.add(expression);
+    if (expression.kind === 'ref' && expression.targetId !== undefined) {
+        refs.add(String(expression.targetId));
+    }
+    if (expression.kind === 'call' &&
+        typeof expression.function === 'string' &&
+        WORKFLOW_NONDETERMINISTIC_BUILTINS.has(expression.function)) {
+        nondeterministic.add(expression.function);
+    }
+    if (expression.kind === 'literal')
+        return;
+    for (const value of Object.values(expression)) {
+        if (Array.isArray(value)) {
+            for (const entry of value)
+                walkExpression(entry, refs, nondeterministic, seen);
+        }
+        else if (isPlainObject(value)) {
+            walkExpression(value, refs, nondeterministic, seen);
+        }
+    }
+}
+/**
+ * The complete **runtime-boundary** admission check on a `WorkflowDef` — total over *any*
+ * value, including a hand-tampered `ServerIR` where `workflows`, `steps`, `inputs` or
+ * `bindings` are the wrong shape entirely (spec14pt3 §44-§49, spec14pt4 §11-§19, §31).
+ * `validateGraph` remains the authoring-time authority; this is what the authoritative
+ * runtime runs on a `ServerIR` it did not compile itself, so a structurally invalid or
+ * referentially inconsistent workflow fails closed with a structured result instead of
+ * reaching a native exception, a silently dropped binding or a permanently wedged
+ * `running` instance.
+ *
+ * It checks, in order (never traverse before proving shape):
+ *   1. container shape — `workflow` is an object; `steps` / `inputs` / `bindings` are arrays
+ *      of the right element shape;
+ *   2. step shape + control-flow edges (`entry` / `next` / `then` / `else` / `onError` /
+ *      `onTimeout` resolve; `action` / `event` targets present; timer / terminal shape);
+ *   3. reference integrity — a `wait-event` `bind` key is a declared `WorkflowBinding`; a
+ *      `WorkflowBinding.producedBy` resolves to a step; every workflow expression `ref`
+ *      resolves in that location's closed scope (inputs / bindings / `PRINCIPAL`, plus
+ *      `EVENT` only inside a `wait-event` `where` / `bind`); no `now` / `uuid` / `random`.
+ *
+ * Cross-node references (`ActionDef` / `EventDef` *existence in the graph*) stay a
+ * compile-time concern — a missing target id surfaces as a structured `UNKNOWN_SERVER_ACTION`
+ * refusal at invoke time, not a wedge.
+ */
+export function workflowStructuralProblems(workflow) {
+    const problems = [];
+    const wid = isPlainObject(workflow) ? String(workflow.id ?? '<unknown>') : '<unknown>';
+    // 1. Container shape — before any traversal.
+    if (!isPlainObject(workflow)) {
+        return [{ code: 'WORKFLOW_INVALID_STEP', message: `Workflow ${wid} is not an object` }];
+    }
+    if (!Array.isArray(workflow.steps)) {
+        problems.push({ code: 'WORKFLOW_INVALID_STEP', message: `Workflow ${wid} steps is not an array` });
+    }
+    if (workflow.inputs !== undefined && !Array.isArray(workflow.inputs)) {
+        problems.push({ code: 'WORKFLOW_INVALID_STEP', message: `Workflow ${wid} inputs is not an array` });
+    }
+    if (workflow.bindings !== undefined && !Array.isArray(workflow.bindings)) {
+        problems.push({ code: 'WORKFLOW_INVALID_STEP', message: `Workflow ${wid} bindings is not an array` });
+    }
+    const steps = Array.isArray(workflow.steps) ? workflow.steps : [];
+    const rawInputs = Array.isArray(workflow.inputs) ? workflow.inputs : [];
+    const rawBindings = Array.isArray(workflow.bindings) ? workflow.bindings : [];
+    const inputIds = new Set();
+    for (const input of rawInputs) {
+        if (!isPlainObject(input) || typeof input.id !== 'string') {
+            problems.push({ code: 'WORKFLOW_INVALID_STEP', message: `Workflow ${wid} has an input that is not an object with a string id` });
+        }
+        else {
+            inputIds.add(input.id);
+        }
+    }
+    // 2. Steps.
+    const ids = new Set();
+    for (const step of steps) {
+        if (!isWorkflowStep(step)) {
+            problems.push({
+                code: 'WORKFLOW_INVALID_STEP',
+                message: `Workflow ${wid} has a step that is not an object with an id and a known kind`,
+            });
+            continue;
+        }
+        ids.add(String(step.id));
+    }
+    const bindingIds = new Set();
+    for (const binding of rawBindings) {
+        if (!isPlainObject(binding) || typeof binding.id !== 'string') {
+            problems.push({ code: 'WORKFLOW_INVALID_STEP', message: `Workflow ${wid} has a binding that is not an object with a string id` });
+            continue;
+        }
+        bindingIds.add(binding.id);
+        if (binding.producedBy === undefined || !ids.has(String(binding.producedBy))) {
+            problems.push({
+                code: 'WORKFLOW_STEP_NOT_FOUND',
+                message: `Workflow ${wid} binding ${binding.id} is producedBy ${String(binding.producedBy)}, which is not a step`,
+            });
+        }
+    }
+    if (workflow.entry === undefined || !ids.has(String(workflow.entry))) {
+        problems.push({
+            code: 'WORKFLOW_ENTRY_NOT_FOUND',
+            message: `Workflow ${wid} entry ${String(workflow.entry)} is not one of its steps`,
+        });
+    }
+    const edge = (target, from) => {
+        if (target !== undefined && !ids.has(String(target))) {
+            problems.push({
+                code: 'WORKFLOW_STEP_NOT_FOUND',
+                message: `Workflow ${wid} step ${from} points at ${String(target)}, which is not a step`,
+            });
+        }
+    };
+    const scopeCheck = (expression, from, eventInScope) => {
+        const refs = new Set();
+        const nondeterministic = new Set();
+        walkExpression(expression, refs, nondeterministic);
+        for (const id of refs) {
+            const ok = inputIds.has(id) ||
+                bindingIds.has(id) ||
+                id === WORKFLOW_PRINCIPAL_SCOPE ||
+                (eventInScope && id === WORKFLOW_EVENT_SCOPE);
+            if (!ok) {
+                problems.push({
+                    code: 'WORKFLOW_EXPRESSION_SCOPE',
+                    message: `Workflow ${wid} step ${from} references ${id}, which is not in scope (inputs / bindings${eventInScope ? ' / EVENT' : ''} / PRINCIPAL)`,
+                });
+            }
+        }
+        for (const fn of nondeterministic) {
+            problems.push({
+                code: 'WORKFLOW_NONDETERMINISTIC',
+                message: `Workflow ${wid} step ${from} calls ${fn}(), which is not deterministic and not allowed in a workflow expression`,
+            });
+        }
+    };
+    for (const step of steps) {
+        if (!isWorkflowStep(step))
+            continue;
+        const from = String(step.id);
+        switch (step.type) {
+            case 'action':
+                if (typeof step.action !== 'string') {
+                    problems.push({ code: 'WORKFLOW_INVALID_STEP', message: `Workflow ${wid} action step ${from} has no action target` });
+                }
+                edge(step.next, from);
+                edge(step.onError, from);
+                break;
+            case 'wait-event':
+                if (typeof step.event !== 'string') {
+                    problems.push({ code: 'WORKFLOW_INVALID_STEP', message: `Workflow ${wid} wait-event step ${from} has no event target` });
+                }
+                edge(step.next, from);
+                edge(step.onTimeout, from);
+                if (step.timeout !== undefined && !(Number(step.timeout?.seconds) > 0)) {
+                    problems.push({ code: 'WORKFLOW_INVALID_TIMER', message: `Workflow ${wid} wait-event step ${from} has a non-positive timeout` });
+                }
+                for (const bindingId of isPlainObject(step.bind) ? Object.keys(step.bind) : []) {
+                    if (!bindingIds.has(bindingId)) {
+                        problems.push({
+                            code: 'WORKFLOW_BINDING_NOT_FOUND',
+                            message: `Workflow ${wid} step ${from} binds ${bindingId}, which is not a declared WorkflowBinding`,
+                        });
+                    }
+                }
+                break;
+            case 'timer': {
+                const hasAfter = step.after !== undefined;
+                const hasAt = step.at !== undefined;
+                if (hasAfter === hasAt) {
+                    problems.push({ code: 'WORKFLOW_INVALID_TIMER', message: `Workflow ${wid} timer step ${from} must declare exactly one of after / at` });
+                }
+                else if (hasAfter && !(Number(step.after?.seconds) > 0)) {
+                    problems.push({ code: 'WORKFLOW_INVALID_TIMER', message: `Workflow ${wid} timer step ${from} has a non-positive after.seconds` });
+                }
+                edge(step.next, from);
+                break;
+            }
+            case 'branch':
+                if (step.when === undefined) {
+                    problems.push({ code: 'WORKFLOW_INVALID_STEP', message: `Workflow ${wid} branch step ${from} has no when expression` });
+                }
+                edge(step.then, from);
+                edge(step.else, from);
+                break;
+            case 'complete':
+            case 'fail':
+                break;
+        }
+        // 3. Expression reference / scope integrity (spec14pt4 §17, §18).
+        for (const expression of workflowStepExpressions(step)) {
+            scopeCheck(expression, from, step.type === 'wait-event');
+        }
+    }
+    return problems;
 }
 /**
  * Step ids reachable from `entry` by control flow (spec14 §122). A step not in this set is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cynodia/axiom-core",
-  "version": "0.14.0-alpha.1",
+  "version": "0.14.0-alpha.3",
   "description": "Application Graph, semantic types, locations and validation for Axiom.",
   "license": "MIT",
   "author": "AskTech AS",