@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/developer-agent/validation.js

@@ -0,0 +1,2617 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeveloperAgentContractValidationError = void 0;
+exports.validateDeveloperAgentContext = validateDeveloperAgentContext;
+exports.validateDeveloperAgentGeneratorPreview = validateDeveloperAgentGeneratorPreview;
+exports.validateDeveloperAgentGeneratorPreviewReceipt = validateDeveloperAgentGeneratorPreviewReceipt;
+exports.validateDeveloperAgentPlan = validateDeveloperAgentPlan;
+exports.validateDeveloperAgentResult = validateDeveloperAgentResult;
+exports.validateDeveloperAgentHandoff = validateDeveloperAgentHandoff;
+exports.serializeDeveloperAgentContext = serializeDeveloperAgentContext;
+exports.serializeDeveloperAgentGeneratorPreview = serializeDeveloperAgentGeneratorPreview;
+exports.serializeDeveloperAgentGeneratorPreviewReceipt = serializeDeveloperAgentGeneratorPreviewReceipt;
+exports.serializeDeveloperAgentPlan = serializeDeveloperAgentPlan;
+exports.serializeDeveloperAgentResult = serializeDeveloperAgentResult;
+exports.serializeDeveloperAgentHandoff = serializeDeveloperAgentHandoff;
+const node_crypto_1 = require("node:crypto");
+const node_util_1 = require("node:util");
+const canonical_json_1 = require("@empire-builder-kit/runtime/canonical-json");
+const safe_reference_1 = require("@empire-builder-kit/runtime/safe-reference");
+const index_js_1 = require("../testing-evidence/index.js");
+const validation_js_1 = require("../validation.js");
+const model_js_1 = require("./model.js");
+const ordering_js_1 = require("./ordering.js");
+const workspace_path_js_1 = require("./workspace-path.js");
+const MAX_COLLECTION_ITEMS = 256;
+const MAX_AFFECTED_FILE_REFERENCES = 128;
+const MAX_CONCURRENT_PATHS = 2_048;
+const MAX_GENERATED_SURFACES = 512;
+const MAX_RESULTS = 16;
+const MAX_COMMAND_ARGUMENTS = 64;
+const MAX_IDENTIFIER_LENGTH = (0, safe_reference_1.safeReferenceMaximumLength)('supply-chain');
+const MAX_PATH_LENGTH = 1024;
+const MAX_SUMMARY_LENGTH = 1024;
+const MAX_INPUT_VALUE_LENGTH = 512;
+const COMMIT_PATTERN = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
+const SHA256_DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/;
+const GENERATOR_PREVIEW_CHANGE_SET = new Set(['create', 'delete', 'update']);
+const IDENTIFIER_PATTERN = new RegExp((0, safe_reference_1.safeReferencePatternSource)('supply-chain'));
+const FIELD_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9._-]*$/;
+const WORKSPACE_RELATIVE_PATH_PATTERN = /^(?![\\/])(?![A-Za-z]:[\\/])(?!.*(?:^|[\\/])\.\.(?:[\\/]|$)).+$/;
+const GENERATOR_PREVIEW_REFERENCE_PATTERN = /^\.ebk\/agent\/previews\/[a-z][a-z0-9-]{0,62}\.json$/;
+const GENERATOR_SLUG_PATTERN = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+const AUTHORITY_SET = new Set(model_js_1.DEVELOPER_AGENT_AUTHORITY_CLASSES);
+const CANONICAL_STAGE_SET = new Set(model_js_1.DEVELOPER_AGENT_CANONICAL_STAGES);
+const FAILURE_SET = new Set(model_js_1.DEVELOPER_AGENT_FAILURE_CLASSIFICATIONS);
+const RESULT_OUTCOME_SET = new Set(model_js_1.DEVELOPER_AGENT_RESULT_OUTCOMES);
+const HANDOFF_STATE_SET = new Set(model_js_1.DEVELOPER_AGENT_HANDOFF_STATES);
+const PRIVACY_CLASS_SET = new Set(model_js_1.DEVELOPER_AGENT_ARTIFACT_PRIVACY_CLASSES);
+const CLEANUP_RECOVERY_SET = new Set(model_js_1.DEVELOPER_AGENT_CLEANUP_RECOVERY_OUTCOMES);
+const OWNERSHIP_MODE_SET = new Set(model_js_1.DEVELOPER_AGENT_OWNERSHIP_MODES);
+const CONTRACT_CLASS_SET = new Set(model_js_1.DEVELOPER_AGENT_CONTRACT_CLASSES);
+const RISK_CLASS_SET = new Set(model_js_1.DEVELOPER_AGENT_RISK_CLASSES);
+const OPERATION_OWNER_SET = new Set(model_js_1.DEVELOPER_AGENT_OPERATION_OWNERS);
+const POLICY_LIFECYCLE_ACTION_SET = new Set(model_js_1.DEVELOPER_AGENT_POLICY_LIFECYCLE_ACTIONS);
+const STABLE_GENERATOR_SET = new Set(model_js_1.DEVELOPER_AGENT_STABLE_GENERATORS);
+const GENERATOR_MODE_SET = new Set(model_js_1.DEVELOPER_AGENT_GENERATOR_MODES);
+const PRODUCTION_PROFILE_SET = new Set(['cost-optimized', 'standard']);
+const BLOCKING_FAILURES = new Set([
+    'unsupported-operation',
+    'invalid-input',
+    'dirty-worktree',
+    'stale-base',
+    'ownership-conflict',
+    'generated-drift',
+    'policy-conflict',
+    'marker-blocked',
+    'authority-required',
+    'prerequisite-missing',
+]);
+const FAILED_FAILURES = new Set([
+    'verification-failed',
+    'cleanup-incomplete',
+    'tool-internal-error',
+]);
+class DeveloperAgentContractValidationError extends Error {
+    issues;
+    constructor(label, issues) {
+        super(`${label} is invalid: ${issues
+            .slice(0, 3)
+            .map(({ message, path }) => `${path} ${message}`)
+            .join('; ')}`);
+        this.name = 'DeveloperAgentContractValidationError';
+        this.issues = issues;
+    }
+}
+exports.DeveloperAgentContractValidationError = DeveloperAgentContractValidationError;
+function addIssue(issues, path, message) {
+    issues.push({ message, path });
+}
+function has(value, property) {
+    return Object.prototype.hasOwnProperty.call(value, property);
+}
+function requireRecord(value, path, required, optional, issues) {
+    if (!(0, validation_js_1.isRecord)(value)) {
+        addIssue(issues, path, 'must be an object');
+        return undefined;
+    }
+    const allowed = new Set([...required, ...optional]);
+    for (const property of Object.keys(value)) {
+        if (!allowed.has(property)) {
+            addIssue(issues, `${path}.*`, 'is not an allowlisted property');
+        }
+    }
+    for (const property of required) {
+        if (!has(value, property)) {
+            addIssue(issues, `${path}.${property}`, 'is required');
+        }
+    }
+    return value;
+}
+function requireSafeString(value, path, issues, options = {}) {
+    if (typeof value !== 'string' ||
+        value.length === 0 ||
+        value !== value.trim()) {
+        addIssue(issues, path, 'must be a non-empty trimmed string');
+        return false;
+    }
+    if (value.length > (options.maximumLength ?? MAX_IDENTIFIER_LENGTH)) {
+        addIssue(issues, path, `must contain at most ${options.maximumLength ?? MAX_IDENTIFIER_LENGTH} characters`);
+        return false;
+    }
+    for (const character of value) {
+        const codePoint = character.codePointAt(0) ?? 0;
+        if (codePoint <= 31 ||
+            (codePoint >= 127 && codePoint <= 159) ||
+            codePoint === 0x2028 ||
+            codePoint === 0x2029) {
+            addIssue(issues, path, 'must not contain unsafe control characters');
+            return false;
+        }
+    }
+    if (options.pattern && !options.pattern.test(value)) {
+        addIssue(issues, path, 'has an unsupported format');
+        return false;
+    }
+    const inspection = (0, index_js_1.inspectTestingEvidenceText)(value);
+    if (!inspection.safe) {
+        addIssue(issues, path, 'must not contain protected data');
+        return false;
+    }
+    return true;
+}
+function requireBoolean(value, path, issues) {
+    if (typeof value !== 'boolean') {
+        addIssue(issues, path, 'must be a boolean');
+        return false;
+    }
+    return true;
+}
+function requireInteger(value, path, issues, minimum = 0, maximum = Number.MAX_SAFE_INTEGER) {
+    if (typeof value !== 'number' ||
+        !Number.isSafeInteger(value) ||
+        value < minimum ||
+        value > maximum) {
+        addIssue(issues, path, `must be an integer from ${minimum} through ${maximum}`);
+        return false;
+    }
+    return true;
+}
+function requireEnum(value, path, allowed, issues) {
+    if (typeof value !== 'string' || !allowed.has(value)) {
+        addIssue(issues, path, `must equal one of ${[...allowed].join(', ')}`);
+        return false;
+    }
+    return true;
+}
+function requireArray(value, path, issues, maximumItems = MAX_COLLECTION_ITEMS) {
+    if (!Array.isArray(value)) {
+        addIssue(issues, path, 'must be an array');
+        return undefined;
+    }
+    if (value.length > maximumItems) {
+        addIssue(issues, path, `must contain at most ${maximumItems} items`);
+    }
+    return value;
+}
+function validateStringArray(value, path, issues, options = {}) {
+    const entries = requireArray(value, path, issues, options.maximumItems ?? MAX_COLLECTION_ITEMS);
+    if (!entries)
+        return false;
+    const seen = new Set();
+    entries.forEach((entry, index) => {
+        if (requireSafeString(entry, `${path}[${index}]`, issues, {
+            maximumLength: options.maximumLength,
+            pattern: options.pattern,
+        }) &&
+            options.unique !== false) {
+            if (seen.has(entry)) {
+                addIssue(issues, `${path}[${index}]`, 'must not duplicate another item');
+            }
+            seen.add(entry);
+        }
+    });
+    return entries.every((entry) => typeof entry === 'string');
+}
+function validateVersionRecord(value, path, issues) {
+    const record = requireRecord(value, path, ['name', 'version'], [], issues);
+    if (!record)
+        return false;
+    requireSafeString(record.name, `${path}.name`, issues, {
+        pattern: IDENTIFIER_PATTERN,
+    });
+    requireSafeString(record.version, `${path}.version`, issues);
+    return true;
+}
+function validateVersionRecords(value, path, issues) {
+    const entries = requireArray(value, path, issues);
+    if (!entries)
+        return false;
+    const names = new Set();
+    entries.forEach((entry, index) => {
+        if (validateVersionRecord(entry, `${path}[${index}]`, issues)) {
+            const name = entry.name;
+            if (names.has(name)) {
+                addIssue(issues, `${path}[${index}].name`, 'must be unique');
+            }
+            names.add(name);
+        }
+    });
+    return true;
+}
+function validateCandidateProvenance(value, path, issues) {
+    const record = requireRecord(value, path, ['reference'], ['digest'], issues);
+    if (!record)
+        return false;
+    requireSafeString(record.reference, `${path}.reference`, issues, {
+        maximumLength: MAX_PATH_LENGTH,
+    });
+    if (has(record, 'digest')) {
+        requireSafeString(record.digest, `${path}.digest`, issues, {
+            maximumLength: 71,
+            pattern: SHA256_DIGEST_PATTERN,
+        });
+    }
+    return true;
+}
+function validateCommand(value, path, issues) {
+    const record = requireRecord(value, path, ['args', 'executable'], ['cwd'], issues);
+    if (!record)
+        return false;
+    requireSafeString(record.executable, `${path}.executable`, issues, {
+        maximumLength: MAX_PATH_LENGTH,
+    });
+    validateStringArray(record.args, `${path}.args`, issues, {
+        maximumItems: MAX_COMMAND_ARGUMENTS,
+        maximumLength: MAX_INPUT_VALUE_LENGTH,
+        unique: false,
+    });
+    if (has(record, 'cwd')) {
+        requireSafeString(record.cwd, `${path}.cwd`, issues, {
+            maximumLength: MAX_PATH_LENGTH,
+        });
+    }
+    return true;
+}
+function validateNextSafeAction(value, path, issues) {
+    const record = requireRecord(value, path, ['approvalRequired', 'authority', 'description'], ['command', 'operationId', 'owner'], issues);
+    if (!record)
+        return false;
+    requireBoolean(record.approvalRequired, `${path}.approvalRequired`, issues);
+    requireEnum(record.authority, `${path}.authority`, AUTHORITY_SET, issues);
+    requireSafeString(record.description, `${path}.description`, issues, {
+        maximumLength: MAX_SUMMARY_LENGTH,
+    });
+    if (has(record, 'command')) {
+        validateCommand(record.command, `${path}.command`, issues);
+    }
+    if (has(record, 'operationId')) {
+        requireSafeString(record.operationId, `${path}.operationId`, issues, {
+            maximumLength: MAX_IDENTIFIER_LENGTH,
+            pattern: IDENTIFIER_PATTERN,
+        });
+    }
+    if (has(record, 'owner')) {
+        requireEnum(record.owner, `${path}.owner`, OPERATION_OWNER_SET, issues);
+    }
+    if (has(record, 'operationId') !== has(record, 'owner')) {
+        addIssue(issues, path, 'operationId and owner must be retained together');
+    }
+    if ((record.authority === 'protected-mutate' ||
+        record.authority === 'destructive') &&
+        record.approvalRequired !== true) {
+        addIssue(issues, `${path}.approvalRequired`, 'must be true for protected or destructive action');
+    }
+    return true;
+}
+function validateCleanupRecovery(value, path, issues) {
+    const record = requireRecord(value, path, ['outcome'], ['owner', 'sanitizedSummary'], issues);
+    if (!record)
+        return false;
+    requireEnum(record.outcome, `${path}.outcome`, CLEANUP_RECOVERY_SET, issues);
+    if (has(record, 'owner')) {
+        requireSafeString(record.owner, `${path}.owner`, issues);
+    }
+    if (has(record, 'sanitizedSummary')) {
+        requireSafeString(record.sanitizedSummary, `${path}.sanitizedSummary`, issues, { maximumLength: MAX_SUMMARY_LENGTH });
+    }
+    if (record.outcome === 'incomplete' && !has(record, 'sanitizedSummary')) {
+        addIssue(issues, path, 'must include a sanitized summary when incomplete');
+    }
+    return true;
+}
+function validateArtifact(value, path, issues) {
+    const record = requireRecord(value, path, ['digest', 'evidenceClass', 'name', 'privacyClass', 'reference'], [], issues);
+    if (!record)
+        return false;
+    requireSafeString(record.digest, `${path}.digest`, issues, {
+        maximumLength: 71,
+        pattern: SHA256_DIGEST_PATTERN,
+    });
+    requireSafeString(record.evidenceClass, `${path}.evidenceClass`, issues, {
+        maximumLength: MAX_IDENTIFIER_LENGTH,
+        pattern: IDENTIFIER_PATTERN,
+    });
+    requireSafeString(record.name, `${path}.name`, issues, {
+        maximumLength: MAX_PATH_LENGTH,
+    });
+    validateCanonicalWorkspacePath(record.reference, `${path}.reference`, issues);
+    requireEnum(record.privacyClass, `${path}.privacyClass`, PRIVACY_CLASS_SET, issues);
+    return true;
+}
+function validateArtifacts(value, path, issues) {
+    const entries = requireArray(value, path, issues);
+    if (!entries)
+        return false;
+    const names = new Set();
+    entries.forEach((entry, index) => {
+        if (validateArtifact(entry, `${path}[${index}]`, issues)) {
+            const name = entry.name;
+            if (names.has(name)) {
+                addIssue(issues, `${path}[${index}].name`, 'must be unique');
+            }
+            names.add(name);
+        }
+    });
+    return true;
+}
+function validateContractReference(value, path, issues) {
+    const record = requireRecord(value, path, ['class', 'reference'], [], issues);
+    if (!record)
+        return false;
+    requireEnum(record.class, `${path}.class`, CONTRACT_CLASS_SET, issues);
+    requireSafeString(record.reference, `${path}.reference`, issues, {
+        maximumLength: MAX_PATH_LENGTH,
+    });
+    return true;
+}
+function validateContractReferences(value, path, issues) {
+    const entries = requireArray(value, path, issues);
+    if (!entries)
+        return false;
+    const identities = new Set();
+    entries.forEach((entry, index) => {
+        if (validateContractReference(entry, `${path}[${index}]`, issues)) {
+            const contract = entry;
+            const identity = `${contract.class}:${contract.reference}`;
+            if (identities.has(identity)) {
+                addIssue(issues, `${path}[${index}]`, 'must be unique');
+            }
+            identities.add(identity);
+        }
+    });
+    return true;
+}
+function validateWorkspaceContext(value, path, issues) {
+    const record = requireRecord(value, path, [
+        'blueprintVersions',
+        'frameworkVersion',
+        'identity',
+        'ownershipVersions',
+        'ownershipAgreement',
+        'repositoryRoot',
+    ], ['candidateProvenance'], issues);
+    if (!record)
+        return false;
+    validateVersionRecords(record.blueprintVersions, `${path}.blueprintVersions`, issues);
+    requireSafeString(record.frameworkVersion, `${path}.frameworkVersion`, issues);
+    requireSafeString(record.identity, `${path}.identity`, issues, {
+        pattern: IDENTIFIER_PATTERN,
+    });
+    validateOwnershipVersionStates(record.ownershipVersions, `${path}.ownershipVersions`, issues);
+    requireEnum(record.ownershipAgreement, `${path}.ownershipAgreement`, new Set(['agrees', 'conflict', 'unavailable']), issues);
+    requireSafeString(record.repositoryRoot, `${path}.repositoryRoot`, issues, {
+        maximumLength: MAX_PATH_LENGTH,
+    });
+    if (has(record, 'candidateProvenance')) {
+        validateCandidateProvenance(record.candidateProvenance, `${path}.candidateProvenance`, issues);
+    }
+    return true;
+}
+function validateOwnershipVersionState(value, path, issues) {
+    const record = requireRecord(value, path, ['kind', 'target'], [
+        'blueprintName',
+        'installedBlueprintVersion',
+        'installedFrameworkVersion',
+        'recordedBlueprintVersion',
+        'recordedFrameworkVersion',
+    ], issues);
+    if (!record)
+        return false;
+    requireEnum(record.kind, `${path}.kind`, new Set(['foundation', 'slice', 'workspace']), issues);
+    requireSafeString(record.target, `${path}.target`, issues, {
+        pattern: IDENTIFIER_PATTERN,
+    });
+    for (const field of [
+        'blueprintName',
+        'installedBlueprintVersion',
+        'installedFrameworkVersion',
+        'recordedBlueprintVersion',
+        'recordedFrameworkVersion',
+    ]) {
+        if (has(record, field)) {
+            requireSafeString(record[field], `${path}.${field}`, issues);
+        }
+    }
+    const kind = record.kind;
+    if ((kind === 'workspace' || kind === 'foundation') &&
+        record.target !== kind) {
+        addIssue(issues, `${path}.target`, `must equal ${kind}`);
+    }
+    if (kind === 'slice') {
+        for (const field of ['blueprintName', 'recordedBlueprintVersion']) {
+            if (!has(record, field)) {
+                addIssue(issues, `${path}.${field}`, 'is required for a Slice');
+            }
+        }
+    }
+    else {
+        if (!has(record, 'recordedFrameworkVersion')) {
+            addIssue(issues, `${path}.recordedFrameworkVersion`, `is required for ${String(kind)} ownership`);
+        }
+        for (const field of [
+            'blueprintName',
+            'installedBlueprintVersion',
+            'recordedBlueprintVersion',
+        ]) {
+            if (has(record, field)) {
+                addIssue(issues, `${path}.${field}`, 'is accepted only for Slice ownership');
+            }
+        }
+    }
+    return true;
+}
+function validateOwnershipVersionStates(value, path, issues) {
+    const entries = requireArray(value, path, issues, MAX_COLLECTION_ITEMS);
+    if (!entries)
+        return false;
+    const targets = new Set();
+    let previousTarget;
+    entries.forEach((entry, index) => {
+        if (validateOwnershipVersionState(entry, `${path}[${index}]`, issues)) {
+            if (targets.has(entry.target)) {
+                addIssue(issues, `${path}[${index}].target`, 'must be unique');
+            }
+            if (previousTarget !== undefined &&
+                (0, ordering_js_1.compareDeveloperAgentStrings)(previousTarget, entry.target) >= 0) {
+                addIssue(issues, `${path}[${index}].target`, 'must be in ascending canonical order');
+            }
+            targets.add(entry.target);
+            previousTarget = entry.target;
+        }
+    });
+    return true;
+}
+function validateGitContext(value, path, issues) {
+    const record = requireRecord(value, path, [
+        'ahead',
+        'behind',
+        'commit',
+        'concurrentChangeInspectionComplete',
+        'concurrentChanges',
+        'defaultBaseCommit',
+        'defaultBaseRef',
+        'dirty',
+        'worktreeRoot',
+    ], ['baseCommit', 'branch', 'headCommit', 'upstream'], issues);
+    if (!record)
+        return false;
+    requireInteger(record.ahead, `${path}.ahead`, issues, 0, 1_000_000);
+    requireInteger(record.behind, `${path}.behind`, issues, 0, 1_000_000);
+    requireSafeString(record.commit, `${path}.commit`, issues, {
+        maximumLength: 64,
+        pattern: COMMIT_PATTERN,
+    });
+    requireBoolean(record.concurrentChangeInspectionComplete, `${path}.concurrentChangeInspectionComplete`, issues);
+    const concurrentChanges = requireArray(record.concurrentChanges, `${path}.concurrentChanges`, issues, MAX_CONCURRENT_PATHS);
+    const concurrentPaths = new Set();
+    let previousConcurrentPath;
+    concurrentChanges?.forEach((entry, index) => {
+        const entryPath = `${path}.concurrentChanges[${index}]`;
+        const concurrent = requireRecord(entry, entryPath, ['committed', 'dirty', 'path', 'worktreeCount'], [], issues);
+        if (!concurrent)
+            return;
+        const committedValid = requireBoolean(concurrent.committed, `${entryPath}.committed`, issues);
+        const dirtyValid = requireBoolean(concurrent.dirty, `${entryPath}.dirty`, issues);
+        if (committedValid &&
+            dirtyValid &&
+            concurrent.committed === false &&
+            concurrent.dirty === false) {
+            addIssue(issues, entryPath, 'must identify a dirty or committed concurrent change');
+        }
+        if (validateCanonicalWorkspacePath(concurrent.path, `${entryPath}.path`, issues)) {
+            const change = concurrent;
+            const collisionKey = change.path
+                .normalize('NFC')
+                .toLocaleLowerCase('en-US');
+            if (concurrentPaths.has(collisionKey)) {
+                addIssue(issues, `${entryPath}.path`, 'must not duplicate or case-alias another concurrent path');
+            }
+            if (previousConcurrentPath !== undefined &&
+                previousConcurrentPath >= collisionKey) {
+                addIssue(issues, `${entryPath}.path`, 'must be in ascending canonical order');
+            }
+            concurrentPaths.add(collisionKey);
+            previousConcurrentPath = collisionKey;
+        }
+        requireInteger(concurrent.worktreeCount, `${entryPath}.worktreeCount`, issues, 1, 64);
+    });
+    requireSafeString(record.defaultBaseCommit, `${path}.defaultBaseCommit`, issues, {
+        maximumLength: 64,
+        pattern: COMMIT_PATTERN,
+    });
+    requireSafeString(record.defaultBaseRef, `${path}.defaultBaseRef`, issues, {
+        maximumLength: MAX_PATH_LENGTH,
+    });
+    requireBoolean(record.dirty, `${path}.dirty`, issues);
+    requireSafeString(record.worktreeRoot, `${path}.worktreeRoot`, issues, {
+        maximumLength: MAX_PATH_LENGTH,
+    });
+    for (const property of ['baseCommit', 'headCommit']) {
+        if (has(record, property)) {
+            requireSafeString(record[property], `${path}.${property}`, issues, {
+                maximumLength: 64,
+                pattern: COMMIT_PATTERN,
+            });
+        }
+    }
+    for (const property of ['branch', 'upstream']) {
+        if (has(record, property)) {
+            requireSafeString(record[property], `${path}.${property}`, issues, {
+                maximumLength: MAX_PATH_LENGTH,
+            });
+        }
+    }
+    return true;
+}
+function validatePolicyField(value, path, issues) {
+    const record = requireRecord(value, path, ['name', 'value'], [], issues);
+    if (!record)
+        return false;
+    requireSafeString(record.name, `${path}.name`, issues, {
+        pattern: FIELD_NAME_PATTERN,
+    });
+    requireSafeString(record.value, `${path}.value`, issues, {
+        maximumLength: MAX_INPUT_VALUE_LENGTH,
+    });
+    return true;
+}
+function validateEffectivePolicyDecision(value, path, issues) {
+    const record = requireRecord(value, path, ['action', 'allowed', 'projects', 'reasons', 'stage'], ['effectiveProductionProfile'], issues);
+    if (!record)
+        return false;
+    requireEnum(record.action, `${path}.action`, POLICY_LIFECYCLE_ACTION_SET, issues);
+    requireBoolean(record.allowed, `${path}.allowed`, issues);
+    validateStringArray(record.projects, `${path}.projects`, issues, {
+        pattern: IDENTIFIER_PATTERN,
+    });
+    validateStringArray(record.reasons, `${path}.reasons`, issues, {
+        maximumLength: MAX_SUMMARY_LENGTH,
+    });
+    requireEnum(record.stage, `${path}.stage`, CANONICAL_STAGE_SET, issues);
+    if (has(record, 'effectiveProductionProfile')) {
+        requireEnum(record.effectiveProductionProfile, `${path}.effectiveProductionProfile`, PRODUCTION_PROFILE_SET, issues);
+    }
+    if (record.allowed === true &&
+        Array.isArray(record.reasons) &&
+        record.reasons.length > 0) {
+        addIssue(issues, `${path}.reasons`, 'must be empty when allowed is true');
+    }
+    if (record.allowed === false &&
+        Array.isArray(record.reasons) &&
+        record.reasons.length === 0) {
+        addIssue(issues, `${path}.reasons`, 'must explain a denied decision');
+    }
+    return true;
+}
+function validatePolicyContext(value, path, issues) {
+    const record = requireRecord(value, path, [
+        'canonicalStage',
+        'effectiveDecisions',
+        'effectivePolicyDigest',
+        'effectivePolicyReferences',
+        'repositoryPolicyFields',
+    ], [], issues);
+    if (!record)
+        return false;
+    requireEnum(record.canonicalStage, `${path}.canonicalStage`, CANONICAL_STAGE_SET, issues);
+    const decisions = requireArray(record.effectiveDecisions, `${path}.effectiveDecisions`, issues);
+    const decisionKeys = new Set();
+    decisions?.forEach((entry, index) => {
+        if (validateEffectivePolicyDecision(entry, `${path}.effectiveDecisions[${index}]`, issues)) {
+            const decision = entry;
+            const key = `${decision.stage}:${decision.action}:${decision.projects.join(',')}`;
+            if (decisionKeys.has(key)) {
+                addIssue(issues, `${path}.effectiveDecisions[${index}]`, 'must not duplicate another stage/action decision');
+            }
+            decisionKeys.add(key);
+            if (decision.stage !== record.canonicalStage) {
+                addIssue(issues, `${path}.effectiveDecisions[${index}].stage`, 'must equal the canonical stage');
+            }
+        }
+    });
+    requireSafeString(record.effectivePolicyDigest, `${path}.effectivePolicyDigest`, issues, {
+        maximumLength: 71,
+        pattern: SHA256_DIGEST_PATTERN,
+    });
+    validateStringArray(record.effectivePolicyReferences, `${path}.effectivePolicyReferences`, issues, { maximumLength: MAX_PATH_LENGTH });
+    const fields = requireArray(record.repositoryPolicyFields, `${path}.repositoryPolicyFields`, issues);
+    if (fields) {
+        const names = new Set();
+        fields.forEach((entry, index) => {
+            if (validatePolicyField(entry, `${path}.repositoryPolicyFields[${index}]`, issues)) {
+                const name = entry.name;
+                if (names.has(name)) {
+                    addIssue(issues, `${path}.repositoryPolicyFields[${index}].name`, 'must be unique');
+                }
+                names.add(name);
+            }
+        });
+    }
+    return true;
+}
+function validateProjectContext(value, path, issues) {
+    const record = requireRecord(value, path, ['dependencies', 'name', 'root', 'tags', 'targets'], [], issues);
+    if (!record)
+        return false;
+    validateStringArray(record.dependencies, `${path}.dependencies`, issues, {
+        pattern: IDENTIFIER_PATTERN,
+    });
+    requireSafeString(record.name, `${path}.name`, issues, {
+        pattern: IDENTIFIER_PATTERN,
+    });
+    requireSafeString(record.root, `${path}.root`, issues, {
+        maximumLength: MAX_PATH_LENGTH,
+    });
+    validateStringArray(record.tags, `${path}.tags`, issues, {
+        pattern: IDENTIFIER_PATTERN,
+    });
+    validateStringArray(record.targets, `${path}.targets`, issues, {
+        pattern: IDENTIFIER_PATTERN,
+    });
+    return true;
+}
+function validateProjectContexts(value, path, issues) {
+    const entries = requireArray(value, path, issues);
+    if (!entries)
+        return false;
+    const names = new Set();
+    entries.forEach((entry, index) => {
+        if (validateProjectContext(entry, `${path}[${index}]`, issues)) {
+            const name = entry.name;
+            if (names.has(name)) {
+                addIssue(issues, `${path}[${index}].name`, 'must be unique');
+            }
+            names.add(name);
+        }
+    });
+    return true;
+}
+function validateSelectionContext(value, path, issues) {
+    const record = requireRecord(value, path, ['contracts', 'foundationCapabilities', 'projectInventory'], ['feature', 'files', 'slice'], issues);
+    if (!record)
+        return false;
+    validateContractReferences(record.contracts, `${path}.contracts`, issues);
+    validateStringArray(record.foundationCapabilities, `${path}.foundationCapabilities`, issues, { pattern: IDENTIFIER_PATTERN });
+    requireEnum(record.projectInventory, `${path}.projectInventory`, new Set(['bounded', 'full']), issues);
+    for (const property of ['feature', 'slice']) {
+        if (has(record, property)) {
+            requireSafeString(record[property], `${path}.${property}`, issues, {
+                pattern: IDENTIFIER_PATTERN,
+            });
+        }
+    }
+    if (has(record, 'files')) {
+        const files = requireArray(record.files, `${path}.files`, issues);
+        const paths = new Set();
+        files?.forEach((entry, index) => {
+            if (validateSelectedFileContext(entry, `${path}.files[${index}]`, issues)) {
+                const selected = entry;
+                if (paths.has(selected.path)) {
+                    addIssue(issues, `${path}.files[${index}].path`, 'must not duplicate another selected file');
+                }
+                paths.add(selected.path);
+            }
+        });
+    }
+    return true;
+}
+function validateSelectedFileContext(value, path, issues) {
+    const record = requireRecord(value, path, ['ownershipMode', 'path', 'project'], [], issues);
+    if (!record)
+        return false;
+    requireEnum(record.ownershipMode, `${path}.ownershipMode`, OWNERSHIP_MODE_SET, issues);
+    validateCanonicalWorkspacePath(record.path, `${path}.path`, issues);
+    requireSafeString(record.project, `${path}.project`, issues, {
+        pattern: IDENTIFIER_PATTERN,
+    });
+    return true;
+}
+function validateCanonicalWorkspacePath(value, path, issues) {
+    const valid = requireSafeString(value, path, issues, {
+        maximumLength: MAX_PATH_LENGTH,
+        pattern: WORKSPACE_RELATIVE_PATH_PATTERN,
+    });
+    if (valid && !(0, workspace_path_js_1.isCanonicalDeveloperAgentWorkspacePath)(value)) {
+        addIssue(issues, path, 'must be a canonical relative path');
+    }
+    return valid;
+}
+function validateAffectedContext(value, path, issues) {
+    const record = requireRecord(value, path, [
+        'baseCommit',
+        'fileCount',
+        'files',
+        'filesDigest',
+        'filesTruncated',
+        'headCommit',
+        'projects',
+        'targets',
+    ], [], issues);
+    if (!record)
+        return false;
+    for (const property of ['baseCommit', 'headCommit']) {
+        requireSafeString(record[property], `${path}.${property}`, issues, {
+            maximumLength: 64,
+            pattern: COMMIT_PATTERN,
+        });
+    }
+    const fileCountValid = requireInteger(record.fileCount, `${path}.fileCount`, issues, 0, MAX_CONCURRENT_PATHS);
+    const files = requireArray(record.files, `${path}.files`, issues, MAX_AFFECTED_FILE_REFERENCES);
+    const fileKeys = new Set();
+    let previousFileKey;
+    files?.forEach((entry, index) => {
+        if (validateCanonicalWorkspacePath(entry, `${path}.files[${index}]`, issues)) {
+            const file = entry;
+            const key = file.normalize('NFC').toLocaleLowerCase('en-US');
+            if (fileKeys.has(key)) {
+                addIssue(issues, `${path}.files[${index}]`, 'must not duplicate or case-alias another affected path');
+            }
+            if (previousFileKey !== undefined && previousFileKey >= key) {
+                addIssue(issues, `${path}.files[${index}]`, 'must be in ascending canonical order');
+            }
+            fileKeys.add(key);
+            previousFileKey = key;
+        }
+    });
+    requireSafeString(record.filesDigest, `${path}.filesDigest`, issues, {
+        maximumLength: 71,
+        pattern: SHA256_DIGEST_PATTERN,
+    });
+    const truncatedValid = requireBoolean(record.filesTruncated, `${path}.filesTruncated`, issues);
+    if (fileCountValid && truncatedValid && files) {
+        const fileCount = record.fileCount;
+        if ((record.filesTruncated === false && fileCount !== files.length) ||
+            (record.filesTruncated === true &&
+                (files.length !== MAX_AFFECTED_FILE_REFERENCES ||
+                    fileCount <= files.length))) {
+            addIssue(issues, path, 'must retain an exact file count and an honest bounded-file truncation state');
+        }
+        if (record.filesTruncated === false &&
+            files.every((entry) => typeof entry === 'string') &&
+            record.filesDigest !==
+                `sha256:${(0, node_crypto_1.createHash)('sha256')
+                    .update(JSON.stringify(files), 'utf8')
+                    .digest('hex')}`) {
+            addIssue(issues, `${path}.filesDigest`, 'must bind the complete retained affected-path set');
+        }
+    }
+    validateStringArray(record.projects, `${path}.projects`, issues, {
+        pattern: IDENTIFIER_PATTERN,
+    });
+    validateStringArray(record.targets, `${path}.targets`, issues, {
+        pattern: IDENTIFIER_PATTERN,
+    });
+    return true;
+}
+function validateMarkerContext(value, path, issues) {
+    const record = requireRecord(value, path, ['blocking', 'path', 'reference', 'sanitizedSummary'], [], issues);
+    if (!record)
+        return false;
+    requireBoolean(record.blocking, `${path}.blocking`, issues);
+    validateCanonicalWorkspacePath(record.path, `${path}.path`, issues);
+    requireSafeString(record.reference, `${path}.reference`, issues);
+    requireSafeString(record.sanitizedSummary, `${path}.sanitizedSummary`, issues, { maximumLength: MAX_SUMMARY_LENGTH });
+    return true;
+}
+function validateReportContext(value, path, issues) {
+    const record = requireRecord(value, path, ['name', 'outcome'], ['reference'], issues);
+    if (!record)
+        return false;
+    requireSafeString(record.name, `${path}.name`, issues, {
+        pattern: IDENTIFIER_PATTERN,
+    });
+    requireEnum(record.outcome, `${path}.outcome`, new Set(['passed', 'failed', 'blocked', 'unavailable']), issues);
+    if (has(record, 'reference')) {
+        requireSafeString(record.reference, `${path}.reference`, issues, {
+            maximumLength: MAX_PATH_LENGTH,
+        });
+    }
+    return true;
+}
+function validateWarning(value, path, issues) {
+    const record = requireRecord(value, path, ['classification', 'sanitizedSummary'], ['upgradeVersionDrift'], issues);
+    if (!record)
+        return false;
+    requireEnum(record.classification, `${path}.classification`, FAILURE_SET, issues);
+    requireSafeString(record.sanitizedSummary, `${path}.sanitizedSummary`, issues, { maximumLength: MAX_SUMMARY_LENGTH });
+    if (has(record, 'upgradeVersionDrift')) {
+        const drift = requireRecord(record.upgradeVersionDrift, `${path}.upgradeVersionDrift`, ['kind', 'target'], [], issues);
+        if (drift) {
+            requireEnum(drift.kind, `${path}.upgradeVersionDrift.kind`, new Set(['foundation', 'slice', 'workspace']), issues);
+            requireSafeString(drift.target, `${path}.upgradeVersionDrift.target`, issues, { pattern: IDENTIFIER_PATTERN });
+        }
+        if (record.classification !== 'ownership-conflict') {
+            addIssue(issues, `${path}.upgradeVersionDrift`, 'is accepted only for ownership-conflict warnings');
+        }
+    }
+    return true;
+}
+function validateWarnings(value, path, issues) {
+    const entries = requireArray(value, path, issues);
+    if (!entries)
+        return false;
+    entries.forEach((entry, index) => validateWarning(entry, `${path}[${index}]`, issues));
+    return true;
+}
+function validateGeneratorOperation(value, path, issues) {
+    const record = requireRecord(value, path, ['generator', 'mode'], [], issues);
+    if (!record)
+        return false;
+    requireEnum(record.generator, `${path}.generator`, STABLE_GENERATOR_SET, issues);
+    requireEnum(record.mode, `${path}.mode`, GENERATOR_MODE_SET, issues);
+    return true;
+}
+function validateGeneratorInput(value, path, issues) {
+    if (!(0, validation_js_1.isRecord)(value) || typeof value.generator !== 'string') {
+        addIssue(issues, path, 'must be one closed typed stable-generator input');
+        return false;
+    }
+    const slug = (entry, entryPath) => requireSafeString(entry, entryPath, issues, {
+        maximumLength: 63,
+        pattern: GENERATOR_SLUG_PATTERN,
+    });
+    if (value.generator === 'slice') {
+        const record = requireRecord(value, path, ['generator', 'name'], [], issues);
+        if (record)
+            slug(record.name, `${path}.name`);
+        return record !== undefined;
+    }
+    if (value.generator === 'function' ||
+        value.generator === 'service' ||
+        value.generator === 'job') {
+        const record = requireRecord(value, path, ['feature', 'generator', 'name', 'slice'], [], issues);
+        if (record) {
+            slug(record.feature, `${path}.feature`);
+            slug(record.name, `${path}.name`);
+            slug(record.slice, `${path}.slice`);
+        }
+        return record !== undefined;
+    }
+    if (value.generator === 'upgrade') {
+        const record = requireRecord(value, path, ['generator', 'name'], ['preview'], issues);
+        if (!record)
+            return false;
+        slug(record.name, `${path}.name`);
+        if (has(record, 'preview')) {
+            const preview = requireRecord(record.preview, `${path}.preview`, ['digest', 'reference'], [], issues);
+            if (preview) {
+                requireSafeString(preview.digest, `${path}.preview.digest`, issues, {
+                    pattern: SHA256_DIGEST_PATTERN,
+                });
+                requireSafeString(preview.reference, `${path}.preview.reference`, issues, {
+                    maximumLength: MAX_PATH_LENGTH,
+                    pattern: GENERATOR_PREVIEW_REFERENCE_PATTERN,
+                });
+            }
+        }
+        return true;
+    }
+    addIssue(issues, `${path}.generator`, 'must identify a stable typed generator');
+    return false;
+}
+function validateSupportedOperation(value, path, issues) {
+    const record = requireRecord(value, path, [
+        'applicableStages',
+        'approvalRequired',
+        'authority',
+        'contracts',
+        'documentationPaths',
+        'evidenceClasses',
+        'id',
+        'owner',
+        'projects',
+        'requiredVerification',
+    ], ['command', 'generator', 'policyLifecycleAction'], issues);
+    if (!record)
+        return false;
+    const applicableStages = requireArray(record.applicableStages, `${path}.applicableStages`, issues);
+    const stages = new Set();
+    applicableStages?.forEach((stage, index) => {
+        if (requireEnum(stage, `${path}.applicableStages[${index}]`, CANONICAL_STAGE_SET, issues)) {
+            if (stages.has(stage)) {
+                addIssue(issues, `${path}.applicableStages[${index}]`, 'must not duplicate another stage');
+            }
+            stages.add(stage);
+        }
+    });
+    if (applicableStages?.length === 0) {
+        addIssue(issues, `${path}.applicableStages`, 'must declare at least one canonical stage');
+    }
+    requireBoolean(record.approvalRequired, `${path}.approvalRequired`, issues);
+    requireEnum(record.authority, `${path}.authority`, AUTHORITY_SET, issues);
+    if (has(record, 'command')) {
+        validateCommand(record.command, `${path}.command`, issues);
+    }
+    if (has(record, 'generator')) {
+        validateGeneratorOperation(record.generator, `${path}.generator`, issues);
+    }
+    validateContractReferences(record.contracts, `${path}.contracts`, issues);
+    validateStringArray(record.documentationPaths, `${path}.documentationPaths`, issues, { maximumLength: MAX_PATH_LENGTH });
+    validateStringArray(record.evidenceClasses, `${path}.evidenceClasses`, issues);
+    requireSafeString(record.id, `${path}.id`, issues, {
+        pattern: IDENTIFIER_PATTERN,
+    });
+    requireEnum(record.owner, `${path}.owner`, OPERATION_OWNER_SET, issues);
+    if (has(record, 'policyLifecycleAction')) {
+        requireEnum(record.policyLifecycleAction, `${path}.policyLifecycleAction`, POLICY_LIFECYCLE_ACTION_SET, issues);
+    }
+    validateStringArray(record.projects, `${path}.projects`, issues, {
+        pattern: IDENTIFIER_PATTERN,
+    });
+    validateStringArray(record.requiredVerification, `${path}.requiredVerification`, issues);
+    if ((record.authority === 'protected-mutate' ||
+        record.authority === 'destructive') &&
+        record.approvalRequired !== true) {
+        addIssue(issues, `${path}.approvalRequired`, 'must be true for protected or destructive operation');
+    }
+    if ((record.authority === 'protected-mutate' ||
+        record.authority === 'destructive') &&
+        has(record, 'command')) {
+        addIssue(issues, `${path}.command`, 'must be absent because protected or destructive authority is not local argv');
+    }
+    if (record.authority !== 'protected-mutate' &&
+        record.authority !== 'destructive' &&
+        record.owner !== 'source-edit' &&
+        record.owner !== 'nx-generator' &&
+        !has(record, 'command')) {
+        addIssue(issues, `${path}.command`, 'is required for a locally invocable operation');
+    }
+    const generator = (0, validation_js_1.isRecord)(record.generator) ? record.generator : undefined;
+    if (record.owner === 'nx-generator') {
+        if (!generator) {
+            addIssue(issues, `${path}.generator`, 'is required for a typed Nx generator template');
+        }
+        else {
+            if (typeof generator.generator === 'string' &&
+                typeof generator.mode === 'string' &&
+                record.id !== `generator:${generator.generator}:${generator.mode}`) {
+                addIssue(issues, `${path}.id`, 'must exactly identify the typed generator and mode');
+            }
+            if ((generator.mode === 'preview' || generator.mode === 'apply') &&
+                record.authority !== 'local-source') {
+                addIssue(issues, `${path}.authority`, 'must be local-source because generator preview and apply execute the owning generator against a workspace tree');
+            }
+        }
+        if (has(record, 'command')) {
+            addIssue(issues, `${path}.command`, 'must be absent until typed generator inputs are bound by planning');
+        }
+    }
+    else if (generator) {
+        addIssue(issues, `${path}.generator`, 'is valid only for an nx-generator owner');
+    }
+    if (record.authority === 'development-mutate' &&
+        (stages.size !== 1 || !stages.has('development'))) {
+        addIssue(issues, `${path}.applicableStages`, 'must equal development for development mutation');
+    }
+    if (record.policyLifecycleAction === 'dev' &&
+        (stages.size !== 1 || !stages.has('development'))) {
+        addIssue(issues, `${path}.applicableStages`, 'must equal development for repository-policy dev actions');
+    }
+    if ((record.authority === 'protected-mutate' ||
+        record.authority === 'destructive') &&
+        ['deploy', 'migrate', 'refresh', 'remove'].includes(String(record.policyLifecycleAction)) &&
+        stages.has('development')) {
+        addIssue(issues, `${path}.applicableStages`, 'must route protected lifecycle mutation through staging or production');
+    }
+    return true;
+}
+function validateSerializedBound(value, path, maximumBytes, issues) {
+    try {
+        const serialized = (0, canonical_json_1.canonicalJson)(value);
+        if (Buffer.byteLength(serialized, 'utf8') > maximumBytes) {
+            addIssue(issues, path, `must serialize to at most ${maximumBytes} bytes`);
+        }
+    }
+    catch {
+        addIssue(issues, path, 'must be canonically JSON serializable');
+    }
+}
+function validateDeveloperAgentContext(value) {
+    const issues = [];
+    validateSerializedBound(value, '$', model_js_1.DEVELOPER_AGENT_CONTEXT_MAX_BYTES, issues);
+    const record = requireRecord(value, '$', [
+        'authenticatedTargets',
+        'documentationPaths',
+        'evidenceClasses',
+        'git',
+        'kind',
+        'markers',
+        'nonPlannableTargets',
+        'policy',
+        'projectNames',
+        'projects',
+        'reports',
+        'requiredVerification',
+        'schemaVersion',
+        'selection',
+        'supportedOperations',
+        'warnings',
+        'workspace',
+    ], ['affected'], issues);
+    if (!record)
+        return (0, validation_js_1.validationResult)(value, issues);
+    if (record.kind !== model_js_1.DEVELOPER_AGENT_CONTEXT_KIND) {
+        addIssue(issues, '$.kind', `must equal ${model_js_1.DEVELOPER_AGENT_CONTEXT_KIND}`);
+    }
+    if (record.schemaVersion !== model_js_1.DEVELOPER_AGENT_CONTRACT_SCHEMA_VERSION) {
+        addIssue(issues, '$.schemaVersion', `must equal ${model_js_1.DEVELOPER_AGENT_CONTRACT_SCHEMA_VERSION}`);
+    }
+    validateStringArray(record.authenticatedTargets, '$.authenticatedTargets', issues, { pattern: IDENTIFIER_PATTERN });
+    validateStringArray(record.documentationPaths, '$.documentationPaths', issues, {
+        maximumLength: MAX_PATH_LENGTH,
+    });
+    validateStringArray(record.evidenceClasses, '$.evidenceClasses', issues);
+    validateGitContext(record.git, '$.git', issues);
+    const markers = requireArray(record.markers, '$.markers', issues);
+    markers?.forEach((entry, index) => validateMarkerContext(entry, `$.markers[${index}]`, issues));
+    const nonPlannableTargets = requireArray(record.nonPlannableTargets, '$.nonPlannableTargets', issues);
+    const nonPlannableNames = new Set();
+    nonPlannableTargets?.forEach((entry, index) => {
+        const path = `$.nonPlannableTargets[${index}]`;
+        const target = requireRecord(entry, path, ['rationale', 'target'], [], issues);
+        if (!target)
+            return;
+        requireSafeString(target.rationale, `${path}.rationale`, issues, {
+            maximumLength: MAX_SUMMARY_LENGTH,
+        });
+        if (requireSafeString(target.target, `${path}.target`, issues, {
+            pattern: IDENTIFIER_PATTERN,
+        })) {
+            const name = target.target;
+            if (nonPlannableNames.has(name)) {
+                addIssue(issues, `${path}.target`, 'must be unique');
+            }
+            nonPlannableNames.add(name);
+        }
+    });
+    if (Array.isArray(record.authenticatedTargets)) {
+        for (const target of record.authenticatedTargets) {
+            if (typeof target === 'string' && nonPlannableNames.has(target)) {
+                addIssue(issues, '$.nonPlannableTargets', `${target} cannot be both authenticated and non-plannable`);
+            }
+        }
+    }
+    validatePolicyContext(record.policy, '$.policy', issues);
+    const projectNamesValid = validateStringArray(record.projectNames, '$.projectNames', issues, {
+        maximumItems: model_js_1.DEVELOPER_AGENT_MAX_PROJECT_NAMES,
+        pattern: IDENTIFIER_PATTERN,
+    });
+    const projectNames = projectNamesValid
+        ? record.projectNames
+        : undefined;
+    if (projectNames) {
+        if (projectNames.length === 0) {
+            addIssue(issues, '$.projectNames', 'must contain the Nx workspace project');
+        }
+        for (let index = 1; index < projectNames.length; index += 1) {
+            if ((0, ordering_js_1.compareDeveloperAgentStrings)(projectNames[index - 1], projectNames[index]) >= 0) {
+                addIssue(issues, `$.projectNames[${index}]`, 'must be in ascending canonical order');
+            }
+        }
+    }
+    const projectsValid = validateProjectContexts(record.projects, '$.projects', issues);
+    const projects = projectsValid
+        ? record.projects
+        : undefined;
+    const reports = requireArray(record.reports, '$.reports', issues);
+    reports?.forEach((entry, index) => validateReportContext(entry, `$.reports[${index}]`, issues));
+    validateStringArray(record.requiredVerification, '$.requiredVerification', issues);
+    validateSelectionContext(record.selection, '$.selection', issues);
+    const operations = requireArray(record.supportedOperations, '$.supportedOperations', issues);
+    const operationIds = new Set();
+    operations?.forEach((entry, index) => {
+        if (validateSupportedOperation(entry, `$.supportedOperations[${index}]`, issues)) {
+            const id = entry.id;
+            if (operationIds.has(id)) {
+                addIssue(issues, `$.supportedOperations[${index}].id`, 'must be unique');
+            }
+            operationIds.add(id);
+        }
+    });
+    validateWarnings(record.warnings, '$.warnings', issues);
+    validateWorkspaceContext(record.workspace, '$.workspace', issues);
+    if (projectNames) {
+        const inventory = new Set(projectNames);
+        if (projects) {
+            for (const [index, project] of projects.entries()) {
+                if (!inventory.has(project.name)) {
+                    addIssue(issues, `$.projects[${index}].name`, 'must be included in the full Nx project-name inventory');
+                }
+            }
+        }
+        if ((0, validation_js_1.isRecord)(record.workspace) &&
+            typeof record.workspace.identity === 'string' &&
+            !inventory.has(record.workspace.identity)) {
+            addIssue(issues, '$.workspace.identity', 'must be included in the full Nx project-name inventory');
+        }
+    }
+    if (has(record, 'affected')) {
+        validateAffectedContext(record.affected, '$.affected', issues);
+    }
+    if ((0, validation_js_1.isRecord)(record.git) && Array.isArray(record.warnings)) {
+        const classifications = new Set(record.warnings.filter(validation_js_1.isRecord).map((warning) => warning.classification));
+        if (record.git.dirty === true && !classifications.has('dirty-worktree')) {
+            addIssue(issues, '$.warnings', 'must report dirty-worktree when Git context is dirty');
+        }
+        if ((0, validation_js_1.isRecord)(record.workspace) &&
+            record.workspace.ownershipAgreement === 'conflict' &&
+            !classifications.has('ownership-conflict')) {
+            addIssue(issues, '$.warnings', 'must report ownership-conflict when records disagree');
+        }
+        if ((0, validation_js_1.isRecord)(record.workspace) &&
+            Array.isArray(record.workspace.ownershipVersions)) {
+            for (const [index, entry] of record.warnings.entries()) {
+                if (!(0, validation_js_1.isRecord)(entry) || !(0, validation_js_1.isRecord)(entry.upgradeVersionDrift)) {
+                    continue;
+                }
+                const drift = entry.upgradeVersionDrift;
+                const state = record.workspace.ownershipVersions.find((candidate) => (0, validation_js_1.isRecord)(candidate) &&
+                    candidate.kind === drift.kind &&
+                    candidate.target === drift.target);
+                const frameworkDrift = (0, validation_js_1.isRecord)(state) &&
+                    typeof state.installedFrameworkVersion === 'string' &&
+                    typeof state.recordedFrameworkVersion === 'string' &&
+                    state.installedFrameworkVersion !== state.recordedFrameworkVersion;
+                const blueprintDrift = (0, validation_js_1.isRecord)(state) &&
+                    typeof state.installedBlueprintVersion === 'string' &&
+                    typeof state.recordedBlueprintVersion === 'string' &&
+                    state.installedBlueprintVersion !== state.recordedBlueprintVersion;
+                if (!frameworkDrift && !blueprintDrift) {
+                    addIssue(issues, `$.warnings[${index}].upgradeVersionDrift`, 'must identify one exact inspected installed/recorded version mismatch');
+                }
+            }
+        }
+    }
+    if (has(record, 'affected') &&
+        (0, validation_js_1.isRecord)(record.affected) &&
+        (0, validation_js_1.isRecord)(record.git)) {
+        if (typeof record.git.baseCommit === 'string' &&
+            record.affected.baseCommit !== record.git.baseCommit) {
+            addIssue(issues, '$.affected.baseCommit', 'must agree with Git baseCommit');
+        }
+        if (typeof record.git.headCommit === 'string' &&
+            record.affected.headCommit !== record.git.headCommit) {
+            addIssue(issues, '$.affected.headCommit', 'must agree with Git headCommit');
+        }
+    }
+    return (0, validation_js_1.validationResult)(value, issues);
+}
+function validateGeneratedSurface(value, path, issues) {
+    const record = requireRecord(value, path, ['ownershipMode', 'path'], [], issues);
+    if (!record)
+        return false;
+    requireEnum(record.ownershipMode, `${path}.ownershipMode`, OWNERSHIP_MODE_SET, issues);
+    requireSafeString(record.path, `${path}.path`, issues, {
+        maximumLength: MAX_PATH_LENGTH,
+    });
+    return true;
+}
+function validateGeneratorPreviewChange(value, path, issues) {
+    const record = requireRecord(value, path, ['change', 'ownershipMode', 'path'], ['contentDigest', 'mode'], issues);
+    if (!record)
+        return false;
+    requireEnum(record.change, `${path}.change`, GENERATOR_PREVIEW_CHANGE_SET, issues);
+    requireEnum(record.ownershipMode, `${path}.ownershipMode`, OWNERSHIP_MODE_SET, issues);
+    requireSafeString(record.path, `${path}.path`, issues, {
+        maximumLength: MAX_PATH_LENGTH,
+    });
+    if (record.change === 'delete') {
+        if (has(record, 'contentDigest')) {
+            addIssue(issues, `${path}.contentDigest`, 'must be absent for a deleted file');
+        }
+    }
+    else {
+        requireSafeString(record.contentDigest, `${path}.contentDigest`, issues, {
+            pattern: SHA256_DIGEST_PATTERN,
+        });
+    }
+    if (has(record, 'mode')) {
+        requireSafeString(record.mode, `${path}.mode`, issues, {
+            pattern: /^[0-7]{3,4}$/,
+        });
+    }
+    return true;
+}
+function validateGeneratorPreviewSource(value, path, issues) {
+    const record = requireRecord(value, path, [
+        'blueprintVersions',
+        'commit',
+        'frameworkVersion',
+        'ownershipVersions',
+        'workspace',
+    ], ['candidateProvenance'], issues);
+    if (!record)
+        return false;
+    validateVersionRecords(record.blueprintVersions, `${path}.blueprintVersions`, issues);
+    if (has(record, 'candidateProvenance')) {
+        validateCandidateProvenance(record.candidateProvenance, `${path}.candidateProvenance`, issues);
+    }
+    requireSafeString(record.commit, `${path}.commit`, issues, {
+        maximumLength: 64,
+        pattern: COMMIT_PATTERN,
+    });
+    requireSafeString(record.frameworkVersion, `${path}.frameworkVersion`, issues);
+    validateOwnershipVersionStates(record.ownershipVersions, `${path}.ownershipVersions`, issues);
+    requireSafeString(record.workspace, `${path}.workspace`, issues, {
+        pattern: IDENTIFIER_PATTERN,
+    });
+    return true;
+}
+function validateDeveloperAgentGeneratorPreview(value) {
+    const issues = [];
+    validateSerializedBound(value, '$', model_js_1.DEVELOPER_AGENT_GENERATOR_PREVIEW_MAX_BYTES, issues);
+    const record = requireRecord(value, '$', [
+        'changes',
+        'generatedSurfaces',
+        'generator',
+        'input',
+        'kind',
+        'operationId',
+        'schemaVersion',
+        'source',
+    ], [], issues);
+    if (!record)
+        return (0, validation_js_1.validationResult)(value, issues);
+    if (record.kind !== model_js_1.DEVELOPER_AGENT_GENERATOR_PREVIEW_KIND) {
+        addIssue(issues, '$.kind', `must equal ${model_js_1.DEVELOPER_AGENT_GENERATOR_PREVIEW_KIND}`);
+    }
+    if (record.schemaVersion !== model_js_1.DEVELOPER_AGENT_CONTRACT_SCHEMA_VERSION) {
+        addIssue(issues, '$.schemaVersion', `must equal ${model_js_1.DEVELOPER_AGENT_CONTRACT_SCHEMA_VERSION}`);
+    }
+    if (record.generator !== 'upgrade') {
+        addIssue(issues, '$.generator', 'must equal upgrade');
+    }
+    if (record.operationId !== 'generator:upgrade:preview') {
+        addIssue(issues, '$.operationId', 'must equal generator:upgrade:preview');
+    }
+    const input = requireRecord(record.input, '$.input', ['generator', 'name'], [], issues);
+    if (input) {
+        if (input.generator !== 'upgrade') {
+            addIssue(issues, '$.input.generator', 'must equal upgrade');
+        }
+        requireSafeString(input.name, '$.input.name', issues, {
+            maximumLength: 63,
+            pattern: /^[a-z0-9][a-z0-9-]*$/,
+        });
+    }
+    validateGeneratorPreviewSource(record.source, '$.source', issues);
+    const changes = requireArray(record.changes, '$.changes', issues, MAX_GENERATED_SURFACES);
+    const changePaths = new Set();
+    let previousChangePath;
+    changes?.forEach((entry, index) => {
+        if (validateGeneratorPreviewChange(entry, `$.changes[${index}]`, issues)) {
+            validateCanonicalWorkspacePath(entry.path, `$.changes[${index}].path`, issues);
+            if (changePaths.has(entry.path)) {
+                addIssue(issues, `$.changes[${index}].path`, 'must be unique');
+            }
+            if (previousChangePath !== undefined &&
+                (0, ordering_js_1.compareDeveloperAgentStrings)(previousChangePath, entry.path) >= 0) {
+                addIssue(issues, `$.changes[${index}].path`, 'must be in ascending canonical order');
+            }
+            changePaths.add(entry.path);
+            previousChangePath = entry.path;
+        }
+    });
+    const surfaces = requireArray(record.generatedSurfaces, '$.generatedSurfaces', issues, MAX_GENERATED_SURFACES);
+    const paths = new Set();
+    let previousPath;
+    surfaces?.forEach((entry, index) => {
+        if (validateGeneratedSurface(entry, `$.generatedSurfaces[${index}]`, issues)) {
+            validateCanonicalWorkspacePath(entry.path, `$.generatedSurfaces[${index}].path`, issues);
+            if (paths.has(entry.path)) {
+                addIssue(issues, `$.generatedSurfaces[${index}].path`, 'must be unique');
+            }
+            if (previousPath !== undefined &&
+                (0, ordering_js_1.compareDeveloperAgentStrings)(previousPath, entry.path) >= 0) {
+                addIssue(issues, `$.generatedSurfaces[${index}].path`, 'must be in ascending canonical order');
+            }
+            paths.add(entry.path);
+            previousPath = entry.path;
+        }
+    });
+    if (changes &&
+        surfaces &&
+        changes.every(validation_js_1.isRecord) &&
+        surfaces.every(validation_js_1.isRecord) &&
+        !(0, node_util_1.isDeepStrictEqual)(surfaces, changes.map(({ ownershipMode, path }) => ({ ownershipMode, path })))) {
+        addIssue(issues, '$.generatedSurfaces', 'must exactly project the preview change paths and ownership modes');
+    }
+    return (0, validation_js_1.validationResult)(value, issues);
+}
+function validateDeveloperAgentGeneratorPreviewReceipt(value) {
+    const issues = [];
+    validateSerializedBound(value, '$', model_js_1.DEVELOPER_AGENT_GENERATOR_PREVIEW_RECEIPT_MAX_BYTES, issues);
+    const record = requireRecord(value, '$', ['digest', 'kind', 'preview', 'reference', 'schemaVersion'], [], issues);
+    if (!record)
+        return (0, validation_js_1.validationResult)(value, issues);
+    if (record.kind !== model_js_1.DEVELOPER_AGENT_GENERATOR_PREVIEW_RECEIPT_KIND) {
+        addIssue(issues, '$.kind', `must equal ${model_js_1.DEVELOPER_AGENT_GENERATOR_PREVIEW_RECEIPT_KIND}`);
+    }
+    if (record.schemaVersion !== model_js_1.DEVELOPER_AGENT_CONTRACT_SCHEMA_VERSION) {
+        addIssue(issues, '$.schemaVersion', `must equal ${model_js_1.DEVELOPER_AGENT_CONTRACT_SCHEMA_VERSION}`);
+    }
+    requireSafeString(record.digest, '$.digest', issues, {
+        pattern: SHA256_DIGEST_PATTERN,
+    });
+    requireSafeString(record.reference, '$.reference', issues, {
+        maximumLength: MAX_PATH_LENGTH,
+        pattern: GENERATOR_PREVIEW_REFERENCE_PATTERN,
+    });
+    const previewValidation = validateDeveloperAgentGeneratorPreview(record.preview);
+    if (!previewValidation.valid) {
+        for (const issue of previewValidation.issues) {
+            addIssue(issues, `$.preview${issue.path === '$' ? '' : issue.path.slice(1)}`, issue.message);
+        }
+    }
+    else if (record.digest !==
+        `sha256:${(0, node_crypto_1.createHash)('sha256')
+            .update((0, canonical_json_1.canonicalJson)(previewValidation.value), 'utf8')
+            .digest('hex')}`) {
+        addIssue(issues, '$.digest', 'must bind the canonical preview bytes exactly');
+    }
+    return (0, validation_js_1.validationResult)(value, issues);
+}
+function validateInvocation(value, path, issues) {
+    const record = requireRecord(value, path, ['command', 'owner'], [], issues);
+    if (!record)
+        return false;
+    validateCommand(record.command, `${path}.command`, issues);
+    requireEnum(record.owner, `${path}.owner`, OPERATION_OWNER_SET, issues);
+    return true;
+}
+function validateApprovalPoint(value, path, issues) {
+    const record = requireRecord(value, path, ['authority', 'description'], [], issues);
+    if (!record)
+        return false;
+    requireEnum(record.authority, `${path}.authority`, AUTHORITY_SET, issues);
+    requireSafeString(record.description, `${path}.description`, issues, {
+        maximumLength: MAX_SUMMARY_LENGTH,
+    });
+    return true;
+}
+function validateRisk(value, path, issues) {
+    const record = requireRecord(value, path, ['class', 'sanitizedSummary'], [], issues);
+    if (!record)
+        return false;
+    requireEnum(record.class, `${path}.class`, RISK_CLASS_SET, issues);
+    requireSafeString(record.sanitizedSummary, `${path}.sanitizedSummary`, issues, { maximumLength: MAX_SUMMARY_LENGTH });
+    return true;
+}
+function validateDeveloperAgentPlan(value) {
+    const issues = [];
+    validateSerializedBound(value, '$', model_js_1.DEVELOPER_AGENT_PLAN_MAX_BYTES, issues);
+    const record = requireRecord(value, '$', [
+        'acceptanceCriteriaReference',
+        'affectedContracts',
+        'approvalPoints',
+        'assumptions',
+        'authority',
+        'blockers',
+        'cleanup',
+        'evidenceClasses',
+        'generatedSurfaces',
+        'invocations',
+        'kind',
+        'nextSafeAction',
+        'operation',
+        'recovery',
+        'requestedOutcome',
+        'risks',
+        'schemaVersion',
+        'selectedFiles',
+        'selectedProjects',
+        'verification',
+    ], [], issues);
+    if (!record)
+        return (0, validation_js_1.validationResult)(value, issues);
+    if (record.kind !== model_js_1.DEVELOPER_AGENT_PLAN_KIND) {
+        addIssue(issues, '$.kind', `must equal ${model_js_1.DEVELOPER_AGENT_PLAN_KIND}`);
+    }
+    if (record.schemaVersion !== model_js_1.DEVELOPER_AGENT_CONTRACT_SCHEMA_VERSION) {
+        addIssue(issues, '$.schemaVersion', `must equal ${model_js_1.DEVELOPER_AGENT_CONTRACT_SCHEMA_VERSION}`);
+    }
+    requireSafeString(record.acceptanceCriteriaReference, '$.acceptanceCriteriaReference', issues, { maximumLength: MAX_PATH_LENGTH });
+    validateContractReferences(record.affectedContracts, '$.affectedContracts', issues);
+    const approvalPoints = requireArray(record.approvalPoints, '$.approvalPoints', issues);
+    approvalPoints?.forEach((entry, index) => validateApprovalPoint(entry, `$.approvalPoints[${index}]`, issues));
+    validateStringArray(record.assumptions, '$.assumptions', issues, {
+        maximumLength: MAX_SUMMARY_LENGTH,
+    });
+    requireEnum(record.authority, '$.authority', AUTHORITY_SET, issues);
+    validateWarnings(record.blockers, '$.blockers', issues);
+    validateCleanupRecovery(record.cleanup, '$.cleanup', issues);
+    validateStringArray(record.evidenceClasses, '$.evidenceClasses', issues);
+    const surfaces = requireArray(record.generatedSurfaces, '$.generatedSurfaces', issues, MAX_GENERATED_SURFACES);
+    surfaces?.forEach((entry, index) => validateGeneratedSurface(entry, `$.generatedSurfaces[${index}]`, issues));
+    const invocations = requireArray(record.invocations, '$.invocations', issues);
+    invocations?.forEach((entry, index) => validateInvocation(entry, `$.invocations[${index}]`, issues));
+    validateNextSafeAction(record.nextSafeAction, '$.nextSafeAction', issues);
+    validateHandoffOperation(record.operation, '$.operation', issues);
+    validateCleanupRecovery(record.recovery, '$.recovery', issues);
+    requireSafeString(record.requestedOutcome, '$.requestedOutcome', issues, {
+        maximumLength: MAX_SUMMARY_LENGTH,
+    });
+    const risks = requireArray(record.risks, '$.risks', issues);
+    risks?.forEach((entry, index) => validateRisk(entry, `$.risks[${index}]`, issues));
+    validateStringArray(record.selectedFiles, '$.selectedFiles', issues, {
+        maximumItems: MAX_GENERATED_SURFACES,
+        maximumLength: MAX_PATH_LENGTH,
+    });
+    if (Array.isArray(record.selectedFiles)) {
+        record.selectedFiles.forEach((entry, index) => validateCanonicalWorkspacePath(entry, `$.selectedFiles[${index}]`, issues));
+    }
+    validateStringArray(record.selectedProjects, '$.selectedProjects', issues, {
+        pattern: IDENTIFIER_PATTERN,
+    });
+    validateStringArray(record.verification, '$.verification', issues);
+    if ((0, validation_js_1.isRecord)(record.operation) && (0, validation_js_1.isRecord)(record.operation.scope)) {
+        if (record.operation.authority !== record.authority) {
+            addIssue(issues, '$.operation.authority', 'must equal the effective plan authority');
+        }
+        const sameStringSet = (left, right) => Array.isArray(left) &&
+            Array.isArray(right) &&
+            left.length === right.length &&
+            [...left]
+                .sort()
+                .every((entry, index) => entry === [...right].sort()[index]);
+        const contractIdentity = (value) => (0, validation_js_1.isRecord)(value)
+            ? `${String(value.class)}\u0000${String(value.reference)}`
+            : '';
+        if (!sameStringSet(record.operation.scope.projects, record.selectedProjects)) {
+            addIssue(issues, '$.operation.scope.projects', 'must equal the effective selected project scope');
+        }
+        if (!sameStringSet(Array.isArray(record.operation.scope.contracts)
+            ? record.operation.scope.contracts.map(contractIdentity)
+            : undefined, Array.isArray(record.affectedContracts)
+            ? record.affectedContracts.map(contractIdentity)
+            : undefined)) {
+            addIssue(issues, '$.operation.scope.contracts', 'must equal the effective affected contract scope');
+        }
+        if (!sameStringSet(record.operation.scope.evidenceClasses, record.evidenceClasses)) {
+            addIssue(issues, '$.operation.scope.evidenceClasses', 'must equal the effective evidence scope');
+        }
+        const planVerification = Array.isArray(record.verification)
+            ? record.verification
+            : [];
+        if (Array.isArray(record.operation.scope.requiredVerification) &&
+            record.operation.scope.requiredVerification.some((entry) => !planVerification.includes(entry))) {
+            addIssue(issues, '$.operation.scope.requiredVerification', 'must be included in the complete plan verification set');
+        }
+    }
+    if ((0, validation_js_1.isRecord)(record.operation) &&
+        (0, validation_js_1.isRecord)(record.nextSafeAction) &&
+        Array.isArray(record.invocations) &&
+        Array.isArray(record.blockers)) {
+        const blocked = record.blockers.length > 0;
+        const protectedOrDestructive = record.operation.authority === 'protected-mutate' ||
+            record.operation.authority === 'destructive';
+        const sourceEdit = record.operation.owner === 'source-edit';
+        if (blocked) {
+            if (record.nextSafeAction.authority !== 'read-only' ||
+                has(record.nextSafeAction, 'command') ||
+                has(record.nextSafeAction, 'operationId') ||
+                has(record.nextSafeAction, 'owner')) {
+                addIssue(issues, '$.nextSafeAction', 'a blocked plan must retain only a non-actionable read-only remediation');
+            }
+            if (record.invocations.length !== 0) {
+                addIssue(issues, '$.invocations', 'a blocked plan must not retain an invocation');
+            }
+        }
+        else {
+            if (record.nextSafeAction.authority !== record.operation.authority) {
+                addIssue(issues, '$.nextSafeAction.authority', 'must equal the effective operation authority');
+            }
+            if (record.nextSafeAction.operationId !== record.operation.id) {
+                addIssue(issues, '$.nextSafeAction.operationId', 'must equal the effective operation id');
+            }
+            if (record.nextSafeAction.owner !== record.operation.owner) {
+                addIssue(issues, '$.nextSafeAction.owner', 'must equal the effective operation owner');
+            }
+            if (protectedOrDestructive || sourceEdit) {
+                if (record.invocations.length !== 0) {
+                    addIssue(issues, '$.invocations', 'this authority boundary must not retain a local invocation');
+                }
+                if (has(record.nextSafeAction, 'command')) {
+                    addIssue(issues, '$.nextSafeAction.command', 'this authority boundary must not retain executable argv');
+                }
+            }
+            else {
+                if (record.invocations.length !== 1) {
+                    addIssue(issues, '$.invocations', 'an executable local plan must retain exactly one owning-tool invocation');
+                }
+                else {
+                    const invocation = record.invocations[0];
+                    if (!(0, validation_js_1.isRecord)(invocation) ||
+                        invocation.owner !== record.operation.owner) {
+                        addIssue(issues, '$.invocations[0].owner', 'must equal the effective operation owner');
+                    }
+                    if (!(0, validation_js_1.isRecord)(invocation) ||
+                        !has(record.nextSafeAction, 'command') ||
+                        !(0, node_util_1.isDeepStrictEqual)(record.nextSafeAction.command, invocation.command)) {
+                        addIssue(issues, '$.nextSafeAction.command', 'must equal the sole owning-tool invocation command');
+                    }
+                }
+            }
+        }
+    }
+    if (Array.isArray(record.generatedSurfaces) &&
+        Array.isArray(record.selectedFiles)) {
+        const surfacePaths = record.generatedSurfaces.map((surface) => (0, validation_js_1.isRecord)(surface) && typeof surface.path === 'string'
+            ? surface.path
+            : undefined);
+        if (surfacePaths.length !== record.selectedFiles.length ||
+            surfacePaths.some((surfacePath, index) => surfacePath !== record.selectedFiles[index])) {
+            addIssue(issues, '$.generatedSurfaces', 'must be derived in order from selectedFiles');
+        }
+    }
+    if ((record.authority === 'protected-mutate' ||
+        record.authority === 'destructive') &&
+        Array.isArray(record.approvalPoints) &&
+        record.approvalPoints.length === 0) {
+        addIssue(issues, '$.approvalPoints', 'must identify an approval point for protected or destructive work');
+    }
+    if ((record.authority === 'protected-mutate' ||
+        record.authority === 'destructive') &&
+        Array.isArray(record.invocations) &&
+        record.invocations.length > 0) {
+        addIssue(issues, '$.invocations', 'must not materialize local argv for protected or destructive work');
+    }
+    return (0, validation_js_1.validationResult)(value, issues);
+}
+function validateSourceIdentity(value, path, issues) {
+    const record = requireRecord(value, path, ['commit', 'worktree'], [], issues);
+    if (!record)
+        return false;
+    requireSafeString(record.commit, `${path}.commit`, issues, {
+        maximumLength: 64,
+        pattern: COMMIT_PATTERN,
+    });
+    requireSafeString(record.worktree, `${path}.worktree`, issues, {
+        maximumLength: MAX_PATH_LENGTH,
+    });
+    return true;
+}
+function validateToolIdentity(value, path, issues) {
+    const record = requireRecord(value, path, ['contractVersion', 'name', 'version'], [], issues);
+    if (!record)
+        return false;
+    if (record.contractVersion !== model_js_1.DEVELOPER_AGENT_CONTRACT_SCHEMA_VERSION) {
+        addIssue(issues, `${path}.contractVersion`, `must equal ${model_js_1.DEVELOPER_AGENT_CONTRACT_SCHEMA_VERSION}`);
+    }
+    requireSafeString(record.name, `${path}.name`, issues, {
+        pattern: IDENTIFIER_PATTERN,
+    });
+    requireSafeString(record.version, `${path}.version`, issues);
+    return true;
+}
+function validateNormalizedInput(value, path, issues) {
+    const record = requireRecord(value, path, ['name', 'value'], [], issues);
+    if (!record)
+        return false;
+    requireSafeString(record.name, `${path}.name`, issues, {
+        pattern: FIELD_NAME_PATTERN,
+    });
+    requireSafeString(record.value, `${path}.value`, issues, {
+        maximumLength: MAX_INPUT_VALUE_LENGTH,
+    });
+    return true;
+}
+function validateOperationIdentity(value, path, issues) {
+    const record = requireRecord(value, path, ['name', 'normalizedInputs'], [], issues);
+    if (!record)
+        return false;
+    requireSafeString(record.name, `${path}.name`, issues, {
+        pattern: IDENTIFIER_PATTERN,
+    });
+    const entries = requireArray(record.normalizedInputs, `${path}.normalizedInputs`, issues);
+    const names = new Set();
+    entries?.forEach((entry, index) => {
+        if (validateNormalizedInput(entry, `${path}.normalizedInputs[${index}]`, issues)) {
+            const name = entry.name;
+            if (names.has(name)) {
+                addIssue(issues, `${path}.normalizedInputs[${index}].name`, 'must be unique');
+            }
+            names.add(name);
+        }
+    });
+    return true;
+}
+function validateAffectedResult(value, path, issues) {
+    const record = requireRecord(value, path, ['contracts', 'projects'], [], issues);
+    if (!record)
+        return false;
+    validateContractReferences(record.contracts, `${path}.contracts`, issues);
+    validateStringArray(record.projects, `${path}.projects`, issues, {
+        pattern: IDENTIFIER_PATTERN,
+    });
+    return true;
+}
+function validateChangeSet(value, path, issues) {
+    const record = requireRecord(value, path, ['externalResources', 'files'], [], issues);
+    if (!record)
+        return false;
+    validateStringArray(record.externalResources, `${path}.externalResources`, issues, { maximumLength: MAX_PATH_LENGTH });
+    validateStringArray(record.files, `${path}.files`, issues, {
+        maximumLength: MAX_PATH_LENGTH,
+    });
+    if (Array.isArray(record.files)) {
+        record.files.forEach((entry, index) => validateCanonicalWorkspacePath(entry, `${path}.files[${index}]`, issues));
+    }
+    return true;
+}
+function validateVerificationSummary(value, path, issues) {
+    const record = requireRecord(value, path, ['executed', 'omitted'], [], issues);
+    if (!record)
+        return false;
+    validateStringArray(record.executed, `${path}.executed`, issues);
+    validateStringArray(record.omitted, `${path}.omitted`, issues);
+    if (Array.isArray(record.executed) && Array.isArray(record.omitted)) {
+        const executed = new Set(record.executed);
+        record.omitted.forEach((entry, index) => {
+            if (executed.has(entry)) {
+                addIssue(issues, `${path}.omitted[${index}]`, 'must not also be recorded as executed');
+            }
+        });
+    }
+    return true;
+}
+function validateTestingEvidenceComposition(value, path, issues) {
+    const record = requireRecord(value, path, ['digest', 'reference', 'result', 'schemaVersion'], [], issues);
+    if (!record)
+        return false;
+    requireSafeString(record.digest, `${path}.digest`, issues, {
+        maximumLength: 71,
+        pattern: SHA256_DIGEST_PATTERN,
+    });
+    validateCanonicalWorkspacePath(record.reference, `${path}.reference`, issues);
+    if (record.schemaVersion !== index_js_1.TESTING_EVIDENCE_RESULT_SCHEMA_VERSION) {
+        addIssue(issues, `${path}.schemaVersion`, `must equal consumed Testing/Evidence revision ${index_js_1.TESTING_EVIDENCE_RESULT_SCHEMA_VERSION}`);
+    }
+    const result = (0, index_js_1.validateTestingEvidenceResult)(record.result);
+    if (!result.valid) {
+        result.issues.forEach((issue) => addIssue(issues, `${path}.result${issue.path === 'result' ? '' : issue.path.replace(/^result/, '')}`, issue.message));
+    }
+    return true;
+}
+function validateUnresolvedState(value, path, issues) {
+    const record = requireRecord(value, path, ['approvalNeeds', 'assumptions', 'conflicts', 'markers'], [], issues);
+    if (!record)
+        return false;
+    for (const property of [
+        'approvalNeeds',
+        'assumptions',
+        'conflicts',
+        'markers',
+    ]) {
+        validateStringArray(record[property], `${path}.${property}`, issues, {
+            maximumLength: MAX_SUMMARY_LENGTH,
+        });
+    }
+    return true;
+}
+function validateResultCoherence(record, path, issues) {
+    const outcome = record.outcome;
+    const classification = record.failureClassification;
+    const changes = (0, validation_js_1.isRecord)(record.changes) ? record.changes : undefined;
+    const cleanup = (0, validation_js_1.isRecord)(record.cleanup) ? record.cleanup : undefined;
+    const recovery = (0, validation_js_1.isRecord)(record.recovery) ? record.recovery : undefined;
+    const verification = (0, validation_js_1.isRecord)(record.verification)
+        ? record.verification
+        : undefined;
+    if (outcome === 'succeeded' && classification !== undefined) {
+        addIssue(issues, `${path}.failureClassification`, 'must be omitted for a succeeded result');
+    }
+    if ((outcome === 'blocked' || outcome === 'failed') &&
+        classification === undefined) {
+        addIssue(issues, `${path}.failureClassification`, `is required for a ${outcome} result`);
+    }
+    if (typeof classification === 'string' &&
+        BLOCKING_FAILURES.has(classification) &&
+        outcome !== 'blocked') {
+        addIssue(issues, `${path}.outcome`, `must be blocked for ${classification}`);
+    }
+    if (typeof classification === 'string' &&
+        FAILED_FAILURES.has(classification) &&
+        outcome !== 'failed') {
+        addIssue(issues, `${path}.outcome`, `must be failed for ${classification}`);
+    }
+    if (classification === 'external-proof-pending' && outcome !== 'incomplete') {
+        addIssue(issues, `${path}.outcome`, 'must be incomplete while external proof is pending');
+    }
+    if (classification === 'external-proof-pending' &&
+        (!verification ||
+            !Array.isArray(verification.omitted) ||
+            verification.omitted.length === 0)) {
+        addIssue(issues, `${path}.verification.omitted`, 'must identify the pending external proof');
+    }
+    if (classification === 'cleanup-incomplete' &&
+        cleanup?.outcome !== 'incomplete' &&
+        recovery?.outcome !== 'incomplete') {
+        addIssue(issues, `${path}.cleanup`, 'or recovery must be incomplete for cleanup-incomplete');
+    }
+    if (outcome === 'succeeded' &&
+        (cleanup?.outcome === 'incomplete' || recovery?.outcome === 'incomplete')) {
+        addIssue(issues, `${path}.outcome`, 'cannot succeed with incomplete cleanup or recovery');
+    }
+    if (outcome === 'blocked' &&
+        changes &&
+        ((Array.isArray(changes.files) && changes.files.length > 0) ||
+            (Array.isArray(changes.externalResources) &&
+                changes.externalResources.length > 0))) {
+        addIssue(issues, `${path}.changes`, 'must be empty when blocked before mutation');
+    }
+    if (outcome === 'incomplete' &&
+        classification === undefined &&
+        changes &&
+        ((Array.isArray(changes.files) && changes.files.length > 0) ||
+            (Array.isArray(changes.externalResources) &&
+                changes.externalResources.length > 0))) {
+        addIssue(issues, `${path}.failureClassification`, 'is required when incomplete work changed state');
+    }
+}
+function validateDeveloperAgentResult(value) {
+    const issues = [];
+    validateSerializedBound(value, '$', model_js_1.DEVELOPER_AGENT_RESULT_MAX_BYTES, issues);
+    const record = requireRecord(value, '$', [
+        'affected',
+        'artifacts',
+        'changes',
+        'cleanup',
+        'kind',
+        'nextSafeAction',
+        'operation',
+        'outcome',
+        'recovery',
+        'schemaVersion',
+        'source',
+        'tool',
+        'unresolved',
+        'verification',
+    ], ['failureClassification', 'testingEvidence'], issues);
+    if (!record)
+        return (0, validation_js_1.validationResult)(value, issues);
+    if (record.kind !== model_js_1.DEVELOPER_AGENT_RESULT_KIND) {
+        addIssue(issues, '$.kind', `must equal ${model_js_1.DEVELOPER_AGENT_RESULT_KIND}`);
+    }
+    if (record.schemaVersion !== model_js_1.DEVELOPER_AGENT_CONTRACT_SCHEMA_VERSION) {
+        addIssue(issues, '$.schemaVersion', `must equal ${model_js_1.DEVELOPER_AGENT_CONTRACT_SCHEMA_VERSION}`);
+    }
+    validateAffectedResult(record.affected, '$.affected', issues);
+    validateArtifacts(record.artifacts, '$.artifacts', issues);
+    validateChangeSet(record.changes, '$.changes', issues);
+    validateCleanupRecovery(record.cleanup, '$.cleanup', issues);
+    if (has(record, 'failureClassification')) {
+        requireEnum(record.failureClassification, '$.failureClassification', FAILURE_SET, issues);
+    }
+    validateNextSafeAction(record.nextSafeAction, '$.nextSafeAction', issues);
+    validateOperationIdentity(record.operation, '$.operation', issues);
+    requireEnum(record.outcome, '$.outcome', RESULT_OUTCOME_SET, issues);
+    validateCleanupRecovery(record.recovery, '$.recovery', issues);
+    validateSourceIdentity(record.source, '$.source', issues);
+    if (has(record, 'testingEvidence')) {
+        validateTestingEvidenceComposition(record.testingEvidence, '$.testingEvidence', issues);
+    }
+    validateToolIdentity(record.tool, '$.tool', issues);
+    validateUnresolvedState(record.unresolved, '$.unresolved', issues);
+    validateVerificationSummary(record.verification, '$.verification', issues);
+    validateResultCoherence(record, '$', issues);
+    return (0, validation_js_1.validationResult)(value, issues);
+}
+function validateHandoffWork(value, path, issues) {
+    const record = requireRecord(value, path, ['acceptanceCriteriaRevision', 'reference'], [], issues);
+    if (!record)
+        return false;
+    requireSafeString(record.acceptanceCriteriaRevision, `${path}.acceptanceCriteriaRevision`, issues, { maximumLength: MAX_PATH_LENGTH });
+    requireSafeString(record.reference, `${path}.reference`, issues, {
+        maximumLength: MAX_PATH_LENGTH,
+    });
+    return true;
+}
+function validateHandoffRepository(value, path, issues) {
+    const record = requireRecord(value, path, ['baseCommit', 'baseRef', 'branch', 'headCommit', 'identity', 'worktree'], [], issues);
+    if (!record)
+        return false;
+    for (const property of ['baseCommit', 'headCommit']) {
+        requireSafeString(record[property], `${path}.${property}`, issues, {
+            maximumLength: 64,
+            pattern: COMMIT_PATTERN,
+        });
+    }
+    requireSafeString(record.baseRef, `${path}.baseRef`, issues, {
+        maximumLength: MAX_PATH_LENGTH,
+    });
+    requireSafeString(record.branch, `${path}.branch`, issues, {
+        maximumLength: MAX_PATH_LENGTH,
+    });
+    requireSafeString(record.identity, `${path}.identity`, issues, {
+        pattern: IDENTIFIER_PATTERN,
+    });
+    requireSafeString(record.worktree, `${path}.worktree`, issues, {
+        maximumLength: MAX_PATH_LENGTH,
+    });
+    return true;
+}
+function validateHandoffVersions(value, path, issues) {
+    const record = requireRecord(value, path, [
+        'blueprintVersions',
+        'canonicalStage',
+        'effectivePolicyDigest',
+        'frameworkVersion',
+        'policyReferences',
+    ], ['candidateEvidenceReference'], issues);
+    if (!record)
+        return false;
+    validateVersionRecords(record.blueprintVersions, `${path}.blueprintVersions`, issues);
+    requireEnum(record.canonicalStage, `${path}.canonicalStage`, CANONICAL_STAGE_SET, issues);
+    requireSafeString(record.effectivePolicyDigest, `${path}.effectivePolicyDigest`, issues, {
+        maximumLength: 71,
+        pattern: SHA256_DIGEST_PATTERN,
+    });
+    requireSafeString(record.frameworkVersion, `${path}.frameworkVersion`, issues);
+    validateStringArray(record.policyReferences, `${path}.policyReferences`, issues, { maximumLength: MAX_PATH_LENGTH });
+    if (has(record, 'candidateEvidenceReference')) {
+        validateCandidateProvenance(record.candidateEvidenceReference, `${path}.candidateEvidenceReference`, issues);
+        if (!(0, validation_js_1.isRecord)(record.candidateEvidenceReference) ||
+            typeof record.candidateEvidenceReference.digest !== 'string') {
+            addIssue(issues, `${path}.candidateEvidenceReference.digest`, 'is required for a resumable candidate reference');
+        }
+    }
+    return true;
+}
+function validateHandoffSelection(value, path, issues) {
+    const record = requireRecord(value, path, ['affectedTargets', 'projects'], ['feature', 'slice'], issues);
+    if (!record)
+        return false;
+    validateStringArray(record.affectedTargets, `${path}.affectedTargets`, issues, { pattern: IDENTIFIER_PATTERN });
+    validateStringArray(record.projects, `${path}.projects`, issues, {
+        pattern: IDENTIFIER_PATTERN,
+    });
+    if (has(record, 'slice')) {
+        requireSafeString(record.slice, `${path}.slice`, issues, {
+            pattern: IDENTIFIER_PATTERN,
+        });
+    }
+    if (has(record, 'feature')) {
+        requireSafeString(record.feature, `${path}.feature`, issues, {
+            pattern: IDENTIFIER_PATTERN,
+        });
+        if (!has(record, 'slice')) {
+            addIssue(issues, `${path}.feature`, 'requires a selected Slice');
+        }
+    }
+    if (typeof record.slice === 'string' &&
+        Array.isArray(record.projects) &&
+        !record.projects.includes(record.slice)) {
+        addIssue(issues, `${path}.slice`, 'must be included in the selected projects');
+    }
+    return true;
+}
+function validateHandoffOperation(value, path, issues) {
+    const record = requireRecord(value, path, ['authority', 'id', 'owner', 'scope'], ['generatorInput'], issues);
+    if (!record)
+        return false;
+    requireEnum(record.authority, `${path}.authority`, AUTHORITY_SET, issues);
+    requireSafeString(record.id, `${path}.id`, issues, {
+        maximumLength: MAX_IDENTIFIER_LENGTH,
+        pattern: IDENTIFIER_PATTERN,
+    });
+    requireEnum(record.owner, `${path}.owner`, OPERATION_OWNER_SET, issues);
+    if (record.owner === 'nx-generator') {
+        if (!has(record, 'generatorInput')) {
+            addIssue(issues, `${path}.generatorInput`, 'is required to rebind a completed typed generator scope');
+        }
+        else if (validateGeneratorInput(record.generatorInput, `${path}.generatorInput`, issues) &&
+            (0, validation_js_1.isRecord)(record.generatorInput) &&
+            typeof record.generatorInput.generator === 'string' &&
+            typeof record.id === 'string') {
+            const previewId = `generator:${record.generatorInput.generator}:preview`;
+            const applyId = `generator:${record.generatorInput.generator}:apply`;
+            if (record.id !== previewId && record.id !== applyId) {
+                addIssue(issues, `${path}.generatorInput.generator`, 'must exactly match the retained generator operation id');
+            }
+            if (record.generatorInput.generator === 'upgrade') {
+                const hasPreview = has(record.generatorInput, 'preview');
+                if (record.id === previewId && hasPreview) {
+                    addIssue(issues, `${path}.generatorInput.preview`, 'must be absent for a completed Upgrade preview operation');
+                }
+                if (record.id === applyId && !hasPreview) {
+                    addIssue(issues, `${path}.generatorInput.preview`, 'is required to bind a completed Upgrade apply operation');
+                }
+            }
+        }
+    }
+    else if (has(record, 'generatorInput')) {
+        addIssue(issues, `${path}.generatorInput`, 'is valid only for a typed Nx generator operation');
+    }
+    const scope = requireRecord(record.scope, `${path}.scope`, ['contracts', 'evidenceClasses', 'projects', 'requiredVerification'], [], issues);
+    if (scope) {
+        validateContractReferences(scope.contracts, `${path}.scope.contracts`, issues);
+        validateStringArray(scope.evidenceClasses, `${path}.scope.evidenceClasses`, issues);
+        validateStringArray(scope.projects, `${path}.scope.projects`, issues, {
+            pattern: IDENTIFIER_PATTERN,
+        });
+        validateStringArray(scope.requiredVerification, `${path}.scope.requiredVerification`, issues);
+    }
+    return true;
+}
+function validateHandoffMarkerSnapshot(value, path, issues) {
+    const record = requireRecord(value, path, ['blocking', 'reference'], [], issues);
+    if (!record)
+        return false;
+    requireBoolean(record.blocking, `${path}.blocking`, issues);
+    requireSafeString(record.reference, `${path}.reference`, issues, {
+        maximumLength: MAX_PATH_LENGTH,
+    });
+    return true;
+}
+function validateExternalState(value, path, issues) {
+    const record = requireRecord(value, path, ['cleanupOperationId', 'cleanupOwner', 'reference'], [], issues);
+    if (!record)
+        return false;
+    requireSafeString(record.cleanupOperationId, `${path}.cleanupOperationId`, issues, {
+        maximumLength: MAX_IDENTIFIER_LENGTH,
+        pattern: IDENTIFIER_PATTERN,
+    });
+    requireEnum(record.cleanupOwner, `${path}.cleanupOwner`, OPERATION_OWNER_SET, issues);
+    requireSafeString(record.reference, `${path}.reference`, issues, {
+        maximumLength: MAX_PATH_LENGTH,
+    });
+    return true;
+}
+function nestedResultIssues(value, path, issues) {
+    const result = validateDeveloperAgentResult(value);
+    if (result.valid)
+        return true;
+    result.issues.forEach((issue) => {
+        addIssue(issues, issue.path === '$' ? path : `${path}${issue.path.replace(/^\$/, '')}`, issue.message);
+    });
+    return false;
+}
+function validateHandoffCoherence(record, issues) {
+    const state = record.state;
+    const results = Array.isArray(record.results)
+        ? record.results.filter(validation_js_1.isRecord)
+        : [];
+    const changedFiles = Array.isArray(record.changedFiles)
+        ? record.changedFiles
+        : [];
+    const changedContracts = Array.isArray(record.changedContracts)
+        ? record.changedContracts
+        : [];
+    const externalState = Array.isArray(record.externalState)
+        ? record.externalState
+        : [];
+    const pending = Array.isArray(record.requiredVerificationPending)
+        ? record.requiredVerificationPending
+        : [];
+    const requiredVerification = Array.isArray(record.requiredVerification)
+        ? record.requiredVerification
+        : [];
+    const requiredEvidence = Array.isArray(record.requiredEvidence)
+        ? record.requiredEvidence
+        : [];
+    const requiredEvidencePending = Array.isArray(record.requiredEvidencePending)
+        ? record.requiredEvidencePending
+        : [];
+    const markerSnapshot = Array.isArray(record.markerSnapshot)
+        ? record.markerSnapshot.filter(validation_js_1.isRecord)
+        : [];
+    const operations = Array.isArray(record.operations)
+        ? record.operations.filter(validation_js_1.isRecord)
+        : [];
+    const cleanup = (0, validation_js_1.isRecord)(record.cleanup) ? record.cleanup : undefined;
+    const recovery = (0, validation_js_1.isRecord)(record.recovery) ? record.recovery : undefined;
+    const unresolved = (0, validation_js_1.isRecord)(record.unresolved)
+        ? record.unresolved
+        : undefined;
+    const repository = (0, validation_js_1.isRecord)(record.repository)
+        ? record.repository
+        : undefined;
+    const selection = (0, validation_js_1.isRecord)(record.selection) ? record.selection : undefined;
+    const nextSafeAction = (0, validation_js_1.isRecord)(record.nextSafeAction)
+        ? record.nextSafeAction
+        : undefined;
+    if (nextSafeAction && has(nextSafeAction, 'command')) {
+        addIssue(issues, '$.nextSafeAction.command', 'handoffs retain an operation identity, never executable argv');
+    }
+    if (nextSafeAction &&
+        (nextSafeAction.owner === 'nx-generator' ||
+            (typeof nextSafeAction.operationId === 'string' &&
+                nextSafeAction.operationId.startsWith('generator:')))) {
+        addIssue(issues, '$.nextSafeAction', 'typed generator operations are not resumable because handoffs retain neither typed inputs nor preview references');
+    }
+    results.forEach((result, index) => {
+        const resultNextSafeAction = (0, validation_js_1.isRecord)(result.nextSafeAction)
+            ? result.nextSafeAction
+            : undefined;
+        if (resultNextSafeAction && has(resultNextSafeAction, 'command')) {
+            addIssue(issues, `$.results[${index}].nextSafeAction.command`, 'handoffs retain nested operation identity, never executable argv');
+        }
+        if (resultNextSafeAction &&
+            (resultNextSafeAction.owner === 'nx-generator' ||
+                (typeof resultNextSafeAction.operationId === 'string' &&
+                    resultNextSafeAction.operationId.startsWith('generator:')))) {
+            addIssue(issues, `$.results[${index}].nextSafeAction`, 'typed generator operations are not resumable from a retained result');
+        }
+        const operation = (0, validation_js_1.isRecord)(result.operation) ? result.operation : undefined;
+        if (Array.isArray(operation?.normalizedInputs) &&
+            operation.normalizedInputs.length > 0) {
+            addIssue(issues, `$.results[${index}].operation.normalizedInputs`, 'handoffs must not retain normalized operation inputs');
+        }
+    });
+    if (nextSafeAction &&
+        nextSafeAction.authority !== 'read-only' &&
+        (!has(nextSafeAction, 'operationId') || !has(nextSafeAction, 'owner'))) {
+        addIssue(issues, '$.nextSafeAction', 'an actionable handoff step requires a rebound operationId and owner');
+    }
+    const sortedUniqueStrings = (values) => [
+        ...new Set(values.filter((value) => typeof value === 'string')),
+    ].sort();
+    const sameStrings = (left, right) => {
+        const normalizedLeft = sortedUniqueStrings(left);
+        const normalizedRight = sortedUniqueStrings(right);
+        return (normalizedLeft.length === normalizedRight.length &&
+            normalizedLeft.every((value, index) => value === normalizedRight[index]));
+    };
+    const contractKey = (value) => (0, validation_js_1.isRecord)(value) &&
+        typeof value.class === 'string' &&
+        typeof value.reference === 'string'
+        ? `${value.class}\u0000${value.reference}`
+        : undefined;
+    const selectedProjects = Array.isArray(selection?.projects)
+        ? selection.projects.filter((value) => typeof value === 'string')
+        : [];
+    const retainedScopeProjects = sortedUniqueStrings(operations.flatMap((operation) => {
+        const scope = (0, validation_js_1.isRecord)(operation.scope) ? operation.scope : undefined;
+        return Array.isArray(scope?.projects) ? scope.projects : [];
+    }));
+    if (operations.length > 0 &&
+        !sameStrings(retainedScopeProjects, selectedProjects)) {
+        addIssue(issues, '$.selection.projects', 'must equal the exact performed-operation project-scope union');
+    }
+    const retainedScopeEvidence = sortedUniqueStrings(operations.flatMap((operation) => {
+        const scope = (0, validation_js_1.isRecord)(operation.scope) ? operation.scope : undefined;
+        return Array.isArray(scope?.evidenceClasses) ? scope.evidenceClasses : [];
+    }));
+    if (state !== 'proposal-or-research-only' &&
+        !sameStrings(retainedScopeEvidence, requiredEvidence)) {
+        addIssue(issues, '$.requiredEvidence', 'must equal the exact performed-operation evidence-scope union');
+    }
+    results.forEach((result, index) => {
+        const resultOperation = (0, validation_js_1.isRecord)(result.operation)
+            ? result.operation
+            : undefined;
+        const retained = operations.find((operation) => operation.id === resultOperation?.name);
+        const scope = (0, validation_js_1.isRecord)(retained?.scope) ? retained.scope : undefined;
+        if (!scope)
+            return;
+        if (result.outcome === 'blocked')
+            return;
+        const affected = (0, validation_js_1.isRecord)(result.affected) ? result.affected : undefined;
+        const affectedProjects = Array.isArray(affected?.projects)
+            ? affected.projects
+            : [];
+        const affectedContracts = Array.isArray(affected?.contracts)
+            ? affected.contracts
+                .map(contractKey)
+                .filter((value) => value !== undefined)
+            : [];
+        const scopeContracts = Array.isArray(scope.contracts)
+            ? scope.contracts
+                .map(contractKey)
+                .filter((value) => value !== undefined)
+            : [];
+        if (!Array.isArray(scope.projects) ||
+            !sameStrings(affectedProjects, scope.projects)) {
+            addIssue(issues, `$.results[${index}].affected.projects`, 'must equal the exact retained effective-operation project scope');
+        }
+        if (!sameStrings(affectedContracts, scopeContracts)) {
+            addIssue(issues, `$.results[${index}].affected.contracts`, 'must equal the exact retained effective-operation contract scope');
+        }
+        const verification = (0, validation_js_1.isRecord)(result.verification)
+            ? result.verification
+            : undefined;
+        const resultVerification = [
+            ...(Array.isArray(verification?.executed) ? verification.executed : []),
+            ...(Array.isArray(verification?.omitted) ? verification.omitted : []),
+        ];
+        if (!Array.isArray(scope.requiredVerification) ||
+            !sameStrings(resultVerification, scope.requiredVerification)) {
+            addIssue(issues, `$.results[${index}].verification`, 'must equal the exact retained effective-operation verification scope');
+        }
+    });
+    const executedVerification = sortedUniqueStrings(results.flatMap((result) => {
+        const verification = (0, validation_js_1.isRecord)(result.verification)
+            ? result.verification
+            : undefined;
+        return Array.isArray(verification?.executed) ? verification.executed : [];
+    }));
+    const omittedVerification = sortedUniqueStrings(results.flatMap((result) => {
+        const verification = (0, validation_js_1.isRecord)(result.verification)
+            ? result.verification
+            : undefined;
+        return Array.isArray(verification?.omitted) ? verification.omitted : [];
+    }));
+    if (!sameStrings(requiredVerification, [...executedVerification, ...pending])) {
+        addIssue(issues, '$.requiredVerification', 'must equal the exact executed-or-pending verification union');
+    }
+    if (!sameStrings(omittedVerification, pending)) {
+        addIssue(issues, '$.requiredVerificationPending', 'must equal the exact omitted verification union');
+    }
+    const artifacts = results.flatMap((result) => Array.isArray(result.artifacts) ? result.artifacts.filter(validation_js_1.isRecord) : []);
+    const satisfiedEvidence = sortedUniqueStrings(artifacts.map((artifact) => artifact.evidenceClass));
+    if (!sameStrings(requiredEvidence, [
+        ...satisfiedEvidence,
+        ...requiredEvidencePending,
+    ])) {
+        addIssue(issues, '$.requiredEvidence', 'must equal the exact referenced-or-pending evidence union');
+    }
+    const protectedEvidenceClasses = new Set([
+        'protected-promotion-proof',
+        'recovery-proof',
+    ]);
+    const externalEvidencePending = requiredEvidencePending.some((value) => typeof value === 'string' && protectedEvidenceClasses.has(value));
+    if (record.externalProofPending !== externalEvidencePending) {
+        addIssue(issues, '$.externalProofPending', 'must reflect whether required evidence remains pending');
+    }
+    for (const evidenceClass of protectedEvidenceClasses) {
+        if (satisfiedEvidence.includes(evidenceClass) &&
+            artifacts.some((artifact) => artifact.evidenceClass === evidenceClass)) {
+            addIssue(issues, '$.results', `${evidenceClass} cannot be marked satisfied until a semantic validator binds repository head, workspace, stage, policy, and candidate identity`);
+        }
+    }
+    const retainedOperationIds = operations.map((operation) => operation.id);
+    const resultOperationIds = results.flatMap((result) => {
+        const operation = (0, validation_js_1.isRecord)(result.operation) ? result.operation : undefined;
+        return typeof operation?.name === 'string' ? [operation.name] : [];
+    });
+    if (!sameStrings(retainedOperationIds, resultOperationIds)) {
+        addIssue(issues, '$.operations', 'must identify exactly the operations represented by retained results');
+    }
+    results.forEach((result, index) => {
+        const affected = (0, validation_js_1.isRecord)(result.affected) ? result.affected : undefined;
+        const affectedProjects = Array.isArray(affected?.projects)
+            ? affected.projects.filter((value) => typeof value === 'string')
+            : [];
+        if (affectedProjects.some((project) => !selectedProjects.includes(project))) {
+            addIssue(issues, `$.results[${index}].affected.projects`, 'must remain within the exact retained project selection');
+        }
+    });
+    const resultFiles = [
+        ...new Set(results.flatMap((result) => {
+            const changes = (0, validation_js_1.isRecord)(result.changes) ? result.changes : undefined;
+            return Array.isArray(changes?.files)
+                ? changes.files.filter((value) => typeof value === 'string')
+                : [];
+        })),
+    ].sort();
+    const retainedFiles = changedFiles
+        .filter((value) => typeof value === 'string')
+        .sort();
+    if (resultFiles.length !== retainedFiles.length ||
+        resultFiles.some((value, index) => value !== retainedFiles[index])) {
+        addIssue(issues, '$.changedFiles', 'must equal the unique file-change union of retained results');
+    }
+    const resultContracts = [
+        ...new Set(results.flatMap((result) => {
+            const affected = (0, validation_js_1.isRecord)(result.affected)
+                ? result.affected
+                : undefined;
+            return Array.isArray(affected?.contracts)
+                ? affected.contracts
+                    .map(contractKey)
+                    .filter((value) => value !== undefined)
+                : [];
+        })),
+    ].sort();
+    const retainedContracts = changedContracts
+        .map(contractKey)
+        .filter((value) => value !== undefined)
+        .sort();
+    if (resultContracts.length !== retainedContracts.length ||
+        resultContracts.some((value, index) => value !== retainedContracts[index])) {
+        addIssue(issues, '$.changedContracts', 'must equal the unique contract-change union of retained results');
+    }
+    const resultExternalResources = sortedUniqueStrings(results.flatMap((result) => {
+        const changes = (0, validation_js_1.isRecord)(result.changes) ? result.changes : undefined;
+        return Array.isArray(changes?.externalResources)
+            ? changes.externalResources
+            : [];
+    }));
+    const retainedExternalResources = externalState.flatMap((entry) => (0, validation_js_1.isRecord)(entry) && typeof entry.reference === 'string'
+        ? [entry.reference]
+        : []);
+    if (!sameStrings(resultExternalResources, retainedExternalResources)) {
+        addIssue(issues, '$.externalState', 'must bind every nested external resource to one cleanup owner');
+    }
+    if (externalState.length > 0 &&
+        !externalState.some((entry) => (0, validation_js_1.isRecord)(entry) &&
+            entry.cleanupOperationId === nextSafeAction?.operationId &&
+            entry.cleanupOwner === nextSafeAction?.owner)) {
+        addIssue(issues, '$.nextSafeAction', 'must exactly bind one retained external-state cleanup operation and owner');
+    }
+    if (unresolved) {
+        for (const property of [
+            'approvalNeeds',
+            'assumptions',
+            'conflicts',
+            'markers',
+        ]) {
+            const nested = results.flatMap((result) => {
+                const resultUnresolved = (0, validation_js_1.isRecord)(result.unresolved)
+                    ? result.unresolved
+                    : undefined;
+                return Array.isArray(resultUnresolved?.[property])
+                    ? resultUnresolved[property]
+                    : [];
+            });
+            const retained = Array.isArray(unresolved[property])
+                ? unresolved[property]
+                : [];
+            if (!sameStrings(nested, retained)) {
+                addIssue(issues, `$.unresolved.${property}`, 'must equal the exact nested unresolved-state union');
+            }
+        }
+    }
+    if (repository) {
+        results.forEach((result, index) => {
+            const source = (0, validation_js_1.isRecord)(result.source) ? result.source : undefined;
+            if (source?.commit !== repository.headCommit ||
+                source?.worktree !== repository.worktree) {
+                addIssue(issues, `$.results[${index}].source`, 'must match the retained repository head commit and worktree');
+            }
+            const testingEvidence = (0, validation_js_1.isRecord)(result.testingEvidence)
+                ? result.testingEvidence
+                : undefined;
+            const testingResult = (0, validation_js_1.isRecord)(testingEvidence?.result)
+                ? testingEvidence.result
+                : undefined;
+            const testingSource = (0, validation_js_1.isRecord)(testingResult?.source)
+                ? testingResult.source
+                : undefined;
+            if (testingSource && testingSource.commit !== repository.headCommit) {
+                addIssue(issues, `$.results[${index}].testingEvidence.result.source.commit`, 'must match the retained repository head commit');
+            }
+            if (testingResult && testingResult.workspace !== repository.identity) {
+                addIssue(issues, `$.results[${index}].testingEvidence.result.workspace`, 'must match the retained repository identity');
+            }
+            const versions = (0, validation_js_1.isRecord)(record.versions) ? record.versions : undefined;
+            const affected = (0, validation_js_1.isRecord)(result.affected) ? result.affected : undefined;
+            const affectedProjects = Array.isArray(affected?.projects)
+                ? affected.projects.filter((value) => typeof value === 'string')
+                : [];
+            if (testingSource &&
+                typeof versions?.frameworkVersion === 'string' &&
+                testingSource.frameworkCandidate !==
+                    `@empire-builder-kit/nx@${versions.frameworkVersion}`) {
+                addIssue(issues, `$.results[${index}].testingEvidence.result.source.frameworkCandidate`, 'must match the retained framework candidate');
+            }
+            if (testingSource &&
+                Array.isArray(testingSource.blueprintCandidates) &&
+                Array.isArray(versions?.blueprintVersions)) {
+                const affectedProjectSet = new Set(affectedProjects);
+                const expectedBlueprints = versions.blueprintVersions.flatMap((entry) => {
+                    if (!(0, validation_js_1.isRecord)(entry) ||
+                        typeof entry.name !== 'string' ||
+                        typeof entry.version !== 'string') {
+                        return [];
+                    }
+                    const separator = entry.name.indexOf(':@');
+                    const project = separator === -1 ? undefined : entry.name.slice(0, separator);
+                    if (project && !affectedProjectSet.has(project))
+                        return [];
+                    const packageName = separator === -1 ? entry.name : entry.name.slice(separator + 1);
+                    return [`${packageName}@${entry.version}`];
+                });
+                if (!sameStrings(testingSource.blueprintCandidates, expectedBlueprints)) {
+                    addIssue(issues, `$.results[${index}].testingEvidence.result.source.blueprintCandidates`, 'must match the retained Blueprint candidates for affected projects');
+                }
+            }
+            const testingOperation = (0, validation_js_1.isRecord)(testingResult?.operation)
+                ? testingResult.operation
+                : undefined;
+            const testingEnvironment = (0, validation_js_1.isRecord)(testingResult?.environment)
+                ? testingResult.environment
+                : undefined;
+            const testingCleanup = (0, validation_js_1.isRecord)(testingResult?.cleanup)
+                ? testingResult.cleanup
+                : undefined;
+            if (testingResult && testingResult.outcome !== 'passed') {
+                addIssue(issues, `$.results[${index}].testingEvidence.result.outcome`, 'must be passed before Testing/Evidence can satisfy a handoff');
+            }
+            if (testingCleanup &&
+                testingCleanup.outcome !== 'passed' &&
+                testingCleanup.outcome !== 'not-required') {
+                addIssue(issues, `$.results[${index}].testingEvidence.result.cleanup.outcome`, 'must be passed or not-required');
+            }
+            if (typeof testingOperation?.project === 'string' &&
+                (!affectedProjects.includes(testingOperation.project) ||
+                    (Array.isArray(selection?.projects) &&
+                        !selection.projects.includes(testingOperation.project)))) {
+                addIssue(issues, `$.results[${index}].testingEvidence.result.operation.project`, 'must identify an affected project in the retained selection');
+            }
+            if (testingResult &&
+                (typeof selection?.slice === 'string'
+                    ? testingResult.slice !== selection.slice
+                    : has(testingResult, 'slice'))) {
+                addIssue(issues, `$.results[${index}].testingEvidence.result.slice`, 'must exactly match the retained Slice selection');
+            }
+            if (typeof versions?.canonicalStage === 'string' &&
+                ((testingEnvironment?.deployed === true &&
+                    testingEnvironment.stage !== versions.canonicalStage) ||
+                    (typeof testingEnvironment?.stage === 'string' &&
+                        testingEnvironment.stage !== versions.canonicalStage))) {
+                addIssue(issues, `$.results[${index}].testingEvidence.result.environment.stage`, 'must be present for deployed proof and exactly match the retained canonical stage');
+            }
+            if (typeof testingOperation?.target === 'string' &&
+                !requiredVerification.some((value) => typeof value === 'string' &&
+                    (value === testingOperation.target ||
+                        value.endsWith(`:${testingOperation.target}`)))) {
+                addIssue(issues, `$.results[${index}].testingEvidence.result.operation.target`, 'must be accounted for by retained required verification');
+            }
+            if (typeof testingOperation?.proofLayer === 'string' &&
+                !requiredEvidence.includes(testingOperation.proofLayer)) {
+                addIssue(issues, `$.results[${index}].testingEvidence.result.operation.proofLayer`, 'must be accounted for by retained required evidence');
+            }
+            if (testingEvidence && testingResult) {
+                const outerArtifacts = Array.isArray(result.artifacts)
+                    ? result.artifacts.filter(validation_js_1.isRecord)
+                    : [];
+                if (!outerArtifacts.some((artifact) => artifact.reference === testingEvidence.reference &&
+                    artifact.digest === testingEvidence.digest &&
+                    artifact.evidenceClass === testingOperation?.proofLayer)) {
+                    addIssue(issues, `$.results[${index}].testingEvidence`, 'must have an exact outer artifact reference, digest, and evidence-class identity');
+                }
+                const nestedArtifacts = Array.isArray(testingResult.artifacts)
+                    ? testingResult.artifacts.filter(validation_js_1.isRecord)
+                    : [];
+                nestedArtifacts.forEach((artifact, artifactIndex) => {
+                    if (!outerArtifacts.some((outer) => outer.name === artifact.name &&
+                        outer.digest === artifact.digest)) {
+                        addIssue(issues, `$.results[${index}].testingEvidence.result.artifacts[${artifactIndex}]`, 'must match an exact outer artifact name and digest');
+                    }
+                });
+            }
+        });
+    }
+    if (resultExternalResources.length > 0 &&
+        cleanup?.outcome === 'not-required') {
+        addIssue(issues, '$.cleanup.outcome', 'cannot be not-required when external state was created');
+    }
+    if (state === 'implemented-and-verified') {
+        if (markerSnapshot.some((marker) => marker.blocking === true)) {
+            addIssue(issues, '$.markerSnapshot', 'cannot retain a blocking repository marker when verified');
+        }
+        if (results.length === 0 ||
+            results.some((result) => result.outcome !== 'succeeded')) {
+            addIssue(issues, '$.results', 'must contain only succeeded results when implemented and verified');
+        }
+        if (results.some((result) => !(0, validation_js_1.isRecord)(result.testingEvidence))) {
+            addIssue(issues, '$.results', 'implemented work must retain ingested Testing/Evidence results');
+        }
+        if (results.some((result) => !(0, validation_js_1.isRecord)(result.verification) ||
+            !Array.isArray(result.verification.executed) ||
+            result.verification.executed.length === 0)) {
+            addIssue(issues, '$.results', 'must retain executed verification for implemented work');
+        }
+        if (pending.length > 0 || record.externalProofPending !== false) {
+            addIssue(issues, '$.state', 'cannot claim verified completion while proof is pending');
+        }
+        if (cleanup?.outcome === 'incomplete' ||
+            recovery?.outcome === 'incomplete' ||
+            results.some((result) => (0, validation_js_1.isRecord)(result.cleanup) && result.cleanup.outcome === 'incomplete') ||
+            results.some((result) => (0, validation_js_1.isRecord)(result.recovery) && result.recovery.outcome === 'incomplete') ||
+            results.some((result) => (0, validation_js_1.isRecord)(result.verification) &&
+                Array.isArray(result.verification.omitted) &&
+                result.verification.omitted.length > 0)) {
+            addIssue(issues, '$.state', 'cannot claim verified completion with omitted proof or incomplete cleanup/recovery');
+        }
+        if (unresolved &&
+            ['approvalNeeds', 'assumptions', 'conflicts', 'markers'].some((property) => Array.isArray(unresolved[property]) &&
+                unresolved[property].length > 0)) {
+            addIssue(issues, '$.unresolved', 'cannot retain unresolved approval, assumption, conflict, or marker state when verified');
+        }
+    }
+    if (state === 'implemented-external-proof-pending') {
+        if (record.externalProofPending !== true ||
+            requiredEvidencePending.length === 0) {
+            addIssue(issues, '$.requiredEvidencePending', 'must identify required external evidence');
+        }
+        if (results.length === 0 ||
+            !results.some((result) => result.outcome === 'incomplete' &&
+                result.failureClassification === 'external-proof-pending')) {
+            addIssue(issues, '$.results', 'must include an external-proof-pending incomplete result');
+        }
+        if (results.some((result) => !(0, validation_js_1.isRecord)(result.testingEvidence))) {
+            addIssue(issues, '$.results', 'implemented work must retain ingested Testing/Evidence results');
+        }
+        if (results.some((result) => result.outcome !== 'succeeded' &&
+            !(result.outcome === 'incomplete' &&
+                result.failureClassification === 'external-proof-pending'))) {
+            addIssue(issues, '$.results', 'may contain only succeeded or external-proof-pending results');
+        }
+        if (cleanup?.outcome === 'incomplete' ||
+            recovery?.outcome === 'incomplete' ||
+            results.some((result) => ((0, validation_js_1.isRecord)(result.cleanup) &&
+                result.cleanup.outcome === 'incomplete') ||
+                ((0, validation_js_1.isRecord)(result.recovery) &&
+                    result.recovery.outcome === 'incomplete'))) {
+            addIssue(issues, '$.state', 'external-proof-pending cannot hide incomplete cleanup or recovery');
+        }
+    }
+    if (state === 'blocked-before-mutation') {
+        if (results.length === 0 ||
+            results.some((result) => result.outcome !== 'blocked')) {
+            addIssue(issues, '$.results', 'must contain only blocked results when blocked before mutation');
+        }
+        if (changedContracts.length > 0 ||
+            changedFiles.length > 0 ||
+            externalState.length > 0) {
+            addIssue(issues, '$.state', 'blocked-before-mutation cannot report changed or external state');
+        }
+    }
+    if (state === 'failed-recovery-complete') {
+        if (!results.some((result) => result.outcome === 'failed') ||
+            recovery?.outcome !== 'complete' ||
+            cleanup?.outcome === 'incomplete') {
+            addIssue(issues, '$.state', 'requires a failed result, complete recovery, and no incomplete cleanup');
+        }
+        if (results.some((result) => ((0, validation_js_1.isRecord)(result.cleanup) &&
+            result.cleanup.outcome === 'incomplete') ||
+            ((0, validation_js_1.isRecord)(result.recovery) &&
+                result.recovery.outcome === 'incomplete'))) {
+            addIssue(issues, '$.results', 'cannot retain incomplete nested cleanup or recovery');
+        }
+    }
+    if (state === 'failed-recovery-or-cleanup-required') {
+        if (!results.some((result) => result.outcome === 'failed') ||
+            (recovery?.outcome !== 'incomplete' && cleanup?.outcome !== 'incomplete')) {
+            addIssue(issues, '$.state', 'requires a failed result and incomplete recovery or cleanup');
+        }
+    }
+    if (state === 'proposal-or-research-only') {
+        if (changedContracts.length > 0 ||
+            changedFiles.length > 0 ||
+            externalState.length > 0 ||
+            results.some((result) => Array.isArray(result.changes) ||
+                ((0, validation_js_1.isRecord)(result.changes) &&
+                    ((Array.isArray(result.changes.files) &&
+                        result.changes.files.length > 0) ||
+                        (Array.isArray(result.changes.externalResources) &&
+                            result.changes.externalResources.length > 0))))) {
+            addIssue(issues, '$.state', 'proposal or research handoff cannot report mutation');
+        }
+        if (results.some((result) => result.outcome !== 'incomplete' && result.outcome !== 'blocked')) {
+            addIssue(issues, '$.results', 'proposal or research results must be incomplete or blocked');
+        }
+    }
+}
+function validateDeveloperAgentHandoff(value) {
+    const issues = [];
+    validateSerializedBound(value, '$', model_js_1.DEVELOPER_AGENT_HANDOFF_MAX_BYTES, issues);
+    const record = requireRecord(value, '$', [
+        'changedContracts',
+        'changedFiles',
+        'cleanup',
+        'externalProofPending',
+        'externalState',
+        'kind',
+        'markerSnapshot',
+        'nextSafeAction',
+        'operations',
+        'recovery',
+        'repository',
+        'requiredEvidence',
+        'requiredEvidencePending',
+        'requiredVerification',
+        'requiredVerificationPending',
+        'results',
+        'schemaVersion',
+        'selection',
+        'state',
+        'unresolved',
+        'versions',
+        'work',
+    ], [], issues);
+    if (!record)
+        return (0, validation_js_1.validationResult)(value, issues);
+    if (record.kind !== model_js_1.DEVELOPER_AGENT_HANDOFF_KIND) {
+        addIssue(issues, '$.kind', `must equal ${model_js_1.DEVELOPER_AGENT_HANDOFF_KIND}`);
+    }
+    if (record.schemaVersion !== model_js_1.DEVELOPER_AGENT_CONTRACT_SCHEMA_VERSION) {
+        addIssue(issues, '$.schemaVersion', `must equal ${model_js_1.DEVELOPER_AGENT_CONTRACT_SCHEMA_VERSION}`);
+    }
+    validateContractReferences(record.changedContracts, '$.changedContracts', issues);
+    validateStringArray(record.changedFiles, '$.changedFiles', issues, {
+        maximumLength: MAX_PATH_LENGTH,
+        pattern: WORKSPACE_RELATIVE_PATH_PATTERN,
+    });
+    if (Array.isArray(record.changedFiles)) {
+        record.changedFiles.forEach((entry, index) => validateCanonicalWorkspacePath(entry, `$.changedFiles[${index}]`, issues));
+    }
+    validateCleanupRecovery(record.cleanup, '$.cleanup', issues);
+    requireBoolean(record.externalProofPending, '$.externalProofPending', issues);
+    const externalState = requireArray(record.externalState, '$.externalState', issues);
+    const externalReferences = new Set();
+    const externalCleanupOwners = new Set();
+    externalState?.forEach((entry, index) => {
+        if (validateExternalState(entry, `$.externalState[${index}]`, issues)) {
+            const retained = entry;
+            if (externalReferences.has(retained.reference)) {
+                addIssue(issues, `$.externalState[${index}].reference`, 'must be unique');
+            }
+            externalReferences.add(retained.reference);
+            const cleanupIdentity = `${retained.cleanupOwner}\u0000${retained.cleanupOperationId}`;
+            if (externalCleanupOwners.has(cleanupIdentity)) {
+                addIssue(issues, `$.externalState[${index}]`, 'must have a unique cleanup operation owner');
+            }
+            externalCleanupOwners.add(cleanupIdentity);
+        }
+    });
+    const markerSnapshot = requireArray(record.markerSnapshot, '$.markerSnapshot', issues);
+    const markerReferences = new Set();
+    markerSnapshot?.forEach((entry, index) => {
+        if (validateHandoffMarkerSnapshot(entry, `$.markerSnapshot[${index}]`, issues)) {
+            const reference = entry
+                .reference;
+            if (markerReferences.has(reference)) {
+                addIssue(issues, `$.markerSnapshot[${index}].reference`, 'must be unique');
+            }
+            markerReferences.add(reference);
+        }
+    });
+    validateNextSafeAction(record.nextSafeAction, '$.nextSafeAction', issues);
+    const operations = requireArray(record.operations, '$.operations', issues);
+    const operationIds = new Set();
+    operations?.forEach((entry, index) => {
+        if (validateHandoffOperation(entry, `$.operations[${index}]`, issues)) {
+            const id = entry.id;
+            if (operationIds.has(id)) {
+                addIssue(issues, `$.operations[${index}].id`, 'must be unique');
+            }
+            operationIds.add(id);
+        }
+    });
+    validateCleanupRecovery(record.recovery, '$.recovery', issues);
+    validateHandoffRepository(record.repository, '$.repository', issues);
+    validateStringArray(record.requiredEvidence, '$.requiredEvidence', issues);
+    validateStringArray(record.requiredEvidencePending, '$.requiredEvidencePending', issues);
+    validateStringArray(record.requiredVerification, '$.requiredVerification', issues);
+    validateStringArray(record.requiredVerificationPending, '$.requiredVerificationPending', issues);
+    validateHandoffSelection(record.selection, '$.selection', issues);
+    const results = requireArray(record.results, '$.results', issues, MAX_RESULTS);
+    results?.forEach((entry, index) => nestedResultIssues(entry, `$.results[${index}]`, issues));
+    requireEnum(record.state, '$.state', HANDOFF_STATE_SET, issues);
+    validateUnresolvedState(record.unresolved, '$.unresolved', issues);
+    validateHandoffVersions(record.versions, '$.versions', issues);
+    validateHandoffWork(record.work, '$.work', issues);
+    validateHandoffCoherence(record, issues);
+    return (0, validation_js_1.validationResult)(value, issues);
+}
+function serializeValidated(label, value, validate) {
+    const result = validate(value);
+    if (!result.valid) {
+        throw new DeveloperAgentContractValidationError(label, result.issues);
+    }
+    return (0, canonical_json_1.canonicalJson)(result.value);
+}
+function serializeDeveloperAgentContext(value) {
+    return serializeValidated('Developer-Agent context', value, validateDeveloperAgentContext);
+}
+function serializeDeveloperAgentGeneratorPreview(value) {
+    return serializeValidated('Developer-Agent generator preview', value, validateDeveloperAgentGeneratorPreview);
+}
+function serializeDeveloperAgentGeneratorPreviewReceipt(value) {
+    return serializeValidated('Developer-Agent generator preview receipt', value, validateDeveloperAgentGeneratorPreviewReceipt);
+}
+function serializeDeveloperAgentPlan(value) {
+    return serializeValidated('Developer-Agent plan', value, validateDeveloperAgentPlan);
+}
+function serializeDeveloperAgentResult(value) {
+    return serializeValidated('Developer-Agent result', value, validateDeveloperAgentResult);
+}
+function serializeDeveloperAgentHandoff(value) {
+    return serializeValidated('Developer-Agent handoff', value, validateDeveloperAgentHandoff);
+}
+//# sourceMappingURL=validation.js.map