@gadmin2n/schematics 0.0.143 → 0.0.145

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/workflow/workflow-compiler.service.ts

@@ -2,6 +2,7 @@ import { BadRequestException, Injectable } from '@nestjs/common';
 import { Prisma } from '@prisma/client';
 import { PrismaService } from 'nestjs-prisma';
 import { ActorContext } from '../subjectProvider/subject-provider.types';
+import type { NodeConfigValidationError } from '../workflowConfig/node-config-validator.service';
 import { NodeConfigValidatorService } from '../workflowConfig/node-config-validator.service';
 import { JsonSchema } from '../workflowConfig/schema.types';
 import { SubjectConfigValidatorService } from '../workflowConfig/subject-config-validator.service';
@@ -10,7 +11,6 @@ import { hashNodeInstanceConfig } from '../workflowNodeInstance/node-instance-co
 import { validateParameterBinding } from './parameter-binding';
 import {
   describeCallableWorkflow,
-  describeReturningWorkflowInputs,
   validateCallableWorkflow,
 } from './workflow-callable';
 import {
@@ -20,7 +20,7 @@ import {
   DraftWorkflowNode,
   WorkflowCompilerErrorCode,
 } from './workflow-compiler.types';
-import { validateWebhookResponseWorkflow } from './workflow-http-response';
+import { switchCaseValidationError } from './workflow-switch-config';
 
 @Injectable()
 export class WorkflowCompilerService {
@@ -34,6 +34,7 @@ export class WorkflowCompilerService {
   async compile(
     draftDsl: DraftWorkflowDsl,
     actor: ActorContext,
+    options?: { workflowId?: bigint },
   ): Promise<CompiledWorkflowDsl> {
     if (!draftDsl || !Array.isArray(draftDsl.nodes))
       throw new BadRequestException({
@@ -56,6 +57,7 @@ export class WorkflowCompilerService {
       select: {
         id: true,
         type: true,
+        label: true,
         runtimeKey: true,
         instancePolicy: true,
         schemaVersion: true,
@@ -92,19 +94,6 @@ export class WorkflowCompilerService {
           `Unknown node type: ${node.type}`,
         );
       const ref = node.instanceRef;
-      if (nodeType.instancePolicy === 'REQUIRED' && !ref)
-        this.fail(
-          'NODE_INSTANCE_REQUIRED',
-          node,
-          `Node type ${node.type} requires an instance`,
-        );
-      if (nodeType.instancePolicy === 'INLINE_ONLY' && ref)
-        this.fail(
-          'INLINE_NODE_INSTANCE_FORBIDDEN',
-          node,
-          `Node type ${node.type} does not accept an instance reference`,
-        );
-
       let config = clone(node.config ?? {});
       let source: CompiledWorkflowNode['source'];
       if (ref) {
@@ -146,225 +135,114 @@ export class WorkflowCompilerService {
 
       const schemaKey = `${nodeType.id}:${nodeType.schemaVersion}`;
       const schema = nodeType.configSchema as JsonSchema;
-      this.configs.validateOrThrow(schemaKey, schema, config);
+      const approvalSubjects = (config as Record<string, unknown>).subjects;
+      if (
+        nodeType.runtimeKey === 'human_approval' &&
+        (!Array.isArray(approvalSubjects) || approvalSubjects.length === 0)
+      )
+        this.fail(
+          'NODE_TYPE_MISMATCH',
+          node,
+          '必须至少设置一位固定审批人或动态审批人',
+        );
+      const manualParameterError =
+        nodeType.runtimeKey === 'manual_trigger'
+          ? validateManualInputParameters(config)
+          : null;
+      if (manualParameterError)
+        this.fail('NODE_TYPE_MISMATCH', node, manualParameterError);
+      const invalidBindingPath = findInvalidParameterBinding(config);
+      if (invalidBindingPath)
+        this.fail(
+          'NODE_TYPE_MISMATCH',
+          node,
+          `参数来源或固定值无效：${invalidBindingPath}`,
+        );
+      try {
+        this.configs.validateOrThrow(schemaKey, schema, config);
+      } catch (error) {
+        const errors = nodeConfigValidationErrors(error);
+        if (!errors) throw error;
+        const nodeLabel = String(node.label ?? '').trim() || nodeType.label;
+        throw new BadRequestException({
+          code: 'NODE_CONFIG_INVALID',
+          message: `节点“${nodeLabel}”的配置不完整或有误`,
+          nodeLabel,
+          errors,
+        });
+      }
       this.widgets.assertUiSchemaSupported(nodeType.uiSchema);
-      await this.subjects.validateSubjects(schema, config, actor);
-      if (nodeType.runtimeKey === 'http_request') {
-        const connectionRef = (config as Record<string, unknown>)
-          ?.connectionRef;
-        const connection =
-          typeof connectionRef === 'string'
-            ? await this.prisma.integrationConnection.findUnique({
-                where: { code: connectionRef },
-                select: { isEnabled: true },
-              })
-            : null;
-        if (!connection?.isEnabled)
-          this.fail(
-            'NODE_TYPE_MISMATCH',
-            node,
-            'HTTP Request Connection was not found or is disabled',
-          );
+      try {
+        await this.subjects.validateSubjects(schema, config, actor);
+      } catch (error) {
+        const errors = subjectValidationErrors(error);
+        if (!errors) throw error;
+        const nodeLabel = String(node.label ?? '').trim() || nodeType.label;
+        throw new BadRequestException({
+          code: 'SUBJECT_REF_INVALID',
+          message: `节点“${nodeLabel}”的审批人配置不完整或无效`,
+          nodeLabel,
+          errors,
+        });
       }
-      if (nodeType.runtimeKey === 'sub_workflow') {
-        const workflowId = String(
-          (config as Record<string, unknown>)?.workflowId ?? '',
+      if (nodeType.runtimeKey === 'http_request') {
+        await this.validateIntegrationConnection(
+          node,
+          (config as Record<string, unknown>)?.connectionRef,
+          'HTTP Request Connection',
         );
-        if (!/^[1-9]\d*$/.test(workflowId))
-          this.fail('NODE_TYPE_MISMATCH', node, '调用的 Workflow ID 无效');
-        const workflow = await this.prisma.workflow.findUnique({
-          where: { id: BigInt(workflowId) },
-          select: {
-            isEnabled: true,
-            status: true,
-            versions: {
-              orderBy: { version: 'desc' },
-              take: 1,
-              select: { dsl: true },
-            },
-          },
-        });
-        if (!workflow?.isEnabled || workflow.status !== 'PUBLISHED')
-          this.fail(
-            'NODE_TYPE_MISMATCH',
-            node,
-            '调用的 Workflow 未发布或已停用',
-          );
-        let descriptor;
-        try {
-          descriptor = describeCallableWorkflow(workflow.versions[0]?.dsl);
-        } catch (error) {
-          this.fail(
-            'NODE_TYPE_MISMATCH',
+      }
+      if (nodeType.runtimeKey === 'human_approval') {
+        const approvalConfig = asObject(config);
+        if (approvalConfig.external) {
+          await this.validateIntegrationConnection(
             node,
-            error instanceof Error ? error.message : '调用的 Workflow 配置无效',
+            asObject(asObject(approvalConfig.external).request).connectionRef,
+            '外部审批连接',
           );
         }
-        if (!descriptor)
-          this.fail(
-            'NODE_TYPE_MISMATCH',
+        const approvalSubjects = Array.isArray(approvalConfig.subjects)
+          ? approvalConfig.subjects
+          : [];
+        for (const subjectValue of approvalSubjects) {
+          const subject = asObject(subjectValue);
+          if (subject.source !== 'DYNAMIC') continue;
+          await this.validateIntegrationConnection(
             node,
-            '选择的 Workflow 不能被内部调用',
+            asObject(asObject(subject.lookup).request).connectionRef,
+            `动态审批人“${String(
+              subject.label ?? subject.inputKey ?? '',
+            )}”连接`,
           );
-        const bindings =
-          (config as Record<string, unknown>).inputBindings &&
-          typeof (config as Record<string, unknown>).inputBindings ===
-            'object' &&
-          !Array.isArray((config as Record<string, unknown>).inputBindings)
-            ? ((config as Record<string, unknown>).inputBindings as Record<
-                string,
-                unknown
-              >)
-            : {};
-        const invalidParameter = descriptor.inputParameters.find(
-          (parameter) =>
-            (parameter.required || bindings[parameter.key] !== undefined) &&
-            !validateParameterBinding(bindings[parameter.key]),
+        }
+      }
+      if (nodeType.runtimeKey === 'switch') {
+        const error = switchCaseValidationError(
+          (config as Record<string, unknown>).cases,
         );
-        if (invalidParameter)
+        if (error) this.fail('NODE_TYPE_MISMATCH', node, error);
+      }
+      if (nodeType.runtimeKey === 'db_execute') {
+        const databaseConfig = config as Record<string, unknown>;
+        const allowWrite = databaseConfig.allowWrite === true;
+        const sql = String(databaseConfig.sql ?? '');
+        if (!isDatabaseSqlAllowed(sql, allowWrite))
           this.fail(
             'NODE_TYPE_MISMATCH',
             node,
-            `调用 Workflow 的参数来源无效：${
-              invalidParameter.label ?? invalidParameter.key
-            }`,
+            allowWrite
+              ? '数据库操作只允许单条查询、新增、更新或删除语句'
+              : '当前数据库操作节点只允许单条只读查询',
           );
       }
-      if (nodeType.runtimeKey === 'human_approval') {
-        const approvalWorkflowId = (config as Record<string, unknown>)
-          ?.approvalWorkflowId;
-        if (
-          typeof approvalWorkflowId === 'string' &&
-          /^[1-9]\d*$/.test(approvalWorkflowId)
-        ) {
-          const approvalWorkflow = await this.prisma.workflow.findUnique({
-            where: { id: BigInt(approvalWorkflowId) },
-            select: {
-              isEnabled: true,
-              status: true,
-              versions: {
-                orderBy: { version: 'desc' },
-                take: 1,
-                select: { dsl: true },
-              },
-            },
-          });
-          if (
-            !approvalWorkflow?.isEnabled ||
-            approvalWorkflow.status !== 'PUBLISHED'
-          )
-            this.fail(
-              'NODE_TYPE_MISMATCH',
-              node,
-              'Approval Workflow was not found, published, or enabled',
-            );
-          const bindings =
-            (config as Record<string, unknown>).approvalWorkflowInputBindings &&
-            typeof (config as Record<string, unknown>)
-              .approvalWorkflowInputBindings === 'object' &&
-            !Array.isArray(
-              (config as Record<string, unknown>).approvalWorkflowInputBindings,
-            )
-              ? ((config as Record<string, unknown>)
-                  .approvalWorkflowInputBindings as Record<string, unknown>)
-              : {};
-          const missing = describeReturningWorkflowInputs(
-            approvalWorkflow.versions[0]?.dsl,
-          ).find((parameter) => parameter.required && !bindings[parameter.key]);
-          if (missing)
-            this.fail(
-              'NODE_TYPE_MISMATCH',
-              node,
-              `审批 Workflow 缺少必填参数：${missing.label ?? missing.key}`,
-            );
-        } else if (approvalWorkflowId !== undefined) {
-          this.fail('NODE_TYPE_MISMATCH', node, 'Approval Workflow ID 无效');
-        }
-        const approverSources = Array.isArray(
-          (config as Record<string, unknown>)?.approverSources,
-        )
-          ? ((config as Record<string, unknown>).approverSources as Array<
-              Record<string, unknown>
-            >)
-          : [];
-        for (const source of approverSources) {
-          const workflowId = String(source.workflowId ?? '');
-          if (!/^[1-9]\d*$/.test(workflowId))
-            this.fail(
-              'NODE_TYPE_MISMATCH',
-              node,
-              '自动找审批人的 Workflow ID 无效',
-            );
-          const workflow = await this.prisma.workflow.findUnique({
-            where: { id: BigInt(workflowId) },
-            include: {
-              versions: {
-                orderBy: { version: 'desc' },
-                take: 1,
-              },
-            },
-          });
-          if (
-            !workflow ||
-            workflow.status !== 'PUBLISHED' ||
-            !workflow.isEnabled
-          )
-            this.fail(
-              'NODE_TYPE_MISMATCH',
-              node,
-              '自动找审批人的 Workflow 未发布或已停用',
-            );
-          let descriptor;
-          try {
-            descriptor = describeCallableWorkflow(workflow.versions[0]?.dsl);
-          } catch (error) {
-            this.fail(
-              'NODE_TYPE_MISMATCH',
-              node,
-              error instanceof Error
-                ? error.message
-                : '自动找审批人的 Workflow 配置无效',
-            );
-          }
-          if (descriptor?.mode !== 'RETURN')
-            this.fail(
-              'NODE_TYPE_MISMATCH',
-              node,
-              '选择的 Workflow 没有返回结果',
-            );
-          const inputBindings =
-            source.inputBindings &&
-            typeof source.inputBindings === 'object' &&
-            !Array.isArray(source.inputBindings)
-              ? (source.inputBindings as Record<string, unknown>)
-              : {};
-          const missingInput = descriptor.inputParameters.find(
-            (parameter) =>
-              parameter.required &&
-              !validateParameterBinding(inputBindings[parameter.key]),
-          );
-          if (missingInput)
-            this.fail(
-              'NODE_TYPE_MISMATCH',
-              node,
-              `自动找审批人缺少参数映射：${
-                missingInput.label ?? missingInput.key
-              }`,
-            );
-          const invalidInput = descriptor.inputParameters.find(
-            (parameter) =>
-              inputBindings[parameter.key] !== undefined &&
-              !validateParameterBinding(inputBindings[parameter.key]),
-          );
-          if (invalidInput)
-            this.fail(
-              'NODE_TYPE_MISMATCH',
-              node,
-              `自动找审批人的参数来源无效：${
-                invalidInput.label ?? invalidInput.key
-              }`,
-            );
-        }
+      if (nodeType.runtimeKey === 'sub_workflow') {
+        await this.validateCallableTarget(
+          node,
+          (config as Record<string, unknown>).workflowId,
+          (config as Record<string, unknown>).workflowVersionId,
+          (config as Record<string, unknown>).inputBindings,
+          '调用 Workflow',
+        );
       }
       compiledNodes.push({
         ...clone(node),
@@ -381,7 +259,6 @@ export class WorkflowCompilerService {
       } catch (error) {
         const boundaryNode =
           draftDsl.nodes.find((node) => node.type === 'callable_trigger') ??
-          draftDsl.nodes.find((node) => node.type === 'return_result') ??
           draftDsl.nodes[0];
         this.fail(
           'NODE_TYPE_MISMATCH',
@@ -390,25 +267,151 @@ export class WorkflowCompilerService {
         );
       }
     }
+    return compiledDsl;
+  }
+
+  private async validateCallableTarget(
+    node: DraftWorkflowNode,
+    workflowIdValue: unknown,
+    workflowVersionIdValue: unknown,
+    inputBindingsValue: unknown,
+    label: string,
+  ): Promise<void> {
+    const workflowId = String(workflowIdValue ?? '');
+    if (!/^[1-9]\d*$/.test(workflowId))
+      this.fail('NODE_TYPE_MISMATCH', node, `${label} ID 无效`);
+    const workflowVersionId = String(workflowVersionIdValue ?? '');
+    if (!/^[1-9]\d*$/.test(workflowVersionId))
+      this.fail('NODE_TYPE_MISMATCH', node, `${label}版本 ID 无效`);
+    const workflow = await this.prisma.workflow.findUnique({
+      where: { id: BigInt(workflowId) },
+      select: {
+        isEnabled: true,
+        versions: {
+          where: { id: BigInt(workflowVersionId) },
+          take: 1,
+          select: { dsl: true },
+        },
+      },
+    });
+    if (!workflow?.isEnabled)
+      this.fail('NODE_TYPE_MISMATCH', node, `${label} 不存在或已停用`);
+    if (!workflow.versions[0])
+      this.fail(
+        'NODE_TYPE_MISMATCH',
+        node,
+        `${label}版本不存在、未发布或不属于所选 Workflow`,
+      );
+
+    let descriptor;
     try {
-      validateWebhookResponseWorkflow(compiledDsl);
+      descriptor = describeCallableWorkflow(workflow.versions[0]?.dsl);
     } catch (error) {
-      const boundaryNode =
-        draftDsl.nodes.find(
-          (node) =>
-            node.type === 'webhook_trigger' &&
-            (node.config as Record<string, unknown> | undefined)
-              ?.responseMode === 'WAIT_FOR_RESULT',
-        ) ??
-        draftDsl.nodes.find((node) => node.type === 'return_result') ??
-        draftDsl.nodes[0];
       this.fail(
         'NODE_TYPE_MISMATCH',
-        boundaryNode,
-        error instanceof Error ? error.message : 'HTTP 返回配置无效',
+        node,
+        error instanceof Error ? error.message : `${label} 配置无效`,
       );
     }
-    return compiledDsl;
+    if (!descriptor)
+      this.fail('NODE_TYPE_MISMATCH', node, `${label} 不能被内部调用`);
+
+    await this.assertNoInvocationCycle(
+      BigInt(workflowId),
+      BigInt(workflowVersionId),
+      workflow.versions[0]?.dsl,
+      node,
+      label,
+    );
+
+    const bindings = asObject(inputBindingsValue);
+    const declaredKeys = new Set(
+      descriptor.inputParameters.map((parameter) => parameter.key),
+    );
+    const extraParameter = Object.keys(bindings).find(
+      (key) => !declaredKeys.has(key),
+    );
+    if (extraParameter)
+      this.fail(
+        'NODE_TYPE_MISMATCH',
+        node,
+        `${label} 包含未声明的参数：${extraParameter}`,
+      );
+    const invalidParameter = descriptor.inputParameters.find(
+      (parameter) =>
+        (parameter.required || bindings[parameter.key] !== undefined) &&
+        !validateParameterBinding(bindings[parameter.key]),
+    );
+    if (invalidParameter)
+      this.fail(
+        'NODE_TYPE_MISMATCH',
+        node,
+        `${label} 的参数来源无效：${
+          invalidParameter.label ?? invalidParameter.key
+        }`,
+      );
+  }
+
+  private async validateIntegrationConnection(
+    node: DraftWorkflowNode,
+    connectionRefValue: unknown,
+    label: string,
+  ): Promise<void> {
+    const connection =
+      typeof connectionRefValue === 'string'
+        ? await this.prisma.integrationConnection.findUnique({
+            where: { code: connectionRefValue },
+            select: { isEnabled: true },
+          })
+        : null;
+    if (!connection?.isEnabled)
+      this.fail('NODE_TYPE_MISMATCH', node, `${label}不存在或已停用`);
+  }
+
+  private async assertNoInvocationCycle(
+    targetWorkflowId: bigint,
+    targetWorkflowVersionId: bigint,
+    targetDsl: unknown,
+    node: DraftWorkflowNode,
+    label: string,
+    active = new Set<string>(),
+    visited = new Set<string>(),
+  ): Promise<void> {
+    const targetKey = `${targetWorkflowId}:${targetWorkflowVersionId}`;
+    if (active.has(targetKey))
+      this.fail(
+        'NODE_TYPE_MISMATCH',
+        node,
+        `${label} 的固定版本调用链存在循环`,
+      );
+    if (visited.has(targetKey)) return;
+    active.add(targetKey);
+
+    for (const referenced of collectInvokedWorkflows(targetDsl)) {
+      const referencedKey = `${referenced.workflowId}:${referenced.workflowVersionId}`;
+      if (visited.has(referencedKey) && !active.has(referencedKey)) continue;
+      const referencedWorkflow = await this.prisma.workflow.findUnique({
+        where: { id: referenced.workflowId },
+        select: {
+          versions: {
+            where: { id: referenced.workflowVersionId },
+            take: 1,
+            select: { dsl: true },
+          },
+        },
+      });
+      await this.assertNoInvocationCycle(
+        referenced.workflowId,
+        referenced.workflowVersionId,
+        referencedWorkflow?.versions[0]?.dsl,
+        node,
+        label,
+        active,
+        visited,
+      );
+    }
+    active.delete(targetKey);
+    visited.add(targetKey);
   }
 
   private fail(
@@ -416,8 +419,39 @@ export class WorkflowCompilerService {
     node: DraftWorkflowNode,
     message: string,
   ): never {
-    throw new BadRequestException({ code, message, nodeId: node.id });
+    const nodeLabel = String(node.label ?? '').trim();
+    throw new BadRequestException({
+      code,
+      message,
+      ...(nodeLabel && { nodeLabel }),
+      nodeId: node.id,
+    });
+  }
+}
+
+function collectInvokedWorkflows(
+  dsl: unknown,
+): Array<{ workflowId: bigint; workflowVersionId: bigint }> {
+  const value = asObject(dsl);
+  const nodes = Array.isArray(value.nodes) ? value.nodes : [];
+  const result = new Map<
+    string,
+    { workflowId: bigint; workflowVersionId: bigint }
+  >();
+  for (const item of nodes) {
+    const node = asObject(item);
+    const config = asObject(node.config);
+    if (node.type !== 'sub_workflow') continue;
+    const workflowId = String(config.workflowId ?? '');
+    const workflowVersionId = String(config.workflowVersionId ?? '');
+    if (!/^[1-9]\d*$/.test(workflowId) || !/^[1-9]\d*$/.test(workflowVersionId))
+      continue;
+    result.set(`${workflowId}:${workflowVersionId}`, {
+      workflowId: BigInt(workflowId),
+      workflowVersionId: BigInt(workflowVersionId),
+    });
   }
+  return [...result.values()];
 }
 
 function parseId(value: string, node: DraftWorkflowNode): bigint {
@@ -433,3 +467,142 @@ function parseId(value: string, node: DraftWorkflowNode): bigint {
 function clone<T>(value: T): T {
   return JSON.parse(JSON.stringify(value)) as T;
 }
+
+function isSingleReadOnlySql(sql: string): boolean {
+  const normalized = normalizeSqlForPolicy(sql);
+  if (!/^(select|with)\b/i.test(normalized)) return false;
+  return !/\b(insert|update|delete|merge|call|copy|create|alter|drop|truncate|grant|revoke|vacuum|refresh)\b/i.test(
+    normalized,
+  );
+}
+
+function isDatabaseSqlAllowed(sql: string, allowWrite: boolean): boolean {
+  const normalized = normalizeSqlForPolicy(sql);
+  const writableCte =
+    /^with\b/i.test(normalized) &&
+    /\b(insert|update|delete)\b/i.test(normalized) &&
+    !/\b(merge|call|copy|create|alter|drop|truncate|grant|revoke|vacuum|refresh)\b/i.test(
+      normalized,
+    );
+  return (
+    isSingleReadOnlySql(sql) ||
+    (allowWrite &&
+      (/^(insert|update|delete)\b/i.test(normalized) || writableCte))
+  );
+}
+
+function normalizeSqlForPolicy(sql: string): string {
+  const withoutContent = sql
+    .replace(/\$(\w*)\$[\s\S]*?\$\1\$/g, ' ')
+    .replace(/'(?:''|[^'])*'/g, ' ')
+    .replace(/"(?:""|[^"])*"/g, ' ')
+    .replace(/\/\*[\s\S]*?\*\//g, ' ')
+    .replace(/--[^\r\n]*/g, ' ')
+    .trim();
+  const withoutTrailingSemicolon = withoutContent.replace(/;\s*$/, '').trim();
+  return withoutTrailingSemicolon.includes(';') ? '' : withoutTrailingSemicolon;
+}
+
+function asObject(value: unknown): Record<string, unknown> {
+  return value && typeof value === 'object' && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : {};
+}
+
+function nodeConfigValidationErrors(
+  error: unknown,
+): NodeConfigValidationError[] | null {
+  const getResponse = (error as { getResponse?: () => unknown })?.getResponse;
+  if (typeof getResponse !== 'function') return null;
+  const response = getResponse.call(error);
+  if (!response || typeof response !== 'object' || Array.isArray(response))
+    return null;
+  const value = response as Record<string, unknown>;
+  if (value.code !== 'NODE_CONFIG_INVALID' || !Array.isArray(value.errors))
+    return null;
+  return value.errors.filter(
+    (item): item is NodeConfigValidationError =>
+      Boolean(item) &&
+      typeof item === 'object' &&
+      typeof (item as NodeConfigValidationError).path === 'string' &&
+      typeof (item as NodeConfigValidationError).keyword === 'string' &&
+      typeof (item as NodeConfigValidationError).message === 'string',
+  );
+}
+
+function subjectValidationErrors(
+  error: unknown,
+): NodeConfigValidationError[] | null {
+  const getResponse = (error as { getResponse?: () => unknown })?.getResponse;
+  if (typeof getResponse !== 'function') return null;
+  const response = getResponse.call(error);
+  if (!response || typeof response !== 'object' || Array.isArray(response))
+    return null;
+  const value = response as Record<string, unknown>;
+  if (value.code !== 'SUBJECT_REF_INVALID' || !Array.isArray(value.issues))
+    return null;
+  return value.issues.flatMap((item) => {
+    if (!item || typeof item !== 'object' || Array.isArray(item)) return [];
+    const issue = item as Record<string, unknown>;
+    if (typeof issue.path !== 'string' || typeof issue.message !== 'string')
+      return [];
+    return [
+      {
+        path: issue.path,
+        keyword:
+          typeof issue.code === 'string' ? issue.code : 'INVALID_SUBJECT',
+        message: issue.message,
+      },
+    ];
+  });
+}
+
+function findInvalidParameterBinding(
+  value: unknown,
+  path = 'config',
+): string | null {
+  if (Array.isArray(value)) {
+    for (let index = 0; index < value.length; index++) {
+      const invalid = findInvalidParameterBinding(
+        value[index],
+        `${path}[${index}]`,
+      );
+      if (invalid) return invalid;
+    }
+    return null;
+  }
+  if (!value || typeof value !== 'object') return null;
+
+  const object = value as Record<string, unknown>;
+  const isBindingCandidate =
+    Object.prototype.hasOwnProperty.call(object, 'source') &&
+    (Object.prototype.hasOwnProperty.call(object, 'path') ||
+      Object.prototype.hasOwnProperty.call(object, 'valueType') ||
+      Object.prototype.hasOwnProperty.call(object, 'value'));
+  if (isBindingCandidate && !validateParameterBinding(object)) return path;
+
+  for (const [key, child] of Object.entries(object)) {
+    if (['body', 'inputSchema'].includes(key)) continue;
+    const invalid = findInvalidParameterBinding(child, `${path}.${key}`);
+    if (invalid) return invalid;
+  }
+  return null;
+}
+
+function validateManualInputParameters(
+  config: Record<string, unknown>,
+): string | null {
+  if (!Array.isArray(config.inputParameters)) return null;
+  const seen = new Set<string>();
+  for (const [index, item] of config.inputParameters.entries()) {
+    const parameter =
+      item && typeof item === 'object' && !Array.isArray(item)
+        ? (item as Record<string, unknown>)
+        : {};
+    const key = typeof parameter.key === 'string' ? parameter.key.trim() : '';
+    if (!key) return `启动参数 ${index + 1} 的参数名不能为空`;
+    if (seen.has(key)) return `启动参数名不能重复：${key}`;
+    seen.add(key);
+  }
+  return null;
+}