@hunsu/protocol 0.1.0

package/dist/protocol-validation.js

@@ -0,0 +1,1139 @@
+import { GUARDRAIL_SCOPES, GUARDRAIL_SEVERITIES, REASONING_EFFORTS, SERVICE_TIERS, VOTE_RULES } from "./constants.js";
+import { DomainInvariantError, unwrapDomainModelResult } from "./errors.js";
+import { assertValidPromptTemplate, decodePromptTemplate, promptTemplateFromText } from "./prompt-template.js";
+import { makeNonEmptyText, makePositiveInteger } from "./primitives.js";
+import { err, ok } from "./result.js";
+export const DEFAULT_TEAM_PROMPT = "Create a closure-free ExecutionPlan using the available Members.";
+export const DEFAULT_MANAGER_PROMPT = [
+    "Discuss HUNSU changes conversationally and edit only decoded request files under .hunsu-request when a file-backed draft change is needed.",
+    "Help the user refine divergent Hunsu changes while preserving the current Execute result as the source of truth."
+].join(" ");
+export const DEFAULT_MEMBER_EXECUTION = { kind: "read_only", network: "disabled" };
+export const DEFAULT_MEMBER_APPROVAL = { policy: "never" };
+const MEMBER_EXECUTION_KINDS = ["read_only", "worktree_write", "unrestricted"];
+const MEMBER_EXECUTION_NETWORKS = ["disabled", "enabled"];
+const MEMBER_APPROVAL_POLICIES = ["never", "on_request"];
+const MEMBER_APPROVAL_REVIEWERS = ["user", "auto_review"];
+const DEFAULT_ROOT_TEAM_ID = "root-team";
+export function validateHarness(value) {
+    return parseHarness(value);
+}
+export function validateHarnessPlanner(value) {
+    return parseHarnessPlanner(value);
+}
+export function validateHarnessEntity(value, path = "Harness") {
+    const harness = recordResult(value, path);
+    if (!harness.ok)
+        return harness;
+    if (typeof harness.value.rootTeamId !== "string" || harness.value.rootTeamId.trim() === "") {
+        return workflowValidationError(`${path}.rootTeamId must be a non-empty string`);
+    }
+    if (!Array.isArray(harness.value.executors)) {
+        return workflowValidationError(`${path}.executors must be an array`);
+    }
+    if (!Array.isArray(harness.value.resources)) {
+        return workflowValidationError(`${path}.resources must be an array`);
+    }
+    const executorIds = new Set();
+    for (const [index, executor] of harness.value.executors.entries()) {
+        const validation = executorEntityResult(executor, `${path}.executors[${index}]`);
+        if (!validation.ok)
+            return validation;
+        const id = String(executor.id);
+        if (executorIds.has(id)) {
+            return workflowValidationError(`${path}.executors must not include duplicate Executor ${id}`);
+        }
+        executorIds.add(id);
+    }
+    const root = harness.value.executors.find(executor => {
+        const record = executor;
+        return record.id === harness.value.rootTeamId && record.kind === "team";
+    });
+    if (!root) {
+        return workflowValidationError(`${path}.rootTeamId must reference a Team Executor`);
+    }
+    const executorKindById = new Map();
+    const teamMemberships = new Map();
+    for (const executor of harness.value.executors) {
+        const record = executor;
+        const id = String(record.id);
+        const kind = record.kind === "team" ? "team" : "member";
+        executorKindById.set(id, kind);
+        if (kind === "team") {
+            teamMemberships.set(id, (record.members ?? []).map(membership => String(membership.executorId)));
+        }
+    }
+    for (const [index, executor] of harness.value.executors.entries()) {
+        const record = executor;
+        if (record.kind !== "team") {
+            continue;
+        }
+        const memberships = record.members;
+        for (const [membershipIndex, membership] of memberships.entries()) {
+            const memberId = String(membership.executorId);
+            const memberKind = executorKindById.get(memberId);
+            if (!memberKind) {
+                return workflowValidationError(`${path}.executors[${index}].members[${membershipIndex}].executorId references unknown Executor ${membership.executorId}`);
+            }
+            if (membership.visibleProfile.kind !== memberKind) {
+                return workflowValidationError(`${path}.executors[${index}].members[${membershipIndex}].visibleProfile.kind must match Executor ${memberId} kind ${memberKind}`);
+            }
+        }
+    }
+    const cycle = findTeamCycle(teamMemberships);
+    if (cycle) {
+        return workflowValidationError(`${path}.executors must not contain cyclic Team Memberships: ${cycle.join(" -> ")}`);
+    }
+    for (const [index, resource] of harness.value.resources.entries()) {
+        const validation = resourceEntityResult(resource, `${path}.resources[${index}]`);
+        if (!validation.ok)
+            return validation;
+    }
+    const guardrails = guardrailsResult(harness.value.guardrails, `${path}.guardrails`);
+    if (!guardrails.ok)
+        return guardrails;
+    if (!Array.isArray(harness.value.artifactActions)) {
+        return workflowValidationError(`${path}.artifactActions must be an array`);
+    }
+    return ok(cloneHarnessEntity(harness.value));
+}
+function findTeamCycle(teamMemberships) {
+    const visiting = new Set();
+    const visited = new Set();
+    const stack = [];
+    const visit = (teamId) => {
+        if (visiting.has(teamId)) {
+            const start = stack.indexOf(teamId);
+            return [...stack.slice(start), teamId];
+        }
+        if (visited.has(teamId)) {
+            return undefined;
+        }
+        visiting.add(teamId);
+        stack.push(teamId);
+        for (const childId of teamMemberships.get(teamId) ?? []) {
+            if (!teamMemberships.has(childId)) {
+                continue;
+            }
+            const cycle = visit(childId);
+            if (cycle) {
+                return cycle;
+            }
+        }
+        stack.pop();
+        visiting.delete(teamId);
+        visited.add(teamId);
+        return undefined;
+    };
+    for (const teamId of teamMemberships.keys()) {
+        const cycle = visit(teamId);
+        if (cycle) {
+            return cycle;
+        }
+    }
+    return undefined;
+}
+export function validateMemberConfig(value, path = "Member") {
+    const member = recordResult(value, path);
+    if (!member.ok)
+        return member;
+    const validation = memberConfigResult(member.value, path);
+    return validation.ok ? ok(cloneMemberConfig(member.value)) : validation;
+}
+export function validateManagerConfig(value, path = "Manager") {
+    const manager = recordResult(value, path);
+    if (!manager.ok)
+        return manager;
+    const validation = managerConfigResult(manager.value, path);
+    return validation.ok ? ok(cloneManagerConfig(manager.value)) : validation;
+}
+function parseHarness(value) {
+    const protocol = recordResult(value, "Harness");
+    if (!protocol.ok)
+        return protocol;
+    const normalized = normalizeHarnessKind(protocol.value);
+    switch (normalized.kind) {
+        case "team_execution_plan":
+            return validateHarnessSnapshotShape({ ...normalized, kind: "team_execution_plan" }, "team_execution_plan", "maxAttemptCount");
+        case "role_squad":
+            return validateHarnessSnapshotShape(normalized, "role_squad", "maxRoundCount");
+        case "council_vote":
+            return chainResult(allowedResult("council_vote.voteRule", normalized.voteRule, VOTE_RULES), () => validateHarnessSnapshotShape(normalized, "council_vote", "maxRoundCount"));
+        case "court_debate":
+            return validateHarnessSnapshotShape(normalized, "court_debate", "maxRoundCount");
+        default:
+            return workflowValidationError(`Unsupported Harness kind: ${String(normalized.kind)}`);
+    }
+}
+function parseHarnessPlanner(value) {
+    const protocol = recordResult(value, "Planner Harness");
+    if (!protocol.ok)
+        return protocol;
+    const normalized = normalizeHarnessKind(protocol.value);
+    switch (normalized.kind) {
+        case "team_execution_plan":
+            return validateHarnessPlannerSnapshotShape({ ...normalized, kind: "team_execution_plan" }, "team_execution_plan", "maxAttemptCount");
+        case "role_squad":
+            return validateHarnessPlannerSnapshotShape(normalized, "role_squad", "maxRoundCount");
+        case "council_vote":
+            return chainResult(allowedResult("council_vote.voteRule", normalized.voteRule, VOTE_RULES), () => validateHarnessPlannerSnapshotShape(normalized, "council_vote", "maxRoundCount"));
+        case "court_debate":
+            return validateHarnessPlannerSnapshotShape(normalized, "court_debate", "maxRoundCount");
+        default:
+            return workflowValidationError(`Unsupported Planner Harness kind: ${String(normalized.kind)}`);
+    }
+}
+export function isExecutableHarness(protocol) {
+    return protocol.kind === "team_execution_plan";
+}
+export function validateExecutableHarness(protocol) {
+    if (!isExecutableHarness(protocol)) {
+        return err({ type: "DomainWorkflowError", message: `Harness ${protocol.kind} is not executable yet` });
+    }
+    return ok(protocol);
+}
+export function createDefaultHarness(instructions = "", skills = []) {
+    return {
+        kind: "team_execution_plan",
+        maxAttemptCount: unwrapDomainModelResult(makePositiveInteger(5, "team_execution_plan.maxAttemptCount")),
+        team: {
+            promptTemplate: promptTemplateFromText(instructions || DEFAULT_TEAM_PROMPT)
+        },
+        members: [
+            createDefaultMemberConfig("azir", "Plan briefly, then implement the focused goal in this repository.", skills),
+            createDefaultMemberConfig("galio", "Verify the completed work against the focused goal with concrete evidence.", [])
+        ]
+    };
+}
+export function createDefaultMemberConfig(id, prompt = "", skills = [], execution = DEFAULT_MEMBER_EXECUTION, approval = DEFAULT_MEMBER_APPROVAL, plugins = []) {
+    return {
+        id: unwrapDomainModelResult(makeNonEmptyText(id, "executorId")),
+        promptTemplate: promptTemplateFromText(prompt),
+        skills: cloneSkills(skills),
+        plugins: clonePlugins(plugins),
+        model: unwrapDomainModelResult(makeNonEmptyText("codex-default", "member.model")),
+        reasoningEffort: "default",
+        serviceTier: "default",
+        execution: cloneMemberExecution(execution),
+        approval: cloneMemberApproval(approval)
+    };
+}
+export function createDefaultManagerConfig(id = "manager.hunsu.default", prompt = DEFAULT_MANAGER_PROMPT, skills = [], plugins = []) {
+    return {
+        id: unwrapDomainModelResult(makeNonEmptyText(id, "manager.id")),
+        promptTemplate: promptTemplateFromText(prompt),
+        skills: cloneSkills(skills),
+        plugins: clonePlugins(plugins)
+    };
+}
+export function cloneHarness(protocol) {
+    const cloned = JSON.parse(JSON.stringify(protocol));
+    return {
+        ...cloned,
+        guardrails: cloned.guardrails?.map(guardrail => ({ ...guardrail })),
+        members: cloned.members.map(cloneMemberConfig)
+    };
+}
+export function cloneHarnessPlanner(protocol) {
+    const cloned = JSON.parse(JSON.stringify(protocol));
+    return {
+        ...cloned,
+        team: { promptTemplate: { ...cloned.team.promptTemplate } },
+        guardrails: cloned.guardrails?.map(guardrail => ({ ...guardrail }))
+    };
+}
+export function harnessPlannerFromSnapshot(protocol) {
+    const cloned = cloneHarness(protocol);
+    const { members: _members, ...planner } = cloned;
+    return cloneHarnessPlanner(planner);
+}
+export function composeHarnessSnapshot(planner, members) {
+    const memberValidation = memberArrayResult(members, "members.members", true);
+    if (!memberValidation.ok) {
+        throw new DomainInvariantError(memberValidation.error.message);
+    }
+    const clonedPlanner = cloneHarnessPlanner(planner);
+    const clonedMembers = members.map(cloneMemberConfig);
+    return {
+        ...clonedPlanner,
+        members: clonedMembers
+    };
+}
+export function harnessEntityFromSnapshot(protocol, rootTeamId = DEFAULT_ROOT_TEAM_ID) {
+    const rootId = executorId(rootTeamId, "rootTeamId");
+    const planner = harnessPlannerFromSnapshot(protocol);
+    const members = protocol.members.map(cloneMemberConfig);
+    const rootMemberships = members.map(member => ({
+        executorId: member.id,
+        visibleProfile: visibleProfileFromMemberConfig(member)
+    }));
+    return {
+        rootTeamId: rootId,
+        executors: [
+            {
+                kind: "team",
+                id: rootId,
+                planner: {
+                    promptTemplate: { ...planner.team.promptTemplate },
+                    maxAttemptCount: "maxAttemptCount" in planner ? planner.maxAttemptCount : undefined,
+                    guardrails: planner.guardrails?.map(guardrail => ({ ...guardrail }))
+                },
+                members: rootMemberships
+            },
+            ...members.map(memberEntityFromConfig)
+        ],
+        resources: resourceEntitiesFromMembers(members),
+        guardrails: planner.guardrails?.map(guardrail => ({ ...guardrail })) ?? [],
+        artifactActions: []
+    };
+}
+export function harnessSnapshotForTeam(harness, teamId = harness.rootTeamId) {
+    const team = getHarnessTeam(harness, teamId);
+    if (!team) {
+        throw new DomainInvariantError(`Harness does not define Team ${teamId}`);
+    }
+    const members = team.members.map(membership => memberConfigForMembership(harness, membership));
+    const maxAttemptCount = team.planner.maxAttemptCount
+        ?? unwrapDomainModelResult(makePositiveInteger(5, "team.maxAttemptCount"));
+    return {
+        kind: "team_execution_plan",
+        maxAttemptCount,
+        guardrails: team.planner.guardrails?.map(guardrail => ({ ...guardrail })),
+        team: {
+            promptTemplate: { ...team.planner.promptTemplate }
+        },
+        members
+    };
+}
+export function rootHarnessSnapshot(harness) {
+    return harnessSnapshotForTeam(harness, harness.rootTeamId);
+}
+export function cloneHarnessEntity(harness) {
+    return {
+        rootTeamId: harness.rootTeamId,
+        executors: harness.executors.map(cloneExecutorEntity),
+        resources: harness.resources.map(cloneResourceEntity),
+        guardrails: harness.guardrails.map(guardrail => ({ ...guardrail })),
+        artifactActions: JSON.parse(JSON.stringify(harness.artifactActions))
+    };
+}
+export function getHarnessExecutor(harness, executorId) {
+    const executor = harness.executors.find(candidate => candidate.id === executorId);
+    return executor ? cloneExecutorEntity(executor) : undefined;
+}
+export function getHarnessTeam(harness, executorId) {
+    const executor = harness.executors.find(candidate => candidate.id === executorId && candidate.kind === "team");
+    return executor ? cloneExecutorEntity(executor) : undefined;
+}
+export function getHarnessMember(harness, executorId) {
+    const executor = harness.executors.find(candidate => candidate.id === executorId && candidate.kind === "member");
+    return executor ? cloneMemberEntity(executor) : undefined;
+}
+export function memberConfigFromMemberEntity(member) {
+    return {
+        id: member.id,
+        promptTemplate: { ...member.promptTemplate },
+        skills: member.resources
+            .filter((binding) => binding.kind === "skill")
+            .map(binding => cloneSkill(binding.skill)),
+        plugins: member.resources
+            .filter((binding) => binding.kind === "plugin")
+            .map(binding => ({ ...binding.plugin })),
+        model: member.runtimePolicy.model,
+        reasoningEffort: member.runtimePolicy.reasoningEffort,
+        serviceTier: member.runtimePolicy.serviceTier,
+        execution: cloneMemberExecution(member.runtimePolicy.execution),
+        approval: cloneMemberApproval(member.runtimePolicy.approval)
+    };
+}
+export function getHarnessMemberConfig(protocol, executorId) {
+    return protocol.members.find(member => member.id === executorId)
+        ? cloneMemberConfig(protocol.members.find(member => member.id === executorId))
+        : undefined;
+}
+export function updateHarnessMemberConfig(protocol, executorId, update) {
+    if (!protocol.members.some(member => member.id === executorId)) {
+        throw new DomainInvariantError(`Unknown Member ${executorId} for Harness ${protocol.kind}`);
+    }
+    return {
+        ...protocol,
+        team: { ...protocol.team },
+        guardrails: protocol.guardrails?.map(guardrail => ({ ...guardrail })),
+        members: protocol.members.map(member => member.id === executorId ? update(cloneMemberConfig(member)) : cloneMemberConfig(member))
+    };
+}
+export function updateHarnessTeamPromptTemplate(protocol, promptTemplate) {
+    assertValidPromptTemplate(promptTemplate, "Team prompt template");
+    return {
+        ...protocol,
+        team: { promptTemplate: { ...promptTemplate } },
+        guardrails: protocol.guardrails?.map(guardrail => ({ ...guardrail })),
+        members: protocol.members.map(cloneMemberConfig)
+    };
+}
+function executorId(value, path) {
+    return unwrapDomainModelResult(makeNonEmptyText(value, path));
+}
+function runtimePolicyFromMemberConfig(member) {
+    return {
+        model: member.model,
+        reasoningEffort: member.reasoningEffort,
+        serviceTier: member.serviceTier,
+        execution: cloneMemberExecution(member.execution),
+        approval: cloneMemberApproval(member.approval)
+    };
+}
+function resourceBindingsFromMemberConfig(member) {
+    return [
+        ...member.skills.map(skill => ({ kind: "skill", skill: cloneSkill(skill) })),
+        ...(member.plugins ?? []).map(plugin => ({ kind: "plugin", plugin: { ...plugin } }))
+    ];
+}
+function memberEntityFromConfig(member) {
+    return {
+        kind: "member",
+        id: member.id,
+        promptTemplate: { ...member.promptTemplate },
+        resources: resourceBindingsFromMemberConfig(member),
+        runtimePolicy: runtimePolicyFromMemberConfig(member)
+    };
+}
+function visibleProfileFromMemberConfig(member) {
+    return {
+        kind: "member",
+        label: member.id,
+        summary: unwrapDomainModelResult(makeNonEmptyText(member.promptTemplate.template || `Member ${member.id}`, "visibleProfile.summary")),
+        capabilities: member.skills.map(skill => skill.name)
+    };
+}
+function memberConfigForMembership(harness, membership) {
+    const executor = harness.executors.find(candidate => candidate.id === membership.executorId);
+    if (!executor) {
+        throw new DomainInvariantError(`Team Membership references unknown Executor ${membership.executorId}`);
+    }
+    if (executor.kind === "member") {
+        return memberConfigFromMemberEntity(executor);
+    }
+    return createDefaultMemberConfig(executor.id, visibleProfilePrompt(membership.visibleProfile), [], DEFAULT_MEMBER_EXECUTION, DEFAULT_MEMBER_APPROVAL, []);
+}
+function visibleProfilePrompt(profile) {
+    const capabilities = profile.capabilities?.length ? `\nCapabilities:\n${profile.capabilities.map(capability => `- ${capability}`).join("\n")}` : "";
+    return [
+        profile.kind === "team" ? "Composite Team Executor." : "Member Executor.",
+        profile.label ? `Label: ${profile.label}` : undefined,
+        profile.summary ? `Summary: ${profile.summary}` : undefined,
+        capabilities || undefined
+    ].filter(Boolean).join("\n");
+}
+function resourceEntitiesFromMembers(members) {
+    const resources = [];
+    const seen = new Set();
+    for (const member of members) {
+        for (const binding of resourceBindingsFromMemberConfig(member)) {
+            const id = resourceEntityId(member.id, binding);
+            if (seen.has(id)) {
+                continue;
+            }
+            seen.add(id);
+            resources.push({
+                id: id,
+                binding
+            });
+        }
+    }
+    return resources;
+}
+function resourceEntityId(memberId, binding) {
+    if (binding.kind === "skill") {
+        return `resource.${memberId}.skill.${binding.skill.name}`;
+    }
+    if (binding.kind === "plugin") {
+        return `resource.${memberId}.plugin.${binding.plugin.id}`;
+    }
+    return `resource.${memberId}.package.${binding.lock.kind}.${binding.lock.key}.${binding.lock.version}`;
+}
+function cloneExecutorEntity(executor) {
+    if (executor.kind === "member") {
+        return { ...cloneMemberEntity(executor), packageLock: executor.packageLock ? { ...executor.packageLock } : undefined };
+    }
+    return {
+        ...executor,
+        planner: {
+            promptTemplate: { ...executor.planner.promptTemplate },
+            maxAttemptCount: executor.planner.maxAttemptCount,
+            guardrails: executor.planner.guardrails?.map(guardrail => ({ ...guardrail }))
+        },
+        members: executor.members.map(membership => ({
+            executorId: membership.executorId,
+            visibleProfile: {
+                ...membership.visibleProfile,
+                capabilities: membership.visibleProfile.capabilities ? [...membership.visibleProfile.capabilities] : undefined
+            }
+        })),
+        packageLock: executor.packageLock ? { ...executor.packageLock } : undefined
+    };
+}
+function cloneMemberEntity(member) {
+    return {
+        kind: "member",
+        id: member.id,
+        promptTemplate: { ...member.promptTemplate },
+        resources: member.resources.map(cloneResourceBinding),
+        runtimePolicy: {
+            model: member.runtimePolicy.model,
+            reasoningEffort: member.runtimePolicy.reasoningEffort,
+            serviceTier: member.runtimePolicy.serviceTier,
+            execution: cloneMemberExecution(member.runtimePolicy.execution),
+            approval: cloneMemberApproval(member.runtimePolicy.approval)
+        }
+    };
+}
+function cloneResourceBinding(binding) {
+    if (binding.kind === "skill") {
+        return { kind: "skill", skill: cloneSkill(binding.skill) };
+    }
+    if (binding.kind === "plugin") {
+        return { kind: "plugin", plugin: { ...binding.plugin } };
+    }
+    return { kind: "package", lock: { ...binding.lock } };
+}
+function cloneResourceEntity(resource) {
+    return {
+        id: resource.id,
+        binding: cloneResourceBinding(resource.binding),
+        packageLock: resource.packageLock ? { ...resource.packageLock } : undefined
+    };
+}
+export function validateSkillBinding(value, path) {
+    const validation = validateSkillBindingResult(value, path);
+    if (!validation.ok) {
+        throw new DomainInvariantError(validation.error.message);
+    }
+}
+function validateHarnessSnapshotShape(protocol, kind, countField) {
+    for (const validation of [
+        positiveIntegerResult(protocol[countField], `${kind}.${countField}`),
+        guardrailsResult(protocol.guardrails, `${kind}.guardrails`),
+        teamConfigResult(protocol.team, `${kind}.team`),
+        memberArrayResult(protocol.members, `${kind}.members`, true)
+    ]) {
+        if (!validation.ok) {
+            return validation;
+        }
+    }
+    return ok(cloneHarness(protocol));
+}
+function normalizeHarnessKind(protocol) {
+    return protocol.kind === "team_execution_plan"
+        ? { ...protocol, kind: "team_execution_plan" }
+        : protocol;
+}
+function validateHarnessPlannerSnapshotShape(protocol, kind, countField) {
+    if (Object.prototype.hasOwnProperty.call(protocol, "members")) {
+        return workflowValidationError(`${kind}.members is stored in executors.json, not harness.json`);
+    }
+    for (const validation of [
+        positiveIntegerResult(protocol[countField], `${kind}.${countField}`),
+        guardrailsResult(protocol.guardrails, `${kind}.guardrails`),
+        teamConfigResult(protocol.team, `${kind}.team`)
+    ]) {
+        if (!validation.ok) {
+            return validation;
+        }
+    }
+    return ok(cloneHarnessPlanner(protocol));
+}
+function validateSkillBindingResult(value, path) {
+    const skill = recordResult(value, path);
+    if (!skill.ok)
+        return skill;
+    if (skill.value.kind !== "local-snapshot" && skill.value.kind !== "local-root-installed" && skill.value.kind !== "registry-package" && skill.value.kind !== "skillMeta") {
+        return workflowValidationError(`${path}.kind must be local-snapshot, local-root-installed, registry-package, or skillMeta`);
+    }
+    if (typeof skill.value.name !== "string" || skill.value.name.trim() === "") {
+        return workflowValidationError(`${path}.name must be a non-empty string`);
+    }
+    if (skill.value.kind === "skillMeta") {
+        const exactKeys = exactKeysResult(skill.value, ["agent", "kind", "name", "source"], path);
+        if (!exactKeys.ok)
+            return exactKeys;
+        if (typeof skill.value.source !== "string" || skill.value.source.trim() === "") {
+            return workflowValidationError(`${path}.source must be a non-empty string`);
+        }
+        if (skill.value.agent !== "codex") {
+            return workflowValidationError(`${path}.agent must be codex`);
+        }
+        return ok(undefined);
+    }
+    if (skill.value.kind === "local-root-installed") {
+        if (skill.value.sourcePath !== undefined && (typeof skill.value.sourcePath !== "string" || skill.value.sourcePath.trim() === "")) {
+            return workflowValidationError(`${path}.sourcePath must be a non-empty string when provided`);
+        }
+        return ok(undefined);
+    }
+    if (skill.value.kind === "local-snapshot") {
+        for (const key of ["sourcePath", "contentHash", "snapshotRef"]) {
+            if (typeof skill.value[key] !== "string" || skill.value[key].trim() === "") {
+                return workflowValidationError(`${path}.${key} must be a non-empty string`);
+            }
+        }
+        if (skill.value.snapshotFiles !== undefined) {
+            if (!Array.isArray(skill.value.snapshotFiles)) {
+                return workflowValidationError(`${path}.snapshotFiles must be an array`);
+            }
+            for (const [index, file] of skill.value.snapshotFiles.entries()) {
+                const snapshotFile = recordResult(file, `${path}.snapshotFiles[${index}]`);
+                if (!snapshotFile.ok)
+                    return snapshotFile;
+                if (typeof snapshotFile.value.path !== "string" || snapshotFile.value.path.trim() === "") {
+                    return workflowValidationError(`${path}.snapshotFiles[${index}].path must be a non-empty string`);
+                }
+                if (typeof snapshotFile.value.text !== "string") {
+                    return workflowValidationError(`${path}.snapshotFiles[${index}].text must be a string`);
+                }
+            }
+        }
+        return ok(undefined);
+    }
+    if (skill.value.registryKind !== "apm") {
+        return workflowValidationError(`${path}.registryKind must be apm`);
+    }
+    for (const key of ["registry", "package", "version", "integrity", "contentHash"]) {
+        if (typeof skill.value[key] !== "string" || skill.value[key].trim() === "") {
+            return workflowValidationError(`${path}.${key} must be a non-empty string`);
+        }
+    }
+    if (!isExactSemver(String(skill.value.version))) {
+        return workflowValidationError(`${path}.version must be an exact semver version`);
+    }
+    if (skill.value.snapshotFiles !== undefined) {
+        return workflowValidationError(`${path}.snapshotFiles is not supported for registry-package skills`);
+    }
+    return ok(undefined);
+}
+function validateMemberPluginBindingResult(value, path) {
+    const plugin = recordResult(value, path);
+    if (!plugin.ok)
+        return plugin;
+    if (plugin.value.kind !== "local-root-installed") {
+        return workflowValidationError(`${path}.kind must be local-root-installed`);
+    }
+    if (typeof plugin.value.id !== "string" || plugin.value.id.trim() === "") {
+        return workflowValidationError(`${path}.id must be a non-empty string`);
+    }
+    return ok(undefined);
+}
+function teamConfigResult(value, path) {
+    const team = recordResult(value, path);
+    if (!team.ok)
+        return team;
+    const template = decodePromptTemplate(team.value.promptTemplate, `${path}.promptTemplate`);
+    return template.ok ? ok(undefined) : template;
+}
+function memberArrayResult(value, path, requireNonEmpty) {
+    if (!Array.isArray(value)) {
+        return workflowValidationError(`${path} must be an array`);
+    }
+    if (requireNonEmpty && value.length === 0) {
+        return workflowValidationError(`${path} must include at least one Member`);
+    }
+    const seen = new Set();
+    for (const [index, member] of value.entries()) {
+        const record = recordResult(member, `${path}[${index}]`);
+        if (!record.ok)
+            return record;
+        const validation = memberConfigResult(record.value, `${path}[${index}]`);
+        if (!validation.ok)
+            return validation;
+        const id = String(record.value.id);
+        if (seen.has(id)) {
+            return workflowValidationError(`${path} must not include duplicate Member ${id}`);
+        }
+        seen.add(id);
+    }
+    return ok(undefined);
+}
+function memberConfigResult(member, path) {
+    if (typeof member.id !== "string" || member.id.trim() === "") {
+        return workflowValidationError(`${path}.id must be a non-empty string`);
+    }
+    const promptTemplate = decodePromptTemplate(member.promptTemplate, `${path}.promptTemplate`);
+    if (!promptTemplate.ok)
+        return promptTemplate;
+    if (typeof member.model !== "string" || member.model.trim() === "") {
+        return workflowValidationError(`${path}.model must be a non-empty string`);
+    }
+    for (const validation of [
+        allowedResult(`${path}.reasoningEffort`, member.reasoningEffort, REASONING_EFFORTS),
+        member.serviceTier === undefined ? ok(undefined) : allowedResult(`${path}.serviceTier`, member.serviceTier, SERVICE_TIERS),
+        memberExecutionResult(member.execution, `${path}.execution`),
+        memberApprovalResult(member.approval, `${path}.approval`)
+    ]) {
+        if (!validation.ok) {
+            return validation;
+        }
+    }
+    if (!Array.isArray(member.skills)) {
+        return workflowValidationError(`${path}.skills must be an array`);
+    }
+    for (const [index, skill] of member.skills.entries()) {
+        const validation = validateSkillBindingResult(skill, `${path}.skills[${index}]`);
+        if (!validation.ok)
+            return validation;
+    }
+    if (member.plugins !== undefined) {
+        if (!Array.isArray(member.plugins)) {
+            return workflowValidationError(`${path}.plugins must be an array`);
+        }
+        for (const [index, plugin] of member.plugins.entries()) {
+            const validation = validateMemberPluginBindingResult(plugin, `${path}.plugins[${index}]`);
+            if (!validation.ok)
+                return validation;
+        }
+    }
+    return ok(undefined);
+}
+function managerConfigResult(manager, path) {
+    const keys = exactKeysResult(manager, ["id", "plugins", "promptTemplate", "skills"], path);
+    if (!keys.ok)
+        return keys;
+    if (typeof manager.id !== "string" || manager.id.trim() === "") {
+        return workflowValidationError(`${path}.id must be a non-empty string`);
+    }
+    const promptTemplate = decodePromptTemplate(manager.promptTemplate, `${path}.promptTemplate`);
+    if (!promptTemplate.ok)
+        return promptTemplate;
+    if (!Array.isArray(manager.skills)) {
+        return workflowValidationError(`${path}.skills must be an array`);
+    }
+    for (const [index, skill] of manager.skills.entries()) {
+        const validation = validateSkillBindingResult(skill, `${path}.skills[${index}]`);
+        if (!validation.ok)
+            return validation;
+    }
+    if (!Array.isArray(manager.plugins)) {
+        return workflowValidationError(`${path}.plugins must be an array`);
+    }
+    for (const [index, plugin] of manager.plugins.entries()) {
+        const validation = validateMemberPluginBindingResult(plugin, `${path}.plugins[${index}]`);
+        if (!validation.ok)
+            return validation;
+    }
+    return ok(undefined);
+}
+function executorEntityResult(value, path) {
+    const executor = recordResult(value, path);
+    if (!executor.ok)
+        return executor;
+    if (executor.value.kind === "team") {
+        return teamExecutorResult(executor.value, path);
+    }
+    if (executor.value.kind === "member") {
+        return memberExecutorResult(executor.value, path);
+    }
+    return workflowValidationError(`${path}.kind must be team or member`);
+}
+function teamExecutorResult(team, path) {
+    if (typeof team.id !== "string" || team.id.trim() === "") {
+        return workflowValidationError(`${path}.id must be a non-empty string`);
+    }
+    const planner = teamPlannerResult(team.planner, `${path}.planner`);
+    if (!planner.ok)
+        return planner;
+    if (!Array.isArray(team.members)) {
+        return workflowValidationError(`${path}.members must be an array`);
+    }
+    const seen = new Set();
+    for (const [index, membership] of team.members.entries()) {
+        const validation = membershipResult(membership, `${path}.members[${index}]`);
+        if (!validation.ok)
+            return validation;
+        const executorId = String(membership.executorId);
+        if (seen.has(executorId)) {
+            return workflowValidationError(`${path}.members must not include duplicate Membership ${executorId}`);
+        }
+        seen.add(executorId);
+    }
+    return packageLockResult(team.packageLock, `${path}.packageLock`);
+}
+function teamPlannerResult(value, path) {
+    const planner = recordResult(value, path);
+    if (!planner.ok)
+        return planner;
+    const template = decodePromptTemplate(planner.value.promptTemplate, `${path}.promptTemplate`);
+    if (!template.ok)
+        return template;
+    if (planner.value.maxAttemptCount !== undefined) {
+        const maxAttemptCount = positiveIntegerResult(planner.value.maxAttemptCount, `${path}.maxAttemptCount`);
+        if (!maxAttemptCount.ok)
+            return maxAttemptCount;
+    }
+    return guardrailsResult(planner.value.guardrails, `${path}.guardrails`);
+}
+function membershipResult(value, path) {
+    const membership = recordResult(value, path);
+    if (!membership.ok)
+        return membership;
+    if (typeof membership.value.executorId !== "string" || membership.value.executorId.trim() === "") {
+        return workflowValidationError(`${path}.executorId must be a non-empty string`);
+    }
+    return visibleProfileResult(membership.value.visibleProfile, `${path}.visibleProfile`);
+}
+function visibleProfileResult(value, path) {
+    const profile = recordResult(value, path);
+    if (!profile.ok)
+        return profile;
+    const kind = allowedResult(`${path}.kind`, profile.value.kind, ["team", "member"]);
+    if (!kind.ok)
+        return kind;
+    for (const key of ["label", "summary"]) {
+        if (profile.value[key] !== undefined && (typeof profile.value[key] !== "string" || String(profile.value[key]).trim() === "")) {
+            return workflowValidationError(`${path}.${key} must be a non-empty string when provided`);
+        }
+    }
+    if (profile.value.capabilities !== undefined) {
+        if (!Array.isArray(profile.value.capabilities)) {
+            return workflowValidationError(`${path}.capabilities must be an array`);
+        }
+        for (const [index, capability] of profile.value.capabilities.entries()) {
+            if (typeof capability !== "string" || capability.trim() === "") {
+                return workflowValidationError(`${path}.capabilities[${index}] must be a non-empty string`);
+            }
+        }
+    }
+    return ok(undefined);
+}
+function memberExecutorResult(member, path) {
+    if (typeof member.id !== "string" || member.id.trim() === "") {
+        return workflowValidationError(`${path}.id must be a non-empty string`);
+    }
+    const promptTemplate = decodePromptTemplate(member.promptTemplate, `${path}.promptTemplate`);
+    if (!promptTemplate.ok)
+        return promptTemplate;
+    if (!Array.isArray(member.resources)) {
+        return workflowValidationError(`${path}.resources must be an array`);
+    }
+    for (const [index, resource] of member.resources.entries()) {
+        const validation = resourceBindingResult(resource, `${path}.resources[${index}]`);
+        if (!validation.ok)
+            return validation;
+    }
+    const runtimePolicy = runtimePolicyResult(member.runtimePolicy, `${path}.runtimePolicy`);
+    if (!runtimePolicy.ok)
+        return runtimePolicy;
+    return packageLockResult(member.packageLock, `${path}.packageLock`);
+}
+function runtimePolicyResult(value, path) {
+    const policy = recordResult(value, path);
+    if (!policy.ok)
+        return policy;
+    if (typeof policy.value.model !== "string" || policy.value.model.trim() === "") {
+        return workflowValidationError(`${path}.model must be a non-empty string`);
+    }
+    for (const validation of [
+        allowedResult(`${path}.reasoningEffort`, policy.value.reasoningEffort, REASONING_EFFORTS),
+        policy.value.serviceTier === undefined ? ok(undefined) : allowedResult(`${path}.serviceTier`, policy.value.serviceTier, SERVICE_TIERS),
+        memberExecutionResult(policy.value.execution, `${path}.execution`),
+        memberApprovalResult(policy.value.approval, `${path}.approval`)
+    ]) {
+        if (!validation.ok) {
+            return validation;
+        }
+    }
+    return ok(undefined);
+}
+function resourceEntityResult(value, path) {
+    const resource = recordResult(value, path);
+    if (!resource.ok)
+        return resource;
+    if (typeof resource.value.id !== "string" || resource.value.id.trim() === "") {
+        return workflowValidationError(`${path}.id must be a non-empty string`);
+    }
+    const binding = resourceBindingResult(resource.value.binding, `${path}.binding`);
+    if (!binding.ok)
+        return binding;
+    return packageLockResult(resource.value.packageLock, `${path}.packageLock`);
+}
+function resourceBindingResult(value, path) {
+    const binding = recordResult(value, path);
+    if (!binding.ok)
+        return binding;
+    if (binding.value.kind === "skill") {
+        return validateSkillBindingResult(binding.value.skill, `${path}.skill`);
+    }
+    if (binding.value.kind === "plugin") {
+        return validateMemberPluginBindingResult(binding.value.plugin, `${path}.plugin`);
+    }
+    if (binding.value.kind === "package") {
+        return packageLockResult(binding.value.lock, `${path}.lock`);
+    }
+    return workflowValidationError(`${path}.kind must be skill, plugin, or package`);
+}
+function packageLockResult(value, path) {
+    if (value === undefined) {
+        return ok(undefined);
+    }
+    const lock = recordResult(value, path);
+    if (!lock.ok)
+        return lock;
+    for (const key of ["origin", "kind", "key", "version", "integrity"]) {
+        if (typeof lock.value[key] !== "string" || String(lock.value[key]).trim() === "") {
+            return workflowValidationError(`${path}.${key} must be a non-empty string`);
+        }
+    }
+    return ok(undefined);
+}
+function memberExecutionResult(value, path) {
+    const execution = recordResult(value, path);
+    if (!execution.ok)
+        return execution;
+    const kind = allowedResult(`${path}.kind`, execution.value.kind, MEMBER_EXECUTION_KINDS);
+    if (!kind.ok)
+        return kind;
+    const network = allowedResult(`${path}.network`, execution.value.network, MEMBER_EXECUTION_NETWORKS);
+    return network.ok ? ok(undefined) : network;
+}
+function memberApprovalResult(value, path) {
+    const approval = recordResult(value, path);
+    if (!approval.ok)
+        return approval;
+    const policy = allowedResult(`${path}.policy`, approval.value.policy, MEMBER_APPROVAL_POLICIES);
+    if (!policy.ok)
+        return policy;
+    if (approval.value.policy === "on_request") {
+        const reviewer = allowedResult(`${path}.reviewer`, approval.value.reviewer, MEMBER_APPROVAL_REVIEWERS);
+        return reviewer.ok ? ok(undefined) : reviewer;
+    }
+    return "reviewer" in approval.value
+        ? workflowValidationError(`${path}.reviewer is only allowed when policy is on_request`)
+        : ok(undefined);
+}
+function guardrailsResult(value, path) {
+    if (value === undefined) {
+        return ok(undefined);
+    }
+    if (!Array.isArray(value)) {
+        return workflowValidationError(`${path} must be an array`);
+    }
+    for (const [index, entry] of value.entries()) {
+        const guardrail = recordResult(entry, `${path}[${index}]`);
+        if (!guardrail.ok)
+            return guardrail;
+        if (typeof guardrail.value.name !== "string" || guardrail.value.name.trim() === "") {
+            return workflowValidationError(`${path}[${index}].name must be a non-empty string`);
+        }
+        const scope = allowedResult(`${path}[${index}].scope`, guardrail.value.scope, GUARDRAIL_SCOPES);
+        if (!scope.ok)
+            return scope;
+        if (typeof guardrail.value.rule !== "string" || guardrail.value.rule.trim() === "") {
+            return workflowValidationError(`${path}[${index}].rule must be a non-empty string`);
+        }
+        const severity = allowedResult(`${path}[${index}].severity`, guardrail.value.severity, GUARDRAIL_SEVERITIES);
+        if (!severity.ok)
+            return severity;
+    }
+    return ok(undefined);
+}
+function recordResult(value, path) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? ok(value)
+        : workflowValidationError(`${path} must be an object`);
+}
+function exactKeysResult(record, allowedKeys, path) {
+    const missing = allowedKeys.filter(key => !(key in record));
+    if (missing.length > 0) {
+        return workflowValidationError(`${path} is missing required keys: ${missing.join(", ")}`);
+    }
+    const extra = Object.keys(record).filter(key => !allowedKeys.includes(key));
+    return extra.length > 0
+        ? workflowValidationError(`${path} has unsupported keys: ${extra.join(", ")}`)
+        : ok(undefined);
+}
+function positiveIntegerResult(value, path) {
+    return Number.isInteger(value) && Number(value) >= 1
+        ? ok(undefined)
+        : workflowValidationError(`${path} must be a positive integer`);
+}
+function allowedResult(path, value, allowed) {
+    return typeof value === "string" && allowed.includes(value)
+        ? ok(value)
+        : workflowValidationError(`${path} must be one of: ${allowed.join(", ")}`);
+}
+function chainResult(result, next) {
+    return result.ok ? next() : result;
+}
+function workflowValidationError(message) {
+    return err({ type: "DomainWorkflowError", message });
+}
+function requireHarnessMemberConfig(protocol, executorId) {
+    const member = getHarnessMemberConfig(protocol, executorId);
+    if (!member) {
+        throw new DomainInvariantError(`Unknown Member ${executorId} for Harness ${protocol.kind}`);
+    }
+    return member;
+}
+function validateHubPackageLock(lock, expectedKind, label) {
+    assertText(lock.origin, `${label} origin must be non-empty`);
+    if (lock.kind !== expectedKind) {
+        throw new DomainInvariantError(`${label} kind must be ${expectedKind}`);
+    }
+    assertText(lock.key, `${label} key must be non-empty`);
+    assertText(lock.version, `${label} version must be non-empty`);
+    assertText(lock.integrity, `${label} integrity must be non-empty`);
+}
+function validateTeamConfig(value, path) {
+    const team = requireRecord(value, path);
+    assertValidPromptTemplate(team.promptTemplate, `${path}.promptTemplate`);
+}
+function validateMemberArray(value, path, requireNonEmpty) {
+    if (!Array.isArray(value)) {
+        throw new DomainInvariantError(`${path} must be an array`);
+    }
+    if (requireNonEmpty && value.length === 0) {
+        throw new DomainInvariantError(`${path} must include at least one Member`);
+    }
+    const seen = new Set();
+    value.forEach((member, index) => {
+        const record = requireRecord(member, `${path}[${index}]`);
+        assertValidMemberConfig(record, `${path}[${index}]`);
+        const id = String(record.id);
+        if (seen.has(id)) {
+            throw new DomainInvariantError(`${path} must not include duplicate Member ${id}`);
+        }
+        seen.add(id);
+    });
+}
+function assertValidMemberConfig(member, path) {
+    if (typeof member.id !== "string" || member.id.trim() === "") {
+        throw new DomainInvariantError(`${path}.id must be a non-empty string`);
+    }
+    assertValidPromptTemplate(member.promptTemplate, `${path}.promptTemplate`);
+    if (typeof member.model !== "string" || member.model.trim() === "") {
+        throw new DomainInvariantError(`${path}.model must be a non-empty string`);
+    }
+    assertAllowed(`${path}.reasoningEffort`, member.reasoningEffort, REASONING_EFFORTS);
+    if (member.serviceTier !== undefined) {
+        assertAllowed(`${path}.serviceTier`, member.serviceTier, SERVICE_TIERS);
+    }
+    validateMemberExecution(member.execution, `${path}.execution`);
+    validateMemberApproval(member.approval, `${path}.approval`);
+    if (!Array.isArray(member.skills)) {
+        throw new DomainInvariantError(`${path}.skills must be an array`);
+    }
+    member.skills.forEach((skill, index) => validateSkillBinding(skill, `${path}.skills[${index}]`));
+    if (member.plugins !== undefined) {
+        if (!Array.isArray(member.plugins)) {
+            throw new DomainInvariantError(`${path}.plugins must be an array`);
+        }
+        member.plugins.forEach((plugin, index) => validateMemberPluginBinding(plugin, `${path}.plugins[${index}]`));
+    }
+}
+function validateMemberPluginBinding(value, path) {
+    const validation = validateMemberPluginBindingResult(value, path);
+    if (!validation.ok) {
+        throw new DomainInvariantError(validation.error.message);
+    }
+}
+function validateMemberExecution(value, path) {
+    const execution = requireRecord(value, path);
+    assertAllowed(`${path}.kind`, execution.kind, MEMBER_EXECUTION_KINDS);
+    assertAllowed(`${path}.network`, execution.network, MEMBER_EXECUTION_NETWORKS);
+}
+function validateMemberApproval(value, path) {
+    const approval = requireRecord(value, path);
+    assertAllowed(`${path}.policy`, approval.policy, MEMBER_APPROVAL_POLICIES);
+    if (approval.policy === "on_request") {
+        assertAllowed(`${path}.reviewer`, approval.reviewer, MEMBER_APPROVAL_REVIEWERS);
+        return;
+    }
+    if ("reviewer" in approval) {
+        throw new DomainInvariantError(`${path}.reviewer is only allowed when policy is on_request`);
+    }
+}
+function validateGuardrails(value, path) {
+    if (value === undefined) {
+        return;
+    }
+    if (!Array.isArray(value)) {
+        throw new DomainInvariantError(`${path} must be an array`);
+    }
+    value.forEach((entry, index) => {
+        const guardrail = requireRecord(entry, `${path}[${index}]`);
+        if (typeof guardrail.name !== "string" || guardrail.name.trim() === "") {
+            throw new DomainInvariantError(`${path}[${index}].name must be a non-empty string`);
+        }
+        assertAllowed(`${path}[${index}].scope`, guardrail.scope, GUARDRAIL_SCOPES);
+        if (typeof guardrail.rule !== "string" || guardrail.rule.trim() === "") {
+            throw new DomainInvariantError(`${path}[${index}].rule must be a non-empty string`);
+        }
+        assertAllowed(`${path}[${index}].severity`, guardrail.severity, GUARDRAIL_SEVERITIES);
+    });
+}
+function requireRecord(value, path) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new DomainInvariantError(`${path} must be an object`);
+    }
+    return value;
+}
+function assertPositiveInteger(value, path) {
+    if (!Number.isInteger(value) || Number(value) < 1) {
+        throw new DomainInvariantError(`${path} must be a positive integer`);
+    }
+}
+function assertAllowed(path, value, allowed) {
+    if (typeof value !== "string" || !allowed.includes(value)) {
+        throw new DomainInvariantError(`${path} must be one of: ${allowed.join(", ")}`);
+    }
+}
+function assertText(value, message) {
+    if (value.trim() === "") {
+        throw new DomainInvariantError(message);
+    }
+}
+function assertString(value, message) {
+    if (typeof value !== "string") {
+        throw new DomainInvariantError(message);
+    }
+}
+function cloneMemberConfig(member) {
+    return {
+        ...member,
+        promptTemplate: { ...member.promptTemplate },
+        skills: cloneSkills(member.skills),
+        plugins: clonePlugins(member.plugins ?? []),
+        execution: cloneMemberExecution(member.execution),
+        approval: cloneMemberApproval(member.approval)
+    };
+}
+function cloneManagerConfig(manager) {
+    return {
+        ...manager,
+        promptTemplate: { ...manager.promptTemplate },
+        skills: cloneSkills(manager.skills),
+        plugins: clonePlugins(manager.plugins)
+    };
+}
+function cloneMemberExecution(execution) {
+    return { ...execution };
+}
+function cloneMemberApproval(approval) {
+    return { ...approval };
+}
+function cloneSkills(skills = []) {
+    return skills.map(cloneSkill);
+}
+function cloneSkill(skill) {
+    if (skill.kind === "local-snapshot") {
+        return {
+            ...skill,
+            snapshotFiles: skill.snapshotFiles?.map(file => ({ ...file }))
+        };
+    }
+    return { ...skill };
+}
+function clonePlugins(plugins = []) {
+    return plugins.map(plugin => ({ ...plugin }));
+}
+function isExactSemver(value) {
+    return /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(value);
+}