@meru454545/nexus-modscript-composer 2.0.12

package/dist/script-validator.js

@@ -0,0 +1,1029 @@
+import { execSync } from "node:child_process";
+import { writeFileSync, unlinkSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { getShellcheckPath } from "./shellcheck-bin.js";
+import { validateHereStringTerminators } from "./composer.js";
+import { createLogger } from "./logger.js";
+const log = createLogger("validator");
+// The env vars that L2 writes into the env file and L1 reads at startup.
+// This is the contract between the two layers.
+const NEXUS_ENV_VARS = [
+    "NEXUS_ICEBERG_ENDPOINT",
+    "NEXUS_AGENT_ID",
+    "NEXUS_AUTH_TOKEN",
+    "NEXUS_DRY_RUN",
+    "NEXUS_MAX_PARALLEL",
+];
+function createResult() {
+    return { valid: true, errors: [], warnings: [] };
+}
+function addError(result, msg) {
+    result.errors.push(msg);
+    result.valid = false;
+}
+function addWarning(result, msg) {
+    result.warnings.push(msg);
+}
+function mergeResults(...results) {
+    const merged = createResult();
+    for (const r of results) {
+        merged.errors.push(...r.errors);
+        merged.warnings.push(...r.warnings);
+    }
+    merged.valid = merged.errors.length === 0;
+    return merged;
+}
+// ── Shared checks ──────────────────────────────────────────────────────────
+function checkUnreplacedPlaceholders(script, label) {
+    const result = createResult();
+    const matches = script.match(/\{\{[A-Z_]+\}\}/g);
+    if (matches) {
+        const unique = [...new Set(matches)];
+        addError(result, `${label} contains unreplaced template placeholders: ${unique.join(", ")}`);
+    }
+    return result;
+}
+// ── L1 Validation ──────────────────────────────────────────────────────────
+function validateL1Linux(script, moduleNames) {
+    const result = createResult();
+    // Shebang
+    if (!script.startsWith("#!/bin/bash")) {
+        addError(result, "L1 Linux: missing #!/bin/bash shebang");
+    }
+    // Shell safety flags
+    if (!script.includes("set -uo pipefail")) {
+        addError(result, "L1 Linux: missing 'set -uo pipefail' safety flags");
+    }
+    // Env var reads — L1 must consume every var the L2 env file provides
+    for (const envVar of NEXUS_ENV_VARS) {
+        if (!script.includes(envVar)) {
+            addError(result, `L1 Linux: does not read env var ${envVar}`);
+        }
+    }
+    // Required guard — L1 must reject missing critical env vars
+    if (!script.includes('-z "$ICEBERG_ENDPOINT"')) {
+        addWarning(result, "L1 Linux: missing empty-check guard for ICEBERG_ENDPOINT");
+    }
+    if (!script.includes('-z "$AGENT_ID"')) {
+        addWarning(result, "L1 Linux: missing empty-check guard for AGENT_ID");
+    }
+    if (!script.includes('-z "$AUTH_TOKEN"')) {
+        addWarning(result, "L1 Linux: missing empty-check guard for AUTH_TOKEN");
+    }
+    // L0 function definitions — each module must have its collector function
+    for (const mod of moduleNames) {
+        const fnName = `nexus_collect_${mod}`;
+        if (!script.includes(fnName)) {
+            addError(result, `L1 Linux: missing L0 function definition '${fnName}' for module '${mod}'`);
+        }
+    }
+    // Module array — the orchestration loop must list all modules
+    for (const mod of moduleNames) {
+        if (!script.includes(`"${mod}"`)) {
+            addError(result, `L1 Linux: module '${mod}' not found in modules array`);
+        }
+    }
+    // Core functions
+    if (!script.includes("run_all_modules")) {
+        addError(result, "L1 Linux: missing 'run_all_modules' entry point");
+    }
+    if (!script.includes("_push_to_iceberg")) {
+        addError(result, "L1 Linux: missing '_push_to_iceberg' function");
+    }
+    if (!script.includes("_run_module")) {
+        addError(result, "L1 Linux: missing '_run_module' function");
+    }
+    if (!script.includes("_build_envelope")) {
+        addError(result, "L1 Linux: missing '_build_envelope' function — L0 log/result records would never be folded into a payload");
+    }
+    if (!script.includes("_json_validate")) {
+        addWarning(result, "L1 Linux: missing '_json_validate' — output won't be checked before push");
+    }
+    if (!script.includes(".ndjson")) {
+        addWarning(result, "L1 Linux: no '.ndjson' capture file — L0 record streams may not be captured line-wise");
+    }
+    if (!script.includes("_interrupt_and_flush") || !/trap\s+_interrupt_and_flush\s+TERM/.test(script)) {
+        addError(result, "L1 Linux: missing TERM timeout flush handler — partial L0 records would be lost when systemd times out");
+    }
+    // L1 must self-redirect output now that the L2 unit no longer uses
+    // StandardOutput=append: (which was removed for systemd 228 compatibility).
+    // Without this, log lines from L1 vanish into the journal on old systemd.
+    if (!/exec\s+>>.*NEXUS_SERVICE_NAME/.test(script)) {
+        addError(result, "L1 Linux: missing 'exec >> ...${NEXUS_SERVICE_NAME}...' redirect — L1 logs will be lost on systemd < 240");
+    }
+    return result;
+}
+function validateL1Aix(script, moduleNames) {
+    const result = createResult();
+    // Shebang — AIX default ksh (ksh88)
+    if (!script.startsWith("#!/bin/ksh")) {
+        addError(result, "L1 AIX: missing #!/bin/ksh shebang");
+    }
+    // Shell safety flags — ksh88 has no `pipefail`, so only `set -u` is required.
+    if (!/^set -u\b/m.test(script)) {
+        addError(result, "L1 AIX: missing 'set -u' safety flag");
+    }
+    // Env var reads — L1 must consume every var the L2 env file provides
+    for (const envVar of NEXUS_ENV_VARS) {
+        if (!script.includes(envVar)) {
+            addError(result, `L1 AIX: does not read env var ${envVar}`);
+        }
+    }
+    // Required guard — L1 must reject missing critical env vars
+    if (!script.includes('-z "$ICEBERG_ENDPOINT"')) {
+        addWarning(result, "L1 AIX: missing empty-check guard for ICEBERG_ENDPOINT");
+    }
+    if (!script.includes('-z "$AGENT_ID"')) {
+        addWarning(result, "L1 AIX: missing empty-check guard for AGENT_ID");
+    }
+    if (!script.includes('-z "$AUTH_TOKEN"')) {
+        addWarning(result, "L1 AIX: missing empty-check guard for AUTH_TOKEN");
+    }
+    // L0 function definitions — each module must have its collector function
+    for (const mod of moduleNames) {
+        const fnName = `nexus_collect_${mod}`;
+        if (!script.includes(fnName)) {
+            addError(result, `L1 AIX: missing L0 function definition '${fnName}' for module '${mod}'`);
+        }
+    }
+    // Module array — the orchestration loop must list all modules
+    for (const mod of moduleNames) {
+        if (!script.includes(`"${mod}"`)) {
+            addError(result, `L1 AIX: module '${mod}' not found in modules array`);
+        }
+    }
+    // ksh88 array population must use `set -A` (no bash `arr=(...)` form)
+    if (!/\bset -A\b/.test(script)) {
+        addError(result, "L1 AIX: missing 'set -A' module array — ksh88 does not support bash array assignment");
+    }
+    // Core functions
+    if (!script.includes("run_all_modules")) {
+        addError(result, "L1 AIX: missing 'run_all_modules' entry point");
+    }
+    if (!script.includes("_push_to_iceberg")) {
+        addError(result, "L1 AIX: missing '_push_to_iceberg' function");
+    }
+    if (!script.includes("_run_module")) {
+        addError(result, "L1 AIX: missing '_run_module' function");
+    }
+    if (!script.includes("_build_envelope")) {
+        addError(result, "L1 AIX: missing '_build_envelope' function — L0 log/result records would never be folded into a payload");
+    }
+    if (!script.includes("_json_validate")) {
+        addWarning(result, "L1 AIX: missing '_json_validate' — output won't be checked before push");
+    }
+    if (!script.includes(".ndjson")) {
+        addWarning(result, "L1 AIX: no '.ndjson' capture file — L0 record streams may not be captured line-wise");
+    }
+    if (!script.includes("_interrupt_and_flush") || !/trap\s+_interrupt_and_flush\s+TERM/.test(script)) {
+        addError(result, "L1 AIX: missing TERM timeout flush handler — partial L0 records would be lost when the wrapper watchdog fires");
+    }
+    // ksh88 incompatibilities that would silently break on AIX /bin/ksh.
+    // These are why dev-box `ksh -n` (ksh93) is not enough — ksh93 accepts them.
+    for (const err of detectKsh88Incompatibilities(script, "L1 AIX")) {
+        addError(result, err);
+    }
+    // L1 self-redirects its own logs (kept for manual debug runs; the SRC
+    // wrapper daemon also redirects, so this is belt-and-suspenders).
+    if (!/exec\s+>>.*NEXUS_SERVICE_NAME/.test(script)) {
+        addError(result, "L1 AIX: missing 'exec >> ...${NEXUS_SERVICE_NAME}...' redirect — L1 logs will be lost");
+    }
+    return result;
+}
+function validateL1Windows(script, moduleNames) {
+    const result = createResult();
+    // Error preference
+    if (!script.includes("$ErrorActionPreference")) {
+        addError(result, "L1 Windows: missing $ErrorActionPreference setting");
+    }
+    // Env var reads
+    for (const envVar of NEXUS_ENV_VARS) {
+        if (!script.includes(`$env:${envVar}`)) {
+            addError(result, `L1 Windows: does not read env var $env:${envVar}`);
+        }
+    }
+    // Required guard
+    if (!script.includes("-not $IcebergEndpoint") ||
+        !script.includes("-not $AgentId") ||
+        !script.includes("-not $AuthToken")) {
+        addWarning(result, "L1 Windows: missing empty-check guard for required parameters");
+    }
+    // Module array — each module must appear in the @() array
+    for (const mod of moduleNames) {
+        if (!script.includes(`"${mod}"`)) {
+            addError(result, `L1 Windows: module '${mod}' not found in modules array`);
+        }
+    }
+    // Core functions
+    if (!script.includes("Invoke-AllModules")) {
+        addError(result, "L1 Windows: missing 'Invoke-AllModules' entry point");
+    }
+    if (!script.includes("Push-ToIceberg")) {
+        addError(result, "L1 Windows: missing 'Push-ToIceberg' function");
+    }
+    if (!script.includes("Build-Envelope")) {
+        addError(result, "L1 Windows: missing 'Build-Envelope' function — L0 log/result records would never be folded into a payload");
+    }
+    if (!script.includes("$env:NEXUS_TIMEOUT_SECONDS") ||
+        !script.includes("$job.Shell.Stop()") ||
+        !script.includes("$collected = @($job.Output)")) {
+        addError(result, "L1 Windows: missing runspace timeout/partial-output handling — records emitted before timeout would be lost");
+    }
+    // Runspace pool — the parallelism mechanism
+    if (!script.includes("RunspacePool")) {
+        addWarning(result, "L1 Windows: missing RunspacePool — modules may not run in parallel");
+    }
+    // Here-string terminators — must conform to PowerShell 5.1 rules
+    const terminatorErrors = validateHereStringTerminators(script);
+    for (const err of terminatorErrors) {
+        addError(result, `L1 Windows: ${err}`);
+    }
+    // Mixed line endings — PowerShell 5.1 can fail with mixed \r\n and \n
+    const hasCRLF = script.includes("\r\n");
+    const bareLF = (script.match(/(?<!\r)\n/g) || []).length;
+    if (hasCRLF && bareLF > 0) {
+        addError(result, `L1 Windows: mixed line endings — ${bareLF} bare LF lines mixed with CRLF`);
+    }
+    return result;
+}
+export function validateL1(script, osFamily, moduleNames) {
+    log.info("Validating L1 script", { osFamily, moduleCount: moduleNames.length });
+    const placeholders = checkUnreplacedPlaceholders(script, "L1");
+    const structural = osFamily === "linux"
+        ? validateL1Linux(script, moduleNames)
+        : osFamily === "aix"
+            ? validateL1Aix(script, moduleNames)
+            : validateL1Windows(script, moduleNames);
+    const result = mergeResults(placeholders, structural);
+    if (result.valid) {
+        log.info("L1 validation passed", { warnings: result.warnings.length });
+    }
+    else {
+        log.error("L1 validation failed", {
+            errorCount: result.errors.length,
+            errors: result.errors,
+        });
+    }
+    for (const w of result.warnings) {
+        log.debug("L1 validation warning", { warning: w });
+    }
+    return result;
+}
+// ── L2 Validation ──────────────────────────────────────────────────────────
+function validateL2Linux(script) {
+    const result = createResult();
+    // Shebang
+    if (!script.startsWith("#!/bin/bash")) {
+        addError(result, "L2 Linux: missing #!/bin/bash shebang");
+    }
+    // Shell safety flags
+    if (!script.includes("set -euo pipefail")) {
+        addError(result, "L2 Linux: missing 'set -euo pipefail' safety flags");
+    }
+    // Named flag argument parser
+    if (!script.includes("--service-name")) {
+        addError(result, "L2 Linux: missing --service-name flag in argument parser");
+    }
+    // Composition default variables
+    const requiredVars = [
+        "BUFFER_TIME",
+        "ICEBERG_ENDPOINT",
+        "AGENT_ID",
+        "AUTH_TOKEN",
+        "ORG_ID",
+        "MAX_PARALLEL",
+        "TIMEOUT",
+    ];
+    for (const v of requiredVars) {
+        if (!script.includes(`${v}=`)) {
+            addError(result, `L2 Linux: missing variable ${v}`);
+        }
+    }
+    // L1 body embedding
+    if (!script.includes("NEXUS_L1_SCRIPT_BOUNDARY")) {
+        addError(result, "L2 Linux: missing NEXUS_L1_SCRIPT_BOUNDARY heredoc — L1 not embedded");
+    }
+    // Env file — must write all NEXUS_* vars so L1 can read them at runtime
+    for (const envVar of NEXUS_ENV_VARS) {
+        if (!script.includes(`${envVar}=`)) {
+            addError(result, `L2 Linux: env file does not set ${envVar} — L1 will fail to read it`);
+        }
+    }
+    // Systemd units
+    if (!script.includes(".service")) {
+        addError(result, "L2 Linux: missing systemd service unit creation");
+    }
+    if (!script.includes(".timer")) {
+        addError(result, "L2 Linux: missing systemd timer unit creation");
+    }
+    if (!script.includes("EnvironmentFile=")) {
+        addError(result, "L2 Linux: systemd service missing EnvironmentFile= directive — env vars won't reach L1");
+    }
+    if (!script.includes("systemctl daemon-reload")) {
+        addError(result, "L2 Linux: missing 'systemctl daemon-reload'");
+    }
+    if (!script.includes("systemctl enable")) {
+        addWarning(result, "L2 Linux: missing 'systemctl enable' — timer won't survive reboot");
+    }
+    if (!script.includes("systemctl start")) {
+        addWarning(result, "L2 Linux: missing 'systemctl start' — timer won't begin immediately");
+    }
+    // ── systemd 228 compatibility (SLES 12 SP5) ────────────────────────────────
+    // Each of these directives breaks on systemd < a particular version. Checks
+    // are anchored at start-of-line so explanatory comments inside heredocs
+    // (which mention the broken directive names by design) don't false-positive.
+    //   Type=oneshot + Restart=  → forbidden until systemd 244
+    //   StandardOutput=append:   → introduced in systemd 240
+    //   StartLimitIntervalSec=   → renamed (was StartLimitInterval=) in 230
+    //   RandomizedDelaySec=      → introduced in systemd 229 (warn-only)
+    const hasOneshotDirective = /^Type=oneshot\s*$/m.test(script);
+    const hasRealRestart = /^Restart=(?!no\b)/m.test(script);
+    if (hasOneshotDirective && hasRealRestart) {
+        addError(result, "L2 Linux: Type=oneshot combined with Restart= is rejected by systemd < 244 (SLES 12). Use Type=simple.");
+    }
+    if (!/^Type=simple\s*$/m.test(script)) {
+        addError(result, "L2 Linux: missing 'Type=simple' — required for systemd 228 + Restart= compatibility");
+    }
+    if (/^StandardOutput=append:/m.test(script) ||
+        /^StandardError=append:/m.test(script)) {
+        addError(result, "L2 Linux: 'append:' output specifier requires systemd >= 240 (breaks SLES 12). Use in-script 'exec >>' redirect in L1 instead.");
+    }
+    if (/^StartLimitIntervalSec=/m.test(script)) {
+        addError(result, "L2 Linux: 'StartLimitIntervalSec=' requires systemd >= 230. Use 'StartLimitInterval=' (in [Service]) for systemd 228 compatibility.");
+    }
+    if (!/^StartLimitInterval=/m.test(script)) {
+        addError(result, "L2 Linux: missing rate-limit directive 'StartLimitInterval=' — required to throttle restart loops");
+    }
+    if (/^RandomizedDelaySec=/m.test(script)) {
+        addWarning(result, "L2 Linux: 'RandomizedDelaySec=' requires systemd >= 229 and is ignored on 228. Drop it unless cross-host trigger jitter is genuinely needed.");
+    }
+    if (!script.includes("NEXUS_SERVICE_NAME=")) {
+        addError(result, "L2 Linux: env file does not set NEXUS_SERVICE_NAME — L1 cannot redirect its own logs");
+    }
+    if (!/^TimeoutStopSec=\S+/m.test(script)) {
+        addError(result, "L2 Linux: missing TimeoutStopSec grace period — L1 may be killed before partial timeout records are posted");
+    }
+    return result;
+}
+function validateL2Aix(script) {
+    const result = createResult();
+    // Shebang
+    if (!script.startsWith("#!/bin/ksh")) {
+        addError(result, "L2 AIX: missing #!/bin/ksh shebang");
+    }
+    // Shell safety flags — ksh88 has no `pipefail`.
+    if (!/^set -u\b/m.test(script)) {
+        addError(result, "L2 AIX: missing 'set -u' safety flag");
+    }
+    // Named flag argument parser
+    if (!script.includes("--service-name")) {
+        addError(result, "L2 AIX: missing --service-name flag in argument parser");
+    }
+    // Composition default variables — the SRC wrapper uses integer seconds.
+    const requiredVars = [
+        "BUFFER_TIME_SECONDS",
+        "TIMEOUT_SECONDS",
+        "ICEBERG_ENDPOINT",
+        "AGENT_ID",
+        "AUTH_TOKEN",
+        "ORG_ID",
+        "MAX_PARALLEL",
+    ];
+    for (const v of requiredVars) {
+        if (!script.includes(`${v}=`)) {
+            addError(result, `L2 AIX: missing variable ${v}`);
+        }
+    }
+    // L1 body embedding — same heredoc marker as Linux
+    if (!script.includes("NEXUS_L1_SCRIPT_BOUNDARY")) {
+        addError(result, "L2 AIX: missing NEXUS_L1_SCRIPT_BOUNDARY heredoc — L1 not embedded");
+    }
+    // Env file — must write all NEXUS_* vars so L1 can read them at runtime
+    for (const envVar of NEXUS_ENV_VARS) {
+        if (!script.includes(`${envVar}=`)) {
+            addError(result, `L2 AIX: env file does not set ${envVar} — L1 will fail to read it`);
+        }
+    }
+    if (!script.includes("NEXUS_SERVICE_NAME=")) {
+        addError(result, "L2 AIX: env file does not set NEXUS_SERVICE_NAME — L1 cannot redirect its own logs");
+    }
+    // ── SRC subsystem registration ─────────────────────────────────────────
+    // SRC wants a daemon that never exits; L2 registers the ksh wrapper as a
+    // subsystem and boots it from inittab.
+    if (!script.includes("mkssys")) {
+        addError(result, "L2 AIX: missing 'mkssys' — SRC subsystem is never registered");
+    }
+    if (!script.includes("mkitab")) {
+        addError(result, "L2 AIX: missing 'mkitab' — subsystem won't start at boot");
+    }
+    if (!script.includes("startsrc")) {
+        addWarning(result, "L2 AIX: missing 'startsrc' — subsystem won't begin immediately");
+    }
+    // ── Teardown of previous / same-name deployments ────────────────────────
+    // Without these the old wrapper daemon keeps running and spawning L1 in
+    // parallel with the new deployment (the AIX analog of the Windows
+    // Stop-NexusModScript teardown).
+    if (!script.includes("stopsrc")) {
+        addError(result, "L2 AIX: missing 'stopsrc' — previous subsystem won't be stopped on redeploy");
+    }
+    if (!script.includes("rmssys")) {
+        addError(result, "L2 AIX: missing 'rmssys' — previous SRC subsystem definition will leak in the ODM");
+    }
+    if (!script.includes("rmitab")) {
+        addError(result, "L2 AIX: missing 'rmitab' — previous inittab boot entry will leak");
+    }
+    // ── Persistent wrapper daemon (the actual SRC-managed process) ──────────
+    // It must never exit (while loop), trap SIGTERM for a clean stopsrc, and
+    // enforce the per-run timeout by killing the L1 child (watchdog).
+    if (!/\bwhile\s+(true|:)\b/.test(script)) {
+        addError(result, "L2 AIX: wrapper daemon missing 'while true' loop — script would exit and SRC would mark it inoperative");
+    }
+    if (!script.includes("trap")) {
+        addError(result, "L2 AIX: wrapper daemon missing 'trap' — stopsrc would wait the full -w window before SIGKILL");
+    }
+    if (!/\bkill\b/.test(script)) {
+        addError(result, "L2 AIX: wrapper daemon missing 'kill' — the per-run timeout watchdog cannot force-stop a hung L1");
+    }
+    // ksh88 incompatibilities
+    for (const err of detectKsh88Incompatibilities(script, "L2 AIX")) {
+        addError(result, err);
+    }
+    return result;
+}
+/**
+ * Detect bash/ksh93-only constructs that AIX's default /bin/ksh (ksh88) rejects.
+ * This catches the class of bugs that `ksh -n` on a dev box misses, because dev
+ * `ksh` is almost always ksh93 (and macOS ships ksh93), which happily parses
+ * here-strings, process substitution, indirect/substring expansion, etc.
+ *
+ * Comments are stripped first so explanatory prose mentioning a construct
+ * doesn't false-positive. The checks scan code only.
+ */
+function detectKsh88Incompatibilities(script, label) {
+    const errors = [];
+    // Strip full-line and trailing comments (heuristic — good enough for token
+    // presence detection; avoids the obvious comment false-positives).
+    const code = script
+        .split("\n")
+        .map((line) => line.replace(/(^|\s)#.*$/, "$1"))
+        .join("\n");
+    const checks = [
+        { re: /<<</, msg: "here-strings ('<<<') — use 'print -r -- \"$x\" | cmd'" },
+        { re: /[<>]\(/, msg: "process substitution ('<(...)'/'>(...)') — stage to a temp file and redirect" },
+        { re: /\$\{!/, msg: "indirect expansion ('${!var}') — use eval to read the named variable" },
+        // Offset form is `${var:N}`, `${var:N:M}` or `${var: -N}` (space before the
+        // minus). NOT `${var:-default}` (no space) — that's a valid ksh88 default.
+        { re: /\$\{[A-Za-z_][A-Za-z0-9_]*:( +-?[0-9]+|[0-9]+)(:-?[0-9]+)?\}/, msg: "substring offset ('${var:n:m}'/'${var: -n}') — use prefix/suffix removal or sed" },
+        { re: /\bwait -n\b/, msg: "'wait -n' — use a batch concurrency gate" },
+        { re: /(^|;)\s*local\s+\w/m, msg: "'local' — use 'typeset' for function-local vars" },
+        { re: /&>/, msg: "'&>' redirect — use '>file 2>&1'" },
+        { re: /\bmapfile\b|\breadarray\b/, msg: "'mapfile'/'readarray' — read with a while loop" },
+        { re: /\bprintf\s+-v\b/, msg: "'printf -v' — capture with command substitution" },
+        // These are the nastiest failures of the lot: ksh88 simply doesn't define
+        // them, so under the `set -u` L1 inherits, the *first* reference aborts the
+        // collector mid-run. It emits no result record and the module silently
+        // shows up as "No output from nexus_collect_<name>".
+        { re: /\$\{?E?UID\b/, msg: "'$EUID'/'$UID' — undefined in ksh88; under 'set -u' the first reference aborts the collector. Use '$(id -u)'" },
+        { re: /\$\{?BASH_[A-Z_]+/, msg: "a '$BASH_*' variable — undefined in ksh88; under 'set -u' the first reference aborts the collector" },
+    ];
+    for (const { re, msg } of checks) {
+        if (re.test(code)) {
+            errors.push(`${label}: uses ${msg} — unsupported in ksh88 (AIX /bin/ksh).`);
+        }
+    }
+    return errors;
+}
+function validateL2Windows(script) {
+    const result = createResult();
+    // Param block
+    if (!script.includes("param(")) {
+        addError(result, "L2 Windows: missing param() block");
+    }
+    // ServiceName is the only required runtime param() parameter
+    // All other config values are baked as variable assignments at composition time
+    const requiredVars = [
+        "ServiceName",
+        "BufferTimeSeconds",
+        "TimeoutSeconds",
+        "IcebergEndpoint",
+        "AgentId",
+        "AuthToken",
+        "OrgId",
+    ];
+    for (const v of requiredVars) {
+        if (!script.includes(`$${v}`)) {
+            addError(result, `L2 Windows: missing variable $${v}`);
+        }
+    }
+    // L1 body embedding — PowerShell here-string
+    if (!script.includes("@'") || !script.includes("'@")) {
+        addError(result, "L2 Windows: missing here-string markers — L1 not embedded");
+    }
+    // Here-string terminators — must conform to PowerShell 5.1 rules
+    const terminatorErrors = validateHereStringTerminators(script);
+    for (const err of terminatorErrors) {
+        addError(result, `L2 Windows: ${err}`);
+    }
+    // Mixed line endings — PowerShell 5.1 can fail with mixed \r\n and \n
+    const hasCRLF = script.includes("\r\n");
+    const bareLF = (script.match(/(?<!\r)\n/g) || []).length;
+    if (hasCRLF && bareLF > 0) {
+        addError(result, `L2 Windows: mixed line endings — ${bareLF} bare LF lines mixed with CRLF`);
+    }
+    // Env file — must write all NEXUS_* vars
+    for (const envVar of NEXUS_ENV_VARS) {
+        if (!script.includes(`${envVar}=`)) {
+            addError(result, `L2 Windows: env.conf does not set ${envVar} — L1 will fail to read it`);
+        }
+    }
+    if (!script.includes("NEXUS_TIMEOUT_SECONDS=")) {
+        addError(result, "L2 Windows: env.conf does not set NEXUS_TIMEOUT_SECONDS — L1 cannot stop runspaces gracefully before the wrapper hard timeout");
+    }
+    // Wrapper script — loads env and runs L1
+    if (!script.includes("wrapper.ps1")) {
+        addError(result, "L2 Windows: missing wrapper.ps1 creation — env vars won't be loaded before L1 runs");
+    }
+    // SetEnvironmentVariable in wrapper — the mechanism that feeds env vars to L1
+    if (!script.includes("SetEnvironmentVariable")) {
+        addError(result, "L2 Windows: wrapper missing SetEnvironmentVariable — env vars won't propagate to L1 process");
+    }
+    // Scheduled task
+    if (!script.includes("Register-ScheduledTask")) {
+        addError(result, "L2 Windows: missing Register-ScheduledTask");
+    }
+    // Teardown of previous / same-name deployments — must kill the running
+    // wrapper.ps1 + l1-script.ps1 processes, not just unregister the task.
+    // Without these markers the L2 only does a soft unregister and orphans the
+    // previous wrapper's `while ($true)` loop, which keeps spawning L1 in
+    // parallel with the new deployment.
+    if (!script.includes("Stop-NexusModScript")) {
+        addError(result, "L2 Windows: missing Stop-NexusModScript helper — teardown of previous deployment is incomplete");
+    }
+    // Helper must accept both bare service names and the prefixed task name
+    // returned in the L2 output JSON's 'service_id' field. Without this
+    // normalisation an orchestrator round-tripping service_id back into
+    // -PreviousServiceId silently doubles the prefix and matches nothing.
+    if (!script.includes('StartsWith("NexusModScript-")')) {
+        addError(result, "L2 Windows: Stop-NexusModScript missing prefix normalisation — callers passing the JSON 'service_id' value will silently miss every cleanup target");
+    }
+    if (!script.includes("Stop-ScheduledTask")) {
+        addError(result, "L2 Windows: missing Stop-ScheduledTask — previous task instances will keep running after Unregister-ScheduledTask");
+    }
+    if (!script.includes("Win32_Process")) {
+        addError(result, "L2 Windows: missing Win32_Process lookup — previous wrapper.ps1 / l1-script.ps1 processes will not be killed on redeploy");
+    }
+    // Error handling
+    if (!script.includes('$ErrorActionPreference = "Stop"')) {
+        addWarning(result, "L2 Windows: ErrorActionPreference not set to Stop — errors may be silently ignored");
+    }
+    return result;
+}
+export function validateL2(script, osFamily) {
+    log.info("Validating L2 script", { osFamily });
+    const placeholders = checkUnreplacedPlaceholders(script, "L2");
+    const structural = osFamily === "linux"
+        ? validateL2Linux(script)
+        : osFamily === "aix"
+            ? validateL2Aix(script)
+            : validateL2Windows(script);
+    const result = mergeResults(placeholders, structural);
+    if (result.valid) {
+        log.info("L2 validation passed", { warnings: result.warnings.length });
+    }
+    else {
+        log.error("L2 validation failed", {
+            errorCount: result.errors.length,
+            errors: result.errors,
+        });
+    }
+    for (const w of result.warnings) {
+        log.debug("L2 validation warning", { warning: w });
+    }
+    return result;
+}
+// ── Parameter flow: L2 → env file → L1 ────────────────────────────────────
+export function validateParameterFlow(l1Script, l2Script, osFamily, orgId) {
+    log.info("Validating parameter flow L2 → L1", { osFamily });
+    const result = createResult();
+    // 1. Every env var that L2 writes must be consumed by L1
+    for (const envVar of NEXUS_ENV_VARS) {
+        const l2Writes = l2Script.includes(`${envVar}=`);
+        const l1Reads = osFamily === "windows"
+            ? l1Script.includes(`$env:${envVar}`)
+            : l1Script.includes(envVar);
+        if (l2Writes && !l1Reads) {
+            addWarning(result, `Parameter flow: L2 sets ${envVar} but L1 never reads it`);
+        }
+        if (!l2Writes && l1Reads) {
+            addError(result, `Parameter flow: L1 reads ${envVar} but L2 never writes it to env file — will be empty at runtime`);
+        }
+        if (!l2Writes && !l1Reads) {
+            addError(result, `Parameter flow: ${envVar} is neither written by L2 nor read by L1 — broken contract`);
+        }
+    }
+    // 2. ORG_ID is baked directly into L1 (not via env), verify it was substituted
+    if (osFamily === "linux" || osFamily === "aix") {
+        // In L1 Linux/AIX, ORG_ID appears as a literal string in the
+        // _push_to_iceberg envelope. Check it's not still a placeholder and not empty.
+        if (l1Script.includes("{{ORG_ID}}")) {
+            addError(result, "Parameter flow: ORG_ID was not substituted in L1 — still a placeholder");
+        }
+        // Verify actual orgId value appears in the script
+        if (!l1Script.includes(`'org_id': '${orgId}'`) &&
+            !l1Script.includes(`"org_id":"${orgId}"`) &&
+            !l1Script.includes(`--arg cid "${orgId}"`)) {
+            addWarning(result, `Parameter flow: ORG_ID value '${orgId}' not found baked into L1 ${osFamily} envelope`);
+        }
+    }
+    else {
+        if (l1Script.includes("{{ORG_ID}}")) {
+            addError(result, "Parameter flow: ORG_ID was not substituted in L1 — still a placeholder");
+        }
+        if (!l1Script.includes(`$OrgId        = "${orgId}"`)) {
+            addWarning(result, `Parameter flow: ORG_ID value '${orgId}' not found baked into L1 Windows $OrgId variable`);
+        }
+    }
+    // 3. L2 must embed the L1 body — without this the whole chain is broken.
+    //    Linux & AIX use the NEXUS_L1_SCRIPT_BOUNDARY heredoc; Windows a here-string.
+    if (osFamily === "windows") {
+        if (!l2Script.includes("$l1Content = @'")) {
+            addError(result, "Parameter flow: L2 does not embed L1 script — deployment will have no collection logic");
+        }
+    }
+    else {
+        if (!l2Script.includes("NEXUS_L1_SCRIPT_BOUNDARY")) {
+            addError(result, "Parameter flow: L2 does not embed L1 script — deployment will have no collection logic");
+        }
+    }
+    // 4. L2 env file must be loaded before L1 runs.
+    //    Linux: systemd EnvironmentFile=. Windows: wrapper SetEnvironmentVariable.
+    //    AIX: the SRC wrapper daemon sources the env file (`. <file>`) before exec'ing L1.
+    if (osFamily === "linux") {
+        if (!l2Script.includes("EnvironmentFile=")) {
+            addError(result, "Parameter flow: systemd service has no EnvironmentFile — L1 will run without env vars");
+        }
+    }
+    else if (osFamily === "aix") {
+        // Match a POSIX `.`/`source` of the env file in the wrapper daemon.
+        // The wrapper is written via an unquoted heredoc, so its runtime `$`
+        // appears escaped (`\$ENV_FILE`) in the composed L2 — allow the backslash.
+        if (!/(^|\s)(\.|source)\s+["']?\\?\$?\{?(INSTALL_DIR|ENV_FILE)/m.test(l2Script)) {
+            addError(result, "Parameter flow: AIX wrapper daemon doesn't source the env file — L1 will run without env vars");
+        }
+    }
+    else {
+        if (!l2Script.includes("SetEnvironmentVariable")) {
+            addError(result, "Parameter flow: Windows wrapper doesn't call SetEnvironmentVariable — L1 will run without env vars");
+        }
+    }
+    if (result.valid) {
+        log.info("Parameter flow validation passed", {
+            warnings: result.warnings.length,
+        });
+    }
+    else {
+        log.error("Parameter flow validation failed", {
+            errorCount: result.errors.length,
+            errors: result.errors,
+        });
+    }
+    for (const w of result.warnings) {
+        log.debug("Parameter flow warning", { warning: w });
+    }
+    return result;
+}
+// ── Shell syntax checks ────────────────────────────────────────────────────
+function shellAvailable(cmd) {
+    try {
+        execSync(`which ${cmd}`, { stdio: "ignore" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function writeTempFile(content, ext) {
+    const name = `nexus-validate-${Date.now()}-${Math.random().toString(36).slice(2)}.${ext}`;
+    const path = join(tmpdir(), name);
+    writeFileSync(path, content, "utf-8");
+    return path;
+}
+function removeTempFile(path) {
+    try {
+        unlinkSync(path);
+    }
+    catch {
+        // best-effort cleanup
+    }
+}
+export async function syntaxCheckBash(script, label) {
+    return syntaxCheckShellLike(script, label, "bash");
+}
+export async function syntaxCheckKsh(script, label) {
+    // ⚠️ Dev/CI `ksh` is typically ksh93, which is more lenient than the AIX
+    // default ksh88. `ksh -n` catches gross syntax errors but won't flag every
+    // ksh88-only regression — real ksh88 safety comes from the hand-written
+    // templates and the structural ksh88 guards in validateL1Aix/validateL2Aix.
+    return syntaxCheckShellLike(script, label, "ksh");
+}
+async function syntaxCheckShellLike(script, label, interpreter) {
+    const result = createResult();
+    const tmpPath = writeTempFile(script, "sh");
+    try {
+        // Phase 1: `<interpreter> -n` for basic syntax validation
+        if (shellAvailable(interpreter)) {
+            log.debug(`Running ${interpreter} -n syntax check`, { label, tmpPath });
+            try {
+                execSync(`${interpreter} -n "${tmpPath}"`, {
+                    stdio: ["ignore", "ignore", "pipe"],
+                    timeout: 15_000,
+                });
+                log.info(`${interpreter} -n syntax check passed`, { label });
+            }
+            catch (err) {
+                const stderr = err instanceof Error && "stderr" in err
+                    ? String(err.stderr)
+                    : String(err);
+                const cleanErr = stderr.replace(new RegExp(tmpPath.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "g"), label);
+                addError(result, `${label}: ${interpreter} syntax error:\n${cleanErr.trim()}`);
+                log.error(`${interpreter} -n syntax check failed`, { label, error: cleanErr.trim() });
+            }
+        }
+        else {
+            addWarning(result, `${label}: ${interpreter} not found — skipping ${interpreter} -n check`);
+        }
+        // Phase 2: shellcheck for deeper lint (SC errors = errors, SC warnings = warnings)
+        // Uses bundled platform-specific binary, falls back to system binary
+        log.debug("Running shellcheck", { label, tmpPath });
+        let shellcheckOutput = null;
+        const shellcheckBin = getShellcheckPath();
+        if (shellcheckBin !== null) {
+            try {
+                const buf = execSync(`"${shellcheckBin}" -f json -S error "${tmpPath}"`, {
+                    stdio: ["ignore", "pipe", "ignore"],
+                    timeout: 30_000,
+                });
+                shellcheckOutput = buf.toString("utf8");
+            }
+            catch (scErr) {
+                // shellcheck exits non-zero when it finds issues — stdout still has JSON
+                if (scErr instanceof Error && "stdout" in scErr) {
+                    shellcheckOutput = String(scErr.stdout);
+                }
+            }
+        }
+        if (shellcheckOutput !== null) {
+            let findings = [];
+            try {
+                findings = JSON.parse(shellcheckOutput);
+            }
+            catch {
+                addWarning(result, `${label}: shellcheck returned non-JSON output`);
+            }
+            const errors = findings.filter((f) => f.level === "error");
+            const warnings = findings.filter((f) => f.level === "warning");
+            for (const f of errors) {
+                addError(result, `${label}: shellcheck SC${f.code} (line ${f.line}:${f.column}): ${f.message}`);
+            }
+            for (const f of warnings) {
+                addWarning(result, `${label}: shellcheck SC${f.code} (line ${f.line}:${f.column}): ${f.message}`);
+            }
+            if (errors.length === 0) {
+                log.info("shellcheck passed", { label, warnings: warnings.length });
+            }
+            else {
+                log.error("shellcheck found errors", { label, errorCount: errors.length, warningCount: warnings.length });
+            }
+        }
+        else {
+            addWarning(result, `${label}: shellcheck not available — skipping deep lint`);
+            log.info("shellcheck not available, skipping", { label });
+        }
+    }
+    finally {
+        removeTempFile(tmpPath);
+    }
+    return result;
+}
+export async function syntaxCheckPowerShell(script, label) {
+    const result = createResult();
+    if (!shellAvailable("pwsh")) {
+        addWarning(result, `${label}: pwsh not found — skipping PowerShell syntax check`);
+        log.info("PowerShell syntax check skipped — pwsh not available", { label });
+        return result;
+    }
+    const tmpPath = writeTempFile(script, "ps1");
+    // Write a separate validator script so shell doesn't eat PowerShell's $ variables
+    const validatorScript = [
+        `$null = [System.Management.Automation.Language.Parser]::ParseFile('${tmpPath}', [ref]$null, [ref]$errors)`,
+        `if ($errors.Count -gt 0) { $errors | ForEach-Object { Write-Error $_.ToString() }; exit 1 }`,
+    ].join("\n");
+    const validatorPath = writeTempFile(validatorScript, "ps1");
+    try {
+        log.debug("Running pwsh syntax check", { label, tmpPath });
+        execSync(`pwsh -NoProfile -NonInteractive -File "${validatorPath}"`, {
+            stdio: ["ignore", "ignore", "pipe"],
+            timeout: 30_000,
+        });
+        log.info("PowerShell syntax check passed", { label });
+    }
+    catch (err) {
+        const stderr = err instanceof Error && "stderr" in err
+            ? String(err.stderr)
+            : String(err);
+        const cleanErr = stderr
+            .replace(new RegExp(tmpPath.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "g"), label)
+            .replace(new RegExp(validatorPath.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "g"), "(validator)");
+        addError(result, `${label}: PowerShell syntax error:\n${cleanErr.trim()}`);
+        log.error("PowerShell syntax check failed", { label, error: cleanErr.trim() });
+    }
+    finally {
+        removeTempFile(tmpPath);
+        removeTempFile(validatorPath);
+    }
+    return result;
+}
+async function syntaxCheck(script, osFamily, label) {
+    if (osFamily === "linux") {
+        return syntaxCheckBash(script, label);
+    }
+    else if (osFamily === "aix") {
+        return syntaxCheckKsh(script, label);
+    }
+    else {
+        return syntaxCheckPowerShell(script, label);
+    }
+}
+// ── L2 structural dry-run ──────────────────────────────────────────────────
+function extractL1FromL2Linux(l2Script) {
+    // L1 is embedded between heredoc markers:
+    //   cat > "$SCRIPT_PATH" << 'NEXUS_L1_SCRIPT_BOUNDARY'
+    //   ...l1 content...
+    //   NEXUS_L1_SCRIPT_BOUNDARY
+    const startMarker = "NEXUS_L1_SCRIPT_BOUNDARY";
+    const startIdx = l2Script.indexOf(startMarker);
+    if (startIdx === -1)
+        return null;
+    // Find the first newline after the opening marker line
+    const contentStart = l2Script.indexOf("\n", startIdx) + 1;
+    if (contentStart === 0)
+        return null;
+    // Find the closing marker (standalone on its own line)
+    const closingPattern = new RegExp(`^${startMarker}$`, "m");
+    const remaining = l2Script.slice(contentStart);
+    const closingMatch = closingPattern.exec(remaining);
+    if (!closingMatch)
+        return null;
+    return remaining.slice(0, closingMatch.index);
+}
+function extractL1FromL2Windows(l2Script) {
+    // L1 is embedded in a PowerShell here-string:
+    //   $l1Content = @'
+    //   ...l1 content...
+    //   '@
+    const startMarker = "$l1Content = @'";
+    const startIdx = l2Script.indexOf(startMarker);
+    if (startIdx === -1)
+        return null;
+    const contentStart = l2Script.indexOf("\n", startIdx) + 1;
+    if (contentStart === 0)
+        return null;
+    // Closing here-string: '@ at the start of a line
+    const remaining = l2Script.slice(contentStart);
+    const closingMatch = /^'@/m.exec(remaining);
+    if (!closingMatch)
+        return null;
+    return remaining.slice(0, closingMatch.index);
+}
+export async function validateL2StructuralDryRun(l1Script, l2Script, osFamily, moduleNames) {
+    log.info("Running L2 structural dry-run", { osFamily });
+    const result = createResult();
+    // 1. Extract the L1 body embedded inside L2.
+    //    AIX uses the same NEXUS_L1_SCRIPT_BOUNDARY heredoc as Linux.
+    const extractedL1 = osFamily === "windows"
+        ? extractL1FromL2Windows(l2Script)
+        : extractL1FromL2Linux(l2Script);
+    if (extractedL1 === null) {
+        addError(result, "L2 dry-run: could not extract embedded L1 body from L2 script — " +
+            (osFamily === "windows"
+                ? "here-string @'...'@ block not found"
+                : "NEXUS_L1_SCRIPT_BOUNDARY heredoc not found"));
+        log.error("L2 dry-run: L1 extraction failed", { osFamily });
+        return result;
+    }
+    log.debug("Extracted L1 from L2", {
+        extractedLength: extractedL1.length,
+        standaloneLength: l1Script.length,
+    });
+    // 2. Verify extracted L1 matches the standalone L1 we composed
+    const extractedTrimmed = extractedL1.trim();
+    const standaloneTrimmed = l1Script.trim();
+    if (extractedTrimmed !== standaloneTrimmed) {
+        // Find where they diverge for a useful error
+        let divergeIdx = 0;
+        const minLen = Math.min(extractedTrimmed.length, standaloneTrimmed.length);
+        while (divergeIdx < minLen && extractedTrimmed[divergeIdx] === standaloneTrimmed[divergeIdx]) {
+            divergeIdx++;
+        }
+        const contextStart = Math.max(0, divergeIdx - 40);
+        const extractedSnippet = extractedTrimmed.slice(contextStart, divergeIdx + 40);
+        const standaloneSnippet = standaloneTrimmed.slice(contextStart, divergeIdx + 40);
+        addError(result, `L2 dry-run: embedded L1 does not match standalone L1 — ` +
+            `diverges at byte ${divergeIdx}. ` +
+            `Embedded: "...${extractedSnippet}..." vs Standalone: "...${standaloneSnippet}..."`);
+        log.error("L2 dry-run: L1 content mismatch", {
+            divergeIdx,
+            extractedLength: extractedTrimmed.length,
+            standaloneLength: standaloneTrimmed.length,
+        });
+    }
+    else {
+        log.info("L2 dry-run: embedded L1 matches standalone L1");
+    }
+    // 3. Syntax-check the extracted L1 (proves the embedding didn't corrupt it)
+    const extractedSyntax = await syntaxCheck(extractedTrimmed, osFamily, "L2-embedded-L1");
+    for (const e of extractedSyntax.errors) {
+        addError(result, `L2 dry-run: ${e}`);
+    }
+    for (const w of extractedSyntax.warnings) {
+        addWarning(result, `L2 dry-run: ${w}`);
+    }
+    // 4. Validate the extracted L1 has the expected structure
+    //    (catches cases where the heredoc boundary sliced wrong)
+    if (osFamily === "linux" || osFamily === "aix") {
+        const expectedShebang = osFamily === "aix" ? "#!/bin/ksh" : "#!/bin/bash";
+        if (!extractedTrimmed.startsWith(expectedShebang)) {
+            addError(result, `L2 dry-run: extracted L1 does not start with ${expectedShebang} shebang — heredoc boundary likely wrong`);
+        }
+        if (!extractedTrimmed.includes("run_all_modules")) {
+            addError(result, "L2 dry-run: extracted L1 missing run_all_modules entry point");
+        }
+    }
+    else {
+        if (!extractedTrimmed.includes("$ErrorActionPreference")) {
+            addError(result, "L2 dry-run: extracted L1 missing $ErrorActionPreference");
+        }
+        if (!extractedTrimmed.includes("Invoke-AllModules")) {
+            addError(result, "L2 dry-run: extracted L1 missing Invoke-AllModules entry point");
+        }
+    }
+    // 5. Verify each module's collector function survived embedding.
+    // The Windows name is derived the same way the L1 template derives it:
+    // module 'tomcat' -> 'Invoke-NexusCollect_Tomcat'. Checking the bare
+    // 'Invoke-NexusCollect_' prefix would let a single collector satisfy every
+    // module in the list.
+    for (const mod of moduleNames) {
+        const fnName = osFamily === "windows"
+            ? `Invoke-NexusCollect_${mod.charAt(0).toUpperCase()}${mod.slice(1)}`
+            : `nexus_collect_${mod}`;
+        if (!extractedTrimmed.includes(fnName)) {
+            addError(result, `L2 dry-run: extracted L1 missing function '${fnName}' for module '${mod}'`);
+        }
+    }
+    // 6. Verify L2 env file vars will match what the extracted L1 expects
+    for (const envVar of NEXUS_ENV_VARS) {
+        const l2Writes = l2Script.includes(`${envVar}=`);
+        const l1Reads = osFamily === "windows"
+            ? extractedTrimmed.includes(`$env:${envVar}`)
+            : extractedTrimmed.includes(envVar);
+        if (!l2Writes && l1Reads) {
+            addError(result, `L2 dry-run: extracted L1 reads ${envVar} but L2 env file never writes it`);
+        }
+    }
+    if (result.valid) {
+        log.info("L2 structural dry-run passed", { warnings: result.warnings.length });
+    }
+    else {
+        log.error("L2 structural dry-run failed", {
+            errorCount: result.errors.length,
+            errors: result.errors,
+        });
+    }
+    return result;
+}
+export async function validateComposedScripts(params) {
+    log.info("Running composed script validation", {
+        osFamily: params.osFamily,
+        modules: params.moduleNames,
+    });
+    // Phase 1: structural validation (synchronous)
+    const l1Result = validateL1(params.l1Script, params.osFamily, params.moduleNames);
+    const l2Result = validateL2(params.l2Script, params.osFamily);
+    const flowResult = validateParameterFlow(params.l1Script, params.l2Script, params.osFamily, params.orgId);
+    // Phase 2: shell syntax checks — bash -n + shellcheck / pwsh parse
+    const [l1Syntax, l2Syntax] = await Promise.all([
+        syntaxCheck(params.l1Script, params.osFamily, "L1"),
+        syntaxCheck(params.l2Script, params.osFamily, "L2"),
+    ]);
+    // Phase 3: L2 structural dry-run — extract L1 from L2, verify integrity
+    const dryRunResult = await validateL2StructuralDryRun(params.l1Script, params.l2Script, params.osFamily, params.moduleNames);
+    const combined = mergeResults(l1Result, l2Result, flowResult, l1Syntax, l2Syntax, dryRunResult);
+    log.info("Composed script validation complete", {
+        valid: combined.valid,
+        errors: combined.errors.length,
+        warnings: combined.warnings.length,
+    });
+    return combined;
+}
+//# sourceMappingURL=script-validator.js.map