@open-agent-toolkit/cli 0.3.7 → 0.3.8

package/dist/providers/claude/dispatch-envelope.js

@@ -1,4 +1,5 @@
-import { parseGenericDispatchRecord, } from '../identity/generic-dispatch-record.js';
+import { collectAbsolutePathViolations } from '../identity/absolute-paths.js';
+import { collectSensitiveDispatchContent, genericDispatchRecordBaseSchema, identityFieldsOf, parseGenericDispatchRecord, redactSensitiveValues, refineGenericDispatchRecord, } from '../identity/generic-dispatch-record.js';
 import YAML from 'yaml';
 import { z } from 'zod';
 import { readOatManagedClaudeRole } from './codec/materialize.js';
@@ -97,76 +98,166 @@ function definitionFrontmatter(content) {
     }
     return parsed;
 }
-function assertSameTarget(left, right) {
-    if (left.model !== right.model ||
-        left.effort !== right.effort ||
-        JSON.stringify(left.capabilityEvidence) !==
-            JSON.stringify(right.capabilityEvidence)) {
-        throw new Error('Claude resolver target and selection target disagree on model, effort, or capability evidence.');
+/** Render a Zod issue path as `a.b[0].c`, or `<root>` when empty. */
+export function formatIssuePath(prefix, path) {
+    let rendered = prefix ?? '';
+    for (const segment of path) {
+        rendered +=
+            typeof segment === 'number'
+                ? `[${segment}]`
+                : rendered === ''
+                    ? segment
+                    : `.${segment}`;
     }
+    return rendered === '' ? '<root>' : rendered;
+}
+export function zodIssueViolations(stage, prefix, error) {
+    return error.issues.map((issue) => ({
+        stage,
+        path: formatIssuePath(prefix, issue.path),
+        message: issue.message,
+    }));
 }
 /**
- * Validate the managed resolver result against the generated provider role and
- * the exact payload that will be launched. This is the production boundary
- * used by the project dispatch-record producer for managed Claude dispatches.
+ * The launch consistency checks, in the order the throwing boundary has always
+ * applied them, so its first reported error is unchanged. A check that needs
+ * an input which did not parse — the launch payload, the managed role marker,
+ * or the definition frontmatter — is skipped rather than guessed at.
  */
-export function acceptClaudeLaunchEnvelope(input) {
-    const resolution = resolutionSchema.parse(input.resolution);
+function launchConsistencyViolations(resolution, launch, definition) {
+    const violations = [];
     const provider = resolution.providers.claude;
-    const launch = launchPayloadSchema.parse(input.launch);
-    assertSameTarget(provider.target, provider.selection.target);
-    const validation = validateClaudeDispatchCapability(provider.selection.target);
+    const selected = provider.selection.target;
+    if (provider.target.model !== selected.model ||
+        provider.target.effort !== selected.effort ||
+        JSON.stringify(provider.target.capabilityEvidence) !==
+            JSON.stringify(selected.capabilityEvidence)) {
+        violations.push({
+            path: 'resolution.providers.claude.target',
+            message: 'Claude resolver target and selection target disagree on model, effort, or capability evidence.',
+        });
+    }
+    const validation = validateClaudeDispatchCapability(selected);
     if (!validation.valid) {
-        throw new Error(validation.reason ?? 'Resolver selected an invalid Claude target.');
+        violations.push({
+            path: 'resolution.providers.claude.selection.target',
+            message: validation.reason ?? 'Resolver selected an invalid Claude target.',
+        });
     }
     const baseRole = provider.selection.role === 'reviewer'
         ? 'oat-reviewer'
         : 'oat-phase-implementer';
     const expectedVariant = buildClaudeEffortVariantName({
         agentName: baseRole,
-        model: provider.selection.target.model,
-        effort: provider.selection.target.effort,
+        model: selected.model,
+        effort: selected.effort,
     });
     if (provider.dispatchArgs.variant !== expectedVariant) {
-        throw new Error(`Managed Claude resolver variant ${provider.dispatchArgs.variant} does not match selected target ${expectedVariant}.`);
+        violations.push({
+            path: 'resolution.providers.claude.dispatchArgs.variant',
+            message: `Managed Claude resolver variant ${provider.dispatchArgs.variant} does not match selected target ${expectedVariant}.`,
+        });
     }
-    if (launch.variant !== expectedVariant) {
-        throw new Error(`Claude launch variant ${launch.variant} does not match resolver-selected variant ${expectedVariant}.`);
+    if (launch !== null && launch.variant !== expectedVariant) {
+        violations.push({
+            path: 'payload.variant',
+            message: `Claude launch variant ${launch.variant} does not match resolver-selected variant ${expectedVariant}.`,
+        });
     }
-    const managed = readOatManagedClaudeRole(input.definition);
+    const managed = readOatManagedClaudeRole(definition);
     if (!managed || managed.roleName !== expectedVariant) {
-        throw new Error(`Generated Claude definition ${expectedVariant} is absent or is not the matching OAT-managed role.`);
+        violations.push({
+            path: 'definition',
+            message: `Generated Claude definition ${expectedVariant} is absent or is not the matching OAT-managed role.`,
+        });
     }
-    if (JSON.stringify(managed.capabilityEvidence) !==
-        JSON.stringify(provider.selection.target.capabilityEvidence)) {
-        throw new Error('Generated Claude definition capability evidence does not match the resolver-selected capability.');
+    if (managed &&
+        JSON.stringify(managed.capabilityEvidence) !==
+            JSON.stringify(selected.capabilityEvidence)) {
+        violations.push({
+            path: 'definition',
+            message: 'Generated Claude definition capability evidence does not match the resolver-selected capability.',
+        });
     }
-    const frontmatter = definitionFrontmatter(input.definition);
-    if (frontmatter.name !== expectedVariant) {
-        throw new Error(`Generated Claude definition name does not match ${expectedVariant}.`);
+    let frontmatter = null;
+    try {
+        frontmatter = definitionFrontmatter(definition);
     }
-    if (frontmatter.model !== provider.selection.target.model) {
-        throw new Error(`Generated Claude definition model does not match selected model ${provider.selection.target.model}.`);
+    catch (error) {
+        violations.push({
+            path: 'definition',
+            message: error instanceof Error ? error.message : String(error),
+        });
     }
-    if (frontmatter.effort !== provider.selection.target.effort) {
-        throw new Error(`Generated Claude definition effort does not match selected effort ${provider.selection.target.effort}.`);
+    if (frontmatter !== null) {
+        if (frontmatter.name !== expectedVariant) {
+            violations.push({
+                path: 'definition',
+                message: `Generated Claude definition name does not match ${expectedVariant}.`,
+            });
+        }
+        if (frontmatter.model !== selected.model) {
+            violations.push({
+                path: 'definition',
+                message: `Generated Claude definition model does not match selected model ${selected.model}.`,
+            });
+        }
+        if (frontmatter.effort !== selected.effort) {
+            violations.push({
+                path: 'definition',
+                message: `Generated Claude definition effort does not match selected effort ${selected.effort}.`,
+            });
+        }
     }
-    if (launch.model !== undefined &&
-        launch.model !== provider.selection.target.model) {
-        throw new Error(`Per-call Claude model ${launch.model} conflicts with generated definition model ${provider.selection.target.model}.`);
+    if (launch !== null &&
+        launch.model !== undefined &&
+        launch.model !== selected.model) {
+        violations.push({
+            path: 'payload.model',
+            message: `Per-call Claude model ${launch.model} conflicts with generated definition model ${selected.model}.`,
+        });
     }
-    if (provider.modelAxis !== `selected:${provider.selection.target.model}`) {
-        throw new Error('Claude resolver model axis disagrees with its target.');
+    if (provider.modelAxis !== `selected:${selected.model}`) {
+        violations.push({
+            path: 'resolution.providers.claude.modelAxis',
+            message: 'Claude resolver model axis disagrees with its target.',
+        });
     }
-    if (provider.effortAxis !== `selected:${provider.selection.target.effort}`) {
-        throw new Error('Claude resolver effort axis disagrees with its target.');
+    if (provider.effortAxis !== `selected:${selected.effort}`) {
+        violations.push({
+            path: 'resolution.providers.claude.effortAxis',
+            message: 'Claude resolver effort axis disagrees with its target.',
+        });
     }
+    return violations;
+}
+/**
+ * Validate the managed resolver result against the generated provider role and
+ * the exact payload that will be launched. This is the production boundary
+ * used by the project dispatch-record producer for managed Claude dispatches.
+ * It stops at the first failure; {@link collectClaudeLaunchViolations} reports
+ * every failure for a caller building its input.
+ */
+export function acceptClaudeLaunchEnvelope(input) {
+    const resolution = resolutionSchema.parse(input.resolution);
+    const provider = resolution.providers.claude;
+    const launch = launchPayloadSchema.parse(input.launch);
+    const [first] = launchConsistencyViolations(resolution, launch, input.definition);
+    if (first)
+        throw new Error(first.message);
+    const baseRole = provider.selection.role === 'reviewer'
+        ? 'oat-reviewer'
+        : 'oat-phase-implementer';
     return {
         schemaVersion: 1,
         provider: 'claude',
         resolverRole: provider.selection.role,
         baseRole,
-        variant: expectedVariant,
+        variant: buildClaudeEffortVariantName({
+            agentName: baseRole,
+            model: provider.selection.target.model,
+            effort: provider.selection.target.effort,
+        }),
         model: provider.selection.target.model,
         capabilityEvidence: provider.selection.target.capabilityEvidence,
         effort: provider.selection.target.effort,
@@ -175,6 +266,195 @@ export function acceptClaudeLaunchEnvelope(input) {
         payload: launch,
     };
 }
+const LAUNCH_CONSISTENCY_SKIPPED = 'claudeLaunch consistency checks (need a parsed resolution)';
+const PAYLOAD_CHECKS_SKIPPED = 'claudeLaunch payload variant and model checks (need a parsed payload)';
+const ACTION_ROLE_SKIPPED = 'recordBase action/role check (needs a parsed resolution)';
+/**
+ * Report every `claudeLaunch` violation in one pass: each schema issue in the
+ * resolution and the payload, then every consistency check the parsed inputs
+ * allow. Consistency checks depend on a parsed resolution, and the two payload
+ * checks on a parsed payload; those are skipped and named in `skipped` rather
+ * than reported against a value that failed to parse.
+ */
+export function collectClaudeLaunchViolations(claudeLaunch) {
+    if (!claudeLaunch ||
+        typeof claudeLaunch !== 'object' ||
+        Array.isArray(claudeLaunch)) {
+        return {
+            resolverRole: null,
+            violations: [
+                {
+                    stage: 'claudeLaunch',
+                    path: '<root>',
+                    message: 'Managed Claude claudeLaunch must be a JSON object with resolution, definition, and payload.',
+                },
+            ],
+            skipped: [LAUNCH_CONSISTENCY_SKIPPED],
+        };
+    }
+    const launchInput = claudeLaunch;
+    const violations = [];
+    const resolution = resolutionSchema.safeParse(launchInput.resolution);
+    if (!resolution.success) {
+        violations.push(...zodIssueViolations('claudeLaunch', 'resolution', resolution.error));
+    }
+    const launch = launchPayloadSchema.safeParse(launchInput.payload);
+    if (!launch.success) {
+        violations.push(...zodIssueViolations('claudeLaunch', 'payload', launch.error));
+    }
+    if (!resolution.success) {
+        return {
+            resolverRole: null,
+            violations,
+            skipped: [LAUNCH_CONSISTENCY_SKIPPED],
+        };
+    }
+    const skipped = launch.success ? [] : [PAYLOAD_CHECKS_SKIPPED];
+    violations.push(...launchConsistencyViolations(resolution.data, launch.success ? launch.data : null, String(launchInput.definition ?? '')).map((violation) => ({ stage: 'claudeLaunch', ...violation })));
+    return {
+        resolverRole: resolution.data.providers.claude.selection.role,
+        violations,
+        skipped,
+    };
+}
+const PROTECTED_FIELD_MASK = Object.fromEntries(PROTECTED_RECORD_FIELDS.map((field) => [field, true]));
+/**
+ * The caller-authored half of a managed record: the closed generic field set
+ * with every derived field omitted. The cross-field rules are applied
+ * separately (see {@link crossFieldViolations}) because a Zod refinement never
+ * runs once the object parse aborts, which would push those rules to a later
+ * run.
+ */
+const managedRecordBaseSchema = genericDispatchRecordBaseSchema.omit(PROTECTED_FIELD_MASK);
+/**
+ * Run the generic cross-field rules directly on the caller-owned fields,
+ * whether or not the object parse succeeded. The rules read every field
+ * defensively, so a missing or mistyped field elsewhere does not hide a
+ * cross-field violation until the next run.
+ */
+function crossFieldViolations(callerOwned) {
+    const violations = [];
+    const context = {
+        path: [],
+        addIssue: (issue) => {
+            violations.push({
+                stage: 'recordBase',
+                path: formatIssuePath(null, issue.path ?? []),
+                message: issue.message ?? 'Invalid',
+            });
+        },
+    };
+    refineGenericDispatchRecord(callerOwned, context);
+    return violations;
+}
+function actionConflict(resolverRole, action) {
+    return (resolverRole === 'reviewer' && action !== 'review') ||
+        (resolverRole === 'implementer' &&
+            action !== 'implementation' &&
+            action !== 'fix')
+        ? `Managed Claude resolver role ${resolverRole} conflicts with record action ${String(action)}.`
+        : null;
+}
+/**
+ * Report every `recordBase` violation in one pass: each derived field that is
+ * present, the action/role check, every missing, mistyped, or unknown field,
+ * every absolute path in an identity or control field, and every sensitive key
+ * or value. The action/role check needs a parsed resolution and is skipped
+ * without one.
+ */
+export function collectClaudeRecordBaseViolations(candidate, resolverRole) {
+    if (!candidate || typeof candidate !== 'object' || Array.isArray(candidate)) {
+        return {
+            violations: [
+                {
+                    stage: 'recordBase',
+                    path: '<root>',
+                    message: 'Managed Claude dispatch recordBase must be a JSON object.',
+                },
+            ],
+            skipped: [],
+        };
+    }
+    const base = candidate;
+    const protectedFields = new Set(PROTECTED_RECORD_FIELDS);
+    const violations = [];
+    for (const field of PROTECTED_RECORD_FIELDS) {
+        if (Object.hasOwn(base, field)) {
+            violations.push({
+                stage: 'recordBase',
+                path: field,
+                message: `Managed Claude dispatch recordBase must omit derived field ${field}.`,
+            });
+        }
+    }
+    const skipped = [];
+    if (resolverRole === null) {
+        skipped.push(ACTION_ROLE_SKIPPED);
+    }
+    else {
+        const conflict = actionConflict(resolverRole, base.action);
+        if (conflict !== null) {
+            violations.push({
+                stage: 'recordBase',
+                path: 'action',
+                message: conflict,
+            });
+        }
+    }
+    const callerOwned = Object.fromEntries(Object.entries(base).filter(([key]) => !protectedFields.has(key)));
+    const parsed = managedRecordBaseSchema.safeParse(callerOwned);
+    if (!parsed.success) {
+        violations.push(...zodIssueViolations('recordBase', null, parsed.error));
+    }
+    violations.push(...crossFieldViolations(callerOwned));
+    for (const [field, value] of Object.entries(identityFieldsOf(callerOwned))) {
+        violations.push(...collectAbsolutePathViolations(value, field).map((violation) => ({
+            stage: 'recordBase',
+            ...violation,
+        })));
+    }
+    violations.push(...collectSensitiveDispatchContent(base, 'recordBase').map((violation) => ({
+        stage: 'recordBase',
+        path: violation.path.slice('recordBase.'.length) || '<root>',
+        message: violation.message,
+    })));
+    return { violations, skipped };
+}
+function oneLine(text) {
+    return text.replace(/\r?\n/g, ' ');
+}
+/**
+ * One error for a whole validation run: a header, then one
+ * `stage path: message` line per violation, then the checks that were skipped
+ * because they depend on a stage that failed to parse.
+ */
+export class ManagedClaudeDispatchValidationError extends Error {
+    violations;
+    skipped;
+    constructor(violations, skipped = []) {
+        // Scrub each violation on its own before joining. A scrub over the joined
+        // text lets one unterminated secret (a private-key header with no END
+        // marker) consume every later line; per violation it ends with that
+        // violation. Echoed newlines are folded so each violation stays one line
+        // and the line count matches the header.
+        const scrubbed = violations.map((violation) => ({
+            stage: violation.stage,
+            path: oneLine(redactSensitiveValues(violation.path)),
+            message: oneLine(redactSensitiveValues(violation.message)),
+        }));
+        const lines = [
+            `Managed Claude dispatch input has ${scrubbed.length} violation${scrubbed.length === 1 ? '' : 's'}:`,
+            ...scrubbed.map(({ stage, path, message }) => `${stage} ${path}: ${message}`),
+        ];
+        if (skipped.length > 0) {
+            lines.push(`Skipped until the above are fixed: ${skipped.join('; ')}.`);
+        }
+        super(lines.join('\n'));
+        this.name = 'ManagedClaudeDispatchValidationError';
+        this.violations = scrubbed;
+        this.skipped = skipped;
+    }
+}
 function recordBase(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value)) {
         throw new Error('Managed Claude dispatch recordBase must be a JSON object.');
@@ -190,13 +470,9 @@ function recordBase(value) {
 /** Build configured invocation evidence only from an accepted launch envelope. */
 export function buildClaudeDispatchRecord(input) {
     const base = recordBase(input.recordBase);
-    const action = base.action;
-    if ((input.envelope.resolverRole === 'reviewer' && action !== 'review') ||
-        (input.envelope.resolverRole === 'implementer' &&
-            action !== 'implementation' &&
-            action !== 'fix')) {
-        throw new Error(`Managed Claude resolver role ${input.envelope.resolverRole} conflicts with record action ${String(action)}.`);
-    }
+    const conflict = actionConflict(input.envelope.resolverRole, base.action);
+    if (conflict !== null)
+        throw new Error(conflict);
     return parseGenericDispatchRecord({
         ...base,
         provider: 'claude',

package/dist/providers/claude/rule-transform.js

@@ -8,7 +8,7 @@ function parsePaths(value) {
     return undefined;
 }
 export function transformCanonicalToClaudeRule(canonicalContent, canonicalPath) {
-    const rule = parseCanonicalRuleMarkdown(canonicalContent);
+    const rule = parseCanonicalRuleMarkdown(canonicalContent, canonicalPath);
     const frontmatter = rule.activation === 'glob' && rule.globs ? { paths: rule.globs } : null;
     return appendGeneratedMarker(renderMarkdownWithFrontmatter(frontmatter, rule.body), canonicalPath);
 }

package/dist/providers/copilot/rule-transform.js

@@ -33,7 +33,7 @@ function isRepoWideApplyTo(globs) {
     return globs?.length === 1 && globs[0] === '**';
 }
 export function transformCanonicalToCopilotRule(canonicalContent, canonicalPath) {
-    const rule = parseCanonicalRuleMarkdown(canonicalContent);
+    const rule = parseCanonicalRuleMarkdown(canonicalContent, canonicalPath);
     if (rule.activation === 'glob' && rule.globs) {
         assertCopilotGlobsAreRepresentable(rule.globs);
     }

package/dist/providers/cursor/rule-transform.js

@@ -24,7 +24,7 @@ function buildCursorFrontmatter(activation, description, globs) {
     };
 }
 export function transformCanonicalToCursorRule(canonicalContent, canonicalPath) {
-    const rule = parseCanonicalRuleMarkdown(canonicalContent);
+    const rule = parseCanonicalRuleMarkdown(canonicalContent, canonicalPath);
     const frontmatter = buildCursorFrontmatter(rule.activation, rule.description, rule.globs);
     return appendGeneratedMarker(renderMarkdownWithFrontmatter(frontmatter, rule.body), canonicalPath);
 }

package/dist/providers/identity/absolute-paths.d.ts

@@ -49,6 +49,19 @@ export declare function redactAbsolutePaths(value: string): string;
  * a malformed identifier.
  */
 export declare function redactAbsolutePathsDeep<T>(value: T): T;
+/** One located validation violation. The message never echoes the value. */
+export interface DispatchValueViolation {
+    path: string;
+    message: string;
+}
+/**
+ * Collect every absolute path in an identity or control value, in the same
+ * depth-first order {@link assertNoAbsolutePath} visits them, so a caller that
+ * reports all violations at once and one that stops at the first agree on
+ * which hit comes first. Each message names the field, never the path found
+ * there, so the report itself cannot disclose it.
+ */
+export declare function collectAbsolutePathViolations(value: unknown, path: string): DispatchValueViolation[];
 /**
  * Recursively reject any absolute path. Used for identity and control fields,
  * where a path is never a legitimate value and silently rewriting one would

package/dist/providers/identity/absolute-paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"absolute-paths.d.ts","sourceRoot":"","sources":["../../../src/providers/identity/absolute-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AA6BH,6EAA6E;AAC7E,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAM/C;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE3D;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOzD;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CActD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAmBvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,sCAAsC,CACpD,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAChD,IAAI,CAIN"}
+{"version":3,"file":"absolute-paths.d.ts","sourceRoot":"","sources":["../../../src/providers/identity/absolute-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AA6BH,6EAA6E;AAC7E,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAM/C;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE3D;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOzD;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CActD;AAED,4EAA4E;AAC5E,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,MAAM,GACX,sBAAsB,EAAE,CAoB1B;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAGvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,sCAAsC,CACpD,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAChD,IAAI,CAIN"}

package/dist/providers/identity/absolute-paths.js

@@ -107,26 +107,39 @@ export function redactAbsolutePathsDeep(value) {
     return value;
 }
 /**
- * Recursively reject any absolute path. Used for identity and control fields,
- * where a path is never a legitimate value and silently rewriting one would
- * corrupt the identifier it claims to be.
+ * Collect every absolute path in an identity or control value, in the same
+ * depth-first order {@link assertNoAbsolutePath} visits them, so a caller that
+ * reports all violations at once and one that stops at the first agree on
+ * which hit comes first. Each message names the field, never the path found
+ * there, so the report itself cannot disclose it.
  */
-export function assertNoAbsolutePath(value, path) {
+export function collectAbsolutePathViolations(value, path) {
     if (typeof value === 'string') {
-        if (containsAbsolutePath(value)) {
-            throw new Error(`A dispatch record must not carry an absolute filesystem path at ${path}.`);
-        }
-        return;
+        return containsAbsolutePath(value)
+            ? [
+                {
+                    path,
+                    message: `A dispatch record must not carry an absolute filesystem path at ${path}.`,
+                },
+            ]
+            : [];
     }
     if (Array.isArray(value)) {
-        value.forEach((entry, index) => assertNoAbsolutePath(entry, `${path}[${index}]`));
-        return;
+        return value.flatMap((entry, index) => collectAbsolutePathViolations(entry, `${path}[${index}]`));
     }
     if (value === null || typeof value !== 'object')
-        return;
-    for (const [key, entry] of Object.entries(value)) {
-        assertNoAbsolutePath(entry, `${path}.${key}`);
-    }
+        return [];
+    return Object.entries(value).flatMap(([key, entry]) => collectAbsolutePathViolations(entry, `${path}.${key}`));
+}
+/**
+ * Recursively reject any absolute path. Used for identity and control fields,
+ * where a path is never a legitimate value and silently rewriting one would
+ * corrupt the identifier it claims to be.
+ */
+export function assertNoAbsolutePath(value, path) {
+    const [first] = collectAbsolutePathViolations(value, path);
+    if (first)
+        throw new Error(first.message);
 }
 /**
  * The publication postcondition, scoped to what is actually guaranteed.