@open-mercato/core 0.7.1-develop.7193.1.910a5b0a1e → 0.7.1-develop.7195.1.b5efd1d51a

package/src/modules/workflows/lib/crud-form-dialogs-flag.ts

@@ -0,0 +1,5 @@
+import { parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'
+
+export function resolveCrudFormDialogsEnabled(rawFlag: string | undefined): boolean {
+  return parseBooleanWithDefault(rawFlag, true)
+}

package/src/modules/workflows/lib/data-edge-mapping.ts

@@ -0,0 +1,112 @@
+/**
+ * Workflows Module - Data-edge field mapping
+ *
+ * Pure helpers that let a SUB_WORKFLOW field mapping be authored by dragging a
+ * connection to a child IN port, as an alternative to the key/value form. A
+ * data-port connection is persisted as the SAME `config.inputMapping` shape the
+ * form writes (`{ childPortKey: parentDotPath }`) and rendered as a distinct
+ * "data" edge rather than a control-flow transition.
+ *
+ * Port handle ids (from the SubWorkflowNode): `in:<key>` (child input target),
+ * `out:<key>` (child output source). Control-flow handles keep ids
+ * `target` / `source`.
+ */
+
+import type { Connection, Edge, Node } from '@xyflow/react'
+
+export const IN_PORT_PREFIX = 'in:'
+export const OUT_PORT_PREFIX = 'out:'
+
+/** Edge type used for drag-authored field mappings (not a transition). */
+export const DATA_MAPPING_EDGE_TYPE = 'workflowDataMapping'
+
+export type ConnectionClassification =
+  | { kind: 'control' }
+  | { kind: 'data-mapping'; targetNodeId: string; childPortKey: string; parentPath: string }
+  | { kind: 'data-ignored' }
+
+/**
+ * Derive the parent-context dot-path a data connection maps from.
+ *
+ * MVP (per spec D3 — no per-node typed output ports yet): when the source is a
+ * child OUT port (`out:<name>`) use that port name; otherwise fall back to the
+ * source node id. Either way the value is a plain dot-path the user can refine
+ * in the key/value form.
+ */
+export function deriveParentPath(connection: Connection): string {
+  const sourceHandle = connection.sourceHandle || ''
+  if (sourceHandle.startsWith(OUT_PORT_PREFIX)) {
+    return sourceHandle.slice(OUT_PORT_PREFIX.length)
+  }
+  return connection.source || ''
+}
+
+/**
+ * Classify a new connection:
+ * - `data-mapping` — the target is a child IN port (`in:<key>`); becomes an
+ *   `inputMapping` entry + a data edge, never a transition.
+ * - `data-ignored` — dragged from an OUT port but not onto an IN port; there is
+ *   no child port to bind, so it is dropped (no bogus transition is created).
+ * - `control` — a plain control connection; keeps today's transition behaviour.
+ */
+export function classifyConnection(connection: Connection): ConnectionClassification {
+  const targetHandle = connection.targetHandle || ''
+  const sourceHandle = connection.sourceHandle || ''
+
+  if (targetHandle.startsWith(IN_PORT_PREFIX)) {
+    return {
+      kind: 'data-mapping',
+      targetNodeId: connection.target || '',
+      childPortKey: targetHandle.slice(IN_PORT_PREFIX.length),
+      parentPath: deriveParentPath(connection),
+    }
+  }
+
+  if (sourceHandle.startsWith(OUT_PORT_PREFIX)) {
+    return { kind: 'data-ignored' }
+  }
+
+  return { kind: 'control' }
+}
+
+/** Stable id for a data edge — one per (target node, child port). */
+export function dataMappingEdgeId(targetNodeId: string, childPortKey: string): string {
+  return `data:${targetNodeId}:${childPortKey}`
+}
+
+/** Build the React Flow edge for a data mapping connection. */
+export function buildDataMappingEdge(connection: Connection, childPortKey: string): Edge {
+  return {
+    id: dataMappingEdgeId(connection.target || '', childPortKey),
+    source: connection.source || '',
+    target: connection.target || '',
+    sourceHandle: connection.sourceHandle || undefined,
+    targetHandle: connection.targetHandle || undefined,
+    type: DATA_MAPPING_EDGE_TYPE,
+  }
+}
+
+/**
+ * Apply a data mapping to the target node's `config.inputMapping`, returning a
+ * new nodes array. The result matches the key/value form's shape exactly
+ * (`config.inputMapping[childPortKey] = parentPath`).
+ */
+export function applyInputMappingToNodes(
+  nodes: Node[],
+  targetNodeId: string,
+  childPortKey: string,
+  parentPath: string,
+): Node[] {
+  return nodes.map((node) => {
+    if (node.id !== targetNodeId) return node
+    const data = (node.data || {}) as Record<string, any>
+    const config = (data.config || {}) as Record<string, any>
+    const inputMapping = { ...(config.inputMapping || {}), [childPortKey]: parentPath }
+    return { ...node, data: { ...data, config: { ...config, inputMapping } } }
+  })
+}
+
+/** True when an edge is a drag-authored data mapping (not a transition). */
+export function isDataMappingEdge(edge: Pick<Edge, 'type'>): boolean {
+  return edge.type === DATA_MAPPING_EDGE_TYPE
+}

package/src/modules/workflows/lib/definition-context-schema.ts

@@ -0,0 +1,103 @@
+/**
+ * Shared context-ledger resolution for a workflow definition.
+ *
+ * Extracted verbatim from `api/definitions/[id]/context-schema/route.ts` so the
+ * REST route and the `workflows.get_context_schema` AI tool serve the SAME
+ * ledger from the SAME id forms. The output-contract seam stays single-sourced:
+ * both callers reach `resolveServerOutputContract` through
+ * {@link computeDefinitionContextLedger} and never resolve contracts a second
+ * way (the browser editor deliberately pins the seam to `'unknown'` and
+ * consumes this response instead).
+ */
+
+import type { EntityManager } from '@mikro-orm/core'
+import { getDeclaredEvents } from '@open-mercato/shared/modules/events'
+import { WorkflowDefinition, type WorkflowDefinitionData } from '../data/entities'
+import {
+  buildTriggerPayloadContracts,
+  computeContextLedger,
+  type ContextLedger,
+  type LedgerStepView,
+  type LedgerWorkflowDefinition,
+} from './context-ledger'
+import { ensureWorkflowEndpointCatalog } from './endpoint-catalog'
+import {
+  ensureWorkflowAgentOutcomeContracts,
+  resolveServerOutputContract,
+} from './server-output-contract'
+import { getCodeWorkflow, getAllCodeWorkflows } from './code-registry'
+import { codeWorkflowUuid } from './find-definition'
+
+export type DefinitionLookupScope = {
+  tenantId: string
+  /**
+   * Organization where-clause fragment. The route passes
+   * `resolveOrganizationScopeFilter(...).where`; other callers pass
+   * `{ organizationId }` (or `{}` when the caller is tenant-wide).
+   */
+  organizationWhere: Record<string, unknown>
+}
+
+/**
+ * Warm the two sync-lookup caches the server output-contract seam reads.
+ * MUST run before {@link computeDefinitionContextLedger} or CALL_API and
+ * INVOKE_AGENT contracts silently degrade to `'unknown'`.
+ */
+export async function warmContextLedgerResolvers(container: {
+  resolve: <T>(name: string) => T
+}): Promise<void> {
+  await ensureWorkflowEndpointCatalog()
+  await ensureWorkflowAgentOutcomeContracts(container)
+}
+
+export function computeDefinitionContextLedger(definition: WorkflowDefinitionData): ContextLedger {
+  const ledgerDefinition = definition as unknown as LedgerWorkflowDefinition
+  return computeContextLedger(ledgerDefinition, {
+    resolveOutputContract: resolveServerOutputContract,
+    triggerPayloadContracts: buildTriggerPayloadContracts(
+      ledgerDefinition.triggers ?? [],
+      getDeclaredEvents(),
+    ),
+  })
+}
+
+export function narrowLedgerToStep(ledger: ContextLedger, stepId: string): LedgerStepView | null {
+  return ledger.steps[stepId] ?? null
+}
+
+/**
+ * Resolve a definition's `definition` JSON from any of the three id forms the
+ * context-schema route accepts: `code:<workflowId>`, a tenant/org-scoped DB
+ * UUID, and the synthetic `codeWorkflowUuid(workflowId)` fallback.
+ *
+ * Tenant scoping is not optional — a definition outside `scope.tenantId` is
+ * INVISIBLE (returns `null`, indistinguishable from "does not exist"), never
+ * merely unauthorized.
+ */
+export async function resolveDefinitionDataForLedger(
+  em: EntityManager,
+  id: string,
+  scope: DefinitionLookupScope,
+): Promise<WorkflowDefinitionData | null> {
+  if (id.startsWith('code:')) {
+    const codeDef = getCodeWorkflow(id.slice(5))
+    if (!codeDef) return null
+    return codeDef.definition as unknown as WorkflowDefinitionData
+  }
+
+  const definition = (await em.findOne(WorkflowDefinition, {
+    id,
+    tenantId: scope.tenantId,
+    ...scope.organizationWhere,
+    deletedAt: null,
+  })) as WorkflowDefinition | null
+
+  if (definition) return definition.definition
+
+  const codeDef = getAllCodeWorkflows().find(
+    (workflow) => codeWorkflowUuid(workflow.workflowId) === id,
+  )
+  if (codeDef) return codeDef.definition as unknown as WorkflowDefinitionData
+
+  return null
+}

package/src/modules/workflows/lib/definition-edit-safety.ts

@@ -0,0 +1,228 @@
+/**
+ * Workflows Module — Edit-safety rule for definitions with active instances (pure)
+ *
+ * Spec §4.1: "structural edits to a definition with active instances require a
+ * new version (running instances keep executing their pinned definition
+ * snapshot)… Re-pointing an edge under a running instance must be impossible,
+ * not merely discouraged."
+ *
+ * A `WorkflowInstance` pins `definitionId` — a specific `(workflowId, version,
+ * tenantId)` row — and the engine re-reads that row on every advance, so a PUT
+ * that rewrites the row's `definition` JSONB changes what a running instance
+ * executes mid-flight. This module answers the one question the definition PUT
+ * needs before it writes: does the incoming definition change the topology the
+ * engine navigates?
+ *
+ * Topology means the parts a mid-flight instance resolves against: which steps
+ * exist and what type they are, how forks and joins pair up, and which routes
+ * exist with which endpoints. Labels, descriptions, editor positions, activity
+ * config, conditions, priorities, triggers and metadata are deliberately NOT
+ * structural — authors must never be blocked from cosmetic or config edits.
+ *
+ * PURE: no ORM, no DI, no React. The caller supplies both definition documents.
+ */
+
+import type { WorkflowInstanceStatus } from '../data/entities'
+
+/**
+ * Instance statuses that still execute (or still resolve) their pinned
+ * definition row. `COMPENSATING` is included: the saga walks the definition's
+ * activities in reverse, so a topology rewrite corrupts it exactly like a
+ * running instance. Terminal statuses (`COMPLETED`, `FAILED`, `CANCELLED`,
+ * `COMPENSATED`) never read the definition again and never block an edit.
+ */
+export const ACTIVE_WORKFLOW_INSTANCE_STATUSES: readonly WorkflowInstanceStatus[] = [
+  'RUNNING',
+  'PAUSED',
+  'WAITING_FOR_ACTIVITIES',
+  'FORKED',
+  'COMPENSATING',
+]
+
+/** Machine-readable marker on the 409 body so clients can offer "Create version". */
+export const STRUCTURAL_EDIT_CONFLICT_CODE = 'WORKFLOW_STRUCTURAL_EDIT_REQUIRES_NEW_VERSION'
+
+export type StructuralChangeKind =
+  | 'stepAdded'
+  | 'stepRemoved'
+  | 'stepTypeChanged'
+  | 'stepWiringChanged'
+  | 'transitionAdded'
+  | 'transitionRemoved'
+  | 'transitionRetargeted'
+  | 'transitionKindChanged'
+
+export interface StructuralChange {
+  kind: StructuralChangeKind
+  /** `stepId` for step changes, `transitionId` for route changes. */
+  id: string
+}
+
+export interface StructuralEditConflictBody {
+  error: string
+  code: typeof STRUCTURAL_EDIT_CONFLICT_CODE
+  definitionId: string
+  activeInstanceCount: number
+  activeStatuses: readonly WorkflowInstanceStatus[]
+  changes: StructuralChange[]
+  remedy: {
+    action: 'createVersion'
+    method: 'POST'
+    endpoint: string
+  }
+}
+
+interface StepSignature {
+  stepType: string
+  joinStepId: string | null
+  forkStepId: string | null
+}
+
+interface TransitionSignature {
+  fromStepId: string
+  toStepId: string
+  kind: string
+}
+
+function asRecord(value: unknown): Record<string, unknown> | null {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : null
+}
+
+function asArray(value: unknown): unknown[] {
+  return Array.isArray(value) ? value : []
+}
+
+function readString(source: Record<string, unknown>, key: string): string | null {
+  const value = source[key]
+  return typeof value === 'string' && value.length > 0 ? value : null
+}
+
+function stepSignatures(definition: unknown): Map<string, StepSignature> {
+  const signatures = new Map<string, StepSignature>()
+  const document = asRecord(definition)
+  if (!document) return signatures
+
+  for (const entry of asArray(document.steps)) {
+    const step = asRecord(entry)
+    if (!step) continue
+    const stepId = readString(step, 'stepId')
+    if (!stepId) continue
+    const config = asRecord(step.config)
+    signatures.set(stepId, {
+      stepType: readString(step, 'stepType') ?? '',
+      joinStepId: config ? readString(config, 'joinStepId') : null,
+      forkStepId: config ? readString(config, 'forkStepId') : null,
+    })
+  }
+
+  return signatures
+}
+
+function transitionSignatures(definition: unknown): Map<string, TransitionSignature> {
+  const signatures = new Map<string, TransitionSignature>()
+  const document = asRecord(definition)
+  if (!document) return signatures
+
+  for (const entry of asArray(document.transitions)) {
+    const transition = asRecord(entry)
+    if (!transition) continue
+    const transitionId = readString(transition, 'transitionId')
+    if (!transitionId) continue
+    signatures.set(transitionId, {
+      fromStepId: readString(transition, 'fromStepId') ?? '',
+      toStepId: readString(transition, 'toStepId') ?? '',
+      kind: readString(transition, 'kind') ?? 'normal',
+    })
+  }
+
+  return signatures
+}
+
+/**
+ * Diff the execution topology of two definition documents.
+ *
+ * Order is deterministic without sorting: step changes in `next` order, then
+ * removals in `previous` order, then the same for transitions.
+ */
+export function diffDefinitionStructure(previous: unknown, next: unknown): StructuralChange[] {
+  const changes: StructuralChange[] = []
+
+  const previousSteps = stepSignatures(previous)
+  const nextSteps = stepSignatures(next)
+
+  for (const [stepId, signature] of nextSteps) {
+    const before = previousSteps.get(stepId)
+    if (!before) {
+      changes.push({ kind: 'stepAdded', id: stepId })
+      continue
+    }
+    if (before.stepType !== signature.stepType) {
+      changes.push({ kind: 'stepTypeChanged', id: stepId })
+      continue
+    }
+    if (before.joinStepId !== signature.joinStepId || before.forkStepId !== signature.forkStepId) {
+      changes.push({ kind: 'stepWiringChanged', id: stepId })
+    }
+  }
+
+  for (const stepId of previousSteps.keys()) {
+    if (!nextSteps.has(stepId)) changes.push({ kind: 'stepRemoved', id: stepId })
+  }
+
+  const previousTransitions = transitionSignatures(previous)
+  const nextTransitions = transitionSignatures(next)
+
+  for (const [transitionId, signature] of nextTransitions) {
+    const before = previousTransitions.get(transitionId)
+    if (!before) {
+      changes.push({ kind: 'transitionAdded', id: transitionId })
+      continue
+    }
+    if (before.fromStepId !== signature.fromStepId || before.toStepId !== signature.toStepId) {
+      changes.push({ kind: 'transitionRetargeted', id: transitionId })
+      continue
+    }
+    if (before.kind !== signature.kind) {
+      changes.push({ kind: 'transitionKindChanged', id: transitionId })
+    }
+  }
+
+  for (const transitionId of previousTransitions.keys()) {
+    if (!nextTransitions.has(transitionId)) {
+      changes.push({ kind: 'transitionRemoved', id: transitionId })
+    }
+  }
+
+  return changes
+}
+
+/** True when the incoming definition changes the topology the engine navigates. */
+export function isStructuralDefinitionChange(previous: unknown, next: unknown): boolean {
+  return diffDefinitionStructure(previous, next).length > 0
+}
+
+/**
+ * Structured 409 body. It names the remedy explicitly so the Studio can offer a
+ * one-click "Create version" instead of leaving the author with a dead end.
+ */
+export function buildStructuralEditConflictBody(params: {
+  definitionId: string
+  activeInstanceCount: number
+  changes: StructuralChange[]
+}): StructuralEditConflictBody {
+  return {
+    error: 'Structural changes require a new version while instances are still running',
+    code: STRUCTURAL_EDIT_CONFLICT_CODE,
+    definitionId: params.definitionId,
+    activeInstanceCount: params.activeInstanceCount,
+    activeStatuses: ACTIVE_WORKFLOW_INSTANCE_STATUSES,
+    changes: params.changes,
+    remedy: {
+      action: 'createVersion',
+      method: 'POST',
+      endpoint: `/api/workflows/definitions/${params.definitionId}/publish`,
+    },
+  }
+}

package/src/modules/workflows/lib/definition-error-body.ts

@@ -0,0 +1,43 @@
+import type { z } from 'zod'
+
+export type DefinitionValidationIssue = {
+  path: Array<string | number>
+  code: string
+  message: string
+  expected?: string
+  got?: string
+}
+
+const RECEIVED_MESSAGE_PATTERN = /received (.+)$/
+
+function normalizeIssuePath(path: ReadonlyArray<PropertyKey>): Array<string | number> {
+  return path.map((segment) => (typeof segment === 'number' ? segment : String(segment)))
+}
+
+function resolveExpected(issue: z.core.$ZodIssue): string | undefined {
+  if ('expected' in issue && typeof issue.expected === 'string') return issue.expected
+  if ('values' in issue && Array.isArray(issue.values)) {
+    return issue.values.map((value) => JSON.stringify(value)).join(' | ')
+  }
+  return undefined
+}
+
+function resolveGot(issue: z.core.$ZodIssue): string | undefined {
+  if (issue.code !== 'invalid_type') return undefined
+  const match = RECEIVED_MESSAGE_PATTERN.exec(issue.message)
+  return match ? match[1] : undefined
+}
+
+export function normalizeDefinitionValidationIssues(error: z.ZodError): DefinitionValidationIssue[] {
+  return error.issues.map((issue) => {
+    const expected = resolveExpected(issue)
+    const got = resolveGot(issue)
+    return {
+      path: normalizeIssuePath(issue.path),
+      code: typeof issue.code === 'string' ? issue.code : 'custom',
+      message: issue.message,
+      ...(expected !== undefined ? { expected } : {}),
+      ...(got !== undefined ? { got } : {}),
+    }
+  })
+}

package/src/modules/workflows/lib/definition-evaluation.ts

@@ -0,0 +1,156 @@
+/**
+ * One evaluation path for a workflow definition.
+ *
+ * The Studio's Problems panel and the definition API routes historically ran
+ * the same checks through two different normalizers: the panel builds
+ * `WorkflowValidationIssue[]` via `collectValidationIssues`, the routes build
+ * the structured `{path, code, message, expected?, got?}` body via
+ * `normalizeDefinitionValidationIssues`. Neither reimplements the checks — they
+ * share `workflowDefinitionDataSchema` — but nothing composed both.
+ *
+ * This module composes them, and NOTHING ELSE. Every check below is an existing
+ * exported function; a second validator that could disagree with the panel is
+ * precisely the failure mode to avoid, so callers that need "what would the
+ * Studio show me?" MUST come through here rather than re-deriving the recipe.
+ */
+
+import { collectActivityConfigWarnings } from '../data/activity-config-warnings'
+import { workflowDefinitionDataSchema } from '../data/validators'
+import type { WorkflowDefinitionData } from '../data/entities'
+import {
+  collectValidationIssues,
+  countIssuesBySeverity,
+  type WorkflowIssueTranslator,
+  type WorkflowValidationIssue,
+  type ZodIssueLike,
+} from './collect-validation-issues'
+import type { ContextLedger } from './context-ledger'
+import {
+  normalizeDefinitionValidationIssues,
+  type DefinitionValidationIssue,
+} from './definition-error-body'
+import { collectUnresolvedContextRefWarnings } from './expression-refs'
+import { definitionToGraph, validateWorkflowGraph } from './graph-utils'
+
+/**
+ * Problems-panel copy for an unresolved `{{context.*}}` reference. Shared so
+ * the Studio and every server-side evaluator emit the identical warning instead
+ * of drifting apart on the message text.
+ */
+export const UNRESOLVED_CONTEXT_REF_MESSAGE = {
+  key: 'workflows.visualEditor.problems.unresolvedContextRef',
+  fallback: 'Context reference "{path}" is not provided by any earlier step, trigger, or input',
+} as const
+
+function interpolateFallback(fallback: string, params: Record<string, string>): string {
+  return fallback.replace(/\{(\w+)\}/g, (match, name: string) =>
+    Object.prototype.hasOwnProperty.call(params, name) ? params[name] : match,
+  )
+}
+
+/**
+ * Map unresolved `{{context.*}}` references onto Problems-panel warnings.
+ * `translate` is optional — omit it (server, agent tools) to get the English
+ * fallback the panel itself falls back to.
+ */
+export function toUnresolvedContextRefIssues(
+  definition: WorkflowDefinitionData,
+  ledger: ContextLedger,
+  translate?: WorkflowIssueTranslator,
+): ZodIssueLike[] {
+  return collectUnresolvedContextRefWarnings(definition, ledger).map((warning) => ({
+    path: warning.path,
+    message: translate
+      ? translate(UNRESOLVED_CONTEXT_REF_MESSAGE.key, UNRESOLVED_CONTEXT_REF_MESSAGE.fallback, {
+          path: warning.refPath,
+        })
+      : interpolateFallback(UNRESOLVED_CONTEXT_REF_MESSAGE.fallback, { path: warning.refPath }),
+  }))
+}
+
+export interface EvaluateWorkflowDefinitionOptions {
+  /**
+   * Server-computed context ledger. When supplied, unresolved-reference
+   * warnings join the result exactly as they do in the Studio; when omitted
+   * those warnings are skipped (they are advisory and never blocking).
+   */
+  ledger?: ContextLedger | null
+}
+
+export interface WorkflowDefinitionEvaluation {
+  /** No blocking errors — the same bar the Studio's Save handler enforces. */
+  valid: boolean
+  errorCount: number
+  warningCount: number
+  /**
+   * The structured issue format: identical in shape and content to the
+   * `details[]` array the definition create/update routes return on a 400.
+   * Empty when the definition parses.
+   */
+  issues: DefinitionValidationIssue[]
+  /** Exactly what the Studio's Problems panel renders, in its order. */
+  problems: WorkflowValidationIssue[]
+}
+
+/**
+ * Run the Studio Problems-panel evaluation plus the API routes' structured-body
+ * normalizer over one definition.
+ */
+export function evaluateWorkflowDefinition(
+  definition: WorkflowDefinitionData,
+  options: EvaluateWorkflowDefinitionOptions = {},
+): WorkflowDefinitionEvaluation {
+  // The Studio only ever evaluates well-formed canvas state, but an agent can
+  // hand us anything. A definition whose `steps`/`transitions` are not arrays
+  // cannot be turned into a graph at all, so it answers with the schema issues
+  // alone rather than throwing out of a validation call.
+  const shaped =
+    Array.isArray((definition as { steps?: unknown })?.steps) &&
+    Array.isArray((definition as { transitions?: unknown })?.transitions)
+  if (!shaped) {
+    const parsedShape = workflowDefinitionDataSchema.safeParse(definition)
+    const structuralIssues = parsedShape.success
+      ? []
+      : normalizeDefinitionValidationIssues(parsedShape.error)
+    return {
+      valid: false,
+      errorCount: structuralIssues.length,
+      warningCount: 0,
+      issues: structuralIssues,
+      problems: structuralIssues.map((entry, index) => ({
+        id: `schema-${index}`,
+        severity: 'error' as const,
+        message: entry.path.length ? `${entry.path.join('.')} - ${entry.message}` : entry.message,
+      })),
+    }
+  }
+
+  const { nodes, edges } = definitionToGraph(definition, { autoLayout: false })
+  const graphErrors = validateWorkflowGraph(nodes, edges)
+  const parsed = workflowDefinitionDataSchema.safeParse(definition)
+  const zodIssues: ZodIssueLike[] = parsed.success ? [] : parsed.error.issues
+  const ledger = options.ledger ?? null
+  const configWarnings: ZodIssueLike[] = [
+    ...collectActivityConfigWarnings(definition),
+    ...(ledger ? toUnresolvedContextRefIssues(definition, ledger) : []),
+  ]
+
+  const problems = collectValidationIssues({
+    graphErrors,
+    zodIssues,
+    configWarnings,
+    nodes,
+    edges,
+    definition,
+    ledger: ledger ?? undefined,
+  })
+  const { errors, warnings } = countIssuesBySeverity(problems)
+
+  return {
+    valid: errors === 0,
+    errorCount: errors,
+    warningCount: warnings,
+    issues: parsed.success ? [] : normalizeDefinitionValidationIssues(parsed.error),
+    problems,
+  }
+}