@pasko70/pibo 1.9.8 → 1.9.9

package/dist/apps/chat/workflow-registered-ref-params.js

@@ -1,130 +0,0 @@
-export function validateWorkflowRegisteredRefParamsLike(value, paramsSchema, diagnostics, target) {
-    if (value === undefined)
-        return;
-    const code = target.kind === "guard" ? "WorkflowGraphError.invalidGuardParams" : "WorkflowGraphError.invalidAdapterParams";
-    if (!paramsSchema) {
-        diagnostics.push({
-            code: target.kind === "guard" ? "WorkflowGraphError.unexpectedGuardParams" : "WorkflowGraphError.unexpectedAdapterParams",
-            message: `${target.diagnosticLabel} declares params, but registry ref '${target.registryRef}' does not expose a paramsSchema.`,
-            severity: "error",
-            path: target.path,
-            nodeId: target.nodeId,
-            edgeId: target.edgeId,
-            registryRef: target.registryRef,
-            hint: "Remove params or select a registered ref whose picker metadata includes paramsSchema.",
-        });
-        return;
-    }
-    if (!isJsonObject(value)) {
-        diagnostics.push({
-            code,
-            message: `${target.diagnosticLabel} params for '${target.registryRef}' must be a JSON object matching the registry paramsSchema.`,
-            severity: "error",
-            path: target.path,
-            nodeId: target.nodeId,
-            edgeId: target.edgeId,
-            registryRef: target.registryRef,
-            hint: "Edit params as JSON object data only; inline handlers or arbitrary code are not allowed.",
-        });
-        return;
-    }
-    validateWorkflowParamsValueAgainstSchema(value, paramsSchema, target.path, diagnostics, target, code);
-}
-function validateWorkflowParamsValueAgainstSchema(value, schema, path, diagnostics, target, code) {
-    const typeNames = readParamsSchemaTypes(schema.type);
-    if (typeNames.length && !typeNames.some((typeName) => workflowParamValueMatchesType(value, typeName))) {
-        diagnostics.push({
-            code,
-            message: `${target.diagnosticLabel} params for '${target.registryRef}' do not match the registry paramsSchema type at '${path}'.`,
-            severity: "error",
-            path,
-            nodeId: target.nodeId,
-            edgeId: target.edgeId,
-            registryRef: target.registryRef,
-            hint: "Use the selected ref's paramsSchema from the picker when editing params.",
-        });
-        return;
-    }
-    if (isJsonObject(value)) {
-        const required = Array.isArray(schema.required) ? schema.required.filter((entry) => typeof entry === "string") : [];
-        for (const requiredKey of required) {
-            if (Object.hasOwn(value, requiredKey))
-                continue;
-            diagnostics.push({
-                code,
-                message: `${target.diagnosticLabel} params for '${target.registryRef}' are missing required registry paramsSchema field '${requiredKey}'.`,
-                severity: "error",
-                path: workflowParamsChildPath(path, requiredKey),
-                nodeId: target.nodeId,
-                edgeId: target.edgeId,
-                registryRef: target.registryRef,
-                hint: "Add the required params field or remove the params block.",
-            });
-        }
-        const properties = isJsonObject(schema.properties) ? schema.properties : {};
-        for (const [key, propertyValue] of Object.entries(value)) {
-            const propertySchema = properties[key];
-            if (isJsonObject(propertySchema)) {
-                validateWorkflowParamsValueAgainstSchema(propertyValue, propertySchema, workflowParamsChildPath(path, key), diagnostics, target, code);
-            }
-            else if (schema.additionalProperties === false) {
-                diagnostics.push({
-                    code,
-                    message: `${target.diagnosticLabel} params for '${target.registryRef}' include field '${key}', which is not allowed by the registry paramsSchema.`,
-                    severity: "error",
-                    path: workflowParamsChildPath(path, key),
-                    nodeId: target.nodeId,
-                    edgeId: target.edgeId,
-                    registryRef: target.registryRef,
-                    hint: "Remove fields not declared by the selected ref's paramsSchema.",
-                });
-            }
-        }
-    }
-    if (Array.isArray(value) && isJsonObject(schema.items)) {
-        value.forEach((item, index) => validateWorkflowParamsValueAgainstSchema(item, schema.items, `${path}.${index}`, diagnostics, target, code));
-    }
-}
-function readParamsSchemaTypes(value) {
-    if (typeof value === "string")
-        return [value];
-    if (Array.isArray(value))
-        return value.filter((entry) => typeof entry === "string");
-    return [];
-}
-function workflowParamValueMatchesType(value, typeName) {
-    if (typeName === "string")
-        return typeof value === "string";
-    if (typeName === "number")
-        return typeof value === "number";
-    if (typeName === "integer")
-        return typeof value === "number" && Number.isInteger(value);
-    if (typeName === "boolean")
-        return typeof value === "boolean";
-    if (typeName === "object")
-        return isJsonObject(value);
-    if (typeName === "array")
-        return Array.isArray(value);
-    if (typeName === "null")
-        return value === null;
-    return true;
-}
-function workflowParamsChildPath(path, key) {
-    return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key) ? `${path}.${key}` : `${path}[${JSON.stringify(key)}]`;
-}
-function isJsonValue(value) {
-    if (value === null
-        || typeof value === "string"
-        || typeof value === "boolean"
-        || (typeof value === "number" && Number.isFinite(value))) {
-        return true;
-    }
-    if (Array.isArray(value))
-        return value.every(isJsonValue);
-    if (value && typeof value === "object")
-        return Object.values(value).every(isJsonValue);
-    return false;
-}
-function isJsonObject(value) {
-    return Boolean(value) && typeof value === "object" && !Array.isArray(value) && isJsonValue(value);
-}

package/dist/apps/chat/workflow-registered-ref-pickers.js

@@ -1,179 +0,0 @@
-import { hashPromptAssetMarkdown, workflowPromptAssetDocumentFromRecords, } from "./workflow-persistence.js";
-export const WORKFLOW_ADAPTER_REF_OPTIONS = [
-    {
-        id: "fixture.adapters.textToTopic",
-        displayName: "Text to topic",
-        description: "Registered deterministic adapter from the workflow fixtures registry.",
-        paramsSchema: null,
-    },
-    {
-        id: "fixture.adapters.draftToSummary",
-        displayName: "Draft to summary",
-        description: "Registered deterministic adapter from the workflow fixtures registry.",
-        paramsSchema: {
-            type: "object",
-            properties: {
-                format: { type: "string", description: "Presentation format for the summarized payload." },
-            },
-            required: ["format"],
-            additionalProperties: false,
-        },
-    },
-];
-export const WORKFLOW_GUARD_REF_OPTIONS = [
-    {
-        id: "fixture.guards.approved",
-        displayName: "Approved",
-        description: "Registered guard from the workflow fixtures registry.",
-        paramsSchema: {
-            type: "object",
-            properties: {
-                expected: { type: "boolean", description: "Expected approval flag for this guarded route." },
-            },
-            required: ["expected"],
-            additionalProperties: false,
-        },
-    },
-    {
-        id: "fixture.guards.needsRevision",
-        displayName: "Needs revision",
-        description: "Registered guard from the workflow fixtures registry.",
-        paramsSchema: null,
-    },
-];
-export const WORKFLOW_PROMPT_ASSET_REF_OPTIONS = [
-    {
-        id: "fixture.promptBuilders.draftPrompt",
-        displayName: "Draft prompt builder",
-        description: "Registered prompt asset/prompt-builder ref from the workflow fixtures registry.",
-        paramsSchema: null,
-        kind: "code",
-    },
-];
-export const WORKFLOW_HUMAN_ACTION_REF_OPTIONS = [
-    {
-        id: "fixture.humanActions.approve",
-        kind: "approve",
-        displayName: "Approve",
-        description: "Registered human action for approving a pending workflow wait token.",
-        paramsSchema: null,
-    },
-    {
-        id: "fixture.humanActions.reject",
-        kind: "reject",
-        displayName: "Reject",
-        description: "Registered human action for rejecting a pending workflow wait token.",
-        paramsSchema: null,
-    },
-    {
-        id: "fixture.humanActions.resume",
-        kind: "resume",
-        displayName: "Resume",
-        description: "Registered human action for resuming a pending workflow wait token with a payload.",
-        paramsSchema: null,
-    },
-    {
-        id: "fixture.humanActions.cancel",
-        kind: "cancel",
-        displayName: "Cancel",
-        description: "Registered human action for cancelling a pending workflow wait token.",
-        paramsSchema: null,
-    },
-];
-const WORKFLOW_STATIC_PROMPT_ASSET_MARKDOWN = {
-    "fixture.promptBuilders.draftPrompt": "Draft a concise response from the workflow input.\n\n{{input}}",
-};
-export function buildWorkflowRegisteredRefPicker(kind, optionsInput, selectedRefId) {
-    const options = [...optionsInput]
-        .sort((left, right) => left.displayName.localeCompare(right.displayName) || left.id.localeCompare(right.id));
-    const normalizedSelection = selectedRefId?.trim() || undefined;
-    const activeSelection = normalizedSelection && options.some((option) => option.id === normalizedSelection)
-        ? normalizedSelection
-        : undefined;
-    const diagnostics = [];
-    if (normalizedSelection && !activeSelection) {
-        diagnostics.push(workflowRegisteredRefPickerDiagnostic(kind, normalizedSelection));
-    }
-    return {
-        kind,
-        options,
-        ...(activeSelection ? { selectedRefId: activeSelection } : {}),
-        diagnostics,
-    };
-}
-export function buildWorkflowPromptAssetPicker(state, webSession, selectedRefId) {
-    const uiOptions = state.workflowPromptAssetStore.listAssets().map((asset) => ({
-        id: asset.assetId,
-        displayName: asset.displayName,
-        ...(asset.description ? { description: asset.description } : {}),
-        paramsSchema: null,
-        kind: "ui",
-    }));
-    return buildWorkflowRegisteredRefPicker("prompt-assets", [...WORKFLOW_PROMPT_ASSET_REF_OPTIONS, ...uiOptions], selectedRefId);
-}
-export function getWorkflowPromptAssetDocument(state, webSession, assetId) {
-    const staticOption = WORKFLOW_PROMPT_ASSET_REF_OPTIONS.find((option) => option.id === assetId);
-    if (staticOption) {
-        const markdown = WORKFLOW_STATIC_PROMPT_ASSET_MARKDOWN[assetId] ?? "";
-        const now = "code";
-        return {
-            id: staticOption.id,
-            displayName: staticOption.displayName,
-            ...(staticOption.description ? { description: staticOption.description } : {}),
-            source: "code",
-            readOnly: true,
-            revisionId: `code:${staticOption.id}:1`,
-            contentHash: hashPromptAssetMarkdown(markdown),
-            markdown,
-            createdAt: now,
-            updatedAt: now,
-        };
-    }
-    const asset = state.workflowPromptAssetStore.getAsset(assetId);
-    const revision = asset ? state.workflowPromptAssetStore.getActiveRevision(assetId) : undefined;
-    return asset && revision ? workflowPromptAssetDocumentFromRecords(asset, revision) : undefined;
-}
-export function isWorkflowPromptAssetRegistered(state, webSession, assetId) {
-    return WORKFLOW_PROMPT_ASSET_REF_OPTIONS.some((option) => option.id === assetId)
-        || Boolean(state.workflowPromptAssetStore.getAsset(assetId));
-}
-function workflowRegisteredRefPickerDiagnostic(kind, registryRef) {
-    if (kind === "guards") {
-        return {
-            code: "WorkflowGraphError.unknownGuardRef",
-            message: `Workflow edge references guard '${registryRef}', but it is not registered in the Workflow Registry.`,
-            severity: "error",
-            path: "$.edges.edge.guard.handler",
-            registryRef,
-            hint: "Select a registered guard ref before publishing or running this workflow.",
-        };
-    }
-    if (kind === "adapters") {
-        return {
-            code: "WorkflowGraphError.unknownAdapterRef",
-            message: `Workflow edge references adapter '${registryRef}', but it is not registered in the Workflow Registry.`,
-            severity: "error",
-            path: "$.edges.edge.adapter.transform.id",
-            registryRef,
-            hint: "Select a registered adapter ref before publishing or running this workflow.",
-        };
-    }
-    if (kind === "human-actions") {
-        return {
-            code: "WorkflowGraphError.unknownHumanActionRef",
-            message: `Human node references human action '${registryRef}', but it is not registered in the Workflow Registry.`,
-            severity: "error",
-            path: "$.nodes.human.actions.0.id",
-            registryRef,
-            hint: "Select a registered human action before publishing or running this workflow.",
-        };
-    }
-    return {
-        code: "WorkflowGraphError.unknownPromptBuilderRef",
-        message: `Agent node references prompt asset '${registryRef}', but it is not registered in the Workflow Registry.`,
-        severity: "error",
-        path: "$.nodes.agent.promptBuilder.id",
-        registryRef,
-        hint: "Select a registered prompt asset ref before publishing or running this workflow.",
-    };
-}

package/dist/apps/chat/workflow-registered-ref-validation.js

@@ -1,210 +0,0 @@
-import { validateWorkflowRegisteredRefParamsLike } from "./workflow-registered-ref-params.js";
-import { WORKFLOW_ADAPTER_REF_OPTIONS, WORKFLOW_GUARD_REF_OPTIONS, WORKFLOW_HUMAN_ACTION_REF_OPTIONS, isWorkflowPromptAssetRegistered, } from "./workflow-registered-ref-pickers.js";
-export function validateWorkflowPromptAssetRefLike(nodeId, value, input, diagnostics) {
-    const path = `$.nodes.${nodeId}.promptBuilder`;
-    const ref = readPromptAssetRef(value);
-    if (!ref.id) {
-        diagnostics.push({
-            code: "WorkflowGraphError.invalidPromptBuilderRef",
-            message: `Agent node '${nodeId}' must use a registered prompt asset ref when promptBuilder is declared.`,
-            severity: "error",
-            path,
-            nodeId,
-            hint: "Select a registered prompt asset/prompt-builder ref; V2 does not expose inline TypeScript prompt builders.",
-        });
-        return;
-    }
-    if (!ref.valid) {
-        diagnostics.push({
-            code: "WorkflowGraphError.invalidPromptBuilderRef",
-            message: `Agent node '${nodeId}' prompt asset ref '${ref.id}' must use a registered TypeScript promptBuilder shape.`,
-            severity: "error",
-            path,
-            nodeId,
-            registryRef: ref.id,
-            hint: "Use { kind: 'promptBuilder', language: 'typescript', id: '<registered id>' } or a registered prompt asset id string.",
-        });
-        return;
-    }
-    if (!isWorkflowPromptAssetRegistered(input.state, input.webSession, ref.id)) {
-        diagnostics.push({
-            code: "WorkflowGraphError.unknownPromptBuilderRef",
-            message: `Agent node '${nodeId}' references prompt asset '${ref.id}', but it is not registered in the Workflow Registry.`,
-            severity: "error",
-            path: isJsonObject(value) ? `${path}.id` : path,
-            nodeId,
-            registryRef: ref.id,
-            hint: "Select a registered prompt asset ref before publishing or running this workflow.",
-        });
-    }
-}
-function readPromptAssetRef(value) {
-    if (typeof value === "string")
-        return { id: value.trim() || undefined, valid: Boolean(value.trim()) };
-    if (!isJsonObject(value))
-        return { valid: false };
-    const id = typeof value.id === "string" ? value.id.trim() : undefined;
-    return {
-        id,
-        valid: value.kind === "promptBuilder" && value.language === "typescript" && Boolean(id),
-    };
-}
-export function validateRegisteredAdapterRefLike(value, diagnostics, target) {
-    const ref = readRegisteredAdapterRef(value);
-    if (!ref.id) {
-        diagnostics.push({
-            code: "WorkflowGraphError.unknownAdapterRef",
-            message: `${target.diagnosticLabel} must select a registered adapter ref.`,
-            severity: "error",
-            path: `${target.path}.id`,
-            nodeId: target.nodeId,
-            edgeId: target.edgeId,
-            hint: "Adapter refs must be selected from the registered adapter picker; the UI cannot create inline adapter code.",
-        });
-        return;
-    }
-    if (!ref.valid) {
-        diagnostics.push({
-            code: "WorkflowGraphError.invalidAdapterRef",
-            message: `${target.diagnosticLabel} must use a registered TypeScript adapter ref shape.`,
-            severity: "error",
-            path: target.path,
-            nodeId: target.nodeId,
-            edgeId: target.edgeId,
-            registryRef: ref.id,
-            hint: "Persist adapter refs as { kind: 'adapter', language: 'typescript', id: '<registered id>' } instead of inline or raw handlers.",
-        });
-        return;
-    }
-    const registered = WORKFLOW_ADAPTER_REF_OPTIONS.find((option) => option.id === ref.id);
-    if (!registered) {
-        diagnostics.push({
-            code: "WorkflowGraphError.unknownAdapterRef",
-            message: `${target.diagnosticLabel} references adapter '${ref.id}', but it is not registered in the Workflow Registry.`,
-            severity: "error",
-            path: `${target.path}.id`,
-            nodeId: target.nodeId,
-            edgeId: target.edgeId,
-            registryRef: ref.id,
-            hint: "Select a registered adapter ref before publishing or running this workflow.",
-        });
-        return;
-    }
-    validateWorkflowRegisteredRefParamsLike(ref.params, registered.paramsSchema, diagnostics, {
-        kind: "adapter",
-        path: `${target.path}.params`,
-        diagnosticLabel: target.diagnosticLabel,
-        registryRef: ref.id,
-        nodeId: target.nodeId,
-        edgeId: target.edgeId,
-    });
-}
-function readRegisteredAdapterRef(value) {
-    if (!isJsonObject(value))
-        return { valid: false };
-    const id = typeof value.id === "string" ? value.id.trim() : undefined;
-    return {
-        id,
-        valid: value.kind === "adapter" && value.language === "typescript" && Boolean(id),
-        ...(value.params !== undefined ? { params: value.params } : {}),
-    };
-}
-export function validateWorkflowGuardRefLike(edgeId, value, diagnostics) {
-    const path = `$.edges.${edgeId}.guard.handler`;
-    if (!isJsonObject(value) || typeof value.handler !== "string" || !value.handler.trim()) {
-        diagnostics.push({
-            code: "WorkflowGraphError.invalidGuardRef",
-            message: `Workflow edge '${edgeId}' must use a registered guard handler ref.`,
-            severity: "error",
-            path,
-            edgeId,
-            hint: "Select a registered guard ref; V2 does not expose inline guard code.",
-        });
-        return;
-    }
-    const guardId = value.handler.trim();
-    if (value.priority !== undefined && (typeof value.priority !== "number" || !Number.isInteger(value.priority) || value.priority < 0)) {
-        diagnostics.push({
-            code: "WorkflowGraphError.invalidGuardPriority",
-            message: `Workflow edge '${edgeId}' guard priority must be a non-negative integer when declared.`,
-            severity: "error",
-            path: `$.edges.${edgeId}.guard.priority`,
-            edgeId,
-        });
-    }
-    const registered = WORKFLOW_GUARD_REF_OPTIONS.find((option) => option.id === guardId);
-    if (!registered) {
-        diagnostics.push({
-            code: "WorkflowGraphError.unknownGuardRef",
-            message: `Workflow edge '${edgeId}' references guard '${guardId}', but it is not registered in the Workflow Registry.`,
-            severity: "error",
-            path,
-            edgeId,
-            registryRef: guardId,
-            hint: "Select a registered guard ref before publishing or running this workflow.",
-        });
-        return;
-    }
-    validateWorkflowRegisteredRefParamsLike(value.params, registered.paramsSchema, diagnostics, {
-        kind: "guard",
-        path: `$.edges.${edgeId}.guard.params`,
-        diagnosticLabel: `Workflow edge '${edgeId}' guard`,
-        registryRef: guardId,
-        edgeId,
-    });
-}
-export function validateWorkflowHumanActionRefsLike(nodeId, value, diagnostics) {
-    if (!Array.isArray(value)) {
-        diagnostics.push({
-            code: "WorkflowGraphError.invalidHumanActionRef",
-            message: `Human node '${nodeId}' actions must be an array of registered human action refs.`,
-            severity: "error",
-            path: `$.nodes.${nodeId}.actions`,
-            nodeId,
-            hint: "Select registered human actions such as approve/reject/resume/cancel; V2 does not create arbitrary action handlers.",
-        });
-        return;
-    }
-    value.forEach((action, index) => {
-        const path = `$.nodes.${nodeId}.actions.${index}`;
-        if (!isJsonObject(action) || typeof action.id !== "string" || !action.id.trim()) {
-            diagnostics.push({
-                code: "WorkflowGraphError.invalidHumanActionRef",
-                message: `Human node '${nodeId}' declares an invalid human action ref at index ${index}.`,
-                severity: "error",
-                path,
-                nodeId,
-                hint: "Human action refs must contain a non-empty registered action id.",
-            });
-            return;
-        }
-        const actionId = action.id.trim();
-        const registered = WORKFLOW_HUMAN_ACTION_REF_OPTIONS.find((option) => option.id === actionId);
-        if (!registered) {
-            diagnostics.push({
-                code: "WorkflowGraphError.unknownHumanActionRef",
-                message: `Human node '${nodeId}' references human action '${actionId}', but it is not registered in the Workflow Registry.`,
-                severity: "error",
-                path: `${path}.id`,
-                nodeId,
-                registryRef: actionId,
-                hint: "Select a registered human action before publishing or running this workflow.",
-            });
-            return;
-        }
-        if (action.kind !== undefined && action.kind !== registered.kind) {
-            diagnostics.push({
-                code: "WorkflowGraphError.humanActionKindMismatch",
-                message: `Human node '${nodeId}' action '${actionId}' declares kind '${action.kind}', but the registry defines kind '${registered.kind}'.`,
-                severity: "error",
-                path: `${path}.kind`,
-                nodeId,
-                registryRef: actionId,
-                hint: "Keep human action refs aligned with their registered action definitions.",
-            });
-        }
-    });
-}
-function isJsonObject(value) {
-    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}

package/dist/apps/chat/workflow-v2-security-validation.js

@@ -1,93 +0,0 @@
-const INLINE_EXECUTABLE_FIELD_NAMES = new Set([
-    "code",
-    "script",
-    "command",
-    "eval",
-    "javascript",
-    "shell",
-    "typescript",
-    "inlinecode",
-    "inlinehandler",
-    "inlinetypescript",
-    "inlinejavascript",
-    "inlineshell",
-    "handlersource",
-    "sourcecode",
-]);
-const HIDDEN_LLM_COERCION_FIELD_NAMES = new Set([
-    "llmcoercion",
-    "coercewithllm",
-    "hiddenllmcoercion",
-    "autocoerce",
-    "llmadapter",
-]);
-const RAW_XSTATE_FIELD_NAMES = new Set([
-    "xstate",
-    "xstatemachine",
-    "xstatesource",
-    "xstatejson",
-]);
-export function validateWorkflowDefinitionSecurityBoundary(definition, diagnostics) {
-    validateNoInlineExecutableCode(definition, "$", diagnostics, {});
-    validateNoHiddenLlmCoercion(definition, "$", diagnostics, {});
-    for (const key of Object.keys(definition)) {
-        if (!RAW_XSTATE_FIELD_NAMES.has(normalizeWorkflowSecurityFieldName(key)))
-            continue;
-        diagnostics.push({
-            code: "WorkflowSecurityError.rawXStateAuthoring",
-            message: `Workflow definition declares raw XState field '${key}', which is projection-only and not editable in Workflow UI Authoring V2.`,
-            severity: "error",
-            path: `$.${key}`,
-            hint: "Edit and publish Pibo Workflow IR only; XState is generated as a visualization/projection from workflow run records.",
-        });
-    }
-}
-export function validateNoInlineExecutableCode(value, path, diagnostics, target) {
-    for (const key of Object.keys(value)) {
-        if (!INLINE_EXECUTABLE_FIELD_NAMES.has(normalizeWorkflowSecurityFieldName(key)))
-            continue;
-        diagnostics.push({
-            code: "WorkflowSecurityError.inlineExecutableCode",
-            message: `${workflowDiagnosticTargetLabel(target)} declares inline executable field '${key}', which is not allowed in Workflow UI Authoring V2.`,
-            severity: "error",
-            path: `${path}.${key}`,
-            ...target,
-            hint: "Use registered handler, adapter, guard, prompt asset, or human action refs selected from V2 pickers instead of inline JavaScript, TypeScript, shell, eval, or arbitrary executable code.",
-        });
-    }
-}
-export function validateNoHiddenLlmCoercion(value, path, diagnostics, target) {
-    for (const key of Object.keys(value)) {
-        if (!HIDDEN_LLM_COERCION_FIELD_NAMES.has(normalizeWorkflowSecurityFieldName(key)))
-            continue;
-        diagnostics.push({
-            code: "WorkflowSecurityError.hiddenLlmCoercion",
-            message: `${workflowDiagnosticTargetLabel(target)} declares hidden LLM coercion field '${key}', which is not allowed in Workflow UI Authoring V2.`,
-            severity: "error",
-            path: `${path}.${key}`,
-            ...target,
-            hint: "Use a visible registered adapter node or edge adapter when schemas are incompatible.",
-        });
-    }
-    const kind = typeof value.kind === "string" ? normalizeWorkflowSecurityFieldName(value.kind) : "";
-    if (kind === "llm" || kind === "llmadapter" || kind === "llmcoercion") {
-        diagnostics.push({
-            code: "WorkflowSecurityError.hiddenLlmCoercion",
-            message: `${workflowDiagnosticTargetLabel(target)} uses LLM coercion kind '${value.kind}', which is not allowed in Workflow UI Authoring V2.`,
-            severity: "error",
-            path: `${path}.kind`,
-            ...target,
-            hint: "Use deterministic registered adapters instead of hidden LLM coercion.",
-        });
-    }
-}
-function workflowDiagnosticTargetLabel(target) {
-    if (target.nodeId)
-        return `Workflow node '${target.nodeId}'`;
-    if (target.edgeId)
-        return `Workflow edge '${target.edgeId}'`;
-    return "Workflow definition";
-}
-function normalizeWorkflowSecurityFieldName(value) {
-    return value.replace(/[^a-zA-Z0-9]/g, "").toLowerCase();
-}