@planu/cli 4.13.0 → 4.14.1

package/dist/engine/execution/validate-job-executor.js

@@ -0,0 +1,342 @@
+import { randomUUID } from 'node:crypto';
+import { DurableJobRuntime } from './job-runtime.js';
+import { RuntimeDatabase } from '../../storage/runtime-db.js';
+import { createExecutionScope } from './context.js';
+import { runValidateWorker } from './validate-worker-runtime.js';
+import { redactValidationProgress, computeDurableValidationBindings, toValidationReceiptBindings, writeValidationArtifactProvenance, } from '../validation/durable-validation.js';
+import { resolveStorageLayout } from '../../storage/storage-layout.js';
+import { reportClassifiedDegradation } from '../../errors/classified-degradation.js';
+import { createValidationReceiptAuthority, ensureValidationIssuerKey, issueValidationReceipt, LOCAL_VALIDATION_RECEIPT_ISSUER, } from '../validation/validation-receipt.js';
+import { appendArtifact, readArtifact } from '../handoff-artifacts/io.js';
+import { assertValidationFreshnessBarrier, rebaselineValidationFreshnessLeaseAfterRecompute, } from '../validation/validation-freshness.js';
+import { recoverValidateJobs } from './validate-job-recovery.js';
+import { getRuntimePolicy } from '../runtime-policy.js';
+import { isValidateJob, parseValidatePayload, rehydrateValidationPayload, } from './validate-job-payload.js';
+const WORKSPACE_ID = 'global';
+const activeScopes = new Set();
+function hasReceipt(result) {
+    const structured = result.structuredContent;
+    return typeof structured?.receiptId === 'string' && typeof structured.receiptKey === 'string';
+}
+function validationPassed(result) {
+    const structured = result.structuredContent;
+    const report = structured?.validationReport;
+    return structured?.ready === true && report?.passed === true;
+}
+function toolResultError(result) {
+    return result.content
+        .map((item) => item.text)
+        .join('\n')
+        .slice(0, 4_096);
+}
+function executionAborted(signal) {
+    return signal.aborted;
+}
+function hasReceiptInputs(payload) {
+    return Boolean(payload.bindings && payload.artifactDigests && payload.freshnessLease);
+}
+/** Executes accepted validate jobs directly against the validation core, never through MCP. */
+export class ValidateJobExecutor {
+    runtime;
+    workerId;
+    options;
+    constructor(runtime, workerId = `validate-${randomUUID()}`, options = {}) {
+        this.runtime = runtime;
+        this.workerId = workerId;
+        this.options = options;
+    }
+    async runOnce(projectId, workspaceId = WORKSPACE_ID) {
+        const candidates = this.runtime
+            .list(projectId, workspaceId)
+            .filter((job) => (job.state === 'accepted' || job.state === 'checkpointed') && isValidateJob(job.payload))
+            .slice(0, getRuntimePolicy().validation.workerConcurrency);
+        return Promise.all(candidates.map((job) => this.execute(job)));
+    }
+    async runUntilIdle(projectId, workspaceId = WORKSPACE_ID) {
+        for (;;) {
+            const completed = await this.runOnce(projectId, workspaceId);
+            if (completed.length === 0) {
+                return;
+            }
+        }
+    }
+    async execute(job) {
+        const identity = {
+            operationId: job.id,
+            projectId: job.projectId,
+            workspaceId: job.workspaceId,
+        };
+        const claimed = this.runtime.claim({
+            ...identity,
+            workerId: this.workerId,
+            leaseMs: getRuntimePolicy().validation.workerLeaseMs,
+        });
+        if (!claimed) {
+            return this.runtime.get(identity);
+        }
+        const parsedPayload = parseValidatePayload(claimed.payload);
+        if (!parsedPayload) {
+            return this.runtime.fail({
+                ...identity,
+                workerId: this.workerId,
+                fencingToken: claimed.fencingToken,
+                error: '[Planu] Invalid validate job payload',
+            });
+        }
+        const deadlineAt = parsedPayload.deadlineAt ?? Date.now() + getRuntimePolicy().validation.defaultDeadlineMs;
+        if (deadlineAt <= Date.now()) {
+            return this.runtime.fail({
+                ...identity,
+                workerId: this.workerId,
+                fencingToken: claimed.fencingToken,
+                error: '[Planu] Durable validate job deadline elapsed',
+            });
+        }
+        let payload;
+        try {
+            payload = await rehydrateValidationPayload(parsedPayload);
+        }
+        catch (error) {
+            /* reliability-optional: VALIDATE_JOB_SUBMISSION_FAILURE — runtime records typed failure */
+            reportClassifiedDegradation('VALIDATE_JOB_SUBMISSION_FAILURE', error);
+            return this.runtime.fail({
+                ...identity,
+                workerId: this.workerId,
+                fencingToken: claimed.fencingToken,
+                error: (error instanceof Error ? error.message : String(error)).slice(0, 4_096),
+            });
+        }
+        return this.runClaimedValidation(identity, payload, deadlineAt, claimed.fencingToken);
+    }
+    async runClaimedValidation(identity, payload, deadlineAt, fencingToken) {
+        const scope = createExecutionScope({
+            requestId: identity.operationId,
+            deadlineAt,
+        });
+        const heartbeat = this.startHeartbeat(identity, fencingToken, (reason) => {
+            scope.cancel(reason);
+        });
+        try {
+            const startedAt = Date.now();
+            const result = await scope.run(() => (this.options.runWorker ?? runValidateWorker)({
+                requestId: identity.operationId,
+                input: payload.input,
+                deadlineAt,
+                signal: scope.context.signal,
+                onProgress: (progress) => {
+                    this.persistProgress(identity, fencingToken, progress);
+                },
+            }));
+            const current = this.runtime.get(identity);
+            if (current.state === 'cancelled') {
+                return current;
+            }
+            if (result.isError === true) {
+                return this.runtime.fail({
+                    ...identity,
+                    workerId: this.workerId,
+                    fencingToken,
+                    error: toolResultError(result),
+                });
+            }
+            if (hasReceipt(result)) {
+                throw new Error('[Planu] Validate workers cannot self-issue authoritative receipts');
+            }
+            const durableResult = validationPassed(result)
+                ? await this.issueReceipt(identity, payload, result, Date.now() - startedAt, scope.context.signal)
+                : result;
+            return this.runtime.complete({
+                ...identity,
+                workerId: this.workerId,
+                fencingToken,
+                result: durableResult,
+            });
+        }
+        catch (error) {
+            /* reliability-optional: VALIDATE_JOB_EXECUTION_FAILURE — runtime records typed failure */
+            reportClassifiedDegradation('VALIDATE_JOB_EXECUTION_FAILURE', error);
+            const current = this.runtime.get(identity);
+            if (current.state === 'cancelled') {
+                return current;
+            }
+            return this.runtime.fail({
+                ...identity,
+                workerId: this.workerId,
+                fencingToken,
+                error: redactValidationProgress({
+                    phase: 'worker',
+                    command: error instanceof Error ? error.message : String(error),
+                    durationMs: 0,
+                    status: 'failed',
+                }).command.slice(0, 4_096),
+            });
+        }
+        finally {
+            clearInterval(heartbeat);
+            scope.dispose();
+        }
+    }
+    startHeartbeat(identity, fencingToken, cancel) {
+        const heartbeat = setInterval(() => {
+            const current = this.runtime.get(identity);
+            if (current.state === 'cancelled' || current.cancelRequested) {
+                cancel(new Error('[Planu] Durable validate job cancelled'));
+                return;
+            }
+            if (!this.runtime.renew({
+                ...identity,
+                workerId: this.workerId,
+                fencingToken,
+                leaseMs: getRuntimePolicy().validation.workerLeaseMs,
+            })) {
+                cancel(new Error('[Planu] Durable validate job lease was lost'));
+            }
+        }, getRuntimePolicy().validation.workerHeartbeatMs);
+        heartbeat.unref();
+        return heartbeat;
+    }
+    persistProgress(identity, fencingToken, progress) {
+        const current = this.runtime.get(identity);
+        if (current.state !== 'running') {
+            return;
+        }
+        this.runtime.recordProgress({
+            ...identity,
+            workerId: this.workerId,
+            fencingToken,
+            checkpoint: redactValidationProgress(progress),
+        });
+    }
+    async issueReceipt(identity, payload, result, durationMs, signal) {
+        if (!hasReceiptInputs(payload)) {
+            throw new Error('[Planu] Passing durable validation is missing receipt bindings');
+        }
+        const receiptBindings = toValidationReceiptBindings(payload.bindings, payload.artifactDigests);
+        const publicationLease = await this.preparePublicationLease(payload, receiptBindings);
+        if (executionAborted(signal) ||
+            !(await assertValidationFreshnessBarrier(publicationLease, receiptBindings))) {
+            throw new Error('[Planu] Validation inputs changed before receipt publication');
+        }
+        const database = new RuntimeDatabase({ path: resolveStorageLayout().runtimeDatabase });
+        try {
+            const signingKeyReference = await ensureValidationIssuerKey({
+                projectId: identity.projectId,
+                issuerId: LOCAL_VALIDATION_RECEIPT_ISSUER,
+            });
+            const { store } = createValidationReceiptAuthority({
+                database,
+                workspaceId: identity.workspaceId,
+                projectId: identity.projectId,
+                issuerId: LOCAL_VALIDATION_RECEIPT_ISSUER,
+            });
+            const receipt = await issueValidationReceipt({
+                bindings: receiptBindings,
+                command: {
+                    executable: 'planu',
+                    args: ['validate', payload.bindings.specId],
+                    ...(payload.input.projectPath === undefined ? {} : { cwd: payload.input.projectPath }),
+                },
+                versions: { node: process.version, receiptSchema: '1' },
+                exitCode: 0,
+                durationMs,
+                log: result.content.map((item) => item.text).join('\n'),
+                gates: [{ gate: 'validation', status: 'passed', durationMs }],
+            }, {
+                issuerId: LOCAL_VALIDATION_RECEIPT_ISSUER,
+                signingKeyReference,
+                store,
+            });
+            if (executionAborted(signal) ||
+                !(await assertValidationFreshnessBarrier(publicationLease, receiptBindings))) {
+                await store.invalidateCurrentBindings(identity.projectId, payload.bindings.specId);
+                throw new Error('[Planu] Validation inputs changed during receipt publication');
+            }
+            const receiptKey = `validation-receipt:${receipt.receiptId.slice('sha256:'.length)}`;
+            await this.persistReceiptArtifacts(identity, payload, receipt.receiptId, receiptKey);
+            return {
+                ...result,
+                structuredContent: {
+                    ...(result.structuredContent ?? {}),
+                    receiptId: receipt.receiptId,
+                    receiptKey,
+                },
+            };
+        }
+        finally {
+            database.close();
+        }
+    }
+    async preparePublicationLease(payload, expectedBindings) {
+        let lease = payload.freshnessLease;
+        if (!lease) {
+            throw new Error('[Planu] Passing durable validation is missing freshness lease');
+        }
+        if (!payload.bindings || !payload.input.projectPath || !payload.specPath) {
+            return lease;
+        }
+        const bindings = payload.bindings;
+        const projectPath = payload.input.projectPath;
+        const specPath = payload.specPath;
+        const rebaselined = await rebaselineValidationFreshnessLeaseAfterRecompute({
+            lease,
+            expectedBindings,
+            recompute: async () => {
+                const observed = await computeDurableValidationBindings({
+                    canonicalProjectId: bindings.projectId,
+                    specId: bindings.specId,
+                    projectPath,
+                    specPath,
+                });
+                return toValidationReceiptBindings(observed.bindings, observed.artifactDigests);
+            },
+        });
+        if (!rebaselined) {
+            throw new Error('[Planu] Validation inputs changed before receipt publication');
+        }
+        lease = rebaselined;
+        return lease;
+    }
+    async persistReceiptArtifacts(identity, payload, receiptId, receiptKey) {
+        await writeValidationArtifactProvenance({
+            canonicalProjectId: identity.projectId,
+            specId: payload.bindings.specId,
+            receiptId,
+            issuerId: LOCAL_VALIDATION_RECEIPT_ISSUER,
+            artifactDigests: payload.artifactDigests,
+        });
+        const existingReport = await readArtifact({
+            projectId: identity.projectId,
+            specId: payload.bindings.specId,
+            kind: 'validation-report',
+        });
+        if (existingReport.ok) {
+            await appendArtifact({
+                projectId: identity.projectId,
+                specId: payload.bindings.specId,
+                kind: 'validation-report',
+                payload: { ...existingReport.payload, receiptId, receiptKey },
+            });
+        }
+    }
+}
+/** Schedules background execution after the submit response can be flushed. */
+export function scheduleValidateJobExecution(projectId, workspaceId = WORKSPACE_ID) {
+    const scope = `${projectId}:${workspaceId}`;
+    if (activeScopes.has(scope)) {
+        return;
+    }
+    activeScopes.add(scope);
+    setImmediate(() => {
+        const runtime = new DurableJobRuntime();
+        const executor = new ValidateJobExecutor(runtime);
+        void executor.runUntilIdle(projectId, workspaceId).finally(() => {
+            runtime.close();
+            activeScopes.delete(scope);
+        });
+    });
+}
+/** Re-enqueues accepted/checkpointed validate work discovered after a process restart. */
+export function recoverValidateJobsAtStartup(options = {}) {
+    recoverValidateJobs(scheduleValidateJobExecution, options);
+}
+//# sourceMappingURL=validate-job-executor.js.map

package/dist/engine/execution/validate-job-payload.d.ts

@@ -0,0 +1,5 @@
+import type { ValidateDurableJobPayload } from '../../types/durable-job.js';
+export declare function isValidateJob(value: unknown): boolean;
+export declare function parseValidatePayload(value: unknown): ValidateDurableJobPayload | undefined;
+export declare function rehydrateValidationPayload(payload: ValidateDurableJobPayload): Promise<ValidateDurableJobPayload>;
+//# sourceMappingURL=validate-job-payload.d.ts.map

package/dist/engine/execution/validate-job-payload.js

@@ -0,0 +1,87 @@
+import { mkdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { projectDataDir } from '../../storage/base-store.js';
+import { computeDurableValidationBindings, toValidationReceiptBindings, } from '../validation/durable-validation.js';
+import { assertValidationFreshnessBarrier, beginValidationFreshnessBarrier, bindValidationFreshnessLease, } from '../validation/validation-freshness.js';
+import { PROJECT_ID as CANONICAL_PROJECT_ID } from '../validation/validation-receipt-codec.js';
+export function isValidateJob(value) {
+    return Boolean(value && typeof value === 'object' && value.kind === 'validate');
+}
+export function parseValidatePayload(value) {
+    if (!value || typeof value !== 'object') {
+        return undefined;
+    }
+    const payload = value;
+    if (payload.kind !== 'validate' ||
+        payload.schemaVersion !== 1 ||
+        !payload.input ||
+        typeof payload.input.specId !== 'string' ||
+        typeof payload.input.projectId !== 'string' ||
+        !CANONICAL_PROJECT_ID.test(payload.input.projectId) ||
+        (payload.bindings !== undefined &&
+            (payload.bindings.projectId !== payload.input.projectId ||
+                !CANONICAL_PROJECT_ID.test(payload.bindings.projectId))) ||
+        (payload.input.projectPath !== undefined && typeof payload.input.projectPath !== 'string')) {
+        return undefined;
+    }
+    return payload;
+}
+export async function rehydrateValidationPayload(payload) {
+    const projectPath = payload.input.projectPath;
+    const specPath = payload.specPath;
+    if (!projectPath || !specPath) {
+        return payload;
+    }
+    if (!payload.bindings || !payload.artifactDigests) {
+        const handoffPath = join(projectDataDir(payload.input.projectId), 'handoffs', payload.input.specId);
+        await mkdir(handoffPath, { recursive: true });
+        const freshnessLease = await beginValidationFreshnessBarrier({
+            projectId: payload.input.projectId,
+            specId: payload.input.specId,
+            projectPath,
+            handoffPath,
+        });
+        const observed = await computeDurableValidationBindings({
+            canonicalProjectId: payload.input.projectId,
+            specId: payload.input.specId,
+            projectPath,
+            specPath,
+        });
+        const observedReceiptBindings = toValidationReceiptBindings(observed.bindings, observed.artifactDigests);
+        if (!(await bindValidationFreshnessLease(freshnessLease, observedReceiptBindings))) {
+            throw new Error('[Planu] Validation inputs changed while the snapshot was computed');
+        }
+        return {
+            ...payload,
+            bindings: observed.bindings,
+            artifactDigests: observed.artifactDigests,
+            freshnessLease,
+        };
+    }
+    const expected = toValidationReceiptBindings(payload.bindings, payload.artifactDigests);
+    if (payload.freshnessLease &&
+        (await assertValidationFreshnessBarrier(payload.freshnessLease, expected))) {
+        return payload;
+    }
+    const handoffPath = join(projectDataDir(payload.bindings.projectId), 'handoffs', payload.bindings.specId);
+    await mkdir(handoffPath, { recursive: true });
+    const freshnessLease = await beginValidationFreshnessBarrier({
+        projectId: payload.bindings.projectId,
+        specId: payload.bindings.specId,
+        projectPath,
+        handoffPath,
+    });
+    const observed = await computeDurableValidationBindings({
+        canonicalProjectId: payload.bindings.projectId,
+        specId: payload.bindings.specId,
+        projectPath,
+        specPath,
+    });
+    const observedReceiptBindings = toValidationReceiptBindings(observed.bindings, observed.artifactDigests);
+    if (JSON.stringify(expected) !== JSON.stringify(observedReceiptBindings) ||
+        !(await bindValidationFreshnessLease(freshnessLease, observedReceiptBindings))) {
+        throw new Error('[Planu] Durable validation bindings became stale; submit a new validation');
+    }
+    return { ...payload, freshnessLease };
+}
+//# sourceMappingURL=validate-job-payload.js.map

package/dist/engine/execution/validate-job-recovery.d.ts

@@ -0,0 +1,4 @@
+import type { ValidateJobRecoveryOptions } from '../../types/durable-validation.js';
+/** Recover runnable validation work and program one global sweep for the earliest live lease. */
+export declare function recoverValidateJobs(defaultSchedule: (projectId: string, workspaceId: string) => void, options?: ValidateJobRecoveryOptions): void;
+//# sourceMappingURL=validate-job-recovery.d.ts.map

package/dist/engine/execution/validate-job-recovery.js

@@ -0,0 +1,47 @@
+import { DurableJobRuntime } from './job-runtime.js';
+function isValidatePayload(value) {
+    return Boolean(value &&
+        typeof value === 'object' &&
+        value.kind === 'validate' &&
+        value.schemaVersion === 1);
+}
+/** Recover runnable validation work and program one global sweep for the earliest live lease. */
+export function recoverValidateJobs(defaultSchedule, options = {}) {
+    const runtime = options.runtimeFactory?.() ?? new DurableJobRuntime();
+    const schedule = options.schedule ?? defaultSchedule;
+    const now = options.now ?? Date.now;
+    const scheduleLater = options.scheduleLater ??
+        ((callback, delayMs) => {
+            const timer = setTimeout(callback, delayMs);
+            timer.unref();
+        });
+    try {
+        let earliestRunningLeaseExpiry;
+        for (const scope of runtime.listRunnableScopes()) {
+            const jobs = runtime
+                .list(scope.projectId, scope.workspaceId)
+                .filter((job) => isValidatePayload(job.payload));
+            if (jobs.some((job) => job.state === 'accepted' || job.state === 'checkpointed')) {
+                schedule(scope.projectId, scope.workspaceId);
+            }
+            for (const job of jobs) {
+                if (job.state !== 'running' || !job.leaseExpiresAt) {
+                    continue;
+                }
+                const expiry = Date.parse(job.leaseExpiresAt);
+                if (Number.isFinite(expiry)) {
+                    earliestRunningLeaseExpiry = Math.min(earliestRunningLeaseExpiry ?? expiry, expiry);
+                }
+            }
+        }
+        if (earliestRunningLeaseExpiry !== undefined) {
+            scheduleLater(() => {
+                recoverValidateJobs(defaultSchedule, options);
+            }, Math.max(1, earliestRunningLeaseExpiry - now() + 1));
+        }
+    }
+    finally {
+        runtime.close();
+    }
+}
+//# sourceMappingURL=validate-job-recovery.js.map

package/dist/engine/execution/validate-worker-runtime.d.ts

@@ -0,0 +1,5 @@
+import type { ValidateWorkerCall } from '../../types/validate-worker.js';
+import type { ToolResult } from '../../types/index.js';
+/** Execute validation in a supervised OS worker thread, isolated from the MCP event loop. */
+export declare function runValidateWorker(call: ValidateWorkerCall): Promise<ToolResult>;
+//# sourceMappingURL=validate-worker-runtime.d.ts.map

package/dist/engine/execution/validate-worker-runtime.js

@@ -0,0 +1,100 @@
+import { randomBytes } from 'node:crypto';
+import { existsSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { Worker } from 'node:worker_threads';
+function workerUrl() {
+    const sibling = new URL('./validate-worker-thread.js', import.meta.url);
+    if (existsSync(sibling)) {
+        return sibling;
+    }
+    const built = resolve(process.cwd(), 'dist/engine/execution/validate-worker-thread.js');
+    if (existsSync(built)) {
+        return pathToFileURL(built);
+    }
+    throw new Error('[Planu] Validate worker artifact is missing; run the production build');
+}
+/** Execute validation in a supervised OS worker thread, isolated from the MCP event loop. */
+export function runValidateWorker(call) {
+    if (call.signal?.aborted) {
+        return Promise.reject(abortError(call.signal));
+    }
+    if (!Number.isSafeInteger(call.deadlineAt) || call.deadlineAt <= Date.now()) {
+        return Promise.reject(new Error('[Planu] Validate worker requires a future deadline'));
+    }
+    const secret = randomBytes(32).toString('hex');
+    const worker = new Worker(workerUrl(), { workerData: { secret } });
+    return new Promise((resolveCall, reject) => {
+        let settled = false;
+        let sent = false;
+        const finish = (error, result) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            clearTimeout(timer);
+            call.signal?.removeEventListener('abort', abort);
+            void worker.terminate();
+            if (error) {
+                reject(error);
+            }
+            else if (result) {
+                resolveCall(result);
+            }
+            else {
+                reject(new Error('[Planu] Validate worker returned no result'));
+            }
+        };
+        const abort = () => {
+            finish(abortError(call.signal));
+        };
+        const timer = setTimeout(() => {
+            finish(new Error('[Planu] Validate worker deadline exceeded'));
+        }, Math.max(1, call.deadlineAt - Date.now()));
+        timer.unref();
+        call.signal?.addEventListener('abort', abort, { once: true });
+        worker.once('error', (error) => {
+            finish(error instanceof Error ? error : new Error(String(error)));
+        });
+        worker.once('exit', (code) => {
+            if (!settled && code !== 0) {
+                finish(new Error(`[Planu] Validate worker exited ${String(code)}`));
+            }
+        });
+        worker.on('message', (value) => {
+            const response = value;
+            if (response.kind === 'ready' && response.schemaVersion === 1 && !sent) {
+                const request = {
+                    kind: 'validate-request',
+                    schemaVersion: 1,
+                    secret,
+                    requestId: call.requestId,
+                    deadlineAt: call.deadlineAt,
+                    input: call.input,
+                };
+                sent = true;
+                worker.postMessage(request);
+                return;
+            }
+            const responseRequestId = 'requestId' in response ? response.requestId : undefined;
+            if (!sent || responseRequestId !== call.requestId || response.schemaVersion !== 1) {
+                finish(new Error('[Planu] Validate worker response identity mismatch'));
+            }
+            else if (response.kind === 'validate-progress' && response.progress !== undefined) {
+                call.onProgress?.(response.progress);
+            }
+            else if (response.kind === 'validate-error') {
+                finish(new Error(response.message));
+            }
+            else if (response.kind === 'validate-result') {
+                finish(undefined, response.result);
+            }
+        });
+    });
+}
+function abortError(signal) {
+    return signal?.reason instanceof Error
+        ? signal.reason
+        : new Error('[Planu] Validate worker cancelled');
+}
+//# sourceMappingURL=validate-worker-runtime.js.map

package/dist/engine/execution/validate-worker-thread.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=validate-worker-thread.d.ts.map

package/dist/engine/execution/validate-worker-thread.js

@@ -0,0 +1,71 @@
+import { parentPort, workerData } from 'node:worker_threads';
+import { redactFailureMessage, reportClassifiedDegradation, } from '../../errors/classified-degradation.js';
+const bootstrap = workerData;
+if (!parentPort || typeof bootstrap?.secret !== 'string' || bootstrap.secret.length < 32) {
+    throw new Error('[Planu] Validate worker bootstrap authentication failed');
+}
+const port = parentPort;
+const secret = bootstrap.secret;
+port.postMessage({ kind: 'ready', schemaVersion: 1 });
+port.once('message', (value) => {
+    void execute(value);
+});
+async function execute(value) {
+    const request = value;
+    const requestId = typeof request.requestId === 'string' ? request.requestId : 'invalid';
+    try {
+        if (request.kind !== 'validate-request' ||
+            request.schemaVersion !== 1 ||
+            request.secret !== secret ||
+            typeof request.requestId !== 'string' ||
+            !request.input ||
+            typeof request.input.specId !== 'string' ||
+            typeof request.input.projectId !== 'string' ||
+            typeof request.deadlineAt !== 'number' ||
+            Date.now() >= request.deadlineAt) {
+            throw new Error('[Planu] Validate worker rejected malformed or expired work');
+        }
+        const { executeValidate } = await import('../../tools/validate.js');
+        const startedAt = Date.now();
+        port.postMessage({
+            kind: 'validate-progress',
+            schemaVersion: 1,
+            requestId,
+            progress: {
+                phase: 'validation',
+                command: 'planu validate',
+                durationMs: 0,
+                status: 'running',
+            },
+        });
+        const result = await executeValidate(request.input);
+        port.postMessage({
+            kind: 'validate-progress',
+            schemaVersion: 1,
+            requestId,
+            progress: {
+                phase: 'validation',
+                command: 'planu validate',
+                durationMs: Date.now() - startedAt,
+                status: result.isError === true ? 'failed' : 'passed',
+            },
+        });
+        port.postMessage({
+            kind: 'validate-result',
+            schemaVersion: 1,
+            requestId,
+            result,
+        });
+    }
+    catch (error) {
+        /* reliability-optional: VALIDATE_WORKER_FAILURE — typed error response is emitted */
+        reportClassifiedDegradation('VALIDATE_WORKER_FAILURE', error);
+        port.postMessage({
+            kind: 'validate-error',
+            schemaVersion: 1,
+            requestId,
+            message: redactFailureMessage(error),
+        });
+    }
+}
+//# sourceMappingURL=validate-worker-thread.js.map