@vaudience/aigentflow-flow-validator 0.22.0 → 0.24.0

package/PARITY.md

@@ -4,7 +4,47 @@ This document maps every rule in this JavaScript validator back to the AIgentFlo
 Go reference implementation, records the intentional divergences, and defines the
 discipline for keeping the two in sync.
 
-**Tracks AIgentFlow flow schema: `v2.828.0`** (`SPEC_VERSION` in [`src/spec/aigentflow-spec.json`](./src/spec/aigentflow-spec.json)), which adds the rule `flow_data_key_reserved` (package 0.22.0, below). Earlier: the `here` executor scheme, the `strict_templates` flow key and the rule `template_default_piped` (package 0.21.0). Earlier: the warning `compliance_residency_unenforced` (package 0.20.0). `orchestrator.region` / `orchestrator.enforce_region` (package 0.19.0). Earlier: the AigentChat executor was removed (package 0.18.0). Earlier additions: the `examples:` block (package 0.17.0), `server_owned_query_key` (package 0.15.1) from the AIgentFlow release after v2.790.0, `credential_endpoint_unpaired` (package 0.15.2) from AIgentFlow v2.793.0 and the release after it, and `display_name_too_long` (package 0.15.3) from AIgentFlow v2.802.0.
+**Tracks AIgentFlow flow schema: `v2.831.0`** (`SPEC_VERSION` in [`src/spec/aigentflow-spec.json`](./src/spec/aigentflow-spec.json)), which adds the rule `unknown_function_operation` and a clearer `unknown_executor_scheme` message (package 0.23.0, below). Earlier: the rule `flow_data_key_reserved` (package 0.22.0). Earlier: the `here` executor scheme, the `strict_templates` flow key and the rule `template_default_piped` (package 0.21.0). Earlier: the warning `compliance_residency_unenforced` (package 0.20.0). `orchestrator.region` / `orchestrator.enforce_region` (package 0.19.0). Earlier: the AigentChat executor was removed (package 0.18.0). Earlier additions: the `examples:` block (package 0.17.0), `server_owned_query_key` (package 0.15.1) from the AIgentFlow release after v2.790.0, `credential_endpoint_unpaired` (package 0.15.2) from AIgentFlow v2.793.0 and the release after it, and `display_name_too_long` (package 0.15.3) from AIgentFlow v2.802.0.
+
+> package 0.24.0 — **`potential_infinite_loop` fires only on a cycle with no way out**, in step
+> with the reference. It used to fire on every cycle reachable from the start step, so a deliberate
+> ask-again loop (a step that routes back until a condition sends it onward) carried a warning that
+> told the author nothing. The reference now computes the strongly connected sets (Tarjan) over
+> `next.default` and `next.conditions[].goto` edges reachable from start (markers `null` /
+> `orchestrator` and unknown steps are not followed; `end` is an ordinary step) and warns once when
+> a cyclic set (more than one step, or a self-loop) has no exit. A member leaves the set when it has
+> no `next`, its `next` has `parallel` (a fan-out is treated as an exit, not guessed at), its
+> `next.default` is empty (when no condition matches the flow ends), or any default or condition
+> target is `null`, `orchestrator` or a step outside the set. Code and severity are unchanged; the
+> message now ends "a cycle of steps has no way out" and the suggestion asks for a `next.conditions`
+> branch that leaves the cycle. It cannot prove an exit ever fires; that is undecidable from the
+> YAML. Module: `validators/connectivity.ts`. Gates: ten `valid-cycle-*` / `warn-cycle-*` fixtures
+> (the valid ones use `forbidWarningCodes`, the only way to assert a false-positive risk), shared
+> byte for byte with the Go port. On the 227 bundled example flows both ports report 0 findings.
+
+> package 0.23.0 — **`unknown_function_operation`**, in step with the reference (AIgentFlow
+> v2.831.0; `specVersion` 2.831.0). One new **error**: a step or loop sub-step whose executor
+> is `function://<a>/<b>` where `<a>/<b>` is not one of the 32 registered built-ins. Before
+> this, `function://utils/noop` validated and then failed every run with "function
+> 'utils/noop' not found".
+>
+> | Rule (reference)                             | Code                         | Severity | Module                                               |
+> | -------------------------------------------- | ---------------------------- | -------- | ---------------------------------------------------- |
+> | `validateFunctionOperationKnown` (parser.go) | `unknown_function_operation` | error    | `validators/executors.ts`, spec `functionOperations` |
+>
+> - **Operation** = authority + `/` + path of the executor URL (so `binary-processor/validate-and-store`).
+>   The set is closed and sorted in spec `functionOperations.operations`. Templated executors
+>   (containing `{{`), unparsable URLs (`invalid_executor_url` owns them) and other schemes are
+>   skipped; the scheme match is exact and case-sensitive.
+> - **Finding.** Field `steps.<id>.executor` (loop sub-step: `steps.<id>.loop.steps[i].executor`,
+>   step id `<id>.<sub>`); message `step "<id>" uses function://<op>, which is not a built-in
+function. Available: <sorted list, ", ">`; the suggestion carries the list.
+> - **Divergence 23** (below): the reference tolerates this code on its load door.
+> - **`unknown_executor_scheme` text (still a warning).** For `decide` the message appends
+>   `Decision models run through ai://{provider}/decide (for example ai://openai/decide), not
+through a scheme of their own.`; for any other unknown scheme with a known scheme within
+>   edit distance 2 (case-insensitive; the closest, ties to the alphabetically first) it
+>   appends `Did you mean '<scheme>'?`. No verdict changes.
 
 > package 0.22.0 — **`flow_data_key_reserved`**, in step with the reference (AIgentFlow
 > v2.828.0; `specVersion` 2.828.0). One new **error**: a key of the top-level `data:` map
@@ -1110,6 +1150,7 @@ Comparison contract: **error `code` + `valid` verdict**, not message wording. Th
 | `tool_discovery` vocabulary, mock scenario `delay`, empty `output:` entry                                               | `validateToolDiscoveryVocabulary`, `validateMockScenarioDelays`, `validateOutputParameters` (parser.go) | `validators/saveDoor.ts`                                  | `validate.test.ts`, `conformance.test.ts`                     |
 | `executor_config` `${NAME}` references outside the key's scope (`executor_config_env_scope`)                            | `ValidateExecutorConfigEnvScopes` (parser.go)                                                           | `validators/executorConfigEnv.ts`                         | `v0150-save-door.test.ts`, `conformance.test.ts`              |
 | A step or loop sub-step `query:` declaring a server-owned key (`server_owned_query_key`)                                | `validateNoServerOwnedStepQueryKeys` (validation.go), `IsServerOwnedParamKey`                           | `validators/serverOwnedQueryKeys.ts`                      | `v0151-save-door.test.ts`, `conformance.test.ts`              |
+| A `function://` operation outside the built-in set (`unknown_function_operation`)                                       | `validateFunctionOperationKnown` (parser.go)                                                            | `validators/executors.ts`                                 | `v0230-function-operation.test.ts`, `conformance.test.ts`     |
 | A top-level `data:` key naming engine state (`flow_data_key_reserved`)                                                  | `FlowDataKeyReservation`, `validateFlowDataKeysAreNotReserved` (validation.flowdata.go)                 | `validators/flowDataKeys.ts`                              | `v0220-flow-data-keys.test.ts`, `conformance.test.ts`         |
 | An endpoint a server-supplied credential will never be sent to (`credential_endpoint_unpaired`, warning)                | `validateCredentialEndpointPairing`, `validateFamilyCredentialEndpointPairing` (validation.go)          | `validators/credentialEndpoint.ts`, `validators/goUrl.ts` | `v0152-credential-endpoint.test.ts`, `conformance.test.ts`    |
 | The `examples:` block: 58 codes, one walker (ids, inputs, references, expectations, checkpoints, variants)              | the examples walker (`ValidateExamples`)                                                                | `validators/examples.ts`, `validators/goUrl.ts`           | `examples.test.ts`, `conformance.test.ts`                     |
@@ -1380,6 +1421,11 @@ number their shared divergences alike._
     - The recursion bound of 32 on a nested value is the reference's own and is not in the
       spec.
 
+23. **`unknown_function_operation` is tolerated on the reference's load door (0.23.0).** The
+    reference refuses an unknown `function://` operation when a flow is _saved_ but loads
+    (and then fails at run time) a stored flow that already carries one. This validator
+    answers "would this save", so it is an error here, as for every other save-door rule.
+
 ---
 
 ## The examples block

package/README.md

@@ -116,7 +116,7 @@ Low-level: parse YAML into `{ flow?, parseErrors, parseWarnings }` without valid
 
 ### `SPEC_VERSION: string`
 
-The AIgentFlow flow-schema version this build tracks (e.g. `"2.828.0"`).
+The AIgentFlow flow-schema version this build tracks (e.g. `"2.831.0"`).
 
 ### Options
 

package/dist/cli.js

@@ -438,7 +438,7 @@ function validateBasicStructure(flow, issues) {
           message: "Executor is required for each step",
           code: "missing_required_field",
           stepId: stepID,
-          suggestion: "Specify an executor URL (e.g., 'function://demo/processor')"
+          suggestion: "Specify an executor URL (e.g., 'function://utils/log')"
         });
       } else if (executorText === null) {
         issues.error({
@@ -455,7 +455,7 @@ function validateBasicStructure(flow, issues) {
 // src/spec/aigentflow-spec.json
 var aigentflow_spec_default = {
   $comment: "Vendored enum surface mirrored from the AIgentFlow Go reference implementation. Regenerate / review on every flow-YAML schema change. See PARITY.md. Values here are public protocol/type names only.",
-  specVersion: "2.828.0",
+  specVersion: "2.831.0",
   inputSchemaVersion: 1,
   executorSchemes: [
     "a2a",
@@ -965,6 +965,47 @@ var aigentflow_spec_default = {
     stepFieldFormat: "steps.%s.query.%s",
     loopStepFieldFormat: "steps.%s.loop.steps.%s.query.%s"
   },
+  functionOperations: {
+    $comment: `unknown_function_operation (ERROR): a step or loop sub-step whose executor is function://<authority>/<path> where authority+"/"+path is not in operations. Templated executors (containing templateActionOpen), unparsable URLs (invalid_executor_url owns them) and other schemes are skipped; the scheme match is exact and case-sensitive, as in the reference. The message is messageFormat with the stepId, the operation, then operations joined by ', '. Reference: validateFunctionOperationKnown (parser.go), functionSchemaOperations.`,
+    code: "unknown_function_operation",
+    scheme: "function",
+    messageFormat: "step %s uses function://%s, which is not a built-in function. Available: %s",
+    suggestionFormat: "Use one of the built-in function operations: %s. For custom logic use a script://, http:// or ai:// executor instead.",
+    operations: [
+      "binary-processor/validate-and-store",
+      "data/create",
+      "data/from-json",
+      "data/to-json",
+      "data/validate",
+      "demo/adult-processor",
+      "demo/calculator",
+      "demo/data-processor",
+      "demo/finalizer",
+      "demo/senior-processor",
+      "demo/youth-processor",
+      "document/finalize",
+      "document/prepare",
+      "json/validate",
+      "math/basic",
+      "math/calculate",
+      "math/sum",
+      "results-compiler/aggregate",
+      "system/info",
+      "text/analysis",
+      "text/count-characters",
+      "text/count-lines",
+      "text/count-occurrences",
+      "text/count-words",
+      "text/find-pattern",
+      "text/generate",
+      "text/replace-text",
+      "text/search",
+      "utils/datetime",
+      "utils/format-date",
+      "utils/log",
+      "utils/parse-date"
+    ]
+  },
   flowDataReservedKeys: {
     $comment: "flow_data_key_reserved (ERROR, no loop demotion): a key of the top-level data: map that names engine state. data: is seeded into the mission's .data namespace, where the engine keeps its own bookkeeping, so a flow declaring such a key would forge it. Matching is exact and case-sensitive. A key is reserved when it is one of exact (each with its reason), or starts with one of prefixes (checked in order, first wins; each with its reason). The finding's field is fieldFormat with the key; the message is messageFormat with the key (JSON-quoted, as Go's %q) then the reason; the suggestion is verbatim. Findings are sorted by key. Reference: FlowDataKeyReservation, validateFlowDataKeysAreNotReserved (aigentflow#247 review).",
     code: "flow_data_key_reserved",
@@ -2080,9 +2121,51 @@ var TEMPLATE_DEFAULT_PIPED = {
   messageFormat: aigentflow_spec_default.templateDefaultPiped.messageFormat,
   suggestion: aigentflow_spec_default.templateDefaultPiped.suggestion
 };
+var FUNCTION_OPERATIONS = {
+  code: aigentflow_spec_default.functionOperations.code,
+  scheme: aigentflow_spec_default.functionOperations.scheme,
+  messageFormat: aigentflow_spec_default.functionOperations.messageFormat,
+  suggestionFormat: aigentflow_spec_default.functionOperations.suggestionFormat,
+  operations: new Set(aigentflow_spec_default.functionOperations.operations),
+  sorted: aigentflow_spec_default.functionOperations.operations
+};
 
 // src/validators/executors.ts
 var SCHEME_SEPARATOR = "://";
+var UNKNOWN_SCHEME_BASE = (scheme) => `Unknown executor scheme '${scheme}'. It may be valid in a newer AIgentFlow release, or it could be a typo.`;
+var DECIDE_SCHEME = "decide";
+var DECIDE_HINT = "Decision models run through ai://{provider}/decide (for example ai://openai/decide), not through a scheme of their own.";
+var MAX_SCHEME_EDIT_DISTANCE = 2;
+function editDistance(a, b) {
+  let prev = Array.from({ length: b.length + 1 }, (_, j) => j);
+  for (let i = 1; i <= a.length; i++) {
+    const cur = [i];
+    for (let j = 1; j <= b.length; j++) {
+      cur[j] = Math.min(
+        prev[j] + 1,
+        cur[j - 1] + 1,
+        prev[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1)
+      );
+    }
+    prev = cur;
+  }
+  return prev[b.length];
+}
+function unknownSchemeMessage(scheme) {
+  const lower = scheme.toLowerCase();
+  const base = UNKNOWN_SCHEME_BASE(scheme);
+  if (lower === DECIDE_SCHEME) return `${base} ${DECIDE_HINT}`;
+  let best;
+  let bestDist = MAX_SCHEME_EDIT_DISTANCE + 1;
+  for (const known of [...EXECUTOR_SCHEMES].sort()) {
+    const d = editDistance(lower, known);
+    if (d < bestDist) {
+      best = known;
+      bestDist = d;
+    }
+  }
+  return best === void 0 ? base : `${base} Did you mean '${best}'?`;
+}
 function checkExecutor(executor, field, stepID, issues) {
   const sepIdx = executor.indexOf(SCHEME_SEPARATOR);
   const scheme = sepIdx > 0 ? executor.slice(0, sepIdx) : "";
@@ -2101,11 +2184,28 @@ function checkExecutor(executor, field, stepID, issues) {
   if (!EXECUTOR_SCHEMES.has(scheme.toLowerCase())) {
     issues.warn({
       field,
-      message: `Unknown executor scheme '${scheme}'. It may be valid in a newer AIgentFlow release, or it could be a typo.`,
+      message: unknownSchemeMessage(scheme),
       code: "unknown_executor_scheme",
       stepId: stepID
     });
+    return;
   }
+  checkFunctionOperation(executor, field, stepID, templated, issues);
+}
+function checkFunctionOperation(executor, field, stepID, templated, issues) {
+  if (templated) return;
+  const m = EXECUTOR_URL_PATTERN.exec(executor);
+  if (m === null || m[1] !== FUNCTION_OPERATIONS.scheme) return;
+  const op = `${m[2]}/${m[3]}`;
+  if (FUNCTION_OPERATIONS.operations.has(op)) return;
+  const list = FUNCTION_OPERATIONS.sorted.join(", ");
+  issues.error({
+    field,
+    message: FUNCTION_OPERATIONS.messageFormat.replace("%s", () => JSON.stringify(stepID)).replace("%s", () => op).replace("%s", () => list),
+    code: FUNCTION_OPERATIONS.code,
+    stepId: stepID,
+    suggestion: FUNCTION_OPERATIONS.suggestionFormat.replace("%s", () => list)
+  });
 }
 function validateExecutors(flow, issues) {
   const steps = flow.steps;
@@ -2632,32 +2732,82 @@ function validateConnectivity(flow, issues) {
       });
     }
   }
-  const visited = /* @__PURE__ */ new Set();
-  const recStack = /* @__PURE__ */ new Set();
-  const hasCycle = (stepID) => {
-    if (recStack.has(stepID)) return true;
-    if (visited.has(stepID)) return false;
-    visited.add(stepID);
-    recStack.add(stepID);
-    const step = steps[stepID];
-    if (isRecord(step) && isRecord(step.next)) {
-      const next = step.next;
-      for (const target of cycleTargets(next, `steps.${stepID}.next`, issues)) {
-        if (hasCycle(target)) return true;
-      }
-    }
-    recStack.delete(stepID);
-    return false;
-  };
-  if (hasCycle(start)) {
+  if (cycleWithoutExit(steps, start, issues)) {
     issues.warn({
       field: "steps",
-      message: "Potential infinite loop detected in step flow",
+      message: "Potential infinite loop detected in step flow: a cycle of steps has no way out",
       code: "potential_infinite_loop",
-      suggestion: "Review your step transitions to ensure they eventually terminate"
+      suggestion: "Give one step in the cycle a `next.conditions` branch that leaves it (or end the flow there)"
     });
   }
 }
+function cycleEdges(step, stepID, issues) {
+  if (!isRecord(step) || !isRecord(step.next)) return [];
+  const next = step.next;
+  const nextPath = `steps.${stepID}.next`;
+  const out = [];
+  const def = issues.stringOf(next, "default", nextPath);
+  if (def !== null && def !== "") out.push(def);
+  if (Array.isArray(next.conditions)) {
+    next.conditions.forEach((cond, i) => {
+      if (!isRecord(cond)) return;
+      const goto = issues.stringOf(cond, "goto", `${nextPath}.conditions[${i}]`);
+      if (goto !== null && goto !== "") out.push(goto);
+    });
+  }
+  return out;
+}
+function stepLeavesCycle(steps, stepID, inCycle, issues) {
+  const step = steps[stepID];
+  if (!isRecord(step) || !isRecord(step.next)) return true;
+  const next = step.next;
+  if (next.parallel !== void 0 && next.parallel !== null) return true;
+  const def = issues.stringOf(next, "default", `steps.${stepID}.next`);
+  if (def === null || def === "") return true;
+  for (const target of cycleEdges(step, stepID, issues)) {
+    if (isMarker(target) || !inCycle.has(target)) return true;
+  }
+  return false;
+}
+function cycleWithoutExit(steps, start, issues) {
+  let index = 0;
+  const indices = /* @__PURE__ */ new Map();
+  const low = /* @__PURE__ */ new Map();
+  const onStack = /* @__PURE__ */ new Set();
+  const stack = [];
+  let found = false;
+  const strong = (id) => {
+    indices.set(id, index);
+    low.set(id, index);
+    index++;
+    stack.push(id);
+    onStack.add(id);
+    for (const target of cycleEdges(steps[id], id, issues)) {
+      if (isMarker(target) || !Object.prototype.hasOwnProperty.call(steps, target)) continue;
+      if (!indices.has(target)) {
+        strong(target);
+        low.set(id, Math.min(low.get(id), low.get(target)));
+      } else if (onStack.has(target)) {
+        low.set(id, Math.min(low.get(id), indices.get(target)));
+      }
+    }
+    if (low.get(id) !== indices.get(id)) return;
+    const component = [];
+    for (; ; ) {
+      const top = stack.pop();
+      onStack.delete(top);
+      component.push(top);
+      if (top === id) break;
+    }
+    const inCycle = new Set(component);
+    const cyclic = component.length > 1 || cycleEdges(steps[id], id, issues).includes(id);
+    if (!cyclic) return;
+    if (component.some((member) => stepLeavesCycle(steps, member, inCycle, issues))) return;
+    found = true;
+  };
+  if (Object.prototype.hasOwnProperty.call(steps, start)) strong(start);
+  return found;
+}
 
 // src/validators/nextLogic.ts
 var NEXT_NULL = "null";

package/dist/index.cjs

@@ -435,7 +435,7 @@ function validateBasicStructure(flow, issues) {
           message: "Executor is required for each step",
           code: "missing_required_field",
           stepId: stepID,
-          suggestion: "Specify an executor URL (e.g., 'function://demo/processor')"
+          suggestion: "Specify an executor URL (e.g., 'function://utils/log')"
         });
       } else if (executorText === null) {
         issues.error({
@@ -451,7 +451,7 @@ function validateBasicStructure(flow, issues) {
 
 // src/spec/aigentflow-spec.json
 var aigentflow_spec_default = {
-  specVersion: "2.828.0",
+  specVersion: "2.831.0",
   inputSchemaVersion: 1,
   executorSchemes: [
     "a2a",
@@ -948,6 +948,46 @@ var aigentflow_spec_default = {
     stepFieldFormat: "steps.%s.query.%s",
     loopStepFieldFormat: "steps.%s.loop.steps.%s.query.%s"
   },
+  functionOperations: {
+    code: "unknown_function_operation",
+    scheme: "function",
+    messageFormat: "step %s uses function://%s, which is not a built-in function. Available: %s",
+    suggestionFormat: "Use one of the built-in function operations: %s. For custom logic use a script://, http:// or ai:// executor instead.",
+    operations: [
+      "binary-processor/validate-and-store",
+      "data/create",
+      "data/from-json",
+      "data/to-json",
+      "data/validate",
+      "demo/adult-processor",
+      "demo/calculator",
+      "demo/data-processor",
+      "demo/finalizer",
+      "demo/senior-processor",
+      "demo/youth-processor",
+      "document/finalize",
+      "document/prepare",
+      "json/validate",
+      "math/basic",
+      "math/calculate",
+      "math/sum",
+      "results-compiler/aggregate",
+      "system/info",
+      "text/analysis",
+      "text/count-characters",
+      "text/count-lines",
+      "text/count-occurrences",
+      "text/count-words",
+      "text/find-pattern",
+      "text/generate",
+      "text/replace-text",
+      "text/search",
+      "utils/datetime",
+      "utils/format-date",
+      "utils/log",
+      "utils/parse-date"
+    ]
+  },
   flowDataReservedKeys: {
     code: "flow_data_key_reserved",
     fieldFormat: "data.%s",
@@ -1982,9 +2022,51 @@ var TEMPLATE_DEFAULT_PIPED = {
   messageFormat: aigentflow_spec_default.templateDefaultPiped.messageFormat,
   suggestion: aigentflow_spec_default.templateDefaultPiped.suggestion
 };
+var FUNCTION_OPERATIONS = {
+  code: aigentflow_spec_default.functionOperations.code,
+  scheme: aigentflow_spec_default.functionOperations.scheme,
+  messageFormat: aigentflow_spec_default.functionOperations.messageFormat,
+  suggestionFormat: aigentflow_spec_default.functionOperations.suggestionFormat,
+  operations: new Set(aigentflow_spec_default.functionOperations.operations),
+  sorted: aigentflow_spec_default.functionOperations.operations
+};
 
 // src/validators/executors.ts
 var SCHEME_SEPARATOR = "://";
+var UNKNOWN_SCHEME_BASE = (scheme) => `Unknown executor scheme '${scheme}'. It may be valid in a newer AIgentFlow release, or it could be a typo.`;
+var DECIDE_SCHEME = "decide";
+var DECIDE_HINT = "Decision models run through ai://{provider}/decide (for example ai://openai/decide), not through a scheme of their own.";
+var MAX_SCHEME_EDIT_DISTANCE = 2;
+function editDistance(a, b) {
+  let prev = Array.from({ length: b.length + 1 }, (_, j) => j);
+  for (let i = 1; i <= a.length; i++) {
+    const cur = [i];
+    for (let j = 1; j <= b.length; j++) {
+      cur[j] = Math.min(
+        prev[j] + 1,
+        cur[j - 1] + 1,
+        prev[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1)
+      );
+    }
+    prev = cur;
+  }
+  return prev[b.length];
+}
+function unknownSchemeMessage(scheme) {
+  const lower = scheme.toLowerCase();
+  const base = UNKNOWN_SCHEME_BASE(scheme);
+  if (lower === DECIDE_SCHEME) return `${base} ${DECIDE_HINT}`;
+  let best;
+  let bestDist = MAX_SCHEME_EDIT_DISTANCE + 1;
+  for (const known of [...EXECUTOR_SCHEMES].sort()) {
+    const d = editDistance(lower, known);
+    if (d < bestDist) {
+      best = known;
+      bestDist = d;
+    }
+  }
+  return best === void 0 ? base : `${base} Did you mean '${best}'?`;
+}
 function checkExecutor(executor, field, stepID, issues) {
   const sepIdx = executor.indexOf(SCHEME_SEPARATOR);
   const scheme = sepIdx > 0 ? executor.slice(0, sepIdx) : "";
@@ -2003,11 +2085,28 @@ function checkExecutor(executor, field, stepID, issues) {
   if (!EXECUTOR_SCHEMES.has(scheme.toLowerCase())) {
     issues.warn({
       field,
-      message: `Unknown executor scheme '${scheme}'. It may be valid in a newer AIgentFlow release, or it could be a typo.`,
+      message: unknownSchemeMessage(scheme),
       code: "unknown_executor_scheme",
       stepId: stepID
     });
+    return;
   }
+  checkFunctionOperation(executor, field, stepID, templated, issues);
+}
+function checkFunctionOperation(executor, field, stepID, templated, issues) {
+  if (templated) return;
+  const m = EXECUTOR_URL_PATTERN.exec(executor);
+  if (m === null || m[1] !== FUNCTION_OPERATIONS.scheme) return;
+  const op = `${m[2]}/${m[3]}`;
+  if (FUNCTION_OPERATIONS.operations.has(op)) return;
+  const list = FUNCTION_OPERATIONS.sorted.join(", ");
+  issues.error({
+    field,
+    message: FUNCTION_OPERATIONS.messageFormat.replace("%s", () => JSON.stringify(stepID)).replace("%s", () => op).replace("%s", () => list),
+    code: FUNCTION_OPERATIONS.code,
+    stepId: stepID,
+    suggestion: FUNCTION_OPERATIONS.suggestionFormat.replace("%s", () => list)
+  });
 }
 function validateExecutors(flow, issues) {
   const steps = flow.steps;
@@ -2534,32 +2633,82 @@ function validateConnectivity(flow, issues) {
       });
     }
   }
-  const visited = /* @__PURE__ */ new Set();
-  const recStack = /* @__PURE__ */ new Set();
-  const hasCycle = (stepID) => {
-    if (recStack.has(stepID)) return true;
-    if (visited.has(stepID)) return false;
-    visited.add(stepID);
-    recStack.add(stepID);
-    const step = steps[stepID];
-    if (isRecord(step) && isRecord(step.next)) {
-      const next = step.next;
-      for (const target of cycleTargets(next, `steps.${stepID}.next`, issues)) {
-        if (hasCycle(target)) return true;
-      }
-    }
-    recStack.delete(stepID);
-    return false;
-  };
-  if (hasCycle(start)) {
+  if (cycleWithoutExit(steps, start, issues)) {
     issues.warn({
       field: "steps",
-      message: "Potential infinite loop detected in step flow",
+      message: "Potential infinite loop detected in step flow: a cycle of steps has no way out",
       code: "potential_infinite_loop",
-      suggestion: "Review your step transitions to ensure they eventually terminate"
+      suggestion: "Give one step in the cycle a `next.conditions` branch that leaves it (or end the flow there)"
     });
   }
 }
+function cycleEdges(step, stepID, issues) {
+  if (!isRecord(step) || !isRecord(step.next)) return [];
+  const next = step.next;
+  const nextPath = `steps.${stepID}.next`;
+  const out = [];
+  const def = issues.stringOf(next, "default", nextPath);
+  if (def !== null && def !== "") out.push(def);
+  if (Array.isArray(next.conditions)) {
+    next.conditions.forEach((cond, i) => {
+      if (!isRecord(cond)) return;
+      const goto = issues.stringOf(cond, "goto", `${nextPath}.conditions[${i}]`);
+      if (goto !== null && goto !== "") out.push(goto);
+    });
+  }
+  return out;
+}
+function stepLeavesCycle(steps, stepID, inCycle, issues) {
+  const step = steps[stepID];
+  if (!isRecord(step) || !isRecord(step.next)) return true;
+  const next = step.next;
+  if (next.parallel !== void 0 && next.parallel !== null) return true;
+  const def = issues.stringOf(next, "default", `steps.${stepID}.next`);
+  if (def === null || def === "") return true;
+  for (const target of cycleEdges(step, stepID, issues)) {
+    if (isMarker(target) || !inCycle.has(target)) return true;
+  }
+  return false;
+}
+function cycleWithoutExit(steps, start, issues) {
+  let index = 0;
+  const indices = /* @__PURE__ */ new Map();
+  const low = /* @__PURE__ */ new Map();
+  const onStack = /* @__PURE__ */ new Set();
+  const stack = [];
+  let found = false;
+  const strong = (id) => {
+    indices.set(id, index);
+    low.set(id, index);
+    index++;
+    stack.push(id);
+    onStack.add(id);
+    for (const target of cycleEdges(steps[id], id, issues)) {
+      if (isMarker(target) || !Object.prototype.hasOwnProperty.call(steps, target)) continue;
+      if (!indices.has(target)) {
+        strong(target);
+        low.set(id, Math.min(low.get(id), low.get(target)));
+      } else if (onStack.has(target)) {
+        low.set(id, Math.min(low.get(id), indices.get(target)));
+      }
+    }
+    if (low.get(id) !== indices.get(id)) return;
+    const component = [];
+    for (; ; ) {
+      const top = stack.pop();
+      onStack.delete(top);
+      component.push(top);
+      if (top === id) break;
+    }
+    const inCycle = new Set(component);
+    const cyclic = component.length > 1 || cycleEdges(steps[id], id, issues).includes(id);
+    if (!cyclic) return;
+    if (component.some((member) => stepLeavesCycle(steps, member, inCycle, issues))) return;
+    found = true;
+  };
+  if (Object.prototype.hasOwnProperty.call(steps, start)) strong(start);
+  return found;
+}
 
 // src/validators/nextLogic.ts
 var NEXT_NULL = "null";