akm-cli 0.9.0-beta.9 → 0.9.0-rc.1

package/dist/core/config/config-types.js

@@ -9,8 +9,8 @@ import { VALID_HARNESS_IDS } from "../../integrations/harnesses/index.js";
 /**
  * Canonical list of valid agent harness / platform ids. Re-exported from the
  * unified harness registry (#562) so the Zod `AgentPlatformSchema` enum, the
- * `AgentProfileConfigV2` platform union, `parseAgentProfilesMapV2`'s membership
- * check, and setup's `DetectedHarness` union all derive from one place and
- * cannot drift. Add a harness in `src/integrations/harnesses/index.ts`.
+ * `AgentProfileConfig` platform union, and setup's `DetectedHarness` union all
+ * derive from one place and cannot drift. Add a harness in
+ * `src/integrations/harnesses/index.ts`.
  */
 export { VALID_HARNESS_IDS };

package/dist/core/config/config.js

@@ -13,20 +13,9 @@ import { warn } from "../warn.js";
 // Canonical harness-id source of truth (#565) — runtime value re-export.
 export { VALID_HARNESS_IDS } from "./config-types.js";
 // ── Feedback failure-mode constants (F-3 / #384) ────────────────────────────
-/**
- * Curated taxonomy of failure modes for negative feedback.
- *
- * Structured failure modes enable aggregation across feedback events so the
- * distill pipeline can detect that "5 assets failed for the same reason" and
- * act on it — free-text strings about the same issue are not aggregatable.
- */
-export const FEEDBACK_FAILURE_MODES = [
-    "incorrect", // Factually wrong or logically flawed content
-    "outdated", // Correct at some point but now stale
-    "dangerous", // Could cause harm if followed (security, safety)
-    "incomplete", // Missing key steps, context, or caveats
-    "redundant", // Duplicates another asset without adding value
-];
+// Canonical taxonomy lives in the schema/validator layer; re-exported here so
+// existing `../core/config/config` import sites keep working.
+export { FEEDBACK_FAILURE_MODES } from "./config-schema.js";
 /**
  * Default value for {@link IndexPassConfig.graphExtractionBatchSize}. Chosen
  * empirically: 4 amortises the per-call HTTP overhead 4× while keeping the
@@ -205,6 +194,25 @@ export function getDefaultLlmConfig(config) {
         return undefined;
     return config.profiles?.llm?.[defaultName];
 }
+/**
+ * Resolve the per-process config section for an improve process,
+ * centralizing the deeply-nested lookup
+ * `profile?.processes?.<name>` that was previously copy-pasted across the
+ * improve command family (20+ call sites).
+ *
+ * When an `activeProfile` is supplied (the profile resolved for the current
+ * `akm improve --profile <name>` run), its per-process override wins; otherwise
+ * — and as a fallback when the active profile does not define the section — the
+ * lookup falls back to the `"default"` improve profile from the on-disk config.
+ * Callers that have not yet threaded the active profile pass only `config` and
+ * get the historical default-profile behavior unchanged.
+ */
+export function getImproveProcessConfig(config, processName, activeProfile) {
+    const fromActiveProfile = activeProfile?.processes?.[processName];
+    if (fromActiveProfile !== undefined)
+        return fromActiveProfile;
+    return config.profiles?.improve?.default?.processes?.[processName];
+}
 /**
  * Run `migrateConfigShape` on the raw text and — unless `AKM_NO_AUTO_MIGRATE=1`
  * is set — persist the migrated result. Returns the (possibly migrated) text
@@ -221,7 +229,18 @@ function maybeAutoMigrateConfigFile(configPath, text) {
     catch {
         return text; // Malformed JSON — let parseAndValidate surface the error.
     }
-    if (compareConfigVersion(obj.configVersion, CURRENT_CONFIG_VERSION) === 1) {
+    // Downgrade protection. Skip migration when the on-disk config is NEWER than
+    // this binary (=== 1), OR when it carries a configVersion we cannot order
+    // against ours (compareConfigVersion returns undefined for an unparseable
+    // value — e.g. one written by a newer/foreign akm). Migrating such a config
+    // could strip fields a newer binary added, a cross-version data-loss path.
+    //
+    // A MISSING configVersion (absent → undefined) is a legacy pre-versioning
+    // config that MUST still migrate, so the unparseable-skip is gated on the
+    // field being PRESENT (`onDiskVersion !== undefined`).
+    const onDiskVersion = obj.configVersion;
+    const versionOrder = compareConfigVersion(onDiskVersion, CURRENT_CONFIG_VERSION);
+    if (versionOrder === 1 || (onDiskVersion !== undefined && versionOrder === undefined)) {
         return text;
     }
     const { changed, result } = migrateConfigShape(obj);
@@ -249,8 +268,8 @@ function maybeAutoMigrateConfigFile(configPath, text) {
             "  to preview a dry-run diff:            akm config migrate --dry-run --print-diff",
             "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━",
         ].join("\n");
-        process.stderr.write(`${banner}\n`);
-        process.stdout.write(`${banner}\n`);
+        process.stderr?.write?.(`${banner}\n`);
+        process.stdout?.write?.(`${banner}\n`);
     }
     catch (err) {
         // #461: never return migrated bytes when disk write fails — that triggers
@@ -267,15 +286,32 @@ export function loadConfig() {
     warnIfProjectConfigPresent(process.cwd());
     return loadUserConfig();
 }
+let saveConfigOverride;
+/** TEST-ONLY. Swap the implementation of `saveConfig`; pass undefined to restore. */
+export function _setSaveConfigForTests(fake) {
+    saveConfigOverride = fake;
+}
 export function saveConfig(config) {
+    if (saveConfigOverride) {
+        saveConfigOverride(config);
+        return;
+    }
+    saveConfigReal(config);
+}
+function saveConfigReal(config) {
     cachedConfig = undefined;
     const configPath = getConfigPath();
     const dir = path.dirname(configPath);
     fs.mkdirSync(dir, { recursive: true });
     const sanitized = sanitizeConfigForWrite(config);
-    // Final validation gate before bytes hit disk. Catches schema violations
-    // (unknown keys in registries[] / sources[] / profiles.*; out-of-range
-    // numbers; etc. — closes #462) before we corrupt the user's config.
+    // Final validation gate before bytes hit disk. Runs the FULL schema —
+    // including the cross-field superRefine guards (removed `feedbackDistillation`
+    // process key, `defaultWriteTarget` resolution, writable npm/website sources)
+    // and all type/enum/range checks — so an `akm config set` (leaf OR object
+    // form) cannot persist a guard-violating or mistyped value. NOTE: unknown
+    // keys are intentionally NOT rejected here — object schemas are `.passthrough()`
+    // so cross-version skew round-trips (see config-schema.ts header); the lenient
+    // tolerance is by design, not an oversight.
     const parseResult = AkmConfigSchema.safeParse(sanitized);
     if (!parseResult.success) {
         const lines = parseResult.error.issues.map((i) => `  - ${i.path.join(".") || "(root)"}: ${i.message}`).join("\n");
@@ -398,7 +434,11 @@ export function resolveSecret(value) {
  * filtering out the reserved feature-section keys so callers don't mistake
  * `metadataEnhance` / `stalenessDetection` for a pass.
  */
-/** Reserved well-known keys on IndexConfig that are NOT per-pass entries. */
+/**
+ * Reserved well-known keys on IndexConfig that are NOT per-pass entries.
+ * `stalenessDetection` is retired (10-Q3) but stays reserved so a leftover
+ * config section is never misread as a pass entry.
+ */
 const INDEX_RESERVED_KEYS = new Set(["metadataEnhance", "stalenessDetection"]);
 export function getIndexPassConfig(config, passName) {
     if (!config)
@@ -450,7 +490,12 @@ function applyRuntimeEnvApiKeys(config) {
     }
     // LLM profile keys: AKM_LLM_API_KEY for the default profile, then
     // AKM_PROFILE_<UPPER>_API_KEY for any profile (per-profile wins).
-    const defaultProfile = next.defaults?.llm;
+    // Resolve the default profile the SAME way the rest of the config layer does
+    // (resolveDefaultLlmProfileName), so the implicit `profiles.llm.default`
+    // fallback is honored. Keying off the raw `defaults.llm` field alone silently
+    // dropped AKM_LLM_API_KEY for configs that rely on the implicit default —
+    // the same no-op-run class as the 2026-05-23 incident.
+    const defaultProfile = resolveDefaultLlmProfileName(next);
     if (next.profiles?.llm) {
         const updated = { ...next.profiles.llm };
         let changed = false;

package/dist/core/deep-merge.js

@@ -0,0 +1,38 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * Generic recursive object merge, extracted from the setup wizard (it is not
+ * setup-specific). Plain objects merge key-by-key; arrays and scalars replace
+ * wholesale. Used to apply a partial `--file` config over the existing config
+ * without dropping sibling subkeys.
+ */
+/** True for non-null, non-array plain objects. */
+export function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+ * Recursively merge `incoming` into `base`: plain objects merge key-by-key,
+ * while arrays and scalars replace wholesale. A partial input therefore only
+ * updates the keys it carries and never drops sibling subkeys (e.g. a file
+ * containing `{ output: { format: "text" } }` leaves `output.detail` intact).
+ *
+ * `base` is treated as immutable — a fresh object graph is returned.
+ */
+export function deepMergeConfig(base, incoming) {
+    if (!isPlainObject(incoming))
+        return incoming;
+    const baseObj = isPlainObject(base) ? base : {};
+    const out = { ...baseObj };
+    for (const [key, value] of Object.entries(incoming)) {
+        if (value === undefined)
+            continue;
+        if (isPlainObject(value) && isPlainObject(baseObj[key])) {
+            out[key] = deepMergeConfig(baseObj[key], value);
+        }
+        else {
+            out[key] = value;
+        }
+    }
+    return out;
+}

package/dist/core/errors.js

@@ -14,6 +14,7 @@ const CONFIG_HINTS = {
     TEST_ISOLATION_MISSING: "Under bun test, when AKM_STASH_DIR is set you MUST also set XDG_DATA_HOME (or AKM_DATA_DIR) and XDG_STATE_HOME (or AKM_STATE_DIR) to temp directories so the test does not touch the developer's real ~/.local/share/akm or ~/.local/state/akm.",
     SETUP_TMP_STASH_REFUSED: "Use a persistent directory, or set AKM_FORCE_SETUP_TMP_STASH=1 to opt in to a sandboxed setup (setup also pre-sets AKM_STASH_DIR so config and cache writes auto-isolate into $stashDir/.akm/ — host config is preserved).",
     UNSAFE_STASH_DIR: "Choose a path inside your home directory (e.g. ~/akm) or another empty workspace. The stash directory cannot be the filesystem root, your home directory itself, or a sensitive system path like /etc, /var, ~/.config, or ~/.ssh.",
+    UNKNOWN_IMPROVE_PROFILE: "Pass one of the listed profile names to `--profile`, or define it under `profiles.improve` in your config. Names are case-sensitive.",
 };
 /** Default hint for each UsageError code. */
 const USAGE_HINTS = {

package/dist/core/eval/rank-metrics.js

@@ -0,0 +1,113 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+export const DEFAULT_CURATE_WEIGHTS = {
+    ndcg: 0.5,
+    recall: 0.2,
+    mrr: 0.1,
+    noBannedAboveRequired: 0.2,
+};
+/** nDCG@k with binary relevance: gain 1 for relevant refs, 0 otherwise. */
+export function ndcgAtK(returned, relevant, k) {
+    const top = returned.slice(0, k);
+    let dcg = 0;
+    for (let i = 0; i < top.length; i++) {
+        if (relevant.has(top[i]))
+            dcg += 1 / Math.log2(i + 2);
+    }
+    const idealCount = Math.min(k, relevant.size);
+    let idcg = 0;
+    for (let i = 0; i < idealCount; i++)
+        idcg += 1 / Math.log2(i + 2);
+    return idcg === 0 ? 1 : dcg / idcg;
+}
+export function recallAtK(returned, relevant, k) {
+    if (relevant.size === 0)
+        return 1;
+    const top = new Set(returned.slice(0, k));
+    let hit = 0;
+    for (const r of relevant)
+        if (top.has(r))
+            hit += 1;
+    return hit / relevant.size;
+}
+export function mrr(returned, relevant) {
+    for (let i = 0; i < returned.length; i++) {
+        if (relevant.has(returned[i]))
+            return 1 / (i + 1);
+    }
+    return 0;
+}
+/**
+ * Leapfrog gate. A banned ref "leapfrogs" when it appears ABOVE at least one
+ * present relevant ref. Returns the fraction of present banned refs that do
+ * NOT leapfrog (1.0 when no banned ref is present, or none leapfrog), plus the
+ * raw violation count.
+ */
+export function noBannedAboveRequired(returned, relevant, banned) {
+    const rankOf = new Map();
+    returned.forEach((ref, i) => {
+        if (!rankOf.has(ref))
+            rankOf.set(ref, i);
+    });
+    const relevantRanks = returned.map((ref, i) => (relevant.has(ref) ? i : -1)).filter((i) => i >= 0);
+    if (relevantRanks.length === 0) {
+        // No relevant ref present to be leapfrogged — gate is vacuously satisfied.
+        return { score: 1, leapfrogCount: 0 };
+    }
+    const worstRelevantRank = Math.max(...relevantRanks);
+    const bannedPresent = returned.filter((ref) => banned.has(ref));
+    if (bannedPresent.length === 0)
+        return { score: 1, leapfrogCount: 0 };
+    let leapfrog = 0;
+    for (const b of bannedPresent) {
+        const rb = rankOf.get(b);
+        if (rb !== undefined && rb < worstRelevantRank)
+            leapfrog += 1;
+    }
+    return { score: 1 - leapfrog / bannedPresent.length, leapfrogCount: leapfrog };
+}
+/** Score a single curate result (ordered refs) against its judgment. */
+export function scoreCurateCase(returned, judgment, weights = DEFAULT_CURATE_WEIGHTS) {
+    const k = judgment.limit;
+    const relevant = new Set(judgment.relevant);
+    const banned = new Set(judgment.banned);
+    const ndcg = ndcgAtK(returned, relevant, k);
+    const recall = recallAtK(returned, relevant, k);
+    const rr = mrr(returned, relevant);
+    const gate = noBannedAboveRequired(returned, relevant, banned);
+    const score = ndcg * weights.ndcg + recall * weights.recall + rr * weights.mrr + gate.score * weights.noBannedAboveRequired;
+    return {
+        ndcg,
+        recall,
+        mrr: rr,
+        noBannedAboveRequired: gate.score,
+        bannedLeapfrogCount: gate.leapfrogCount,
+        score,
+    };
+}
+/** Aggregate per-case metrics into a suite summary. */
+export function summarizeCurateMetrics(metrics) {
+    const n = metrics.length;
+    if (n === 0) {
+        return {
+            caseCount: 0,
+            meanScore: 0,
+            meanNdcg: 0,
+            meanRecall: 0,
+            meanMrr: 0,
+            meanNoBannedAboveRequired: 1,
+            totalBannedLeapfrog: 0,
+        };
+    }
+    const sum = (sel) => metrics.reduce((a, m) => a + sel(m), 0);
+    return {
+        caseCount: n,
+        meanScore: sum((m) => m.score) / n,
+        meanNdcg: sum((m) => m.ndcg) / n,
+        meanRecall: sum((m) => m.recall) / n,
+        meanMrr: sum((m) => m.mrr) / n,
+        meanNoBannedAboveRequired: sum((m) => m.noBannedAboveRequired) / n,
+        totalBannedLeapfrog: sum((m) => m.bannedLeapfrogCount),
+    };
+}

package/dist/core/events.js

@@ -25,9 +25,10 @@
  * - `ts` is ISO-8601 (UTC, millisecond precision).
  */
 import path from "node:path";
+import { insertEvent, readStateEvents } from "../storage/repositories/events-repository.js";
 import { rethrowIfTestIsolationError } from "./errors.js";
 import { getDataDir } from "./paths.js";
-import { insertEvent, openStateDatabase, readStateEvents } from "./state-db.js";
+import { openStateDatabase, withStateDb } from "./state-db.js";
 import { error } from "./warn.js";
 /**
  * Legacy events.jsonl path — used only by the migration script
@@ -82,18 +83,14 @@ export function appendEvent(input, ctx) {
     // Default path: open, insert, close.
     const dbPath = resolveDbPath(ctx);
     try {
-        const db = openStateDatabase(dbPath);
-        try {
+        withStateDb((db) => {
             insertEvent(db, {
                 eventType: input.eventType,
                 ts,
                 ref: input.ref,
                 metadata: input.metadata,
             });
-        }
-        finally {
-            db.close();
-        }
+        }, { path: dbPath });
     }
     catch (err) {
         // Never mask the bun-test isolation guard as a silent "events failed".

package/dist/core/improve-types.js

@@ -11,16 +11,18 @@ import { assertNever } from "./assert.js";
  *
  * Buckets:
  * - `accepted` — a write/content-authoring action succeeded.
- * - `rejected` — the action was deliberately not applied (cooldown, skip,
- *   distill-skip, or a content-policy guard rejection). NOTE: as of the
- *   round-2 health pass `reflect-guard-rejected` is bucketed here. Previously
- *   the `state-db.ts` switch omitted it entirely (no case, no default), so a
- *   guard rejection silently vanished from accepted/rejected/error totals — a
- *   data-integrity miscount. It is a deliberate non-application of the action,
- *   so it belongs with the other "rejected" outcomes.
+ * - `skipped` — the ref was GATED OUT before any content was produced: a
+ *   cooldown, a signal-delta/eligibility skip, or a distill pool-delta skip.
+ *   These are NOT rejections of produced content — they are the run declining
+ *   to act on a ref it had no new reason to touch, and they scale with the
+ *   whole indexed-ref pool (~13k/run), so folding them into `rejected` made the
+ *   "accept rate" meaningless (deep-tuning analysis 2026-06-29, finding #1).
+ * - `rejected` — the run PRODUCED a change and a content-policy guard then
+ *   rejected it (`reflect-guard-rejected`). This is the genuine value-rejection
+ *   signal; it is small and meaningful, no longer drowned by gated skips.
  * - `error` — the action failed (LLM/runtime error).
  * - `noop` — bookkeeping that is neither a write nor a rejection (memory-prune);
- *   intentionally counted in none of the three numeric buckets.
+ *   intentionally counted in none of the numeric buckets.
  *
  * The `default: assertNever(mode)` arm makes any future union variant a
  * compile-time error here, forcing an explicit bucket choice.
@@ -35,6 +37,7 @@ export function classifyImproveAction(mode) {
         case "reflect-cooldown":
         case "reflect-skipped":
         case "distill-skipped":
+            return "skipped";
         case "reflect-guard-rejected":
             return "rejected";
         case "reflect-failed":
@@ -46,3 +49,39 @@ export function classifyImproveAction(mode) {
             return assertNever(mode);
     }
 }
+/** Upper bound on retained sample refs PER reason in {@link DistillSkippedAggregate}. */
+export const DISTILL_SKIPPED_SAMPLE_CAP_PER_REASON = 3;
+/**
+ * Partition an action list into the rows to persist and the `distill-skipped`
+ * aggregate. Pure — no I/O. Called once at improve-result assembly time so the
+ * serialized envelope never carries per-ref distill-skipped rows.
+ *
+ * Non-`distill-skipped` actions are returned verbatim and in order. When there
+ * are zero distill-skipped actions the aggregate is omitted (the envelope stays
+ * byte-identical to a run that skipped nothing).
+ */
+export function foldDistillSkipped(actions) {
+    const kept = [];
+    const byReason = {};
+    const samples = [];
+    const sampleCountByReason = {};
+    let total = 0;
+    for (const action of actions) {
+        if (action.mode !== "distill-skipped") {
+            kept.push(action);
+            continue;
+        }
+        total += 1;
+        const r = action.result;
+        const reason = typeof r?.reason === "string" && r.reason.trim() ? r.reason : "unknown";
+        byReason[reason] = (byReason[reason] ?? 0) + 1;
+        const seen = sampleCountByReason[reason] ?? 0;
+        if (seen < DISTILL_SKIPPED_SAMPLE_CAP_PER_REASON) {
+            sampleCountByReason[reason] = seen + 1;
+            samples.push({ ref: action.ref, reason });
+        }
+    }
+    if (total === 0)
+        return { actions: kept };
+    return { actions: kept, aggregate: { total, byReason, samples } };
+}

package/dist/core/json-schema.js

@@ -0,0 +1,142 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * Structural JSON-Schema-subset validator (orchestration plan P1).
+ *
+ * The workflow engine's structured-output normalization needs to validate
+ * unit results against the author-declared unit `output` schema on any harness —
+ * including ones with no native schema support. Pulling in a full
+ * draft-2020-12 validator is deliberately avoided (dependency surface); this
+ * module implements the bounded subset that covers the schemas workflow
+ * authors actually write:
+ *
+ *   Supported: `type` (string | string[] — string, number, integer, boolean,
+ *   object, array, null), `properties`, `required`, `items`,
+ *   `additionalProperties: false`, `enum` (primitives), `minItems`,
+ *   `maxItems`, `minLength`, `maxLength`, `minimum`, `maximum`.
+ *
+ *   Ignored (permissive): `$ref`, `allOf`/`anyOf`/`oneOf`/`not`, `pattern`,
+ *   `format`, and every other keyword. Unknown keywords never throw — a
+ *   schema using them simply constrains less. Callers needing full JSON
+ *   Schema semantics should validate downstream.
+ *
+ * Returns a flat list of human-readable error strings (empty = valid), each
+ * prefixed with a JSON-pointer-ish path — the shape `runStructured`'s
+ * corrective-feedback builder wants.
+ */
+export function validateJsonSchemaSubset(value, schema) {
+    const errors = [];
+    validateNode(value, schema, "$", errors);
+    return errors;
+}
+function typeOf(value) {
+    if (value === null)
+        return "null";
+    if (Array.isArray(value))
+        return "array";
+    switch (typeof value) {
+        case "string":
+            return "string";
+        case "boolean":
+            return "boolean";
+        case "number":
+            return Number.isInteger(value) ? "integer" : "number";
+        default:
+            return "object";
+    }
+}
+function matchesType(actual, expected) {
+    if (expected === actual)
+        return true;
+    // JSON Schema: every integer is also a number.
+    return expected === "number" && actual === "integer";
+}
+function validateNode(value, schema, path, errors) {
+    const actual = typeOf(value);
+    const declared = schema.type;
+    if (typeof declared === "string" || Array.isArray(declared)) {
+        const expected = (Array.isArray(declared) ? declared : [declared]).filter((t) => typeof t === "string");
+        if (expected.length > 0 && !expected.some((t) => matchesType(actual, t))) {
+            errors.push(`${path}: expected type ${expected.join(" | ")}, got ${actual}`);
+            return; // type mismatch makes the remaining constraints meaningless
+        }
+    }
+    if (Array.isArray(schema.enum) && schema.enum.length > 0) {
+        const allowed = schema.enum;
+        if (!allowed.some((candidate) => candidate === value)) {
+            errors.push(`${path}: value ${JSON.stringify(value)} is not one of ${JSON.stringify(allowed)}`);
+            return;
+        }
+    }
+    if (actual === "string" && typeof value === "string") {
+        if (typeof schema.minLength === "number" && value.length < schema.minLength) {
+            errors.push(`${path}: string shorter than minLength ${schema.minLength}`);
+        }
+        if (typeof schema.maxLength === "number" && value.length > schema.maxLength) {
+            errors.push(`${path}: string longer than maxLength ${schema.maxLength}`);
+        }
+        return;
+    }
+    if ((actual === "number" || actual === "integer") && typeof value === "number") {
+        if (typeof schema.minimum === "number" && value < schema.minimum) {
+            errors.push(`${path}: ${value} is below minimum ${schema.minimum}`);
+        }
+        if (typeof schema.maximum === "number" && value > schema.maximum) {
+            errors.push(`${path}: ${value} is above maximum ${schema.maximum}`);
+        }
+        return;
+    }
+    if (actual === "array" && Array.isArray(value)) {
+        if (typeof schema.minItems === "number" && value.length < schema.minItems) {
+            errors.push(`${path}: array has fewer than minItems ${schema.minItems}`);
+        }
+        if (typeof schema.maxItems === "number" && value.length > schema.maxItems) {
+            errors.push(`${path}: array has more than maxItems ${schema.maxItems}`);
+        }
+        const items = schema.items;
+        if (items && typeof items === "object" && !Array.isArray(items)) {
+            value.forEach((element, index) => {
+                validateNode(element, items, `${path}[${index}]`, errors);
+            });
+        }
+        return;
+    }
+    if (actual === "object" && typeof value === "object" && value !== null) {
+        const record = value;
+        const properties = schema.properties && typeof schema.properties === "object" && !Array.isArray(schema.properties)
+            ? schema.properties
+            : undefined;
+        if (Array.isArray(schema.required)) {
+            for (const key of schema.required) {
+                // `Object.hasOwn`, not `key in record`: a required key satisfied only by
+                // an inherited prototype member (e.g. "toString", "constructor") is NOT
+                // present on the value itself, so `{}` must fail `required: ["toString"]`.
+                if (typeof key === "string" && !Object.hasOwn(record, key)) {
+                    errors.push(`${path}: missing required property "${key}"`);
+                }
+            }
+        }
+        if (properties) {
+            for (const [key, propSchema] of Object.entries(properties)) {
+                if (!Object.hasOwn(record, key))
+                    continue;
+                if (propSchema && typeof propSchema === "object" && !Array.isArray(propSchema)) {
+                    validateNode(record[key], propSchema, `${path}.${key}`, errors);
+                }
+            }
+        }
+        // `additionalProperties: false` closes the object to exactly its declared
+        // `properties`. This MUST run even when no `properties` object is present:
+        // `{ type: "object", additionalProperties: false }` admits only `{}`. Use
+        // `Object.hasOwn` so an inherited key name (e.g. "toString") on the empty
+        // property set is not mistaken for a declared property.
+        if (schema.additionalProperties === false) {
+            for (const key of Object.keys(record)) {
+                if (!properties || !Object.hasOwn(properties, key)) {
+                    errors.push(`${path}: unexpected property "${key}" (additionalProperties: false)`);
+                }
+            }
+        }
+    }
+}