botmux 3.10.0 → 3.23.1

package/dist/workflows/v3/library-schema.js

@@ -1,667 +0,0 @@
-/**
- * Saved Workflow library schema.
- *
- * A saved workflow is deliberately separate from a v3 run:
- *   - metadata.json is the small mutable index (name/scope/pointers/status)
- *   - revisions/<revisionId>.json is immutable and content addressed
- *
- * This module has no dependency on the legacy workflow definition/runtime.
- * It only reuses the v3 DAG/spec validators, then removes the run-specific
- * `runId` from the persisted template shape.
- */
-import { createHash, randomUUID } from 'node:crypto';
-import { canonicalJsonStringify } from '../../utils/canonical-json.js';
-import { DagValidationError, isGoalNode, isLoopNode, validateDag } from './dag.js';
-import { SpecValidationError, validateSpec } from './spec.js';
-import { assertSavedWorkflowTemplateBindings } from './template-bindings.js';
-// Compatibility export for callers that historically imported the encoder
-// from the Saved Workflow schema module.
-export { canonicalJsonStringify } from '../../utils/canonical-json.js';
-export const SAVED_WORKFLOW_METADATA_SCHEMA_VERSION = 1;
-export const SAVED_WORKFLOW_REVISION_SCHEMA_VERSION = 1;
-export const SAVED_WORKFLOW_ID_RE = /^wf_[0-9a-f]{32}$/;
-export const SAVED_WORKFLOW_REVISION_ID_RE = /^rev_[0-9a-f]{64}$/;
-export const SAVED_WORKFLOW_CONTENT_HASH_RE = /^sha256:[0-9a-f]{64}$/;
-export const SAVED_WORKFLOW_PARAM_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]{0,63}$/;
-const FORBIDDEN_SAVED_WORKFLOW_PARAM_NAMES = new Set([
-    '__proto__', 'prototype', 'constructor',
-]);
-const MAX_DISPLAY_NAME_LENGTH = 128;
-const MAX_ALIAS_LENGTH = 128;
-const MAX_PARAMS = 128;
-export class SavedWorkflowSchemaError extends Error {
-    problems;
-    constructor(problems) {
-        super(`Invalid saved workflow:\n  - ${problems.join('\n  - ')}`);
-        this.problems = problems;
-        this.name = 'SavedWorkflowSchemaError';
-    }
-}
-function isRecord(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-function nonEmptyString(value, where, problems) {
-    if (typeof value !== 'string' || value.trim() === '') {
-        problems.push(`${where} must be a non-empty string`);
-        return '';
-    }
-    return value.trim();
-}
-function validIso(value, where, problems) {
-    const s = nonEmptyString(value, where, problems);
-    if (s && !Number.isFinite(Date.parse(s)))
-        problems.push(`${where} must be an ISO timestamp`);
-    return s;
-}
-function normalizeOwner(value, where, problems) {
-    if (!isRecord(value)) {
-        problems.push(`${where} must be an object`);
-        return { openId: '', larkAppId: '' };
-    }
-    return {
-        openId: nonEmptyString(value.openId, `${where}.openId`, problems),
-        larkAppId: nonEmptyString(value.larkAppId, `${where}.larkAppId`, problems),
-    };
-}
-function normalizeScope(value, problems) {
-    if (!isRecord(value)) {
-        problems.push('scope must be an object');
-        return { kind: 'global' };
-    }
-    if (value.kind === 'global')
-        return { kind: 'global' };
-    if (value.kind === 'chat') {
-        return { chatId: nonEmptyString(value.chatId, 'scope.chatId', problems), kind: 'chat' };
-    }
-    problems.push('scope.kind must be chat or global');
-    return { kind: 'global' };
-}
-function normalizeName(value, where, max, problems) {
-    const out = nonEmptyString(value, where, problems).normalize('NFC');
-    if (out.length > max)
-        problems.push(`${where} must be at most ${max} characters`);
-    return out;
-}
-export function validateSavedWorkflowMetadata(raw) {
-    const problems = [];
-    if (!isRecord(raw))
-        throw new SavedWorkflowSchemaError(['metadata root must be an object']);
-    if (raw.schemaVersion !== SAVED_WORKFLOW_METADATA_SCHEMA_VERSION) {
-        problems.push(`metadata.schemaVersion must be ${SAVED_WORKFLOW_METADATA_SCHEMA_VERSION}`);
-    }
-    const workflowId = typeof raw.workflowId === 'string' ? raw.workflowId : '';
-    if (!SAVED_WORKFLOW_ID_RE.test(workflowId))
-        problems.push('workflowId must match wf_<32 lowercase hex>');
-    const displayName = normalizeName(raw.displayName, 'displayName', MAX_DISPLAY_NAME_LENGTH, problems);
-    const aliases = [];
-    if (!Array.isArray(raw.aliases)) {
-        problems.push('aliases must be an array');
-    }
-    else {
-        const seen = new Set();
-        for (let i = 0; i < raw.aliases.length; i++) {
-            const alias = normalizeName(raw.aliases[i], `aliases[${i}]`, MAX_ALIAS_LENGTH, problems);
-            const key = normalizeSavedWorkflowLookupKey(alias);
-            if (key && seen.has(key))
-                problems.push(`aliases contains duplicate ${JSON.stringify(alias)}`);
-            if (key)
-                seen.add(key);
-            aliases.push(alias);
-        }
-    }
-    const owner = normalizeOwner(raw.owner, 'owner', problems);
-    const scope = normalizeScope(raw.scope, problems);
-    const statuses = ['draft', 'active', 'archived'];
-    const status = statuses.includes(raw.status)
-        ? raw.status
-        : 'draft';
-    if (!statuses.includes(raw.status)) {
-        problems.push('status must be draft, active, or archived');
-    }
-    const latestRevision = typeof raw.latestRevision === 'string' ? raw.latestRevision : '';
-    if (!SAVED_WORKFLOW_REVISION_ID_RE.test(latestRevision)) {
-        problems.push('latestRevision must match rev_<64 lowercase hex>');
-    }
-    let publishedRevision;
-    if (raw.publishedRevision !== undefined) {
-        if (typeof raw.publishedRevision !== 'string' || !SAVED_WORKFLOW_REVISION_ID_RE.test(raw.publishedRevision)) {
-            problems.push('publishedRevision must match rev_<64 lowercase hex>');
-        }
-        else {
-            publishedRevision = raw.publishedRevision;
-        }
-    }
-    if (status === 'active' && !publishedRevision) {
-        problems.push('active workflow must have publishedRevision');
-    }
-    if (status === 'draft' && publishedRevision) {
-        problems.push('draft workflow cannot have publishedRevision');
-    }
-    const createdAt = validIso(raw.createdAt, 'createdAt', problems);
-    const updatedAt = validIso(raw.updatedAt, 'updatedAt', problems);
-    if (createdAt && updatedAt && Date.parse(updatedAt) < Date.parse(createdAt)) {
-        problems.push('updatedAt cannot be earlier than createdAt');
-    }
-    if (problems.length > 0)
-        throw new SavedWorkflowSchemaError(problems);
-    return {
-        schemaVersion: SAVED_WORKFLOW_METADATA_SCHEMA_VERSION,
-        workflowId,
-        displayName,
-        aliases,
-        owner,
-        scope,
-        status,
-        latestRevision,
-        ...(publishedRevision ? { publishedRevision } : {}),
-        createdAt,
-        updatedAt,
-    };
-}
-export function mintSavedWorkflowId(uuid = randomUUID()) {
-    const hex = uuid.replace(/-/g, '').toLowerCase();
-    if (!/^[0-9a-f]{32}$/.test(hex))
-        throw new Error('workflow UUID must contain exactly 32 hexadecimal characters');
-    return `wf_${hex}`;
-}
-/** Lookup normalization affects discovery only; the original Unicode value is preserved. */
-export function normalizeSavedWorkflowLookupKey(value) {
-    return value.trim().normalize('NFKC').toLocaleLowerCase('en-US');
-}
-function isJsonValue(value, seen = new Set()) {
-    if (value === null || typeof value === 'string' || typeof value === 'boolean')
-        return true;
-    if (typeof value === 'number')
-        return Number.isFinite(value);
-    if (typeof value !== 'object')
-        return false;
-    if (seen.has(value))
-        return false;
-    seen.add(value);
-    if (Array.isArray(value))
-        return value.every((item) => isJsonValue(item, seen));
-    const proto = Object.getPrototypeOf(value);
-    if (proto !== Object.prototype && proto !== null)
-        return false;
-    return Object.values(value).every((item) => isJsonValue(item, seen));
-}
-function defaultMatchesType(type, value) {
-    switch (type) {
-        case 'string': return typeof value === 'string';
-        case 'number': return typeof value === 'number' && Number.isFinite(value);
-        case 'boolean': return typeof value === 'boolean';
-        case 'array': return Array.isArray(value) && isJsonValue(value);
-        case 'object': return isRecord(value) && isJsonValue(value);
-    }
-}
-function normalizeInputs(value, problems) {
-    if (!isRecord(value)) {
-        problems.push('inputs must be an object');
-        return {};
-    }
-    const entries = Object.entries(value);
-    if (entries.length > MAX_PARAMS)
-        problems.push(`inputs may contain at most ${MAX_PARAMS} parameters`);
-    const out = {};
-    for (const [name, rawDef] of entries) {
-        if (!isValidSavedWorkflowParamName(name)) {
-            problems.push(`input name ${JSON.stringify(name)} must match ${SAVED_WORKFLOW_PARAM_NAME_RE} ` +
-                'and must not be __proto__/prototype/constructor');
-        }
-        if (!isRecord(rawDef)) {
-            problems.push(`inputs.${name} must be an object`);
-            continue;
-        }
-        const allowed = new Set(['type', 'required', 'default', 'description', 'sensitive']);
-        for (const key of Object.keys(rawDef)) {
-            if (!allowed.has(key))
-                problems.push(`inputs.${name}.${key} is not supported`);
-        }
-        const types = ['string', 'number', 'boolean', 'object', 'array'];
-        const type = types.includes(rawDef.type)
-            ? rawDef.type
-            : 'string';
-        if (!types.includes(rawDef.type)) {
-            problems.push(`inputs.${name}.type must be string, number, boolean, object, or array`);
-        }
-        if (rawDef.required !== undefined && typeof rawDef.required !== 'boolean') {
-            problems.push(`inputs.${name}.required must be boolean`);
-        }
-        if (rawDef.sensitive !== undefined && typeof rawDef.sensitive !== 'boolean') {
-            problems.push(`inputs.${name}.sensitive must be boolean`);
-        }
-        if (rawDef.description !== undefined && typeof rawDef.description !== 'string') {
-            problems.push(`inputs.${name}.description must be string`);
-        }
-        const hasDefault = Object.prototype.hasOwnProperty.call(rawDef, 'default');
-        if (hasDefault && !defaultMatchesType(type, rawDef.default)) {
-            problems.push(`inputs.${name}.default must match declared type ${type} and be finite JSON`);
-        }
-        if (rawDef.sensitive === true && hasDefault) {
-            problems.push(`inputs.${name} is sensitive and cannot have a default`);
-        }
-        out[name] = {
-            type,
-            ...(rawDef.required === true ? { required: true } : {}),
-            ...(hasDefault ? { default: rawDef.default } : {}),
-            ...(typeof rawDef.description === 'string' ? { description: rawDef.description } : {}),
-            ...(rawDef.sensitive === true ? { sensitive: true } : {}),
-        };
-    }
-    return out;
-}
-/** Shared by host-owned compilers before they construct an input definition. */
-export function isValidSavedWorkflowParamName(name) {
-    return SAVED_WORKFLOW_PARAM_NAME_RE.test(name) &&
-        !FORBIDDEN_SAVED_WORKFLOW_PARAM_NAMES.has(name);
-}
-const BUILTIN_CONTEXT_REFS = [
-    'chatId', 'larkAppId', 'chatType', 'rootMessageId', 'initiatorOpenId',
-];
-function normalizeContextRefs(value, problems) {
-    if (!Array.isArray(value)) {
-        problems.push('contextRefs must be an array');
-        return [];
-    }
-    const out = [];
-    const seen = new Set();
-    for (let i = 0; i < value.length; i++) {
-        const item = value[i];
-        if (typeof item !== 'string' || !BUILTIN_CONTEXT_REFS.includes(item)) {
-            problems.push(`contextRefs[${i}] is not a supported built-in context ref`);
-            continue;
-        }
-        if (seen.has(item))
-            problems.push(`contextRefs contains duplicate ${item}`);
-        seen.add(item);
-        out.push(item);
-    }
-    return out;
-}
-export function validateDagTemplate(raw) {
-    if (!isRecord(raw))
-        throw new SavedWorkflowSchemaError(['dagTemplate must be an object']);
-    if (Object.prototype.hasOwnProperty.call(raw, 'runId')) {
-        throw new SavedWorkflowSchemaError(['dagTemplate must not contain runId']);
-    }
-    let nodes;
-    try {
-        nodes = validateDag({ runId: 'saved-template', nodes: raw.nodes }).nodes;
-    }
-    catch (err) {
-        if (err instanceof DagValidationError)
-            throw new SavedWorkflowSchemaError(err.problems.map((p) => `dagTemplate: ${p}`));
-        throw err;
-    }
-    const botProblems = [];
-    validateDirectBotSelectors(nodes, undefined, 'dagTemplate.nodes', botProblems);
-    if (botProblems.length > 0)
-        throw new SavedWorkflowSchemaError(botProblems);
-    // NOTE: the chat-facing side-effect policy lint is deliberately NOT run here.
-    // validateDagTemplate is the structural deserializer shared by the READ path
-    // (loadSavedWorkflowRevision → validateSavedWorkflowRevisionPayload), so
-    // gating it would retroactively brick already-saved revisions that were legal
-    // before the lint existed. The policy check runs only at authoring boundaries
-    // (buildSavedWorkflowRevisionBaseline / validateSavedWorkflowRevisionDraft /
-    // v2 migration) via assertNoSavedWorkflowChatSideEffects.
-    return { nodes };
-}
-function validateDirectBotSelectors(nodes, inheritedBot, where, problems) {
-    for (const node of nodes) {
-        const effectiveBot = typeof node.bot === 'string' && node.bot.trim() ? node.bot.trim() : inheritedBot;
-        if (node.type === 'goal' && !effectiveBot) {
-            problems.push(`${where}.${node.id} must declare a direct bot selector`);
-        }
-        if (node.type === 'loop' && node.body) {
-            validateDirectBotSelectors(node.body.nodes, effectiveBot, `${where}.${node.id}.body`, problems);
-        }
-    }
-}
-export function validateSpecTemplate(raw) {
-    if (!isRecord(raw))
-        throw new SavedWorkflowSchemaError(['specTemplate must be an object']);
-    if (Object.prototype.hasOwnProperty.call(raw, 'runId')) {
-        throw new SavedWorkflowSchemaError(['specTemplate must not contain runId']);
-    }
-    try {
-        const spec = validateSpec({ ...raw, runId: 'saved-template' });
-        const { runId: _runId, ...template } = spec;
-        return template;
-    }
-    catch (err) {
-        if (err instanceof SpecValidationError)
-            throw new SavedWorkflowSchemaError(err.problems.map((p) => `specTemplate: ${p}`));
-        throw err;
-    }
-}
-function gateProjection(nodes, prefix = '') {
-    const out = [];
-    for (const node of nodes) {
-        const id = prefix ? `${prefix}.${node.id}` : node.id;
-        if (node.humanGate)
-            out.push({ id, humanGate: node.humanGate });
-        if (node.type === 'loop' && node.body)
-            out.push(...gateProjection(node.body.nodes, id));
-    }
-    return out;
-}
-const CHAT_SIDE_EFFECT_PATTERNS = [
-    { kind: 'botmux-send', re: /\bbotmux\s+(?:send|reply)\b/i },
-    { kind: 'bytedcli-feishu', re: /\bbytedcli\s+feishu\b.*\b(?:send|reply|message|im|chat)\b/i },
-    { kind: 'lark-cli-im', re: /\blark-cli\b.*\b(?:send|reply|message|im|chat)\b/i },
-    { kind: 'feishu-openapi-message', re: /\/open-apis\/im\/v1\/(?:messages|chats)\b/i },
-    { kind: 'feishu-openapi-message', re: /\b(?:feishu|lark)\b.*\bopenapi\b.*\b(?:send|reply|message)\b/i },
-    { kind: 'feishu-openapi-message', re: /\bim\.v1\.message\.(?:create|reply|patch)\b/i },
-];
-function collectStrings(value, path, out) {
-    if (typeof value === 'string') {
-        out.push({ path, value });
-        return;
-    }
-    if (Array.isArray(value)) {
-        value.forEach((item, index) => collectStrings(item, `${path}[${index}]`, out));
-        return;
-    }
-    if (value && typeof value === 'object') {
-        for (const [key, child] of Object.entries(value)) {
-            collectStrings(child, `${path}.${key}`, out);
-        }
-    }
-}
-function pushChatSideEffectProblems(node, nodeId, where, problems) {
-    const strings = [];
-    collectStrings({
-        goal: node.goal,
-        humanGate: node.humanGate,
-        override: node.override,
-    }, where, strings);
-    for (const item of strings) {
-        for (const pattern of CHAT_SIDE_EFFECT_PATTERNS) {
-            if (!pattern.re.test(item.value))
-                continue;
-            problems.push({
-                nodeId,
-                path: item.path,
-                kind: pattern.kind,
-                guidance: `Move chat notification out of goal node "${nodeId}": split it into ` +
-                    'businessTask (write result.json/final_message.md) plus a hostExecutor ' +
-                    'feishu-send/feishu-reply node that reads the upstream result.',
-            });
-            break;
-        }
-    }
-}
-export function collectSavedWorkflowChatSideEffectProblems(dagTemplate) {
-    const problems = [];
-    const visit = (nodes, prefix) => {
-        for (const node of nodes) {
-            const nodeId = prefix ? `${prefix}.${node.id}` : node.id;
-            if (isGoalNode(node)) {
-                pushChatSideEffectProblems(node, nodeId, prefix ? `dagTemplate.nodes.${prefix}.${node.id}` : `dagTemplate.nodes.${node.id}`, problems);
-            }
-            else if (isLoopNode(node)) {
-                visit(node.body.nodes, nodeId);
-            }
-        }
-    };
-    visit(dagTemplate.nodes, '');
-    return problems;
-}
-export function formatSavedWorkflowChatSideEffectProblems(problems) {
-    return problems.map((problem) => `${problem.path} contains chat-facing side effect (${problem.kind}); ${problem.guidance}`);
-}
-/**
- * Authoring-boundary policy gate. Throw when a to-be-saved DAG template has a
- * chat-facing side effect in a goal node. This is intentionally NOT part of the
- * structural deserializer (validateDagTemplate) or the read path
- * (validateSavedWorkflowRevisionPayload): those are traversed when LOADING an
- * already-saved revision, and gating them would retroactively brick revisions
- * that were legal before the lint existed. Callers on the write/compile/publish
- * side (buildSavedWorkflowRevisionBaseline, validateSavedWorkflowRevisionDraft,
- * v2→v3 migration) invoke this so a fresh authored definition must be
- * lint-clean, while old revisions stay loadable/show-able/appendable (and can
- * be fixed by appending a clean revision).
- */
-export function assertNoSavedWorkflowChatSideEffects(dagTemplate) {
-    const chatEffects = formatSavedWorkflowChatSideEffectProblems(collectSavedWorkflowChatSideEffectProblems(dagTemplate));
-    if (chatEffects.length > 0)
-        throw new SavedWorkflowSchemaError(chatEffects);
-}
-function sha256(value) {
-    return createHash('sha256').update(value).digest('hex');
-}
-export function computeSavedWorkflowGateDigest(dagTemplate) {
-    return `sha256:${sha256(canonicalJsonStringify(gateProjection(dagTemplate.nodes)))}`;
-}
-export function computeSavedWorkflowSideEffects(dagTemplate) {
-    return dagTemplate.nodes
-        .filter((node) => node.type === 'host')
-        .map((node) => ({ nodeId: node.id, kind: node.executor }))
-        .sort((left, right) => left.nodeId.localeCompare(right.nodeId) || left.kind.localeCompare(right.kind));
-}
-function normalizeSafety(value, dagTemplate, problems) {
-    if (!isRecord(value)) {
-        problems.push('safety must be an object');
-        return { gateDigest: computeSavedWorkflowGateDigest(dagTemplate), sideEffects: [] };
-    }
-    const gateDigest = typeof value.gateDigest === 'string' ? value.gateDigest : '';
-    if (!SAVED_WORKFLOW_CONTENT_HASH_RE.test(gateDigest)) {
-        problems.push('safety.gateDigest must match sha256:<64 lowercase hex>');
-    }
-    const expectedGateDigest = computeSavedWorkflowGateDigest(dagTemplate);
-    if (gateDigest && gateDigest !== expectedGateDigest) {
-        problems.push(`safety.gateDigest does not match dagTemplate gates (expected ${expectedGateDigest})`);
-    }
-    const sideEffects = [];
-    if (!Array.isArray(value.sideEffects)) {
-        problems.push('safety.sideEffects must be an array');
-    }
-    else {
-        for (let i = 0; i < value.sideEffects.length; i++) {
-            const item = value.sideEffects[i];
-            if (!isRecord(item)) {
-                problems.push(`safety.sideEffects[${i}] must be an object`);
-                continue;
-            }
-            sideEffects.push({
-                nodeId: nonEmptyString(item.nodeId, `safety.sideEffects[${i}].nodeId`, problems),
-                kind: nonEmptyString(item.kind, `safety.sideEffects[${i}].kind`, problems),
-            });
-        }
-    }
-    const expectedSideEffects = computeSavedWorkflowSideEffects(dagTemplate);
-    const normalizedSideEffects = [...sideEffects]
-        .sort((left, right) => left.nodeId.localeCompare(right.nodeId) || left.kind.localeCompare(right.kind));
-    if (canonicalJsonStringify(normalizedSideEffects) !== canonicalJsonStringify(expectedSideEffects)) {
-        problems.push(`safety.sideEffects does not match host nodes (expected ${canonicalJsonStringify(expectedSideEffects)})`);
-    }
-    return { gateDigest, sideEffects: normalizedSideEffects };
-}
-export function validateSavedWorkflowRevisionPayload(raw) {
-    const problems = [];
-    if (!isRecord(raw))
-        throw new SavedWorkflowSchemaError(['revision payload must be an object']);
-    const workflowId = typeof raw.workflowId === 'string' ? raw.workflowId : '';
-    if (!SAVED_WORKFLOW_ID_RE.test(workflowId))
-        problems.push('payload.workflowId must match wf_<32 lowercase hex>');
-    const humanVersion = raw.humanVersion;
-    if (!Number.isInteger(humanVersion) || humanVersion < 1) {
-        problems.push('payload.humanVersion must be a positive integer');
-    }
-    const createdAt = validIso(raw.createdAt, 'payload.createdAt', problems);
-    const createdBy = normalizeOwner(raw.createdBy, 'payload.createdBy', problems);
-    let sourceRunId;
-    if (raw.sourceRunId !== undefined) {
-        sourceRunId = nonEmptyString(raw.sourceRunId, 'payload.sourceRunId', problems);
-    }
-    const inputs = normalizeInputs(raw.inputs, problems);
-    const contextRefs = normalizeContextRefs(raw.contextRefs, problems);
-    let specTemplate;
-    try {
-        specTemplate = validateSpecTemplate(raw.specTemplate);
-    }
-    catch (err) {
-        if (err instanceof SavedWorkflowSchemaError)
-            problems.push(...err.problems);
-        else
-            throw err;
-    }
-    const specStatus = raw.specStatus === 'current' || raw.specStatus === 'stale'
-        ? raw.specStatus
-        : 'current';
-    if (raw.specStatus !== 'current' && raw.specStatus !== 'stale') {
-        problems.push('specStatus must be current or stale');
-    }
-    let dagTemplate;
-    try {
-        dagTemplate = validateDagTemplate(raw.dagTemplate);
-    }
-    catch (err) {
-        if (err instanceof SavedWorkflowSchemaError)
-            problems.push(...err.problems);
-        else
-            throw err;
-    }
-    const safeDag = dagTemplate ?? { nodes: [] };
-    if (dagTemplate) {
-        try {
-            assertSavedWorkflowTemplateBindings(dagTemplate, inputs, contextRefs);
-        }
-        catch (err) {
-            problems.push(`dagTemplate bindings: ${err instanceof Error ? err.message : String(err)}`);
-        }
-    }
-    const safety = normalizeSafety(raw.safety, safeDag, problems);
-    if (problems.length > 0 || !specTemplate || !dagTemplate)
-        throw new SavedWorkflowSchemaError(problems);
-    return {
-        workflowId,
-        humanVersion: humanVersion,
-        createdAt,
-        createdBy,
-        ...(sourceRunId ? { sourceRunId } : {}),
-        inputs,
-        contextRefs,
-        specTemplate,
-        specStatus,
-        dagTemplate,
-        safety,
-    };
-}
-/**
- * Strict host-owned validation for a revision before the store allocates its
- * identity/version fields. Unknown identity fields are rejected rather than
- * allowed to override the store's authority later.
- */
-export function validateSavedWorkflowRevisionDraft(raw) {
-    if (!isRecord(raw))
-        throw new SavedWorkflowSchemaError(['revision draft must be an object']);
-    const allowed = new Set([
-        'sourceRunId', 'inputs', 'contextRefs', 'specTemplate', 'specStatus',
-        'dagTemplate', 'safety',
-    ]);
-    const extra = Object.keys(raw).filter((key) => !allowed.has(key));
-    if (extra.length > 0) {
-        throw new SavedWorkflowSchemaError([
-            `revision draft has unsupported key(s): ${extra.sort().join(', ')}`,
-        ]);
-    }
-    const normalized = validateSavedWorkflowRevisionPayload({
-        workflowId: 'wf_00000000000000000000000000000000',
-        humanVersion: 1,
-        createdAt: '1970-01-01T00:00:00.000Z',
-        createdBy: { openId: 'validation-owner', larkAppId: 'validation-app' },
-        ...raw,
-    });
-    // Authoring boundary: a new revision draft (e.g. distillation submit) must be
-    // free of chat-facing side effects. Kept here rather than in
-    // validateSavedWorkflowRevisionPayload so the READ path (loadSavedWorkflowRevision)
-    // never applies the policy to already-saved revisions.
-    assertNoSavedWorkflowChatSideEffects(normalized.dagTemplate);
-    const { workflowId: _workflowId, humanVersion: _humanVersion, createdAt: _createdAt, createdBy: _createdBy, ...draft } = normalized;
-    return draft;
-}
-export function computeSavedWorkflowRevisionContentHash(schemaVersion, payload) {
-    return `sha256:${sha256(canonicalJsonStringify({ schemaVersion, payload }))}`;
-}
-export function buildSavedWorkflowRevision(payload) {
-    const normalized = validateSavedWorkflowRevisionPayload(payload);
-    const contentHash = computeSavedWorkflowRevisionContentHash(SAVED_WORKFLOW_REVISION_SCHEMA_VERSION, normalized);
-    return {
-        schemaVersion: SAVED_WORKFLOW_REVISION_SCHEMA_VERSION,
-        revisionId: `rev_${contentHash.slice('sha256:'.length)}`,
-        contentHash,
-        payload: normalized,
-    };
-}
-/**
- * Read migrations are pure and one-way. Immutable files are never rewritten;
- * future schema bumps add `N: payload => payloadV(N+1)` entries here.
- */
-const REVISION_MIGRATIONS = Object.freeze({});
-export function migrateSavedWorkflowRevisionPayload(schemaVersion, payload) {
-    if (!Number.isInteger(schemaVersion) || schemaVersion < 1) {
-        throw new SavedWorkflowSchemaError(['revision.schemaVersion must be a positive integer']);
-    }
-    if (schemaVersion > SAVED_WORKFLOW_REVISION_SCHEMA_VERSION) {
-        throw new SavedWorkflowSchemaError([
-            `revision schema ${schemaVersion} is newer than supported ${SAVED_WORKFLOW_REVISION_SCHEMA_VERSION}`,
-        ]);
-    }
-    let version = schemaVersion;
-    let next = payload;
-    while (version < SAVED_WORKFLOW_REVISION_SCHEMA_VERSION) {
-        const migrate = REVISION_MIGRATIONS[version];
-        if (!migrate)
-            throw new SavedWorkflowSchemaError([`no saved-workflow read migration from schema ${version}`]);
-        next = migrate(next);
-        version++;
-    }
-    return { schemaVersion: version, payload: next, migrated: version !== schemaVersion };
-}
-export function loadSavedWorkflowRevision(raw, expected = {}) {
-    const problems = [];
-    if (!isRecord(raw))
-        throw new SavedWorkflowSchemaError(['revision root must be an object']);
-    const storedSchemaVersion = raw.schemaVersion;
-    if (!Number.isInteger(storedSchemaVersion) || storedSchemaVersion < 1) {
-        problems.push('revision.schemaVersion must be a positive integer');
-    }
-    const revisionId = typeof raw.revisionId === 'string' ? raw.revisionId : '';
-    const contentHash = typeof raw.contentHash === 'string' ? raw.contentHash : '';
-    if (!SAVED_WORKFLOW_REVISION_ID_RE.test(revisionId))
-        problems.push('revisionId must match rev_<64 lowercase hex>');
-    if (!SAVED_WORKFLOW_CONTENT_HASH_RE.test(contentHash))
-        problems.push('contentHash must match sha256:<64 lowercase hex>');
-    if (expected.revisionId && revisionId !== expected.revisionId) {
-        problems.push(`revisionId ${revisionId} does not match expected ${expected.revisionId}`);
-    }
-    if (Number.isInteger(storedSchemaVersion) && storedSchemaVersion >= 1) {
-        const computed = computeSavedWorkflowRevisionContentHash(storedSchemaVersion, raw.payload);
-        if (contentHash && computed !== contentHash)
-            problems.push('revision contentHash does not match payload');
-        if (revisionId && revisionId !== `rev_${computed.slice('sha256:'.length)}`) {
-            problems.push('revisionId does not match contentHash');
-        }
-    }
-    if (problems.length > 0)
-        throw new SavedWorkflowSchemaError(problems);
-    // Verify the immutable stored bytes before transforming them. The original
-    // revisionId remains the identity after a read migration.
-    const migrated = migrateSavedWorkflowRevisionPayload(storedSchemaVersion, raw.payload);
-    const payload = validateSavedWorkflowRevisionPayload(migrated.payload);
-    if (expected.workflowId && payload.workflowId !== expected.workflowId) {
-        throw new SavedWorkflowSchemaError([
-            `payload.workflowId ${payload.workflowId} does not match expected ${expected.workflowId}`,
-        ]);
-    }
-    return {
-        revisionId,
-        contentHash,
-        storedSchemaVersion: storedSchemaVersion,
-        schemaVersion: SAVED_WORKFLOW_REVISION_SCHEMA_VERSION,
-        payload,
-        migrated: migrated.migrated,
-    };
-}
-//# sourceMappingURL=library-schema.js.map