mova_agent 0.1.1

package/README.md

@@ -0,0 +1,94 @@
+# MOVA Agent (TypeScript)
+
+### Localization
+Russian originals are kept in `docs/ru/`. This README and all docs are the English versions for the global community.
+
+## Overview
+Deterministic interpreter runtime for MOVA envelopes with strict typing, atomic evidence/episode writing, plugin driver registry, and CI/CD with Docker.
+
+## Plugin Driver Registry
+- Location: `src/drivers/index.ts`.
+- API: `registerDriver(name, factory)`, `getDriver(name)`, `listDrivers()`.
+- DriverContext supports `allowlist`, `limits`, `bindings`.
+- Built-in drivers: `noop`, `http` (fetch with allowlist + timeout), `restricted_shell` (execFile with allowlist).
+
+Example:
+```ts
+import { registerDriver } from './src/drivers';
+
+registerDriver('my_driver', () => ({
+  async execute(input) {
+    return { ok: true, input };
+  },
+}));
+```
+
+## Linting & Formatting
+```bash
+npm run lint          # ESLint check
+npm run format        # Prettier auto-format
+npm run format:check  # Prettier check only
+npm run check:structure  # Ensure .ts files stay in allowed folders
+npm run check:docs       # Validate docs have headings (excluding docs/ru)
+```
+
+## Docker Build Verification
+- Dockerfile: multi-stage on `node:18-alpine`, builds TS + generated types.
+- Docker Compose: `docker-compose.yml` exposes port 3000.
+- CI job `docker-build` builds `mova-agent:ci` and runs CLI help:
+  `docker run --rm mova-agent:ci node build/tools/mova-agent.js --help`
+- Local check:
+  ```bash
+  docker compose up --build
+  curl http://localhost:3000/health
+  ```
+
+## SDK CLI
+- Published package: `@leryk1981/mova-sdk-cli` (npm). Repo: `sdk-cli/` in this project.
+- Install globally: `npm i -g @leryk1981/mova-sdk-cli`
+- Quick use:
+  ```bash
+  mova init my-project                  # scaffold configs/episodes/plans
+  mova plan -s env.mova_agent_plan_v1.json plans/plan.sample.json
+  mova run plans/plan.sample.json       # local; add --endpoint <url> for MCP gateway
+  mova driver:add http                  # generate/register driver skeleton
+  mova policy:set --role admin --verb noop --allow
+  mova episode:list --verb noop
+  ```
+- More details: `sdk-cli/README.md`, `sdk-cli/USAGE.md`.
+
+## Scripts
+- `npm run build` — compile to `build/`.
+- `npm run gen:types` — generate `.d.ts` from JSON Schemas.
+- `npm run lint` / `npm run format:check` — style checks.
+- `npm test` — build + gen:types + unit tests (atomic writer, drivers).
+- `npm run build:sdk-cli` — build the MOVA SDK CLI locally.
+- `npm run test:integration` — smoke test CLI → Agent → Episodes flow.
+- `npm run release:version` — bump patch version (uses `npm version patch`).
+- `npm publish` — publish package (CI does this automatically on tags).
+
+## Compatibility
+- Matrix: see `COMPATIBILITY_MATRIX.md` for tested Agent / SDK CLI / schema-set versions.
+- Check locally: `npm run verify:compat` (runs in CI).
+- On releases: bump versions (Agent `package.json`, `sdk-cli/package.json`, `@leryk1981/mova-spec` dependency) and update the top row of the matrix.
+
+## Documentation
+- Architecture: `docs/MOVA_AGENT_ARCHITECTURE.md`
+- Roadmap: `docs/MOVA_AGENT_ROADMAP.md`
+- Production spec: `docs/prod_tz.md`
+- Token budgeting: `docs/TOKEN_BUDGETING.md`
+- Linting rules: `docs/linting.md`
+
+## CI/CD
+GitHub Actions: lint → format check → tests → docker-build. Node 18, npm ci.
+- Release workflow (`.github/workflows/release.yml`): runs on tags `v*.*.*`, verifies `package.json` version matches the tag, builds, and publishes to npm using `NPM_TOKEN` secret. Release notes are generated automatically.
+
+## Release
+- Local manual publish:
+  ```bash
+  npm install
+  npm run release:version   # or npm version <patch|minor|major>
+  git push --follow-tags
+  npm publish --access public
+  ```
+- CI publish: push a tag `vX.Y.Z` to trigger `release.yml` (requires `NPM_TOKEN` secret set in repo settings). Docker image publishing can be added later via Docker Hub credentials.

package/build/scripts/check_docs.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=check_docs.d.ts.map

package/build/scripts/check_docs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check_docs.d.ts","sourceRoot":"","sources":["../../scripts/check_docs.ts"],"names":[],"mappings":""}

package/build/scripts/check_docs.js

@@ -0,0 +1,48 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const DOCS_DIR = path_1.default.resolve(__dirname, '..', 'docs');
+const RU_DIR = path_1.default.join(DOCS_DIR, 'ru');
+function isMarkdown(file) {
+    return file.toLowerCase().endsWith('.md');
+}
+function verifyDoc(filePath, violations) {
+    const content = fs_1.default.readFileSync(filePath, 'utf8');
+    const firstLine = content.split('\n').find((line) => line.trim().length > 0) || '';
+    if (!firstLine.trim().startsWith('#')) {
+        violations.push(`${path_1.default.relative(process.cwd(), filePath)}: missing top-level heading (# ...)`);
+    }
+}
+function walkDocs(dir, violations) {
+    const entries = fs_1.default.readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+        const fullPath = path_1.default.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            if (fullPath.startsWith(RU_DIR))
+                continue; // skip Russian originals
+            walkDocs(fullPath, violations);
+            continue;
+        }
+        if (entry.isFile() && isMarkdown(entry.name)) {
+            verifyDoc(fullPath, violations);
+        }
+    }
+}
+function main() {
+    const violations = [];
+    walkDocs(DOCS_DIR, violations);
+    if (violations.length > 0) {
+        console.error('Documentation check failed:');
+        for (const v of violations) {
+            console.error(`- ${v}`);
+        }
+        process.exit(1);
+    }
+    console.log('All docs verified.');
+}
+main();
+//# sourceMappingURL=check_docs.js.map

package/build/scripts/check_docs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check_docs.js","sourceRoot":"","sources":["../../scripts/check_docs.ts"],"names":[],"mappings":";;;;;AAAA,4CAAoB;AACpB,gDAAwB;AAExB,MAAM,QAAQ,GAAG,cAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AACvD,MAAM,MAAM,GAAG,cAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AAEzC,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB,EAAE,UAAoB;IACvD,MAAM,OAAO,GAAG,YAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACnF,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,UAAU,CAAC,IAAI,CAAC,GAAG,cAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,qCAAqC,CAAC,CAAC;IAClG,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW,EAAE,UAAoB;IACjD,MAAM,OAAO,GAAG,YAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,cAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,SAAS,CAAC,yBAAyB;YACpE,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,IAAI;IACX,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAE/B,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC7C,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;AACpC,CAAC;AAED,IAAI,EAAE,CAAC"}

package/build/scripts/check_schema_paths.d.ts

@@ -0,0 +1,3 @@
+declare const AjvLoaderSrc: any;
+declare const getLogger: any;
+//# sourceMappingURL=check_schema_paths.d.ts.map

package/build/scripts/check_schema_paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check_schema_paths.d.ts","sourceRoot":"","sources":["../../scripts/check_schema_paths.ts"],"names":[],"mappings":"AACA,QAAA,MAAM,YAAY,KAAmC,CAAC;AACtD,QAAA,MAAQ,SAAS,KAAqC,CAAC"}

package/build/scripts/check_schema_paths.js

@@ -0,0 +1,15 @@
+"use strict";
+// @ts-nocheck
+const AjvLoaderSrc = require('../src/ajv/ajv_loader');
+const { getLogger } = require('../src/logging/logger');
+(async () => {
+    const logger = getLogger();
+    const loader = new AjvLoaderSrc.AjvSchemaLoader();
+    const schemaId = 'ds.security_event_episode_core_v1';
+    logger.info(`Checking paths for ${schemaId}`);
+    await loader
+        .loadSchema(schemaId)
+        .then((sch) => logger.info(`Loaded schema keys: ${Object.keys(sch).join(', ')}`))
+        .catch((e) => logger.error(`loadSchema error: ${e.message}`));
+})();
+//# sourceMappingURL=check_schema_paths.js.map

package/build/scripts/check_schema_paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check_schema_paths.js","sourceRoot":"","sources":["../../scripts/check_schema_paths.ts"],"names":[],"mappings":";AAAA,cAAc;AACd,MAAM,YAAY,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;AACtD,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;AAEvD,CAAC,KAAK,IAAI,EAAE;IACV,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,eAAe,EAAE,CAAC;IAClD,MAAM,QAAQ,GAAG,mCAAmC,CAAC;IACrD,MAAM,CAAC,IAAI,CAAC,sBAAsB,QAAQ,EAAE,CAAC,CAAC;IAC9C,MAAM,MAAM;SACT,UAAU,CAAC,QAAQ,CAAC;SACpB,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;SAChF,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAClE,CAAC,CAAC,EAAE,CAAC"}

package/build/scripts/check_schema_paths_dist.d.ts

@@ -0,0 +1,3 @@
+declare const loader: any;
+declare const getLogger: any;
+//# sourceMappingURL=check_schema_paths_dist.d.ts.map

package/build/scripts/check_schema_paths_dist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check_schema_paths_dist.d.ts","sourceRoot":"","sources":["../../scripts/check_schema_paths_dist.ts"],"names":[],"mappings":"AACA,QAAA,MAAM,MAAM,KAAyC,CAAC;AACtD,QAAA,MAAQ,SAAS,KAAqC,CAAC"}

package/build/scripts/check_schema_paths_dist.js

@@ -0,0 +1,16 @@
+"use strict";
+// @ts-nocheck
+const loader = require('../build/src/ajv/ajv_loader');
+const { getLogger } = require('../src/logging/logger');
+(async () => {
+    const logger = getLogger();
+    const schemaId = 'ds.security_event_episode_core_v1';
+    try {
+        const schema = await loader.ajvLoader.loadSchema(schemaId);
+        logger.info(`Loaded schema id: ${schema.$id || '[no $id]'} keys: ${Object.keys(schema).join(', ')}`);
+    }
+    catch (err) {
+        logger.error(`dist loader loadSchema error: ${err.message}`);
+    }
+})();
+//# sourceMappingURL=check_schema_paths_dist.js.map

package/build/scripts/check_schema_paths_dist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check_schema_paths_dist.js","sourceRoot":"","sources":["../../scripts/check_schema_paths_dist.ts"],"names":[],"mappings":";AAAA,cAAc;AACd,MAAM,MAAM,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;AACtD,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;AAEvD,CAAC,KAAK,IAAI,EAAE;IACV,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,mCAAmC,CAAC;IACrD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC3D,MAAM,CAAC,IAAI,CACT,qBAAqB,MAAM,CAAC,GAAG,IAAI,UAAU,UAAU,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,iCAAiC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC,CAAC,EAAE,CAAC"}

package/build/scripts/check_structure.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=check_structure.d.ts.map

package/build/scripts/check_structure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check_structure.d.ts","sourceRoot":"","sources":["../../scripts/check_structure.ts"],"names":[],"mappings":""}

package/build/scripts/check_structure.js

@@ -0,0 +1,59 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const allowedRoots = new Set([
+    'src',
+    'scripts',
+    'test',
+    'tests',
+    'docs',
+    'configs',
+    'tools',
+    'sdk-cli',
+    'vendor',
+    '.github',
+]);
+const ignored = new Set([
+    'node_modules',
+    'build',
+    'dist',
+    'artifacts',
+    'temp_dist',
+    'test_dist',
+    '.git',
+]);
+function walk(dir, violations) {
+    const entries = fs_1.default.readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+        if (ignored.has(entry.name))
+            continue;
+        const fullPath = path_1.default.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            walk(fullPath, violations);
+        }
+        else if (entry.isFile() && entry.name.endsWith('.ts')) {
+            const rel = path_1.default.relative(process.cwd(), fullPath);
+            const top = rel.split(path_1.default.sep)[0];
+            if (!allowedRoots.has(top)) {
+                violations.push(rel);
+            }
+        }
+    }
+}
+function main() {
+    const violations = [];
+    walk(process.cwd(), violations);
+    if (violations.length > 0) {
+        console.error('Found TypeScript files outside allowed directories:', violations);
+        process.exit(1);
+    }
+    else {
+        console.log('Structure check passed: no stray TypeScript files.');
+    }
+}
+main();
+//# sourceMappingURL=check_structure.js.map

package/build/scripts/check_structure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check_structure.js","sourceRoot":"","sources":["../../scripts/check_structure.ts"],"names":[],"mappings":";;;;;AAAA,4CAAoB;AACpB,gDAAwB;AAExB,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,KAAK;IACL,SAAS;IACT,MAAM;IACN,OAAO;IACP,MAAM;IACN,SAAS;IACT,OAAO;IACP,SAAS;IACT,QAAQ;IACR,SAAS;CACV,CAAC,CAAC;AACH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;IACtB,cAAc;IACd,OAAO;IACP,MAAM;IACN,WAAW;IACX,WAAW;IACX,WAAW;IACX,MAAM;CACP,CAAC,CAAC;AAEH,SAAS,IAAI,CAAC,GAAW,EAAE,UAAoB;IAC7C,MAAM,OAAO,GAAG,YAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QACtC,MAAM,QAAQ,GAAG,cAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC7B,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,MAAM,GAAG,GAAG,cAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,cAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,IAAI;IACX,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,CAAC;IAChC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,qDAAqD,EAAE,UAAU,CAAC,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC"}

package/build/scripts/debug_validate.d.ts

@@ -0,0 +1,3 @@
+declare const path: any;
+declare const fs: any;
+//# sourceMappingURL=debug_validate.d.ts.map

package/build/scripts/debug_validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"debug_validate.d.ts","sourceRoot":"","sources":["../../scripts/debug_validate.ts"],"names":[],"mappings":"AACA,QAAA,MAAM,IAAI,KAAkB,CAAC;AAC7B,QAAA,MAAM,EAAE,KAAgB,CAAC"}

package/build/scripts/debug_validate.js

@@ -0,0 +1,39 @@
+"use strict";
+// @ts-nocheck
+const path = require('path');
+const fs = require('fs');
+(async function () {
+    try {
+        const epPath = path.join('artifacts', 'mova_agent', 'req_89228ac4-6377-469b-9972-25e3f643382a', 'runs', 'run_dba1cec9-de6a-41d7-98de-5c7cce822dc0', 'episodes', 'sec_1768237057635_v3gpy8yex.json');
+        const ep = JSON.parse(fs.readFileSync(epPath, 'utf8'));
+        console.log('Loaded episode:', ep.episode_id, ep.episode_type);
+        // Inline referenced schema to produce a merged schema for debugging
+        const Ajv = require('ajv');
+        const ajv = new Ajv({ allErrors: true, strict: false });
+        const securitySchemaPath = path.join('vendor', 'MOVA', 'schemas', 'ds.security_event_episode_core_v1.schema.json');
+        const movaEpisodePath = path.join('vendor', 'MOVA', 'schemas', 'ds.mova_episode_core_v1.schema.json');
+        const securitySchema = JSON.parse(fs.readFileSync(securitySchemaPath, 'utf8'));
+        const movaEpisodeSchema = JSON.parse(fs.readFileSync(movaEpisodePath, 'utf8'));
+        // Replace $ref in allOf with actual content for debugging
+        if (securitySchema.allOf && Array.isArray(securitySchema.allOf)) {
+            for (let i = 0; i < securitySchema.allOf.length; i++) {
+                const item = securitySchema.allOf[i];
+                if (item.$ref && item.$ref.includes('ds.mova_episode_core_v1')) {
+                    securitySchema.allOf[i] = movaEpisodeSchema;
+                }
+            }
+        }
+        // Remove $schema to avoid meta-schema resolution issues in this ad-hoc AJV instance
+        delete securitySchema.$schema;
+        delete movaEpisodeSchema.$schema;
+        const validateFunc = ajv.compile(securitySchema);
+        const ok = validateFunc(ep);
+        console.log('compiled ok=', ok);
+        console.log('errors:', JSON.stringify(validateFunc.errors, null, 2));
+    }
+    catch (e) {
+        console.error('Error during debug:', e);
+        process.exit(2);
+    }
+})();
+//# sourceMappingURL=debug_validate.js.map

package/build/scripts/debug_validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"debug_validate.js","sourceRoot":"","sources":["../../scripts/debug_validate.ts"],"names":[],"mappings":";AAAA,cAAc;AACd,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAC7B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC,KAAK;IACJ,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CACtB,WAAW,EACX,YAAY,EACZ,0CAA0C,EAC1C,MAAM,EACN,0CAA0C,EAC1C,UAAU,EACV,kCAAkC,CACnC,CAAC;QACF,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC;QAE/D,oEAAoE;QACpE,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAClC,QAAQ,EACR,MAAM,EACN,SAAS,EACT,+CAA+C,CAChD,CAAC;QACF,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAC/B,QAAQ,EACR,MAAM,EACN,SAAS,EACT,qCAAqC,CACtC,CAAC;QACF,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/E,MAAM,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/E,0DAA0D;QAC1D,IAAI,cAAc,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACrD,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACrC,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CAAC;oBAC/D,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC;gBAC9C,CAAC;YACH,CAAC;QACH,CAAC;QACD,oFAAoF;QACpF,OAAO,cAAc,CAAC,OAAO,CAAC;QAC9B,OAAO,iBAAiB,CAAC,OAAO,CAAC;QACjC,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACjD,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,EAAE,CAAC"}

package/build/scripts/debug_validate2.d.ts

@@ -0,0 +1,3 @@
+declare const path: any;
+declare const fs: any;
+//# sourceMappingURL=debug_validate2.d.ts.map

package/build/scripts/debug_validate2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"debug_validate2.d.ts","sourceRoot":"","sources":["../../scripts/debug_validate2.ts"],"names":[],"mappings":"AACA,QAAA,MAAM,IAAI,KAAkB,CAAC;AAC7B,QAAA,MAAM,EAAE,KAAgB,CAAC"}

package/build/scripts/debug_validate2.js

@@ -0,0 +1,18 @@
+"use strict";
+// @ts-nocheck
+const path = require('path');
+const fs = require('fs');
+(async function () {
+    try {
+        const epPath = path.join('artifacts', 'mova_agent', 'req_89228ac4-6377-469b-9972-25e3f643382a', 'runs', 'run_dba1cec9-de6a-41d7-98de-5c7cce822dc0', 'episodes', 'sec_1768237057635_v3gpy8yex.json');
+        const ep = JSON.parse(fs.readFileSync(epPath, 'utf8'));
+        const validate = require('../build/src/ajv/ajv_loader').validate;
+        const res = await validate('ds.security_event_episode_core_v1', ep);
+        console.log('validate result:');
+        console.log(JSON.stringify(res, null, 2));
+    }
+    catch (e) {
+        console.error('Error during debug2:', e);
+    }
+})();
+//# sourceMappingURL=debug_validate2.js.map

package/build/scripts/debug_validate2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"debug_validate2.js","sourceRoot":"","sources":["../../scripts/debug_validate2.ts"],"names":[],"mappings":";AAAA,cAAc;AACd,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAC7B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC,KAAK;IACJ,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CACtB,WAAW,EACX,YAAY,EACZ,0CAA0C,EAC1C,MAAM,EACN,0CAA0C,EAC1C,UAAU,EACV,kCAAkC,CACnC,CAAC;QACF,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC,QAAQ,CAAC;QACjE,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC,CAAC,EAAE,CAAC"}

package/build/scripts/debug_validate_runtime.d.ts

@@ -0,0 +1,3 @@
+declare const fs: any;
+declare const path: any;
+//# sourceMappingURL=debug_validate_runtime.d.ts.map

package/build/scripts/debug_validate_runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"debug_validate_runtime.d.ts","sourceRoot":"","sources":["../../scripts/debug_validate_runtime.ts"],"names":[],"mappings":"AACA,QAAA,MAAM,EAAE,KAAsB,CAAC;AAC/B,QAAA,MAAM,IAAI,KAAkB,CAAC"}

package/build/scripts/debug_validate_runtime.js

@@ -0,0 +1,39 @@
+"use strict";
+// @ts-nocheck
+const fs = require('fs-extra');
+const path = require('path');
+(async () => {
+    try {
+        const indexPath = path.join('artifacts', 'mova_agent', 'req_99be755e-3a41-40f6-9be0-6df3829e3f09', 'runs', 'run_958577be-c4f1-4149-af40-17aa27daa93c', 'episodes', 'index.jsonl');
+        const content = await fs.readFile(indexPath, 'utf8');
+        const lines = content.trim().split('\n').filter(Boolean);
+        const eps = lines.map((l) => JSON.parse(l));
+        const sec = eps.find((e) => e.episode_type && e.episode_type.startsWith('security_event'));
+        console.log('Found security event:', sec.episode_id, sec.episode_type);
+        const ajvLoader = require('../build/src/ajv/ajv_loader');
+        const validate = ajvLoader.validate;
+        const ajvInst = ajvLoader.ajvLoader.getAjv;
+        console.log('AJV registered schema keys:', Object.keys(ajvInst.schemas || {}));
+        const s1 = ajvInst.getSchema('ds.security_event_episode_core_v1');
+        console.log('getSchema short id:', !!s1);
+        // try canonical id from known vendor URL
+        const canonical = 'https://mova.dev/schemas/ds.security_event_episode_core_v1.schema.json';
+        const s2 = ajvInst.getSchema(canonical);
+        console.log('getSchema canonical id:', !!s2);
+        const validation = await validate('ds.security_event_episode_core_v1', sec);
+        console.log('validate result.ok =', validation.ok);
+        console.log('validation.errors raw =', validation.errors);
+        if (s1) {
+            console.log('Validator (short id) errors:', s1.errors);
+        }
+        if (s2) {
+            console.log('Validator (canonical) errors:', s2.errors);
+        }
+        process.exit(0);
+    }
+    catch (e) {
+        console.error('Error in debug script:', e);
+        process.exit(2);
+    }
+})();
+//# sourceMappingURL=debug_validate_runtime.js.map

package/build/scripts/debug_validate_runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"debug_validate_runtime.js","sourceRoot":"","sources":["../../scripts/debug_validate_runtime.ts"],"names":[],"mappings":";AAAA,cAAc;AACd,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC,KAAK,IAAI,EAAE;IACV,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CACzB,WAAW,EACX,YAAY,EACZ,0CAA0C,EAC1C,MAAM,EACN,0CAA0C,EAC1C,UAAU,EACV,aAAa,CACd,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAC3F,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;QAEvE,MAAM,SAAS,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC;QACpC,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC;QAE3C,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;QAC/E,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACzC,yCAAyC;QACzC,MAAM,SAAS,GAAG,wEAAwE,CAAC;QAC3F,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAE7C,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAE1D,IAAI,EAAE,EAAE,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,EAAE,EAAE,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;QAC1D,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,EAAE,CAAC"}

package/build/scripts/dump_ajv_schemas.d.ts

@@ -0,0 +1,2 @@
+declare const loader: any;
+//# sourceMappingURL=dump_ajv_schemas.d.ts.map

package/build/scripts/dump_ajv_schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dump_ajv_schemas.d.ts","sourceRoot":"","sources":["../../scripts/dump_ajv_schemas.ts"],"names":[],"mappings":"AACA,QAAA,MAAM,MAAM,KAAyC,CAAC"}

package/build/scripts/dump_ajv_schemas.js

@@ -0,0 +1,22 @@
+"use strict";
+// @ts-nocheck
+const loader = require('../build/src/ajv/ajv_loader');
+(async () => {
+    try {
+        await loader.ajvLoader.registerSchema('ds.security_event_episode_core_v1');
+        const ajv = loader.ajvLoader.ajv;
+        const keys = Object.keys(ajv.schemas || {});
+        console.log('ajv schemas keys count:', keys.length);
+        console.log(keys.slice(0, 50));
+        const vf = ajv.getSchema('ds.security_event_episode_core_v1') ||
+            ajv.getSchema('https://mova.dev/schemas/ds.security_event_episode_core_v1.schema.json');
+        console.log('validator found:', !!vf);
+        if (vf) {
+            console.log('schema id from validator:', vf.schema && vf.schema.$id);
+        }
+    }
+    catch (e) {
+        console.error('error:', e.message);
+    }
+})();
+//# sourceMappingURL=dump_ajv_schemas.js.map

package/build/scripts/dump_ajv_schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dump_ajv_schemas.js","sourceRoot":"","sources":["../../scripts/dump_ajv_schemas.ts"],"names":[],"mappings":";AAAA,cAAc;AACd,MAAM,MAAM,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;AACtD,CAAC,KAAK,IAAI,EAAE;IACV,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,mCAAmC,CAAC,CAAC;QAC3E,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/B,MAAM,EAAE,GACN,GAAG,CAAC,SAAS,CAAC,mCAAmC,CAAC;YAClD,GAAG,CAAC,SAAS,CAAC,wEAAwE,CAAC,CAAC;QAC1F,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,EAAE,EAAE,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;AACH,CAAC,CAAC,EAAE,CAAC"}

package/build/scripts/dump_resolved_schema.d.ts

@@ -0,0 +1,3 @@
+declare const fs: any;
+declare const path: any;
+//# sourceMappingURL=dump_resolved_schema.d.ts.map

package/build/scripts/dump_resolved_schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dump_resolved_schema.d.ts","sourceRoot":"","sources":["../../scripts/dump_resolved_schema.ts"],"names":[],"mappings":"AACA,QAAA,MAAM,EAAE,KAAsB,CAAC;AAC/B,QAAA,MAAM,IAAI,KAAkB,CAAC"}

package/build/scripts/dump_resolved_schema.js

@@ -0,0 +1,22 @@
+"use strict";
+// @ts-nocheck
+const fs = require('fs-extra');
+const path = require('path');
+(async () => {
+    try {
+        const ajvLoader = require('../build/src/ajv/ajv_loader');
+        const loader = ajvLoader.ajvLoader;
+        const schema = await loader.loadSchema('ds.security_event_episode_core_v1');
+        console.log('Loaded schema $id =', schema.$id);
+        const resolved = await loader.resolveRefs(schema);
+        await fs.ensureDir('tmp');
+        await fs.writeJson(path.join('tmp', 'resolved_security_event.json'), resolved, { spaces: 2 });
+        console.log('Wrote tmp/resolved_security_event.json');
+        process.exit(0);
+    }
+    catch (e) {
+        console.error(e);
+        process.exit(2);
+    }
+})();
+//# sourceMappingURL=dump_resolved_schema.js.map

package/build/scripts/dump_resolved_schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dump_resolved_schema.js","sourceRoot":"","sources":["../../scripts/dump_resolved_schema.ts"],"names":[],"mappings":";AAAA,cAAc;AACd,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC,KAAK,IAAI,EAAE;IACV,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,mCAAmC,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,8BAA8B,CAAC,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9F,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;QACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,EAAE,CAAC"}

package/build/scripts/gen_types.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=gen_types.d.ts.map

package/build/scripts/gen_types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gen_types.d.ts","sourceRoot":"","sources":["../../scripts/gen_types.ts"],"names":[],"mappings":""}