natureco-cli 5.63.0 → 5.64.1

package/src/utils/agent-core.js

@@ -0,0 +1,51 @@
+'use strict';
+
+const { ToolGuardrails } = require('./tool-guardrails');
+const { standardToolResult } = require('./tool-result');
+
+class AgentCore {
+  constructor(options = {}) {
+    this.guardrails = options.guardrails || new ToolGuardrails({ hardStopEnabled: true });
+    this.maxIterations = options.maxIterations || 10;
+    this.iteration = 0;
+  }
+
+  startRequest() {
+    this.iteration = 0;
+    this.guardrails.reset();
+  }
+
+  startIteration() {
+    this.iteration++;
+    this.guardrails.startIteration();
+    return { iteration: this.iteration, maxIterations: this.maxIterations, allowed: this.iteration <= this.maxIterations };
+  }
+
+  parseToolCalls(toolCalls = []) {
+    return toolCalls.map((call, index) => {
+      const name = call.function?.name || call.name;
+      const raw = call.function?.arguments ?? call.input ?? call.args ?? {};
+      let input = raw;
+      let parseError = null;
+      if (typeof raw === 'string') {
+        try { input = JSON.parse(raw || '{}'); }
+        catch (error) { input = {}; parseError = error.message; }
+      }
+      return { id: call.id || `call_${this.iteration}_${index}`, name, input, parseError, original: call };
+    });
+  }
+
+  assess(call) {
+    if (!call?.name) return { blocked: true, reason: 'Araç adı eksik' };
+    if (call.parseError) return { blocked: true, reason: `Araç argümanları JSON değil: ${call.parseError}` };
+    return this.guardrails.check(call.name, call.input || {});
+  }
+
+  record(call, result) {
+    const standard = standardToolResult(result, { tool: call.name, iteration: this.iteration });
+    this.guardrails.record(call.name, call.input || {}, standard.ok);
+    return standard;
+  }
+}
+
+module.exports = { AgentCore };

package/src/utils/agent-workspace.js

@@ -0,0 +1,24 @@
+'use strict';
+
+const { Worktree } = require('./worktree');
+
+class AgentWorkspaceManager {
+  constructor(options = {}) { this.createWorktree = options.createWorktree || (() => new Worktree()); }
+
+  async run(agentId, task, options = {}) {
+    const worktree = this.createWorktree();
+    if (options.gitRepo !== undefined) worktree._mockGitRepo = options.gitRepo;
+    const entered = worktree.enter({ id: `agent-${agentId}` });
+    if (entered.error) throw new Error(entered.error);
+    try {
+      const result = await task({ id: agentId, cwd: entered.worktreeDir, worktree });
+      const exited = worktree.exit({ merge: options.merge === true });
+      return { ok: true, result, workspace: entered.worktreeDir, merged: !!exited.merged };
+    } catch (error) {
+      try { worktree.exit({ merge: false }); } catch {}
+      return { ok: false, error: error.message, workspace: entered.worktreeDir, merged: false };
+    }
+  }
+}
+
+module.exports = { AgentWorkspaceManager };

package/src/utils/api.js

@@ -9,9 +9,8 @@ const { getConfig } = require('./config');
 const { getToolDefinitions, executeToolCalls } = require('./tool-runner');
 const { MCPClient } = require('./mcp-client');
 const TB = require('./token-budget');
-const { accumulateToolCallDeltas } = require('./streaming-tools');
-const { ToolGuardrails } = require('./tool-guardrails');
-const guardrails = new ToolGuardrails();
+const { accumulateToolCallDeltas } = require('./streaming-tools');
+const { AgentCore } = require('./agent-core');
 
 /**
  * v5.5.0: Provider-specific format detection
@@ -671,7 +670,12 @@ async function sendMessageAnthropic(providerConfig, messages, tools) {
 /**
  * Send message with tool support (universal)
  */
-async function sendMessageToProvider(apiKey, message, conversationId = null, systemPrompt = null, options = {}) {
+async function sendMessageToProvider(apiKey, message, conversationId = null, systemPrompt = null, options = {}) {
+  // Per-request state prevents concurrent conversations from contaminating one
+  // another while preserving failure/no-progress counters across tool rounds.
+  const agentCore = new AgentCore({ maxIterations: 10 });
+  agentCore.startRequest();
+  const guardrails = agentCore.guardrails;
   const providerConfig = getProviderConfig();
   
   if (!providerConfig) {
@@ -784,8 +788,7 @@ async function sendMessageToProvider(apiKey, message, conversationId = null, sys
       const localCalls = toolCalls.filter(tc => !mcpTools.find(t => t.name === tc.name));
 
       // Guardrails: filter blocked tools
-      guardrails.reset();
-      guardrails.startIteration();
+      agentCore.startIteration();
       const blockedMcp = mcpCalls.filter(tc => {
         const check = guardrails.check(tc.name, tc.input);
         return check.blocked;
@@ -803,8 +806,9 @@ async function sendMessageToProvider(apiKey, message, conversationId = null, sys
           localCalls.filter(tc => !blockedLocal.includes(tc)),
           { toolDefinitions: getToolDefinitions() }
         );
-        for (const r of localResults) {
-          guardrails.record(r.name, {}, r.result?.success !== false);
+        for (const r of localResults) {
+          const original = localCalls.find(tc => tc.id === r.id);
+          guardrails.record(r.name, original?.input || {}, r.result?.success !== false && !r.result?.error);
         }
       }
 

package/src/utils/channel-sdk.js

@@ -0,0 +1,212 @@
+'use strict';
+
+const crypto = require('crypto');
+const { EventEmitter } = require('events');
+
+function deliveryId(channel, target, payload, explicitKey) {
+  if (explicitKey) return String(explicitKey);
+  return crypto.createHash('sha256').update(`${channel}\0${target}\0${JSON.stringify(payload)}`).digest('hex').slice(0, 24);
+}
+
+class ChannelAdapter extends EventEmitter {
+  constructor(options = {}) {
+    super();
+    if (!options.name) throw new Error('channel adapter name is required');
+    this.name = options.name;
+    this.connectFn = options.connect;
+    this.disconnectFn = options.disconnect;
+    this.sendFn = options.send;
+    this.healthFn = options.health;
+    this.state = 'disconnected';
+    this.lastError = null;
+    this.connectedAt = null;
+  }
+
+  async connect() {
+    if (this.state === 'connected') return { ok: true, reused: true };
+    this.state = 'connecting';
+    try {
+      if (this.connectFn) await this.connectFn();
+      this.state = 'connected'; this.connectedAt = new Date().toISOString(); this.lastError = null;
+      this.emit('state', this.state);
+      return { ok: true };
+    } catch (error) {
+      this.state = 'degraded'; this.lastError = error.message; this.emit('state', this.state);
+      return { ok: false, error: error.message };
+    }
+  }
+
+  async disconnect() {
+    try { if (this.disconnectFn) await this.disconnectFn(); } finally { this.state = 'disconnected'; this.emit('state', this.state); }
+  }
+
+  async send(delivery) {
+    if (typeof this.sendFn !== 'function') throw new Error(`channel ${this.name} cannot send`);
+    if (this.state !== 'connected') {
+      const connected = await this.connect();
+      if (!connected.ok) throw new Error(connected.error);
+    }
+    return this.sendFn(delivery);
+  }
+
+  async health() {
+    try {
+      const detail = this.healthFn ? await this.healthFn() : { ok: this.state === 'connected' };
+      return { channel: this.name, state: this.state, connectedAt: this.connectedAt, lastError: this.lastError, ...detail };
+    } catch (error) { return { channel: this.name, state: 'degraded', ok: false, error: error.message }; }
+  }
+}
+
+class ChannelDeliveryManager extends EventEmitter {
+  constructor(options = {}) {
+    super();
+    this.adapters = new Map();
+    this.queue = [];
+    this.completed = new Map();
+    this.inFlight = new Map();
+    this.maxAttempts = options.maxAttempts || 4;
+    this.baseDelayMs = options.baseDelayMs ?? 250;
+    this.maxCompleted = options.maxCompleted || 10000;
+    this.sleep = options.sleep || (ms => new Promise(resolve => setTimeout(resolve, ms)));
+    this.store = options.store || null;
+    this.deadLetters = [];
+    this.metrics = { enqueued: 0, delivered: 0, failed: 0, retried: 0, deduplicated: 0, byChannel: {} };
+    if (this.store) {
+      const persisted = this.store.load();
+      this.queue = persisted.queue || [];
+      this.deadLetters = persisted.deadLetters || [];
+    }
+  }
+
+  register(adapter) { if (!(adapter instanceof ChannelAdapter)) throw new Error('ChannelAdapter required'); this.adapters.set(adapter.name, adapter); return adapter; }
+
+  enqueue(channel, target, payload, options = {}) {
+    const id = deliveryId(channel, target, payload, options.idempotencyKey);
+    if (this.completed.has(id) || this.inFlight.has(id) || this.queue.some(item => item.id === id)) {
+      this.metrics.deduplicated++; return { ok: true, id, duplicate: true };
+    }
+    const item = { id, channel, target, payload, attempt: 0, createdAt: new Date().toISOString(), metadata: options.metadata || {} };
+    this.queue.push(item); this.metrics.enqueued++; this._channel(channel).enqueued++;
+    this._persist();
+    this.emit('queued', item);
+    return { ok: true, id, duplicate: false };
+  }
+
+  async drain() {
+    const results = [];
+    while (this.queue.length) {
+      const item = this.queue.shift();
+      this._persist();
+      results.push(await this._deliver(item));
+    }
+    return results;
+  }
+
+  async _deliver(item) {
+    const adapter = this.adapters.get(item.channel);
+    if (!adapter) return this._failure(item, `channel adapter not registered: ${item.channel}`);
+    this.inFlight.set(item.id, item);
+    while (item.attempt < this.maxAttempts) {
+      item.attempt++;
+      try {
+        const result = await adapter.send(item);
+        const record = { ok: true, id: item.id, attempts: item.attempt, result, deliveredAt: new Date().toISOString() };
+        this.inFlight.delete(item.id); this.completed.set(item.id, record);
+        while (this.completed.size > this.maxCompleted) this.completed.delete(this.completed.keys().next().value);
+        this.metrics.delivered++; this._channel(item.channel).delivered++; this.emit('delivered', record);
+        this._persist();
+        return record;
+      } catch (error) {
+        item.lastError = error.message;
+        if (item.attempt < this.maxAttempts) {
+          this.metrics.retried++; this._channel(item.channel).retried++;
+          await this.sleep(Math.min(this.baseDelayMs * (2 ** (item.attempt - 1)), 30000));
+        }
+      }
+    }
+    this.inFlight.delete(item.id);
+    return this._failure(item, item.lastError || 'delivery failed');
+  }
+
+  _failure(item, error) {
+    const record = { ok: false, id: item.id, attempts: item.attempt, error };
+    this.deadLetters.push({ ...item, failedAt: new Date().toISOString(), error });
+    if (this.deadLetters.length > 10000) this.deadLetters.shift();
+    this.metrics.failed++; this._channel(item.channel).failed++; this.emit('failed', record); this._persist(); return record;
+  }
+
+  _channel(name) {
+    if (!this.metrics.byChannel[name]) this.metrics.byChannel[name] = { enqueued: 0, delivered: 0, failed: 0, retried: 0 };
+    return this.metrics.byChannel[name];
+  }
+
+  snapshotMetrics() { return JSON.parse(JSON.stringify({ ...this.metrics, queueDepth: this.queue.length, inFlight: this.inFlight.size })); }
+  async health() { return Promise.all([...this.adapters.values()].map(adapter => adapter.health())); }
+  _persist() { if (this.store) this.store.save({ queue: this.queue, deadLetters: this.deadLetters }); }
+  requeueDeadLetter(id) {
+    const index = this.deadLetters.findIndex(item => item.id === id);
+    if (index === -1) return { ok: false, error: 'dead letter not found' };
+    const [item] = this.deadLetters.splice(index, 1);
+    item.attempt = 0; delete item.error; delete item.failedAt;
+    this.queue.push(item); this._persist();
+    return { ok: true, id };
+  }
+}
+
+class ReconnectSupervisor extends EventEmitter {
+  constructor(options = {}) {
+    super();
+    this.baseDelayMs = options.baseDelayMs ?? 1000;
+    this.maxDelayMs = options.maxDelayMs ?? 60000;
+    this.maxAttempts = options.maxAttempts ?? Infinity;
+    this.jitter = options.jitter ?? 0.2;
+    this.sleep = options.sleep || (ms => new Promise(resolve => setTimeout(resolve, ms)));
+    this.random = options.random || Math.random;
+    this.jobs = new Map();
+    this.metrics = { attempts: 0, reconnected: 0, exhausted: 0, cancelled: 0 };
+  }
+
+  reconnect(adapter) {
+    if (!(adapter instanceof ChannelAdapter)) return Promise.reject(new Error('ChannelAdapter required'));
+    if (this.jobs.has(adapter.name)) return this.jobs.get(adapter.name).promise;
+    const job = { cancelled: false, attempt: 0, promise: null };
+    job.promise = this._run(adapter, job).finally(() => this.jobs.delete(adapter.name));
+    this.jobs.set(adapter.name, job);
+    return job.promise;
+  }
+
+  cancel(name) {
+    const job = this.jobs.get(name);
+    if (!job) return false;
+    job.cancelled = true; this.metrics.cancelled++; this.emit('cancelled', { channel: name }); return true;
+  }
+
+  async _run(adapter, job) {
+    while (!job.cancelled && job.attempt < this.maxAttempts) {
+      job.attempt++; this.metrics.attempts++;
+      if (job.attempt > 1) await this.sleep(this._delay(job.attempt - 1));
+      if (job.cancelled) break;
+      const result = await adapter.connect();
+      this.emit('attempt', { channel: adapter.name, attempt: job.attempt, result });
+      if (result.ok) {
+        this.metrics.reconnected++; this.emit('reconnected', { channel: adapter.name, attempts: job.attempt });
+        return { ok: true, channel: adapter.name, attempts: job.attempt };
+      }
+      // connect() leaves degraded state; reset so the next attempt calls connectFn.
+      adapter.state = 'disconnected';
+    }
+    if (job.cancelled) return { ok: false, channel: adapter.name, stopped: 'cancelled', attempts: job.attempt };
+    this.metrics.exhausted++; this.emit('exhausted', { channel: adapter.name, attempts: job.attempt });
+    return { ok: false, channel: adapter.name, stopped: 'exhausted', attempts: job.attempt };
+  }
+
+  _delay(attempt) {
+    const raw = Math.min(this.baseDelayMs * (2 ** Math.max(0, attempt - 1)), this.maxDelayMs);
+    const spread = raw * this.jitter;
+    return Math.max(0, Math.round(raw - spread + this.random() * spread * 2));
+  }
+
+  snapshotMetrics() { return { ...this.metrics, active: this.jobs.size }; }
+}
+
+module.exports = { ChannelAdapter, ChannelDeliveryManager, ReconnectSupervisor, deliveryId };

package/src/utils/code-intelligence.js

@@ -0,0 +1,69 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const CODE_EXTENSIONS = new Set(['.js', '.cjs', '.mjs', '.ts', '.tsx', '.jsx', '.py', '.go', '.rs', '.java']);
+const DEFINITION_PATTERNS = [
+  /\b(?:function|class|const|let|var|interface|type|enum)\s+([A-Za-z_$][\w$]*)/g,
+  /^\s*def\s+([A-Za-z_]\w*)/gm,
+  /^\s*(?:func|type)\s+([A-Za-z_]\w*)/gm,
+];
+
+function walkCodeFiles(root, limit = 5000) {
+  const files = [];
+  const ignored = new Set(['node_modules', '.git', '.natureco', 'dist', 'build', 'coverage']);
+  function walk(dir) {
+    if (files.length >= limit) return;
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+      if (ignored.has(entry.name)) continue;
+      const target = path.join(dir, entry.name);
+      if (entry.isDirectory()) walk(target);
+      else if (entry.isFile() && CODE_EXTENSIONS.has(path.extname(entry.name))) files.push(target);
+    }
+  }
+  walk(path.resolve(root));
+  return files;
+}
+
+class CodeIntelligence {
+  constructor(root = process.cwd()) { this.root = path.resolve(root); this.files = []; this.definitions = new Map(); }
+
+  index() {
+    this.files = walkCodeFiles(this.root);
+    this.definitions.clear();
+    for (const file of this.files) {
+      const text = fs.readFileSync(file, 'utf8');
+      for (const pattern of DEFINITION_PATTERNS) {
+        pattern.lastIndex = 0;
+        let match;
+        while ((match = pattern.exec(text))) {
+          const line = text.slice(0, match.index).split('\n').length;
+          const item = { symbol: match[1], file, line };
+          if (!this.definitions.has(match[1])) this.definitions.set(match[1], []);
+          this.definitions.get(match[1]).push(item);
+        }
+      }
+    }
+    return { files: this.files.length, symbols: this.definitions.size };
+  }
+
+  findDefinitions(symbol) { return this.definitions.get(symbol) || []; }
+
+  findReferences(symbol, limit = 200) {
+    if (!symbol || !/^[A-Za-z_$][\w$]*$/.test(symbol)) return [];
+    const regex = new RegExp(`\\b${symbol.replace(/[$]/g, '\\$&')}\\b`, 'g');
+    const results = [];
+    for (const file of this.files) {
+      const lines = fs.readFileSync(file, 'utf8').split('\n');
+      lines.forEach((text, index) => {
+        regex.lastIndex = 0;
+        if (regex.test(text)) results.push({ symbol, file, line: index + 1, text: text.trim().slice(0, 240) });
+      });
+      if (results.length >= limit) break;
+    }
+    return results.slice(0, limit);
+  }
+}
+
+module.exports = { CodeIntelligence, walkCodeFiles };

package/src/utils/coding-session.js

@@ -0,0 +1,54 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const TB = require('./token-budget');
+const { writeFileAtomicSync } = require('./atomic-file');
+
+class CodingSession {
+  constructor(options = {}) {
+    this.maxSnapshots = options.maxSnapshots || 20;
+    this.snapshots = [];
+    this.lastUserMessage = null;
+  }
+
+  rememberUserMessage(message) { if (message && !message.startsWith('/')) this.lastUserMessage = message; }
+  retryMessage() { return this.lastUserMessage; }
+
+  capture(filePath) {
+    if (!filePath) return null;
+    const target = path.resolve(filePath);
+    const existed = fs.existsSync(target);
+    const content = existed ? fs.readFileSync(target) : null;
+    const snapshot = { path: target, existed, content, capturedAt: Date.now() };
+    this.snapshots.push(snapshot);
+    if (this.snapshots.length > this.maxSnapshots) this.snapshots.shift();
+    return snapshot;
+  }
+
+  undo() {
+    const snapshot = this.snapshots.pop();
+    if (!snapshot) return { ok: false, error: 'Geri alınacak değişiklik yok.' };
+    if (snapshot.existed) writeFileAtomicSync(snapshot.path, snapshot.content);
+    else if (fs.existsSync(snapshot.path)) fs.unlinkSync(snapshot.path);
+    return { ok: true, path: snapshot.path, restored: snapshot.existed };
+  }
+
+  compact(messages) {
+    const before = messages.length;
+    const compacted = TB.smartTrim(messages);
+    return { messages: compacted, before, after: compacted.length, removed: before - compacted.length };
+  }
+
+  riskSummary(toolCall) {
+    const name = toolCall?.name || '';
+    const args = toolCall?.input || {};
+    const risks = [];
+    if (name === 'write_file' || name === 'edit_file') risks.push('filesystem-write');
+    if (name === 'bash' || name === 'shell_command') risks.push('command-execution');
+    if (/\b(rm|delete|drop|truncate|chmod|chown)\b/i.test(args.command || '')) risks.push('destructive');
+    return { level: risks.includes('destructive') ? 'high' : risks.length ? 'medium' : 'low', risks };
+  }
+}
+
+module.exports = { CodingSession };

package/src/utils/conversation-context.js

@@ -0,0 +1,52 @@
+'use strict';
+
+function estimateTokens(content) {
+  if (!content) return 0;
+  return Math.ceil(String(content).length / 4);
+}
+
+function prepareConversationHistory(messages, options = {}) {
+  if (!Array.isArray(messages)) return [];
+
+  if (typeof options === 'number') options = { maxMessages: options };
+  const maxMessages = Math.max(1, options.maxMessages || 20);
+  const maxTokens = Math.max(1, options.maxTokens || 2048);
+
+  const candidates = messages
+    .filter(message =>
+      message &&
+      (message.role === 'user' || message.role === 'assistant') &&
+      typeof message.content === 'string' &&
+      message.content.trim()
+    )
+    .slice(-maxMessages);
+
+  const selected = [];
+  let remainingTokens = maxTokens;
+
+  for (let i = candidates.length - 1; i >= 0 && remainingTokens > 0; i--) {
+    const message = candidates[i];
+    const content = message.content.trim();
+    const contentTokens = estimateTokens(content);
+    if (contentTokens <= remainingTokens) {
+      selected.unshift({ role: message.role, content });
+      remainingTokens -= contentTokens;
+      continue;
+    }
+
+    // Preserve the newest oversized turn, but never let a generated file or
+    // verbose tool summary consume the entire next request's context budget.
+    if (selected.length === 0) {
+      const maxChars = Math.max(4, remainingTokens * 4);
+      selected.unshift({
+        role: message.role,
+        content: content.slice(0, Math.max(0, maxChars - 36)) + '\n[... context truncated ...]',
+      });
+    }
+    break;
+  }
+
+  return selected;
+}
+
+module.exports = { estimateTokens, prepareConversationHistory };

package/src/utils/delivery-store.js

@@ -0,0 +1,34 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const { writeJsonAtomicSync, readJsonSafeSync } = require('./atomic-file');
+
+class DeliveryStore {
+  constructor(options = {}) {
+    this.file = options.file || path.join(os.homedir(), '.natureco', 'delivery-queue.json');
+    this.maxItems = options.maxItems || 10000;
+  }
+
+  load() {
+    const data = readJsonSafeSync(this.file, { version: 1, queue: [], deadLetters: [] });
+    return {
+      version: 1,
+      queue: Array.isArray(data.queue) ? data.queue.slice(0, this.maxItems) : [],
+      deadLetters: Array.isArray(data.deadLetters) ? data.deadLetters.slice(-this.maxItems) : [],
+    };
+  }
+
+  save(state) {
+    fs.mkdirSync(path.dirname(this.file), { recursive: true, mode: 0o700 });
+    writeJsonAtomicSync(this.file, {
+      version: 1,
+      savedAt: new Date().toISOString(),
+      queue: (state.queue || []).slice(0, this.maxItems),
+      deadLetters: (state.deadLetters || []).slice(-this.maxItems),
+    }, { mode: 0o600 });
+  }
+}
+
+module.exports = { DeliveryStore };

package/src/utils/i18n.js

@@ -92,4 +92,10 @@ function t(key, vars) {
   return s;
 }
 
-module.exports = { t, getLang, setLangCache, MESSAGES };
+function validateCatalogParity(catalog = MESSAGES) {
+  const tr = Object.keys(catalog.tr || {}).sort();
+  const en = Object.keys(catalog.en || {}).sort();
+  return { ok: tr.length === en.length && tr.every((key, index) => key === en[index]), trOnly: tr.filter(key => !en.includes(key)), enOnly: en.filter(key => !tr.includes(key)), keys: tr.length };
+}
+
+module.exports = { t, getLang, setLangCache, MESSAGES, validateCatalogParity };

package/src/utils/json-schema.js

@@ -0,0 +1,43 @@
+'use strict';
+
+function valueType(value) {
+  if (Array.isArray(value)) return 'array';
+  if (value === null) return 'null';
+  if (Number.isInteger(value)) return 'integer';
+  return typeof value;
+}
+
+function validateJsonSchema(schema, value, at = '$') {
+  const errors = [];
+  if (!schema || typeof schema !== 'object') return { valid: true, errors };
+  const allowedTypes = Array.isArray(schema.type) ? schema.type : schema.type ? [schema.type] : [];
+  const actual = valueType(value);
+  if (allowedTypes.length && !allowedTypes.includes(actual) && !(actual === 'integer' && allowedTypes.includes('number'))) {
+    return { valid: false, errors: [`${at}: expected ${allowedTypes.join('|')}, got ${actual}`] };
+  }
+  if (schema.enum && !schema.enum.some(item => Object.is(item, value))) {
+    errors.push(`${at}: value is not in enum`);
+  }
+  if (actual === 'object' && value !== null) {
+    for (const key of schema.required || []) {
+      if (!Object.prototype.hasOwnProperty.call(value, key)) errors.push(`${at}.${key}: required`);
+    }
+    for (const [key, child] of Object.entries(schema.properties || {})) {
+      if (Object.prototype.hasOwnProperty.call(value, key)) {
+        errors.push(...validateJsonSchema(child, value[key], `${at}.${key}`).errors);
+      }
+    }
+    if (schema.additionalProperties === false) {
+      const known = new Set(Object.keys(schema.properties || {}));
+      for (const key of Object.keys(value)) if (!known.has(key)) errors.push(`${at}.${key}: additional property`);
+    }
+  }
+  if (actual === 'array') {
+    if (schema.minItems != null && value.length < schema.minItems) errors.push(`${at}: minItems ${schema.minItems}`);
+    if (schema.maxItems != null && value.length > schema.maxItems) errors.push(`${at}: maxItems ${schema.maxItems}`);
+    if (schema.items) value.forEach((item, index) => errors.push(...validateJsonSchema(schema.items, item, `${at}[${index}]`).errors));
+  }
+  return { valid: errors.length === 0, errors };
+}
+
+module.exports = { validateJsonSchema };