vgxness 0.1.0

package/dist/mcp/validation.js

@@ -0,0 +1,761 @@
+import { isSddPhase, sddPhases } from '../sdd/schema.js';
+import { errorEnvelope, isVgxMcpToolName } from './schema.js';
+const scopes = ['project', 'personal'];
+const agentModes = ['agent', 'subagent'];
+const memoryTypes = ['architecture', 'decision', 'bugfix', 'pattern', 'config', 'discovery', 'learning', 'preference', 'manual'];
+const activityKinds = ['prompt', 'tool_call', 'artifact', 'summary', 'error'];
+const runStatuses = ['created', 'planned', 'running', 'needs-human', 'completed', 'failed', 'blocked', 'cancelled'];
+const finalRunStatuses = ['completed', 'failed', 'blocked', 'cancelled'];
+const runOutcomes = ['success', 'partial', 'failure', 'blocked', 'cancelled'];
+const permissionCategories = ['read', 'edit', 'shell', 'network', 'git', 'memory', 'external-directory', 'provider-tool', 'secrets'];
+const permissionDecisions = ['allow', 'ask', 'deny'];
+const validChangePattern = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+const validMemoryTopicKeyPattern = /^[A-Za-z0-9][A-Za-z0-9._/-]*$/;
+const maxMemoryTitleLength = 200;
+const maxMemoryContentLength = 20_000;
+const maxMemoryTopicKeyLength = 200;
+export function validateVgxMcpToolCall(call) {
+    const envelope = asRecord(call, undefined, 'Tool call must be an object');
+    if (!envelope.ok)
+        return toValidationResultFailure(envelope);
+    const tool = readString(envelope.value, 'tool', undefined);
+    if (!tool.ok)
+        return toValidationResultFailure(tool);
+    if (!isVgxMcpToolName(tool.value))
+        return toValidationResultFailure(validationFailure(`Unsupported MCP control-plane tool: ${tool.value}`));
+    const input = envelope.value.input;
+    switch (tool.value) {
+        case 'vgxness_sdd_status':
+            return validationSuccess(tool.value, validateSddStatusInput(input, tool.value));
+        case 'vgxness_sdd_ready':
+            return validationSuccess(tool.value, validateSddReadyInput(input, tool.value));
+        case 'vgxness_sdd_save_artifact':
+            return validationSuccess(tool.value, validateSddSaveArtifactInput(input, tool.value));
+        case 'vgxness_sdd_get_artifact':
+            return validationSuccess(tool.value, validateSddGetArtifactInput(input, tool.value));
+        case 'vgxness_sdd_list_artifacts':
+            return validationSuccess(tool.value, validateSddListArtifactsInput(input, tool.value));
+        case 'vgxness_sdd_next':
+            return validationSuccess(tool.value, validateSddNextInput(input, tool.value));
+        case 'vgxness_memory_save':
+            return validationSuccess(tool.value, validateMemorySaveInput(input, tool.value));
+        case 'vgxness_memory_search':
+            return validationSuccess(tool.value, validateMemorySearchInput(input, tool.value));
+        case 'vgxness_memory_get':
+            return validationSuccess(tool.value, validateMemoryGetInput(input, tool.value));
+        case 'vgxness_memory_update':
+            return validationSuccess(tool.value, validateMemoryUpdateInput(input, tool.value));
+        case 'vgxness_session_start':
+            return validationSuccess(tool.value, validateSessionStartInput(input, tool.value));
+        case 'vgxness_session_append_activity':
+            return validationSuccess(tool.value, validateSessionAppendActivityInput(input, tool.value));
+        case 'vgxness_session_close':
+            return validationSuccess(tool.value, validateSessionCloseInput(input, tool.value));
+        case 'vgxness_session_restore':
+            return validationSuccess(tool.value, validateSessionRestoreInput(input, tool.value));
+        case 'vgxness_agent_resolve':
+            return validationSuccess(tool.value, validateAgentResolveInput(input, tool.value));
+        case 'vgxness_agent_activate':
+            return validationSuccess(tool.value, validateAgentActivateInput(input, tool.value));
+        case 'vgxness_manager_profile_get':
+            return validationSuccess(tool.value, validateManagerProfileGetInput(input, tool.value));
+        case 'vgxness_manager_profile_set':
+            return validationSuccess(tool.value, validateManagerProfileSetInput(input, tool.value));
+        case 'vgxness_skill_payload':
+            return validationSuccess(tool.value, validateSkillPayloadInput(input, tool.value));
+        case 'vgxness_opencode_manager_payload':
+            return validationSuccess(tool.value, validateOpenCodeManagerPayloadInput(input, tool.value));
+        case 'vgxness_run_list':
+            return validationSuccess(tool.value, validateRunListInput(input, tool.value));
+        case 'vgxness_run_get':
+            return validationSuccess(tool.value, validateRunGetInput(input, tool.value));
+        case 'vgxness_run_preflight':
+            return validationSuccess(tool.value, validateRunPreflightInput(input, tool.value));
+        case 'vgxness_run_start':
+            return validationSuccess(tool.value, validateRunStartInput(input, tool.value));
+        case 'vgxness_run_checkpoint':
+            return validationSuccess(tool.value, validateRunCheckpointInput(input, tool.value));
+        case 'vgxness_run_finalize':
+            return validationSuccess(tool.value, validateRunFinalizeInput(input, tool.value));
+    }
+}
+export function validateVgxMcpToolInput(tool, input) {
+    return validateVgxMcpToolCall({ tool, input });
+}
+function validateSddStatusInput(input, tool) {
+    const record = inputRecord(input, tool, ['project', 'change']);
+    if (!record.ok)
+        return record;
+    return readProjectAndChange(record.value, tool);
+}
+function validateSddNextInput(input, tool) {
+    const record = inputRecord(input, tool, ['project', 'change']);
+    if (!record.ok)
+        return record;
+    return readProjectAndChange(record.value, tool);
+}
+function readProjectAndChange(record, tool) {
+    const project = readNonEmptyString(record, 'project', tool);
+    if (!project.ok)
+        return project;
+    const change = readChange(record, tool);
+    if (!change.ok)
+        return change;
+    return { ok: true, value: { project: project.value, change: change.value } };
+}
+function validateSddReadyInput(input, tool) {
+    const record = inputRecord(input, tool, ['project', 'change', 'phase']);
+    if (!record.ok)
+        return record;
+    const base = readProjectAndChange(record.value, tool);
+    if (!base.ok)
+        return base;
+    const phase = readPhase(record.value, tool);
+    if (!phase.ok)
+        return phase;
+    return { ok: true, value: { ...base.value, phase: phase.value } };
+}
+function validateSddSaveArtifactInput(input, tool) {
+    const record = inputRecord(input, tool, ['project', 'change', 'phase', 'content']);
+    if (!record.ok)
+        return record;
+    const base = readProjectAndChange(record.value, tool);
+    if (!base.ok)
+        return base;
+    const phase = readPhase(record.value, tool);
+    if (!phase.ok)
+        return phase;
+    const content = readNonEmptyString(record.value, 'content', tool);
+    if (!content.ok)
+        return content;
+    return { ok: true, value: { ...base.value, phase: phase.value, content: content.value } };
+}
+function validateSddGetArtifactInput(input, tool) {
+    const record = inputRecord(input, tool, ['project', 'change', 'phase']);
+    if (!record.ok)
+        return record;
+    const base = readProjectAndChange(record.value, tool);
+    if (!base.ok)
+        return base;
+    const phase = readPhase(record.value, tool);
+    if (!phase.ok)
+        return phase;
+    return { ok: true, value: { ...base.value, phase: phase.value } };
+}
+function validateSddListArtifactsInput(input, tool) {
+    const record = inputRecord(input, tool, ['project', 'change']);
+    if (!record.ok)
+        return record;
+    return readProjectAndChange(record.value, tool);
+}
+function validateMemorySaveInput(input, tool) {
+    const record = inputRecord(input, tool, ['project', 'scope', 'type', 'title', 'content', 'topicKey']);
+    if (!record.ok)
+        return record;
+    const project = readLimitedNonEmptyString(record.value, 'project', tool, undefined);
+    if (!project.ok)
+        return project;
+    const scope = readOptionalOneOf(record.value, 'scope', scopes, tool);
+    if (!scope.ok)
+        return scope;
+    const type = readRequiredOneOf(record.value, 'type', memoryTypes, tool);
+    if (!type.ok)
+        return type;
+    const title = readLimitedNonEmptyString(record.value, 'title', tool, maxMemoryTitleLength);
+    if (!title.ok)
+        return title;
+    const content = readLimitedNonEmptyString(record.value, 'content', tool, maxMemoryContentLength);
+    if (!content.ok)
+        return content;
+    const topicKey = readOptionalTopicKey(record.value, tool);
+    if (!topicKey.ok)
+        return topicKey;
+    const result = { project: project.value, scope: scope.value ?? 'project', type: type.value, title: title.value, content: content.value };
+    if (topicKey.value !== undefined)
+        result.topicKey = topicKey.value;
+    return { ok: true, value: result };
+}
+function validateMemorySearchInput(input, tool) {
+    const record = inputRecord(input, tool, ['project', 'scope', 'type', 'topicKey', 'query', 'limit']);
+    if (!record.ok)
+        return record;
+    const result = {};
+    const copied = copyOptionalLimitedStrings(result, record.value, tool, ['project', 'query'], undefined);
+    if (!copied.ok)
+        return copied;
+    const scope = readOptionalOneOf(record.value, 'scope', scopes, tool);
+    if (!scope.ok)
+        return scope;
+    if (scope.value !== undefined)
+        result.scope = scope.value;
+    const type = readOptionalOneOf(record.value, 'type', memoryTypes, tool);
+    if (!type.ok)
+        return type;
+    if (type.value !== undefined)
+        result.type = type.value;
+    const topicKey = readOptionalTopicKey(record.value, tool);
+    if (!topicKey.ok)
+        return topicKey;
+    if (topicKey.value !== undefined)
+        result.topicKey = topicKey.value;
+    const limit = readMemorySearchLimit(record.value, tool);
+    if (!limit.ok)
+        return limit;
+    result.limit = limit.value;
+    return { ok: true, value: result };
+}
+function validateMemoryGetInput(input, tool) {
+    const record = inputRecord(input, tool, ['id']);
+    if (!record.ok)
+        return record;
+    const id = readNonEmptyString(record.value, 'id', tool);
+    if (!id.ok)
+        return id;
+    return { ok: true, value: { id: id.value } };
+}
+function validateMemoryUpdateInput(input, tool) {
+    const record = inputRecord(input, tool, ['id', 'type', 'title', 'content', 'topicKey']);
+    if (!record.ok)
+        return record;
+    const id = readNonEmptyString(record.value, 'id', tool);
+    if (!id.ok)
+        return id;
+    const result = { id: id.value };
+    const type = readOptionalOneOf(record.value, 'type', memoryTypes, tool);
+    if (!type.ok)
+        return type;
+    if (type.value !== undefined)
+        result.type = type.value;
+    const copied = copyOptionalLimitedStrings(result, record.value, tool, ['title', 'content'], undefined);
+    if (!copied.ok)
+        return copied;
+    if (result.title !== undefined && result.title.length > maxMemoryTitleLength)
+        return validationFailure(`title must be ${maxMemoryTitleLength} characters or fewer`, tool);
+    if (result.content !== undefined && result.content.length > maxMemoryContentLength)
+        return validationFailure(`content must be ${maxMemoryContentLength} characters or fewer`, tool);
+    const topicKey = readOptionalTopicKey(record.value, tool);
+    if (!topicKey.ok)
+        return topicKey;
+    if (topicKey.value !== undefined)
+        result.topicKey = topicKey.value;
+    if (result.type === undefined && result.title === undefined && result.content === undefined && result.topicKey === undefined) {
+        return validationFailure('At least one editable field is required', tool);
+    }
+    return { ok: true, value: result };
+}
+function validateSessionStartInput(input, tool) {
+    const record = inputRecord(input, tool, ['id', 'project', 'directory']);
+    if (!record.ok)
+        return record;
+    const project = readNonEmptyString(record.value, 'project', tool);
+    if (!project.ok)
+        return project;
+    const result = { project: project.value };
+    const copied = copyOptionalStrings(result, record.value, tool, ['id', 'directory']);
+    if (!copied.ok)
+        return copied;
+    return { ok: true, value: result };
+}
+function validateSessionAppendActivityInput(input, tool) {
+    const record = inputRecord(input, tool, ['sessionId', 'actor', 'kind', 'payloadJson']);
+    if (!record.ok)
+        return record;
+    const result = {};
+    const copied = copyRequiredStrings(result, record.value, tool, ['sessionId', 'actor', 'payloadJson']);
+    if (!copied.ok)
+        return copied;
+    const kind = readRequiredOneOf(record.value, 'kind', activityKinds, tool);
+    if (!kind.ok)
+        return kind;
+    result.kind = kind.value;
+    return { ok: true, value: result };
+}
+function validateSessionCloseInput(input, tool) {
+    const record = inputRecord(input, tool, ['sessionId', 'actor', 'summary']);
+    if (!record.ok)
+        return record;
+    const result = {};
+    const copied = copyRequiredStrings(result, record.value, tool, ['sessionId', 'actor', 'summary']);
+    if (!copied.ok)
+        return copied;
+    return { ok: true, value: result };
+}
+function validateSessionRestoreInput(input, tool) {
+    const record = inputRecord(input, tool, ['project', 'directory']);
+    if (!record.ok)
+        return record;
+    const project = readNonEmptyString(record.value, 'project', tool);
+    if (!project.ok)
+        return project;
+    const result = { project: project.value };
+    const copied = copyOptionalStrings(result, record.value, tool, ['directory']);
+    if (!copied.ok)
+        return copied;
+    return { ok: true, value: result };
+}
+function validateAgentResolveInput(input, tool) {
+    const record = inputRecord(input, tool, ['project', 'scope', 'taskDescription', 'intent', 'desiredCapabilities', 'workflow', 'phase', 'providerAdapter', 'mode']);
+    if (!record.ok)
+        return record;
+    const result = {};
+    const copied = copyOptionalStrings(result, record.value, tool, ['project', 'taskDescription', 'intent', 'workflow', 'phase', 'providerAdapter']);
+    if (!copied.ok)
+        return copied;
+    const scope = readOptionalOneOf(record.value, 'scope', scopes, tool);
+    if (!scope.ok)
+        return scope;
+    if (scope.value !== undefined)
+        result.scope = scope.value;
+    const mode = readOptionalOneOf(record.value, 'mode', agentModes, tool);
+    if (!mode.ok)
+        return mode;
+    if (mode.value !== undefined)
+        result.mode = mode.value;
+    const desiredCapabilities = readOptionalStringArray(record.value, 'desiredCapabilities', tool);
+    if (!desiredCapabilities.ok)
+        return desiredCapabilities;
+    if (desiredCapabilities.value !== undefined)
+        result.desiredCapabilities = desiredCapabilities.value;
+    return { ok: true, value: result };
+}
+function validateAgentActivateInput(input, tool) {
+    const record = inputRecord(input, tool, ['project', 'scope', 'agentId', 'userIntent', 'workflow', 'phase', 'workspaceRoot', 'maxSourceBytes', 'providerAdapter']);
+    if (!record.ok)
+        return record;
+    const project = readNonEmptyString(record.value, 'project', tool);
+    if (!project.ok)
+        return project;
+    const userIntent = readNonEmptyString(record.value, 'userIntent', tool);
+    if (!userIntent.ok)
+        return userIntent;
+    const result = { project: project.value, scope: 'project', userIntent: userIntent.value, workflow: 'agent-activation', phase: 'activation' };
+    const copied = copyOptionalStrings(result, record.value, tool, ['agentId', 'workflow', 'phase', 'workspaceRoot']);
+    if (!copied.ok)
+        return copied;
+    if (record.value.providerAdapter !== undefined) {
+        const providerAdapter = readNonEmptyString(record.value, 'providerAdapter', tool);
+        if (!providerAdapter.ok)
+            return providerAdapter;
+        result.providerAdapter = providerAdapter.value.trim();
+    }
+    const scope = readOptionalOneOf(record.value, 'scope', scopes, tool);
+    if (!scope.ok)
+        return scope;
+    result.scope = scope.value ?? 'project';
+    if (record.value.maxSourceBytes !== undefined) {
+        const maxSourceBytes = record.value.maxSourceBytes;
+        if (typeof maxSourceBytes !== 'number' || !Number.isSafeInteger(maxSourceBytes) || maxSourceBytes <= 0)
+            return validationFailure('maxSourceBytes must be a positive safe integer', tool);
+        result.maxSourceBytes = maxSourceBytes;
+    }
+    return { ok: true, value: result };
+}
+function validateSkillPayloadInput(input, tool) {
+    const record = inputRecord(input, tool, ['workspaceRoot', 'maxSourceBytes', 'project', 'scope', 'agentId', 'agentName', 'workflow', 'phase', 'providerAdapter', 'runId']);
+    if (!record.ok)
+        return record;
+    const workspaceRoot = readNonEmptyString(record.value, 'workspaceRoot', tool);
+    if (!workspaceRoot.ok)
+        return workspaceRoot;
+    const result = { workspaceRoot: workspaceRoot.value };
+    const copied = copyOptionalStrings(result, record.value, tool, ['project', 'agentId', 'agentName', 'workflow', 'phase', 'providerAdapter', 'runId']);
+    if (!copied.ok)
+        return copied;
+    const scope = readOptionalOneOf(record.value, 'scope', scopes, tool);
+    if (!scope.ok)
+        return scope;
+    if (scope.value !== undefined)
+        result.scope = scope.value;
+    if (record.value.maxSourceBytes !== undefined) {
+        const maxSourceBytes = record.value.maxSourceBytes;
+        if (typeof maxSourceBytes !== 'number' || !Number.isSafeInteger(maxSourceBytes) || maxSourceBytes <= 0)
+            return validationFailure('maxSourceBytes must be a positive safe integer', tool);
+        result.maxSourceBytes = maxSourceBytes;
+    }
+    return { ok: true, value: result };
+}
+function validateManagerProfileGetInput(input, tool) {
+    const record = inputRecord(input, tool, ['project', 'scope', 'managerName']);
+    if (!record.ok)
+        return record;
+    const project = readNonEmptyString(record.value, 'project', tool);
+    if (!project.ok)
+        return project;
+    const scope = readOptionalOneOf(record.value, 'scope', scopes, tool);
+    if (!scope.ok)
+        return scope;
+    const result = { project: project.value };
+    if (scope.value !== undefined)
+        result.scope = scope.value;
+    const copied = copyOptionalStrings(result, record.value, tool, ['managerName']);
+    if (!copied.ok)
+        return copied;
+    return { ok: true, value: result };
+}
+function validateManagerProfileSetInput(input, tool) {
+    const record = inputRecord(input, tool, ['project', 'scope', 'managerName', 'instructions']);
+    if (!record.ok)
+        return record;
+    const result = {};
+    const copied = copyRequiredStrings(result, record.value, tool, ['project', 'managerName', 'instructions']);
+    if (!copied.ok)
+        return copied;
+    const scope = readRequiredOneOf(record.value, 'scope', scopes, tool);
+    if (!scope.ok)
+        return scope;
+    result.scope = scope.value;
+    return { ok: true, value: result };
+}
+function validateOpenCodeManagerPayloadInput(input, tool) {
+    const record = inputRecord(input, tool, ['project', 'scope', 'agentId', 'agentName', 'workspaceRoot', 'maxSourceBytes']);
+    if (!record.ok)
+        return record;
+    const project = readNonEmptyString(record.value, 'project', tool);
+    if (!project.ok)
+        return project;
+    const result = { project: project.value };
+    const copied = copyOptionalStrings(result, record.value, tool, ['agentId', 'agentName', 'workspaceRoot']);
+    if (!copied.ok)
+        return copied;
+    // Some MCP hosts expose optional fields as required in their generated tool
+    // facade. Accept both selectors here and let the provider payload service
+    // verify that they refer to the same top-level agent.
+    if (result.agentId === undefined && result.agentName === undefined)
+        result.agentName = 'vgxness-manager';
+    const scope = readOptionalOneOf(record.value, 'scope', scopes, tool);
+    if (!scope.ok)
+        return scope;
+    result.scope = scope.value ?? 'project';
+    if (record.value.maxSourceBytes !== undefined) {
+        const maxSourceBytes = record.value.maxSourceBytes;
+        if (typeof maxSourceBytes !== 'number' || !Number.isSafeInteger(maxSourceBytes) || maxSourceBytes <= 0)
+            return validationFailure('maxSourceBytes must be a positive safe integer', tool);
+        result.maxSourceBytes = maxSourceBytes;
+    }
+    return { ok: true, value: result };
+}
+function validateRunListInput(input, tool) {
+    const record = inputRecord(input, tool, ['project', 'status', 'limit']);
+    if (!record.ok)
+        return record;
+    const result = {};
+    const project = copyOptionalStrings(result, record.value, tool, ['project']);
+    if (!project.ok)
+        return project;
+    const status = readOptionalOneOf(record.value, 'status', runStatuses, tool);
+    if (!status.ok)
+        return status;
+    if (status.value !== undefined)
+        result.status = status.value;
+    const limit = readBoundedLimit(record.value, tool);
+    if (!limit.ok)
+        return limit;
+    result.limit = limit.value;
+    return { ok: true, value: result };
+}
+function validateRunGetInput(input, tool) {
+    const record = inputRecord(input, tool, ['id']);
+    if (!record.ok)
+        return record;
+    const id = readNonEmptyString(record.value, 'id', tool);
+    if (!id.ok)
+        return id;
+    return { ok: true, value: { id: id.value } };
+}
+function validateRunPreflightInput(input, tool) {
+    const record = inputRecord(input, tool, ['runId', 'category', 'operation', 'workspaceRoot', 'targetPath', 'providerToolName', 'agent', 'sandboxStrategy', 'destructive', 'external', 'privileged', 'ambiguous']);
+    if (!record.ok)
+        return record;
+    const runId = readNonEmptyString(record.value, 'runId', tool);
+    if (!runId.ok)
+        return runId;
+    const category = readRequiredOneOf(record.value, 'category', permissionCategories, tool);
+    if (!category.ok)
+        return category;
+    const operation = readNonEmptyString(record.value, 'operation', tool);
+    if (!operation.ok)
+        return operation;
+    const result = { runId: runId.value, category: category.value, operation: operation.value };
+    const copied = copyOptionalStrings(result, record.value, tool, ['workspaceRoot', 'targetPath', 'providerToolName']);
+    if (!copied.ok)
+        return copied;
+    const sandboxStrategy = readOptionalOneOf(record.value, 'sandboxStrategy', ['worktree'], tool);
+    if (!sandboxStrategy.ok)
+        return sandboxStrategy;
+    if (sandboxStrategy.value !== undefined)
+        result.sandboxStrategy = sandboxStrategy.value;
+    const booleans = copyOptionalBooleans(result, record.value, tool, ['destructive', 'external', 'privileged', 'ambiguous']);
+    if (!booleans.ok)
+        return booleans;
+    if (record.value.agent !== undefined) {
+        const agent = readPreflightAgent(record.value.agent, tool);
+        if (!agent.ok)
+            return agent;
+        result.agent = agent.value;
+    }
+    return { ok: true, value: result };
+}
+function validateRunStartInput(input, tool) {
+    const record = inputRecord(input, tool, ['project', 'userIntent', 'workflow', 'phase', 'selectedAgentId', 'providerAdapter', 'model']);
+    if (!record.ok)
+        return record;
+    const result = {};
+    const copied = copyRequiredStrings(result, record.value, tool, ['project', 'userIntent', 'workflow', 'phase', 'selectedAgentId', 'providerAdapter', 'model']);
+    if (!copied.ok)
+        return copied;
+    return { ok: true, value: result };
+}
+function validateRunCheckpointInput(input, tool) {
+    const record = inputRecord(input, tool, ['runId', 'label', 'state']);
+    if (!record.ok)
+        return record;
+    const runId = readNonEmptyString(record.value, 'runId', tool);
+    if (!runId.ok)
+        return runId;
+    const label = readNonEmptyString(record.value, 'label', tool);
+    if (!label.ok)
+        return label;
+    const state = readJsonValue(record.value, 'state', tool);
+    if (!state.ok)
+        return state;
+    return { ok: true, value: { runId: runId.value, label: label.value, state: state.value } };
+}
+function validateRunFinalizeInput(input, tool) {
+    const record = inputRecord(input, tool, ['runId', 'status', 'outcome', 'outcomeReason']);
+    if (!record.ok)
+        return record;
+    const runId = readNonEmptyString(record.value, 'runId', tool);
+    if (!runId.ok)
+        return runId;
+    const status = readRequiredOneOf(record.value, 'status', finalRunStatuses, tool);
+    if (!status.ok)
+        return status;
+    const outcome = readRequiredOneOf(record.value, 'outcome', runOutcomes, tool);
+    if (!outcome.ok)
+        return outcome;
+    const result = { runId: runId.value, status: status.value, outcome: outcome.value };
+    const copied = copyOptionalStrings(result, record.value, tool, ['outcomeReason']);
+    if (!copied.ok)
+        return copied;
+    return { ok: true, value: result };
+}
+function validationSuccess(tool, validation) {
+    if (!validation.ok)
+        return validation;
+    return { ok: true, tool, input: validation.value };
+}
+function inputRecord(input, tool, allowed) {
+    const record = asRecord(input, tool, 'Tool input must be an object');
+    if (!record.ok)
+        return record;
+    const unexpected = Object.keys(record.value).find((key) => !allowed.includes(key));
+    if (unexpected !== undefined)
+        return validationFailure(`Unexpected field: ${unexpected}`, tool);
+    return record;
+}
+function asRecord(value, tool, message) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return validationFailure(message, tool);
+    return { ok: true, value: value };
+}
+function readString(record, field, tool) {
+    const value = record[field];
+    if (typeof value !== 'string')
+        return validationFailure(`${field} must be a string`, tool);
+    return { ok: true, value };
+}
+function readNonEmptyString(record, field, tool) {
+    if (record[field] === undefined)
+        return validationFailure(`${field} is required`, tool);
+    const value = readString(record, field, tool);
+    if (!value.ok)
+        return value;
+    if (value.value.trim().length === 0)
+        return validationFailure(`${field} must not be empty`, tool);
+    return value;
+}
+function readChange(record, tool) {
+    const change = readNonEmptyString(record, 'change', tool);
+    if (!change.ok)
+        return change;
+    if (!validChangePattern.test(change.value))
+        return validationFailure(`Invalid SDD change id: ${change.value}`, tool);
+    return change;
+}
+function readPhase(record, tool) {
+    const phase = readNonEmptyString(record, 'phase', tool);
+    if (!phase.ok)
+        return phase;
+    if (!isSddPhase(phase.value))
+        return validationFailure(`phase must be one of: ${sddPhases.join(', ')}`, tool);
+    return { ok: true, value: phase.value };
+}
+function copyOptionalStrings(target, record, tool, fields) {
+    for (const field of fields) {
+        if (record[field] === undefined)
+            continue;
+        const value = readNonEmptyString(record, field, tool);
+        if (!value.ok)
+            return value;
+        target[field] = value.value;
+    }
+    return { ok: true, value: undefined };
+}
+function copyRequiredStrings(target, record, tool, fields) {
+    for (const field of fields) {
+        const value = readNonEmptyString(record, field, tool);
+        if (!value.ok)
+            return value;
+        target[field] = value.value;
+    }
+    return { ok: true, value: undefined };
+}
+function readJsonValue(record, field, tool) {
+    if (record[field] === undefined)
+        return validationFailure(`${field} is required`, tool);
+    if (!isJsonValue(record[field]))
+        return validationFailure(`${field} must be JSON-compatible`, tool);
+    return { ok: true, value: record[field] };
+}
+function isJsonValue(value) {
+    if (value === null)
+        return true;
+    if (typeof value === 'string' || typeof value === 'boolean')
+        return true;
+    if (typeof value === 'number')
+        return Number.isFinite(value);
+    if (Array.isArray(value))
+        return value.every(isJsonValue);
+    if (typeof value !== 'object')
+        return false;
+    return Object.values(value).every(isJsonValue);
+}
+function copyOptionalBooleans(target, record, tool, fields) {
+    for (const field of fields) {
+        if (record[field] === undefined)
+            continue;
+        if (typeof record[field] !== 'boolean')
+            return validationFailure(`${field} must be a boolean`, tool);
+        target[field] = record[field];
+    }
+    return { ok: true, value: undefined };
+}
+function readPreflightAgent(value, tool) {
+    const record = asRecord(value, tool, 'agent must be an object');
+    if (!record.ok)
+        return record;
+    const unexpected = Object.keys(record.value).find((key) => !['id', 'name', 'mode', 'permissions'].includes(key));
+    if (unexpected !== undefined)
+        return validationFailure(`Unexpected agent field: ${unexpected}`, tool);
+    const id = readNonEmptyString(record.value, 'id', tool);
+    if (!id.ok)
+        return id;
+    const mode = readRequiredOneOf(record.value, 'mode', agentModes, tool);
+    if (!mode.ok)
+        return mode;
+    const agent = { id: id.value, name: id.value, mode: mode.value, permissions: {} };
+    const name = copyOptionalStrings(agent, record.value, tool, ['name']);
+    if (!name.ok)
+        return name;
+    if (record.value.permissions !== undefined) {
+        const permissions = readPreflightAgentPermissions(record.value.permissions, tool);
+        if (!permissions.ok)
+            return permissions;
+        agent.permissions = permissions.value;
+    }
+    return { ok: true, value: agent };
+}
+function readPreflightAgentPermissions(value, tool) {
+    const record = asRecord(value, tool, 'agent.permissions must be an object');
+    if (!record.ok)
+        return record;
+    const permissions = {};
+    for (const [category, decision] of Object.entries(record.value)) {
+        if (!permissionCategories.includes(category))
+            return validationFailure(`agent.permissions category must be one of: ${permissionCategories.join(', ')}`, tool);
+        if (typeof decision !== 'string' || !permissionDecisions.includes(decision))
+            return validationFailure(`agent.permissions.${category} must be one of: ${permissionDecisions.join(', ')}`, tool);
+        permissions[category] = decision;
+    }
+    return { ok: true, value: permissions };
+}
+function copyOptionalLimitedStrings(target, record, tool, fields, maxLength) {
+    for (const field of fields) {
+        if (record[field] === undefined)
+            continue;
+        const value = readLimitedNonEmptyString(record, field, tool, maxLength);
+        if (!value.ok)
+            return value;
+        target[field] = value.value;
+    }
+    return { ok: true, value: undefined };
+}
+function readLimitedNonEmptyString(record, field, tool, maxLength) {
+    const value = readNonEmptyString(record, field, tool);
+    if (!value.ok)
+        return value;
+    if (maxLength !== undefined && value.value.length > maxLength)
+        return validationFailure(`${field} must be ${maxLength} characters or fewer`, tool);
+    return value;
+}
+function readRequiredOneOf(record, field, values, tool) {
+    const value = readNonEmptyString(record, field, tool);
+    if (!value.ok)
+        return value;
+    if (!values.includes(value.value))
+        return validationFailure(`${field} must be one of: ${values.join(', ')}`, tool);
+    return { ok: true, value: value.value };
+}
+function readOptionalOneOf(record, field, values, tool) {
+    if (record[field] === undefined)
+        return { ok: true, value: undefined };
+    const value = readNonEmptyString(record, field, tool);
+    if (!value.ok)
+        return value;
+    if (!values.includes(value.value))
+        return validationFailure(`${field} must be one of: ${values.join(', ')}`, tool);
+    return { ok: true, value: value.value };
+}
+function readOptionalTopicKey(record, tool) {
+    if (record.topicKey === undefined)
+        return { ok: true, value: undefined };
+    const topicKey = readLimitedNonEmptyString(record, 'topicKey', tool, maxMemoryTopicKeyLength);
+    if (!topicKey.ok)
+        return topicKey;
+    if (!validMemoryTopicKeyPattern.test(topicKey.value))
+        return validationFailure('topicKey must contain only letters, numbers, dots, underscores, slashes, or hyphens', tool);
+    return topicKey;
+}
+function readMemorySearchLimit(record, tool) {
+    return readBoundedLimit(record, tool);
+}
+function readBoundedLimit(record, tool) {
+    if (record.limit === undefined)
+        return validationFailure('limit is required', tool);
+    const limit = record.limit;
+    if (typeof limit !== 'number' || !Number.isSafeInteger(limit) || limit < 1 || limit > 100)
+        return validationFailure('limit must be between 1 and 100', tool);
+    return { ok: true, value: limit };
+}
+function readOptionalStringArray(record, field, tool) {
+    if (record[field] === undefined)
+        return { ok: true, value: undefined };
+    if (!Array.isArray(record[field]))
+        return validationFailure(`${field} must be an array`, tool);
+    const values = record[field];
+    const result = [];
+    for (const [index, item] of values.entries()) {
+        if (typeof item !== 'string')
+            return validationFailure(`${field}[${index}] must be a string`, tool);
+        if (item.trim().length === 0)
+            return validationFailure(`${field}[${index}] must not be empty`, tool);
+        result.push(item);
+    }
+    return { ok: true, value: result };
+}
+function validationFailure(message, tool) {
+    return errorEnvelope('validation_failed', message, tool);
+}
+function toValidationResultFailure(failure) {
+    return failure;
+}