vgxness 1.20.4 → 1.20.6

package/dist/mcp/validation.js

@@ -1,2239 +1 @@
-import { isRiskyPermissionCategory, permissionCategories } from '../permissions/schema.js';
-import { parseOperationRetryPolicy } from '../runs/operation-retry.js';
-import { normalizeSddPhaseInput, sddPhases } from '../sdd/schema.js';
-import { workflowIds } from '../workflows/schema.js';
-import { commandAllowlistIds } from '../workflows/command-allowlist-adapter.js';
-import { supportedTypeMessage, verificationChangeTypes } from '../verification/index.js';
-import { errorEnvelope, isVgxMcpToolName, } from './schema.js';
-const scopes = ['project', 'personal'];
-const agentModes = ['agent', 'subagent'];
-const memoryTypes = ['architecture', 'decision', 'bugfix', 'pattern', 'config', 'discovery', 'learning', 'preference', 'manual'];
-const activityKinds = ['prompt', 'tool_call', 'artifact', 'summary', 'error'];
-const runStatuses = ['created', 'planned', 'running', 'needs-human', 'completed', 'failed', 'blocked', 'cancelled'];
-const taskGrantStatuses = ['active', 'revoked', 'expired', 'exhausted'];
-const taskGrantCategories = ['shell', 'test-run', 'git'];
-const finalRunStatuses = ['completed', 'failed', 'blocked', 'cancelled'];
-const runOutcomes = ['success', 'partial', 'failure', 'blocked', 'cancelled'];
-const permissionDecisions = ['allow', 'ask', 'deny'];
-const payloadModes = ['compact', 'verbose'];
-const contextCockpitLevels = ['compact', 'expanded', 'verbose'];
-const skillVersionStatuses = ['draft', 'active', 'deprecated', 'archived'];
-const skillImprovementProposalStatuses = ['draft', 'pending-approval', 'approved', 'rejected', 'cancelled', 'applied'];
-const skillEvaluationRequestStatuses = ['requested', 'planned', 'running', 'completed', 'failed', 'cancelled', 'skipped'];
-const skillSourceKinds = ['path', 'url', 'inline'];
-const skillUsageOutcomes = ['selected', 'injected', 'helped', 'failed', 'neutral'];
-const skillAttachmentTargetTypes = ['agent', 'subagent', 'workflow-phase', 'provider-adapter', 'intent-signal'];
-const providerChangePlanProviders = ['opencode', 'claude', 'antigravity', 'custom'];
-const providerChangePlanTypes = ['opencode-mcp-install', 'claude-mcp-install', 'setup', 'install', 'config-preparation'];
-const providerInstallTargets = ['user-global'];
-const providerUserGlobalOnlyMigrationMessage = 'VGX-managed provider configuration is user-global only for OpenCode and Claude. Project/local provider files are treated as external/manual diagnostics and will not be written by VGXNESS. Use installTarget: user-global.';
-const validChangePattern = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
-const validMemoryTopicKeyPattern = /^[A-Za-z0-9][A-Za-z0-9._/-]*$/;
-const maxMemoryTitleLength = 200;
-const maxMemoryContentLength = 20_000;
-const maxMemoryTopicKeyLength = 200;
-export function validateVgxMcpToolCall(call) {
-    const envelope = asRecord(call, undefined, 'Tool call must be an object');
-    if (!envelope.ok)
-        return toValidationResultFailure(envelope);
-    const tool = readString(envelope.value, 'tool', undefined);
-    if (!tool.ok)
-        return toValidationResultFailure(tool);
-    if (!isVgxMcpToolName(tool.value))
-        return toValidationResultFailure(validationFailure(`Unsupported MCP control-plane tool: ${tool.value}`));
-    const input = envelope.value.input;
-    switch (tool.value) {
-        case 'vgxness_sdd_status':
-            return validationSuccess(tool.value, validateSddStatusInput(input, tool.value));
-        case 'vgxness_sdd_ready':
-            return validationSuccess(tool.value, validateSddReadyInput(input, tool.value));
-        case 'vgxness_sdd_get_readiness':
-            return validationSuccess(tool.value, validateSddGetReadinessInput(input, tool.value));
-        case 'vgxness_sdd_save_artifact':
-            return validationSuccess(tool.value, validateSddSaveArtifactInput(input, tool.value));
-        case 'vgxness_sdd_accept_artifact':
-            return validationSuccess(tool.value, validateSddAcceptArtifactInput(input, tool.value));
-        case 'vgxness_sdd_reopen_artifact':
-            return validationSuccess(tool.value, validateSddReopenArtifactInput(input, tool.value));
-        case 'vgxness_sdd_get_artifact':
-            return validationSuccess(tool.value, validateSddGetArtifactInput(input, tool.value));
-        case 'vgxness_sdd_list_artifacts':
-            return validationSuccess(tool.value, validateSddListArtifactsInput(input, tool.value));
-        case 'vgxness_sdd_next':
-            return validationSuccess(tool.value, validateSddNextInput(input, tool.value));
-        case 'vgxness_sdd_cockpit':
-            return validationSuccess(tool.value, validateSddCockpitInput(input, tool.value));
-        case 'vgxness_sdd_continue':
-            return validationSuccess(tool.value, validateSddContinueInput(input, tool.value));
-        case 'vgxness_governance_report':
-            return validationSuccess(tool.value, validateGovernanceReportInput(input, tool.value));
-        case 'vgxness_memory_save':
-            return validationSuccess(tool.value, validateMemorySaveInput(input, tool.value));
-        case 'vgxness_memory_search':
-            return validationSuccess(tool.value, validateMemorySearchInput(input, tool.value));
-        case 'vgxness_memory_get':
-            return validationSuccess(tool.value, validateMemoryGetInput(input, tool.value));
-        case 'vgxness_memory_update':
-            return validationSuccess(tool.value, validateMemoryUpdateInput(input, tool.value));
-        case 'vgxness_session_start':
-            return validationSuccess(tool.value, validateSessionStartInput(input, tool.value));
-        case 'vgxness_session_append_activity':
-            return validationSuccess(tool.value, validateSessionAppendActivityInput(input, tool.value));
-        case 'vgxness_session_close':
-            return validationSuccess(tool.value, validateSessionCloseInput(input, tool.value));
-        case 'vgxness_session_restore':
-            return validationSuccess(tool.value, validateSessionRestoreInput(input, tool.value));
-        case 'vgxness_context_cockpit':
-            return validationSuccess(tool.value, validateContextCockpitInput(input, tool.value));
-        case 'vgxness_resume_context':
-            return validationSuccess(tool.value, validateResumeContextInput(input, tool.value));
-        case 'vgxness_agent_resolve':
-            return validationSuccess(tool.value, validateAgentResolveInput(input, tool.value));
-        case 'vgxness_agent_activate':
-            return validationSuccess(tool.value, validateAgentActivateInput(input, tool.value));
-        case 'vgxness_manager_profile_get':
-            return validationSuccess(tool.value, validateManagerProfileGetInput(input, tool.value));
-        case 'vgxness_manager_profile_set':
-            return validationSuccess(tool.value, validateManagerProfileSetInput(input, tool.value));
-        case 'vgxness_skill_index':
-            return validationSuccess(tool.value, validateSkillIndexInput(input, tool.value));
-        case 'vgxness_skill_search':
-            return validationSuccess(tool.value, validateSkillSearchInput(input, tool.value));
-        case 'vgxness_skill_get':
-            return validationSuccess(tool.value, validateSkillGetInput(input, tool.value));
-        case 'vgxness_skill_status':
-            return validationSuccess(tool.value, validateSkillStatusInput(input, tool.value));
-        case 'vgxness_skill_payload':
-            return validationSuccess(tool.value, validateSkillPayloadInput(input, tool.value));
-        case 'vgxness_skill_activate':
-            return validationSuccess(tool.value, validateSkillActivateInput(input, tool.value));
-        case 'vgxness_skill_record_usage':
-            return validationSuccess(tool.value, validateSkillRecordUsageInput(input, tool.value));
-        case 'vgxness_skill_propose_improvement':
-            return validationSuccess(tool.value, validateSkillProposeImprovementInput(input, tool.value));
-        case 'vgxness_skill_list_improvement_proposals':
-            return validationSuccess(tool.value, validateSkillListImprovementProposalsInput(input, tool.value));
-        case 'vgxness_skill_request_evaluation':
-            return validationSuccess(tool.value, validateSkillRequestEvaluationInput(input, tool.value));
-        case 'vgxness_skill_list_evaluations':
-            return validationSuccess(tool.value, validateSkillListEvaluationsInput(input, tool.value));
-        case 'vgxness_skill_get_evaluation':
-            return validationSuccess(tool.value, validateSkillGetEvaluationInput(input, tool.value));
-        case 'vgxness_skill_create_draft':
-            return validationSuccess(tool.value, validateSkillCreateDraftInput(input, tool.value));
-        case 'vgxness_skill_update_draft':
-            return validationSuccess(tool.value, validateSkillUpdateDraftInput(input, tool.value));
-        case 'vgxness_skill_publish_version':
-            return validationSuccess(tool.value, validateSkillPublishVersionInput(input, tool.value));
-        case 'vgxness_opencode_manager_payload':
-            return validationSuccess(tool.value, validateOpenCodeManagerPayloadInput(input, tool.value));
-        case 'vgxness_opencode_handoff_preview':
-            return validationSuccess(tool.value, validateOpenCodeHandoffPreviewInput(input, tool.value));
-        case 'vgxness_run_list':
-            return validationSuccess(tool.value, validateRunListInput(input, tool.value));
-        case 'vgxness_run_get':
-            return validationSuccess(tool.value, validateRunGetInput(input, tool.value));
-        case 'vgxness_run_preflight':
-            return validationSuccess(tool.value, validateRunPreflightInput(input, tool.value));
-        case 'vgxness_run_task_grant_create':
-            return validationSuccess(tool.value, validateRunTaskGrantCreateInput(input, tool.value));
-        case 'vgxness_run_task_grant_list':
-            return validationSuccess(tool.value, validateRunTaskGrantListInput(input, tool.value));
-        case 'vgxness_run_task_grant_get':
-            return validationSuccess(tool.value, validateRunTaskGrantGetInput(input, tool.value));
-        case 'vgxness_run_task_grant_revoke':
-            return validationSuccess(tool.value, validateRunTaskGrantRevokeInput(input, tool.value));
-        case 'vgxness_run_task_grant_preview_match':
-            return validationSuccess(tool.value, validateRunTaskGrantPreviewMatchInput(input, tool.value));
-        case 'vgxness_run_start':
-            return validationSuccess(tool.value, validateRunStartInput(input, tool.value));
-        case 'vgxness_run_checkpoint':
-            return validationSuccess(tool.value, validateRunCheckpointInput(input, tool.value));
-        case 'vgxness_run_finalize':
-            return validationSuccess(tool.value, validateRunFinalizeInput(input, tool.value));
-        case 'vgxness_run_resume_candidates':
-            return validationSuccess(tool.value, validateRunResumeCandidatesInput(input, tool.value));
-        case 'vgxness_run_resume_inspect':
-            return validationSuccess(tool.value, validateRunResumeInspectInput(input, tool.value));
-        case 'vgxness_run_resume_gate':
-            return validationSuccess(tool.value, validateRunResumeGateInput(input, tool.value));
-        case 'vgxness_provider_status':
-            return validationSuccess(tool.value, validateProviderHealthInput(input, tool.value));
-        case 'vgxness_provider_doctor':
-            return validationSuccess(tool.value, validateProviderHealthInput(input, tool.value));
-        case 'vgxness_provider_change_plan':
-            return validationSuccess(tool.value, validateProviderChangePlanInput(input, tool.value));
-        case 'vgxness_verification_plan':
-            return validationSuccess(tool.value, validateVerificationPlanInput(input, tool.value));
-    }
-}
-function validateVerificationPlanInput(input, tool) {
-    const record = inputRecord(input, tool, ['changeType']);
-    if (!record.ok)
-        return record;
-    const changeType = readVerificationChangeType(record.value, tool);
-    if (!changeType.ok)
-        return changeType;
-    return { ok: true, value: { changeType: changeType.value } };
-}
-function readVerificationChangeType(record, tool) {
-    if (record.changeType === undefined)
-        return validationFailure(supportedTypeMessage('changeType is required'), tool);
-    const value = readString(record, 'changeType', tool);
-    if (!value.ok)
-        return value;
-    const trimmed = value.value.trim();
-    if (trimmed.length === 0)
-        return validationFailure(supportedTypeMessage('changeType must not be empty'), tool);
-    if (!verificationChangeTypes.includes(trimmed))
-        return validationFailure(supportedTypeMessage(`Unsupported changeType: ${trimmed}`), tool);
-    return { ok: true, value: trimmed };
-}
-function validateProviderChangePlanInput(input, tool) {
-    const record = inputRecord(input, tool, ['project', 'scope', 'installTarget', 'provider', 'changeType', 'workspaceRoot', 'payloadMode']);
-    if (!record.ok)
-        return record;
-    const provider = readRequiredOneOf(record.value, 'provider', providerChangePlanProviders, tool);
-    if (!provider.ok)
-        return provider;
-    const changeType = readRequiredOneOf(record.value, 'changeType', providerChangePlanTypes, tool);
-    if (!changeType.ok)
-        return changeType;
-    const workspaceRoot = readNonEmptyString(record.value, 'workspaceRoot', tool);
-    if (!workspaceRoot.ok)
-        return workspaceRoot;
-    const payloadMode = readRequiredOneOf(record.value, 'payloadMode', payloadModes, tool);
-    if (!payloadMode.ok)
-        return payloadMode;
-    const result = {
-        provider: provider.value,
-        changeType: changeType.value,
-        workspaceRoot: workspaceRoot.value,
-        payloadMode: payloadMode.value,
-    };
-    const project = readOptionalNonEmptyString(record.value, 'project', tool);
-    if (!project.ok)
-        return project;
-    if (project.value !== undefined)
-        result.project = project.value;
-    const scope = readOptionalOneOf(record.value, 'scope', scopes, tool);
-    if (!scope.ok)
-        return scope;
-    if (scope.value !== undefined)
-        result.scope = scope.value;
-    if (typeof record.value.installTarget === 'string' && record.value.installTarget.trim() !== 'user-global') {
-        return validationFailure(providerUserGlobalOnlyMigrationMessage, tool);
-    }
-    const installTarget = readOptionalOneOf(record.value, 'installTarget', providerInstallTargets, tool);
-    if (!installTarget.ok)
-        return installTarget;
-    if (installTarget.value !== undefined)
-        result.installTarget = installTarget.value;
-    return { ok: true, value: result };
-}
-function validateProviderHealthInput(input, tool) {
-    const record = inputRecord(input ?? {}, tool, [
-        'project',
-        'scope',
-        'providerAdapter',
-        'workspaceRoot',
-        'change',
-        'expectedPromptContractVersion',
-        'payloadMode',
-    ]);
-    if (!record.ok)
-        return record;
-    const result = {};
-    const project = readOptionalNonEmptyString(record.value, 'project', tool);
-    if (!project.ok)
-        return project;
-    if (project.value !== undefined)
-        result.project = project.value;
-    const scope = readOptionalOneOf(record.value, 'scope', scopes, tool);
-    if (!scope.ok)
-        return scope;
-    if (scope.value !== undefined)
-        result.scope = scope.value;
-    const providerAdapter = readOptionalOneOf(record.value, 'providerAdapter', ['opencode', 'claude'], tool);
-    if (!providerAdapter.ok)
-        return providerAdapter;
-    if (providerAdapter.value !== undefined)
-        result.providerAdapter = providerAdapter.value;
-    const workspaceRoot = readOptionalNonEmptyString(record.value, 'workspaceRoot', tool);
-    if (!workspaceRoot.ok)
-        return workspaceRoot;
-    if (workspaceRoot.value !== undefined)
-        result.workspaceRoot = workspaceRoot.value;
-    const change = readOptionalNonEmptyString(record.value, 'change', tool);
-    if (!change.ok)
-        return change;
-    if (change.value !== undefined)
-        result.change = change.value;
-    const expectedPromptContractVersion = record.value.expectedPromptContractVersion;
-    if (expectedPromptContractVersion !== undefined) {
-        if (typeof expectedPromptContractVersion !== 'number' || !Number.isSafeInteger(expectedPromptContractVersion) || expectedPromptContractVersion <= 0)
-            return validationFailure('expectedPromptContractVersion must be a positive safe integer', tool);
-        result.expectedPromptContractVersion = expectedPromptContractVersion;
-    }
-    const payloadMode = readOptionalOneOf(record.value, 'payloadMode', payloadModes, tool);
-    if (!payloadMode.ok)
-        return payloadMode;
-    if (payloadMode.value !== undefined)
-        result.payloadMode = payloadMode.value;
-    return { ok: true, value: result };
-}
-export function validateVgxMcpToolInput(tool, input) {
-    return validateVgxMcpToolCall({ tool, input });
-}
-function validateSddStatusInput(input, tool) {
-    const record = inputRecord(input, tool, ['project', 'change']);
-    if (!record.ok)
-        return record;
-    return readProjectAndChange(record.value, tool);
-}
-function validateSddNextInput(input, tool) {
-    const record = inputRecord(input, tool, ['project', 'change']);
-    if (!record.ok)
-        return record;
-    return readProjectAndChange(record.value, tool);
-}
-function validateSddCockpitInput(input, tool) {
-    const record = inputRecord(input, tool, ['project', 'change']);
-    if (!record.ok)
-        return record;
-    return readProjectAndChange(record.value, tool);
-}
-function validateSddContinueInput(input, tool) {
-    const record = inputRecord(input, tool, ['project', 'change', 'payloadMode']);
-    if (!record.ok)
-        return record;
-    const base = readProjectAndChange(record.value, tool);
-    if (!base.ok)
-        return base;
-    const payloadMode = readOptionalOneOf(record.value, 'payloadMode', payloadModes, tool);
-    if (!payloadMode.ok)
-        return payloadMode;
-    const result = { ...base.value };
-    if (payloadMode.value !== undefined)
-        result.payloadMode = payloadMode.value;
-    return { ok: true, value: result };
-}
-function validateContextCockpitInput(input, tool) {
-    const record = inputRecord(input, tool, ['project', 'change', 'directory', 'limit', 'level']);
-    if (!record.ok)
-        return record;
-    const project = readNonEmptyString(record.value, 'project', tool);
-    if (!project.ok)
-        return project;
-    const result = { project: project.value };
-    const change = readOptionalContextCockpitChange(record.value, tool);
-    if (!change.ok)
-        return change;
-    if (change.value !== undefined)
-        result.change = change.value;
-    const directory = readOptionalNonEmptyString(record.value, 'directory', tool);
-    if (!directory.ok)
-        return directory;
-    if (directory.value !== undefined)
-        result.directory = directory.value;
-    if (record.value.limit !== undefined) {
-        if (typeof record.value.limit !== 'number' || !Number.isSafeInteger(record.value.limit) || record.value.limit < 1 || record.value.limit > 100)
-            return validationFailure('limit must be an integer between 1 and 100', tool);
-        result.limit = record.value.limit;
-    }
-    const level = readOptionalOneOf(record.value, 'level', contextCockpitLevels, tool);
-    if (!level.ok)
-        return level;
-    if (level.value !== undefined)
-        result.level = level.value;
-    return { ok: true, value: result };
-}
-function validateResumeContextInput(input, tool) {
-    const record = inputRecord(input, tool, ['project', 'directory', 'workspaceRoot', 'userPrompt', 'explicitChange', 'limit', 'payloadMode']);
-    if (!record.ok)
-        return record;
-    const project = readNonEmptyString(record.value, 'project', tool);
-    if (!project.ok)
-        return project;
-    const result = { project: project.value };
-    const directory = readOptionalNonEmptyString(record.value, 'directory', tool);
-    if (!directory.ok)
-        return directory;
-    if (directory.value !== undefined)
-        result.directory = directory.value;
-    const workspaceRoot = readOptionalNonEmptyString(record.value, 'workspaceRoot', tool);
-    if (!workspaceRoot.ok)
-        return workspaceRoot;
-    if (workspaceRoot.value !== undefined)
-        result.workspaceRoot = workspaceRoot.value;
-    if (record.value.userPrompt !== undefined) {
-        if (typeof record.value.userPrompt !== 'string')
-            return validationFailure('userPrompt must be a string', tool);
-        result.userPrompt = record.value.userPrompt;
-    }
-    const explicitChange = readOptionalExplicitChange(record.value, tool);
-    if (!explicitChange.ok)
-        return explicitChange;
-    if (explicitChange.value !== undefined)
-        result.explicitChange = explicitChange.value;
-    if (record.value.limit !== undefined) {
-        if (typeof record.value.limit !== 'number' || !Number.isSafeInteger(record.value.limit) || record.value.limit < 1 || record.value.limit > 25)
-            return validationFailure('limit must be an integer between 1 and 25', tool);
-        result.limit = record.value.limit;
-    }
-    const payloadMode = readOptionalOneOf(record.value, 'payloadMode', payloadModes, tool);
-    if (!payloadMode.ok)
-        return payloadMode;
-    result.payloadMode = payloadMode.value ?? 'compact';
-    return { ok: true, value: result };
-}
-function readProjectAndChange(record, tool) {
-    const project = readNonEmptyString(record, 'project', tool);
-    if (!project.ok)
-        return project;
-    const change = readChange(record, tool);
-    if (!change.ok)
-        return change;
-    return { ok: true, value: { project: project.value, change: change.value } };
-}
-function validateSddReadyInput(input, tool) {
-    const record = inputRecord(input, tool, ['project', 'change', 'phase', 'runId', 'agentId']);
-    if (!record.ok)
-        return record;
-    const base = readProjectAndChange(record.value, tool);
-    if (!base.ok)
-        return base;
-    const phase = readPhase(record.value, tool);
-    if (!phase.ok)
-        return phase;
-    const result = { ...base.value, phase: phase.value };
-    const copied = copyOptionalStrings(result, record.value, tool, ['runId', 'agentId']);
-    if (!copied.ok)
-        return copied;
-    return { ok: true, value: result };
-}
-function validateSddGetReadinessInput(input, tool) {
-    return validateSddReadyInput(input, tool);
-}
-function validateSddSaveArtifactInput(input, tool) {
-    const record = inputRecord(input, tool, ['project', 'change', 'phase', 'content']);
-    if (!record.ok)
-        return record;
-    const base = readProjectAndChange(record.value, tool);
-    if (!base.ok)
-        return base;
-    const phase = readPhase(record.value, tool);
-    if (!phase.ok)
-        return phase;
-    const content = readNonEmptyString(record.value, 'content', tool);
-    if (!content.ok)
-        return content;
-    return { ok: true, value: { ...base.value, phase: phase.value, content: content.value } };
-}
-function validateSddAcceptArtifactInput(input, tool) {
-    const record = inputRecord(input, tool, ['project', 'change', 'phase', 'acceptedBy', 'acceptedAt', 'note', 'runId', 'agentId']);
-    if (!record.ok)
-        return record;
-    const base = readProjectAndChange(record.value, tool);
-    if (!base.ok)
-        return base;
-    const phase = readPhase(record.value, tool);
-    if (!phase.ok)
-        return phase;
-    const acceptedByRecord = asRecord(record.value.acceptedBy, tool, 'acceptedBy is required');
-    if (!acceptedByRecord.ok)
-        return acceptedByRecord;
-    const acceptedByExtra = Object.keys(acceptedByRecord.value).find((key) => !['type', 'id', 'displayName'].includes(key));
-    if (acceptedByExtra !== undefined)
-        return validationFailure(`Unexpected field: acceptedBy.${acceptedByExtra}`, tool);
-    const type = readRequiredOneOf(acceptedByRecord.value, 'type', ['human'], tool);
-    if (!type.ok)
-        return type;
-    const id = readNonEmptyString(acceptedByRecord.value, 'id', tool);
-    if (!id.ok)
-        return id;
-    const displayName = readOptionalNonEmptyString(acceptedByRecord.value, 'displayName', tool);
-    if (!displayName.ok)
-        return displayName;
-    const acceptedBy = { type: type.value, id: id.value };
-    if (displayName.value !== undefined)
-        acceptedBy.displayName = displayName.value;
-    const result = { ...base.value, phase: phase.value, acceptedBy };
-    const copied = copyOptionalLimitedStrings(result, record.value, tool, ['acceptedAt', 'note', 'runId', 'agentId'], undefined);
-    if (!copied.ok)
-        return copied;
-    return { ok: true, value: result };
-}
-function validateSddReopenArtifactInput(input, tool) {
-    const record = inputRecord(input, tool, ['project', 'change', 'phase', 'reopenedBy', 'reopenedAt', 'note', 'runId', 'agentId']);
-    if (!record.ok)
-        return record;
-    const base = readProjectAndChange(record.value, tool);
-    if (!base.ok)
-        return base;
-    const phase = readPhase(record.value, tool);
-    if (!phase.ok)
-        return phase;
-    const reopenedByRecord = asRecord(record.value.reopenedBy, tool, 'reopenedBy is required');
-    if (!reopenedByRecord.ok)
-        return reopenedByRecord;
-    const reopenedByExtra = Object.keys(reopenedByRecord.value).find((key) => !['type', 'id', 'displayName'].includes(key));
-    if (reopenedByExtra !== undefined)
-        return validationFailure(`Unexpected field: reopenedBy.${reopenedByExtra}`, tool);
-    const type = readRequiredOneOf(reopenedByRecord.value, 'type', ['human'], tool);
-    if (!type.ok)
-        return type;
-    const id = readNonEmptyString(reopenedByRecord.value, 'id', tool);
-    if (!id.ok)
-        return id;
-    const displayName = readOptionalNonEmptyString(reopenedByRecord.value, 'displayName', tool);
-    if (!displayName.ok)
-        return displayName;
-    const reopenedBy = { type: type.value, id: id.value };
-    if (displayName.value !== undefined)
-        reopenedBy.displayName = displayName.value;
-    const result = { ...base.value, phase: phase.value, reopenedBy };
-    const copied = copyOptionalLimitedStrings(result, record.value, tool, ['reopenedAt', 'note', 'runId', 'agentId'], undefined);
-    if (!copied.ok)
-        return copied;
-    return { ok: true, value: result };
-}
-function validateSddGetArtifactInput(input, tool) {
-    const record = inputRecord(input, tool, ['project', 'change', 'phase', 'payloadMode']);
-    if (!record.ok)
-        return record;
-    const base = readProjectAndChange(record.value, tool);
-    if (!base.ok)
-        return base;
-    const phase = readPhase(record.value, tool);
-    if (!phase.ok)
-        return phase;
-    const payloadMode = readOptionalOneOf(record.value, 'payloadMode', payloadModes, tool);
-    if (!payloadMode.ok)
-        return payloadMode;
-    const result = { ...base.value, phase: phase.value };
-    if (payloadMode.value !== undefined)
-        result.payloadMode = payloadMode.value;
-    return { ok: true, value: result };
-}
-function validateSddListArtifactsInput(input, tool) {
-    const record = inputRecord(input, tool, ['project', 'change', 'payloadMode']);
-    if (!record.ok)
-        return record;
-    const base = readProjectAndChange(record.value, tool);
-    if (!base.ok)
-        return base;
-    const payloadMode = readOptionalOneOf(record.value, 'payloadMode', payloadModes, tool);
-    if (!payloadMode.ok)
-        return payloadMode;
-    const result = { ...base.value };
-    if (payloadMode.value !== undefined)
-        result.payloadMode = payloadMode.value;
-    return { ok: true, value: result };
-}
-function validateGovernanceReportInput(input, tool) {
-    const record = inputRecord(input, tool, ['project', 'change', 'runId', 'workflow', 'phase', 'agentId', 'payloadMode', 'agent']);
-    if (!record.ok)
-        return record;
-    const project = readNonEmptyString(record.value, 'project', tool);
-    if (!project.ok)
-        return project;
-    const result = { project: project.value };
-    const copied = copyOptionalLimitedStrings(result, record.value, tool, ['change', 'runId', 'workflow', 'phase', 'agentId'], undefined);
-    if (!copied.ok)
-        return copied;
-    const payloadMode = readOptionalOneOf(record.value, 'payloadMode', payloadModes, tool);
-    if (!payloadMode.ok)
-        return payloadMode;
-    if (payloadMode.value !== undefined)
-        result.payloadMode = payloadMode.value;
-    if (record.value.agent !== undefined) {
-        const agent = readGovernanceAgent(record.value.agent, tool);
-        if (!agent.ok)
-            return agent;
-        result.agent = agent.value;
-    }
-    return { ok: true, value: result };
-}
-function readGovernanceAgent(value, tool) {
-    const record = asRecord(value, tool, 'agent must be an object');
-    if (!record.ok)
-        return record;
-    const unexpected = Object.keys(record.value).find((key) => !['id', 'name', 'mode', 'scope'].includes(key));
-    if (unexpected !== undefined)
-        return validationFailure(`Unexpected agent field: ${unexpected}`, tool);
-    const agent = {};
-    const copied = copyOptionalLimitedStrings(agent, record.value, tool, ['id', 'name'], undefined);
-    if (!copied.ok)
-        return copied;
-    const mode = readOptionalOneOf(record.value, 'mode', agentModes, tool);
-    if (!mode.ok)
-        return mode;
-    if (mode.value !== undefined)
-        agent.mode = mode.value;
-    const scope = readOptionalOneOf(record.value, 'scope', scopes, tool);
-    if (!scope.ok)
-        return scope;
-    if (scope.value !== undefined)
-        agent.scope = scope.value;
-    if (Object.keys(agent).length === 0)
-        return validationFailure('agent must include at least one of: id, name, mode, scope', tool);
-    return { ok: true, value: agent };
-}
-function validateMemorySaveInput(input, tool) {
-    const record = inputRecord(input, tool, ['project', 'scope', 'type', 'title', 'content', 'topicKey']);
-    if (!record.ok)
-        return record;
-    const project = readLimitedNonEmptyString(record.value, 'project', tool, undefined);
-    if (!project.ok)
-        return project;
-    const scope = readOptionalOneOf(record.value, 'scope', scopes, tool);
-    if (!scope.ok)
-        return scope;
-    const type = readRequiredOneOf(record.value, 'type', memoryTypes, tool);
-    if (!type.ok)
-        return type;
-    const title = readLimitedNonEmptyString(record.value, 'title', tool, maxMemoryTitleLength);
-    if (!title.ok)
-        return title;
-    const content = readLimitedNonEmptyString(record.value, 'content', tool, maxMemoryContentLength);
-    if (!content.ok)
-        return content;
-    const topicKey = readOptionalTopicKey(record.value, tool);
-    if (!topicKey.ok)
-        return topicKey;
-    const result = { project: project.value, scope: scope.value ?? 'project', type: type.value, title: title.value, content: content.value };
-    if (topicKey.value !== undefined)
-        result.topicKey = topicKey.value;
-    return { ok: true, value: result };
-}
-function validateMemorySearchInput(input, tool) {
-    const record = inputRecord(input, tool, ['project', 'scope', 'type', 'topicKey', 'query', 'limit']);
-    if (!record.ok)
-        return record;
-    const result = {};
-    const copied = copyOptionalLimitedStrings(result, record.value, tool, ['project', 'query'], undefined);
-    if (!copied.ok)
-        return copied;
-    const scope = readOptionalOneOf(record.value, 'scope', scopes, tool);
-    if (!scope.ok)
-        return scope;
-    if (scope.value !== undefined)
-        result.scope = scope.value;
-    const type = readOptionalOneOf(record.value, 'type', memoryTypes, tool);
-    if (!type.ok)
-        return type;
-    if (type.value !== undefined)
-        result.type = type.value;
-    const topicKey = readOptionalSearchTopicKey(record.value, tool);
-    if (!topicKey.ok)
-        return topicKey;
-    if (topicKey.value !== undefined)
-        result.topicKey = topicKey.value;
-    const limit = readMemorySearchLimit(record.value, tool);
-    if (!limit.ok)
-        return limit;
-    result.limit = limit.value;
-    return { ok: true, value: result };
-}
-function validateMemoryGetInput(input, tool) {
-    const record = inputRecord(input, tool, ['id']);
-    if (!record.ok)
-        return record;
-    const id = readNonEmptyString(record.value, 'id', tool);
-    if (!id.ok)
-        return id;
-    return { ok: true, value: { id: id.value } };
-}
-function validateMemoryUpdateInput(input, tool) {
-    const record = inputRecord(input, tool, ['id', 'type', 'title', 'content', 'topicKey']);
-    if (!record.ok)
-        return record;
-    const id = readNonEmptyString(record.value, 'id', tool);
-    if (!id.ok)
-        return id;
-    const result = { id: id.value };
-    const type = readOptionalOneOf(record.value, 'type', memoryTypes, tool);
-    if (!type.ok)
-        return type;
-    if (type.value !== undefined)
-        result.type = type.value;
-    const copied = copyOptionalLimitedStrings(result, record.value, tool, ['title', 'content'], undefined);
-    if (!copied.ok)
-        return copied;
-    if (result.title !== undefined && result.title.length > maxMemoryTitleLength)
-        return validationFailure(`title must be ${maxMemoryTitleLength} characters or fewer`, tool);
-    if (result.content !== undefined && result.content.length > maxMemoryContentLength)
-        return validationFailure(`content must be ${maxMemoryContentLength} characters or fewer`, tool);
-    const topicKey = readOptionalTopicKey(record.value, tool);
-    if (!topicKey.ok)
-        return topicKey;
-    if (topicKey.value !== undefined)
-        result.topicKey = topicKey.value;
-    if (result.type === undefined && result.title === undefined && result.content === undefined && result.topicKey === undefined) {
-        return validationFailure('At least one editable field is required', tool);
-    }
-    return { ok: true, value: result };
-}
-function validateSkillIndexInput(input, tool) {
-    const record = inputRecord(input, tool, ['project', 'scope']);
-    if (!record.ok)
-        return record;
-    const project = readNonEmptyString(record.value, 'project', tool);
-    if (!project.ok)
-        return project;
-    const scope = readRequiredOneOf(record.value, 'scope', scopes, tool);
-    if (!scope.ok)
-        return scope;
-    return { ok: true, value: { project: project.value, scope: scope.value } };
-}
-function validateSkillSearchInput(input, tool) {
-    const record = inputRecord(input, tool, ['project', 'scope', 'query', 'status', 'sourceKind', 'limit']);
-    if (!record.ok)
-        return record;
-    const project = readNonEmptyString(record.value, 'project', tool);
-    if (!project.ok)
-        return project;
-    const result = { project: project.value };
-    const scope = readOptionalOneOf(record.value, 'scope', scopes, tool);
-    if (!scope.ok)
-        return scope;
-    if (scope.value !== undefined)
-        result.scope = scope.value;
-    const query = readOptionalNonEmptyString(record.value, 'query', tool);
-    if (!query.ok)
-        return query;
-    if (query.value !== undefined)
-        result.query = query.value;
-    const status = readOptionalOneOf(record.value, 'status', skillVersionStatuses, tool);
-    if (!status.ok)
-        return status;
-    if (status.value !== undefined)
-        result.status = status.value;
-    const sourceKind = readOptionalOneOf(record.value, 'sourceKind', skillSourceKinds, tool);
-    if (!sourceKind.ok)
-        return sourceKind;
-    if (sourceKind.value !== undefined)
-        result.sourceKind = sourceKind.value;
-    if (record.value.limit !== undefined) {
-        const limit = record.value.limit;
-        if (typeof limit !== 'number' || !Number.isSafeInteger(limit) || limit < 1 || limit > 100)
-            return validationFailure('limit must be an integer between 1 and 100', tool);
-        result.limit = limit;
-    }
-    return { ok: true, value: result };
-}
-function validateSkillGetInput(input, tool) {
-    const record = inputRecord(input, tool, ['project', 'scope', 'id', 'name', 'includeUsage']);
-    if (!record.ok)
-        return record;
-    const project = readNonEmptyString(record.value, 'project', tool);
-    if (!project.ok)
-        return project;
-    const result = { project: project.value };
-    const scope = readOptionalOneOf(record.value, 'scope', scopes, tool);
-    if (!scope.ok)
-        return scope;
-    if (scope.value !== undefined)
-        result.scope = scope.value;
-    const id = readOptionalNonEmptyString(record.value, 'id', tool);
-    if (!id.ok)
-        return id;
-    if (id.value !== undefined)
-        result.id = id.value;
-    const name = readOptionalNonEmptyString(record.value, 'name', tool);
-    if (!name.ok)
-        return name;
-    if (name.value !== undefined)
-        result.name = name.value;
-    if (result.id === undefined && result.name === undefined)
-        return validationFailure('Either id or name is required', tool);
-    if (record.value.includeUsage !== undefined) {
-        if (typeof record.value.includeUsage !== 'boolean')
-            return validationFailure('includeUsage must be boolean', tool);
-        result.includeUsage = record.value.includeUsage;
-    }
-    return { ok: true, value: result };
-}
-function validateSkillStatusInput(input, tool) {
-    const record = inputRecord(input, tool, ['project', 'scope', 'provider', 'mode', 'agent']);
-    if (!record.ok)
-        return record;
-    const project = readNonEmptyString(record.value, 'project', tool);
-    if (!project.ok)
-        return project;
-    const result = { project: project.value };
-    const scope = readOptionalOneOf(record.value, 'scope', scopes, tool);
-    if (!scope.ok)
-        return scope;
-    if (scope.value !== undefined)
-        result.scope = scope.value;
-    const mode = readOptionalOneOf(record.value, 'mode', agentModes, tool);
-    if (!mode.ok)
-        return mode;
-    if (mode.value !== undefined)
-        result.mode = mode.value;
-    const copied = copyOptionalStrings(result, record.value, tool, ['provider', 'agent']);
-    if (!copied.ok)
-        return copied;
-    return { ok: true, value: result };
-}
-function validateSessionStartInput(input, tool) {
-    const record = inputRecord(input, tool, ['id', 'project', 'directory']);
-    if (!record.ok)
-        return record;
-    const project = readNonEmptyString(record.value, 'project', tool);
-    if (!project.ok)
-        return project;
-    const result = { project: project.value };
-    const copied = copyOptionalStrings(result, record.value, tool, ['id', 'directory']);
-    if (!copied.ok)
-        return copied;
-    return { ok: true, value: result };
-}
-function validateSessionAppendActivityInput(input, tool) {
-    const record = inputRecord(input, tool, ['sessionId', 'actor', 'kind', 'payloadJson']);
-    if (!record.ok)
-        return record;
-    const result = {};
-    const copied = copyRequiredStrings(result, record.value, tool, ['sessionId', 'actor', 'payloadJson']);
-    if (!copied.ok)
-        return copied;
-    const kind = readRequiredOneOf(record.value, 'kind', activityKinds, tool);
-    if (!kind.ok)
-        return kind;
-    result.kind = kind.value;
-    return { ok: true, value: result };
-}
-function validateSessionCloseInput(input, tool) {
-    const record = inputRecord(input, tool, ['sessionId', 'actor', 'summary']);
-    if (!record.ok)
-        return record;
-    const result = {};
-    const copied = copyRequiredStrings(result, record.value, tool, ['sessionId', 'actor', 'summary']);
-    if (!copied.ok)
-        return copied;
-    return { ok: true, value: result };
-}
-function validateSessionRestoreInput(input, tool) {
-    const record = inputRecord(input, tool, ['project', 'directory']);
-    if (!record.ok)
-        return record;
-    const project = readNonEmptyString(record.value, 'project', tool);
-    if (!project.ok)
-        return project;
-    const result = { project: project.value };
-    const copied = copyOptionalStrings(result, record.value, tool, ['directory']);
-    if (!copied.ok)
-        return copied;
-    return { ok: true, value: result };
-}
-function validateAgentResolveInput(input, tool) {
-    const record = inputRecord(input, tool, [
-        'project',
-        'scope',
-        'taskDescription',
-        'intent',
-        'desiredCapabilities',
-        'workflow',
-        'phase',
-        'providerAdapter',
-        'mode',
-    ]);
-    if (!record.ok)
-        return record;
-    const result = {};
-    const copied = copyOptionalStrings(result, record.value, tool, ['project', 'taskDescription', 'intent', 'workflow', 'phase', 'providerAdapter']);
-    if (!copied.ok)
-        return copied;
-    const scope = readOptionalOneOf(record.value, 'scope', scopes, tool);
-    if (!scope.ok)
-        return scope;
-    if (scope.value !== undefined)
-        result.scope = scope.value;
-    const mode = readOptionalOneOf(record.value, 'mode', agentModes, tool);
-    if (!mode.ok)
-        return mode;
-    if (mode.value !== undefined)
-        result.mode = mode.value;
-    const desiredCapabilities = readOptionalStringArray(record.value, 'desiredCapabilities', tool);
-    if (!desiredCapabilities.ok)
-        return desiredCapabilities;
-    if (desiredCapabilities.value !== undefined)
-        result.desiredCapabilities = desiredCapabilities.value;
-    return { ok: true, value: result };
-}
-function validateAgentActivateInput(input, tool) {
-    const record = inputRecord(input, tool, [
-        'project',
-        'scope',
-        'agentId',
-        'userIntent',
-        'workflow',
-        'phase',
-        'workspaceRoot',
-        'maxSourceBytes',
-        'providerAdapter',
-        'payloadMode',
-    ]);
-    if (!record.ok)
-        return record;
-    const project = readNonEmptyString(record.value, 'project', tool);
-    if (!project.ok)
-        return project;
-    const userIntent = readNonEmptyString(record.value, 'userIntent', tool);
-    if (!userIntent.ok)
-        return userIntent;
-    const result = {
-        project: project.value,
-        scope: 'project',
-        userIntent: userIntent.value,
-        workflow: 'agent-activation',
-        phase: 'activation',
-    };
-    const copied = copyOptionalStrings(result, record.value, tool, ['agentId', 'workflow', 'phase', 'workspaceRoot']);
-    if (!copied.ok)
-        return copied;
-    if (record.value.providerAdapter !== undefined) {
-        const providerAdapter = readNonEmptyString(record.value, 'providerAdapter', tool);
-        if (!providerAdapter.ok)
-            return providerAdapter;
-        result.providerAdapter = providerAdapter.value.trim();
-    }
-    const scope = readOptionalOneOf(record.value, 'scope', scopes, tool);
-    if (!scope.ok)
-        return scope;
-    result.scope = scope.value ?? 'project';
-    const payloadMode = readOptionalOneOf(record.value, 'payloadMode', payloadModes, tool);
-    if (!payloadMode.ok)
-        return payloadMode;
-    if (payloadMode.value !== undefined)
-        result.payloadMode = payloadMode.value;
-    if (record.value.maxSourceBytes !== undefined) {
-        const maxSourceBytes = record.value.maxSourceBytes;
-        if (typeof maxSourceBytes !== 'number' || !Number.isSafeInteger(maxSourceBytes) || maxSourceBytes <= 0)
-            return validationFailure('maxSourceBytes must be a positive safe integer', tool);
-        result.maxSourceBytes = maxSourceBytes;
-    }
-    return { ok: true, value: result };
-}
-function validateSkillPayloadInput(input, tool) {
-    const record = inputRecord(input, tool, [
-        'workspaceRoot',
-        'maxSourceBytes',
-        'project',
-        'scope',
-        'agentId',
-        'agentName',
-        'workflow',
-        'phase',
-        'intentSignals',
-        'providerAdapter',
-        'runId',
-        'mode',
-    ]);
-    if (!record.ok)
-        return record;
-    const workspaceRoot = readNonEmptyString(record.value, 'workspaceRoot', tool);
-    if (!workspaceRoot.ok)
-        return workspaceRoot;
-    const result = { workspaceRoot: workspaceRoot.value };
-    const copied = copyOptionalStrings(result, record.value, tool, ['project', 'agentId', 'agentName', 'workflow', 'phase', 'providerAdapter', 'runId']);
-    if (!copied.ok)
-        return copied;
-    const intentSignals = readOptionalStringArray(record.value, 'intentSignals', tool);
-    if (!intentSignals.ok)
-        return intentSignals;
-    if (intentSignals.value !== undefined)
-        result.intentSignals = intentSignals.value;
-    const scope = readOptionalOneOf(record.value, 'scope', scopes, tool);
-    if (!scope.ok)
-        return scope;
-    if (scope.value !== undefined)
-        result.scope = scope.value;
-    const mode = readOptionalOneOf(record.value, 'mode', payloadModes, tool);
-    if (!mode.ok)
-        return mode;
-    if (mode.value !== undefined)
-        result.mode = mode.value;
-    if (record.value.maxSourceBytes !== undefined) {
-        const maxSourceBytes = record.value.maxSourceBytes;
-        if (typeof maxSourceBytes !== 'number' || !Number.isSafeInteger(maxSourceBytes) || maxSourceBytes <= 0)
-            return validationFailure('maxSourceBytes must be a positive safe integer', tool);
-        result.maxSourceBytes = maxSourceBytes;
-    }
-    return { ok: true, value: result };
-}
-function validateSkillActivateInput(input, tool) {
-    const record = inputRecord(input, tool, [
-        'project',
-        'scope',
-        'skillId',
-        'name',
-        'versionId',
-        'version',
-        'runId',
-        'agentId',
-        'workflow',
-        'phase',
-        'providerAdapter',
-        'intent',
-        'reason',
-        'workspaceRoot',
-        'maxSourceBytes',
-        'mode',
-    ]);
-    if (!record.ok)
-        return record;
-    const project = readNonEmptyString(record.value, 'project', tool);
-    if (!project.ok)
-        return project;
-    const result = { project: project.value };
-    const copied = copyOptionalStrings(result, record.value, tool, [
-        'skillId',
-        'name',
-        'versionId',
-        'version',
-        'runId',
-        'agentId',
-        'workflow',
-        'phase',
-        'providerAdapter',
-        'reason',
-        'workspaceRoot',
-    ]);
-    if (!copied.ok)
-        return copied;
-    if (result.skillId === undefined && result.name === undefined)
-        return validationFailure('Either skillId or name is required', tool);
-    if (result.versionId !== undefined && result.version !== undefined)
-        return validationFailure('Use either versionId or version, not both', tool);
-    const scope = readOptionalOneOf(record.value, 'scope', scopes, tool);
-    if (!scope.ok)
-        return scope;
-    if (scope.value !== undefined)
-        result.scope = scope.value;
-    const mode = readOptionalOneOf(record.value, 'mode', payloadModes, tool);
-    if (!mode.ok)
-        return mode;
-    if (mode.value !== undefined)
-        result.mode = mode.value;
-    const intent = readOptionalJsonObject(record.value, 'intent', tool);
-    if (!intent.ok)
-        return intent;
-    if (intent.value !== undefined)
-        result.intent = intent.value;
-    if (record.value.maxSourceBytes !== undefined) {
-        const maxSourceBytes = record.value.maxSourceBytes;
-        if (typeof maxSourceBytes !== 'number' || !Number.isSafeInteger(maxSourceBytes) || maxSourceBytes <= 0)
-            return validationFailure('maxSourceBytes must be a positive safe integer', tool);
-        result.maxSourceBytes = maxSourceBytes;
-    }
-    return { ok: true, value: result };
-}
-function validateSkillRecordUsageInput(input, tool) {
-    const record = inputRecord(input, tool, [
-        'skillId',
-        'versionId',
-        'runId',
-        'targetType',
-        'targetKey',
-        'outcome',
-        'notes',
-        'workflow',
-        'phase',
-        'providerAdapter',
-        'agentId',
-        'intent',
-        'evidence',
-    ]);
-    if (!record.ok)
-        return record;
-    const skillId = readNonEmptyString(record.value, 'skillId', tool);
-    if (!skillId.ok)
-        return skillId;
-    const outcome = readRequiredOneOf(record.value, 'outcome', skillUsageOutcomes, tool);
-    if (!outcome.ok)
-        return outcome;
-    const result = { skillId: skillId.value, outcome: outcome.value };
-    const copied = copyOptionalStrings(result, record.value, tool, ['versionId', 'runId', 'targetKey', 'notes', 'workflow', 'phase', 'providerAdapter', 'agentId']);
-    if (!copied.ok)
-        return copied;
-    const targetType = readOptionalOneOf(record.value, 'targetType', skillAttachmentTargetTypes, tool);
-    if (!targetType.ok)
-        return targetType;
-    if (targetType.value !== undefined)
-        result.targetType = targetType.value;
-    if (result.targetType !== undefined && result.targetKey === undefined)
-        return validationFailure('targetKey is required when targetType is set', tool);
-    if (result.targetType === undefined && result.targetKey !== undefined)
-        return validationFailure('targetType is required when targetKey is set', tool);
-    const intent = readOptionalJsonObject(record.value, 'intent', tool);
-    if (!intent.ok)
-        return intent;
-    if (intent.value !== undefined)
-        result.intent = intent.value;
-    const evidence = readOptionalJsonObject(record.value, 'evidence', tool);
-    if (!evidence.ok)
-        return evidence;
-    if (evidence.value !== undefined)
-        result.evidence = evidence.value;
-    return { ok: true, value: result };
-}
-function validateSkillProposeImprovementInput(input, tool) {
-    const record = inputRecord(input, tool, [
-        'project',
-        'scope',
-        'skillId',
-        'name',
-        'baseVersionId',
-        'baseVersion',
-        'proposedVersion',
-        'proposedSource',
-        'proposedCompatibility',
-        'title',
-        'problem',
-        'suggestedChange',
-        'sourceContext',
-        'runId',
-        'agentId',
-        'workflow',
-        'phase',
-        'providerAdapter',
-        'evidenceRefs',
-        'evidence',
-        'actor',
-    ]);
-    if (!record.ok)
-        return record;
-    const result = {};
-    const copied = copyRequiredStrings(result, record.value, tool, ['project', 'proposedVersion', 'title', 'problem', 'suggestedChange']);
-    if (!copied.ok)
-        return copied;
-    const optional = copyOptionalStrings(result, record.value, tool, ['skillId', 'name', 'baseVersionId', 'baseVersion', 'runId', 'agentId', 'workflow', 'phase', 'providerAdapter', 'actor']);
-    if (!optional.ok)
-        return optional;
-    if (result.skillId === undefined && result.name === undefined)
-        return validationFailure('Either skillId or name is required', tool);
-    if (result.baseVersionId !== undefined && result.baseVersion !== undefined)
-        return validationFailure('Use either baseVersionId or baseVersion, not both', tool);
-    const scope = readOptionalOneOf(record.value, 'scope', scopes, tool);
-    if (!scope.ok)
-        return scope;
-    if (scope.value !== undefined)
-        result.scope = scope.value;
-    const source = readSkillSource(record.value, 'proposedSource', tool);
-    if (!source.ok)
-        return source;
-    result.proposedSource = source.value;
-    const compatibility = readOptionalJsonObject(record.value, 'proposedCompatibility', tool);
-    if (!compatibility.ok)
-        return compatibility;
-    if (compatibility.value !== undefined) {
-        const proposedCompatibility = compatibility.value;
-        if (proposedCompatibility !== undefined)
-            result.proposedCompatibility = proposedCompatibility;
-    }
-    const sourceContext = readOptionalJsonObject(record.value, 'sourceContext', tool);
-    if (!sourceContext.ok)
-        return sourceContext;
-    if (sourceContext.value !== undefined)
-        result.sourceContext = sourceContext.value;
-    const evidence = readOptionalJsonObject(record.value, 'evidence', tool);
-    if (!evidence.ok)
-        return evidence;
-    if (evidence.value !== undefined)
-        result.evidence = evidence.value;
-    const evidenceRefs = readOptionalStringArray(record.value, 'evidenceRefs', tool);
-    if (!evidenceRefs.ok)
-        return evidenceRefs;
-    if (evidenceRefs.value !== undefined)
-        result.evidenceRefs = evidenceRefs.value;
-    return { ok: true, value: result };
-}
-function validateSkillListImprovementProposalsInput(input, tool) {
-    const record = inputRecord(input, tool, ['project', 'scope', 'skillId', 'name', 'baseVersionId', 'status', 'runId', 'agentId', 'limit']);
-    if (!record.ok)
-        return record;
-    const project = readNonEmptyString(record.value, 'project', tool);
-    if (!project.ok)
-        return project;
-    const result = { project: project.value };
-    const copied = copyOptionalStrings(result, record.value, tool, ['skillId', 'name', 'baseVersionId', 'runId', 'agentId']);
-    if (!copied.ok)
-        return copied;
-    const scope = readOptionalOneOf(record.value, 'scope', scopes, tool);
-    if (!scope.ok)
-        return scope;
-    if (scope.value !== undefined)
-        result.scope = scope.value;
-    const status = readOptionalOneOf(record.value, 'status', skillImprovementProposalStatuses, tool);
-    if (!status.ok)
-        return status;
-    if (status.value !== undefined)
-        result.status = status.value;
-    const limit = readOptionalBoundedLimit(record.value, tool);
-    if (!limit.ok)
-        return limit;
-    if (limit.value !== undefined)
-        result.limit = limit.value;
-    return { ok: true, value: result };
-}
-function validateSkillRequestEvaluationInput(input, tool) {
-    const record = inputRecord(input, tool, [
-        'project',
-        'scope',
-        'skillId',
-        'name',
-        'versionId',
-        'version',
-        'scenarioId',
-        'proposalId',
-        'requestedBy',
-        'runId',
-        'agentId',
-        'workflow',
-        'phase',
-        'providerAdapter',
-        'risk',
-        'preflight',
-    ]);
-    if (!record.ok)
-        return record;
-    const result = {};
-    const copied = copyRequiredStrings(result, record.value, tool, ['project', 'requestedBy']);
-    if (!copied.ok)
-        return copied;
-    const optional = copyOptionalStrings(result, record.value, tool, ['skillId', 'name', 'versionId', 'version', 'scenarioId', 'proposalId', 'runId', 'agentId', 'workflow', 'phase', 'providerAdapter']);
-    if (!optional.ok)
-        return optional;
-    if (result.skillId === undefined && result.name === undefined)
-        return validationFailure('Either skillId or name is required', tool);
-    if (result.versionId !== undefined && result.version !== undefined)
-        return validationFailure('Use either versionId or version, not both', tool);
-    const scope = readOptionalOneOf(record.value, 'scope', scopes, tool);
-    if (!scope.ok)
-        return scope;
-    if (scope.value !== undefined)
-        result.scope = scope.value;
-    const risk = readOptionalJsonObject(record.value, 'risk', tool);
-    if (!risk.ok)
-        return risk;
-    if (risk.value !== undefined)
-        result.risk = risk.value;
-    const preflight = readOptionalJsonObject(record.value, 'preflight', tool);
-    if (!preflight.ok)
-        return preflight;
-    if (preflight.value !== undefined)
-        result.preflight = preflight.value;
-    return { ok: true, value: result };
-}
-function validateSkillListEvaluationsInput(input, tool) {
-    const record = inputRecord(input, tool, ['project', 'scope', 'skillId', 'name', 'versionId', 'scenarioId', 'proposalId', 'status', 'runId', 'agentId', 'limit']);
-    if (!record.ok)
-        return record;
-    const project = readNonEmptyString(record.value, 'project', tool);
-    if (!project.ok)
-        return project;
-    const result = { project: project.value };
-    const copied = copyOptionalStrings(result, record.value, tool, ['skillId', 'name', 'versionId', 'scenarioId', 'proposalId', 'runId', 'agentId']);
-    if (!copied.ok)
-        return copied;
-    const scope = readOptionalOneOf(record.value, 'scope', scopes, tool);
-    if (!scope.ok)
-        return scope;
-    if (scope.value !== undefined)
-        result.scope = scope.value;
-    const status = readOptionalOneOf(record.value, 'status', skillEvaluationRequestStatuses, tool);
-    if (!status.ok)
-        return status;
-    if (status.value !== undefined)
-        result.status = status.value;
-    const limit = readOptionalBoundedLimit(record.value, tool);
-    if (!limit.ok)
-        return limit;
-    if (limit.value !== undefined)
-        result.limit = limit.value;
-    return { ok: true, value: result };
-}
-function validateSkillGetEvaluationInput(input, tool) {
-    const record = inputRecord(input, tool, ['project', 'scope', 'id']);
-    if (!record.ok)
-        return record;
-    const project = readNonEmptyString(record.value, 'project', tool);
-    if (!project.ok)
-        return project;
-    const id = readNonEmptyString(record.value, 'id', tool);
-    if (!id.ok)
-        return id;
-    const result = { project: project.value, id: id.value };
-    const scope = readOptionalOneOf(record.value, 'scope', scopes, tool);
-    if (!scope.ok)
-        return scope;
-    if (scope.value !== undefined)
-        result.scope = scope.value;
-    return { ok: true, value: result };
-}
-function validateSkillCreateDraftInput(input, tool) {
-    const record = inputRecord(input, tool, [
-        'project',
-        'scope',
-        'name',
-        'description',
-        'version',
-        'source',
-        'compatibility',
-        'draftParentVersionId',
-        'actor',
-        'reason',
-        'runId',
-        'agentId',
-        'evidence',
-        'governance',
-    ]);
-    if (!record.ok)
-        return record;
-    const result = {};
-    const required = copyRequiredStrings(result, record.value, tool, ['project', 'name', 'description', 'version']);
-    if (!required.ok)
-        return required;
-    const optional = copyOptionalStrings(result, record.value, tool, ['draftParentVersionId', 'reason', 'runId', 'agentId']);
-    if (!optional.ok)
-        return optional;
-    const scope = readOptionalOneOf(record.value, 'scope', scopes, tool);
-    if (!scope.ok)
-        return scope;
-    if (scope.value !== undefined)
-        result.scope = scope.value;
-    const source = readSkillSource(record.value, 'source', tool);
-    if (!source.ok)
-        return source;
-    result.source = source.value;
-    const actor = readSkillLifecycleActor(record.value, tool);
-    if (!actor.ok)
-        return actor;
-    result.actor = actor.value;
-    const compatibility = readOptionalJsonObject(record.value, 'compatibility', tool);
-    if (!compatibility.ok)
-        return compatibility;
-    if (compatibility.value !== undefined)
-        result.compatibility = compatibility.value;
-    const evidence = readOptionalJsonObject(record.value, 'evidence', tool);
-    if (!evidence.ok)
-        return evidence;
-    if (evidence.value !== undefined)
-        result.evidence = evidence.value;
-    const governance = readOptionalJsonObject(record.value, 'governance', tool);
-    if (!governance.ok)
-        return governance;
-    if (governance.value !== undefined)
-        result.governance = governance.value;
-    return { ok: true, value: result };
-}
-function validateSkillUpdateDraftInput(input, tool) {
-    const record = inputRecord(input, tool, [
-        'project',
-        'scope',
-        'skillId',
-        'name',
-        'versionId',
-        'version',
-        'source',
-        'compatibility',
-        'expectedDraftRevision',
-        'actor',
-        'reason',
-        'runId',
-        'agentId',
-        'evidence',
-        'governance',
-    ]);
-    if (!record.ok)
-        return record;
-    const result = {};
-    const required = copyRequiredStrings(result, record.value, tool, ['project']);
-    if (!required.ok)
-        return required;
-    const optional = copyOptionalStrings(result, record.value, tool, ['skillId', 'name', 'versionId', 'version', 'reason', 'runId', 'agentId']);
-    if (!optional.ok)
-        return optional;
-    if (result.skillId === undefined && result.name === undefined)
-        return validationFailure('Either skillId or name is required', tool);
-    if (result.versionId === undefined && result.version === undefined)
-        return validationFailure('Either versionId or version is required', tool);
-    if (result.versionId !== undefined && result.version !== undefined)
-        return validationFailure('Use either versionId or version, not both', tool);
-    const scope = readOptionalOneOf(record.value, 'scope', scopes, tool);
-    if (!scope.ok)
-        return scope;
-    if (scope.value !== undefined)
-        result.scope = scope.value;
-    const actor = readSkillLifecycleActor(record.value, tool);
-    if (!actor.ok)
-        return actor;
-    result.actor = actor.value;
-    if (record.value.source !== undefined) {
-        const source = readSkillSource(record.value, 'source', tool);
-        if (!source.ok)
-            return source;
-        result.source = source.value;
-    }
-    const compatibility = readOptionalJsonObject(record.value, 'compatibility', tool);
-    if (!compatibility.ok)
-        return compatibility;
-    if (compatibility.value !== undefined)
-        result.compatibility = compatibility.value;
-    if (record.value.expectedDraftRevision !== undefined) {
-        const revision = record.value.expectedDraftRevision;
-        if (typeof revision !== 'number' || !Number.isSafeInteger(revision) || revision < 1)
-            return validationFailure('expectedDraftRevision must be a positive safe integer', tool);
-        result.expectedDraftRevision = revision;
-    }
-    const evidence = readOptionalJsonObject(record.value, 'evidence', tool);
-    if (!evidence.ok)
-        return evidence;
-    if (evidence.value !== undefined)
-        result.evidence = evidence.value;
-    const governance = readOptionalJsonObject(record.value, 'governance', tool);
-    if (!governance.ok)
-        return governance;
-    if (governance.value !== undefined)
-        result.governance = governance.value;
-    if (result.source === undefined && result.compatibility === undefined && result.governance === undefined)
-        return validationFailure('At least one draft update field is required', tool);
-    return { ok: true, value: result };
-}
-function validateSkillPublishVersionInput(input, tool) {
-    const record = inputRecord(input, tool, ['project', 'scope', 'skillId', 'name', 'versionId', 'version', 'actor', 'reason', 'runId', 'agentId', 'evidence', 'governance']);
-    if (!record.ok)
-        return record;
-    const result = {};
-    const required = copyRequiredStrings(result, record.value, tool, ['project', 'reason']);
-    if (!required.ok)
-        return required;
-    const optional = copyOptionalStrings(result, record.value, tool, ['skillId', 'name', 'versionId', 'version', 'runId', 'agentId']);
-    if (!optional.ok)
-        return optional;
-    if (result.skillId === undefined && result.name === undefined)
-        return validationFailure('Either skillId or name is required', tool);
-    if (result.versionId === undefined && result.version === undefined)
-        return validationFailure('Either versionId or version is required', tool);
-    if (result.versionId !== undefined && result.version !== undefined)
-        return validationFailure('Use either versionId or version, not both', tool);
-    const scope = readOptionalOneOf(record.value, 'scope', scopes, tool);
-    if (!scope.ok)
-        return scope;
-    if (scope.value !== undefined)
-        result.scope = scope.value;
-    const actor = readSkillLifecycleActor(record.value, tool);
-    if (!actor.ok)
-        return actor;
-    result.actor = actor.value;
-    const evidence = readOptionalJsonObject(record.value, 'evidence', tool);
-    if (!evidence.ok)
-        return evidence;
-    if (evidence.value !== undefined)
-        result.evidence = evidence.value;
-    const governance = readOptionalJsonObject(record.value, 'governance', tool);
-    if (!governance.ok)
-        return governance;
-    if (governance.value !== undefined)
-        result.governance = governance.value;
-    return { ok: true, value: result };
-}
-function validateManagerProfileGetInput(input, tool) {
-    const record = inputRecord(input, tool, ['project', 'scope', 'managerName']);
-    if (!record.ok)
-        return record;
-    const project = readNonEmptyString(record.value, 'project', tool);
-    if (!project.ok)
-        return project;
-    const scope = readOptionalOneOf(record.value, 'scope', scopes, tool);
-    if (!scope.ok)
-        return scope;
-    const result = { project: project.value };
-    if (scope.value !== undefined)
-        result.scope = scope.value;
-    const copied = copyOptionalStrings(result, record.value, tool, ['managerName']);
-    if (!copied.ok)
-        return copied;
-    return { ok: true, value: result };
-}
-function validateManagerProfileSetInput(input, tool) {
-    const record = inputRecord(input, tool, ['project', 'scope', 'managerName', 'instructions']);
-    if (!record.ok)
-        return record;
-    const result = {};
-    const copied = copyRequiredStrings(result, record.value, tool, ['project', 'managerName', 'instructions']);
-    if (!copied.ok)
-        return copied;
-    const scope = readRequiredOneOf(record.value, 'scope', scopes, tool);
-    if (!scope.ok)
-        return scope;
-    result.scope = scope.value;
-    return { ok: true, value: result };
-}
-function validateOpenCodeManagerPayloadInput(input, tool) {
-    const record = inputRecord(input, tool, ['project', 'scope', 'agentId', 'agentName', 'workspaceRoot', 'maxSourceBytes', 'payloadMode']);
-    if (!record.ok)
-        return record;
-    const project = readNonEmptyString(record.value, 'project', tool);
-    if (!project.ok)
-        return project;
-    const result = { project: project.value };
-    const copied = copyOptionalStrings(result, record.value, tool, ['agentId', 'agentName', 'workspaceRoot']);
-    if (!copied.ok)
-        return copied;
-    // Some MCP hosts expose optional fields as required in their generated tool
-    // facade. Accept both selectors here and let the provider payload service
-    // verify that they refer to the same top-level agent.
-    if (result.agentId === undefined && result.agentName === undefined)
-        result.agentName = 'vgxness-manager';
-    const scope = readOptionalOneOf(record.value, 'scope', scopes, tool);
-    if (!scope.ok)
-        return scope;
-    result.scope = scope.value ?? 'project';
-    const payloadMode = readOptionalOneOf(record.value, 'payloadMode', payloadModes, tool);
-    if (!payloadMode.ok)
-        return payloadMode;
-    if (payloadMode.value !== undefined)
-        result.payloadMode = payloadMode.value;
-    if (record.value.maxSourceBytes !== undefined) {
-        const maxSourceBytes = record.value.maxSourceBytes;
-        if (typeof maxSourceBytes !== 'number' || !Number.isSafeInteger(maxSourceBytes) || maxSourceBytes <= 0)
-            return validationFailure('maxSourceBytes must be a positive safe integer', tool);
-        result.maxSourceBytes = maxSourceBytes;
-    }
-    return { ok: true, value: result };
-}
-function validateOpenCodeHandoffPreviewInput(input, tool) {
-    const record = inputRecord(input, tool, ['project', 'scope', 'agentId', 'agentName', 'workspaceRoot', 'maxSourceBytes', 'change', 'phase']);
-    if (!record.ok)
-        return record;
-    const project = readNonEmptyString(record.value, 'project', tool);
-    if (!project.ok)
-        return project;
-    const result = { project: project.value, scope: 'project', agentName: 'vgxness-manager' };
-    const copied = copyOptionalStrings(result, record.value, tool, ['agentId', 'agentName', 'workspaceRoot']);
-    if (!copied.ok)
-        return copied;
-    const scope = readOptionalOneOf(record.value, 'scope', scopes, tool);
-    if (!scope.ok)
-        return scope;
-    result.scope = scope.value ?? 'project';
-    const change = readOptionalChange(record.value, tool);
-    if (!change.ok)
-        return change;
-    if (change.value !== undefined)
-        result.change = change.value;
-    if (record.value.phase !== undefined) {
-        const phase = readPhase(record.value, tool);
-        if (!phase.ok)
-            return phase;
-        result.phase = phase.value;
-    }
-    if (record.value.maxSourceBytes !== undefined) {
-        const maxSourceBytes = record.value.maxSourceBytes;
-        if (typeof maxSourceBytes !== 'number' || !Number.isSafeInteger(maxSourceBytes) || maxSourceBytes <= 0)
-            return validationFailure('maxSourceBytes must be a positive safe integer', tool);
-        result.maxSourceBytes = maxSourceBytes;
-    }
-    return { ok: true, value: result };
-}
-function validateRunListInput(input, tool) {
-    const record = inputRecord(input, tool, ['project', 'status', 'limit']);
-    if (!record.ok)
-        return record;
-    const result = {};
-    const project = copyOptionalStrings(result, record.value, tool, ['project']);
-    if (!project.ok)
-        return project;
-    const status = readOptionalOneOf(record.value, 'status', runStatuses, tool);
-    if (!status.ok)
-        return status;
-    if (status.value !== undefined)
-        result.status = status.value;
-    const limit = readBoundedLimit(record.value, tool);
-    if (!limit.ok)
-        return limit;
-    result.limit = limit.value;
-    return { ok: true, value: result };
-}
-function validateRunGetInput(input, tool) {
-    const record = inputRecord(input, tool, ['id']);
-    if (!record.ok)
-        return record;
-    const id = readNonEmptyString(record.value, 'id', tool);
-    if (!id.ok)
-        return id;
-    return { ok: true, value: { id: id.value } };
-}
-function validateRunPreflightInput(input, tool) {
-    const record = inputRecord(input, tool, [
-        'runId',
-        'category',
-        'operation',
-        'workflow',
-        'phase',
-        'agentId',
-        'workspaceRoot',
-        'targetPath',
-        'taskFingerprint',
-        'commandId',
-        'cwd',
-        'targetPaths',
-        'providerToolName',
-        'agent',
-        'sandboxStrategy',
-        'destructive',
-        'external',
-        'privileged',
-        'ambiguous',
-    ]);
-    if (!record.ok)
-        return record;
-    const runId = readNonEmptyString(record.value, 'runId', tool);
-    if (!runId.ok)
-        return runId;
-    const category = readRequiredOneOf(record.value, 'category', permissionCategories, tool);
-    if (!category.ok)
-        return category;
-    const operation = readNonEmptyString(record.value, 'operation', tool);
-    if (!operation.ok)
-        return operation;
-    const result = { runId: runId.value, category: category.value, operation: operation.value };
-    const workflow = readOptionalOneOf(record.value, 'workflow', workflowIds, tool);
-    if (!workflow.ok)
-        return workflow;
-    if (workflow.value !== undefined)
-        result.workflow = workflow.value;
-    const copied = copyOptionalStrings(result, record.value, tool, ['phase', 'agentId', 'workspaceRoot', 'targetPath', 'taskFingerprint', 'commandId', 'cwd', 'providerToolName']);
-    if (!copied.ok)
-        return copied;
-    const targetPaths = readOptionalStringArray(record.value, 'targetPaths', tool);
-    if (!targetPaths.ok)
-        return targetPaths;
-    if (targetPaths.value !== undefined)
-        result.targetPaths = targetPaths.value;
-    const sandboxStrategy = readOptionalOneOf(record.value, 'sandboxStrategy', ['worktree'], tool);
-    if (!sandboxStrategy.ok)
-        return sandboxStrategy;
-    if (sandboxStrategy.value !== undefined)
-        result.sandboxStrategy = sandboxStrategy.value;
-    const booleans = copyOptionalBooleans(result, record.value, tool, ['destructive', 'external', 'privileged', 'ambiguous']);
-    if (!booleans.ok)
-        return booleans;
-    if (record.value.agent !== undefined) {
-        const agent = readPreflightAgent(record.value.agent, tool);
-        if (!agent.ok)
-            return agent;
-        result.agent = agent.value;
-    }
-    if (isRiskyPermissionCategory(result.category)) {
-        if (result.phase !== undefined && result.agentId === undefined && result.agent === undefined) {
-            return validationFailure(`VGX-managed preflight for risky category ${result.category} requires agentId when phase metadata is provided`, tool);
-        }
-        if (result.agentId !== undefined && result.phase === undefined) {
-            return validationFailure(`VGX-managed preflight for risky category ${result.category} requires phase when agentId metadata is provided`, tool);
-        }
-    }
-    return { ok: true, value: result };
-}
-function validateRunTaskGrantCreateInput(input, tool) {
-    const record = inputRecord(input, tool, [
-        'runId',
-        'agentId',
-        'taskFingerprint',
-        'categories',
-        'externalRoots',
-        'cwdPatterns',
-        'commandPolicy',
-        'expiresAt',
-        'maxUses',
-        'createdBy',
-        'creationReason',
-        'approvedScopeSummary',
-    ]);
-    if (!record.ok)
-        return record;
-    const result = {};
-    const copied = copyRequiredStrings(result, record.value, tool, ['runId', 'agentId', 'taskFingerprint', 'expiresAt', 'creationReason', 'approvedScopeSummary']);
-    if (!copied.ok)
-        return copied;
-    const categories = readRequiredOneOfArray(record.value, 'categories', taskGrantCategories, tool);
-    if (!categories.ok)
-        return categories;
-    result.categories = categories.value;
-    const externalRoots = readRequiredStringArray(record.value, 'externalRoots', tool);
-    if (!externalRoots.ok)
-        return externalRoots;
-    result.externalRoots = externalRoots.value;
-    const cwdPatterns = readOptionalStringArray(record.value, 'cwdPatterns', tool);
-    if (!cwdPatterns.ok)
-        return cwdPatterns;
-    if (cwdPatterns.value !== undefined)
-        result.cwdPatterns = cwdPatterns.value;
-    const commandPolicy = readTaskGrantCommandPolicy(record.value.commandPolicy, tool);
-    if (!commandPolicy.ok)
-        return commandPolicy;
-    result.commandPolicy = commandPolicy.value;
-    const createdBy = readTaskGrantActor(record.value.createdBy, tool, ['human']);
-    if (!createdBy.ok)
-        return createdBy;
-    result.createdBy = createdBy.value;
-    if (typeof record.value.maxUses !== 'number' || !Number.isSafeInteger(record.value.maxUses) || record.value.maxUses < 1)
-        return validationFailure('maxUses must be a positive safe integer', tool);
-    result.maxUses = record.value.maxUses;
-    const expiresAt = Date.parse(result.expiresAt ?? '');
-    if (!Number.isFinite(expiresAt) || new Date(expiresAt).toISOString() !== result.expiresAt)
-        return validationFailure('expiresAt must be a valid ISO date', tool);
-    const expiryDelta = expiresAt - Date.now();
-    if (expiryDelta <= 0)
-        return validationFailure('expiresAt must be in the future', tool);
-    if (expiryDelta > 24 * 60 * 60 * 1000)
-        return validationFailure('expiresAt must be within 24 hours', tool);
-    return { ok: true, value: result };
-}
-function validateRunTaskGrantListInput(input, tool) {
-    const record = inputRecord(input, tool, ['runId', 'agentId', 'status', 'limit']);
-    if (!record.ok)
-        return record;
-    const result = {};
-    const copied = copyOptionalStrings(result, record.value, tool, ['runId', 'agentId']);
-    if (!copied.ok)
-        return copied;
-    const status = readOptionalOneOf(record.value, 'status', taskGrantStatuses, tool);
-    if (!status.ok)
-        return status;
-    if (status.value !== undefined)
-        result.status = status.value;
-    const limit = readOptionalBoundedLimit(record.value, tool);
-    if (!limit.ok)
-        return limit;
-    if (limit.value !== undefined)
-        result.limit = limit.value;
-    return { ok: true, value: result };
-}
-function validateRunTaskGrantGetInput(input, tool) {
-    const record = inputRecord(input, tool, ['grantId']);
-    if (!record.ok)
-        return record;
-    const grantId = readNonEmptyString(record.value, 'grantId', tool);
-    if (!grantId.ok)
-        return grantId;
-    return { ok: true, value: { grantId: grantId.value } };
-}
-function validateRunTaskGrantRevokeInput(input, tool) {
-    const record = inputRecord(input, tool, ['grantId', 'actor', 'reason']);
-    if (!record.ok)
-        return record;
-    const grantId = readNonEmptyString(record.value, 'grantId', tool);
-    if (!grantId.ok)
-        return grantId;
-    const reason = readNonEmptyString(record.value, 'reason', tool);
-    if (!reason.ok)
-        return reason;
-    const actor = readTaskGrantActor(record.value.actor, tool, ['human', 'system']);
-    if (!actor.ok)
-        return actor;
-    return { ok: true, value: { grantId: grantId.value, actor: actor.value, reason: reason.value } };
-}
-function validateRunTaskGrantPreviewMatchInput(input, tool) {
-    const record = inputRecord(input, tool, ['runId', 'agentId', 'taskFingerprint', 'category', 'operation', 'workspaceRoot', 'cwd', 'targetPaths']);
-    if (!record.ok)
-        return record;
-    const runId = readNonEmptyString(record.value, 'runId', tool);
-    if (!runId.ok)
-        return runId;
-    const taskFingerprint = readNonEmptyString(record.value, 'taskFingerprint', tool);
-    if (!taskFingerprint.ok)
-        return taskFingerprint;
-    const category = readRequiredOneOf(record.value, 'category', permissionCategories, tool);
-    if (!category.ok)
-        return category;
-    const operation = readNonEmptyString(record.value, 'operation', tool);
-    if (!operation.ok)
-        return operation;
-    const cwd = readNonEmptyString(record.value, 'cwd', tool);
-    if (!cwd.ok)
-        return cwd;
-    const result = { runId: runId.value, taskFingerprint: taskFingerprint.value, category: category.value, operation: operation.value, cwd: cwd.value };
-    const copied = copyOptionalStrings(result, record.value, tool, ['agentId', 'workspaceRoot']);
-    if (!copied.ok)
-        return copied;
-    const targetPaths = readOptionalStringArray(record.value, 'targetPaths', tool);
-    if (!targetPaths.ok)
-        return targetPaths;
-    if (targetPaths.value !== undefined)
-        result.targetPaths = targetPaths.value;
-    return { ok: true, value: result };
-}
-function validateRunStartInput(input, tool) {
-    const record = inputRecord(input, tool, ['project', 'userIntent', 'workflow', 'phase', 'selectedAgentId', 'providerAdapter', 'model']);
-    if (!record.ok)
-        return record;
-    const result = {};
-    const copied = copyRequiredStrings(result, record.value, tool, ['project', 'userIntent', 'workflow', 'phase', 'selectedAgentId', 'providerAdapter', 'model']);
-    if (!copied.ok)
-        return copied;
-    return { ok: true, value: result };
-}
-function validateRunCheckpointInput(input, tool) {
-    const record = inputRecord(input, tool, ['runId', 'label', 'state']);
-    if (!record.ok)
-        return record;
-    const runId = readNonEmptyString(record.value, 'runId', tool);
-    if (!runId.ok)
-        return runId;
-    const label = readNonEmptyString(record.value, 'label', tool);
-    if (!label.ok)
-        return label;
-    const state = readJsonValue(record.value, 'state', tool);
-    if (!state.ok)
-        return state;
-    return { ok: true, value: { runId: runId.value, label: label.value, state: state.value } };
-}
-function validateRunFinalizeInput(input, tool) {
-    const record = inputRecord(input, tool, ['runId', 'status', 'outcome', 'outcomeReason']);
-    if (!record.ok)
-        return record;
-    const runId = readNonEmptyString(record.value, 'runId', tool);
-    if (!runId.ok)
-        return runId;
-    const status = readRequiredOneOf(record.value, 'status', finalRunStatuses, tool);
-    if (!status.ok)
-        return status;
-    const outcome = readRequiredOneOf(record.value, 'outcome', runOutcomes, tool);
-    if (!outcome.ok)
-        return outcome;
-    const result = { runId: runId.value, status: status.value, outcome: outcome.value };
-    const copied = copyOptionalStrings(result, record.value, tool, ['outcomeReason']);
-    if (!copied.ok)
-        return copied;
-    return { ok: true, value: result };
-}
-function validateRunResumeCandidatesInput(input, tool) {
-    const record = inputRecord(input, tool, ['project', 'limit']);
-    if (!record.ok)
-        return record;
-    const project = readNonEmptyString(record.value, 'project', tool);
-    if (!project.ok)
-        return project;
-    const result = { project: project.value };
-    if (record.value.limit !== undefined) {
-        const limit = readBoundedLimit(record.value, tool);
-        if (!limit.ok)
-            return limit;
-        result.limit = limit.value;
-    }
-    return { ok: true, value: result };
-}
-function validateRunResumeInspectInput(input, tool) {
-    const record = inputRecord(input, tool, ['runId']);
-    if (!record.ok)
-        return record;
-    const runId = readNonEmptyString(record.value, 'runId', tool);
-    if (!runId.ok)
-        return runId;
-    return { ok: true, value: { runId: runId.value } };
-}
-function validateRunResumeGateInput(input, tool) {
-    const record = inputRecord(input, tool, ['approvalId', 'policy']);
-    if (!record.ok)
-        return record;
-    const approvalId = readNonEmptyString(record.value, 'approvalId', tool);
-    if (!approvalId.ok)
-        return approvalId;
-    const result = { approvalId: approvalId.value };
-    if (record.value.policy !== undefined) {
-        const policy = parseOperationRetryPolicy(record.value.policy);
-        if (!policy.ok)
-            return validationFailure(policy.errors.join('; '), tool);
-        result.policy = policy.policy;
-    }
-    return { ok: true, value: result };
-}
-function validationSuccess(tool, validation) {
-    if (!validation.ok)
-        return validation;
-    return { ok: true, tool, input: validation.value };
-}
-function inputRecord(input, tool, allowed) {
-    const record = asRecord(input, tool, 'Tool input must be an object');
-    if (!record.ok)
-        return record;
-    const unexpected = Object.keys(record.value).find((key) => !allowed.includes(key));
-    if (unexpected !== undefined)
-        return validationFailure(`Unexpected field: ${unexpected}`, tool);
-    return record;
-}
-function asRecord(value, tool, message) {
-    if (typeof value !== 'object' || value === null || Array.isArray(value))
-        return validationFailure(message, tool);
-    return { ok: true, value: value };
-}
-function readString(record, field, tool) {
-    const value = record[field];
-    if (typeof value !== 'string')
-        return validationFailure(`${field} must be a string`, tool);
-    return { ok: true, value };
-}
-function readNonEmptyString(record, field, tool) {
-    if (record[field] === undefined)
-        return validationFailure(`${field} is required`, tool);
-    const value = readString(record, field, tool);
-    if (!value.ok)
-        return value;
-    if (value.value.trim().length === 0)
-        return validationFailure(`${field} must not be empty`, tool);
-    return value;
-}
-function readOptionalNonEmptyString(record, field, tool) {
-    if (record[field] === undefined)
-        return { ok: true, value: undefined };
-    return readNonEmptyString(record, field, tool);
-}
-function readChange(record, tool) {
-    const change = readNonEmptyString(record, 'change', tool);
-    if (!change.ok)
-        return change;
-    if (!validChangePattern.test(change.value))
-        return validationFailure(`Invalid SDD change id: ${change.value}`, tool);
-    return change;
-}
-function readOptionalChange(record, tool) {
-    if (record.change === undefined)
-        return { ok: true, value: undefined };
-    return readChange(record, tool);
-}
-function readOptionalContextCockpitChange(record, tool) {
-    if (record.change === '')
-        return { ok: true, value: undefined };
-    return readOptionalChange(record, tool);
-}
-function readOptionalExplicitChange(record, tool) {
-    if (record.explicitChange === undefined)
-        return { ok: true, value: undefined };
-    if (typeof record.explicitChange !== 'string')
-        return validationFailure('explicitChange must be a string', tool);
-    const trimmed = record.explicitChange.trim();
-    if (trimmed.length === 0)
-        return { ok: true, value: undefined };
-    if (!validChangePattern.test(trimmed))
-        return validationFailure(`Invalid explicit change id: ${trimmed}`, tool);
-    return { ok: true, value: trimmed };
-}
-function readPhase(record, tool) {
-    const phase = readNonEmptyString(record, 'phase', tool);
-    if (!phase.ok)
-        return phase;
-    const normalized = normalizeSddPhaseInput(phase.value);
-    if (normalized === undefined)
-        return validationFailure(`phase must be one of: ${sddPhases.join(', ')}`, tool);
-    return { ok: true, value: normalized };
-}
-function copyOptionalStrings(target, record, tool, fields) {
-    for (const field of fields) {
-        if (record[field] === undefined)
-            continue;
-        const value = readNonEmptyString(record, field, tool);
-        if (!value.ok)
-            return value;
-        target[field] = value.value;
-    }
-    return { ok: true, value: undefined };
-}
-function copyRequiredStrings(target, record, tool, fields) {
-    for (const field of fields) {
-        const value = readNonEmptyString(record, field, tool);
-        if (!value.ok)
-            return value;
-        target[field] = value.value;
-    }
-    return { ok: true, value: undefined };
-}
-function readJsonValue(record, field, tool) {
-    if (record[field] === undefined)
-        return validationFailure(`${field} is required`, tool);
-    if (!isJsonValue(record[field]))
-        return validationFailure(`${field} must be JSON-compatible`, tool);
-    return { ok: true, value: record[field] };
-}
-function readOptionalJsonObject(record, field, tool) {
-    if (record[field] === undefined)
-        return { ok: true, value: undefined };
-    const value = record[field];
-    if (!isJsonValue(value) || typeof value !== 'object' || value === null || Array.isArray(value))
-        return validationFailure(`${field} must be a JSON object`, tool);
-    return { ok: true, value: value };
-}
-function isJsonValue(value) {
-    if (value === null)
-        return true;
-    if (typeof value === 'string' || typeof value === 'boolean')
-        return true;
-    if (typeof value === 'number')
-        return Number.isFinite(value);
-    if (Array.isArray(value))
-        return value.every(isJsonValue);
-    if (typeof value !== 'object')
-        return false;
-    return Object.values(value).every(isJsonValue);
-}
-function copyOptionalBooleans(target, record, tool, fields) {
-    for (const field of fields) {
-        if (record[field] === undefined)
-            continue;
-        if (typeof record[field] !== 'boolean')
-            return validationFailure(`${field} must be a boolean`, tool);
-        target[field] = record[field];
-    }
-    return { ok: true, value: undefined };
-}
-function readPreflightAgent(value, tool) {
-    const record = asRecord(value, tool, 'agent must be an object');
-    if (!record.ok)
-        return record;
-    const unexpected = Object.keys(record.value).find((key) => !['id', 'name', 'mode', 'permissions'].includes(key));
-    if (unexpected !== undefined)
-        return validationFailure(`Unexpected agent field: ${unexpected}`, tool);
-    const id = readNonEmptyString(record.value, 'id', tool);
-    if (!id.ok)
-        return id;
-    const mode = readRequiredOneOf(record.value, 'mode', agentModes, tool);
-    if (!mode.ok)
-        return mode;
-    const agent = { id: id.value, name: id.value, mode: mode.value, permissions: {} };
-    const name = copyOptionalStrings(agent, record.value, tool, ['name']);
-    if (!name.ok)
-        return name;
-    if (record.value.permissions !== undefined) {
-        const permissions = readPreflightAgentPermissions(record.value.permissions, tool);
-        if (!permissions.ok)
-            return permissions;
-        agent.permissions = permissions.value;
-    }
-    return { ok: true, value: agent };
-}
-function readPreflightAgentPermissions(value, tool) {
-    const record = asRecord(value, tool, 'agent.permissions must be an object');
-    if (!record.ok)
-        return record;
-    const permissions = {};
-    for (const [category, decision] of Object.entries(record.value)) {
-        if (!permissionCategories.includes(category))
-            return validationFailure(`agent.permissions category must be one of: ${permissionCategories.join(', ')}`, tool);
-        if (typeof decision !== 'string' || !permissionDecisions.includes(decision))
-            return validationFailure(`agent.permissions.${category} must be one of: ${permissionDecisions.join(', ')}`, tool);
-        permissions[category] = decision;
-    }
-    return { ok: true, value: permissions };
-}
-function copyOptionalLimitedStrings(target, record, tool, fields, maxLength) {
-    for (const field of fields) {
-        if (record[field] === undefined)
-            continue;
-        const value = readLimitedNonEmptyString(record, field, tool, maxLength);
-        if (!value.ok)
-            return value;
-        target[field] = value.value;
-    }
-    return { ok: true, value: undefined };
-}
-function readLimitedNonEmptyString(record, field, tool, maxLength) {
-    const value = readNonEmptyString(record, field, tool);
-    if (!value.ok)
-        return value;
-    if (maxLength !== undefined && value.value.length > maxLength)
-        return validationFailure(`${field} must be ${maxLength} characters or fewer`, tool);
-    return value;
-}
-function readRequiredOneOf(record, field, values, tool) {
-    const value = readNonEmptyString(record, field, tool);
-    if (!value.ok)
-        return value;
-    if (!values.includes(value.value))
-        return validationFailure(`${field} must be one of: ${values.join(', ')}`, tool);
-    return { ok: true, value: value.value };
-}
-function readRequiredOneOfArray(record, field, values, tool) {
-    const array = readRequiredStringArray(record, field, tool);
-    if (!array.ok)
-        return array;
-    for (const item of array.value) {
-        if (!values.includes(item))
-            return validationFailure(`${field} must contain only: ${values.join(', ')}`, tool);
-    }
-    return { ok: true, value: array.value };
-}
-function readRequiredStringArray(record, field, tool) {
-    if (record[field] === undefined)
-        return validationFailure(`${field} is required`, tool);
-    const values = readOptionalStringArray(record, field, tool);
-    if (!values.ok)
-        return values;
-    if (values.value === undefined || values.value.length === 0)
-        return validationFailure(`${field} must contain at least one item`, tool);
-    if (new Set(values.value).size !== values.value.length)
-        return validationFailure(`${field} must be unique`, tool);
-    return { ok: true, value: values.value };
-}
-function readTaskGrantCommandPolicy(value, tool) {
-    const record = asRecord(value, tool, 'commandPolicy must be an object');
-    if (!record.ok)
-        return record;
-    const unexpected = Object.keys(record.value).find((key) => !['kind', 'ids'].includes(key));
-    if (unexpected !== undefined)
-        return validationFailure(`Unexpected commandPolicy field: ${unexpected}`, tool);
-    const kind = readRequiredOneOf(record.value, 'kind', ['allowlisted-command-ids'], tool);
-    if (!kind.ok)
-        return kind;
-    const ids = readRequiredStringArray(record.value, 'ids', tool);
-    if (!ids.ok)
-        return ids;
-    const known = new Set(commandAllowlistIds());
-    for (const id of ids.value)
-        if (!known.has(id))
-            return validationFailure(`Unknown allowlisted command id: ${id}`, tool);
-    return { ok: true, value: { kind: kind.value, ids: ids.value } };
-}
-function readTaskGrantActor(value, tool, allowedTypes) {
-    const record = asRecord(value, tool, 'actor must be an object');
-    if (!record.ok)
-        return record;
-    const unexpected = Object.keys(record.value).find((key) => !['type', 'id', 'displayName'].includes(key));
-    if (unexpected !== undefined)
-        return validationFailure(`Unexpected actor field: ${unexpected}`, tool);
-    const type = readRequiredOneOf(record.value, 'type', allowedTypes, tool);
-    if (!type.ok)
-        return type;
-    const id = readNonEmptyString(record.value, 'id', tool);
-    if (!id.ok)
-        return id;
-    const actor = { type: type.value, id: id.value };
-    const displayName = readOptionalNonEmptyString(record.value, 'displayName', tool);
-    if (!displayName.ok)
-        return displayName;
-    if (displayName.value !== undefined)
-        actor.displayName = displayName.value;
-    return { ok: true, value: actor };
-}
-function readOptionalOneOf(record, field, values, tool) {
-    if (record[field] === undefined)
-        return { ok: true, value: undefined };
-    const value = readNonEmptyString(record, field, tool);
-    if (!value.ok)
-        return value;
-    if (!values.includes(value.value))
-        return validationFailure(`${field} must be one of: ${values.join(', ')}`, tool);
-    return { ok: true, value: value.value };
-}
-function readOptionalTopicKey(record, tool) {
-    if (record.topicKey === undefined)
-        return { ok: true, value: undefined };
-    const topicKey = readLimitedNonEmptyString(record, 'topicKey', tool, maxMemoryTopicKeyLength);
-    if (!topicKey.ok)
-        return topicKey;
-    if (!validMemoryTopicKeyPattern.test(topicKey.value))
-        return validationFailure('topicKey must contain only letters, numbers, dots, underscores, slashes, or hyphens', tool);
-    return topicKey;
-}
-function readOptionalSearchTopicKey(record, tool) {
-    if (record.topicKey === undefined)
-        return { ok: true, value: undefined };
-    const topicKey = readLimitedNonEmptyString(record, 'topicKey', tool, maxMemoryTopicKeyLength);
-    if (!topicKey.ok)
-        return topicKey;
-    if (topicKey.value === '*')
-        return topicKey;
-    if (!validMemoryTopicKeyPattern.test(topicKey.value))
-        return validationFailure('topicKey must be * or contain only letters, numbers, dots, underscores, slashes, or hyphens', tool);
-    return topicKey;
-}
-function readMemorySearchLimit(record, tool) {
-    return readBoundedLimit(record, tool);
-}
-function readBoundedLimit(record, tool) {
-    if (record.limit === undefined)
-        return validationFailure('limit is required', tool);
-    const limit = record.limit;
-    if (typeof limit !== 'number' || !Number.isSafeInteger(limit) || limit < 1 || limit > 100)
-        return validationFailure('limit must be between 1 and 100', tool);
-    return { ok: true, value: limit };
-}
-function readOptionalBoundedLimit(record, tool) {
-    if (record.limit === undefined)
-        return { ok: true, value: undefined };
-    return readBoundedLimit(record, tool);
-}
-function readSkillSource(record, field, tool) {
-    const source = asRecord(record[field], tool, `${field} must be an object`);
-    if (!source.ok)
-        return source;
-    const kind = readRequiredOneOf(source.value, 'kind', skillSourceKinds, tool);
-    if (!kind.ok)
-        return kind;
-    const result = { kind: kind.value };
-    const path = readOptionalNonEmptyString(source.value, 'path', tool);
-    if (!path.ok)
-        return path;
-    if (path.value !== undefined)
-        result.path = path.value;
-    const url = readOptionalNonEmptyString(source.value, 'url', tool);
-    if (!url.ok)
-        return url;
-    if (url.value !== undefined)
-        result.url = url.value;
-    const inlineMetadata = readOptionalJsonObject(source.value, 'inlineMetadata', tool);
-    if (!inlineMetadata.ok)
-        return inlineMetadata;
-    if (inlineMetadata.value !== undefined)
-        result.inlineMetadata = inlineMetadata.value;
-    if (result.kind === 'path' && result.path === undefined)
-        return validationFailure('proposedSource.path is required when proposedSource.kind is path', tool);
-    if (result.kind === 'url' && result.url === undefined)
-        return validationFailure('proposedSource.url is required when proposedSource.kind is url', tool);
-    if (result.kind === 'inline' && (result.path !== undefined || result.url !== undefined))
-        return validationFailure('Inline proposedSource cannot include path or url', tool);
-    return { ok: true, value: result };
-}
-function readSkillLifecycleActor(record, tool) {
-    const actorRecord = asRecord(record.actor, tool, 'actor must be an object');
-    if (!actorRecord.ok)
-        return actorRecord;
-    const type = readRequiredOneOf(actorRecord.value, 'type', ['human', 'agent', 'system'], tool);
-    if (!type.ok)
-        return type;
-    const id = readNonEmptyString(actorRecord.value, 'id', tool);
-    if (!id.ok)
-        return id;
-    const actor = { type: type.value, id: id.value };
-    const displayName = readOptionalNonEmptyString(actorRecord.value, 'displayName', tool);
-    if (!displayName.ok)
-        return displayName;
-    if (displayName.value !== undefined)
-        actor.displayName = displayName.value;
-    return { ok: true, value: actor };
-}
-function readOptionalStringArray(record, field, tool) {
-    if (record[field] === undefined)
-        return { ok: true, value: undefined };
-    if (!Array.isArray(record[field]))
-        return validationFailure(`${field} must be an array`, tool);
-    const values = record[field];
-    const result = [];
-    for (const [index, item] of values.entries()) {
-        if (typeof item !== 'string')
-            return validationFailure(`${field}[${index}] must be a string`, tool);
-        if (item.trim().length === 0)
-            return validationFailure(`${field}[${index}] must not be empty`, tool);
-        result.push(item);
-    }
-    return { ok: true, value: result };
-}
-function validationFailure(message, tool) {
-    return errorEnvelope('validation_failed', message, tool);
-}
-function toValidationResultFailure(failure) {
-    return failure;
-}
+export * from '../interfaces/mcp/validation.js';