/**
 * Capability validation — checks that referenced plugins exist.
 *
 * Validates at workflow creation/update time that every tool step's plugin
 * directory and built MCP server exist. If any capability is missing, the
 * workflow is set to 'draft'.
 */
import { existsSync } from "node:fs";
import { resolve } from "node:path";
/**
 * Validate that every step's referenced capabilities exist.
 * All steps are tool steps after task 127 — the legacy LLM-step branch is gone.
 */
export function validateCapabilities(steps, platformRoot) {
    const pluginsRoot = resolve(platformRoot, "plugins");
    const errors = [];
    for (const step of steps) {
        const pluginDir = resolve(pluginsRoot, step.plugin);
        // Path traversal check
        if (!pluginDir.startsWith(pluginsRoot + "/")) {
            errors.push({
                stepId: step.stepId,
                label: step.label,
                plugin: step.plugin,
                tool: step.tool,
                reason: `Invalid plugin name: "${step.plugin}" — path traversal blocked`,
            });
            continue;
        }
        if (!existsSync(pluginDir)) {
            errors.push({
                stepId: step.stepId,
                label: step.label,
                plugin: step.plugin,
                tool: step.tool,
                reason: `Plugin not found: "${step.plugin}" — directory does not exist at ${pluginDir}`,
            });
            continue;
        }
        const serverPath = resolve(pluginDir, "mcp", "dist", "index.js");
        if (!existsSync(serverPath)) {
            errors.push({
                stepId: step.stepId,
                label: step.label,
                plugin: step.plugin,
                tool: step.tool,
                reason: `Plugin "${step.plugin}" exists but MCP server is not built — expected ${serverPath}`,
            });
        }
    }
    return {
        valid: errors.length === 0,
        errors,
    };
}
//# sourceMappingURL=validate-capabilities.js.map