Publish validation

$report = Workflows::definition('purchase-approval', $team)->validate();          // the draft
$report = Workflows::versions()->validate($graph, 'purchase_request', $team);     // any graph
$report->valid();          // no errors (warnings don't block)
$report->errors;           // list<ValidationError>
$report->errorsOnly();     // and ->warnings()
$report->find(ValidationCode::UnknownField, 'check');
$report->has(ValidationCode::UnknownField, 'check');
$report->toArray();

ValidationError{code: ValidationCode, severity: error|warning, message (translated), node: ?string, edge: ?{from, to, outcome}, path: ?string (JSON pointer), params: array}. Messages never contain a class name. publish() runs the full validation under the definition lock and throws InvalidGraphException (carrying the report) on errors; its message lists the first problems. Saving a draft checks structure only:

use RoundlyConsulting\Workflows\Exceptions\InvalidGraphException;

try {
    Workflows::definition('purchase-approval', $team)->publish(by: $admin);
} catch (InvalidGraphException $e) {
    $e->validationReport()->toArray();   // [{code, severity, message, node, edge, path, params}, …]
}

Passes

All passes run and collect errors; only a structural failure stops early:

• Structure: schema version, node/edge shape, id pattern, duplicate ids, dangling edges, size caps.
• Catalogue: known node types; a bridged type whose package is missing → adapter_missing with params.package.
• Config: the type’s JSON schema (invalid_config + path), then its semantic checks, then escalation blocks.
• Trigger/end: exactly one trigger, at least one end, no edge into the trigger, none out of an end.
• Outcomes: each required outcome has exactly one edge; no unknown or duplicate outcomes.
• Reachability: every node is reachable from the trigger.
• Cycles: with the guarded edges removed — a loop’s continue edge and the way out of a delay with a positive for — no cycle remains.
• Fields and refs: field paths, operators, value types, writability, inputs, ancestor refs, the subject’s owner resolution.
• Actor: on_behalf_of needs a trigger with a user.
• Import flags: unresolved template review flags.
• Cross-definition: start_workflow targets exist for the owner, are manual, and get their required inputs; a static self-start without wait: false is a warning.

Codes

Input from the browser is untrusted: validation and draft saves answer any document — wrong types at every level, deep nesting, huge strings — with a ValidationReport or InvalidGraphException, never a TypeError, and no error message echoes a submitted value.