feat(web_core): add PayloadValidator, UAX 31 identifier checks, and full JSON Schema constraint parity

[gspencergoog]

Summary

Adds catalog-scoped PayloadValidator and shared UAX #31 identifier validation in @a2ui/web_core, and closes JSON Schema validation disparities with Python's Draft202012Validator directly in schema_loader.ts without an Ajv dependency.

Part of Stack #2720 (stacked on #2715).

Reviewer Focus

• src/validation/payload-validator.ts: Verify validateFunction's @index fallback to IndexApi when un-registered in catalog.functions, argument validation returning parsed records to eliminate duplicate parsing in RpcHandler, and recursive validateNestedFunctions traversal with catalogId overrides.
• src/catalog/schema_loader.ts: Scrutinize convertRefToZod (z.lazy cycle handling with defCache caching), convertUnionToZod (oneOf exclusivity vs anyOf), and numeric/string/array constraint conversion.
• Files to skim: Conformance test updates in conformance/core/validator_v1_0.yaml and schema type registrations in src/types/ can be safely skimmed.

Changes

• UAX #31 identifier validation (src/common/uax31.ts):
  • Extracted isValidUax31Identifier and assertUax31Identifier from schema_loader.ts.
  • Switched from ID_Start/ID_Continue to the specification's XID_Start/XID_Continue Unicode property classes.
  • Raised A2uiCatalogError on invalid identifiers at catalog construction time.
• PayloadValidator (src/validation/payload-validator.ts):
  • Added validateComponent, validateFunction, and validateTheme scoped to a single Catalog.
  • Enforced v1.0 UAX #31 identifier checks on component instance IDs, function names, and argument keys.
  • Added @index system function fallback (IndexApi) so custom v1.0 catalogs validate @index calls under strict validation.
  • Returned parsed argument records from validateFunction to avoid redundant second-pass parsing.
  • Recursively validated nested {call, args} objects within component properties (validateNestedFunctions), resolving catalogId overrides against availableCatalogs.
  • Extracted identifier validation into assertFunctionIdentifiers to maintain cognitive complexity $\le 11$.
• JSON Schema to Zod parity (src/catalog/schema_loader.ts):
  • Added z.lazy recursion and per-branch visitedPointers sets so self-recursive #/$defs/... references (such as TreeNode) validate at arbitrary depth, caching compiled closures in defCache.
  • Replaced silent z.unknown() fallbacks on unresolvable #/$defs/... references with a failing superRefine validator.
  • Added DataBinding and FunctionCall to COMMON_TYPE_SCHEMAS, preserving union branches when combined with enum in oneOf/anyOf.
  • Enforced bounds, counts, and item uniqueness constraints (minimum, maximum, minLength, maxLength, minItems, maxItems, uniqueItems, const, not).
  • Enforced .strict() on inline nested type: object schemas when additionalProperties: false is set.
  • Enforced oneOf single-branch exclusivity (matchCount === 1) distinctly from anyOf.
  • Extracted $ref and union conversion into helper functions (convertRefToZod, convertUnionToZod).
• Processor and RPC wiring (message-processor.ts, rpc-handler.ts):
  • Routed component and theme validation in MessageProcessor and argument validation in RpcHandler.parseArguments through PayloadValidator.
• Conformance suite (validator_v1_0.yaml, conformance_test.mjs):
  • Strengthened test_v10_uax31_invalid_identifier_error with a valid root component on createSurface and an expectError.message check.

Impact & Risks

• Strict v1.0 identifier validation: Component instance IDs, function names, and argument keys in v1.0 surfaces are now checked against UAX #31. Payloads targeting v0.9 catalogs remain unaffected.
• Stricter JSON-loaded catalog validation: Catalogs loaded via Catalog.fromSchema now enforce bounds, recursive $defs, nested additionalProperties: false, and oneOf exclusivity at runtime.

Testing

1. Run unit tests in web_core (including uax31.test.ts and payload-validator.test.ts):

   yarn workspace @a2ui/web_core test

2. Run conformance tests:

   node typescript/web_core/tests/conformance/conformance_test.mjs

3. Run builds and linters across all workspaces:

   yarn workspaces foreach -A -t run build
   yarn workspaces foreach -A -p -j 8 run lint

[gspencergoog]

@nan-yu PTAL