01 · Before and afterThe pattern
// before: array input, duplicate check by hand, caller-supplied flags trusted
seededSteps: z.array(z.object({ nodeId: z.string(), outputs: slots }))
// after: one entry per node by construction; engine-only state derived, never accepted
seededSteps: z.record(z.string().min(1), slots).optional()
const reachable = descendantsOf(graph, trigger.id);
for (const id of Object.keys(seededSteps)) if (!reachable.has(id)) throw new GraphValidationError(...);
const stored = { ...graph, seeded: Object.keys(seededSteps) }; // not read from the request02 · Run it on your appThe check
Can a client of your API send a field that only your server is supposed to set, and does the server keep it?
If the honest answer is no or not sure, this is worth a look before it reaches production.