@flow-as-code/core 0.1.0

package/dist/lint/engine.js

@@ -0,0 +1,37 @@
+import { assertFlowDoc } from "../flowdoc.js";
+import { allRules } from "./rules/index.js";
+const order = (a, b) => a.doc.localeCompare(b.doc) ||
+    a.rule.localeCompare(b.rule) ||
+    (a.blockId ?? "").localeCompare(b.blockId ?? "") ||
+    a.message.localeCompare(b.message);
+/**
+ * Runs every rule over every document. Findings are sorted so output is stable
+ * regardless of rule execution order.
+ */
+export function lint(input, options = {}) {
+    const docs = Array.isArray(input) ? input : [input];
+    // Rules read doc.content.Actions and doc.name directly. A malformed document
+    // used to surface as a TypeError from whichever rule happened to run first,
+    // which named neither lint nor the document.
+    for (const doc of docs)
+        assertFlowDoc(doc, "lint");
+    const disabled = new Set(options.disable ?? []);
+    const rules = (options.rules ?? allRules).filter((r) => !disabled.has(r.id));
+    const findings = [];
+    for (const doc of docs) {
+        for (const rule of rules) {
+            rule.check({
+                doc,
+                all: docs,
+                report: (f) => findings.push({ ...f, rule: rule.id, doc: doc.name }),
+            });
+        }
+    }
+    return findings.sort(order);
+}
+/** True when any finding would block a studio save. */
+export function hasBlockingFindings(findings, rules = allRules) {
+    const hard = new Set(rules.filter((r) => r.hard).map((r) => r.id));
+    return findings.some((f) => hard.has(f.rule));
+}
+//# sourceMappingURL=engine.js.map

package/dist/lint/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/lint/engine.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAU5C,MAAM,KAAK,GAAG,CAAC,CAAU,EAAE,CAAU,EAAU,EAAE,CAC/C,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC;IAC1B,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5B,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;IAChD,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AAErC;;;GAGG;AACH,MAAM,UAAU,IAAI,CAAC,KAAmC,EAAE,UAAuB,EAAE;IACjF,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAgB,CAAC,CAAC;IAC/D,6EAA6E;IAC7E,4EAA4E;IAC5E,6CAA6C;IAC7C,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAE7E,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,KAAK,CAAC;gBACT,GAAG;gBACH,GAAG,EAAE,IAAI;gBACT,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;aACrE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,mBAAmB,CACjC,QAA4B,EAC5B,QAAyB,QAAQ;IAEjC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAChD,CAAC"}

package/dist/lint/graph.d.ts

@@ -0,0 +1,34 @@
+import type { FlowAction, FlowDoc } from "../flowdoc.js";
+export declare function transitionTargets(action: FlowAction): string[];
+export declare function isTerminal(action: FlowAction): boolean;
+export declare function actionsById(doc: FlowDoc): Map<string, FlowAction>;
+/** Identifiers reachable from StartAction. */
+export declare function reachable(doc: FlowDoc): Set<string>;
+/** Walks every string in a value, yielding [jsonPath, value] pairs. */
+export declare function walkStrings(value: unknown, path?: string): [string, string][];
+/**
+ * Every authored string in an action, with the path it sits at, for attributing
+ * a finding to a block.
+ *
+ * Transitions are included, not just Parameters. A condition operand is
+ * authored content like any other, and scanning only Parameters left a literal
+ * ARN or a malformed token in `Transitions.Conditions[n].Condition.Operands`
+ * completely undetected. Identifiers appearing here cannot produce false
+ * positives: Connect forbids ":" in an Identifier, so a NextAction can never
+ * look like an ARN or a token.
+ */
+/**
+ * Authored strings that belong to the document rather than to any one action:
+ * today that is `content.Metadata`.
+ *
+ * materialize carries Metadata into deployable output and resolves tokens in
+ * it, so it is authored content by any reasonable reading, but nothing scanned
+ * it. A literal ARN placed there passed every gate and reached both deploy
+ * paths, including @flow-as-code/cdk, which refuses the identical ARN in Parameters.
+ */
+export declare function documentStrings(doc: FlowDoc): [string, string][];
+export declare function findingsForActions(doc: FlowDoc): {
+    action: FlowAction;
+    strings: [string, string][];
+}[];
+//# sourceMappingURL=graph.d.ts.map

package/dist/lint/graph.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph.d.ts","sourceRoot":"","sources":["../../src/lint/graph.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAEzD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,EAAE,CAO9D;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAEtD;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAEjE;AAED,8CAA8C;AAC9C,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAanD;AAED,uEAAuE;AACvE,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAK,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CASzE;AAED;;;;;;;;;;GAUG;AACH;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAGhE;AAED,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,OAAO,GACX;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAA;CAAE,EAAE,CAKvD"}

package/dist/lint/graph.js

@@ -0,0 +1,79 @@
+/*
+ * Copyright 2026 The flow-as-code Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+// Shared traversal helpers. Browser-safe: no Node builtins.
+export function transitionTargets(action) {
+    const t = action.Transitions;
+    return [
+        ...(t.NextAction === undefined ? [] : [t.NextAction]),
+        ...(t.Errors ?? []).map((e) => e.NextAction),
+        ...(t.Conditions ?? []).map((c) => c.NextAction),
+    ];
+}
+export function isTerminal(action) {
+    return Object.keys(action.Transitions).length === 0;
+}
+export function actionsById(doc) {
+    return new Map(doc.content.Actions.map((a) => [a.Identifier, a]));
+}
+/** Identifiers reachable from StartAction. */
+export function reachable(doc) {
+    const byId = actionsById(doc);
+    const seen = new Set();
+    const queue = [doc.content.StartAction];
+    while (queue.length > 0) {
+        const id = queue.shift();
+        if (seen.has(id))
+            continue;
+        const action = byId.get(id);
+        if (action === undefined)
+            continue;
+        seen.add(id);
+        queue.push(...transitionTargets(action));
+    }
+    return seen;
+}
+/** Walks every string in a value, yielding [jsonPath, value] pairs. */
+export function walkStrings(value, path = "") {
+    if (typeof value === "string")
+        return [[path, value]];
+    if (Array.isArray(value))
+        return value.flatMap((v, i) => walkStrings(v, `${path}[${i}]`));
+    if (value !== null && typeof value === "object") {
+        return Object.entries(value).flatMap(([k, v]) => walkStrings(v, path === "" ? k : `${path}.${k}`));
+    }
+    return [];
+}
+/**
+ * Every authored string in an action, with the path it sits at, for attributing
+ * a finding to a block.
+ *
+ * Transitions are included, not just Parameters. A condition operand is
+ * authored content like any other, and scanning only Parameters left a literal
+ * ARN or a malformed token in `Transitions.Conditions[n].Condition.Operands`
+ * completely undetected. Identifiers appearing here cannot produce false
+ * positives: Connect forbids ":" in an Identifier, so a NextAction can never
+ * look like an ARN or a token.
+ */
+/**
+ * Authored strings that belong to the document rather than to any one action:
+ * today that is `content.Metadata`.
+ *
+ * materialize carries Metadata into deployable output and resolves tokens in
+ * it, so it is authored content by any reasonable reading, but nothing scanned
+ * it. A literal ARN placed there passed every gate and reached both deploy
+ * paths, including @flow-as-code/cdk, which refuses the identical ARN in Parameters.
+ */
+export function documentStrings(doc) {
+    if (doc.content.Metadata === undefined)
+        return [];
+    return walkStrings(doc.content.Metadata, "content.Metadata");
+}
+export function findingsForActions(doc) {
+    return doc.content.Actions.map((action) => ({
+        action,
+        strings: [...walkStrings(action.Parameters), ...walkStrings(action.Transitions, "Transitions")],
+    }));
+}
+//# sourceMappingURL=graph.js.map

package/dist/lint/graph.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph.js","sourceRoot":"","sources":["../../src/lint/graph.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,4DAA4D;AAI5D,MAAM,UAAU,iBAAiB,CAAC,MAAkB;IAClD,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;IAC7B,OAAO;QACL,GAAG,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACrD,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;QAC5C,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAkB;IAC3C,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAY;IACtC,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,SAAS,CAAC,GAAY;IACpC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACxC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;QAC1B,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,KAAK,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,IAAI,GAAG,EAAE;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1F,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAC9C,WAAW,CAAC,CAAC,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CACjD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;GAUG;AACH;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,GAAY;IAC1C,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAClD,OAAO,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,GAAY;IAEZ,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1C,MAAM;QACN,OAAO,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;KAChG,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/lint/index.d.ts

@@ -0,0 +1,7 @@
+export type { Finding, Rule, RuleContext, Severity } from "./types.js";
+export { lint, hasBlockingFindings } from "./engine.js";
+export type { LintOptions } from "./engine.js";
+export { toJson, toText } from "./reporters.js";
+export { allRules, ruleById } from "./rules/index.js";
+export { NO_LITERAL_ARN, literalArnMessage, literalArnPaths } from "./rules/index.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/lint/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lint/index.ts"],"names":[],"mappings":"AAIA,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACxD,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/lint/index.js

@@ -0,0 +1,5 @@
+export { lint, hasBlockingFindings } from "./engine.js";
+export { toJson, toText } from "./reporters.js";
+export { allRules, ruleById } from "./rules/index.js";
+export { NO_LITERAL_ARN, literalArnMessage, literalArnPaths } from "./rules/index.js";
+//# sourceMappingURL=index.js.map

package/dist/lint/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/lint/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAExD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/lint/reporters.d.ts

@@ -0,0 +1,6 @@
+import type { Finding } from "./types.js";
+/** Machine-readable. Stable shape; the CLI's --format json emits this. */
+export declare function toJson(findings: readonly Finding[]): string;
+/** Human-readable, one finding per line, grouped by document. */
+export declare function toText(findings: readonly Finding[]): string;
+//# sourceMappingURL=reporters.d.ts.map

package/dist/lint/reporters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reporters.d.ts","sourceRoot":"","sources":["../../src/lint/reporters.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C,0EAA0E;AAC1E,wBAAgB,MAAM,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,MAAM,CAY3D;AAED,iEAAiE;AACjE,wBAAgB,MAAM,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,MAAM,CAqB3D"}

package/dist/lint/reporters.js

@@ -0,0 +1,30 @@
+/** Machine-readable. Stable shape; the CLI's --format json emits this. */
+export function toJson(findings) {
+    const errors = findings.filter((f) => f.severity === "error").length;
+    return (JSON.stringify({
+        summary: { total: findings.length, errors, warnings: findings.length - errors },
+        findings,
+    }, null, 2) + "\n");
+}
+/** Human-readable, one finding per line, grouped by document. */
+export function toText(findings) {
+    if (findings.length === 0)
+        return "No findings.\n";
+    const lines = [];
+    let current = "";
+    for (const f of findings) {
+        if (f.doc !== current) {
+            if (current !== "")
+                lines.push("");
+            lines.push(f.doc);
+            current = f.doc;
+        }
+        const where = f.blockId === undefined ? "" : ` (${f.blockId})`;
+        lines.push(`  ${f.severity}${where}: ${f.message} [${f.rule}]`);
+    }
+    const errors = findings.filter((f) => f.severity === "error").length;
+    lines.push("");
+    lines.push(`${findings.length} finding(s): ${errors} error(s), ${findings.length - errors} warning(s).`);
+    return lines.join("\n") + "\n";
+}
+//# sourceMappingURL=reporters.js.map

package/dist/lint/reporters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reporters.js","sourceRoot":"","sources":["../../src/lint/reporters.ts"],"names":[],"mappings":"AAMA,0EAA0E;AAC1E,MAAM,UAAU,MAAM,CAAC,QAA4B;IACjD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IACrE,OAAO,CACL,IAAI,CAAC,SAAS,CACZ;QACE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,MAAM,EAAE;QAC/E,QAAQ;KACT,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CACT,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,MAAM,CAAC,QAA4B;IACjD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAEnD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;YACtB,IAAI,OAAO,KAAK,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAClB,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC;QAClB,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,CAAC;QAC/D,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,GAAG,KAAK,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IACrE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CACR,GAAG,QAAQ,CAAC,MAAM,gBAAgB,MAAM,cAAc,QAAQ,CAAC,MAAM,GAAG,MAAM,cAAc,CAC7F,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC"}

package/dist/lint/rules/action-allowed-in-flow-type.d.ts

@@ -0,0 +1,11 @@
+import type { Rule } from "../types.js";
+/**
+ * Almost every Connect action documents a Restrictions section naming the flow
+ * types it is legal in. Deploying a flow that violates one fails at create time
+ * with a message that does not say which block is at fault.
+ *
+ * Added 2026-08-31 from the A00b reference; not one of the original nine rules
+ * in SPEC.md. Restrictions live in actions.ts, sourced per action page.
+ */
+export declare const actionAllowedInFlowType: Rule;
+//# sourceMappingURL=action-allowed-in-flow-type.d.ts.map

package/dist/lint/rules/action-allowed-in-flow-type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-allowed-in-flow-type.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/action-allowed-in-flow-type.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAExC;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,EAAE,IAgBrC,CAAC"}

package/dist/lint/rules/action-allowed-in-flow-type.js

@@ -0,0 +1,32 @@
+/*
+ * Copyright 2026 The flow-as-code Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { FLOW_TYPE_RESTRICTIONS } from "../../actions.js";
+/**
+ * Almost every Connect action documents a Restrictions section naming the flow
+ * types it is legal in. Deploying a flow that violates one fails at create time
+ * with a message that does not say which block is at fault.
+ *
+ * Added 2026-08-31 from the A00b reference; not one of the original nine rules
+ * in SPEC.md. Restrictions live in actions.ts, sourced per action page.
+ */
+export const actionAllowedInFlowType = {
+    id: "action-allowed-in-flow-type",
+    description: "Each action must be legal in the flow type that contains it.",
+    check({ doc, report }) {
+        for (const action of doc.content.Actions) {
+            const allowed = FLOW_TYPE_RESTRICTIONS[action.Type];
+            if (allowed === undefined)
+                continue;
+            if (!allowed.includes(doc.connectType)) {
+                report({
+                    severity: "error",
+                    blockId: action.Identifier,
+                    message: `${action.Type} is not allowed in a ${doc.connectType} flow. Allowed: ${allowed.join(", ")}.`,
+                });
+            }
+        }
+    },
+};
+//# sourceMappingURL=action-allowed-in-flow-type.js.map

package/dist/lint/rules/action-allowed-in-flow-type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-allowed-in-flow-type.js","sourceRoot":"","sources":["../../../src/lint/rules/action-allowed-in-flow-type.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAG1D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAS;IAC3C,EAAE,EAAE,6BAA6B;IACjC,WAAW,EAAE,8DAA8D;IAC3E,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE;QACnB,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACpD,IAAI,OAAO,KAAK,SAAS;gBAAE,SAAS;YACpC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBACvC,MAAM,CAAC;oBACL,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,MAAM,CAAC,UAAU;oBAC1B,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,wBAAwB,GAAG,CAAC,WAAW,mBAAmB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;iBACvG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/lint/rules/action-count.d.ts

@@ -0,0 +1,16 @@
+import type { Rule } from "../types.js";
+/**
+ * "No more than 250 Actions per flow."
+ * https://docs.aws.amazon.com/connect/latest/devguide/flow-language-example.html
+ * (transcribed in conformance/flow-language/actions.md, document envelope).
+ *
+ * The FlowDoc schema says maxItems 250, but nothing on the authoring path runs
+ * the schema: render, codegen, materialization, and both emitters read the
+ * document straight. `Flow.add` refuses the 251st block, so a flow built with
+ * the builder cannot exceed the limit, but a FlowDoc that arrives any other way
+ * (hand-edited, exported from an instance, produced by another tool) reached
+ * emit with no complaint and failed at deploy time with a Connect error that
+ * names no block. This rule is the check on the FlowDoc path.
+ */
+export declare const actionCount: Rule;
+//# sourceMappingURL=action-count.d.ts.map

package/dist/lint/rules/action-count.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-count.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/action-count.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAExC;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,WAAW,EAAE,IAczB,CAAC"}

package/dist/lint/rules/action-count.js

@@ -0,0 +1,32 @@
+/*
+ * Copyright 2026 The flow-as-code Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { MAX_ACTIONS_PER_FLOW } from "../../flowdoc.js";
+/**
+ * "No more than 250 Actions per flow."
+ * https://docs.aws.amazon.com/connect/latest/devguide/flow-language-example.html
+ * (transcribed in conformance/flow-language/actions.md, document envelope).
+ *
+ * The FlowDoc schema says maxItems 250, but nothing on the authoring path runs
+ * the schema: render, codegen, materialization, and both emitters read the
+ * document straight. `Flow.add` refuses the 251st block, so a flow built with
+ * the builder cannot exceed the limit, but a FlowDoc that arrives any other way
+ * (hand-edited, exported from an instance, produced by another tool) reached
+ * emit with no complaint and failed at deploy time with a Connect error that
+ * names no block. This rule is the check on the FlowDoc path.
+ */
+export const actionCount = {
+    id: "action-count",
+    description: `A flow holds no more than ${String(MAX_ACTIONS_PER_FLOW)} actions.`,
+    check({ doc, report }) {
+        const count = doc.content.Actions.length;
+        if (count > MAX_ACTIONS_PER_FLOW) {
+            report({
+                severity: "error",
+                message: `Flow has ${String(count)} actions; Connect allows at most ${String(MAX_ACTIONS_PER_FLOW)}.`,
+            });
+        }
+    },
+};
+//# sourceMappingURL=action-count.js.map

package/dist/lint/rules/action-count.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-count.js","sourceRoot":"","sources":["../../../src/lint/rules/action-count.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAGxD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,WAAW,GAAS;IAC/B,EAAE,EAAE,cAAc;IAClB,WAAW,EAAE,6BAA6B,MAAM,CAAC,oBAAoB,CAAC,WAAW;IACjF,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE;QACnB,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;QACzC,IAAI,KAAK,GAAG,oBAAoB,EAAE,CAAC;YACjC,MAAM,CAAC;gBACL,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,YAAY,MAAM,CAAC,KAAK,CAAC,oCAAoC,MAAM,CAC1E,oBAAoB,CACrB,GAAG;aACL,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/lint/rules/error-branches.d.ts

@@ -0,0 +1,10 @@
+import type { Rule } from "../types.js";
+/**
+ * The backstop for the type-level enforcement in the builder. It catches what
+ * types cannot: hand-edited FlowDocs, exported flows, and studio edits.
+ *
+ * Only modeled actions are checked. We cannot know an unmodeled action's error
+ * set, and some documented actions genuinely have none.
+ */
+export declare const errorBranches: Rule;
+//# sourceMappingURL=error-branches.d.ts.map

package/dist/lint/rules/error-branches.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-branches.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/error-branches.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAIxC;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,EAAE,IAsB3B,CAAC"}

package/dist/lint/rules/error-branches.js

@@ -0,0 +1,39 @@
+/*
+ * Copyright 2026 The flow-as-code Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { ActionType, NO_MATCHING_CONDITION, NO_MATCHING_ERROR, TERMINAL_ACTIONS, } from "../../actions.js";
+import { isTerminal } from "../graph.js";
+const MODELED = new Set(Object.values(ActionType));
+/**
+ * The backstop for the type-level enforcement in the builder. It catches what
+ * types cannot: hand-edited FlowDocs, exported flows, and studio edits.
+ *
+ * Only modeled actions are checked. We cannot know an unmodeled action's error
+ * set, and some documented actions genuinely have none.
+ */
+export const errorBranches = {
+    id: "error-branches",
+    description: "Every non-terminal modeled action must wire its catch-all error branch.",
+    check({ doc, report }) {
+        for (const action of doc.content.Actions) {
+            if (isTerminal(action))
+                continue;
+            if (!MODELED.has(action.Type))
+                continue;
+            if (TERMINAL_ACTIONS.includes(action.Type))
+                continue;
+            // Compare is the one modeled action that fails with NoMatchingCondition.
+            const expected = action.Type === ActionType.Compare ? NO_MATCHING_CONDITION : NO_MATCHING_ERROR;
+            const wired = (action.Transitions.Errors ?? []).some((e) => e.ErrorType === expected);
+            if (!wired) {
+                report({
+                    severity: "error",
+                    blockId: action.Identifier,
+                    message: `${action.Type} does not wire its "${expected}" branch.`,
+                });
+            }
+        }
+    },
+};
+//# sourceMappingURL=error-branches.js.map

package/dist/lint/rules/error-branches.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-branches.js","sourceRoot":"","sources":["../../../src/lint/rules/error-branches.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,UAAU,EACV,qBAAqB,EACrB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;AAE3D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAS;IACjC,EAAE,EAAE,gBAAgB;IACpB,WAAW,EAAE,yEAAyE;IACtF,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE;QACnB,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACzC,IAAI,UAAU,CAAC,MAAM,CAAC;gBAAE,SAAS;YACjC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,SAAS;YACxC,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,SAAS;YAErD,yEAAyE;YACzE,MAAM,QAAQ,GACZ,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,iBAAiB,CAAC;YACjF,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC;YACtF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,CAAC;oBACL,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,MAAM,CAAC,UAAU;oBAC1B,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,uBAAuB,QAAQ,WAAW;iBAClE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/lint/rules/index.d.ts

@@ -0,0 +1,17 @@
+import { actionAllowedInFlowType } from "./action-allowed-in-flow-type.js";
+import { actionCount } from "./action-count.js";
+import { errorBranches } from "./error-branches.js";
+import { moduleDepth5 } from "./module-depth-5.js";
+import { noLiteralArn } from "./no-literal-arn.js";
+import { noUnresolvedToken } from "./no-unresolved-token.js";
+import { promptLength3000 } from "./prompt-length-3000.js";
+import { reachableBlocks } from "./reachable-blocks.js";
+import { recordingConsentBeforeRecord } from "./recording-consent-before-record.js";
+import { terminalBlocks } from "./terminal-blocks.js";
+import { uniqueNames } from "./unique-names.js";
+import type { Rule } from "../types.js";
+export declare const allRules: readonly Rule[];
+export declare function ruleById(id: string): Rule | undefined;
+export { NO_LITERAL_ARN, literalArnMessage, literalArnPaths } from "./no-literal-arn.js";
+export { actionAllowedInFlowType, actionCount, errorBranches, moduleDepth5, noLiteralArn, noUnresolvedToken, promptLength3000, reachableBlocks, recordingConsentBeforeRecord, terminalBlocks, uniqueNames, };
+//# sourceMappingURL=index.d.ts.map

package/dist/lint/rules/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAExC,eAAO,MAAM,QAAQ,EAAE,SAAS,IAAI,EAYnC,CAAC;AAEF,wBAAgB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAErD;AAED,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEzF,OAAO,EACL,uBAAuB,EACvB,WAAW,EACX,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,4BAA4B,EAC5B,cAAc,EACd,WAAW,GACZ,CAAC"}

package/dist/lint/rules/index.js

@@ -0,0 +1,36 @@
+/*
+ * Copyright 2026 The flow-as-code Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+// Rule registry. Ids are stable and never renamed: the conformance fixtures,
+// the CLI, the studio, and the future Go provider all key off them.
+import { actionAllowedInFlowType } from "./action-allowed-in-flow-type.js";
+import { actionCount } from "./action-count.js";
+import { errorBranches } from "./error-branches.js";
+import { moduleDepth5 } from "./module-depth-5.js";
+import { noLiteralArn } from "./no-literal-arn.js";
+import { noUnresolvedToken } from "./no-unresolved-token.js";
+import { promptLength3000 } from "./prompt-length-3000.js";
+import { reachableBlocks } from "./reachable-blocks.js";
+import { recordingConsentBeforeRecord } from "./recording-consent-before-record.js";
+import { terminalBlocks } from "./terminal-blocks.js";
+import { uniqueNames } from "./unique-names.js";
+export const allRules = [
+    noLiteralArn,
+    noUnresolvedToken,
+    reachableBlocks,
+    errorBranches,
+    terminalBlocks,
+    moduleDepth5,
+    promptLength3000,
+    recordingConsentBeforeRecord,
+    uniqueNames,
+    actionAllowedInFlowType,
+    actionCount,
+];
+export function ruleById(id) {
+    return allRules.find((r) => r.id === id);
+}
+export { NO_LITERAL_ARN, literalArnMessage, literalArnPaths } from "./no-literal-arn.js";
+export { actionAllowedInFlowType, actionCount, errorBranches, moduleDepth5, noLiteralArn, noUnresolvedToken, promptLength3000, reachableBlocks, recordingConsentBeforeRecord, terminalBlocks, uniqueNames, };
+//# sourceMappingURL=index.js.map

package/dist/lint/rules/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lint/rules/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,6EAA6E;AAC7E,oEAAoE;AAEpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGhD,MAAM,CAAC,MAAM,QAAQ,GAAoB;IACvC,YAAY;IACZ,iBAAiB;IACjB,eAAe;IACf,aAAa;IACb,cAAc;IACd,YAAY;IACZ,gBAAgB;IAChB,4BAA4B;IAC5B,WAAW;IACX,uBAAuB;IACvB,WAAW;CACZ,CAAC;AAEF,MAAM,UAAU,QAAQ,CAAC,EAAU;IACjC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEzF,OAAO,EACL,uBAAuB,EACvB,WAAW,EACX,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,4BAA4B,EAC5B,cAAc,EACd,WAAW,GACZ,CAAC"}

package/dist/lint/rules/module-depth-5.d.ts

@@ -0,0 +1,14 @@
+import type { Rule } from "../types.js";
+/**
+ * "You can invoke modules within other modules, supporting up to five levels of
+ * nesting with a stack limit to prevent recursive invocations."
+ * https://docs.aws.amazon.com/connect/latest/adminguide/contact-flow-modules.html
+ */
+export declare const MAX_MODULE_DEPTH = 5;
+/**
+ * Depth is only computable across a set: a document alone cannot know what the
+ * modules it invokes go on to invoke. Linting a single document therefore
+ * reports nothing here, which is correct rather than a false pass.
+ */
+export declare const moduleDepth5: Rule;
+//# sourceMappingURL=module-depth-5.d.ts.map

package/dist/lint/rules/module-depth-5.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-depth-5.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/module-depth-5.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAExC;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAclC;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAE,IAoC1B,CAAC"}

package/dist/lint/rules/module-depth-5.js

@@ -0,0 +1,67 @@
+/*
+ * Copyright 2026 The flow-as-code Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { ActionType } from "../../actions.js";
+import { parseToken } from "../../refs.js";
+/**
+ * "You can invoke modules within other modules, supporting up to five levels of
+ * nesting with a stack limit to prevent recursive invocations."
+ * https://docs.aws.amazon.com/connect/latest/adminguide/contact-flow-modules.html
+ */
+export const MAX_MODULE_DEPTH = 5;
+function invokedModules(doc) {
+    const names = [];
+    for (const action of doc.content.Actions) {
+        if (action.Type !== ActionType.InvokeFlowModule)
+            continue;
+        const id = action.Parameters.FlowModuleId;
+        if (typeof id !== "string")
+            continue;
+        const ref = parseToken(id);
+        if (ref?.type === "module")
+            names.push(ref.name);
+    }
+    return names;
+}
+/**
+ * Depth is only computable across a set: a document alone cannot know what the
+ * modules it invokes go on to invoke. Linting a single document therefore
+ * reports nothing here, which is correct rather than a false pass.
+ */
+export const moduleDepth5 = {
+    id: "module-depth-5",
+    description: "Flow module invocation must not nest more than five levels deep, and must not recurse.",
+    check({ doc, all, report }) {
+        // Depth is measured from an entry point. Walking from every document would
+        // report the same violation once per document in the chain, so only flows
+        // start a walk. A module unreachable from any flow is dead code, which is
+        // reachable-blocks territory rather than this rule's.
+        if (doc.kind !== "flow")
+            return;
+        const modules = new Map(all.filter((d) => d.kind === "module").map((d) => [d.name, d]));
+        const walk = (current, depth, stack) => {
+            for (const name of invokedModules(current)) {
+                if (stack.includes(name)) {
+                    report({
+                        severity: "error",
+                        message: `Recursive module invocation: ${[...stack, name].join(" -> ")}.`,
+                    });
+                    continue;
+                }
+                if (depth + 1 > MAX_MODULE_DEPTH) {
+                    report({
+                        severity: "error",
+                        message: `Module nesting reaches depth ${depth + 1} via ${[...stack, name].join(" -> ")}; Connect allows ${MAX_MODULE_DEPTH}.`,
+                    });
+                    continue;
+                }
+                const next = modules.get(name);
+                if (next !== undefined)
+                    walk(next, depth + 1, [...stack, name]);
+            }
+        };
+        walk(doc, 0, [doc.name]);
+    },
+};
+//# sourceMappingURL=module-depth-5.js.map

package/dist/lint/rules/module-depth-5.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-depth-5.js","sourceRoot":"","sources":["../../../src/lint/rules/module-depth-5.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAI3C;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAElC,SAAS,cAAc,CAAC,GAAY;IAClC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACzC,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,gBAAgB;YAAE,SAAS;QAC1D,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC;QAC1C,IAAI,OAAO,EAAE,KAAK,QAAQ;YAAE,SAAS;QACrC,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,GAAG,EAAE,IAAI,KAAK,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAS;IAChC,EAAE,EAAE,gBAAgB;IACpB,WAAW,EACT,wFAAwF;IAC1F,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE;QACxB,2EAA2E;QAC3E,0EAA0E;QAC1E,0EAA0E;QAC1E,sDAAsD;QACtD,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO;QAEhC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAExF,MAAM,IAAI,GAAG,CAAC,OAAgB,EAAE,KAAa,EAAE,KAAe,EAAQ,EAAE;YACtE,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3C,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzB,MAAM,CAAC;wBACL,QAAQ,EAAE,OAAO;wBACjB,OAAO,EAAE,gCAAgC,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG;qBAC1E,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBACD,IAAI,KAAK,GAAG,CAAC,GAAG,gBAAgB,EAAE,CAAC;oBACjC,MAAM,CAAC;wBACL,QAAQ,EAAE,OAAO;wBACjB,OAAO,EAAE,gCAAgC,KAAK,GAAG,CAAC,QAAQ,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,gBAAgB,GAAG;qBAC/H,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC/B,IAAI,IAAI,KAAK,SAAS;oBAAE,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;YAClE,CAAC;QACH,CAAC,CAAC;QAEF,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3B,CAAC;CACF,CAAC"}

package/dist/lint/rules/no-literal-arn.d.ts

@@ -0,0 +1,21 @@
+import type { Rule } from "../types.js";
+/** This rule's id, for tools that report the violation before lint can run. */
+export declare const NO_LITERAL_ARN = "no-literal-arn";
+/** The sentence every literal-ARN report ends with. */
+export declare function literalArnMessage(path: string): string;
+/**
+ * Paths of every string holding a literal ARN in an arbitrary JSON value.
+ *
+ * Takes `unknown` rather than a FlowDoc on purpose: the CLI runs this over a
+ * document the schema has already rejected, because the schema's own pattern
+ * errors describe that one mistake several times over and never name the rule.
+ * See packages/cli/src/docs.ts.
+ */
+export declare function literalArnPaths(value: unknown): string[];
+/**
+ * References are tokens, never literal ARNs. A literal ARN pins a flow to one
+ * account, region, and instance, which is the whole thing this tooling exists
+ * to avoid.
+ */
+export declare const noLiteralArn: Rule;
+//# sourceMappingURL=no-literal-arn.d.ts.map

package/dist/lint/rules/no-literal-arn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-literal-arn.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/no-literal-arn.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAIxC,+EAA+E;AAC/E,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAE/C,uDAAuD;AACvD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAIxD;AAED;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAE,IA2B1B,CAAC"}