@flow-as-code/core 0.1.0

package/dist/lint/rules/no-literal-arn.js

@@ -0,0 +1,58 @@
+/*
+ * Copyright 2026 The flow-as-code Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { documentStrings, findingsForActions, walkStrings } from "../graph.js";
+const ARN = /arn:aws[a-z-]*:/;
+/** This rule's id, for tools that report the violation before lint can run. */
+export const NO_LITERAL_ARN = "no-literal-arn";
+/** The sentence every literal-ARN report ends with. */
+export function literalArnMessage(path) {
+    return `"${path}" contains a literal ARN. Use a \${cdref:type:name} token instead.`;
+}
+/**
+ * Paths of every string holding a literal ARN in an arbitrary JSON value.
+ *
+ * Takes `unknown` rather than a FlowDoc on purpose: the CLI runs this over a
+ * document the schema has already rejected, because the schema's own pattern
+ * errors describe that one mistake several times over and never name the rule.
+ * See packages/cli/src/docs.ts.
+ */
+export function literalArnPaths(value) {
+    return walkStrings(value)
+        .filter(([, v]) => ARN.test(v))
+        .map(([path]) => path);
+}
+/**
+ * References are tokens, never literal ARNs. A literal ARN pins a flow to one
+ * account, region, and instance, which is the whole thing this tooling exists
+ * to avoid.
+ */
+export const noLiteralArn = {
+    id: NO_LITERAL_ARN,
+    description: "Authored content must not contain a literal ARN; use a ${cdref:...} token.",
+    hard: true,
+    check({ doc, report }) {
+        // `refs` is authored content too: it is what the studio's reference
+        // pickers and the emitters read, and an ARN placed there satisfied this
+        // rule while the schema was the only thing catching it.
+        const documentLevel = [...documentStrings(doc), ...walkStrings(doc.refs ?? [], "refs")];
+        for (const [path, value] of documentLevel) {
+            if (ARN.test(value)) {
+                report({ severity: "error", message: literalArnMessage(path) });
+            }
+        }
+        for (const { action, strings } of findingsForActions(doc)) {
+            for (const [path, value] of strings) {
+                if (ARN.test(value)) {
+                    report({
+                        severity: "error",
+                        blockId: action.Identifier,
+                        message: `${path.startsWith("Transitions") ? "Transition" : "Parameter"} ${literalArnMessage(path)}`,
+                    });
+                }
+            }
+        }
+    },
+};
+//# sourceMappingURL=no-literal-arn.js.map

package/dist/lint/rules/no-literal-arn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-literal-arn.js","sourceRoot":"","sources":["../../../src/lint/rules/no-literal-arn.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/E,MAAM,GAAG,GAAG,iBAAiB,CAAC;AAE9B,+EAA+E;AAC/E,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAE/C,uDAAuD;AACvD,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,IAAI,IAAI,oEAAoE,CAAC;AACtF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,WAAW,CAAC,KAAK,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;SAC9B,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAS;IAChC,EAAE,EAAE,cAAc;IAClB,WAAW,EAAE,4EAA4E;IACzF,IAAI,EAAE,IAAI;IACV,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE;QACnB,oEAAoE;QACpE,wEAAwE;QACxE,wDAAwD;QACxD,MAAM,aAAa,GAAG,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QACxF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,aAAa,EAAE,CAAC;YAC1C,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpB,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QAED,KAAK,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;gBACpC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBACpB,MAAM,CAAC;wBACL,QAAQ,EAAE,OAAO;wBACjB,OAAO,EAAE,MAAM,CAAC,UAAU;wBAC1B,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE;qBACrG,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/lint/rules/no-unresolved-token.d.ts

@@ -0,0 +1,8 @@
+import type { Rule } from "../types.js";
+/**
+ * Every token must be well formed, must occupy its entire field, and must
+ * appear in the refs index. A token Connect never resolves deploys a flow that
+ * fails at runtime with an opaque error.
+ */
+export declare const noUnresolvedToken: Rule;
+//# sourceMappingURL=no-unresolved-token.d.ts.map

package/dist/lint/rules/no-unresolved-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-unresolved-token.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/no-unresolved-token.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAexC;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,IAqD/B,CAAC"}

package/dist/lint/rules/no-unresolved-token.js

@@ -0,0 +1,71 @@
+/*
+ * Copyright 2026 The flow-as-code Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { documentStrings, findingsForActions } from "../graph.js";
+import { TOKEN_PATTERN, parseToken } from "../../refs.js";
+/** Any ${...} placeholder, so malformed tokens are caught rather than ignored. */
+/**
+ * Only placeholders that ATTEMPT to be a reference are this rule's business.
+ *
+ * Scanning every `${...}` produced false positives on ordinary prompt text:
+ * "Your balance is ${amount}" is a literal string Connect plays verbatim, since
+ * Connect's own dynamic syntax is JSONPath ($.Attributes.x), not ${}. Matching
+ * on the `cdref` prefix still catches the cases that matter, a well-formed
+ * token interpolated into a longer string and a misspelled cdref, without
+ * claiming authority over text we do not own.
+ */
+const CDREF_PLACEHOLDER = /\$\{\s*cdref[^}]*\}/gi;
+/**
+ * Every token must be well formed, must occupy its entire field, and must
+ * appear in the refs index. A token Connect never resolves deploys a flow that
+ * fails at runtime with an opaque error.
+ */
+export const noUnresolvedToken = {
+    id: "no-unresolved-token",
+    description: "Every ${cdref:...} token must be well formed, stand alone, and appear in the refs index.",
+    hard: true,
+    check({ doc, report }) {
+        const indexed = new Set((doc.refs ?? []).map((r) => r.token));
+        const entries = [
+            ...documentStrings(doc).map(([path, value]) => ({ path, value })),
+            ...findingsForActions(doc).flatMap(({ action, strings }) => strings.map(([path, value]) => ({ blockId: action.Identifier, path, value }))),
+        ];
+        const where = (path) => path.startsWith("content.Metadata")
+            ? ""
+            : path.startsWith("Transitions")
+                ? "Transition "
+                : "Parameter ";
+        for (const { blockId, path, value } of entries) {
+            const placeholders = value.match(CDREF_PLACEHOLDER) ?? [];
+            if (placeholders.length === 0)
+                continue;
+            // Connect requires reference fields to be fully static or a single
+            // JSONPath identifier, so a token cannot be part of a longer string.
+            if (!TOKEN_PATTERN.test(value)) {
+                report({
+                    severity: "error",
+                    ...(blockId === undefined ? {} : { blockId }),
+                    message: `${where(path)}"${path}" embeds a token in a larger string ("${value}"). A token must be the entire value.`,
+                });
+                continue;
+            }
+            const token = placeholders[0];
+            if (parseToken(token) === undefined) {
+                report({
+                    severity: "error",
+                    ...(blockId === undefined ? {} : { blockId }),
+                    message: `${where(path)}"${path}" contains a malformed token "${token}".`,
+                });
+            }
+            else if (!indexed.has(token)) {
+                report({
+                    severity: "error",
+                    ...(blockId === undefined ? {} : { blockId }),
+                    message: `Token "${token}" is missing from the refs index. Re-run synth to regenerate it.`,
+                });
+            }
+        }
+    },
+};
+//# sourceMappingURL=no-unresolved-token.js.map

package/dist/lint/rules/no-unresolved-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-unresolved-token.js","sourceRoot":"","sources":["../../../src/lint/rules/no-unresolved-token.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAG1D,kFAAkF;AAClF;;;;;;;;;GASG;AACH,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAElD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAS;IACrC,EAAE,EAAE,qBAAqB;IACzB,WAAW,EACT,0FAA0F;IAC5F,IAAI,EAAE,IAAI;IACV,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE;QACnB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAE9D,MAAM,OAAO,GAAwD;YACnE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACjE,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CACzD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAC9E;SACF,CAAC;QAEF,MAAM,KAAK,GAAG,CAAC,IAAY,EAAU,EAAE,CACrC,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC;YACjC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;gBAC9B,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,YAAY,CAAC;QAErB,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;YAC/C,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;YAC1D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAExC,mEAAmE;YACnE,qEAAqE;YACrE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,CAAC;oBACL,QAAQ,EAAE,OAAO;oBACjB,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;oBAC7C,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,yCAAyC,KAAK,uCAAuC;iBACrH,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAE,CAAC;YAC/B,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,CAAC;oBACL,QAAQ,EAAE,OAAO;oBACjB,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;oBAC7C,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,iCAAiC,KAAK,IAAI;iBAC1E,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,CAAC;oBACL,QAAQ,EAAE,OAAO;oBACjB,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;oBAC7C,OAAO,EAAE,UAAU,KAAK,kEAAkE;iBAC3F,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/lint/rules/prompt-length-3000.d.ts

@@ -0,0 +1,16 @@
+import type { Rule } from "../types.js";
+/**
+ * "When you use text, either for text-to-speech or chat, you can use a maximum
+ * of 3,000 billed characters, which is 6,000 characters total."
+ * https://docs.aws.amazon.com/connect/latest/adminguide/play.html
+ *
+ * The Get customer input block states the same limit for its own text:
+ * https://docs.aws.amazon.com/connect/latest/adminguide/get-customer-input.html
+ *
+ * Billed characters are the spoken text. SSML markup counts toward the 6,000
+ * total but not the 3,000 billed, so the two are checked separately.
+ */
+export declare const MAX_BILLED_CHARACTERS = 3000;
+export declare const MAX_TOTAL_CHARACTERS = 6000;
+export declare const promptLength3000: Rule;
+//# sourceMappingURL=prompt-length-3000.d.ts.map

package/dist/lint/rules/prompt-length-3000.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt-length-3000.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/prompt-length-3000.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAExC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAC1C,eAAO,MAAM,oBAAoB,OAAO,CAAC;AAUzC,eAAO,MAAM,gBAAgB,EAAE,IAoC9B,CAAC"}

package/dist/lint/rules/prompt-length-3000.js

@@ -0,0 +1,61 @@
+/*
+ * Copyright 2026 The flow-as-code Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { ActionType } from "../../actions.js";
+/**
+ * "When you use text, either for text-to-speech or chat, you can use a maximum
+ * of 3,000 billed characters, which is 6,000 characters total."
+ * https://docs.aws.amazon.com/connect/latest/adminguide/play.html
+ *
+ * The Get customer input block states the same limit for its own text:
+ * https://docs.aws.amazon.com/connect/latest/adminguide/get-customer-input.html
+ *
+ * Billed characters are the spoken text. SSML markup counts toward the 6,000
+ * total but not the 3,000 billed, so the two are checked separately.
+ */
+export const MAX_BILLED_CHARACTERS = 3000;
+export const MAX_TOTAL_CHARACTERS = 6000;
+/** The modeled actions that carry a Text or SSML prompt. */
+const PROMPT_ACTIONS = [
+    ActionType.MessageParticipant,
+    ActionType.GetParticipantInput,
+];
+const stripSsmlTags = (s) => s.replace(/<[^>]*>/g, "");
+export const promptLength3000 = {
+    id: "prompt-length-3000",
+    description: "Prompt text must stay within 3,000 billed characters and 6,000 total.",
+    check({ doc, report }) {
+        for (const action of doc.content.Actions) {
+            if (!PROMPT_ACTIONS.includes(action.Type))
+                continue;
+            const text = action.Parameters.Text;
+            if (typeof text === "string" && text.length > MAX_BILLED_CHARACTERS) {
+                report({
+                    severity: "error",
+                    blockId: action.Identifier,
+                    message: `Text is ${text.length} characters; Connect allows ${MAX_BILLED_CHARACTERS} billed characters.`,
+                });
+            }
+            const ssml = action.Parameters.SSML;
+            if (typeof ssml === "string") {
+                if (ssml.length > MAX_TOTAL_CHARACTERS) {
+                    report({
+                        severity: "error",
+                        blockId: action.Identifier,
+                        message: `SSML is ${ssml.length} characters; Connect allows ${MAX_TOTAL_CHARACTERS} total.`,
+                    });
+                }
+                const spoken = stripSsmlTags(ssml).length;
+                if (spoken > MAX_BILLED_CHARACTERS) {
+                    report({
+                        severity: "error",
+                        blockId: action.Identifier,
+                        message: `SSML contains ${spoken} spoken characters; Connect allows ${MAX_BILLED_CHARACTERS} billed characters.`,
+                    });
+                }
+            }
+        }
+    },
+};
+//# sourceMappingURL=prompt-length-3000.js.map

package/dist/lint/rules/prompt-length-3000.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt-length-3000.js","sourceRoot":"","sources":["../../../src/lint/rules/prompt-length-3000.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG9C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAC1C,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAEzC,4DAA4D;AAC5D,MAAM,cAAc,GAAsB;IACxC,UAAU,CAAC,kBAAkB;IAC7B,UAAU,CAAC,mBAAmB;CAC/B,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAEvE,MAAM,CAAC,MAAM,gBAAgB,GAAS;IACpC,EAAE,EAAE,oBAAoB;IACxB,WAAW,EAAE,uEAAuE;IACpF,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE;QACnB,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACzC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,SAAS;YAEpD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;YACpC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;gBACpE,MAAM,CAAC;oBACL,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,MAAM,CAAC,UAAU;oBAC1B,OAAO,EAAE,WAAW,IAAI,CAAC,MAAM,+BAA+B,qBAAqB,qBAAqB;iBACzG,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;YACpC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,IAAI,IAAI,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;oBACvC,MAAM,CAAC;wBACL,QAAQ,EAAE,OAAO;wBACjB,OAAO,EAAE,MAAM,CAAC,UAAU;wBAC1B,OAAO,EAAE,WAAW,IAAI,CAAC,MAAM,+BAA+B,oBAAoB,SAAS;qBAC5F,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;gBAC1C,IAAI,MAAM,GAAG,qBAAqB,EAAE,CAAC;oBACnC,MAAM,CAAC;wBACL,QAAQ,EAAE,OAAO;wBACjB,OAAO,EAAE,MAAM,CAAC,UAAU;wBAC1B,OAAO,EAAE,iBAAiB,MAAM,sCAAsC,qBAAqB,qBAAqB;qBACjH,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/lint/rules/reachable-blocks.d.ts

@@ -0,0 +1,7 @@
+import type { Rule } from "../types.js";
+/**
+ * Unreachable actions are kept, never dropped, but they are almost always an
+ * editing mistake. Dangling targets are a hard error: Connect rejects the flow.
+ */
+export declare const reachableBlocks: Rule;
+//# sourceMappingURL=reachable-blocks.d.ts.map

package/dist/lint/rules/reachable-blocks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reachable-blocks.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/reachable-blocks.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAExC;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,IAqC7B,CAAC"}

package/dist/lint/rules/reachable-blocks.js

@@ -0,0 +1,45 @@
+/*
+ * Copyright 2026 The flow-as-code Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { reachable, transitionTargets } from "../graph.js";
+import { actionsById } from "../graph.js";
+/**
+ * Unreachable actions are kept, never dropped, but they are almost always an
+ * editing mistake. Dangling targets are a hard error: Connect rejects the flow.
+ */
+export const reachableBlocks = {
+    id: "reachable-blocks",
+    description: "Every action should be reachable from StartAction, and every transition target must exist.",
+    check({ doc, report }) {
+        const byId = actionsById(doc);
+        if (!byId.has(doc.content.StartAction)) {
+            report({
+                severity: "error",
+                message: `StartAction "${doc.content.StartAction}" does not match any action.`,
+            });
+        }
+        for (const action of doc.content.Actions) {
+            for (const target of transitionTargets(action)) {
+                if (!byId.has(target)) {
+                    report({
+                        severity: "error",
+                        blockId: action.Identifier,
+                        message: `Transition points at "${target}", which does not exist.`,
+                    });
+                }
+            }
+        }
+        const live = reachable(doc);
+        for (const action of doc.content.Actions) {
+            if (!live.has(action.Identifier)) {
+                report({
+                    severity: "warning",
+                    blockId: action.Identifier,
+                    message: "Action is not reachable from StartAction.",
+                });
+            }
+        }
+    },
+};
+//# sourceMappingURL=reachable-blocks.js.map

package/dist/lint/rules/reachable-blocks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reachable-blocks.js","sourceRoot":"","sources":["../../../src/lint/rules/reachable-blocks.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAS;IACnC,EAAE,EAAE,kBAAkB;IACtB,WAAW,EACT,4FAA4F;IAC9F,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE;QACnB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAE9B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACvC,MAAM,CAAC;gBACL,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,gBAAgB,GAAG,CAAC,OAAO,CAAC,WAAW,8BAA8B;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACzC,KAAK,MAAM,MAAM,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACtB,MAAM,CAAC;wBACL,QAAQ,EAAE,OAAO;wBACjB,OAAO,EAAE,MAAM,CAAC,UAAU;wBAC1B,OAAO,EAAE,yBAAyB,MAAM,0BAA0B;qBACnE,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5B,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjC,MAAM,CAAC;oBACL,QAAQ,EAAE,SAAS;oBACnB,OAAO,EAAE,MAAM,CAAC,UAAU;oBAC1B,OAAO,EAAE,2CAA2C;iBACrD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/lint/rules/recording-consent-before-record.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from "../types.js";
+export declare const recordingConsentBeforeRecord: Rule;
+//# sourceMappingURL=recording-consent-before-record.d.ts.map

package/dist/lint/rules/recording-consent-before-record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recording-consent-before-record.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/recording-consent-before-record.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAkExC,eAAO,MAAM,4BAA4B,EAAE,IAgB1C,CAAC"}

package/dist/lint/rules/recording-consent-before-record.js

@@ -0,0 +1,87 @@
+/*
+ * Copyright 2026 The flow-as-code Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { ActionType } from "../../actions.js";
+import { actionsById, transitionTargets } from "../graph.js";
+/**
+ * Recording a caller without first telling them is a legal problem in many
+ * jurisdictions. This rule is deliberately generic: it requires that every path
+ * reaching an action which enables recording passes through an action that
+ * plays the participant something first. What that message says is the
+ * operator's business; that one exists is checkable here.
+ */
+function enablesRecording(action) {
+    if (action.Type !== ActionType.UpdateContactRecordingBehavior)
+        return false;
+    const behavior = action.Parameters.RecordingBehavior;
+    if (behavior === null || typeof behavior !== "object")
+        return false;
+    const participants = behavior.RecordedParticipants;
+    // An empty list disables recording, per the action's documentation.
+    return Array.isArray(participants) && participants.length > 0;
+}
+/** The parameters that play something on the two announcing actions. */
+const BODY_FIELDS = ["Text", "SSML", "PromptId"];
+/**
+ * MessageParticipant carries exactly one of Text, SSML, or PromptId.
+ * GetParticipantInput plays its prompt before waiting for a key ("This call
+ * may be recorded. Press 1 to continue." is the usual consent menu), but every
+ * prompt field is optional on its action page, so a menu with none is silent.
+ * https://docs.aws.amazon.com/connect/latest/devguide/participant-actions-messageparticipant.html
+ * https://docs.aws.amazon.com/connect/latest/devguide/participant-actions-getparticipantinput.html
+ *
+ * Content is what counts, not the key: the studio's body switch writes
+ * `Text: ""` until the author types, and an empty or blank Text or SSML plays
+ * nothing on either action.
+ */
+function announces(action) {
+    if (action.Type !== ActionType.MessageParticipant &&
+        action.Type !== ActionType.GetParticipantInput) {
+        return false;
+    }
+    return BODY_FIELDS.some((k) => {
+        const body = action.Parameters[k];
+        return typeof body === "string" && body.trim() !== "";
+    });
+}
+/** Ids from which `targetId` is reachable without passing an announcement. */
+function pathsWithoutAnnouncement(doc, targetId) {
+    const byId = actionsById(doc);
+    const seen = new Set();
+    const queue = [doc.content.StartAction];
+    while (queue.length > 0) {
+        const id = queue.shift();
+        if (id === targetId)
+            return true;
+        if (seen.has(id))
+            continue;
+        seen.add(id);
+        const action = byId.get(id);
+        if (action === undefined)
+            continue;
+        // An announcement on this path satisfies the rule, so stop exploring it.
+        if (announces(action))
+            continue;
+        queue.push(...transitionTargets(action));
+    }
+    return false;
+}
+export const recordingConsentBeforeRecord = {
+    id: "recording-consent-before-record",
+    description: "Recording must not start before the participant has been played a message.",
+    check({ doc, report }) {
+        for (const action of doc.content.Actions) {
+            if (!enablesRecording(action))
+                continue;
+            if (pathsWithoutAnnouncement(doc, action.Identifier)) {
+                report({
+                    severity: "error",
+                    blockId: action.Identifier,
+                    message: "Recording is enabled on a path that plays no message first. Announce recording before starting it.",
+                });
+            }
+        }
+    },
+};
+//# sourceMappingURL=recording-consent-before-record.js.map

package/dist/lint/rules/recording-consent-before-record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recording-consent-before-record.js","sourceRoot":"","sources":["../../../src/lint/rules/recording-consent-before-record.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAI7D;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,MAAkB;IAC1C,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,8BAA8B;QAAE,OAAO,KAAK,CAAC;IAC5E,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,iBAAiB,CAAC;IACrD,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACpE,MAAM,YAAY,GAAI,QAA+C,CAAC,oBAAoB,CAAC;IAC3F,oEAAoE;IACpE,OAAO,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;AAChE,CAAC;AAED,wEAAwE;AACxE,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAU,CAAC;AAE1D;;;;;;;;;;;GAWG;AACH,SAAS,SAAS,CAAC,MAAkB;IACnC,IACE,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,kBAAkB;QAC7C,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,mBAAmB,EAC9C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAClC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,SAAS,wBAAwB,CAAC,GAAY,EAAE,QAAgB;IAC9D,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,KAAK,GAAa,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAElD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;QAC1B,IAAI,EAAE,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAC3B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,yEAAyE;QACzE,IAAI,SAAS,CAAC,MAAM,CAAC;YAAE,SAAS;QAChC,KAAK,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAS;IAChD,EAAE,EAAE,iCAAiC;IACrC,WAAW,EAAE,4EAA4E;IACzF,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE;QACnB,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACzC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;gBAAE,SAAS;YACxC,IAAI,wBAAwB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gBACrD,MAAM,CAAC;oBACL,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,MAAM,CAAC,UAAU;oBAC1B,OAAO,EACL,oGAAoG;iBACvG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/lint/rules/terminal-blocks.d.ts

@@ -0,0 +1,8 @@
+import type { Rule } from "../types.js";
+/**
+ * A flow that cannot terminate strands the contact. Also catches the inverse
+ * mistake: an action with empty Transitions that is not a terminal type, which
+ * Connect treats as an unintended dead end.
+ */
+export declare const terminalBlocks: Rule;
+//# sourceMappingURL=terminal-blocks.d.ts.map

package/dist/lint/rules/terminal-blocks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal-blocks.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/terminal-blocks.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAExC;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,IA8B5B,CAAC"}

package/dist/lint/rules/terminal-blocks.js

@@ -0,0 +1,40 @@
+/*
+ * Copyright 2026 The flow-as-code Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { TERMINAL_ACTIONS } from "../../actions.js";
+import { isTerminal, reachable } from "../graph.js";
+import { actionsById } from "../graph.js";
+/**
+ * A flow that cannot terminate strands the contact. Also catches the inverse
+ * mistake: an action with empty Transitions that is not a terminal type, which
+ * Connect treats as an unintended dead end.
+ */
+export const terminalBlocks = {
+    id: "terminal-blocks",
+    description: "A flow must reach a terminal action, and only terminal action types may have empty transitions.",
+    check({ doc, report }) {
+        const byId = actionsById(doc);
+        const live = reachable(doc);
+        const reachesTerminal = [...live].some((id) => {
+            const a = byId.get(id);
+            return a !== undefined && isTerminal(a) && TERMINAL_ACTIONS.includes(a.Type);
+        });
+        if (!reachesTerminal) {
+            report({
+                severity: "error",
+                message: "No terminal action is reachable from StartAction; the flow cannot end.",
+            });
+        }
+        for (const action of doc.content.Actions) {
+            if (isTerminal(action) && !TERMINAL_ACTIONS.includes(action.Type)) {
+                report({
+                    severity: "warning",
+                    blockId: action.Identifier,
+                    message: `${action.Type} has no transitions but is not a terminal action type, so the flow dead-ends here.`,
+                });
+            }
+        }
+    },
+};
+//# sourceMappingURL=terminal-blocks.js.map

package/dist/lint/rules/terminal-blocks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal-blocks.js","sourceRoot":"","sources":["../../../src/lint/rules/terminal-blocks.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAS;IAClC,EAAE,EAAE,iBAAiB;IACrB,WAAW,EACT,iGAAiG;IACnG,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE;QACnB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAE5B,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;YAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACvB,OAAO,CAAC,KAAK,SAAS,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,CAAC;gBACL,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,wEAAwE;aAClF,CAAC,CAAC;QACL,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACzC,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClE,MAAM,CAAC;oBACL,QAAQ,EAAE,SAAS;oBACnB,OAAO,EAAE,MAAM,CAAC,UAAU;oBAC1B,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,oFAAoF;iBAC5G,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/lint/rules/unique-names.d.ts

@@ -0,0 +1,7 @@
+import type { Rule } from "../types.js";
+/**
+ * Identifiers are unique within a flow and document names unique within a set,
+ * because both are used as keys by the emitters.
+ */
+export declare const uniqueNames: Rule;
+//# sourceMappingURL=unique-names.d.ts.map

package/dist/lint/rules/unique-names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unique-names.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/unique-names.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAExC;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE,IAgCzB,CAAC"}

package/dist/lint/rules/unique-names.js

@@ -0,0 +1,40 @@
+/*
+ * Copyright 2026 The flow-as-code Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { isValidIdentifier } from "../../flowdoc.js";
+/**
+ * Identifiers are unique within a flow and document names unique within a set,
+ * because both are used as keys by the emitters.
+ */
+export const uniqueNames = {
+    id: "unique-names",
+    description: "Action Identifiers are unique within a flow, document names unique within a set, and both are valid.",
+    check({ doc, all, report }) {
+        const seen = new Set();
+        for (const action of doc.content.Actions) {
+            if (seen.has(action.Identifier)) {
+                report({
+                    severity: "error",
+                    blockId: action.Identifier,
+                    message: `Duplicate Identifier "${action.Identifier}".`,
+                });
+            }
+            seen.add(action.Identifier);
+            if (!isValidIdentifier(action.Identifier)) {
+                report({
+                    severity: "error",
+                    blockId: action.Identifier,
+                    message: `Identifier "${action.Identifier}" is not valid: at most 50 characters, and none of % : ( \\ / ) = $ , ; [ ] { }.`,
+                });
+            }
+        }
+        if (all.filter((d) => d.name === doc.name).length > 1) {
+            report({
+                severity: "error",
+                message: `Duplicate document name "${doc.name}" in this flow set.`,
+            });
+        }
+    },
+};
+//# sourceMappingURL=unique-names.js.map

package/dist/lint/rules/unique-names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unique-names.js","sourceRoot":"","sources":["../../../src/lint/rules/unique-names.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrD;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAS;IAC/B,EAAE,EAAE,cAAc;IAClB,WAAW,EACT,sGAAsG;IACxG,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE;QACxB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACzC,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChC,MAAM,CAAC;oBACL,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,MAAM,CAAC,UAAU;oBAC1B,OAAO,EAAE,yBAAyB,MAAM,CAAC,UAAU,IAAI;iBACxD,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAE5B,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC1C,MAAM,CAAC;oBACL,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,MAAM,CAAC,UAAU;oBAC1B,OAAO,EAAE,eAAe,MAAM,CAAC,UAAU,kFAAkF;iBAC5H,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,MAAM,CAAC;gBACL,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,4BAA4B,GAAG,CAAC,IAAI,qBAAqB;aACnE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/lint/types.d.ts

@@ -0,0 +1,30 @@
+import type { FlowDoc } from "../flowdoc.js";
+export type Severity = "error" | "warning";
+export interface Finding {
+    /** Stable rule id. Never renamed; the Go provider keys off these. */
+    rule: string;
+    severity: Severity;
+    message: string;
+    /** Name of the FlowDoc the finding belongs to. */
+    doc: string;
+    /** Action Identifier, when the finding is about one action. */
+    blockId?: string;
+}
+export interface RuleContext {
+    doc: FlowDoc;
+    /** Every doc being linted, for rules that need to follow module references. */
+    all: readonly FlowDoc[];
+    report(finding: Omit<Finding, "rule" | "doc">): void;
+}
+export interface Rule {
+    id: string;
+    description: string;
+    /**
+     * A hard rule blocks a save in the studio rather than merely reporting.
+     * docs/02-studio-design.md: the studio can never save a doc that fails
+     * no-literal-arn or no-unresolved-token.
+     */
+    hard?: boolean;
+    check(ctx: RuleContext): void;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/lint/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/lint/types.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAE7C,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;AAE3C,MAAM,WAAW,OAAO;IACtB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,OAAO,CAAC;IACb,+EAA+E;IAC/E,GAAG,EAAE,SAAS,OAAO,EAAE,CAAC;IACxB,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC;CACtD;AAED,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,GAAG,EAAE,WAAW,GAAG,IAAI,CAAC;CAC/B"}

package/dist/lint/types.js

@@ -0,0 +1,11 @@
+/*
+ * Copyright 2026 The flow-as-code Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+// Lint engine types.
+//
+// Nothing in this directory may import a Node builtin. The studio runs the
+// engine in a web worker, so the whole module graph has to be browser-safe.
+// Enforced by lint-browser-safe.test.ts, which walks the imports statically.
+export {};
+//# sourceMappingURL=types.js.map

package/dist/lint/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/lint/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,qBAAqB;AACrB,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,6EAA6E"}

package/dist/materialize.d.ts

@@ -0,0 +1,31 @@
+import type { FlowContent, FlowDoc, RefEntry } from "./flowdoc.js";
+/**
+ * Strict map materialization failed: one or more tokens in the document have
+ * no entry in the resource map. `missingTokens` is sorted and complete, so a
+ * caller fixes the map once, not one missing key per run.
+ */
+export declare class MaterializeError extends Error {
+    readonly missingTokens: readonly string[];
+    constructor(missingTokens: readonly string[], reason?: string);
+}
+/**
+ * Strict materialization against a token -> value map. Every token in the
+ * content must have an entry; otherwise a MaterializeError lists ALL missing
+ * tokens (sorted), not just the first. Mapped values are not validated: at
+ * this point literal ARNs are the goal, not a mistake.
+ */
+export declare function materializeWithMap(doc: FlowDoc, resourceMap: Record<string, string>): FlowContent;
+/**
+ * Binder materialization for IaC backends (@flow-as-code/cdk). The binder returns an
+ * opaque string per reference, typically a CDK token that CloudFormation later
+ * resolves to an ARN. Output passes through exactly as returned, with no
+ * validation and no arn-shape lint (SPEC.md, Materialization).
+ */
+export declare function materializeWithBinder(doc: FlowDoc, binder: (ref: RefEntry) => string): FlowContent;
+/**
+ * Canonical JSON text of deployable content, two-space indented, newline
+ * terminated. Metadata leads with EntryPointPosition then ActionMetadata,
+ * matching the Flow language example; everything nested is key-sorted.
+ */
+export declare function serializeContent(content: FlowContent): string;
+//# sourceMappingURL=materialize.d.ts.map

package/dist/materialize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"materialize.d.ts","sourceRoot":"","sources":["../src/materialize.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAc,WAAW,EAAE,OAAO,EAAS,QAAQ,EAAE,MAAM,cAAc,CAAC;AAMtF;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;gBAE9B,aAAa,EAAE,SAAS,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,MAAM;CAU9D;AAoGD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,WAAW,CA4BjG;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,CAAC,GAAG,EAAE,QAAQ,KAAK,MAAM,GAChC,WAAW,CAQb;AAOD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAmB7D"}