@foresthubai/workflow-cli 0.4.3 → 0.4.5

package/dist-cli/cli.js

@@ -3232,8 +3232,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path11) {
-      let input = path11;
+    function removeDotSegments(path13) {
+      let input = path13;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -3485,8 +3485,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path11, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path11 && path11 !== "/" ? path11 : void 0;
+        const [path13, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path13 && path13 !== "/" ? path13 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -3641,7 +3641,7 @@ var require_fast_uri = __commonJS({
         normalizeString(uri, options);
       } else if (typeof uri === "object") {
         uri = /** @type {T} */
-        parse3(serialize7(uri, options), options);
+        parse3(serialize8(uri, options), options);
       }
       return uri;
     }
@@ -3649,13 +3649,13 @@ var require_fast_uri = __commonJS({
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const resolved = resolveComponent(parse3(baseURI, schemelessOptions), parse3(relativeURI, schemelessOptions), schemelessOptions, true);
       schemelessOptions.skipEscape = true;
-      return serialize7(resolved, schemelessOptions);
+      return serialize8(resolved, schemelessOptions);
     }
     function resolveComponent(base, relative, options, skipNormalization) {
       const target = {};
       if (!skipNormalization) {
-        base = parse3(serialize7(base, options), options);
-        relative = parse3(serialize7(relative, options), options);
+        base = parse3(serialize8(base, options), options);
+        relative = parse3(serialize8(relative, options), options);
       }
       options = options || {};
       if (!options.tolerant && relative.scheme) {
@@ -3709,7 +3709,7 @@ var require_fast_uri = __commonJS({
       const normalizedB = normalizeComparableURI(uriB, options);
       return normalizedA !== void 0 && normalizedB !== void 0 && normalizedA.toLowerCase() === normalizedB.toLowerCase();
     }
-    function serialize7(cmpts, opts) {
+    function serialize8(cmpts, opts) {
       const component = {
         host: cmpts.host,
         scheme: cmpts.scheme,
@@ -3887,7 +3887,7 @@ var require_fast_uri = __commonJS({
     function normalizeStringWithStatus(uri, opts) {
       const { parsed, malformedAuthorityOrPort } = parseWithStatus(uri, opts);
       return {
-        normalized: malformedAuthorityOrPort ? uri : serialize7(parsed, opts),
+        normalized: malformedAuthorityOrPort ? uri : serialize8(parsed, opts),
         malformedAuthorityOrPort
       };
     }
@@ -3897,7 +3897,7 @@ var require_fast_uri = __commonJS({
         return malformedAuthorityOrPort ? void 0 : normalized;
       }
       if (typeof uri === "object") {
-        return serialize7(uri, opts);
+        return serialize8(uri, opts);
       }
     }
     var fastUri = {
@@ -3906,7 +3906,7 @@ var require_fast_uri = __commonJS({
       resolve,
       resolveComponent,
       equal,
-      serialize: serialize7,
+      serialize: serialize8,
       parse: parse3
     };
     module.exports = fastUri;
@@ -4034,7 +4034,7 @@ var require_core = __commonJS({
         uriResolver
       };
     }
-    var Ajv2 = class {
+    var Ajv3 = class {
       constructor(opts = {}) {
         this.schemas = {};
         this.refs = {};
@@ -4404,9 +4404,9 @@ var require_core = __commonJS({
         }
       }
     };
-    Ajv2.ValidationError = validation_error_1.default;
-    Ajv2.MissingRefError = ref_error_1.default;
-    exports.default = Ajv2;
+    Ajv3.ValidationError = validation_error_1.default;
+    Ajv3.MissingRefError = ref_error_1.default;
+    exports.default = Ajv3;
     function checkOptions(checkOpts, options, msg, log = "error") {
       for (const key in checkOpts) {
         const opt = key;
@@ -6517,7 +6517,7 @@ var require_ajv = __commonJS({
     var draft7MetaSchema = require_json_schema_draft_07();
     var META_SUPPORT_DATA = ["/properties"];
     var META_SCHEMA_ID = "http://json-schema.org/draft-07/schema";
-    var Ajv2 = class extends core_1.default {
+    var Ajv3 = class extends core_1.default {
       _addVocabularies() {
         super._addVocabularies();
         draft7_1.default.forEach((v) => this.addVocabulary(v));
@@ -6536,11 +6536,11 @@ var require_ajv = __commonJS({
         return this.opts.defaultMeta = super.defaultMeta() || (this.getSchema(META_SCHEMA_ID) ? META_SCHEMA_ID : void 0);
       }
     };
-    exports.Ajv = Ajv2;
-    module.exports = exports = Ajv2;
-    module.exports.Ajv = Ajv2;
+    exports.Ajv = Ajv3;
+    module.exports = exports = Ajv3;
+    module.exports.Ajv = Ajv3;
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.default = Ajv2;
+    exports.default = Ajv3;
     var validate_1 = require_validate();
     Object.defineProperty(exports, "KeywordCxt", { enumerable: true, get: function() {
       return validate_1.KeywordCxt;
@@ -9932,7 +9932,7 @@ var require_core3 = __commonJS({
         uriResolver
       };
     }
-    var Ajv2 = class {
+    var Ajv3 = class {
       constructor(opts = {}) {
         this.schemas = {};
         this.refs = {};
@@ -10302,9 +10302,9 @@ var require_core3 = __commonJS({
         }
       }
     };
-    Ajv2.ValidationError = validation_error_1.default;
-    Ajv2.MissingRefError = ref_error_1.default;
-    exports.default = Ajv2;
+    Ajv3.ValidationError = validation_error_1.default;
+    Ajv3.MissingRefError = ref_error_1.default;
+    exports.default = Ajv3;
     function checkOptions(checkOpts, options, msg, log = "error") {
       for (const key in checkOpts) {
         const opt = key;
@@ -12415,7 +12415,7 @@ var require_ajv2 = __commonJS({
     var draft7MetaSchema = require_json_schema_draft_072();
     var META_SUPPORT_DATA = ["/properties"];
     var META_SCHEMA_ID = "http://json-schema.org/draft-07/schema";
-    var Ajv2 = class extends core_1.default {
+    var Ajv3 = class extends core_1.default {
       _addVocabularies() {
         super._addVocabularies();
         draft7_1.default.forEach((v) => this.addVocabulary(v));
@@ -12434,11 +12434,11 @@ var require_ajv2 = __commonJS({
         return this.opts.defaultMeta = super.defaultMeta() || (this.getSchema(META_SCHEMA_ID) ? META_SCHEMA_ID : void 0);
       }
     };
-    exports.Ajv = Ajv2;
-    module.exports = exports = Ajv2;
-    module.exports.Ajv = Ajv2;
+    exports.Ajv = Ajv3;
+    module.exports = exports = Ajv3;
+    module.exports.Ajv = Ajv3;
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.default = Ajv2;
+    exports.default = Ajv3;
     var validate_1 = require_validate2();
     Object.defineProperty(exports, "KeywordCxt", { enumerable: true, get: function() {
       return validate_1.KeywordCxt;
@@ -12557,12 +12557,12 @@ var require_dist = __commonJS({
     var fastName = new codegen_1.Name("fastFormats");
     var formatsPlugin = (ajv, opts = { keywords: true }) => {
       if (Array.isArray(opts)) {
-        addFormats2(ajv, opts, formats_1.fullFormats, fullName);
+        addFormats3(ajv, opts, formats_1.fullFormats, fullName);
         return ajv;
       }
       const [formats, exportName] = opts.mode === "fast" ? [formats_1.fastFormats, fastName] : [formats_1.fullFormats, fullName];
       const list = opts.formats || formats_1.formatNames;
-      addFormats2(ajv, list, formats, exportName);
+      addFormats3(ajv, list, formats, exportName);
       if (opts.keywords)
         (0, limit_1.default)(ajv);
       return ajv;
@@ -12574,12 +12574,12 @@ var require_dist = __commonJS({
         throw new Error(`Unknown format "${name}"`);
       return f;
     };
-    function addFormats2(ajv, list, fs9, exportName) {
+    function addFormats3(ajv, list, fs10, exportName) {
       var _a3;
       var _b;
       (_a3 = (_b = ajv.opts.code).formats) !== null && _a3 !== void 0 ? _a3 : _b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f of list)
-        ajv.addFormat(f, fs9[f]);
+        ajv.addFormat(f, fs10[f]);
     }
     module.exports = exports = formatsPlugin;
     Object.defineProperty(exports, "__esModule", { value: true });
@@ -12782,9 +12782,29 @@ function isAllowed(target, roots) {
     return rel === "" || !rel.startsWith("..") && !path.isAbsolute(rel);
   });
 }
+function isLoopbackHost(host) {
+  if (!host) return false;
+  const name = host.startsWith("[") ? host.slice(0, host.indexOf("]") + 1) : host.replace(/:\d+$/, "");
+  return name === "localhost" || name === "127.0.0.1" || name === "[::1]";
+}
+function isTrustedRequest(req) {
+  if (!isLoopbackHost(req.headers.host)) return false;
+  const origin = req.headers.origin;
+  if (origin === void 0) return true;
+  try {
+    return isLoopbackHost(new URL(origin).host);
+  } catch {
+    return false;
+  }
+}
 async function handleFileRequest(req, res, allowedRoots) {
   const url2 = new URL(req.url ?? "", "http://localhost");
   if (url2.pathname !== "/api/file") return false;
+  if (!isTrustedRequest(req)) {
+    res.statusCode = 403;
+    res.end("forbidden: non-local request");
+    return true;
+  }
   try {
     const filePath = url2.searchParams.get("path");
     if (!filePath) {
@@ -12810,7 +12830,7 @@ async function handleFileRequest(req, res, allowedRoots) {
       }
       return true;
     }
-    if (req.method === "PUT" || req.method === "POST") {
+    if (req.method === "PUT") {
       const chunks = [];
       for await (const chunk of req) chunks.push(chunk);
       const body = Buffer.concat(chunks).toString("utf-8");
@@ -13121,6 +13141,11 @@ function toFunctionInfo(fn) {
 }
 
 // ../workflow-core/src/function/serialization.ts
+function serialize(fn) {
+  const outputAssignments = {};
+  for (const o of fn.outputs) outputAssignments[o.uid] = o.expression;
+  return { functionInfo: toFunctionInfo(fn), outputAssignments };
+}
 function deserialize(functionInfo, outputAssignments) {
   return {
     id: functionInfo.id,
@@ -13182,6 +13207,51 @@ function isToolFlow(type) {
 }
 
 // ../workflow-core/src/edge/serialization.ts
+function serialize2(edge) {
+  const sourceHandle = edge.sourceHandle || "";
+  const targetHandle = edge.targetHandle || "";
+  const edgeType = edge.type;
+  const from = { nodeId: edge.source, port: sourceHandle };
+  const to = { nodeId: edge.target, port: targetHandle };
+  switch (edgeType) {
+    case "agentTask":
+      return {
+        id: edge.id,
+        type: "agentTask",
+        from,
+        to,
+        prompt: edge.data?.prompt ?? { expression: "", references: [], dataType: "string" }
+      };
+    case "agentChoice":
+      return {
+        id: edge.id,
+        type: "agentChoice",
+        from,
+        to,
+        ...edge.data?.description ? { description: edge.data.description } : {}
+      };
+    case "agentDelegate":
+      return {
+        id: edge.id,
+        type: "agentDelegate",
+        from,
+        to,
+        ...edge.data?.prompt ? { prompt: edge.data.prompt } : {},
+        ...edge.data?.description ? { description: edge.data.description } : {}
+      };
+    case "control":
+      return { id: edge.id, type: "control", from, to };
+    case "tool":
+      return { id: edge.id, type: "tool", from, to };
+    default:
+      return {
+        id: edge.id,
+        type: sourceHandle.startsWith("ctrl") || targetHandle.startsWith("ctrl") ? "control" : "tool",
+        from,
+        to
+      };
+  }
+}
 function deserialize2(apiEdge) {
   let data;
   if ((apiEdge.type === "agentTask" || apiEdge.type === "agentDelegate") && apiEdge.prompt) {
@@ -13271,6 +13341,14 @@ function isParameterActive(param, parameterValues, isToolInput) {
 function isEmpty(value) {
   return value === void 0 || value === null || value === "";
 }
+function pruneArguments(args2, parameters, isToolInput = false) {
+  for (const param of parameters) {
+    const inactive = !!param.activationRules?.length && !isParameterActive(param, args2, isToolInput);
+    if (inactive || isEmpty(args2[param.id])) {
+      delete args2[param.id];
+    }
+  }
+}
 function resolveExpressionType(param, args2, variables) {
   if (param.fromReference) {
     const ref = args2[param.fromReference];
@@ -13724,9 +13802,9 @@ var SerialWriteNodeDefinition = {
     {
       id: "portReference",
       label: "Port",
-      description: "Serial port to write to",
+      description: "Serial port or log channel to write to",
       type: "channelSelect",
-      channelType: ["UART"]
+      channelType: ["UART", "LOG"]
     },
     {
       id: "value",
@@ -14105,7 +14183,7 @@ function isNodeUsedAsTool(nodeId, nodeData, edges) {
 }
 
 // ../workflow-core/src/channel/Channel.ts
-var ALL_CHANNEL_TYPES = ["GPIOIN", "GPIOOUT", "ADC", "PWM", "DAC", "UART", "MQTT"];
+var ALL_CHANNEL_TYPES = ["GPIOIN", "GPIOOUT", "ADC", "PWM", "DAC", "UART", "MQTT", "LOG"];
 
 // ../workflow-core/src/channel/ChannelDefinition.ts
 var CHANNEL_DEFINITION = {
@@ -14153,11 +14231,62 @@ var CHANNEL_DEFINITION = {
       description: "MQTT topic this channel publishes to / subscribes on (e.g. sensors/temperature)",
       type: "string",
       activationRules: [{ type: "parameterIn", parameterId: "type", values: ["MQTT"] }]
+    },
+    {
+      id: "level",
+      label: "Level",
+      description: "Severity the engine records messages written to this channel at",
+      type: "selection",
+      default: "info",
+      options: [
+        { value: "debug", label: "Debug" },
+        { value: "info", label: "Info" },
+        { value: "warn", label: "Warn" },
+        { value: "error", label: "Error" }
+      ],
+      activationRules: [{ type: "parameterIn", parameterId: "type", values: ["LOG"] }]
+    },
+    {
+      id: "tag",
+      label: "Tag",
+      description: "Optional category stamped on each line so the backend can group workflow-emitted logs",
+      type: "string",
+      optional: true,
+      activationRules: [{ type: "parameterIn", parameterId: "type", values: ["LOG"] }]
     }
   ]
 };
 
 // ../workflow-core/src/channel/serialization.ts
+function serialize3(ch) {
+  const { id, label, type } = ch;
+  const args2 = { ...ch.arguments, type };
+  pruneArguments(args2, CHANNEL_DEFINITION.parameters);
+  switch (type) {
+    case "GPIOIN":
+      return {
+        type,
+        id,
+        label,
+        bias: args2.bias,
+        debounceMs: args2.debounceMs
+      };
+    case "GPIOOUT":
+      return { type, id, label };
+    case "ADC":
+      return { type, id, label };
+    case "PWM":
+      return { type, id, label, frequency: args2.frequency };
+    case "DAC":
+      return { type, id, label };
+    case "UART":
+      return { type, id, label };
+    case "MQTT":
+      return { type, id, label, topic: args2.topic };
+    case "LOG":
+      return { type, id, label, level: args2.level, tag: args2.tag };
+  }
+}
 function deserialize3(api) {
   const { id, label, type } = api;
   const args2 = {};
@@ -14172,6 +14301,10 @@ function deserialize3(api) {
     case "MQTT":
       args2.topic = api.topic;
       break;
+    case "LOG":
+      args2.level = api.level;
+      args2.tag = api.tag;
+      break;
     case "GPIOOUT":
     case "ADC":
     case "DAC":
@@ -14254,6 +14387,27 @@ var MemoryRegistry = new MemoryDefinitionRegistry();
 MemoryRegistry.initialize();
 
 // ../workflow-core/src/memory/serialization.ts
+function serialize4(mem) {
+  const { id, label, type, arguments: args2 } = mem;
+  switch (type) {
+    case "MemoryFile":
+      return {
+        type,
+        id,
+        label,
+        description: args2.description ?? "",
+        content: args2.content ?? "",
+        ...args2.maxSizeBytes != null ? { maxSizeBytes: args2.maxSizeBytes } : {}
+      };
+    case "VectorDatabase":
+      return {
+        type,
+        id,
+        label,
+        ...args2.description != null ? { description: args2.description } : {}
+      };
+  }
+}
 function deserialize4(api) {
   const { id, label, type } = api;
   const args2 = {};
@@ -14301,6 +14455,18 @@ var ModelRegistry = new ModelDefinitionRegistry();
 ModelRegistry.initialize();
 
 // ../workflow-core/src/model/serialization.ts
+function serialize5(model) {
+  const { id, label, type, arguments: args2 } = model;
+  switch (type) {
+    case "LLMModel":
+      return {
+        type,
+        id,
+        label,
+        capabilities: args2.capabilities ?? ["chat"]
+      };
+  }
+}
 function deserialize5(api) {
   const { id, label, type } = api;
   const args2 = {};
@@ -14349,6 +14515,269 @@ function buildFunctionNodeDef(fn, t = (key) => key) {
 }
 
 // ../workflow-core/src/node/serialization.ts
+function draft(value) {
+  return value;
+}
+function serialize6(node, isToolInput) {
+  const result = serializeNodeData(node, node.position, isToolInput);
+  if (node.label) {
+    result.label = node.label;
+  }
+  if ("arguments" in result && result.arguments) {
+    const def = node.type !== "FunctionCall" ? NodeRegistry.getByType(node.type) : void 0;
+    if (def) {
+      pruneArguments(result.arguments, def.parameters, isToolInput);
+    }
+    const args2 = result.arguments;
+    for (const key of Object.keys(args2)) {
+      if (args2[key] === void 0) delete args2[key];
+    }
+  }
+  return result;
+}
+function serializeNodeData(data, position, isToolInput) {
+  switch (data.type) {
+    case "ReadPin":
+      return {
+        id: data.id,
+        type: data.type,
+        position,
+        arguments: {
+          pinReference: draft(data.arguments.pinReference),
+          signalType: data.arguments.signalType,
+          output: data.arguments.output,
+          toolDescription: data.arguments.toolDescription
+        }
+      };
+    case "SerialRead":
+      return {
+        id: data.id,
+        type: data.type,
+        position,
+        arguments: {
+          portReference: draft(data.arguments.portReference),
+          ...data.arguments.prompt !== void 0 ? { prompt: data.arguments.prompt } : {},
+          output: data.arguments.output
+        }
+      };
+    case "WritePin":
+      return {
+        id: data.id,
+        type: data.type,
+        position,
+        arguments: {
+          pinReference: draft(data.arguments.pinReference),
+          signalType: data.arguments.signalType,
+          value: data.arguments.value
+        }
+      };
+    case "SerialWrite":
+      return {
+        id: data.id,
+        type: data.type,
+        position,
+        arguments: {
+          portReference: draft(data.arguments.portReference),
+          value: data.arguments.value
+        }
+      };
+    case "Agent": {
+      return {
+        id: data.id,
+        type: data.type,
+        position,
+        arguments: {
+          name: data.arguments.name,
+          model: data.arguments.model,
+          instructions: data.arguments.instructions,
+          maxTurns: data.arguments.maxTurns,
+          outputDeclarations: data.arguments.outputDeclarations,
+          memoryRefs: data.arguments.memoryRefs ?? [],
+          answer: data.arguments.answer,
+          toolDescription: data.arguments.toolDescription
+        }
+      };
+    }
+    case "If":
+      return {
+        id: data.id,
+        type: data.type,
+        position,
+        arguments: {
+          condition: data.arguments.condition
+        }
+      };
+    case "OnFunctionCall":
+      return {
+        id: data.id,
+        type: data.type,
+        position
+      };
+    case "OnStartup":
+      return {
+        id: data.id,
+        type: data.type,
+        position
+      };
+    case "OnPinEdge":
+      return {
+        id: data.id,
+        type: data.type,
+        position,
+        arguments: {
+          pinReference: draft(data.arguments.pinReference),
+          edge: data.arguments.edge
+        }
+      };
+    case "OnSerialReceive":
+      return {
+        id: data.id,
+        type: data.type,
+        position,
+        arguments: {
+          portReference: draft(data.arguments.portReference),
+          output: data.arguments.output
+        }
+      };
+    case "OnThreshold":
+      return {
+        id: data.id,
+        type: data.type,
+        position,
+        arguments: {
+          variable: draft(data.arguments.variable),
+          threshold: draft(data.arguments.threshold),
+          direction: data.arguments.direction,
+          deadband: data.arguments.deadband,
+          output: data.arguments.output
+        }
+      };
+    case "Delay":
+      return {
+        id: data.id,
+        type: data.type,
+        position,
+        arguments: {
+          delayMs: draft(data.arguments.delayMs)
+        }
+      };
+    case "Ticker":
+      return {
+        id: data.id,
+        type: data.type,
+        position,
+        arguments: {
+          intervalValue: draft(data.arguments.intervalValue),
+          intervalUnit: data.arguments.intervalUnit
+        }
+      };
+    case "Alarm":
+      return {
+        id: data.id,
+        type: data.type,
+        position,
+        arguments: {
+          time: data.arguments.time,
+          days: data.arguments.days
+        }
+      };
+    case "WebSearchTool":
+      return {
+        id: data.id,
+        type: data.type,
+        position,
+        arguments: {
+          maxResults: data.arguments.maxResults
+        }
+      };
+    case "Retriever":
+      return {
+        id: data.id,
+        type: data.type,
+        position,
+        arguments: {
+          memoryReference: data.arguments.memoryReference,
+          topK: draft(data.arguments.topK),
+          query: data.arguments.query,
+          output: data.arguments.output,
+          toolDescription: data.arguments.toolDescription
+        }
+      };
+    case "WebFetch":
+      return {
+        id: data.id,
+        type: data.type,
+        position,
+        arguments: {
+          url: data.arguments.url,
+          maxChars: data.arguments.maxChars,
+          output: data.arguments.output
+        }
+      };
+    case "FunctionCall": {
+      const inputBindings = {};
+      const outputBindings = {};
+      const args2 = data.arguments;
+      for (const arg of data.functionInfo.arguments) {
+        const key = arg.uid ?? arg.name;
+        const v = args2[key];
+        if (v !== void 0) inputBindings[key] = v;
+      }
+      for (const ret of data.functionInfo.returns) {
+        const key = ret.uid ?? ret.name;
+        const v = args2[key];
+        if (v !== void 0) outputBindings[key] = v;
+      }
+      const toolDescription = args2.toolDescription;
+      return {
+        id: data.id,
+        type: data.type,
+        functionId: data.functionInfo.id,
+        position,
+        arguments: {
+          inputBindings,
+          outputBindings,
+          ...isToolInput && toolDescription !== void 0 ? { toolDescription } : {}
+        }
+      };
+    }
+    case "SetVariable":
+      return {
+        id: data.id,
+        type: data.type,
+        position,
+        arguments: {
+          variable: draft(data.arguments.variable),
+          value: data.arguments.value
+        }
+      };
+    case "MqttPublish":
+      return {
+        id: data.id,
+        type: data.type,
+        position,
+        arguments: {
+          channelReference: data.arguments.channelReference ?? "",
+          dataType: data.arguments.dataType,
+          value: data.arguments.value,
+          // Unset stays unset — Number(undefined) is NaN, which stringifies to null.
+          qos: draft(data.arguments.qos === void 0 ? void 0 : Number(data.arguments.qos)),
+          retain: data.arguments.retain
+        }
+      };
+    case "OnMqttMessage":
+      return {
+        id: data.id,
+        type: data.type,
+        position,
+        arguments: {
+          channelReference: data.arguments.channelReference ?? "",
+          dataType: data.arguments.dataType,
+          output: data.arguments.output
+        }
+      };
+  }
+}
 function deserialize6(apiNode, resolveFunctionInfo) {
   return { ...deserializeNodeData(apiNode, resolveFunctionInfo), position: apiNode.position };
 }
@@ -14587,6 +15016,43 @@ var MAIN_CANVAS_ID = "main";
 
 // ../workflow-core/src/workflow/serialization.ts
 var KNOWN_CHANNEL_TYPES = new Set(ALL_CHANNEL_TYPES);
+function serialize7(state) {
+  const mainCanvas = state.canvases[MAIN_CANVAS_ID];
+  if (!mainCanvas) {
+    throw new Error("Main canvas missing");
+  }
+  const mainNodes = mainCanvas.nodes.map((n) => serialize6(n, isNodeUsedAsTool(n.id, n, mainCanvas.edges)));
+  const mainEdges = mainCanvas.edges.map(serialize2);
+  const mainDeclared = extractDeclaredVariables(mainCanvas.variables);
+  const functions = [];
+  for (const [id, decl] of Object.entries(state.functions)) {
+    const body = state.canvases[id];
+    if (!body) {
+      throw new Error(`[workflow-core] function ${id} has no body canvas \u2014 cannot serialize`);
+    }
+    const { functionInfo, outputAssignments } = serialize(decl);
+    functions.push({
+      functionInfo,
+      outputAssignments,
+      nodes: body.nodes.map((n) => serialize6(n, isNodeUsedAsTool(n.id, n, body.edges))),
+      edges: body.edges.map(serialize2),
+      declaredVariables: extractDeclaredVariables(body.variables)
+    });
+  }
+  const channels = Object.values(state.channels).map(serialize3);
+  const memory = Object.values(state.memory).map(serialize4);
+  const models = Object.values(state.models).map(serialize5);
+  return {
+    schemaVersion: CURRENT_SCHEMA_VERSION,
+    nodes: mainNodes,
+    edges: mainEdges,
+    functions,
+    declaredVariables: mainDeclared,
+    channels,
+    memory,
+    models
+  };
+}
 function deserialize7(workflow) {
   const canvases = {};
   const functions = {};
@@ -14679,6 +15145,20 @@ function buildCanvasVariables(nodes, fnArgs, declaredVariables) {
   }
   return variables;
 }
+function extractDeclaredVariables(variables) {
+  const result = [];
+  for (const v of Object.values(variables)) {
+    if (v.kind === "declared") {
+      result.push({
+        uid: v.uid,
+        name: v.name,
+        dataType: v.dataType,
+        ...v.initialValue !== void 0 ? { initialValue: v.initialValue } : {}
+      });
+    }
+  }
+  return result;
+}
 
 // ../workflow-core/src/expression/types.ts
 function resolveExpression(apiExpr, availableVars) {
@@ -16575,12 +17055,21 @@ function printReport(file2, result) {
 `);
     for (const d of result.memoryDiagnostics) printDiagnostic(d, "    ");
   }
+  if (result.modelDiagnostics.length > 0) {
+    out.write(`
+  models:
+`);
+    for (const d of result.modelDiagnostics) printDiagnostic(d, "    ");
+  }
 }
 function printDiagnostic(d, indent) {
   const where = [];
   if (d.nodeId) where.push(`node ${d.nodeId}`);
   if (d.edgeId) where.push(`edge ${d.edgeId}`);
   if (d.channelId) where.push(`channel ${d.channelId}`);
+  if (d.memoryId) where.push(`memory ${d.memoryId}`);
+  if (d.modelId) where.push(`model ${d.modelId}`);
+  if (d.functionId) where.push(`function ${d.functionId}`);
   if (d.paramId) where.push(`param ${d.paramId}`);
   if (d.outputId) where.push(`output ${d.outputId}`);
   const location = where.length > 0 ? ` (${where.join(", ")})` : "";
@@ -16595,7 +17084,11 @@ function pluralize(n) {
 // cli/check-schema.ts
 var import_ajv = __toESM(require_ajv(), 1);
 var import_ajv_formats = __toESM(require_dist(), 1);
-import { existsSync, readFileSync, promises as fs5 } from "node:fs";
+import { promises as fs5 } from "node:fs";
+import path7 from "node:path";
+
+// cli/contract.ts
+import { existsSync, readFileSync } from "node:fs";
 import path6 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
@@ -18961,7 +19454,7 @@ var import_js_yaml = /* @__PURE__ */ __toESM2((/* @__PURE__ */ __commonJSMin(((e
 var { Type, Schema, FAILSAFE_SCHEMA, JSON_SCHEMA, CORE_SCHEMA, DEFAULT_SCHEMA, load, loadAll, dump, YAMLException, types, safeLoad, safeLoadAll, safeDump } = import_js_yaml.default;
 var index_vite_proxy_tmp_default = import_js_yaml.default;
 
-// cli/check-schema.ts
+// cli/contract.ts
 var here = path6.dirname(fileURLToPath2(import.meta.url));
 var CONTRACT_DIR = existsSync(path6.join(here, "workflow.yaml")) ? here : path6.resolve(here, "../../../contract");
 function loadContractDocument(fileName) {
@@ -18987,6 +19480,8 @@ function openApiToJsonSchema(value) {
   }
   return out;
 }
+
+// cli/check-schema.ts
 var cachedValidator;
 function compileWorkflowValidator() {
   if (cachedValidator) return cachedValidator;
@@ -19011,7 +19506,7 @@ async function checkSchemaCommand(filePath) {
     process.stderr.write("Usage: fh-workflow check-schema <file.json>\n");
     process.exit(1);
   }
-  const abs = path6.resolve(process.cwd(), filePath);
+  const abs = path7.resolve(process.cwd(), filePath);
   let raw;
   try {
     raw = await fs5.readFile(abs, "utf-8");
@@ -19060,35 +19555,35 @@ function describeParams(e) {
   return "";
 }
 
-// cli/deploy/index.ts
-import { promises as fs8 } from "node:fs";
-import path10 from "node:path";
-import { parseArgs } from "node:util";
-
-// cli/deploy/inspect.ts
-function assertNever(channel) {
-  throw new Error(`unhandled channel type: ${JSON.stringify(channel)}`);
-}
-function inspect(workflow) {
-  const customModelIds = new Set((workflow.models ?? []).map((m) => m.id));
-  let hasProviderModel = false;
-  let hasRetriever = false;
-  let hasWebSearch = false;
-  const allNodes = [...workflow.nodes, ...(workflow.functions ?? []).flatMap((f) => f.nodes ?? [])];
-  for (const node of allNodes) {
-    if (node.type === "Agent") {
-      const modelId = node.arguments.model;
-      if (!modelId) continue;
-      if (!customModelIds.has(modelId)) hasProviderModel = true;
-    } else if (node.type === "Retriever") {
-      hasRetriever = true;
-    } else if (node.type === "WebSearchTool") {
-      hasWebSearch = true;
+// ../workflow-core/src/deploy/requirements.ts
+function getReferencedCatalogModelIds(workflow) {
+  const declaredModel = new Set(Object.keys(workflow.models));
+  const catalogIds = /* @__PURE__ */ new Set();
+  for (const canvas of Object.values(workflow.canvases)) {
+    for (const node of canvas.nodes) {
+      const def = NodeRegistry.getByType(node.type);
+      if (!def) continue;
+      const args2 = node.arguments;
+      const isToolInput = isNodeUsedAsTool(node.id, node, canvas.edges);
+      for (const param of def.parameters) {
+        if (param.type !== "modelSelect") continue;
+        if (!isParameterActive(param, args2, isToolInput)) continue;
+        const id = args2[param.id];
+        if (typeof id === "string" && id !== "" && !declaredModel.has(id)) {
+          catalogIds.add(id);
+        }
+      }
     }
   }
+  return [...catalogIds];
+}
+function assertNeverChannel(t) {
+  throw new Error(`unhandled channel type: ${String(t)}`);
+}
+function deriveRequirements(workflow) {
   const hardwareChannels = [];
   const mqttChannels = [];
-  for (const channel of workflow.channels) {
+  for (const channel of Object.values(workflow.channels)) {
     switch (channel.type) {
       case "GPIOIN":
       case "GPIOOUT":
@@ -19109,14 +19604,277 @@ function inspect(workflow) {
       case "MQTT":
         mqttChannels.push({ id: channel.id, label: channel.label });
         break;
+      case "LOG":
+        break;
+      default:
+        return assertNeverChannel(channel.type);
+    }
+  }
+  let hasRetriever = false;
+  let hasWebSearch = false;
+  for (const canvas of Object.values(workflow.canvases)) {
+    for (const node of canvas.nodes) {
+      if (node.type === "Retriever") hasRetriever = true;
+      else if (node.type === "WebSearchTool") hasWebSearch = true;
+    }
+  }
+  const customModels = Object.values(workflow.models).map((m) => ({ id: m.id, label: m.label }));
+  return {
+    hasProviderModel: getReferencedCatalogModelIds(workflow).length > 0,
+    hasRetriever,
+    hasWebSearch,
+    hardwareChannels,
+    mqttChannels,
+    customModels
+  };
+}
+
+// ../workflow-core/src/deploy/spec.ts
+var COMPONENT_WORKSPACE_PATH = "/var/lib/foresthub/workspace";
+var STATE_ROOT = ".";
+function workspaceDir(container) {
+  return `${STATE_ROOT}/workspaces/${container}`;
+}
+var RefAllocator = class {
+  byKey = /* @__PURE__ */ new Map();
+  used = /* @__PURE__ */ new Set();
+  alloc(key, hint) {
+    const existing = this.byKey.get(key);
+    if (existing) return existing;
+    let ref = hint;
+    for (let n = 2; this.used.has(ref); n++) ref = `${hint}-${n}`;
+    this.used.add(ref);
+    this.byKey.set(key, ref);
+    return ref;
+  }
+};
+function basename(p) {
+  const tail = p.replace(/\/+$/, "").split("/").pop() ?? p;
+  return tail.replace(/[^A-Za-z0-9._:-]/g, "-") || "res";
+}
+function brokerHost(url2) {
+  try {
+    return new URL(url2).hostname || "mqtt";
+  } catch {
+    return "mqtt";
+  }
+}
+function sidecarServiceName(modelId) {
+  const slug = modelId.toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "");
+  return `llama-${slug || "model"}`;
+}
+function ggufNameError(name) {
+  const t = (name ?? "").trim();
+  if (!t) return "a model filename is required";
+  if (!t.toLowerCase().endsWith(".gguf")) return "must be a .gguf file (llama-server only loads GGUF)";
+  if (t.includes("/")) return "just the filename, not a path \u2014 the file goes in the model's workspace dir (./workspaces/llama-\u2026/)";
+  return null;
+}
+function hardwareAddressKey(family, chipOrDevice, index) {
+  const dev = chipOrDevice.trim();
+  return family === "serial" ? `serial:${dev}` : `${family}:${dev}:${index}`;
+}
+function hardwareAddressLabel(family, chipOrDevice, index) {
+  const dev = chipOrDevice.trim();
+  if (family === "serial") return dev;
+  return `${dev} ${family === "gpio" ? "line" : "channel"} ${index}`;
+}
+function hardwareConflicts(channels, bindings) {
+  const conflicts = [];
+  const claimed = /* @__PURE__ */ new Map();
+  for (const ch of channels) {
+    const b = bindings[ch.id];
+    if (!b?.chipOrDevice || ch.addressable && b.index === void 0) continue;
+    const key = hardwareAddressKey(ch.family, b.chipOrDevice, b.index);
+    const holder = claimed.get(key);
+    if (holder) {
+      conflicts.push(`hardware "${ch.id}": ${hardwareAddressLabel(ch.family, b.chipOrDevice, b.index)} is already used by "${holder}"`);
+    } else {
+      claimed.set(key, ch.id);
+    }
+  }
+  return conflicts;
+}
+function familyMismatches(channels, bindings) {
+  const mismatches = [];
+  for (const ch of channels) {
+    const b = bindings[ch.id];
+    if (!b) continue;
+    if (ch.family !== "serial" && b.baud !== void 0) {
+      mismatches.push(`hardware "${ch.id}": "baud" only applies to serial channels (this is a ${ch.family} channel)`);
+    }
+    if (ch.family === "serial" && b.index !== void 0) {
+      mismatches.push(`hardware "${ch.id}": "index" does not apply to serial channels (the device path is the full address)`);
+    }
+  }
+  return mismatches;
+}
+function assertNeverFamily(f) {
+  throw new Error(`unhandled hardware family: ${String(f)}`);
+}
+function assertDeployable(req, inputs) {
+  const missing = [];
+  for (const ch of req.hardwareChannels) {
+    const b = inputs.hardware[ch.id];
+    if (!b?.chipOrDevice) missing.push(`hardware "${ch.id}": device path`);
+    else if (ch.addressable && b.index === void 0) missing.push(`hardware "${ch.id}": index`);
+  }
+  for (const ch of req.mqttChannels) {
+    if (!inputs.mqtt[ch.id]?.brokerUrl) missing.push(`mqtt "${ch.id}": broker URL`);
+  }
+  for (const m of req.customModels) {
+    const b = inputs.models[m.id];
+    if (b?.location === "device") {
+      const err = ggufNameError(b.modelFile);
+      if (err) missing.push(`model "${m.id}": ${err}`);
+    } else if (!b?.url) {
+      missing.push(`model "${m.id}": endpoint URL`);
+    }
+  }
+  missing.push(...hardwareConflicts(req.hardwareChannels, inputs.hardware));
+  missing.push(...familyMismatches(req.hardwareChannels, inputs.hardware));
+  if (missing.length > 0) {
+    throw new Error(`invalid deploy config:
+  - ${missing.join("\n  - ")}`);
+  }
+}
+function assertNoNameCollisions(components) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const c of components) {
+    if (seen.has(c.name)) throw new Error(`duplicate component name "${c.name}"`);
+    seen.add(c.name);
+  }
+}
+function buildDeploymentSpec(workflow, inputs, meta3, customComponents = []) {
+  const req = deriveRequirements(workflow);
+  assertDeployable(req, inputs);
+  const refs = new RefAllocator();
+  const resourceSecrets = {};
+  const gpios = {};
+  const adcs = {};
+  const dacs = {};
+  const pwms = {};
+  const serials = {};
+  const externalResources = {};
+  const mapping = {};
+  const cdev = /* @__PURE__ */ new Set();
+  let privileged = false;
+  for (const ch of req.hardwareChannels) {
+    const b = inputs.hardware[ch.id];
+    if (!b) throw new Error(`unbound hardware channel ${ch.id}`);
+    const dev = b.chipOrDevice;
+    const ref = refs.alloc(`hw:${ch.family}:${dev}`, basename(dev));
+    switch (ch.family) {
+      case "gpio":
+        gpios[ref] = { chip: dev };
+        cdev.add(dev);
+        break;
+      case "serial":
+        serials[ref] = b.baud ? { device: dev, baud: b.baud } : { device: dev };
+        cdev.add(dev);
+        break;
+      case "pwm":
+        pwms[ref] = { chip: dev };
+        privileged = true;
+        break;
+      case "adc":
+        adcs[ref] = { device: dev };
+        privileged = true;
+        break;
+      case "dac":
+        dacs[ref] = { device: dev };
+        privileged = true;
+        break;
       default:
-        return assertNever(channel);
+        return assertNeverFamily(ch.family);
     }
+    if (ch.addressable && b.index !== void 0) mapping[ch.id] = { ref, index: b.index };
+    else mapping[ch.id] = { ref };
+  }
+  for (const ch of req.mqttChannels) {
+    const b = inputs.mqtt[ch.id];
+    if (!b) throw new Error(`unbound mqtt channel ${ch.id}`);
+    const conn = { type: "mqtt", brokerUrl: b.brokerUrl };
+    if (b.username) conn.username = b.username;
+    const ref = refs.alloc(`mqtt:${JSON.stringify(conn)}:${b.password ?? ""}`, `mqtt-${brokerHost(b.brokerUrl)}`);
+    externalResources[ref] = conn;
+    mapping[ch.id] = { ref };
+    if (b.password) resourceSecrets[ref] = b.password;
   }
-  const customModels = (workflow.models ?? []).map((m) => ({ id: m.id, label: m.label }));
-  return { hasProviderModel, hasRetriever, hasWebSearch, hardwareChannels, mqttChannels, customModels };
+  const llamaComponents = [];
+  for (const m of req.customModels) {
+    const b = inputs.models[m.id];
+    if (!b) throw new Error(`unbound model ${m.id}`);
+    const ref = refs.alloc(`model:${m.id}`, basename(m.id));
+    mapping[m.id] = { ref };
+    if (b.location === "device") {
+      const port = b.port ?? 8080;
+      const service = sidecarServiceName(m.id);
+      externalResources[ref] = { type: "selfhosted", url: `http://${service}:${port}` };
+      llamaComponents.push({
+        name: service,
+        image: meta3.llamaServerImage,
+        command: [
+          "--model",
+          `${COMPONENT_WORKSPACE_PATH}/${b.modelFile}`,
+          "--host",
+          "0.0.0.0",
+          "--port",
+          String(port),
+          "--ctx-size",
+          String(b.ctxSize ?? 4096)
+        ],
+        // The model lives in this sidecar's own workspace; read-only, so no chown
+        // is needed (docs §5). The operator drops the GGUF in workspaceDir(service).
+        volumes: [`${workspaceDir(service)}:${COMPONENT_WORKSPACE_PATH}:ro`]
+      });
+    } else {
+      externalResources[ref] = { type: "selfhosted", url: b.url };
+      if (b.apiKey) resourceSecrets[ref] = b.apiKey;
+    }
+  }
+  const manifest = {};
+  if (Object.keys(gpios).length) manifest.gpios = gpios;
+  if (Object.keys(adcs).length) manifest.adcs = adcs;
+  if (Object.keys(dacs).length) manifest.dacs = dacs;
+  if (Object.keys(pwms).length) manifest.pwms = pwms;
+  if (Object.keys(serials).length) manifest.serials = serials;
+  const config2 = { workflow: serialize7(workflow) };
+  if (Object.keys(mapping).length) config2.mapping = mapping;
+  if (Object.keys(externalResources).length) config2.externalResources = externalResources;
+  if (Object.keys(manifest).length) config2.manifest = manifest;
+  const engine = {
+    name: "engine",
+    image: meta3.engineImage,
+    pull: "never",
+    // built locally before deploy, in no registry
+    config: config2,
+    // Durable memory: a host bind mount under the state root, read-write, at the
+    // in-container workspace path (docs/device-filesystem.md §10).
+    volumes: [`${workspaceDir("engine")}:${COMPONENT_WORKSPACE_PATH}`],
+    // Run as root: writes the rw workspace bind mount without a host chown step
+    // (the OSS default, §5), and also opens root-owned device nodes when hardware
+    // (cdev passthrough / sysfs-privileged) is mapped in below.
+    user: "0:0"
+  };
+  if (cdev.size > 0) engine.devices = [...cdev];
+  if (privileged) engine.privileged = true;
+  const components = [engine, ...llamaComponents, ...customComponents];
+  assertNoNameCollisions(components);
+  const spec = {
+    schemaVersion: 1,
+    id: meta3.id,
+    components
+  };
+  if (meta3.createdAt) spec.createdAt = meta3.createdAt;
+  return { spec, resourceSecrets };
 }
 
+// cli/deploy/index.ts
+import { promises as fs9 } from "node:fs";
+import path12 from "node:path";
+import { parseArgs } from "node:util";
+
 // ../node_modules/@inquirer/core/dist/lib/key.js
 var keybindings = ["emacs", "vim"];
 var keybindingLookup = new Set(keybindings);
@@ -20520,7 +21278,7 @@ var PromisePolyfill = class extends Promise {
 };
 
 // ../node_modules/@inquirer/core/dist/lib/create-prompt.js
-import path7 from "node:path";
+import path8 from "node:path";
 var nativeSetImmediate = globalThis.setImmediate;
 function getCallSites() {
   const savedPrepareStackTrace = Error.prepareStackTrace;
@@ -20591,7 +21349,7 @@ function createPrompt(view) {
             if (nextView === void 0) {
               let callerFilename = callSites[1]?.getFileName();
               if (callerFilename && !callerFilename.startsWith("file://")) {
-                callerFilename = path7.resolve(callerFilename);
+                callerFilename = path8.resolve(callerFilename);
               }
               throw new Error(`Prompt functions must return a string.
     at ${callerFilename}`);
@@ -20836,11 +21594,57 @@ var dist_default4 = createPrompt((config2, done) => {
   return `${lines}${cursorHide}`;
 });
 
+// ../node_modules/@inquirer/confirm/dist/index.js
+function getBooleanValue(value, defaultValue) {
+  let answer = defaultValue !== false;
+  if (/^(y|yes)/i.test(value))
+    answer = true;
+  else if (/^(n|no)/i.test(value))
+    answer = false;
+  return answer;
+}
+function boolToString(value) {
+  return value ? "Yes" : "No";
+}
+var dist_default5 = createPrompt((config2, done) => {
+  const { transformer = boolToString } = config2;
+  const [status, setStatus] = useState("idle");
+  const [value, setValue] = useState("");
+  const theme = makeTheme(config2.theme);
+  const prefix = usePrefix({ status, theme });
+  useKeypress((key, rl) => {
+    if (status !== "idle")
+      return;
+    if (isEnterKey(key)) {
+      const answer = getBooleanValue(value, config2.default);
+      setValue(transformer(answer));
+      setStatus("done");
+      done(answer);
+    } else if (isTabKey(key)) {
+      const answer = boolToString(!getBooleanValue(value, config2.default));
+      rl.clearLine(0);
+      rl.write(answer);
+      setValue(answer);
+    } else {
+      setValue(rl.line);
+    }
+  });
+  let formattedValue = value;
+  let defaultValue = "";
+  if (status === "done") {
+    formattedValue = theme.style.answer(value);
+  } else {
+    defaultValue = ` ${theme.style.defaultAnswer(config2.default === false ? "y/N" : "Y/n")}`;
+  }
+  const message = theme.style.message(config2.message, status);
+  return `${prefix} ${message}${defaultValue} ${formattedValue}`;
+});
+
 // ../node_modules/@inquirer/input/dist/index.js
 var inputTheme = {
   validationFailureMode: "keep"
 };
-var dist_default5 = createPrompt((config2, done) => {
+var dist_default6 = createPrompt((config2, done) => {
   const { prefill = "tab" } = config2;
   const theme = makeTheme(inputTheme, config2.theme);
   const [status, setStatus] = useState("idle");
@@ -20927,7 +21731,7 @@ var passwordTheme = {
     maskedText: "[input is masked]"
   }
 };
-var dist_default6 = createPrompt((config2, done) => {
+var dist_default7 = createPrompt((config2, done) => {
   const { validate = () => true } = config2;
   const theme = makeTheme(passwordTheme, config2.theme);
   const [status, setStatus] = useState("idle");
@@ -21019,7 +21823,7 @@ function normalizeChoices2(choices) {
     return normalizedChoice;
   });
 }
-var dist_default7 = createPrompt((config2, done) => {
+var dist_default8 = createPrompt((config2, done) => {
   const { loop = true, pageSize = 7 } = config2;
   const theme = makeTheme(selectTheme, config2.theme);
   const { keybindings: keybindings2 } = theme;
@@ -21148,8 +21952,145 @@ var dist_default7 = createPrompt((config2, done) => {
 });
 
 // cli/deploy/prompts.ts
+import { existsSync as existsSync3, promises as fs7 } from "node:fs";
+import path10 from "node:path";
+
+// cli/deploy/components.ts
 import { existsSync as existsSync2, promises as fs6 } from "node:fs";
-import path8 from "node:path";
+import path9 from "node:path";
+var import_ajv2 = __toESM(require_ajv(), 1);
+var import_ajv_formats2 = __toESM(require_dist(), 1);
+async function readComponentJson(dir) {
+  const file2 = path9.join(dir, "component.json");
+  let raw;
+  try {
+    raw = await fs6.readFile(file2, "utf-8");
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      throw new Error(`custom component: no component.json in ${dir}`, { cause: err });
+    }
+    throw err;
+  }
+  try {
+    return JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`${file2}: invalid JSON: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+  }
+}
+var cachedValidator2;
+function compileDeployComponentValidator() {
+  if (cachedValidator2) return cachedValidator2;
+  const deployment = openApiToJsonSchema(loadContractDocument("deployment.yaml"));
+  deployment.$id = "deployment.yaml";
+  const schemas = deployment.components.schemas;
+  schemas.DeployComponent.additionalProperties = false;
+  const ajv = new import_ajv2.default({ strict: false, allErrors: true });
+  (0, import_ajv_formats2.default)(ajv);
+  ajv.addSchema(deployment);
+  cachedValidator2 = ajv.compile({ $ref: "deployment.yaml#/components/schemas/DeployComponent" });
+  return cachedValidator2;
+}
+function validateComponent(data) {
+  const validate = compileDeployComponentValidator();
+  if (validate(data)) return [];
+  return (validate.errors ?? []).map((e) => {
+    const p = e.params;
+    const which = p.additionalProperty ?? p.missingProperty;
+    const detail = typeof which === "string" ? ` "${which}"` : "";
+    return `${e.instancePath || "/"} ${e.message ?? "invalid"}${detail}`;
+  });
+}
+function parseDeployComponents(raw) {
+  const errors = [];
+  for (const { source, data } of raw) {
+    for (const message of validateComponent(data)) errors.push(`${source}: ${message}`);
+  }
+  if (errors.length > 0) {
+    throw new Error(`invalid custom component(s):
+  - ${errors.join("\n  - ")}`);
+  }
+  return raw.map((r) => r.data);
+}
+function parseEnvExample(text) {
+  return text.split("\n").map((line) => {
+    const m = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(line);
+    return m ? { kind: "kv", key: m[1] ?? "", value: m[2] ?? "" } : { kind: "comment", text: line };
+  });
+}
+var SECRET_HINT = /password|secret|key|token/i;
+async function resolveComponentEnv(dir, name, opts) {
+  const file2 = path9.join(dir, `${name}.env.example`);
+  let raw;
+  try {
+    raw = await fs6.readFile(file2, "utf-8");
+  } catch (err) {
+    if (err.code === "ENOENT") return null;
+    throw err;
+  }
+  const lines = [];
+  for (const e of parseEnvExample(raw)) {
+    if (e.kind === "comment") {
+      lines.push(e.text);
+    } else if (e.value !== "" || !opts.interactive) {
+      lines.push(`${e.key}=${e.value}`);
+    } else {
+      const value = SECRET_HINT.test(e.key) ? await dist_default7({ message: `${name}: ${e.key}`, mask: "*" }) : await dist_default6({ message: `${name}: ${e.key}` });
+      lines.push(`${e.key}=${value}`);
+    }
+  }
+  const header = `# Auto-generated by \`fh-workflow deploy\` from ${name}.env.example.
+# Loaded into the ${name} container via compose env_file; chmod 600 if it holds
+# secrets, and fill any empty values before \`up\`.
+`;
+  return `${header}
+${lines.join("\n")}
+`;
+}
+async function promptCustomComponents(preloaded) {
+  const components = [];
+  const env = {};
+  const seen = /* @__PURE__ */ new Set();
+  const add = async (loaded) => {
+    seen.add(loaded.component.name);
+    components.push(loaded.component);
+    const text = await resolveComponentEnv(loaded.dir, loaded.component.name, { interactive: true });
+    if (text !== null) env[loaded.component.name] = text;
+  };
+  if (preloaded.length > 0) {
+    process.stdout.write(`  Already added: ${preloaded.map((c) => c.component.name).join(", ")}
+`);
+  }
+  for (const loaded of preloaded) await add(loaded);
+  while (await dist_default5({
+    message: components.length === 0 ? "Add a custom component?" : "Add another custom component?",
+    default: false
+  })) {
+    const dir = (await dist_default6({
+      message: "Custom component folder",
+      // Full inline validation: path, component.json presence, contract shape,
+      // and a name not already taken — the same checks the batch path runs, so
+      // a bad folder is rejected here instead of failing late in the build.
+      validate: async (v) => {
+        const t = v.trim();
+        if (!t) return "enter a folder path";
+        if (!existsSync2(t)) return `folder not found: ${t}`;
+        if (!existsSync2(path9.join(t, "component.json"))) return `no component.json in ${t}`;
+        let data;
+        try {
+          data = await readComponentJson(t);
+        } catch (err) {
+          return err instanceof Error ? err.message : String(err);
+        }
+        const errors = validateComponent(data);
+        if (errors.length > 0) return errors.join("; ");
+        const name = data.name;
+        return seen.has(name) ? `"${name}" already added` : true;
+      }
+    })).trim();
+    await add({ component: await readComponentJson(dir), dir });
+  }
+  return { components, env };
+}
 
 // ../node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -21761,7 +22702,7 @@ __export(util_exports, {
   assert: () => assert,
   assertEqual: () => assertEqual,
   assertIs: () => assertIs,
-  assertNever: () => assertNever2,
+  assertNever: () => assertNever,
   assertNotEqual: () => assertNotEqual,
   assignProp: () => assignProp,
   base64ToUint8Array: () => base64ToUint8Array,
@@ -21825,7 +22766,7 @@ function assertNotEqual(val) {
 }
 function assertIs(_arg) {
 }
-function assertNever2(_x) {
+function assertNever(_x) {
   throw new Error("Unexpected value in exhaustive check");
 }
 function assert(_) {
@@ -21917,10 +22858,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path11) {
-  if (!path11)
+function getElementAtPath(obj, path13) {
+  if (!path13)
     return obj;
-  return path11.reduce((acc, key) => acc?.[key], obj);
+  return path13.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -22329,11 +23270,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path11, issues) {
+function prefixIssues(path13, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path11);
+    iss.path.unshift(path13);
     return iss;
   });
 }
@@ -22480,16 +23421,16 @@ function flattenError(error51, mapper = (issue2) => issue2.message) {
 }
 function formatError(error51, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path11 = []) => {
+  const processError = (error52, path13 = []) => {
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path11, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path13, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path11, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path13, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path11, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path13, ...issue2.path]);
       } else {
-        const fullpath = [...path11, ...issue2.path];
+        const fullpath = [...path13, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -22516,17 +23457,17 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error52, path11 = []) => {
+  const processError = (error52, path13 = []) => {
     var _a3, _b;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path11, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path13, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path11, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path13, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path11, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path13, ...issue2.path]);
       } else {
-        const fullpath = [...path11, ...issue2.path];
+        const fullpath = [...path13, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -22558,8 +23499,8 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path11 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path11) {
+  const path13 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path13) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -35251,13 +36192,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path11 = ref.slice(1).split("/").filter(Boolean);
-  if (path11.length === 0) {
+  const path13 = ref.slice(1).split("/").filter(Boolean);
+  if (path13.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path11[0] === defsKey) {
-    const key = path11[1];
+  if (path13[0] === defsKey) {
+    const key = path13[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -35679,55 +36620,18 @@ var mqttBindingSchema = external_exports.strictObject({
   password: external_exports.string().optional()
 });
 var modelBindingSchema = external_exports.discriminatedUnion("location", [
-  external_exports.strictObject({ location: external_exports.literal("device"), modelFile: external_exports.string() }),
+  external_exports.strictObject({
+    location: external_exports.literal("device"),
+    modelFile: external_exports.string(),
+    port: external_exports.number().int().positive().optional(),
+    ctxSize: external_exports.number().int().positive().optional()
+  }),
   external_exports.strictObject({ location: external_exports.literal("network"), url: external_exports.string(), apiKey: external_exports.string().optional() })
 ]);
-function ggufNameError(name) {
-  const t = (name ?? "").trim();
-  if (!t) return "a model filename is required";
-  if (!t.toLowerCase().endsWith(".gguf")) return "must be a .gguf file (llama-server only loads GGUF)";
-  if (t.includes("/")) return "just the filename, not a path \u2014 the file goes in ./models/";
-  return null;
-}
-function hardwareAddressKey(family, chipOrDevice, index) {
-  const dev = chipOrDevice.trim();
-  return family === "serial" ? `serial:${dev}` : `${family}:${dev}:${index}`;
-}
-function hardwareAddressLabel(family, chipOrDevice, index) {
-  const dev = chipOrDevice.trim();
-  if (family === "serial") return dev;
-  return `${dev} ${family === "gpio" ? "line" : "channel"} ${index}`;
-}
-function hardwareConflicts(channels, bindings) {
-  const conflicts = [];
-  const claimed = /* @__PURE__ */ new Map();
-  for (const ch of channels) {
-    const b = bindings[ch.id];
-    if (!b?.chipOrDevice || ch.addressable && b.index === void 0) continue;
-    const key = hardwareAddressKey(ch.family, b.chipOrDevice, b.index);
-    const holder = claimed.get(key);
-    if (holder) {
-      conflicts.push(`hardware "${ch.id}": ${hardwareAddressLabel(ch.family, b.chipOrDevice, b.index)} is already used by "${holder}"`);
-    } else {
-      claimed.set(key, ch.id);
-    }
-  }
-  return conflicts;
-}
-function familyMismatches(channels, bindings) {
-  const mismatches = [];
-  for (const ch of channels) {
-    const b = bindings[ch.id];
-    if (!b) continue;
-    if (ch.family !== "serial" && b.baud !== void 0) {
-      mismatches.push(`hardware "${ch.id}": "baud" only applies to serial channels (this is a ${ch.family} channel)`);
-    }
-    if (ch.family === "serial" && b.index !== void 0) {
-      mismatches.push(`hardware "${ch.id}": "index" does not apply to serial channels (the device path is the full address)`);
-    }
-  }
-  return mismatches;
-}
+var webSearchBindingSchema = external_exports.strictObject({
+  provider: external_exports.string(),
+  apiKey: external_exports.string()
+});
 function unknownIds(req, p) {
   const unknown2 = [];
   const check3 = (kind, ids, bindings) => {
@@ -35741,10 +36645,6 @@ function unknownIds(req, p) {
   check3("model", req.customModels.map((m) => m.id), p.models);
   return unknown2;
 }
-var webSearchBindingSchema = external_exports.strictObject({
-  provider: external_exports.string(),
-  apiKey: external_exports.string()
-});
 var deployConfigSchema = external_exports.strictObject({
   llmKeys: external_exports.partialRecord(external_exports.enum(ALL_PROVIDERS), external_exports.string()),
   outputDir: external_exports.string(),
@@ -35780,7 +36680,7 @@ async function promptHardware(channels, seed) {
   }
   for (const ch of channels) {
     if (result[ch.id]) continue;
-    const chipOrDevice = await dist_default5({
+    const chipOrDevice = await dist_default6({
       message: `${ch.label} (${ch.family}): device path`,
       default: HARDWARE_EXAMPLE[ch.family],
       // Only serial claims the whole device; gpio/adc/dac/pwm share the path
@@ -35794,7 +36694,7 @@ async function promptHardware(channels, seed) {
     const dev = chipOrDevice.trim();
     const binding = { chipOrDevice: dev };
     if (ch.addressable) {
-      const idx = await dist_default5({
+      const idx = await dist_default6({
         message: `${ch.label}: channel index / GPIO line`,
         validate: (v) => {
           const uint = isUint(v);
@@ -35806,7 +36706,7 @@ async function promptHardware(channels, seed) {
       binding.index = Number(idx.trim());
     }
     if (ch.family === "serial") {
-      const baud = await dist_default5({ message: `${ch.label}: baud rate`, default: "115200", validate: isUint });
+      const baud = await dist_default6({ message: `${ch.label}: baud rate`, default: "115200", validate: isUint });
       binding.baud = Number(baud.trim());
     }
     result[ch.id] = binding;
@@ -35821,7 +36721,7 @@ async function promptMqtt(channels, seed) {
     const brokers = /* @__PURE__ */ new Map();
     for (const b of Object.values(result)) brokers.set(b.brokerUrl, b);
     if (brokers.size > 0) {
-      const choice = await dist_default7({
+      const choice = await dist_default8({
         message: `${ch.label}: MQTT broker`,
         choices: [
           ...[...brokers.keys()].map((url2) => ({ value: url2, name: `reuse ${url2}` })),
@@ -35834,13 +36734,13 @@ async function promptMqtt(channels, seed) {
         continue;
       }
     }
-    const brokerUrl = await dist_default5({
+    const brokerUrl = await dist_default6({
       message: `${ch.label}: broker URL`,
       default: "tcp://localhost:1883",
       validate: (v) => v.trim().length > 0 || "broker URL is required"
     });
-    const username = (await dist_default5({ message: `${ch.label}: username (optional)` })).trim();
-    const pass = await dist_default6({ message: `${ch.label}: password (optional)`, mask: "*" });
+    const username = (await dist_default6({ message: `${ch.label}: username (optional)` })).trim();
+    const pass = await dist_default7({ message: `${ch.label}: password (optional)`, mask: "*" });
     const binding = { brokerUrl: brokerUrl.trim() };
     if (username) binding.username = username;
     if (pass) binding.password = pass;
@@ -35852,7 +36752,7 @@ async function promptModels(models, seed) {
   const result = { ...seed };
   for (const m of models) {
     if (result[m.id]) continue;
-    const location = await dist_default7({
+    const location = await dist_default8({
       message: `${m.label}: where does this model run?`,
       choices: [
         { value: "device", name: "on this device (generate a llama-server container)" },
@@ -35860,19 +36760,26 @@ async function promptModels(models, seed) {
       ]
     });
     if (location === "device") {
-      const modelFile = await dist_default5({
-        message: `${m.label}: model filename in ./models/ (e.g. model.gguf)`,
+      const modelFile = await dist_default6({
+        message: `${m.label}: model filename, dropped in its workspace dir (e.g. model.gguf)`,
         validate: (v) => ggufNameError(v) ?? true
       });
-      result[m.id] = { location: "device", modelFile: modelFile.trim() };
+      const ctxSize = await dist_default6({ message: `${m.label}: context window in tokens`, default: "4096", validate: isUint });
+      const port = await dist_default6({ message: `${m.label}: sidecar port`, default: "8080", validate: isUint });
+      result[m.id] = {
+        location: "device",
+        modelFile: modelFile.trim(),
+        ctxSize: Number(ctxSize.trim()),
+        port: Number(port.trim())
+      };
       continue;
     }
-    const url2 = await dist_default5({
+    const url2 = await dist_default6({
       message: `${m.label}: inference endpoint URL (a server you run \u2014 llama-server/vLLM/Ollama)`,
       default: "http://localhost:8080",
       validate: (v) => v.trim().length > 0 || "endpoint URL is required"
     });
-    const apiKey = await dist_default6({ message: `${m.label}: API key (optional)`, mask: "*" });
+    const apiKey = await dist_default7({ message: `${m.label}: API key (optional)`, mask: "*" });
     const binding = { location: "network", url: url2.trim() };
     if (apiKey) binding.apiKey = apiKey;
     result[m.id] = binding;
@@ -35881,11 +36788,11 @@ async function promptModels(models, seed) {
 }
 async function promptWebSearch(seed) {
   if (seed) return seed;
-  const provider = (await dist_default5({ message: "Web search provider", default: "brave" })).trim() || "brave";
-  const apiKey = await dist_default6({ message: "Web search API key", mask: "*" });
+  const provider = (await dist_default6({ message: "Web search provider", default: "brave" })).trim() || "brave";
+  const apiKey = await dist_default7({ message: "Web search API key", mask: "*" });
   return { provider, apiKey };
 }
-async function promptMissing(partial2, outputDirDefault, req, workflowName) {
+async function promptMissing(partial2, outputDirDefault, req, workflowName, preloadedComponents) {
   const hwTodo = req.hardwareChannels.filter((ch) => !partial2.hardware?.[ch.id]);
   const mqttTodo = req.mqttChannels.filter((ch) => !partial2.mqtt?.[ch.id]);
   const modelsTodo = req.customModels.filter((m) => !partial2.models?.[m.id]);
@@ -35893,13 +36800,11 @@ async function promptMissing(partial2, outputDirDefault, req, workflowName) {
   const askWeb = req.hasWebSearch && !partial2.webSearch;
   let askOut = true;
   if (partial2.outputDir) {
-    const resolved = path8.resolve(process.cwd(), partial2.outputDir);
-    const nonEmpty = existsSync2(resolved) && (await fs6.readdir(resolved)).length > 0;
+    const resolved = path10.resolve(process.cwd(), partial2.outputDir);
+    const nonEmpty = existsSync3(resolved) && (await fs7.readdir(resolved)).length > 0;
     askOut = nonEmpty && !(partial2.force ?? false);
   }
-  const total = [askKeys, hwTodo.length > 0, mqttTodo.length > 0, modelsTodo.length > 0, askWeb, askOut].filter(
-    Boolean
-  ).length;
+  const total = [askKeys, hwTodo.length > 0, mqttTodo.length > 0, modelsTodo.length > 0, askWeb, askOut].filter(Boolean).length + 1;
   let step = 0;
   const section = (label, count = 0) => {
     step += 1;
@@ -35925,7 +36830,7 @@ async function promptMissing(partial2, outputDirDefault, req, workflowName) {
     }
     for (const provider of selectedProviders) {
       if (llmKeys[provider]) continue;
-      const key = await dist_default6({ message: `${provider} API key`, mask: "*" });
+      const key = await dist_default7({ message: `${provider} API key`, mask: "*" });
       if (key) llmKeys[provider] = key;
     }
   }
@@ -35937,6 +36842,8 @@ async function promptMissing(partial2, outputDirDefault, req, workflowName) {
   const models = await promptModels(req.customModels, partial2.models ?? {});
   if (askWeb) section("Web search");
   const webSearch = req.hasWebSearch ? await promptWebSearch(partial2.webSearch) : void 0;
+  section("Custom components");
+  const { components: customComponents, env: componentEnv } = await promptCustomComponents(preloadedComponents);
   if (askOut) section("Output");
   let outputDir;
   let force = partial2.force ?? false;
@@ -35944,16 +36851,16 @@ async function promptMissing(partial2, outputDirDefault, req, workflowName) {
     let candidate = partial2.outputDir;
     while (true) {
       if (!candidate) {
-        candidate = await dist_default5({ message: "Output directory", default: outputDirDefault });
+        candidate = await dist_default6({ message: "Output directory", default: outputDirDefault });
       }
-      const resolved = path8.resolve(process.cwd(), candidate);
-      const exists = existsSync2(resolved);
-      const nonEmpty = exists && (await fs6.readdir(resolved)).length > 0;
+      const resolved = path10.resolve(process.cwd(), candidate);
+      const exists = existsSync3(resolved);
+      const nonEmpty = exists && (await fs7.readdir(resolved)).length > 0;
       if (!nonEmpty || force) {
         outputDir = candidate;
         break;
       }
-      const action = await dist_default7({
+      const action = await dist_default8({
         message: `${resolved} is not empty.`,
         choices: [
           { value: "overwrite", name: "overwrite the existing files" },
@@ -35970,7 +36877,7 @@ async function promptMissing(partial2, outputDirDefault, req, workflowName) {
       candidate = void 0;
     }
   }
-  return {
+  const config2 = {
     llmKeys,
     outputDir,
     force,
@@ -35980,229 +36887,86 @@ async function promptMissing(partial2, outputDirDefault, req, workflowName) {
     models,
     webSearch
   };
+  return { config: config2, customComponents, componentEnv };
 }
 
 // cli/deploy/write.ts
-import { existsSync as existsSync3, promises as fs7 } from "node:fs";
-import path9 from "node:path";
+import { existsSync as existsSync4, promises as fs8 } from "node:fs";
+import path11 from "node:path";
 
-// cli/deploy/builders.ts
-var RefAllocator = class {
-  byKey = /* @__PURE__ */ new Map();
-  used = /* @__PURE__ */ new Set();
-  alloc(key, hint) {
-    const existing = this.byKey.get(key);
-    if (existing) return existing;
-    let ref = hint;
-    for (let n = 2; this.used.has(ref); n++) ref = `${hint}-${n}`;
-    this.used.add(ref);
-    this.byKey.set(key, ref);
-    return ref;
-  }
-};
-function basename(p) {
-  const tail = p.replace(/\/+$/, "").split("/").pop() ?? p;
-  return tail.replace(/[^A-Za-z0-9._:-]/g, "-") || "res";
-}
-function brokerHost(url2) {
-  try {
-    return new URL(url2).hostname || "mqtt";
-  } catch {
-    return "mqtt";
-  }
-}
-function sidecarServiceName(modelId) {
-  const slug = modelId.toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "");
-  return `llama-${slug || "model"}`;
-}
-function assertNeverFamily(f) {
-  throw new Error(`unhandled hardware family: ${String(f)}`);
-}
-function assertDeployable(req, cfg) {
-  const missing = [];
-  for (const ch of req.hardwareChannels) {
-    const b = cfg.hardware[ch.id];
-    if (!b?.chipOrDevice) missing.push(`hardware "${ch.id}": device path`);
-    else if (ch.addressable && b.index === void 0) missing.push(`hardware "${ch.id}": index`);
-  }
-  for (const ch of req.mqttChannels) {
-    if (!cfg.mqtt[ch.id]?.brokerUrl) missing.push(`mqtt "${ch.id}": broker URL`);
-  }
-  for (const m of req.customModels) {
-    const b = cfg.models[m.id];
-    if (b?.location === "device") {
-      const err = ggufNameError(b.modelFile);
-      if (err) missing.push(`model "${m.id}": ${err}`);
-    } else if (!b?.url) {
-      missing.push(`model "${m.id}": endpoint URL`);
-    }
-  }
-  missing.push(...hardwareConflicts(req.hardwareChannels, cfg.hardware));
-  missing.push(...familyMismatches(req.hardwareChannels, cfg.hardware));
-  missing.push(...unknownIds(req, cfg));
-  if (missing.length > 0) {
-    throw new Error(`invalid deploy config:
-  - ${missing.join("\n  - ")}`);
-  }
-}
-function buildDeployArtifacts(req, cfg) {
-  assertDeployable(req, cfg);
-  const refs = new RefAllocator();
-  const gpios = {};
-  const adcs = {};
-  const dacs = {};
-  const pwms = {};
-  const serials = {};
-  const externalResources = {};
-  const deploymentMapping = {};
-  for (const ch of req.hardwareChannels) {
-    const b = cfg.hardware[ch.id];
-    if (!b) throw new Error(`unbound hardware channel ${ch.id}`);
-    const dev = b.chipOrDevice;
-    const ref = refs.alloc(`hw:${ch.family}:${dev}`, basename(dev));
-    switch (ch.family) {
-      case "gpio":
-        gpios[ref] = { chip: dev };
-        break;
-      case "pwm":
-        pwms[ref] = { chip: dev };
-        break;
-      case "adc":
-        adcs[ref] = { device: dev };
-        break;
-      case "dac":
-        dacs[ref] = { device: dev };
-        break;
-      case "serial":
-        serials[ref] = b.baud ? { device: dev, baud: b.baud } : { device: dev };
-        break;
-      default:
-        return assertNeverFamily(ch.family);
-    }
-    deploymentMapping[ch.id] = ch.addressable ? { ref, index: b.index } : { ref };
-  }
-  for (const ch of req.mqttChannels) {
-    const b = cfg.mqtt[ch.id];
-    if (!b) throw new Error(`unbound mqtt channel ${ch.id}`);
-    const conn = { type: "mqtt", brokerUrl: b.brokerUrl };
-    if (b.username) conn.username = b.username;
-    if (b.password) conn.password = b.password;
-    const ref = refs.alloc(`mqtt:${JSON.stringify(conn)}`, `mqtt-${brokerHost(b.brokerUrl)}`);
-    externalResources[ref] = conn;
-    deploymentMapping[ch.id] = { ref };
-  }
-  for (const m of req.customModels) {
-    const b = cfg.models[m.id];
-    if (!b) throw new Error(`unbound model ${m.id}`);
-    const url2 = b.location === "device" ? `http://${sidecarServiceName(m.id)}:8080` : b.url;
-    const provider = { type: "selfhosted", url: url2 };
-    if (b.location === "network" && b.apiKey) provider.apiKey = b.apiKey;
-    const ref = refs.alloc(`model:${m.id}`, basename(m.id));
-    externalResources[ref] = provider;
-    deploymentMapping[m.id] = { ref };
+// cli/deploy/generate.ts
+import { createHash } from "node:crypto";
+var CONFIG_PATH = "/etc/foresthub/config.json";
+var SECRETS_PATH = "/etc/foresthub/secrets.json";
+function configFileName(name) {
+  return `${name}-config.json`;
+}
+function secretsFileName(name) {
+  return `${name}-secrets.json`;
+}
+function namedVolumeSource(mount) {
+  const src = mount.split(":")[0] ?? "";
+  return src && !src.startsWith(".") && !src.startsWith("/") ? src : null;
+}
+function serviceBlock(c, secretDoc) {
+  const hasSecretDoc = secretDoc !== void 0 && Object.keys(secretDoc).length > 0;
+  const lines = [`  ${c.name}:`, `    image: ${c.image}`, `    pull_policy: ${c.pull ?? "missing"}`, "    restart: unless-stopped"];
+  const labels = [];
+  if (c.config !== void 0) {
+    const hash2 = createHash("sha256").update(JSON.stringify(c.config)).digest("hex");
+    labels.push(`      com.foresthub.config-hash: "${hash2}"`);
+  }
+  if (hasSecretDoc) {
+    const hash2 = createHash("sha256").update(JSON.stringify(secretDoc)).digest("hex");
+    labels.push(`      com.foresthub.secrets-hash: "${hash2}"`);
+  }
+  if (labels.length > 0) lines.push("    labels:", ...labels);
+  if (c.user) lines.push(`    user: "${c.user}"`);
+  if (c.command && c.command.length > 0) {
+    lines.push("    command:");
+    for (const arg of c.command) lines.push(`      - "${arg}"`);
+  }
+  lines.push("    env_file:", `      - path: ${c.name}.env`, "        required: false");
+  const volumes = [
+    ...c.config !== void 0 ? [`./${configFileName(c.name)}:${CONFIG_PATH}:ro`] : [],
+    ...hasSecretDoc ? [`./${secretsFileName(c.name)}:${SECRETS_PATH}:ro`] : [],
+    ...c.volumes ?? []
+  ];
+  if (volumes.length > 0) {
+    lines.push("    volumes:");
+    for (const v of volumes) lines.push(`      - ${v}`);
+  }
+  if (c.devices && c.devices.length > 0) {
+    lines.push("    devices:");
+    for (const d of c.devices) lines.push(`      - "${d}:${d}"`);
+  }
+  if (c.ports && c.ports.length > 0) {
+    lines.push("    ports:");
+    for (const p of c.ports) lines.push(`      - "${p}"`);
+  }
+  if (c.privileged) {
+    lines.push(
+      "    # ADC/DAC/PWM need sysfs access (/sys/class/pwm, /sys/bus/iio). privileged is",
+      "    # the simple default \u2014 tighten to specific bind-mounts if your policy requires.",
+      "    privileged: true"
+    );
   }
-  const deviceManifest = {};
-  if (Object.keys(gpios).length) deviceManifest.gpios = gpios;
-  if (Object.keys(adcs).length) deviceManifest.adcs = adcs;
-  if (Object.keys(dacs).length) deviceManifest.dacs = dacs;
-  if (Object.keys(pwms).length) deviceManifest.pwms = pwms;
-  if (Object.keys(serials).length) deviceManifest.serials = serials;
-  return { deviceManifest, externalResources, deploymentMapping };
+  return lines.join("\n");
 }
-
-// cli/deploy/generate.ts
-function composeYaml(cfg, req) {
-  const hasHardware = req.hardwareChannels.length > 0;
-  const hasExternal = req.mqttChannels.length > 0 || req.customModels.length > 0;
-  const hasMapping = hasHardware || hasExternal;
-  const env = ["ENGINE_LOG_LEVEL: ${ENGINE_LOG_LEVEL:-info}"];
-  for (const p of ALL_PROVIDERS.filter((p2) => Boolean(cfg.llmKeys[p2]))) {
-    env.push(`${p.toUpperCase()}_API_KEY: \${${p.toUpperCase()}_API_KEY:-}`);
-  }
-  if (req.hasWebSearch) {
-    env.push("ENGINE_WEB_SEARCH_PROVIDER: ${ENGINE_WEB_SEARCH_PROVIDER:-brave}");
-    env.push("ENGINE_WEB_SEARCH_API_KEY: ${ENGINE_WEB_SEARCH_API_KEY:-}");
-  }
-  env.push("ENGINE_CONFIG_FILE: /etc/foresthub/workflow.json");
-  env.push("ENGINE_MEMORY_DIR: /var/lib/foresthub/memory");
-  if (hasHardware) env.push("ENGINE_DEVICE_MANIFEST_FILE: /etc/foresthub/device_manifest.json");
-  if (hasExternal) env.push("ENGINE_EXTERNAL_RESOURCES_FILE: /etc/foresthub/external_resources.json");
-  if (hasMapping) env.push("ENGINE_DEPLOYMENT_MAPPING_FILE: /etc/foresthub/deployment_mapping.json");
-  const vols = ["./workflow.json:/etc/foresthub/workflow.json:ro"];
-  if (hasHardware) vols.push("./device_manifest.json:/etc/foresthub/device_manifest.json:ro");
-  if (hasExternal) vols.push("./external_resources.json:/etc/foresthub/external_resources.json:ro");
-  if (hasMapping) vols.push("./deployment_mapping.json:/etc/foresthub/deployment_mapping.json:ro");
-  vols.push("engine-memory:/var/lib/foresthub/memory");
-  const cdev = /* @__PURE__ */ new Set();
-  let needsPrivileged = false;
-  for (const ch of req.hardwareChannels) {
-    const dev = cfg.hardware[ch.id]?.chipOrDevice;
-    if (!dev) continue;
-    if (ch.family === "gpio" || ch.family === "serial") cdev.add(dev);
-    else needsPrivileged = true;
-  }
-  const envBlock = env.map((l) => `      ${l}`).join("\n");
-  const volBlock = vols.map((v) => `      - ${v}`).join("\n");
-  const deviceBlock = cdev.size > 0 ? `
-    devices:
-${[...cdev].map((d) => `      - "${d}:${d}"`).join("\n")}` : "";
-  const privilegedBlock = needsPrivileged ? "\n    # ADC/DAC/PWM need sysfs access (/sys/class/pwm, /sys/bus/iio). privileged is\n    # the simple default \u2014 tighten to specific bind-mounts if your policy requires.\n    privileged: true" : "";
-  const needsRoot = cdev.size > 0 || needsPrivileged;
-  const userBlock = needsRoot ? `
-    # The engine image runs as nonroot and can't open root-owned device nodes /
-    # sysfs files; root is the host-agnostic way to reach the mapped hardware below.
-    user: "0:0"` : "";
-  const deviceModels = [];
-  for (const m of req.customModels) {
-    const b = cfg.models[m.id];
-    if (b?.location === "device")
-      deviceModels.push({ service: sidecarServiceName(m.id), modelFile: b.modelFile, ctxVar: ctxSizeVar(m.id) });
-  }
-  const dependsBlock = deviceModels.length ? "\n    depends_on:\n" + deviceModels.map((d) => `      ${d.service}:
-        condition: service_healthy`).join("\n") : "";
-  const sidecars = deviceModels.map(
-    (d) => `  ${d.service}:
-    image: ghcr.io/ggml-org/llama.cpp:server-b8589
-    pull_policy: missing
-    restart: unless-stopped
-    command:
-      - --model
-      - /models/${d.modelFile}
-      - --host
-      - "0.0.0.0"
-      - --port
-      - "8080"
-      - --ctx-size
-      - "\${${d.ctxVar}:-4096}"
-    volumes:
-      - ./models:/models:ro
-    healthcheck:
-      test: ["CMD-SHELL", "curl -sf http://localhost:8080/health || exit 1"]
-      interval: 10s
-      timeout: 5s
-      retries: 30
-      start_period: 60s`
-  ).join("\n\n");
-  const sidecarBlock = sidecars ? `
-
-${sidecars}` : "";
-  return `# ForestHub engine \u2014 minimal standalone Compose deployment.
+function composeYaml(spec, secretDocs = {}) {
+  const services = spec.components.map((c) => serviceBlock(c, secretDocs[c.name])).join("\n\n");
+  const named = [...new Set(spec.components.flatMap((c) => (c.volumes ?? []).map(namedVolumeSource).filter((s) => s !== null)))];
+  const volumesBlock = named.length > 0 ? `
+volumes:
+${named.map((n) => `  ${n}:`).join("\n")}
+` : "";
+  return `# Edge Agents engine \u2014 minimal standalone Compose deployment.
 # See README.md for the build/transfer/run workflow.
-# See .env for operator-set values.
+# See the <component>.env files for operator-set values.
 
 services:
-  engine:
-    image: fh-engine:latest
-    pull_policy: never
-    restart: unless-stopped${userBlock}${dependsBlock}
-    environment:
-${envBlock}
-    volumes:
-${volBlock}${deviceBlock}${privilegedBlock}${sidecarBlock}
-
-volumes:
-  engine-memory:
-`;
+${services}
+${volumesBlock}`;
 }
 function envFile(cfg) {
   const localProviders = ALL_PROVIDERS.filter((p) => Boolean(cfg.llmKeys[p]));
@@ -36216,48 +36980,33 @@ ENGINE_WEB_SEARCH_PROVIDER=${cfg.webSearch.provider}
 ENGINE_WEB_SEARCH_API_KEY=${cfg.webSearch.apiKey}
 
 ` : "";
-  const deviceModelIds = Object.entries(cfg.models).filter(([, b]) => b.location === "device").map(([id]) => id);
-  const onDeviceSection = deviceModelIds.length ? `# ----- On-device models -----
-# Context window per llama-server sidecar.
-${deviceModelIds.map((id) => `${ctxSizeVar(id)}=4096`).join("\n")}
-
-` : "";
-  return `# ForestHub engine \u2014 operator configuration.
-# Auto-generated by \`fh-workflow deploy\`. \`docker compose\` auto-loads this file.
-# Secret values: chmod 600 .env after editing.
+  return `# Edge Agents engine \u2014 operator configuration.
+# Auto-generated by \`fh-workflow deploy\`. Loaded into the engine via the compose
+# \`env_file\`. Secret values: chmod 600 this file after editing.
 
-${providerSection}${webSearchSection}${onDeviceSection}# ----- Runtime -----
+${providerSection}${webSearchSection}# ----- Runtime -----
 ENGINE_LOG_LEVEL=${cfg.logLevel}     # debug | info | warn | error
 `;
 }
-function readme(cfg, req) {
+function readme(spec, cfg, hasProviderModel, hasSecrets = false) {
   const localProviders = ALL_PROVIDERS.filter((p) => Boolean(cfg.llmKeys[p]));
-  const providerBlock = localProviders.length === 0 ? "_No local API keys set._ An Agent that uses a catalog model will fail at build \u2014 set the matching key in `.env`." : localProviders.map((p) => `- **${p}** \u2014 runs locally (your API key)`).join("\n");
-  const hasHardware = req.hardwareChannels.length > 0;
-  const hasExternal = req.mqttChannels.length > 0 || req.customModels.length > 0;
-  const deviceModelFiles = [];
-  let hasNetworkModel = false;
-  for (const m of req.customModels) {
-    const b = cfg.models[m.id];
-    if (b?.location === "device") deviceModelFiles.push(b.modelFile);
-    else if (b?.location === "network") hasNetworkModel = true;
-  }
-  const hasExternalService = req.mqttChannels.length > 0 || hasNetworkModel;
-  const deployFiles = [];
-  if (hasHardware) deployFiles.push("- `device_manifest.json` \u2014 hardware the engine binds at boot");
-  if (hasExternal)
-    deployFiles.push("- `external_resources.json` \u2014 MQTT brokers / model endpoints (**secrets \u2014 `chmod 600`**)");
-  if (hasHardware || hasExternal)
-    deployFiles.push("- `deployment_mapping.json` \u2014 maps the workflow's resources to the entries above");
-  const deployFilesBlock = deployFiles.length ? "\n" + deployFiles.join("\n") : "";
+  const providerBlock = localProviders.length === 0 ? "_No local API keys set._ An Agent that uses a catalog model will fail at build \u2014 set the matching key in `engine.env`." : localProviders.map((p) => `- **${p}** \u2014 runs locally (your API key)`).join("\n");
+  const engine = spec.components.find((c) => c.name === "engine");
+  const hasHardware = (engine?.devices?.length ?? 0) > 0 || Boolean(engine?.privileged);
+  const deviceModels = Object.entries(cfg.models).flatMap(
+    ([id, b]) => b.location === "device" ? [{ dir: `./workspaces/${sidecarServiceName(id)}`, file: b.modelFile }] : []
+  );
+  const hasNetworkModel = Object.values(cfg.models).some((b) => b.location === "network");
+  const hasMqtt = Object.keys(cfg.mqtt).length > 0;
+  const hasExternalService = hasMqtt || hasNetworkModel;
   const notes = [];
-  if (req.hasProviderModel || localProviders.length > 0) {
+  if (hasProviderModel || localProviders.length > 0) {
     notes.push(`## LLM provider keys
 
 ${providerBlock}
 
-The engine calls each provider directly with the API key from \`.env\`. Without a
-key, an Agent node that uses that provider's catalog model fails at build.`);
+The engine calls each provider directly with the API key from \`engine.env\`. Without
+a key, an Agent node that uses that provider's catalog model fails at build.`);
   }
   if (hasHardware) {
     notes.push(`## Hardware access
@@ -36270,18 +37019,20 @@ and tighten it to your security policy before deploying.`);
   if (hasExternalService) {
     notes.push(`## External resources
 
-\`external_resources.json\` holds the broker/endpoint credentials the engine connects
-with \u2014 keep it \`chmod 600\`. This bundle does not start those services; it assumes the
-broker/endpoint already exists and is reachable from the controller.`);
+The broker/endpoint credentials the engine connects with live in the mounted secret
+document \`engine-secrets.json\` (a JSON map of resource id -> secret value, mounted
+read-only at \`/etc/foresthub/secrets.json\`) \u2014 keep it \`chmod 600\`. This
+bundle does not start those services; it assumes the broker/endpoint already exists
+and is reachable from the controller.`);
   }
-  if (deviceModelFiles.length > 0) {
+  if (deviceModels.length > 0) {
     notes.push(`## On-device models
 
 This bundle runs a llama-server container per on-device model; the engine reaches it
-over the compose network by service name. The GGUF file(s) below must sit in a
-\`models/\` folder next to the compose file on the controller. They are too large for
-the main \`scp\` line, so step 3 transfers them separately:
-${deviceModelFiles.map((f) => `- \`./models/${f}\``).join("\n")}`);
+over the compose network by service name. Each GGUF must sit in that model's workspace
+dir below (read-only mounted into its container). They are too large for the main
+\`scp\` line, so step 3 transfers them separately:
+${deviceModels.map((m) => `- \`${m.dir}/${m.file}\``).join("\n")}`);
   }
   if (hasNetworkModel) {
     notes.push(`## Network models
@@ -36289,43 +37040,38 @@ ${deviceModelFiles.map((f) => `- \`./models/${f}\``).join("\n")}`);
 A network model points at an inference endpoint **you run yourself** (llama-server, vLLM,
 Ollama, ...) on another machine. This bundle does not start that server for you.`);
   }
-  if (req.hasWebSearch) {
+  if (cfg.webSearch) {
     notes.push(`## Web search
 
-The web-search API key is in \`.env\` (\`ENGINE_WEB_SEARCH_API_KEY\`).`);
+The web-search API key is in \`engine.env\` (\`ENGINE_WEB_SEARCH_API_KEY\`).`);
   }
   const notesBlock = notes.length ? "\n" + notes.join("\n\n") + "\n" : "";
-  const transferExtra = [
-    hasHardware ? "device_manifest.json" : "",
-    hasExternal ? "external_resources.json" : "",
-    hasHardware || hasExternal ? "deployment_mapping.json" : ""
-  ].filter(Boolean);
-  const transferExtraStr = transferExtra.length ? " " + transferExtra.join(" ") : "";
-  const modelsTransfer = deviceModelFiles.length ? `
+  const modelsTransfer = deviceModels.length ? `
 
 # On-device model weights \u2014 too large for the line above (GGUF can be several GB).
-# Copy them from this bundle:
-scp -r models/ $CONTROLLER_USER@$CONTROLLER_ADDR:~/fh-engine/
-# ...or download them directly into ~/fh-engine/models/ on the controller.` : "";
-  const runBlock = deviceModelFiles.length ? `ssh $CONTROLLER_USER@$CONTROLLER_ADDR 'cd ~/fh-engine && docker load -i fh-engine.tar'
+# Put each GGUF in its model's workspace dir, then copy the workspaces tree:
+scp -r workspaces/ $CONTROLLER_USER@$CONTROLLER_ADDR:~/fh-engine/
+# ...or download them directly into ~/fh-engine/workspaces/<model>/ on the controller.` : "";
+  const runBlock = deviceModels.length ? `ssh $CONTROLLER_USER@$CONTROLLER_ADDR 'cd ~/fh-engine && docker load -i fh-engine.tar'
 ssh $CONTROLLER_USER@$CONTROLLER_ADDR 'cd ~/fh-engine && docker compose up -d'
 
-# The engine only starts once the llama-server sidecar reports healthy. If the engine
-# stays "created", inspect the sidecar \u2014 these show every container, not just the engine:
+# The engine and the llama-server sidecar start independently; the engine reaches the
+# model once it is up. These show every container, not just the engine:
 ssh $CONTROLLER_USER@$CONTROLLER_ADDR 'cd ~/fh-engine && docker compose ps'
 ssh $CONTROLLER_USER@$CONTROLLER_ADDR 'cd ~/fh-engine && docker compose logs -f'` : `ssh $CONTROLLER_USER@$CONTROLLER_ADDR 'cd ~/fh-engine && docker load -i fh-engine.tar'
 ssh $CONTROLLER_USER@$CONTROLLER_ADDR 'cd ~/fh-engine && docker compose up -d'
 ssh $CONTROLLER_USER@$CONTROLLER_ADDR 'cd ~/fh-engine && docker compose logs -f engine'`;
-  return `# ForestHub engine \u2014 deployment bundle
+  return `# Edge Agents engine \u2014 deployment bundle
 
 Generated by \`fh-workflow deploy\`. This directory contains everything needed to
 run one engine instance on an edge controller, **standalone** \u2014 the engine boots
-the workflow from \`workflow.json\` and runs it autonomously:
+the workflow from \`engine-config.json\` and runs it autonomously:
 
 - \`docker-compose.yml\` \u2014 deployment template
-- \`workflow.json\` \u2014 the workflow graph the engine executes${deployFilesBlock}
-- \`.env\` \u2014 operator configuration (already filled in, \`chmod 600\` it)
-- \`fh-engine.tar\` \u2014 image tarball (you build this in step 1 below)
+- \`engine-config.json\` \u2014 the engine's single boot config (workflow + bindings + device manifest)
+- \`deployment-spec.json\` \u2014 the full resolved deployment spec (deployment record)
+- \`engine.env\` \u2014 operator configuration loaded into the engine (already filled in, \`chmod 600\` it)
+${hasSecrets ? "- `engine-secrets.json` \u2014 resource credentials, mounted read-only at `/etc/foresthub/secrets.json` (already filled in, `chmod 600` it)\n" : ""}- \`fh-engine.tar\` \u2014 image tarball (you build this in step 1 below)
 ${notesBlock}
 ## 1. Build the image (on the dev machine)
 
@@ -36341,10 +37087,10 @@ docker buildx build --platform linux/arm64 -t fh-engine:latest --load .
 docker buildx build --platform linux/amd64 -t fh-engine:latest --load .
 \`\`\`
 
-## 2. Review the generated \`.env\`
+## 2. Review the generated \`engine.env\`
 
 \`\`\`bash
-chmod 600 .env
+chmod 600 engine.env
 \`\`\`
 
 The wizard already filled in your operator values. Double-check before
@@ -36362,7 +37108,7 @@ docker save fh-engine:latest -o ../path/to/this/bundle/fh-engine.tar
 ssh $CONTROLLER_USER@$CONTROLLER_ADDR 'mkdir -p ~/fh-engine'
 
 cd path/to/this/bundle
-scp fh-engine.tar docker-compose.yml workflow.json${transferExtraStr} .env \\
+scp fh-engine.tar docker-compose.yml engine-config.json deployment-spec.json engine.env ${hasSecrets ? "engine-secrets.json " : ""}\\
     $CONTROLLER_USER@$CONTROLLER_ADDR:~/fh-engine/${modelsTransfer}
 \`\`\`
 
@@ -36372,75 +37118,77 @@ scp fh-engine.tar docker-compose.yml workflow.json${transferExtraStr} .env \\
 ${runBlock}
 \`\`\`
 
-## Agent memory
+## Agent memory & durable data
 
-The workflow's memory files live in the named volume \`engine-memory\` (mounted at
-\`/var/lib/foresthub/memory\`). They survive restarts and \`docker compose down\`;
-only \`docker compose down -v\` deletes them. The volume is namespaced by the
-compose project name, which defaults to the bundle directory's name \u2014 keep it
-stable across updates, or pin it via \`COMPOSE_PROJECT_NAME\`. In this standalone
-bundle the volume is the only copy of the memory.
+Each container's durable data is a plain host directory in this bundle,
+\`./workspaces/<container>/\` (mounted read-write at \`/var/lib/foresthub/workspace\`):
 
-To keep the data at a host path instead, replace the named volume with a bind
-mount. Named-volume ownership is handled by the image; a bind-mounted host
-directory you must create and chown to the engine's nonroot user yourself:
+- \`./workspaces/engine/\` \u2014 the engine's memory files.
+- \`./workspaces/<model>/\` \u2014 an on-device model's GGUF weights (see above).
 
-\`\`\`bash
-sudo mkdir -p /data/foresthub/memory && sudo chown -R 65532:65532 /data/foresthub/memory
-# docker-compose.yml:  - /data/foresthub/memory:/var/lib/foresthub/memory
-\`\`\`
+These are ordinary files: back them up by copying the folder, inspect them directly.
+They persist across restarts and redeploys **as long as you keep this bundle directory
+stable** \u2014 deploy into the same path each time; a fresh directory starts empty. This
+bundle is the only copy; there is no backend mirror.
 `;
 }
-function ctxSizeVar(modelId) {
-  const suffix = modelId.toUpperCase().replace(/[^A-Z0-9]+/g, "_").replace(/^_+|_+$/g, "");
-  return `LLAMA_CTX_SIZE_${suffix || "MODEL"}`;
-}
 function slugify2(name) {
   return name.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
 }
 
 // cli/deploy/write.ts
-async function writeOutput(workflow, cfg, req) {
-  const artifacts = buildDeployArtifacts(req, cfg);
-  const dir = path9.resolve(process.cwd(), cfg.outputDir);
-  if (existsSync3(dir)) {
-    const contents = await fs7.readdir(dir);
+async function writeOutput(spec, resourceSecrets, cfg, req, componentEnv = {}) {
+  const dir = path11.resolve(process.cwd(), cfg.outputDir);
+  if (existsSync4(dir)) {
+    const contents = await fs8.readdir(dir);
     if (contents.length > 0) {
       if (!cfg.force) {
         process.stderr.write(`output dir not empty: ${dir} (use --force to overwrite)
 `);
         process.exit(1);
       }
-      await fs7.rm(dir, { recursive: true, force: true });
-      await fs7.mkdir(dir, { recursive: true });
+      await fs8.rm(dir, { recursive: true, force: true });
+      await fs8.mkdir(dir, { recursive: true });
     }
   } else {
-    await fs7.mkdir(dir, { recursive: true });
+    await fs8.mkdir(dir, { recursive: true });
   }
   const written = [];
   const emit = async (name, content, secret = false) => {
-    const out = path9.join(dir, name);
+    const out = path11.join(dir, name);
     const opts = secret ? { encoding: "utf-8", mode: 384 } : { encoding: "utf-8" };
-    await fs7.writeFile(out, content, opts);
+    await fs8.writeFile(out, content, opts);
     written.push(out);
   };
   const json2 = (v) => JSON.stringify(v, null, 2) + "\n";
-  await emit("workflow.json", json2(workflow));
-  await emit("docker-compose.yml", composeYaml(cfg, req));
-  await emit(".env", envFile(cfg), true);
-  await emit("README.md", readme(cfg, req));
-  const hasHardware = req.hardwareChannels.length > 0;
-  const hasExternal = req.mqttChannels.length > 0 || req.customModels.length > 0;
-  if (hasHardware) await emit("device_manifest.json", json2(artifacts.deviceManifest));
-  if (hasExternal) await emit("external_resources.json", json2(artifacts.externalResources), true);
-  if (hasHardware || hasExternal) await emit("deployment_mapping.json", json2(artifacts.deploymentMapping));
-  if (Object.values(cfg.models).some((b) => b.location === "device")) {
-    await fs7.mkdir(path9.join(dir, "models"), { recursive: true });
+  for (const c of spec.components) {
+    if (c.config !== void 0) await emit(configFileName(c.name), json2(c.config));
+  }
+  const secretDocs = Object.keys(resourceSecrets).length > 0 ? { engine: resourceSecrets } : {};
+  await emit("deployment-spec.json", json2(spec));
+  await emit("docker-compose.yml", composeYaml(spec, secretDocs));
+  await emit("engine.env", envFile(cfg), true);
+  for (const [name, doc] of Object.entries(secretDocs)) {
+    await emit(secretsFileName(name), json2(doc), true);
+  }
+  await emit("README.md", readme(spec, cfg, req.hasProviderModel, Object.keys(secretDocs).length > 0));
+  for (const [name, text] of Object.entries(componentEnv)) {
+    await emit(`${name}.env`, text, true);
+  }
+  const workspaceSources = new Set(
+    spec.components.flatMap(
+      (c) => (c.volumes ?? []).map((v) => v.split(":")[0] ?? "").filter((src) => src.startsWith("./workspaces/"))
+    )
+  );
+  for (const src of workspaceSources) {
+    await fs8.mkdir(path11.join(dir, src), { recursive: true });
   }
   return written;
 }
 
 // cli/deploy/index.ts
+var ENGINE_IMAGE = "fh-engine:latest";
+var LLAMA_SERVER_IMAGE = "ghcr.io/ggml-org/llama.cpp:server-b8589";
 var USAGE = `Usage: fh-workflow deploy <workflow.json> [flags]
 
 Generates a self-contained, standalone Engine deployment bundle (workflow.json,
@@ -36451,6 +37199,9 @@ autonomously. Missing values are filled in interactively, or supplied via
 LLM provider keys (set one for each catalog model an Agent uses):
 ${ALL_PROVIDERS.map((p) => `  --${p}-key KEY`).join("\n")}
 
+Custom components (extra containers to run alongside the engine):
+  --component DIR                 folder with a component.json (repeatable)
+
 Output:
   --output DIR                    default: ./<workflow-name>-bundle
   --force                         overwrite existing DIR
@@ -36472,6 +37223,7 @@ function parseFlags(args2) {
       output: { type: "string" },
       "log-level": { type: "string" },
       values: { type: "string" },
+      component: { type: "string", multiple: true },
       force: { type: "boolean", default: false },
       help: { type: "boolean", short: "h", default: false }
     },
@@ -36488,6 +37240,7 @@ function parseFlags(args2) {
     output: values.output,
     logLevel: values["log-level"],
     values: values.values,
+    component: values.component ?? [],
     force: values.force ?? false,
     help: values.help ?? false
   };
@@ -36513,10 +37266,10 @@ function partialFromFlags(flags, fileValues) {
   };
 }
 async function loadValues(source) {
-  const abs = path10.resolve(process.cwd(), source);
+  const abs = path12.resolve(process.cwd(), source);
   let raw;
   try {
-    raw = await fs8.readFile(abs, "utf-8");
+    raw = await fs9.readFile(abs, "utf-8");
   } catch (err) {
     if (err.code === "ENOENT") {
       process.stderr.write(`Values file not found: ${abs}
@@ -36589,15 +37342,41 @@ function configFromPartial(p, outputDirDefault) {
     webSearch: p.webSearch
   };
 }
+async function loadFlagComponents(dirs) {
+  const uniqueDirs = [...new Set(dirs.map((d) => path12.resolve(process.cwd(), d)))];
+  const entries = await Promise.all(
+    uniqueDirs.map(async (dir) => ({ source: path12.join(dir, "component.json"), data: await readComponentJson(dir), dir }))
+  );
+  parseDeployComponents(entries);
+  const seen = /* @__PURE__ */ new Set();
+  const loaded = [];
+  for (const e of entries) {
+    const component = e.data;
+    if (seen.has(component.name)) {
+      throw new Error(`duplicate component name "${component.name}" (two --component folders declare it)`);
+    }
+    seen.add(component.name);
+    loaded.push({ component, dir: e.dir });
+  }
+  return loaded;
+}
+async function resolveComponentsEnv(loaded) {
+  const env = {};
+  for (const { component, dir } of loaded) {
+    const text = await resolveComponentEnv(dir, component.name, { interactive: false });
+    if (text !== null) env[component.name] = text;
+  }
+  return env;
+}
 async function deployCommand(workflowPath, args2) {
   if (!workflowPath || workflowPath === "--help" || workflowPath === "-h") {
     process.stdout.write(USAGE);
     process.exit(workflowPath ? 0 : 1);
   }
-  const abs = path10.resolve(process.cwd(), workflowPath);
+  const abs = path12.resolve(process.cwd(), workflowPath);
   let raw;
   try {
-    raw = await fs8.readFile(abs, "utf-8");
+    raw = await fs9.readFile(abs, "utf-8");
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
@@ -36628,20 +37407,44 @@ async function deployCommand(workflowPath, args2) {
     process.stdout.write(USAGE);
     process.exit(0);
   }
-  const req = inspect(workflow);
+  let domain2;
+  try {
+    domain2 = deserialize7(workflow);
+  } catch (err) {
+    process.stderr.write(`${err instanceof Error ? err.message : String(err)}
+`);
+    process.exit(1);
+  }
+  const req = deriveRequirements(domain2);
   if (req.hasRetriever) {
     process.stderr.write(
       "error: workflow references a Retriever node (RAG).\n       A standalone engine has no retriever, so the node cannot resolve and the\n       engine fails at build. Remove the Retriever node to deploy standalone.\n"
     );
     process.exit(1);
   }
-  const workflowName = path10.basename(abs, path10.extname(abs));
+  const workflowName = path12.basename(abs, path12.extname(abs));
   const outputDirDefault = `./${slugify2(workflowName)}-bundle`;
   const fileValues = flags.values ? await loadValues(flags.values) : {};
   const partial2 = partialFromFlags(flags, fileValues);
+  let preloaded;
+  try {
+    preloaded = await loadFlagComponents(flags.component);
+  } catch (err) {
+    process.stderr.write(`${err instanceof Error ? err.message : String(err)}
+`);
+    process.exit(1);
+  }
   let cfg;
+  let customComponents;
+  let componentEnv;
   if (process.stdin.isTTY) {
-    cfg = await promptMissing(partial2, outputDirDefault, req, workflowName);
+    ({ config: cfg, customComponents, componentEnv } = await promptMissing(
+      partial2,
+      outputDirDefault,
+      req,
+      workflowName,
+      preloaded
+    ));
   } else {
     const missing = missingRequired(req, partial2);
     if (missing.length > 0) {
@@ -36652,21 +37455,40 @@ async function deployCommand(workflowPath, args2) {
       process.exit(1);
     }
     cfg = configFromPartial(partial2, outputDirDefault);
+    customComponents = preloaded.map((c) => c.component);
+    componentEnv = await resolveComponentsEnv(preloaded);
+  }
+  let built;
+  try {
+    built = buildDeploymentSpec(
+      domain2,
+      cfg,
+      {
+        id: slugify2(workflowName),
+        engineImage: ENGINE_IMAGE,
+        llamaServerImage: LLAMA_SERVER_IMAGE
+      },
+      customComponents
+    );
+  } catch (err) {
+    process.stderr.write(`${err instanceof Error ? err.message : String(err)}
+`);
+    process.exit(1);
   }
   let files;
   try {
-    files = await writeOutput(workflow, cfg, req);
+    files = await writeOutput(built.spec, built.resourceSecrets, cfg, req, componentEnv);
   } catch (err) {
     process.stderr.write(`${err instanceof Error ? err.message : String(err)}
 `);
     process.exit(1);
   }
-  const absOut = path10.resolve(process.cwd(), cfg.outputDir);
+  const absOut = path12.resolve(process.cwd(), cfg.outputDir);
   process.stdout.write(`
 \u2713 Deployment bundle written to ${absOut}
 `);
   for (const f of files) {
-    process.stdout.write(`  - ${path10.relative(process.cwd(), f)}
+    process.stdout.write(`  - ${path12.relative(process.cwd(), f)}
 `);
   }
   process.stdout.write(`