@ifc-lite/flow-nodes 0.3.1 → 0.5.1

package/dist/open-model-node.d.ts

@@ -0,0 +1,3 @@
+import { type FlowNodeDef } from './host.js';
+export declare const openModelNode: FlowNodeDef;
+//# sourceMappingURL=open-model-node.d.ts.map

package/dist/open-model-node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-model-node.d.ts","sourceRoot":"","sources":["../src/open-model-node.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAkC,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7E,eAAO,MAAM,aAAa,EAAE,WA2B3B,CAAC"}

package/dist/open-model-node.js

@@ -0,0 +1,47 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+/**
+ * `model.openFromSource` — open a file a previous node fetched (typically
+ * `documents.download`) as a model, through the host's own load path
+ * (`FlowHost.openModel`): the viewer's canonical `addModel`/`loadFile`
+ * pipeline, or the CLI's / MCP's headless loader. The node never parses
+ * the bytes itself, so no second ingest pipeline exists.
+ *
+ * The `modelId` output is what sequences the rest of the graph: wire it
+ * into `model.select` / `model.byType`'s `modelId` input so those reads
+ * run after the model is open and address it.
+ */
+import { fromBase64 } from './base64.js';
+import { requireCapability, SCALAR_ITEM } from './host.js';
+export const openModelNode = {
+    type: 'model.openFromSource',
+    title: 'Open model from source',
+    category: 'model',
+    doc: 'Opens a downloaded IFC file (base64 `data`, e.g. from Download document) as a model on the host. Wire `modelId` into a model read node to query the opened model.',
+    inputs: [
+        { name: 'data', type: SCALAR_ITEM },
+        { name: 'name', type: SCALAR_ITEM, optional: true, nullable: true },
+    ],
+    outputs: [{ name: 'modelId', type: SCALAR_ITEM }],
+    params: [{ name: 'name', kind: 'string', default: 'model.ifc', doc: 'File name, used when the `name` input is not wired; its extension picks the format.' }],
+    capabilities: ['model.create'],
+    requires: { backend: ['openModel'] },
+    // Loading a model changes what every later read sees, so it is a write
+    // (never memoised, and it advances the cache's write generation).
+    writes: 'model',
+    volatile: true,
+    run: async (ctx, i, p) => {
+        requireCapability(ctx, 'model.create');
+        const open = ctx.host.openModel;
+        if (!open)
+            throw new Error('model.openFromSource: this host cannot open models');
+        const bytes = fromBase64(typeof i.data === 'string' ? i.data : '');
+        if (bytes.byteLength === 0)
+            throw new Error('model.openFromSource: "data" is empty');
+        const name = typeof i.name === 'string' && i.name.length > 0 ? i.name : typeof p.name === 'string' && p.name.length > 0 ? p.name : 'model.ifc';
+        const { modelId } = await open.call(ctx.host, bytes, name);
+        return { modelId };
+    },
+};
+//# sourceMappingURL=open-model-node.js.map

package/dist/open-model-node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-model-node.js","sourceRoot":"","sources":["../src/open-model-node.ts"],"names":[],"mappings":"AAAA;;+DAE+D;AAE/D;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAoB,MAAM,WAAW,CAAC;AAE7E,MAAM,CAAC,MAAM,aAAa,GAAgB;IACxC,IAAI,EAAE,sBAAsB;IAC5B,KAAK,EAAE,wBAAwB;IAC/B,QAAQ,EAAE,OAAO;IACjB,GAAG,EAAE,mKAAmK;IACxK,MAAM,EAAE;QACN,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE;QACnC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KACpE;IACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IACjD,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,qFAAqF,EAAE,CAAC;IAC5J,YAAY,EAAE,CAAC,cAAc,CAAC;IAC9B,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE;IACpC,uEAAuE;IACvE,kEAAkE;IAClE,MAAM,EAAE,OAAO;IACf,QAAQ,EAAE,IAAI;IACd,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE;QACvB,iBAAiB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACjF,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACrF,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;QAC/I,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC3D,OAAO,EAAE,OAAO,EAAE,CAAC;IACrB,CAAC;CACF,CAAC"}

package/dist/script-node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"script-node.d.ts","sourceRoot":"","sources":["../src/script-node.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAmD,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAiF9F,eAAO,MAAM,UAAU,EAAE,WAgBxB,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,WAsB5B,CAAC"}
+{"version":3,"file":"script-node.d.ts","sourceRoot":"","sources":["../src/script-node.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAmD,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AA0H9F,eAAO,MAAM,UAAU,EAAE,WAgBxB,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,WAsB5B,CAAC"}

package/dist/script-node.js

@@ -17,38 +17,57 @@
  * no `bcf`, `ids`, `spatial`); that difference is documented, not papered
  * over. Sandbox permissions are derived from the graph's grants: mutation
  * is only enabled when a `model.mutate` grant exists.
+ *
+ * A lane whose code made a network request calls `ctx.markVolatile()`, so
+ * the scheduler does not memoise that run: rerunning the graph fetches
+ * again instead of replaying a stale response. A script that never calls
+ * `bim.network.fetch` stays memoisable even in a graph holding a grant.
  */
 import { createSandbox } from '@ifc-lite/sandbox';
 import { ANY_ITEM, ANY_LIST, requireCapability } from './host.js';
 /**
- * One sandbox per (BimContext, permission set), kept for the lifetime of
- * the context: QuickJS module init is the expensive part, and a graph with
- * several Script nodes (or a re-run) must not pay it per lane. Created here
- * rather than through `bim.sandbox` because that path dynamically imports
- * `@ifc-lite/sandbox` relative to the SDK package, which a pnpm-isolated
- * install cannot resolve headlessly.
+ * One sandbox per (BimContext, transport, permission set), kept for the
+ * lifetime of the context: QuickJS module init is the expensive part, and a
+ * graph with several Script nodes (or a re-run) must not pay it per lane.
+ * Created here rather than through `bim.sandbox` because that path
+ * dynamically imports `@ifc-lite/sandbox` relative to the SDK package, which
+ * a pnpm-isolated install cannot resolve headlessly.
  */
 const sandboxes = new WeakMap();
-function sandboxFor(bim, permissions, timeoutMs) {
-    const key = JSON.stringify({ permissions, timeoutMs });
+function sandboxFor(bim, permissions, timeoutMs, networkGrants, transport) {
+    const key = JSON.stringify({ permissions, timeoutMs, networkGrants });
     let perContext = sandboxes.get(bim);
     if (!perContext) {
         perContext = new Map();
         sandboxes.set(bim, perContext);
     }
-    let pending = perContext.get(key);
-    if (!pending) {
+    let perTransport = perContext.get(transport);
+    if (!perTransport) {
+        perTransport = new Map();
+        perContext.set(transport, perTransport);
+    }
+    const cache = perTransport;
+    let entry = cache.get(key);
+    if (!entry) {
+        const counting = (url, init) => {
+            created.requests += 1;
+            return transport ? transport(url, init) : fetch(url, init);
+        };
         // A rejected creation (a wasm load failure, a transient resource limit)
         // must not be cached: every later lane would await the same rejection for
         // the lifetime of the context, turning one hiccup into a dead node.
-        pending = createSandbox(bim, { permissions, limits: { timeoutMs } }).catch((err) => {
-            if (perContext.get(key) === pending)
-                perContext.delete(key);
+        const sandbox = createSandbox(bim, {
+            permissions, limits: { timeoutMs }, network: { grants: networkGrants, transport: counting },
+        }).catch((err) => {
+            if (cache.get(key) === created)
+                cache.delete(key);
             throw err;
         });
-        perContext.set(key, pending);
+        const created = { sandbox, requests: 0 };
+        entry = created;
+        cache.set(key, entry);
     }
-    return pending;
+    return entry;
 }
 /** Evaluate `params.code` with `inputs` in scope and return its last expression. */
 async function evaluate(ctx, inputs, params) {
@@ -57,6 +76,7 @@ async function evaluate(ctx, inputs, params) {
     // read the model through a capability the graph never had.
     requireCapability(ctx, 'model.read');
     const grants = ctx.host.grants;
+    const networkGrants = ctx.host.networkGrants ?? [];
     const has = (scope, action) => !grants || grants.some((g) => g.scope === scope && g.action === action);
     const permissions = {
         query: true,
@@ -67,6 +87,9 @@ async function evaluate(ctx, inputs, params) {
         export: has('export', 'create'),
         lens: true,
         files: true,
+        // `bim.network` exists only when the graph holds a `network.fetch` grant;
+        // every call is still checked against those grants (#5446 review).
+        network: networkGrants.some((g) => g.scope === 'network' && g.action === 'fetch'),
     };
     const injected = JSON.stringify({ a: inputs.a ?? null, b: inputs.b ?? null, c: inputs.c ?? null });
     // Every lane shares one sandbox, and QuickJS evaluates a program in the
@@ -79,12 +102,23 @@ async function evaluate(ctx, inputs, params) {
     // `inputs` in scope, and the last expression as the value (`eval` returns
     // its program's completion value, which a function body would not).
     const code = `(function (inputs) { return eval(${JSON.stringify(String(params.code ?? ''))}); })(${injected})`;
-    const sandbox = await sandboxFor(ctx.host.bim, permissions, Number(params.timeoutMs) || 30_000);
-    // Plain JavaScript by contract: skipping the TypeScript strip avoids
-    // initialising esbuild-wasm, which only works in the browser. It is also
-    // what keeps the wrapper above honest — the source reaches `eval`
-    // verbatim, not as something a transpiler rewrote.
-    const result = await sandbox.eval(code, { typescript: false });
+    const entry = sandboxFor(ctx.host.bim, permissions, Number(params.timeoutMs) || 30_000, networkGrants, ctx.host.networkTransport);
+    const sandbox = await entry.sandbox;
+    const requestsBefore = entry.requests;
+    let result;
+    try {
+        // Plain JavaScript by contract: skipping the TypeScript strip avoids
+        // initialising esbuild-wasm, which only works in the browser. It is also
+        // what keeps the wrapper above honest — the source reaches `eval`
+        // verbatim, not as something a transpiler rewrote.
+        result = await sandbox.eval(code, { typescript: false });
+    }
+    finally {
+        // In `finally`: a lane that fetched and then threw yields null under
+        // lifting, and that null must not be memoised either.
+        if (entry.requests !== requestsBefore)
+            ctx.markVolatile?.();
+    }
     for (const entry of result.logs) {
         const level = entry.level === 'error' ? 'error' : entry.level === 'warn' ? 'warn' : 'info';
         ctx.log(level, entry.args.map((a) => (typeof a === 'string' ? a : JSON.stringify(a))).join(' '));

package/dist/script-node.js.map

@@ -1 +1 @@
-{"version":3,"file":"script-node.js","sourceRoot":"","sources":["../src/script-node.ts"],"names":[],"mappings":"AAAA;;+DAE+D;AAE/D;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,aAAa,EAAgB,MAAM,mBAAmB,CAAC;AAEhE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,EAA8B,MAAM,WAAW,CAAC;AAE9F;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,IAAI,OAAO,EAA6C,CAAC;AAE3E,SAAS,UAAU,CAAC,GAAe,EAAE,WAAoC,EAAE,SAAiB;IAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;IACvD,IAAI,UAAU,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,UAAU,GAAG,IAAI,GAAG,EAAE,CAAC;QACvB,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,wEAAwE;QACxE,0EAA0E;QAC1E,oEAAoE;QACpE,OAAO,GAAG,aAAa,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjF,IAAI,UAAW,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO;gBAAE,UAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC9D,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,oFAAoF;AACpF,KAAK,UAAU,QAAQ,CAAC,GAAQ,EAAE,MAAyC,EAAE,MAAyC;IACpH,qEAAqE;IACrE,sEAAsE;IACtE,2DAA2D;IAC3D,iBAAiB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,MAAc,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACvH,MAAM,WAAW,GAAG;QAClB,KAAK,EAAE,IAAI;QACX,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC;QACjH,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC;QAC9B,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC;QAC7B,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC/B,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,IAAI;KACZ,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACnG,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,oEAAoE;IACpE,qEAAqE;IACrE,oEAAoE;IACpE,uEAAuE;IACvE,0EAA0E;IAC1E,oEAAoE;IACpE,MAAM,IAAI,GAAG,oCAAoC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,SAAS,QAAQ,GAAG,CAAC;IAC/G,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,CAAC;IAChG,qEAAqE;IACrE,yEAAyE;IACzE,kEAAkE;IAClE,mDAAmD;IACnD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/D,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3F,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC;AAC9B,CAAC;AAED,wEAAwE;AACxE,MAAM,aAAa,GAAG;IACpB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,8EAA8E,EAAE;IAChK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,4EAA4E,EAAE;CACjI,CAAC;AAEX,MAAM,CAAC,MAAM,UAAU,GAAgB;IACrC,IAAI,EAAE,YAAY;IAClB,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,QAAQ;IAClB,GAAG,EAAE,8RAA8R;IACnS,MAAM,EAAE;QACN,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC7D,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC7D,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC9D;IACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC7C,MAAM,EAAE,CAAC,GAAG,aAAa,CAAC;IAC1B,YAAY,EAAE,CAAC,YAAY,CAAC;IAC5B,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE;IAClC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;CACtF,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAgB;IACzC,IAAI,EAAE,aAAa;IACnB,KAAK,EAAE,eAAe;IACtB,QAAQ,EAAE,QAAQ;IAClB,GAAG,EAAE,iKAAiK;IACtK,MAAM,EAAE;QACN,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC7C,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC7C,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC9C;IACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5C,MAAM,EAAE,CAAC,GAAG,aAAa,CAAC;IAC1B,YAAY,EAAE,CAAC,YAAY,CAAC;IAC5B,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE;IAClC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAClD,uEAAuE;QACvE,0EAA0E;QAC1E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;QAC9H,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;CACF,CAAC"}
+{"version":3,"file":"script-node.js","sourceRoot":"","sources":["../src/script-node.ts"],"names":[],"mappings":"AAAA;;+DAE+D;AAE/D;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,aAAa,EAAqC,MAAM,mBAAmB,CAAC;AAGrF,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,EAA8B,MAAM,WAAW,CAAC;AAc9F;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,IAAI,OAAO,EAA0E,CAAC;AAExG,SAAS,UAAU,CACjB,GAAe,EAAE,WAAoC,EAAE,SAAiB,EAAE,aAAoC,EAAE,SAAqC;IAErJ,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC;IACtE,IAAI,UAAU,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,UAAU,GAAG,IAAI,GAAG,EAAE,CAAC;QACvB,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,IAAI,GAAG,EAAE,CAAC;QACzB,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC;IAC3B,IAAI,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,QAAQ,GAAmB,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;YAC7C,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;YACtB,OAAO,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7D,CAAC,CAAC;QACF,wEAAwE;QACxE,0EAA0E;QAC1E,oEAAoE;QACpE,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,EAAE;YACjC,WAAW,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,EAAE;SAC5F,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACf,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO;gBAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClD,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,GAAiB,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACvD,KAAK,GAAG,OAAO,CAAC;QAChB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oFAAoF;AACpF,KAAK,UAAU,QAAQ,CAAC,GAAQ,EAAE,MAAyC,EAAE,MAAyC;IACpH,qEAAqE;IACrE,sEAAsE;IACtE,2DAA2D;IAC3D,iBAAiB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;IAC/B,MAAM,aAAa,GAAG,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IACnD,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,MAAc,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACvH,MAAM,WAAW,GAAG;QAClB,KAAK,EAAE,IAAI;QACX,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC;QACjH,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC;QAC9B,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC;QAC7B,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC/B,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,IAAI;QACX,0EAA0E;QAC1E,mEAAmE;QACnE,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC;KAClF,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACnG,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,oEAAoE;IACpE,qEAAqE;IACrE,oEAAoE;IACpE,uEAAuE;IACvE,0EAA0E;IAC1E,oEAAoE;IACpE,MAAM,IAAI,GAAG,oCAAoC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,SAAS,QAAQ,GAAG,CAAC;IAC/G,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAClI,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC;IACpC,MAAM,cAAc,GAAG,KAAK,CAAC,QAAQ,CAAC;IACtC,IAAI,MAA4C,CAAC;IACjD,IAAI,CAAC;QACH,qEAAqE;QACrE,yEAAyE;QACzE,kEAAkE;QAClE,mDAAmD;QACnD,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC;YAAS,CAAC;QACT,qEAAqE;QACrE,sDAAsD;QACtD,IAAI,KAAK,CAAC,QAAQ,KAAK,cAAc;YAAE,GAAG,CAAC,YAAY,EAAE,EAAE,CAAC;IAC9D,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3F,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC;AAC9B,CAAC;AAED,wEAAwE;AACxE,MAAM,aAAa,GAAG;IACpB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,8EAA8E,EAAE;IAChK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,4EAA4E,EAAE;CACjI,CAAC;AAEX,MAAM,CAAC,MAAM,UAAU,GAAgB;IACrC,IAAI,EAAE,YAAY;IAClB,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,QAAQ;IAClB,GAAG,EAAE,8RAA8R;IACnS,MAAM,EAAE;QACN,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC7D,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC7D,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC9D;IACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC7C,MAAM,EAAE,CAAC,GAAG,aAAa,CAAC;IAC1B,YAAY,EAAE,CAAC,YAAY,CAAC;IAC5B,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE;IAClC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;CACtF,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAgB;IACzC,IAAI,EAAE,aAAa;IACnB,KAAK,EAAE,eAAe;IACtB,QAAQ,EAAE,QAAQ;IAClB,GAAG,EAAE,iKAAiK;IACtK,MAAM,EAAE;QACN,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC7C,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC7C,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC9C;IACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5C,MAAM,EAAE,CAAC,GAAG,aAAa,CAAC;IAC1B,YAAY,EAAE,CAAC,YAAY,CAAC;IAC5B,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE;IAClC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAClD,uEAAuE;QACvE,0EAA0E;QAC1E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;QAC9H,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;CACF,CAAC"}

package/dist/secrets.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Secrets from the host environment (#5167 phase 3.5).
+ *
+ * A node param references a secret with `{{secret:NAME}}` inside a
+ * string value (or a string nested inside a `json`-kind param, e.g. a
+ * header map). The grammar itself is recognised by `@ifc-lite/flow`'s
+ * `referencedSecrets` (availability needs it too); this module is the one
+ * place declared-vs-referenced is cross-checked and `process.env` is read —
+ * shared by `packages/cli/src/commands/flow.ts` (`flow run`) and
+ * `packages/mcp/src/tools/flow.ts` (`run_flow`), the only two callers
+ * allowed to read `process.env` for a flow graph. The viewer never calls
+ * this module: `HostFeatures.secrets` is always the empty set there, so
+ * a graph referencing a secret shows `unavailable` before it runs (see
+ * `availability.ts`), not this module's validation error.
+ *
+ * Two checks run BEFORE any node executes:
+ *   1. every `{{secret:NAME}}` reference must be covered by a declared
+ *      `secret.read:NAME` capability in the graph — an undeclared
+ *      reference is a validation error, not a silently-empty string;
+ *   2. every declared-and-referenced secret must actually be set in the
+ *      environment — a referenced-but-unset secret is also a validation
+ *      error, not an empty string interpolated into a request.
+ *
+ * Redaction (`buildRedactionMap` / `redactDeep`) is a separate, later
+ * step the caller applies at the OUTER boundary — right before writing
+ * to stdout, an MCP response, or a log sink — so a secret value that
+ * reaches a remote response body (a server echoing back an Authorization
+ * header) and comes back into the run's own output is still caught, not
+ * just the point where `{{secret:NAME}}` was first substituted. See the
+ * module doc trade-offs below on the minimum-length cutoff.
+ */
+import { referencedSecrets, type FlowDocument } from '@ifc-lite/flow';
+export { referencedSecrets };
+export interface SecretValidationError {
+    readonly nodeId: string;
+    readonly param: string;
+    readonly name: string;
+    readonly reason: 'undeclared' | 'unset';
+    readonly message: string;
+}
+/** Every `secret:NAME` the graph's capabilities declare (from `secret.read:<NAME>` grants). */
+export declare function declaredSecrets(doc: FlowDocument): ReadonlySet<string>;
+/**
+ * Validate every `{{secret:NAME}}` reference against the graph's declared
+ * capabilities AND the environment, before any node runs. Returns an empty
+ * array when the graph is clean (including "no secrets used at all").
+ */
+export declare function validateSecretReferences(doc: FlowDocument, env: Readonly<Record<string, string | undefined>>): SecretValidationError[];
+/** Resolve every declared-and-referenced secret's value from `env`. Call only after `validateSecretReferences` returns no errors. */
+export declare function resolveSecretValues(doc: FlowDocument, env: Readonly<Record<string, string | undefined>>): ReadonlyMap<string, string>;
+/** Return a new document with every `{{secret:NAME}}` reference in node params replaced by its resolved value. The input document is never mutated. */
+export declare function interpolateSecrets(doc: FlowDocument, values: ReadonlyMap<string, string>): FlowDocument;
+/** Minimum secret length worth redacting (see module doc): shorter values risk mass-redacting incidental substrings of ordinary text. */
+export declare const MIN_REDACTED_SECRET_LENGTH = 6;
+/**
+ * Reverse map (value → marker) for every resolved secret at least
+ * `MIN_REDACTED_SECRET_LENGTH` characters long. A secret shorter than
+ * that is a real gap (documented, not silently accepted): a 4-character
+ * token could coincide with ordinary text often enough that scrubbing it
+ * everywhere would make legitimate output unreadable, so this module
+ * accepts that a very short secret is not redactable by substring match
+ * at all.
+ */
+export declare function buildRedactionMap(values: ReadonlyMap<string, string>): ReadonlyMap<string, string>;
+/**
+ * Replace every occurrence of a redacted secret value with its marker, in ONE
+ * pass, trying the longest value first at each position. Sequential
+ * replacement let a shorter secret inside a longer one match first
+ * (`abcdef` inside `abcdefghi` left `<secret:A>ghi`, exposing B's suffix),
+ * and could match inside a marker already written (#5446 review).
+ */
+export declare function redactText(text: string, redaction: ReadonlyMap<string, string>): string;
+/**
+ * Walk an arbitrary JSON-ish value (a run summary, a log entry, a thrown
+ * error's message) and redact every string found, at any depth — this is
+ * what catches a secret that travelled through a response body and back
+ * into the run's own output, not just the literal param it was
+ * interpolated into.
+ */
+/**
+ * The env names a host may report as available secrets: set, and long
+ * enough to be redacted. `resolveSecretValues` refuses a shorter value, so
+ * counting it as available made `flow validate` pass a graph the run then
+ * refused (#5446 review).
+ */
+export declare function usableSecretNames(env: Readonly<Record<string, string | undefined>>): string[];
+export declare function redactDeep<T>(value: T, redaction: ReadonlyMap<string, string>): T;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,iBAAiB,EAAqB,KAAK,YAAY,EAAiB,MAAM,gBAAgB,CAAC;AAExG,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAG7B,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,+FAA+F;AAC/F,wBAAgB,eAAe,CAAC,GAAG,EAAE,YAAY,GAAG,WAAW,CAAC,MAAM,CAAC,CAWtE;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,GAAG,qBAAqB,EAAE,CAyBtI;AAED,qIAAqI;AACrI,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAkBrI;AAaD,uJAAuJ;AACvJ,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,YAAY,CAQvG;AAED,yIAAyI;AACzI,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAWlG;AAMD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAKvF;AAED;;;;;;GAMG;AACH;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,GAAG,MAAM,EAAE,CAI7F;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAejF"}

package/dist/secrets.js

@@ -0,0 +1,202 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+/**
+ * Secrets from the host environment (#5167 phase 3.5).
+ *
+ * A node param references a secret with `{{secret:NAME}}` inside a
+ * string value (or a string nested inside a `json`-kind param, e.g. a
+ * header map). The grammar itself is recognised by `@ifc-lite/flow`'s
+ * `referencedSecrets` (availability needs it too); this module is the one
+ * place declared-vs-referenced is cross-checked and `process.env` is read —
+ * shared by `packages/cli/src/commands/flow.ts` (`flow run`) and
+ * `packages/mcp/src/tools/flow.ts` (`run_flow`), the only two callers
+ * allowed to read `process.env` for a flow graph. The viewer never calls
+ * this module: `HostFeatures.secrets` is always the empty set there, so
+ * a graph referencing a secret shows `unavailable` before it runs (see
+ * `availability.ts`), not this module's validation error.
+ *
+ * Two checks run BEFORE any node executes:
+ *   1. every `{{secret:NAME}}` reference must be covered by a declared
+ *      `secret.read:NAME` capability in the graph — an undeclared
+ *      reference is a validation error, not a silently-empty string;
+ *   2. every declared-and-referenced secret must actually be set in the
+ *      environment — a referenced-but-unset secret is also a validation
+ *      error, not an empty string interpolated into a request.
+ *
+ * Redaction (`buildRedactionMap` / `redactDeep`) is a separate, later
+ * step the caller applies at the OUTER boundary — right before writing
+ * to stdout, an MCP response, or a log sink — so a secret value that
+ * reaches a remote response body (a server echoing back an Authorization
+ * header) and comes back into the run's own output is still caught, not
+ * just the point where `{{secret:NAME}}` was first substituted. See the
+ * module doc trade-offs below on the minimum-length cutoff.
+ */
+import { referencedSecrets, replaceSecretRefs } from '@ifc-lite/flow';
+export { referencedSecrets };
+import { parseCapabilities } from '@ifc-lite/extensions';
+/** Every `secret:NAME` the graph's capabilities declare (from `secret.read:<NAME>` grants). */
+export function declaredSecrets(doc) {
+    const parsed = parseCapabilities(doc.capabilities);
+    const names = new Set();
+    if (!parsed.ok)
+        return names;
+    for (const cap of parsed.value) {
+        if (cap.scope === 'secret' && cap.action === 'read' && cap.target?.segments.length === 1) {
+            const seg = cap.target.segments[0];
+            if (seg.kind === 'literal')
+                names.add(seg.value);
+        }
+    }
+    return names;
+}
+/**
+ * Validate every `{{secret:NAME}}` reference against the graph's declared
+ * capabilities AND the environment, before any node runs. Returns an empty
+ * array when the graph is clean (including "no secrets used at all").
+ */
+export function validateSecretReferences(doc, env) {
+    const declared = declaredSecrets(doc);
+    const errors = [];
+    for (const ref of referencedSecrets(doc)) {
+        if (!declared.has(ref.name)) {
+            errors.push({
+                nodeId: ref.nodeId,
+                param: ref.param,
+                name: ref.name,
+                reason: 'undeclared',
+                message: `node "${ref.nodeId}" param "${ref.param}" references {{secret:${ref.name}}}, but the graph does not declare "secret.read:${ref.name}"`,
+            });
+            continue;
+        }
+        if (env[ref.name] === undefined) {
+            errors.push({
+                nodeId: ref.nodeId,
+                param: ref.param,
+                name: ref.name,
+                reason: 'unset',
+                message: `node "${ref.nodeId}" param "${ref.param}" references {{secret:${ref.name}}}, which is declared but not set in the environment`,
+            });
+        }
+    }
+    return errors;
+}
+/** Resolve every declared-and-referenced secret's value from `env`. Call only after `validateSecretReferences` returns no errors. */
+export function resolveSecretValues(doc, env) {
+    const values = new Map();
+    for (const ref of referencedSecrets(doc)) {
+        const v = env[ref.name];
+        if (v === undefined)
+            continue;
+        // Redaction is a substring scrub, and a very short value cannot be
+        // scrubbed without mangling ordinary output — so rather than resolve a
+        // secret that would then travel unredacted, refuse it. The message names
+        // the variable, never the value.
+        if (v.length < MIN_REDACTED_SECRET_LENGTH) {
+            throw new Error(`secret ${ref.name} is shorter than ${MIN_REDACTED_SECRET_LENGTH} characters, so it could not be `
+                + 'redacted from run output; refusing to use it');
+        }
+        values.set(ref.name, v);
+    }
+    return values;
+}
+function substitute(value, values) {
+    if (typeof value === 'string') {
+        return replaceSecretRefs(value, (name, whole) => values.get(name) ?? whole);
+    }
+    if (Array.isArray(value))
+        return value.map((v) => substitute(v, values));
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, substitute(v, values)]));
+    }
+    return value;
+}
+/** Return a new document with every `{{secret:NAME}}` reference in node params replaced by its resolved value. The input document is never mutated. */
+export function interpolateSecrets(doc, values) {
+    if (values.size === 0)
+        return doc;
+    const nodes = doc.nodes.map((node) => {
+        if (!node.params)
+            return node;
+        const params = Object.fromEntries(Object.entries(node.params).map(([k, v]) => [k, substitute(v, values)]));
+        return { ...node, params };
+    });
+    return { ...doc, nodes };
+}
+/** Minimum secret length worth redacting (see module doc): shorter values risk mass-redacting incidental substrings of ordinary text. */
+export const MIN_REDACTED_SECRET_LENGTH = 6;
+/**
+ * Reverse map (value → marker) for every resolved secret at least
+ * `MIN_REDACTED_SECRET_LENGTH` characters long. A secret shorter than
+ * that is a real gap (documented, not silently accepted): a 4-character
+ * token could coincide with ordinary text often enough that scrubbing it
+ * everywhere would make legitimate output unreadable, so this module
+ * accepts that a very short secret is not redactable by substring match
+ * at all.
+ */
+export function buildRedactionMap(values) {
+    // Secrets sharing one value share one marker naming all of them, rather
+    // than the last silently taking the value over (#5446 review).
+    const names = new Map();
+    for (const [name, value] of values) {
+        if (value.length < MIN_REDACTED_SECRET_LENGTH)
+            continue;
+        names.set(value, [...(names.get(value) ?? []), name]);
+    }
+    // Longest value first, so a secret containing another is matched whole.
+    const ordered = [...names].sort(([a], [b]) => b.length - a.length);
+    return new Map(ordered.map(([value, owners]) => [value, `<secret:${[...owners].sort().join('|')}>`]));
+}
+function escapeRegExp(text) {
+    return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * Replace every occurrence of a redacted secret value with its marker, in ONE
+ * pass, trying the longest value first at each position. Sequential
+ * replacement let a shorter secret inside a longer one match first
+ * (`abcdef` inside `abcdefghi` left `<secret:A>ghi`, exposing B's suffix),
+ * and could match inside a marker already written (#5446 review).
+ */
+export function redactText(text, redaction) {
+    if (redaction.size === 0)
+        return text;
+    const values = [...redaction.keys()].sort((a, b) => b.length - a.length);
+    const pattern = new RegExp(values.map(escapeRegExp).join('|'), 'g');
+    return text.replace(pattern, (match) => redaction.get(match) ?? match);
+}
+/**
+ * Walk an arbitrary JSON-ish value (a run summary, a log entry, a thrown
+ * error's message) and redact every string found, at any depth — this is
+ * what catches a secret that travelled through a response body and back
+ * into the run's own output, not just the literal param it was
+ * interpolated into.
+ */
+/**
+ * The env names a host may report as available secrets: set, and long
+ * enough to be redacted. `resolveSecretValues` refuses a shorter value, so
+ * counting it as available made `flow validate` pass a graph the run then
+ * refused (#5446 review).
+ */
+export function usableSecretNames(env) {
+    return Object.entries(env)
+        .filter(([, value]) => typeof value === 'string' && value.length >= MIN_REDACTED_SECRET_LENGTH)
+        .map(([name]) => name);
+}
+export function redactDeep(value, redaction) {
+    if (redaction.size === 0)
+        return value;
+    if (typeof value === 'string')
+        return redactText(value, redaction);
+    if (Array.isArray(value))
+        return value.map((v) => redactDeep(v, redaction));
+    // Keys too: a script can return an object keyed by a secret, and
+    // `core.groupBy` can group by one (#5446 review).
+    if (value instanceof Map) {
+        return new Map([...value.entries()].map(([k, v]) => [redactDeep(k, redaction), redactDeep(v, redaction)]));
+    }
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value).map(([k, v]) => [redactText(k, redaction), redactDeep(v, redaction)]));
+    }
+    return value;
+}
+//# sourceMappingURL=secrets.js.map

package/dist/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA;;+DAE+D;AAE/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAoC,MAAM,gBAAgB,CAAC;AAExG,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAUzD,+FAA+F;AAC/F,MAAM,UAAU,eAAe,CAAC,GAAiB;IAC/C,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzF,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAiB,EAAE,GAAiD;IAC3G,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC;gBACV,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,YAAY;gBACpB,OAAO,EAAE,SAAS,GAAG,CAAC,MAAM,YAAY,GAAG,CAAC,KAAK,yBAAyB,GAAG,CAAC,IAAI,mDAAmD,GAAG,CAAC,IAAI,GAAG;aACjJ,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC;gBACV,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,OAAO;gBACf,OAAO,EAAE,SAAS,GAAG,CAAC,MAAM,YAAY,GAAG,CAAC,KAAK,yBAAyB,GAAG,CAAC,IAAI,sDAAsD;aACzI,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,qIAAqI;AACrI,MAAM,UAAU,mBAAmB,CAAC,GAAiB,EAAE,GAAiD;IACtG,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,GAAG,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,mEAAmE;QACnE,uEAAuE;QACvE,yEAAyE;QACzE,iCAAiC;QACjC,IAAI,CAAC,CAAC,MAAM,GAAG,0BAA0B,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,UAAU,GAAG,CAAC,IAAI,oBAAoB,0BAA0B,kCAAkC;kBAChG,8CAA8C,CACjD,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,MAAmC;IACrE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,iBAAiB,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACzE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uJAAuJ;AACvJ,MAAM,UAAU,kBAAkB,CAAC,GAAiB,EAAE,MAAmC;IACvF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAClC,MAAM,KAAK,GAAe,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC/C,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3G,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC;IAC7B,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED,yIAAyI;AACzI,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAE5C;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAmC;IACnE,wEAAwE;IACxE,+DAA+D;IAC/D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,MAAM,GAAG,0BAA0B;YAAE,SAAS;QACxD,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,wEAAwE;IACxE,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACnE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACxG,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,SAAsC;IAC7E,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAiD;IACjF,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SACvB,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,0BAA0B,CAAC;SAC9F,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,UAAU,CAAI,KAAQ,EAAE,SAAsC;IAC5E,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC,KAAK,EAAE,SAAS,CAAiB,CAAC;IACnF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,SAAS,CAAC,CAAiB,CAAC;IAC5F,iEAAiE;IACjE,kDAAkD;IAClD,IAAI,KAAK,YAAY,GAAG,EAAE,CAAC;QACzB,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAiB,CAAC;IAC7H,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAC5E,CAAC;IACpB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/speckle/client.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The Speckle wire protocol, spoken ONLY through `coreNetworkRequest` (the
+ * gated, https-only, exact-host-grant request function every flow node
+ * uses). Nothing here calls `fetch`: the transport comes from the host, and
+ * the grant check runs before any byte moves.
+ *
+ * Three requests, the same three Speckle's own object loader makes:
+ *
+ *   POST /graphql                               version → `referencedObject` (root object id)
+ *   GET  /objects/<project>/<object>/single     the root object alone
+ *   POST /api/getobjects/<project>              a batch of objects by id, one `id\tjson` per line
+ *
+ * The walk is lazy and iterative: a round fetches only the ids the previous
+ * round referenced and has not yet seen, so display meshes and their data
+ * chunks (the bulk of any commit) are never downloaded — `speckle.receive`
+ * does not write them (see `mapping.ts`). A visited set stops cycles and
+ * revisits, and `maxObjects` bounds the total, failing loudly when reached.
+ */
+import { type FetchTransport } from '@ifc-lite/sandbox';
+import type { Capability } from '@ifc-lite/extensions';
+import type { SpeckleTarget } from './url.js';
+export type SpeckleObject = Readonly<Record<string, unknown>> & {
+    readonly id: string;
+};
+export interface SpeckleClientOptions {
+    readonly grants: readonly Capability[];
+    readonly transport?: FetchTransport;
+    /** Personal access token; sent as `Authorization: Bearer`. Empty = anonymous (public projects). */
+    readonly token?: string;
+    readonly timeoutMs: number;
+    /** Per-response byte cap. A response that hits it fails the receive: a truncated batch is missing objects. */
+    readonly maxBytes: number;
+    /** Upper bound on the number of objects fetched. */
+    readonly maxObjects: number;
+    readonly signal?: AbortSignal;
+}
+/** Keys whose values are display geometry: never followed, never fetched. */
+export declare const DISPLAY_KEYS: ReadonlySet<string>;
+/** The root object id a target points at, and the version it came from (if any). */
+export declare function resolveRoot(opts: SpeckleClientOptions, target: SpeckleTarget): Promise<{
+    objectId: string;
+    versionId?: string;
+}>;
+/** Every `referencedId` in an object's own JSON tree, except under display keys. */
+export declare function referencedIds(value: unknown, out?: Set<string>): Set<string>;
+/**
+ * Fetch the root object and everything it references (display geometry
+ * excepted), keyed by id. Throws when an id the graph references is not
+ * returned by the server, or when `maxObjects` is reached.
+ */
+export declare function fetchObjectGraph(opts: SpeckleClientOptions, target: SpeckleTarget, rootId: string): Promise<Map<string, SpeckleObject>>;
+//# sourceMappingURL=client.d.ts.map

package/dist/speckle/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/speckle/client.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAA0C,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAChG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAE9C,MAAM,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAExF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC;IACpC,mGAAmG;IACnG,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,8GAA8G;IAC9G,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED,6EAA6E;AAC7E,eAAO,MAAM,YAAY,EAAE,WAAW,CAAC,MAAM,CAA6E,CAAC;AA4C3H,oFAAoF;AACpF,wBAAsB,WAAW,CAAC,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAwBtI;AAOD,oFAAoF;AACpF,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,GAAE,GAAG,CAAC,MAAM,CAAa,GAAG,GAAG,CAAC,MAAM,CAAC,CAgBvF;AA0BD;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CA0B7I"}