@mondaydotcomorg/z2h-cli 0.27.1 → 0.29.0

package/dist/backend/rules/snowflake-static-sql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"snowflake-static-sql.d.ts","sourceRoot":"","sources":["../../../src/backend/rules/snowflake-static-sql.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAgDxD;;;;;;;;GAQG;AACH,qBAAa,sBAAuB,YAAW,WAAW;IACxD,QAAQ,CAAC,IAAI,0BAA0B;IAEvC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,WAAW,GAAG,MAAM,EAAE;CAcjE"}

package/dist/backend/rules/snowflake-static-sql.js

@@ -0,0 +1,75 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+
+const acornWalk = require('acorn-walk');
+const backend_ast = require('../ast.js');
+
+const SNOWFLAKE_QUERY = 'ctx.api.v1.snowflake.query';
+const message = (file, line) => `${file}${line ? `:${line}` : ''}: ${SNOWFLAKE_QUERY} must receive SQL written in the handler — a string literal, ` +
+    `or a variable bound to one. Client-supplied values go through params (\`:name\` bindings) and options, never into the SQL text.`;
+/**
+ * True when every possible value of `node` is text authored in this file:
+ * string literals, templates whose holes are themselves static, `+`
+ * concatenation, either branch of a conditional, and identifiers that resolve
+ * (within the file) to such values. Anything reaching outside the file —
+ * `ctx.input`, calls, member reads, destructuring — is not static.
+ */
+function isStaticSql(node, bindings, resolving) {
+    if (!node) {
+        return false;
+    }
+    const staticChild = (child) => isStaticSql(child, bindings, resolving);
+    switch (node.type) {
+        case 'Literal':
+            return typeof node.value === 'string';
+        case 'TemplateLiteral':
+            return node.expressions.every(staticChild);
+        case 'BinaryExpression':
+            return node.operator === '+' && staticChild(node.left) && staticChild(node.right);
+        case 'ConditionalExpression':
+            return staticChild(node.consequent) && staticChild(node.alternate);
+        case 'LogicalExpression':
+            return staticChild(node.left) && staticChild(node.right);
+        case 'Identifier': {
+            const { name } = node;
+            if (bindings.unpinnable.has(name) || resolving.has(name)) {
+                return false;
+            }
+            const decls = bindings.declarations.get(name);
+            if (!decls || decls.length === 0) {
+                return false;
+            }
+            const next = new Set(resolving).add(name);
+            return decls.every(d => d.path?.length === 0 && isStaticSql(d.init, bindings, next));
+        }
+        default:
+            return false;
+    }
+}
+/**
+ * `ctx.api.v1.snowflake.query(sql, params?, options?)` — the SQL text must live
+ * in the handler. The frontend chooses *which* handler to call and supplies
+ * `params` / `options`; it never ships SQL. Binding placeholders (`:name`) are
+ * how client values reach the query.
+ *
+ * The call is matched through `const` aliases of the channel
+ * (`const sf = ctx.api.v1.snowflake; sf.query(…)`), see `PathResolver`.
+ */
+class SnowflakeStaticSqlRule {
+    name = 'snowflake/static-sql';
+    check({ file, program, bindings, paths }) {
+        const violations = [];
+        acornWalk.simple(program, {
+            CallExpression(node) {
+                if (paths.pathOf(node.callee) !== SNOWFLAKE_QUERY) {
+                    return;
+                }
+                if (!isStaticSql(node.arguments[0], bindings, new Set())) {
+                    violations.push(message(file, backend_ast.lineOf(node)));
+                }
+            },
+        });
+        return violations;
+    }
+}
+
+exports.SnowflakeStaticSqlRule = SnowflakeStaticSqlRule;

package/dist/backend/rules/types.d.ts

@@ -0,0 +1,29 @@
+import type { Program } from 'acorn';
+import type { Bindings, PathResolver } from '../ast';
+export interface RuleContext {
+    /** Handler file name, used to prefix messages. */
+    file: string;
+    /** Parsed with `locations: true`, so rules can point at a line. */
+    program: Program;
+    /** Every variable binding in the file — see `collectBindings`. */
+    bindings: Bindings;
+    /** Resolves member chains through `const` aliases — see `createPathResolver`. */
+    paths: PathResolver;
+}
+/**
+ * A capability-specific check that runs once the handler is structurally valid
+ * (parses as a script, defines `handler`, imports nothing).
+ *
+ * Rules return human-readable violations rather than throwing so the validator
+ * can report every problem in one pass — agent-generated handlers are fixed in
+ * a loop, and one round-trip per violation is slow.
+ *
+ * Implement as a class (see `SnowflakeStaticSqlRule`) and add an instance to
+ * `HANDLER_RULES` in `./index.ts` — keeps every rule the same shape to read.
+ */
+export interface HandlerRule {
+    /** Stable identifier, e.g. `snowflake/static-sql`. */
+    name: string;
+    check(ctx: RuleContext): string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/backend/rules/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/backend/rules/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AACrC,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAErD,MAAM,WAAW,WAAW;IAC1B,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,OAAO,EAAE,OAAO,CAAC;IACjB,kEAAkE;IAClE,QAAQ,EAAE,QAAQ,CAAC;IACnB,iFAAiF;IACjF,KAAK,EAAE,YAAY,CAAC;CACrB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,WAAW;IAC1B,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,EAAE,CAAC;CACnC"}

package/dist/backend/rules/types.js

@@ -0,0 +1 @@
+

package/dist/backend/validate.d.ts

@@ -0,0 +1,23 @@
+export interface HandlerValidation {
+    /** Every `ctx.api.v1.<domain>` the handler touches (known or not), sorted and unique. */
+    apiDomains: string[];
+}
+/**
+ * Validates a handler's source before upload: real parsing (via acorn) catches
+ * syntax errors at build time instead of an opaque failure inside the isolate.
+ * Handlers run with no module system and no bundler — `handler` must be a plain
+ * top-level global, and imports/requires (which would resolve to nothing at
+ * runtime) are rejected.
+ *
+ * Once the handler is structurally sound, capability-specific rules from
+ * `./rules` run and every violation is reported at once.
+ *
+ * Unknown `ctx.api.v1.<domain>` usage is a warning, not a failure: this pass is
+ * build-time DX feedback for agent-generated code, never a security boundary —
+ * the isolate has no ambient capabilities regardless of what a handler contains.
+ *
+ * Returns the `ctx.api.v1.*` domains the handler touches so callers (integration
+ * detection) can reuse the parse instead of re-scanning the source.
+ */
+export declare function validateHandlerSource(file: string, source: string): HandlerValidation;
+//# sourceMappingURL=validate.d.ts.map

package/dist/backend/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/backend/validate.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,iBAAiB;IAChC,yFAAyF;IACzF,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAuCrF"}

package/dist/backend/validate.js

@@ -0,0 +1,64 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+
+const acornWalk = require('acorn-walk');
+const z2hSharedUtils = require('@mondaydotcomorg/z2h-shared-utils');
+const util_logger = require('../util/logger.js');
+const backend_ast = require('./ast.js');
+const backend_handlerDeclaration = require('./handler-declaration.js');
+const backend_messages = require('./messages.js');
+const backend_parse = require('./parse.js');
+const backend_rules_index = require('./rules/index.js');
+
+const KNOWN_API_DOMAINS = [...z2hSharedUtils.ALWAYS_ON_CHANNELS, ...z2hSharedUtils.DECLARED_INTEGRATIONS];
+/**
+ * Validates a handler's source before upload: real parsing (via acorn) catches
+ * syntax errors at build time instead of an opaque failure inside the isolate.
+ * Handlers run with no module system and no bundler — `handler` must be a plain
+ * top-level global, and imports/requires (which would resolve to nothing at
+ * runtime) are rejected.
+ *
+ * Once the handler is structurally sound, capability-specific rules from
+ * `./rules` run and every violation is reported at once.
+ *
+ * Unknown `ctx.api.v1.<domain>` usage is a warning, not a failure: this pass is
+ * build-time DX feedback for agent-generated code, never a security boundary —
+ * the isolate has no ambient capabilities regardless of what a handler contains.
+ *
+ * Returns the `ctx.api.v1.*` domains the handler touches so callers (integration
+ * detection) can reuse the parse instead of re-scanning the source.
+ */
+function validateHandlerSource(file, source) {
+    const program = backend_parse.parseOrThrow(file, source);
+    const bindings = backend_ast.collectBindings(program);
+    acornWalk.simple(program, {
+        CallExpression(node) {
+            if (node.callee.type === 'Identifier' && node.callee.name === 'require') {
+                throw new Error(backend_messages.messages.mustNotImport(file));
+            }
+        },
+        ImportExpression() {
+            throw new Error(backend_messages.messages.mustNotImport(file));
+        },
+    });
+    const declaration = backend_handlerDeclaration.findHandlerDeclaration(program.body);
+    if (!declaration) {
+        throw new Error(backend_messages.messages.mustDefine(file));
+    }
+    if (declaration.kind === 'variable' && (!declaration.init || backend_handlerDeclaration.NEVER_A_FUNCTION.has(declaration.init.type))) {
+        throw new Error(backend_messages.messages.notAFunction(file));
+    }
+    const paths = backend_ast.createPathResolver(bindings, backend_handlerDeclaration.handlerContextParamName(declaration));
+    const apiDomains = backend_ast.collectApiDomains(program, paths);
+    const violations = backend_rules_index.HANDLER_RULES.flatMap(rule => rule.check({ file, program, bindings, paths }));
+    if (violations.length > 0) {
+        throw new Error(violations.join('\n'));
+    }
+    for (const domain of apiDomains) {
+        if (!KNOWN_API_DOMAINS.includes(domain)) {
+            util_logger.warn(`${file}: ctx.api.v1.${domain} is not a known capability (available: ${KNOWN_API_DOMAINS.join(', ')})`);
+        }
+    }
+    return { apiDomains: [...apiDomains].sort() };
+}
+
+exports.validateHandlerSource = validateHandlerSource;

package/dist/commands/__tests__/backend-validate.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=backend-validate.test.d.ts.map

package/dist/commands/__tests__/backend-validate.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend-validate.test.d.ts","sourceRoot":"","sources":["../../../src/commands/__tests__/backend-validate.test.ts"],"names":[],"mappings":""}

package/dist/commands/backend.d.ts

@@ -28,6 +28,12 @@ export declare function deployBackend(opts: {
     deployedBy: string;
     isPreview: boolean;
 }): Promise<string[]>;
+/**
+ * Run the same handler validation deploy runs (syntax, isolate constraints,
+ * handler rules, integration detection) against the working tree — without
+ * uploading anything. Throws on the first invalid handler.
+ */
+export declare function backendValidateCommand(appDir?: string): Promise<void>;
 export declare function backendInvokeCommand(handlerName: string, opts?: {
     input?: string;
 }): Promise<void>;

package/dist/commands/backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../../src/commands/backend.ts"],"names":[],"mappings":"AAoBA;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnD;AAmCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;CACpB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CASpB;AAED,wBAAsB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAa5G"}
+{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../../src/commands/backend.ts"],"names":[],"mappings":"AAoBA;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnD;AAmCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;CACpB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CASpB;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAAC,MAAM,GAAE,MAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAa1F;AAED,wBAAsB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAa5G"}

package/dist/commands/backend.js

@@ -42,8 +42,8 @@ async function readDetectAndUpload(appDir, prefix, version, deployedBy, logLabel
         return [];
     }
     util_logger.info(`reading backend handlers ${logLabel}`);
-    const { handlers } = await backend_handlers.readHandlers(appDir);
-    const integrations = backend_detectIntegrations.detectIntegrationsFromHandlers(handlers);
+    const { handlers, apiDomains } = await backend_handlers.readHandlers(appDir);
+    const integrations = backend_detectIntegrations.detectIntegrations(apiDomains);
     if (Object.keys(handlers).length === 0) {
         return integrations;
     }
@@ -83,6 +83,25 @@ async function deployBackend(opts) {
         throw util_errors.tagDeployError('deploy_backend_error', err);
     }
 }
+/**
+ * Run the same handler validation deploy runs (syntax, isolate constraints,
+ * handler rules, integration detection) against the working tree — without
+ * uploading anything. Throws on the first invalid handler.
+ */
+async function backendValidateCommand(appDir = process.cwd()) {
+    if (!hasHandlers(appDir)) {
+        util_logger.output('[z2h-cli] no backend/handlers/ directory — nothing to validate', { handlers: [], integrations: [] });
+        return;
+    }
+    const { handlers, apiDomains } = await backend_handlers.readHandlers(appDir);
+    const names = Object.keys(handlers).sort();
+    const integrations = backend_detectIntegrations.detectIntegrations(apiDomains);
+    const list = (xs) => (xs.length ? xs.join(', ') : 'none');
+    util_logger.output(`[z2h-cli] ${names.length} handler(s) valid: ${list(names)}\n[z2h-cli] integrations: ${list(integrations)}`, {
+        handlers: names,
+        integrations,
+    });
+}
 async function backendInvokeCommand(handlerName, opts = {}) {
     const appName = currentAppName();
     let input = null;
@@ -99,5 +118,6 @@ async function backendInvokeCommand(handlerName, opts = {}) {
 }
 
 exports.backendInvokeCommand = backendInvokeCommand;
+exports.backendValidateCommand = backendValidateCommand;
 exports.deployBackend = deployBackend;
 exports.hasHandlers = hasHandlers;

package/dist/commands/create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../src/commands/create.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,YAAY,EAAE,KAAK,UAAU,EAA2C,MAAM,4BAA4B,CAAC;AAKpH,OAAO,EAAE,YAAY,EAAE,KAAK,UAAU,EAAE,CAAC;AAEzC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAwBD,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoF5F"}
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../src/commands/create.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,YAAY,EAAE,KAAK,UAAU,EAA2C,MAAM,4BAA4B,CAAC;AAKpH,OAAO,EAAE,YAAY,EAAE,KAAK,UAAU,EAAE,CAAC;AAEzC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAwBD,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CA6F5F"}

package/dist/commands/create.js

@@ -58,11 +58,19 @@ async function createCommand(appName, opts = {}) {
     if (!(await isDirEmpty(appDir))) {
         throw new Error(`${appDir} is non-empty. Pick a different name or wipe it first.`);
     }
-    // Check the broker — fail fast if the app is already registered.
+    // Check the broker — fail fast if the app already has a real release.
+    // A claimed-but-unpublished stub (`entry: null`) is fine to proceed past:
+    // either it's this same name being re-created after a local wipe (we'd only
+    // see it at all if we still have access to it), or it genuinely doesn't
+    // exist yet and we claim it below.
     const existing = await util_broker_app.fetchApp(util_appName.mfAppName(appName));
-    if (existing) {
+    if (existing?.deployed) {
         throw new Error(`An app named "${appName}" already exists in the Z2H registry. Pick a different name.`);
     }
+    const gitRemote = util_git_remoteOptions.resolveRemoteUrl(opts.remote, appName, opts.repoUrl);
+    if (!existing) {
+        await util_broker_app.claimApp(util_appName.mfAppName(appName), gitRemote);
+    }
     // Compute substitutions.
     const vars = {
         __APP_NAME__: appName,
@@ -87,7 +95,6 @@ async function createCommand(appName, opts = {}) {
         await fs.copy(opts.htmlFile, path__default.default.join(appDir, 'src', 'page.html'));
     }
     util_logger.info(`initializing git repo for ${appName}...`);
-    const gitRemote = util_git_remoteOptions.resolveRemoteUrl(opts.remote, appName, opts.repoUrl);
     await util_git_repo.initRepo(appDir, gitRemote);
     util_logger.info(`installing dependencies for ${appName}...`);
     await util_npm_install.runYarnInstall({ cwd: workspace });

package/dist/commands/generate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/commands/generate.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAwHD;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CA6E3F"}
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/commands/generate.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAwHD;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CA8E3F"}

package/dist/commands/generate.js

@@ -136,8 +136,9 @@ async function generateCommand(appName, opts) {
     if (!(await isDirEmpty(appDir))) {
         throw new Error(`${appDir} is non-empty. Pick a different name or wipe it first.`);
     }
+    // A claimed-but-unpublished stub (`entry: null`) is fine to proceed past — only a real release blocks generate.
     const existing = await util_broker_app.fetchApp(util_appName.mfAppName(appName));
-    if (existing) {
+    if (existing?.deployed) {
         throw new Error(`An app named "${appName}" already exists in the Z2H registry. Pick a different name.`);
     }
     util_logger.info(`copying template "${template.id}" → ${appDir}`);

package/dist/constants.d.ts

@@ -20,8 +20,7 @@ export declare const S3_SKILLS_BUCKET_NAME = "prod-use1-bigbrain-zth-skills";
 export declare const DATAVIZ_SKILLS_PREFIX = "dataviz/";
 export declare const APP_NAME_PATTERN: RegExp;
 export declare const PREVIEW_APP_NAME_PREFIX = "zth-preview-";
-export declare const DECLARED_INTEGRATIONS: readonly ["monday"];
-export type DeclaredIntegration = (typeof DECLARED_INTEGRATIONS)[number];
+export { ALWAYS_ON_CHANNELS, DECLARED_INTEGRATIONS, type DeclaredIntegration } from '@mondaydotcomorg/z2h-shared-utils';
 export declare const DEFAULT_BROKER_BASE_URL = "https://bigbrain-zth.bigbrain.me";
 /**
  * Resolves the broker origin (no trailing slash). Honors

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,eAAO,MAAM,eAAe,SAAS,CAAC;AAGtC,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAEjD,CAAC;AAKF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAElD,CAAC;AAMF,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAG9B,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAQ3C,eAAO,MAAM,iBAAiB,qCAAqC,CAAC;AACpE,eAAO,MAAM,MAAM,cAAc,CAAC;AAClC,eAAO,MAAM,gBAAgB,wEAA4D,CAAC;AAE1F,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAC7D,eAAO,MAAM,mBAAmB,+CAAgD,CAAC;AAKjF,eAAO,MAAM,kBAAkB,aAAa,CAAC;AAK7C,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,eAAO,MAAM,iBAAiB,yDAA2C,CAAC;AAM1E,eAAO,MAAM,qBAAqB,kCAAkC,CAAC;AAIrE,eAAO,MAAM,qBAAqB,aAAa,CAAC;AAMhD,eAAO,MAAM,gBAAgB,QAA2B,CAAC;AAEzD,eAAO,MAAM,uBAAuB,iBAAiB,CAAC;AAMtD,eAAO,MAAM,qBAAqB,qBAAsB,CAAC;AACzD,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAKzE,eAAO,MAAM,uBAAuB,qCAAqC,CAAC;AAE1E;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAID,wBAAgB,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGvD;AAKD,eAAO,MAAM,eAAe,iBAAiB,CAAC;AAG9C,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAGnD,eAAO,MAAM,uBAAuB,gCAAgC,CAAC;AAMrE,eAAO,MAAM,iBAAiB,EAAG,eAAwB,CAAC;AAE1D;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,eAAO,MAAM,eAAe,SAAS,CAAC;AAGtC,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAEjD,CAAC;AAKF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAElD,CAAC;AAMF,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAG9B,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAQ3C,eAAO,MAAM,iBAAiB,qCAAqC,CAAC;AACpE,eAAO,MAAM,MAAM,cAAc,CAAC;AAClC,eAAO,MAAM,gBAAgB,wEAA4D,CAAC;AAE1F,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAC7D,eAAO,MAAM,mBAAmB,+CAAgD,CAAC;AAKjF,eAAO,MAAM,kBAAkB,aAAa,CAAC;AAK7C,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,eAAO,MAAM,iBAAiB,yDAA2C,CAAC;AAM1E,eAAO,MAAM,qBAAqB,kCAAkC,CAAC;AAIrE,eAAO,MAAM,qBAAqB,aAAa,CAAC;AAMhD,eAAO,MAAM,gBAAgB,QAA2B,CAAC;AAEzD,eAAO,MAAM,uBAAuB,iBAAiB,CAAC;AAMtD,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,KAAK,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAKxH,eAAO,MAAM,uBAAuB,qCAAqC,CAAC;AAE1E;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAID,wBAAgB,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGvD;AAKD,eAAO,MAAM,eAAe,iBAAiB,CAAC;AAG9C,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAGnD,eAAO,MAAM,uBAAuB,gCAAgC,CAAC;AAMrE,eAAO,MAAM,iBAAiB,EAAG,eAAwB,CAAC;AAE1D;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C"}

package/dist/constants.js

@@ -1,5 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 
+const z2hSharedUtils = require('@mondaydotcomorg/z2h-shared-utils');
+
 /**
  * Cross-file constants. Narrowly-used literals (templates, prefixes used in
  * one place) stay local to their file to keep this index small.
@@ -57,11 +59,6 @@ const DATAVIZ_SKILLS_PREFIX = 'dataviz/';
 // upfront for friendlier errors.
 const APP_NAME_PATTERN = /^[a-z][a-z0-9-]{1,49}$/;
 const PREVIEW_APP_NAME_PREFIX = 'zth-preview-';
-// ─────────── Declared (OAuth-gated) backend integrations ─────
-// Closed set the CLI detects from handler sources and the broker validates on
-// register/update. Always-on channels (`db`, `llm`, `snowflake`) are not listed —
-// the runner builds those regardless. Shared via `@mondaydotcomorg/z2h-cli/constants`.
-const DECLARED_INTEGRATIONS = ['monday'];
 // ─────────── Broker origin + npm registry (shared §3 contract) ─────
 // The bigbrain-zth broker fronts both the STS credential route and the npm
 // proxy. `Z2H_BROKER_BASE_URL` overrides the origin for tests/staging.
@@ -103,6 +100,14 @@ function brokerNpmRegistryUrl() {
     return `${brokerBaseUrl()}${NPM_BROKER_PATH}`;
 }
 
+Object.defineProperty(exports, 'ALWAYS_ON_CHANNELS', {
+enumerable: true,
+get: () => z2hSharedUtils.ALWAYS_ON_CHANNELS
+});
+Object.defineProperty(exports, 'DECLARED_INTEGRATIONS', {
+enumerable: true,
+get: () => z2hSharedUtils.DECLARED_INTEGRATIONS
+});
 exports.APP_NAME_PATTERN = APP_NAME_PATTERN;
 exports.BROKER_NPM_SCOPE = BROKER_NPM_SCOPE;
 exports.BUCKET_READ_DNS_NAME = BUCKET_READ_DNS_NAME;
@@ -110,7 +115,6 @@ exports.BUCKET_READ_DNS_URL = BUCKET_READ_DNS_URL;
 exports.BUCKET_WRITE_NAME = BUCKET_WRITE_NAME;
 exports.BUCKET_WRITE_URL = BUCKET_WRITE_URL;
 exports.DATAVIZ_SKILLS_PREFIX = DATAVIZ_SKILLS_PREFIX;
-exports.DECLARED_INTEGRATIONS = DECLARED_INTEGRATIONS;
 exports.DEFAULT_BROKER_BASE_URL = DEFAULT_BROKER_BASE_URL;
 exports.GITIGNORE_ENTRIES = GITIGNORE_ENTRIES;
 exports.MANIFEST_KEY = MANIFEST_KEY;

package/dist/esm/backend/__tests__/ast.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ast.test.d.ts.map

package/dist/esm/backend/__tests__/ast.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ast.test.d.ts","sourceRoot":"","sources":["../../../../src/backend/__tests__/ast.test.ts"],"names":[],"mappings":""}

package/dist/esm/backend/__tests__/parse.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=parse.test.d.ts.map

package/dist/esm/backend/__tests__/parse.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.test.d.ts","sourceRoot":"","sources":["../../../../src/backend/__tests__/parse.test.ts"],"names":[],"mappings":""}

package/dist/esm/backend/__tests__/validate.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=validate.test.d.ts.map

package/dist/esm/backend/__tests__/validate.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.test.d.ts","sourceRoot":"","sources":["../../../../src/backend/__tests__/validate.test.ts"],"names":[],"mappings":""}

package/dist/esm/backend/ast.d.ts

@@ -0,0 +1,41 @@
+import type { AnyNode, Expression, Node, Pattern, Program, VariableDeclaration } from 'acorn';
+/** 1-based line a node starts on; requires the program to be parsed with `locations: true`. */
+export declare const lineOf: (node: Node) => number | undefined;
+export interface Declaration {
+    kind: VariableDeclaration['kind'];
+    init: Expression | null | undefined;
+    /**
+     * Property path from `init` to this binding: `[]` for `const x = init`,
+     * `['a', 'b']` for `const { a: { b: x } } = init`, `undefined` when the value
+     * is not a plain property read (array/rest/default patterns).
+     */
+    path: string[] | undefined;
+}
+export interface Bindings {
+    /** Every `var|let|const <name> = …` in the file, by name. */
+    declarations: Map<string, Declaration[]>;
+    /** Names whose value cannot be pinned: reassigned, updated, or bound as parameters. */
+    unpinnable: Set<string>;
+}
+/** Every identifier a binding pattern introduces (`{ a, b: [c] } = …` → a, c). */
+export declare const patternNames: (pattern: Pattern) => string[];
+export declare function collectBindings(program: Program): Bindings;
+export interface PathResolver {
+    /**
+     * Dotted path of a member chain, following `const` aliases back to their
+     * source: with `const sf = ctx.api.v1.snowflake`, `sf.query` resolves to
+     * `ctx.api.v1.snowflake.query`. Destructuring counts too
+     * (`const { snowflake: sf } = ctx.api.v1`). `undefined` if any link is dynamic.
+     *
+     * Only single, never-reassigned, never-shadowed `const` bindings are followed —
+     * anything else is left as written, so a `let` alias or a parameter of the same
+     * name is never mistaken for the channel. The handler's first parameter is
+     * treated as `ctx` even when renamed (`handler(context)` → `context.api.v1.db`
+     * resolves as `ctx.api.v1.db`).
+     */
+    pathOf(node: AnyNode): string | undefined;
+}
+export declare function createPathResolver(bindings: Bindings, contextParam?: string): PathResolver;
+/** Every `ctx.api.v1.<domain>` the program touches (known or not), through `paths`. */
+export declare function collectApiDomains(program: Program, paths: PathResolver): Set<string>;
+//# sourceMappingURL=ast.d.ts.map

package/dist/esm/backend/ast.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ast.d.ts","sourceRoot":"","sources":["../../../src/backend/ast.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,OAAO,CAAC;AAG9F,+FAA+F;AAC/F,eAAO,MAAM,MAAM,GAAI,MAAM,IAAI,KAAG,MAAM,GAAG,SAAiC,CAAC;AAI/E,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,CAAC;IACpC;;;;OAIG;IACH,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAC5B;AAED,MAAM,WAAW,QAAQ;IACvB,6DAA6D;IAC7D,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACzC,uFAAuF;IACvF,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACzB;AA8CD,kFAAkF;AAClF,eAAO,MAAM,YAAY,GAAI,SAAS,OAAO,KAAG,MAAM,EAAmD,CAAC;AAE1G,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,CA4C1D;AA2BD,MAAM,WAAW,YAAY;IAC3B;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,YAAY,CA6B1F;AAED,uFAAuF;AACvF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,CAWpF"}

package/dist/esm/backend/ast.mjs

@@ -0,0 +1,146 @@
+import { full, simple } from 'acorn-walk';
+
+/** 1-based line a node starts on; requires the program to be parsed with `locations: true`. */
+const lineOf = (node) => node.loc?.start.line;
+/**
+ * Every identifier a binding pattern introduces, with its property path from the
+ * pattern's value. `path` is deliberately not defaulted: callers pass `[]` for
+ * the root and `undefined` once the pattern stops being a plain property read.
+ */
+function patternBindings(pattern, path) {
+    switch (pattern.type) {
+        case 'Identifier':
+            return [{ name: pattern.name, path }];
+        case 'ObjectPattern':
+            return pattern.properties.flatMap(p => {
+                if (p.type === 'RestElement') {
+                    return patternBindings(p.argument, undefined);
+                }
+                const key = propertyKey(p.key, p.computed);
+                return patternBindings(p.value, path && key !== undefined ? [...path, key] : undefined);
+            });
+        case 'ArrayPattern':
+            return pattern.elements.flatMap(e => (e ? patternBindings(e, undefined) : []));
+        case 'AssignmentPattern':
+            return patternBindings(pattern.left, undefined);
+        case 'RestElement':
+            return patternBindings(pattern.argument, undefined);
+        default:
+            // MemberExpression targets (`obj.x = …`) bind no names.
+            return [];
+    }
+}
+function propertyKey(key, computed) {
+    if (key.type === 'Literal' && typeof key.value === 'string') {
+        return key.value;
+    }
+    if (!computed && key.type === 'Identifier') {
+        return key.name;
+    }
+    return undefined;
+}
+/** Every identifier a binding pattern introduces (`{ a, b: [c] } = …` → a, c). */
+const patternNames = (pattern) => patternBindings(pattern, []).map(b => b.name);
+function collectBindings(program) {
+    const declarations = new Map();
+    const unpinnable = new Set();
+    const markUnpinnable = (pattern) => patternNames(pattern).forEach(n => unpinnable.add(n));
+    full(program, node => {
+        switch (node.type) {
+            case 'VariableDeclaration':
+                for (const declarator of node.declarations) {
+                    for (const { name, path } of patternBindings(declarator.id, [])) {
+                        const list = declarations.get(name) ?? [];
+                        list.push({ kind: node.kind, init: declarator.init, path });
+                        declarations.set(name, list);
+                    }
+                }
+                break;
+            case 'AssignmentExpression':
+                markUnpinnable(node.left);
+                break;
+            case 'UpdateExpression':
+                if (node.argument.type === 'Identifier') {
+                    unpinnable.add(node.argument.name);
+                }
+                break;
+            case 'ForInStatement':
+            case 'ForOfStatement':
+                if (node.left.type !== 'VariableDeclaration') {
+                    markUnpinnable(node.left);
+                }
+                break;
+            case 'FunctionDeclaration':
+            case 'FunctionExpression':
+            case 'ArrowFunctionExpression':
+                node.params.forEach(markUnpinnable);
+                break;
+            case 'CatchClause':
+                if (node.param) {
+                    markUnpinnable(node.param);
+                }
+                break;
+        }
+    });
+    return { declarations, unpinnable };
+}
+/** `a.b.c` / `a['b'].c` → root `a`, parts `[b, c]`; `undefined` if any link is dynamic or the root is not an identifier. */
+function memberChain(node) {
+    if (node.type === 'ChainExpression') {
+        return memberChain(node.expression);
+    }
+    const parts = [];
+    let cur = node;
+    while (cur.type === 'MemberExpression') {
+        const key = propertyKey(cur.property, cur.computed);
+        if (key === undefined) {
+            return undefined;
+        }
+        parts.unshift(key);
+        cur = cur.object;
+    }
+    return cur.type === 'Identifier' ? { root: cur.name, parts } : undefined;
+}
+function createPathResolver(bindings, contextParam) {
+    function resolveChain(node, resolving) {
+        const chain = memberChain(node);
+        if (!chain) {
+            return undefined;
+        }
+        return [resolveRoot(chain.root, resolving), ...chain.parts].join('.');
+    }
+    function resolveRoot(name, resolving) {
+        if (contextParam !== undefined && name === contextParam) {
+            return 'ctx';
+        }
+        if (bindings.unpinnable.has(name) || resolving.has(name)) {
+            return name;
+        }
+        const decls = bindings.declarations.get(name);
+        if (!decls || decls.length !== 1) {
+            return name;
+        }
+        const [{ kind, init, path }] = decls;
+        if (kind !== 'const' || !init || !path) {
+            return name;
+        }
+        const base = resolveChain(init, new Set(resolving).add(name));
+        return base ? [base, ...path].join('.') : name;
+    }
+    return { pathOf: node => resolveChain(node, new Set()) };
+}
+/** Every `ctx.api.v1.<domain>` the program touches (known or not), through `paths`. */
+function collectApiDomains(program, paths) {
+    const apiDomains = new Set();
+    simple(program, {
+        MemberExpression(node) {
+            const [obj, api, version, domain] = paths.pathOf(node)?.split('.') ?? [];
+            if (obj === 'ctx' && api === 'api' && version === 'v1' && domain) {
+                apiDomains.add(domain);
+            }
+        },
+    });
+    return apiDomains;
+}
+
+export { collectApiDomains, collectBindings, createPathResolver, lineOf, patternNames };

package/dist/esm/backend/detect-integrations.d.ts

@@ -1,11 +1,15 @@
+import { type DeclaredIntegration } from '@mondaydotcomorg/z2h-shared-utils';
 /**
- * Integrations inferred from handler source at deploy time — whatever
+ * Integrations inferred from handler sources at deploy time — whatever
  * `ctx.api.v1.<name>` the handlers touch (from `DECLARED_INTEGRATIONS`) is
  * registered with the platform. There is no `integrations.json` and no declare
  * CLI step.
  *
- * Only OAuth-gated integrations belong in that set. `db`, `llm`, and `snowflake`
- * are always-on channels and are never declared.
+ * `apiDomains` comes from the handler parse in `validateHandlerSource`, so a
+ * domain mentioned only in a comment or string does not count as usage.
+ *
+ * Only OAuth-gated integrations belong in the result. `db`, `llm`, and
+ * `snowflake` are always-on channels and are never declared.
  */
-export declare function detectIntegrationsFromHandlers(handlers: Record<string, string>): string[];
+export declare function detectIntegrations(apiDomains: Iterable<string>): DeclaredIntegration[];
 //# sourceMappingURL=detect-integrations.d.ts.map

package/dist/esm/backend/detect-integrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"detect-integrations.d.ts","sourceRoot":"","sources":["../../../src/backend/detect-integrations.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,CAUzF"}
+{"version":3,"file":"detect-integrations.d.ts","sourceRoot":"","sources":["../../../src/backend/detect-integrations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,KAAK,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAKpG;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,mBAAmB,EAAE,CAEtF"}