@nexusclawhq/cli 0.2.1

package/CHANGELOG.md

@@ -0,0 +1,11 @@
+# Changelog
+
+## 0.2.1 - 2026-07-22
+
+- Publish the official package under the available organization scope `@nexusclawhq/cli`; the executable remains `nexus`.
+- Add one auditable, fail-closed `TargetContext` resolver for remote DX workflows.
+- Resolve `defaultEnvironment` descriptors automatically and keep `defaultOrg` alias-only.
+- Bind workspace UUID, org credential, and instance URL to the same target; reject mismatches before network I/O.
+- Add target flags and redacted target summaries to pull, diff, install, workspace pull/push, promote, rollback, and replay paths.
+- Ensure pull dry-run writes no source files or page baselines and preserve push conflict safeguards.
+- Ship build provenance metadata and clean-machine package safeguards.

package/README.md

@@ -0,0 +1,13 @@
+# @nexusclawhq/cli
+
+NexusClaw developer CLI for authenticated workspace source, package, and deployment workflows.
+
+```bash
+npm install --global @nexusclawhq/cli
+nexus --version
+nexus org login-web --instance-url https://your-nexusclaw.example --alias dev
+```
+
+Remote DX commands resolve one fail-closed target from `--workspace-id`, `--target-org`, the selected environment descriptor, and the authenticated org credential. `defaultOrg` is always an org alias and is never sent as a workspace ID.
+
+Node.js 18 or newer is required. Credentials are encrypted under `~/.nexusclaw` by default; set `NEXUS_CLI_HOME` to use an isolated credential directory in CI.

package/dist/build-info.json

@@ -0,0 +1,8 @@
+{
+  "packageName": "@nexusclawhq/cli",
+  "version": "0.2.1",
+  "gitSha": "fef75898b6fb7a76b839bb379665d911b70e250c",
+  "ciRunId": "29895567648",
+  "contentDigest": "sha256:f4a32d2c47d1a7afbdea808003a59413bca9989a3e7e0162c78357d6b42bbca8",
+  "generatedAt": "2026-07-22T06:09:28.643Z"
+}

package/dist/nexus-cli/node_modules/@nexusclaw/code-authoring/dist/analysis/capability-extractor.d.ts

@@ -0,0 +1,38 @@
+import type { AuthoringDiagnostic } from '../index';
+/** A capability call extracted from the source. */
+export interface ExtractedCapabilityCall {
+    readonly namespace: 'records' | 'connectors' | 'ai';
+    readonly method: string;
+    /** The key field that identifies the capability (objectApiName / bindingKey / policyKey). */
+    readonly keyField: string | null;
+}
+export interface CapabilityExtractionResult {
+    readonly calls: ReadonlyArray<ExtractedCapabilityCall>;
+    readonly diagnostics: ReadonlyArray<AuthoringDiagnostic>;
+}
+/** Declared capabilities from the export descriptor (for extracted-vs-declared comparison). */
+export interface DeclaredCapabilities {
+    readonly records?: ReadonlyArray<{
+        objectApiName: string;
+        operations: ReadonlyArray<string>;
+    }>;
+    readonly connectors?: ReadonlyArray<{
+        bindingKey: string;
+        operations: ReadonlyArray<string>;
+    }>;
+    readonly ai?: ReadonlyArray<{
+        policyKey: string;
+        outputSchemaRef: string;
+    }>;
+}
+/**
+ * Extract capability calls from an ACTION source + enforce direct-literal
+ * rules (design §7.3, tasks 3.9).
+ */
+export declare function extractCapabilities(source: string): CapabilityExtractionResult;
+/**
+ * Compare extracted capabilities against declared capabilities (task 3.10).
+ * Both undeclared (used but not declared) AND unused (declared but not called)
+ * are errors.
+ */
+export declare function compareCapabilities(extracted: CapabilityExtractionResult, declared: DeclaredCapabilities): AuthoringDiagnostic[];

package/dist/nexus-cli/node_modules/@nexusclaw/code-authoring/dist/analysis/capability-extractor.js

@@ -0,0 +1,323 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractCapabilities = extractCapabilities;
+exports.compareCapabilities = compareCapabilities;
+/**
+ * Capability extractor — §7.3 capability syntax + extracted-vs-declared
+ * comparison (tasks 3.9 / 3.10).
+ *
+ * Extracts every `ctx.records.<method>()`, `ctx.connectors.call(...)`, and
+ * `ctx.ai.generate(...)` call from an ACTION source, enforcing the frozen
+ * direct-literal rules:
+ *  - capability calls must be direct member access on `ctx` (no
+ *    aliasing / destructuring / bracket / computed names);
+ *  - every capability call argument must be an inline object literal (no spread
+ *    / identifier / factory / computed keys);
+ *  - `objectApiName` / field names / `bindingKey` / `operation` / `policyKey`
+ *    / `outputSchemaRef` must be string literals;
+ *  - capability Promises must be directly `await`ed (no Promise.all/race/any/
+ *    allSettled, no storing/passing host-call Promises);
+ *  - extracted vs declared capabilities compared exactly; undeclared AND unused
+ *    are both errors.
+ */
+const ts = __importStar(require("typescript"));
+function isCtxIdentifier(node) {
+    return ts.isIdentifier(node) && node.text === 'ctx';
+}
+/**
+ * Extract capability calls from an ACTION source + enforce direct-literal
+ * rules (design §7.3, tasks 3.9).
+ */
+function extractCapabilities(source) {
+    const sourceFile = ts.createSourceFile('action.ts', source, ts.ScriptTarget.ES2022, true);
+    const calls = [];
+    const diagnostics = [];
+    const report = (node, message, code = 'CODE_CAPABILITY_CALL_MUST_BE_INLINE') => {
+        const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+        diagnostics.push({
+            code,
+            severity: 'error',
+            file: 'action.ts',
+            line: line + 1,
+            column: character + 1,
+            message,
+        });
+    };
+    /**
+     * Check whether a node is `ctx.<namespace>.<method>(...)` — the ONLY valid
+     * capability call form.
+     */
+    function visit(node) {
+        if (ts.isAwaitExpression(node)) {
+            // The operand should be a capability call or a pure expression.
+            visit(node.expression);
+            return;
+        }
+        if (ts.isCallExpression(node)) {
+            const expr = node.expression;
+            // ctx.records.get(...) → CallExpression(PropertyAccessExpression(PropertyAccessExpression(ctx, records), get), args)
+            // expr = PropertyAccessExpression(inner=ctx.records, name=get)
+            if (ts.isPropertyAccessExpression(expr)) {
+                const method = expr.name.text;
+                const inner = expr.expression; // ctx.records (PropertyAccessExpression)
+                if (ts.isPropertyAccessExpression(inner) && isCtxIdentifier(inner.expression)) {
+                    const namespace = inner.name.text;
+                    if (namespace === 'records' || namespace === 'connectors' || namespace === 'ai') {
+                        // Valid capability namespace. Extract the key field + enforce literal args.
+                        const keyField = extractKeyField(node, namespace, method);
+                        calls.push({ namespace, method, keyField });
+                        // Enforce: arguments must be inline object literals (no spread/identifier).
+                        enforceLiteralArgs(node, report);
+                        enforceFrozenLiteralFields(node, namespace, report);
+                        // Enforce: the call must be directly awaited (parent is AwaitExpression).
+                        enforceDirectlyAwaited(node, report);
+                    }
+                }
+            }
+            else if (ts.isElementAccessExpression(expr)) {
+                const inner = expr.expression;
+                if (ts.isPropertyAccessExpression(inner) && isCtxIdentifier(inner.expression)) {
+                    const namespace = inner.name.text;
+                    if (namespace === 'records' || namespace === 'connectors' || namespace === 'ai') {
+                        report(expr, 'bracket/computed capability method access is forbidden');
+                    }
+                }
+            }
+        }
+        // Detect aliasing: `const r = ctx.records;` or `const { records } = ctx;`
+        detectAliasing(node, report);
+        ts.forEachChild(node, visit);
+    }
+    visit(sourceFile);
+    // Deduplicate calls by (namespace, method, keyField).
+    const seen = new Set();
+    const unique = calls.filter((c) => {
+        const k = `${c.namespace}.${c.method}.${c.keyField ?? ''}`;
+        if (seen.has(k))
+            return false;
+        seen.add(k);
+        return true;
+    });
+    return { calls: unique, diagnostics };
+}
+/** Extract the identifying key field from a capability call's arguments. */
+function extractKeyField(call, namespace, _method) {
+    const firstArg = call.arguments[0];
+    if (!firstArg || !ts.isObjectLiteralExpression(firstArg))
+        return null;
+    const keyPropName = namespace === 'records' ? 'objectApiName' :
+        namespace === 'connectors' ? 'bindingKey' :
+            'policyKey';
+    for (const prop of firstArg.properties) {
+        if (ts.isPropertyAssignment(prop) && prop.name.getText() === keyPropName && ts.isStringLiteral(prop.initializer)) {
+            return prop.initializer.text;
+        }
+    }
+    return null;
+}
+/** Enforce that capability call arguments are inline object literals (§7.3). */
+function enforceLiteralArgs(call, report) {
+    for (const arg of call.arguments) {
+        if (!ts.isObjectLiteralExpression(arg)) {
+            report(arg, 'capability call argument must be an inline object literal');
+            continue;
+        }
+        for (const prop of arg.properties) {
+            if (ts.isSpreadAssignment(prop)) {
+                report(prop, 'spread in capability call argument is forbidden');
+            }
+            if (!ts.isPropertyAssignment(prop) || ts.isComputedPropertyName(prop.name)) {
+                report(prop, 'computed property name in capability call argument is forbidden');
+            }
+        }
+    }
+}
+function findProperty(object, name) {
+    return object.properties.find((prop) => ts.isPropertyAssignment(prop)
+        && !ts.isComputedPropertyName(prop.name)
+        && (ts.isIdentifier(prop.name) || ts.isStringLiteral(prop.name))
+        && prop.name.text === name);
+}
+/** Enforce the descriptor-relevant literal fields frozen by design §7.3. */
+function enforceFrozenLiteralFields(call, namespace, report) {
+    const arg = call.arguments[0];
+    if (!arg || !ts.isObjectLiteralExpression(arg))
+        return;
+    const requiredStrings = namespace === 'records'
+        ? ['objectApiName']
+        : namespace === 'connectors'
+            ? ['bindingKey', 'operation']
+            : ['policyKey', 'outputSchemaRef'];
+    for (const name of requiredStrings) {
+        const prop = findProperty(arg, name);
+        if (!prop || !ts.isStringLiteral(prop.initializer)) {
+            report(prop?.initializer ?? arg, `${name} must be an inline string literal`);
+        }
+    }
+    if (namespace !== 'records')
+        return;
+    const select = findProperty(arg, 'select');
+    if (select && (!ts.isArrayLiteralExpression(select.initializer)
+        || select.initializer.elements.some((entry) => !ts.isStringLiteral(entry)))) {
+        report(select.initializer, 'record select fields must be an inline string-literal array');
+    }
+    const orderBy = findProperty(arg, 'orderBy');
+    if (orderBy && ts.isArrayLiteralExpression(orderBy.initializer)) {
+        for (const entry of orderBy.initializer.elements) {
+            if (!ts.isObjectLiteralExpression(entry)) {
+                report(entry, 'record orderBy entries must be inline object literals');
+                continue;
+            }
+            const field = findProperty(entry, 'field');
+            if (!field || !ts.isStringLiteral(field.initializer)) {
+                report(field?.initializer ?? entry, 'record orderBy field must be an inline string literal');
+            }
+        }
+    }
+    const where = findProperty(arg, 'where');
+    if (where)
+        enforceInlineFilter(where.initializer, report);
+}
+function enforceInlineFilter(node, report) {
+    if (!ts.isObjectLiteralExpression(node)) {
+        report(node, 'record where filter must be an inline object literal');
+        return;
+    }
+    const op = findProperty(node, 'op');
+    if (!op || !ts.isStringLiteral(op.initializer)) {
+        report(op?.initializer ?? node, 'record filter op must be an inline string literal');
+        return;
+    }
+    if (op.initializer.text === 'and' || op.initializer.text === 'or') {
+        const filters = findProperty(node, 'filters');
+        if (!filters || !ts.isArrayLiteralExpression(filters.initializer)) {
+            report(filters?.initializer ?? node, 'record filters must be an inline array');
+            return;
+        }
+        for (const filter of filters.initializer.elements)
+            enforceInlineFilter(filter, report);
+        return;
+    }
+    const field = findProperty(node, 'field');
+    if (!field || !ts.isStringLiteral(field.initializer)) {
+        report(field?.initializer ?? node, 'record filter field must be an inline string literal');
+    }
+}
+/** Enforce that a capability call is directly awaited (§7.3). */
+function enforceDirectlyAwaited(call, report) {
+    const parent = call.parent;
+    if (!parent || !ts.isAwaitExpression(parent)) {
+        let current = parent;
+        while (current && !ts.isFunctionLike(current)) {
+            if (ts.isCallExpression(current)
+                && ts.isPropertyAccessExpression(current.expression)
+                && current.expression.expression.getText() === 'Promise'
+                && ['all', 'race', 'any', 'allSettled'].includes(current.expression.name.text)) {
+                report(call, 'concurrent host capability calls are forbidden', 'CODE_CONCURRENT_HOST_CALL_FORBIDDEN');
+                return;
+            }
+            current = current.parent;
+        }
+        report(call, 'capability call must be directly awaited (Promise must not be stored, passed or returned)');
+    }
+}
+/** Detect capability aliasing (§7.3): `const r = ctx.records` or destructuring. */
+function detectAliasing(node, report) {
+    if (ts.isVariableDeclaration(node) && node.initializer) {
+        if (ts.isPropertyAccessExpression(node.initializer) && isCtxIdentifier(node.initializer.expression)) {
+            const ns = node.initializer.name.text;
+            if (ns === 'records' || ns === 'connectors' || ns === 'ai') {
+                report(node, `aliasing ctx.${ns} is forbidden (use ctx.${ns} directly)`);
+            }
+        }
+    }
+    if (ts.isVariableDeclaration(node) && node.initializer && isCtxIdentifier(node.initializer) && ts.isObjectBindingPattern(node.name)) {
+        for (const elem of node.name.elements) {
+            if (ts.isBindingElement(elem) && (elem.name.getText() === 'records' || elem.name.getText() === 'connectors' || elem.name.getText() === 'ai')) {
+                report(node, `destructuring ctx.{${elem.name.getText()}} is forbidden (use ctx.${elem.name.getText()} directly)`);
+            }
+        }
+    }
+}
+/**
+ * Compare extracted capabilities against declared capabilities (task 3.10).
+ * Both undeclared (used but not declared) AND unused (declared but not called)
+ * are errors.
+ */
+function compareCapabilities(extracted, declared) {
+    const diagnostics = [];
+    // --- Records: undeclared objectApiName + unused declared ---
+    const usedRecordObjects = new Set(extracted.calls.filter((c) => c.namespace === 'records').map((c) => c.keyField).filter(Boolean));
+    const declaredRecordObjects = new Set((declared.records ?? []).map((r) => r.objectApiName));
+    for (const used of usedRecordObjects) {
+        if (!declaredRecordObjects.has(used)) {
+            diagnostics.push({ code: 'CODE_CAPABILITY_UNDECLARED', severity: 'error', message: `records access to undeclared objectApiName '${used}'` });
+        }
+    }
+    for (const declared_ of declaredRecordObjects) {
+        if (!usedRecordObjects.has(declared_)) {
+            diagnostics.push({ code: 'CODE_CAPABILITY_NOT_ALLOWED', severity: 'warning', message: `declared records objectApiName '${declared_}' is never used` });
+        }
+    }
+    // --- Connectors: undeclared bindingKey + unused declared ---
+    const usedBindingKeys = new Set(extracted.calls.filter((c) => c.namespace === 'connectors').map((c) => c.keyField).filter(Boolean));
+    const declaredBindingKeys = new Set((declared.connectors ?? []).map((c) => c.bindingKey));
+    for (const used of usedBindingKeys) {
+        if (!declaredBindingKeys.has(used)) {
+            diagnostics.push({ code: 'CODE_CAPABILITY_UNDECLARED', severity: 'error', message: `connector call to undeclared bindingKey '${used}'` });
+        }
+    }
+    for (const declared_ of declaredBindingKeys) {
+        if (!usedBindingKeys.has(declared_)) {
+            diagnostics.push({ code: 'CODE_CAPABILITY_NOT_ALLOWED', severity: 'warning', message: `declared connector bindingKey '${declared_}' is never used` });
+        }
+    }
+    // --- AI: undeclared policyKey + unused declared ---
+    const usedPolicyKeys = new Set(extracted.calls.filter((c) => c.namespace === 'ai').map((c) => c.keyField).filter(Boolean));
+    const declaredPolicyKeys = new Set((declared.ai ?? []).map((a) => a.policyKey));
+    for (const used of usedPolicyKeys) {
+        if (!declaredPolicyKeys.has(used)) {
+            diagnostics.push({ code: 'CODE_CAPABILITY_UNDECLARED', severity: 'error', message: `AI call to undeclared policyKey '${used}'` });
+        }
+    }
+    for (const declared_ of declaredPolicyKeys) {
+        if (!usedPolicyKeys.has(declared_)) {
+            diagnostics.push({ code: 'CODE_CAPABILITY_NOT_ALLOWED', severity: 'warning', message: `declared AI policyKey '${declared_}' is never used` });
+        }
+    }
+    return diagnostics;
+}
+//# sourceMappingURL=capability-extractor.js.map

package/dist/nexus-cli/node_modules/@nexusclaw/code-authoring/dist/analysis/capability-extractor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-extractor.js","sourceRoot":"","sources":["../../src/analysis/capability-extractor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiDA,kDAiFC;AA4KD,kDAiDC;AA/VD;;;;;;;;;;;;;;;;;GAiBG;AACH,+CAAiC;AAuBjC,SAAS,eAAe,CAAC,IAAa;IACpC,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,MAAc;IAChD,MAAM,UAAU,GAAG,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC1F,MAAM,KAAK,GAA8B,EAAE,CAAC;IAC5C,MAAM,WAAW,GAA0B,EAAE,CAAC;IAE9C,MAAM,MAAM,GAAG,CACb,IAAa,EACb,OAAe,EACf,IAAI,GAAG,qCAAqC,EACtC,EAAE;QACR,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACtF,WAAW,CAAC,IAAI,CAAC;YACf,IAAI;YACJ,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,IAAI,GAAG,CAAC;YACd,MAAM,EAAE,SAAS,GAAG,CAAC;YACrB,OAAO;SACR,CAAC,CAAC;IACL,CAAC,CAAC;IAEF;;;OAGG;IACH,SAAS,KAAK,CAAC,IAAa;QAC1B,IAAI,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,gEAAgE;YAChE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC;YAC7B,qHAAqH;YACrH,+DAA+D;YAC/D,IAAI,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,yCAAyC;gBACxE,IAAI,EAAE,CAAC,0BAA0B,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC9E,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;oBAClC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,YAAY,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;wBAChF,4EAA4E;wBAC5E,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;wBAC1D,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;wBAC5C,4EAA4E;wBAC5E,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;wBACjC,0BAA0B,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;wBACpD,0EAA0E;wBAC1E,sBAAsB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;oBACvC,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC;gBAC9B,IAAI,EAAE,CAAC,0BAA0B,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC9E,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;oBAClC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,YAAY,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;wBAChF,MAAM,CAAC,IAAI,EAAE,wDAAwD,CAAC,CAAC;oBACzE,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAE7B,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,CAAC;IAElB,sDAAsD;IACtD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAChC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC3D,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACxC,CAAC;AAED,4EAA4E;AAC5E,SAAS,eAAe,CACtB,IAAuB,EACvB,SAAiB,EACjB,OAAe;IAEf,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,yBAAyB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,MAAM,WAAW,GACf,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;QAC3C,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;YAC3C,WAAW,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QACvC,IAAI,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,WAAW,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACjH,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAChF,SAAS,kBAAkB,CACzB,IAAuB,EACvB,MAA+D;IAE/D,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,EAAE,CAAC,yBAAyB,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM,CAAC,GAAG,EAAE,2DAA2D,CAAC,CAAC;YACzE,SAAS;QACX,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YAClC,IAAI,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,MAAM,CAAC,IAAI,EAAE,iDAAiD,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,CAAC,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3E,MAAM,CAAC,IAAI,EAAE,iEAAiE,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAkC,EAAE,IAAY;IACpE,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAiC,EAAE,CACpE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC;WAC1B,CAAC,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC;WACrC,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;WAC7D,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAC3B,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,SAAS,0BAA0B,CACjC,IAAuB,EACvB,SAA0C,EAC1C,MAA+D;IAE/D,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,yBAAyB,CAAC,GAAG,CAAC;QAAE,OAAO;IACvD,MAAM,eAAe,GAAG,SAAS,KAAK,SAAS;QAC7C,CAAC,CAAC,CAAC,eAAe,CAAC;QACnB,CAAC,CAAC,SAAS,KAAK,YAAY;YAC1B,CAAC,CAAC,CAAC,YAAY,EAAE,WAAW,CAAC;YAC7B,CAAC,CAAC,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,EAAE,WAAW,IAAI,GAAG,EAAE,GAAG,IAAI,mCAAmC,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO;IAEpC,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC3C,IAAI,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,WAAW,CAAC;WAC1D,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,6DAA6D,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC7C,IAAI,OAAO,IAAI,EAAE,CAAC,wBAAwB,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAChE,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;YACjD,IAAI,CAAC,EAAE,CAAC,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzC,MAAM,CAAC,KAAK,EAAE,uDAAuD,CAAC,CAAC;gBACvE,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC3C,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;gBACrD,MAAM,CAAC,KAAK,EAAE,WAAW,IAAI,KAAK,EAAE,uDAAuD,CAAC,CAAC;YAC/F,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,KAAK;QAAE,mBAAmB,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,mBAAmB,CAC1B,IAAmB,EACnB,MAA+D;IAE/D,IAAI,CAAC,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,EAAE,sDAAsD,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IACD,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/C,MAAM,CAAC,EAAE,EAAE,WAAW,IAAI,IAAI,EAAE,mDAAmD,CAAC,CAAC;QACrF,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC,WAAW,CAAC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAClE,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC,wBAAwB,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAClE,MAAM,CAAC,OAAO,EAAE,WAAW,IAAI,IAAI,EAAE,wCAAwC,CAAC,CAAC;YAC/E,OAAO;QACT,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,WAAW,CAAC,QAAQ;YAAE,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACvF,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACrD,MAAM,CAAC,KAAK,EAAE,WAAW,IAAI,IAAI,EAAE,sDAAsD,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,SAAS,sBAAsB,CAC7B,IAAuB,EACvB,MAA+D;IAE/D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7C,IAAI,OAAO,GAAwB,MAAM,CAAC;QAC1C,OAAO,OAAO,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9C,IAAI,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC;mBAC3B,EAAE,CAAC,0BAA0B,CAAC,OAAO,CAAC,UAAU,CAAC;mBACjD,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,SAAS;mBACrD,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjF,MAAM,CAAC,IAAI,EAAE,gDAAgD,EAAE,qCAAqC,CAAC,CAAC;gBACtG,OAAO;YACT,CAAC;YACD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;QAC3B,CAAC;QACD,MAAM,CAAC,IAAI,EAAE,2FAA2F,CAAC,CAAC;IAC5G,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,cAAc,CACrB,IAAa,EACb,MAA+D;IAE/D,IAAI,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACvD,IAAI,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;YACpG,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YACtC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,YAAY,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAC3D,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,YAAY,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpI,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtC,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;gBAC7I,MAAM,CAAC,IAAI,EAAE,sBAAsB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,2BAA2B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YACpH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,mBAAmB,CACjC,SAAqC,EACrC,QAA8B;IAE9B,MAAM,WAAW,GAA0B,EAAE,CAAC;IAE9C,8DAA8D;IAC9D,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAA0B,CAAC,CAAC;IAC5J,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IAC5F,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,+CAA+C,IAAI,GAAG,EAAE,CAAC,CAAC;QAC/I,CAAC;IACH,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,qBAAqB,EAAE,CAAC;QAC9C,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,mCAAmC,SAAS,iBAAiB,EAAE,CAAC,CAAC;QACzJ,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAA0B,CAAC,CAAC;IAC7J,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IAC1F,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,4CAA4C,IAAI,GAAG,EAAE,CAAC,CAAC;QAC5I,CAAC;IACH,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,mBAAmB,EAAE,CAAC;QAC5C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACpC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,kCAAkC,SAAS,iBAAiB,EAAE,CAAC,CAAC;QACxJ,CAAC;IACH,CAAC;IAED,qDAAqD;IACrD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAA0B,CAAC,CAAC;IACpJ,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAChF,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,oCAAoC,IAAI,GAAG,EAAE,CAAC,CAAC;QACpI,CAAC;IACH,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,kBAAkB,EAAE,CAAC;QAC3C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,0BAA0B,SAAS,iBAAiB,EAAE,CAAC,CAAC;QAChJ,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/nexus-cli/node_modules/@nexusclaw/code-authoring/dist/analysis/code-static-analysis.d.ts

@@ -0,0 +1,6 @@
+import type { AuthoringDiagnostic } from '../index';
+/**
+ * Analyze an ACTION source for forbidden constructs (design §7.3).
+ * Returns diagnostics for every violation found.
+ */
+export declare function analyzeDeniedConstructs(source: string): AuthoringDiagnostic[];

package/dist/nexus-cli/node_modules/@nexusclaw/code-authoring/dist/analysis/code-static-analysis.js

@@ -0,0 +1,225 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyzeDeniedConstructs = analyzeDeniedConstructs;
+/**
+ * Static analyzer — §7.3 deny list (executable-asset task 3.9).
+ *
+ * Rejects every forbidden construct from an ACTION source via AST traversal.
+ * This is defense-in-depth that runs BEFORE the verified-isolate boundary; it
+ * never substitutes for real-cluster escape evidence (§7.3 line 888).
+ *
+ * The deny list (frozen by design §7.3):
+ *  - non-type import, dynamic import, `require`;
+ *  - `eval`, `Function` constructor, WebAssembly;
+ *  - process / global / module manipulation;
+ *  - `Date.now` / `new Date()` without host clock;
+ *  - `Math.random` / crypto randomness;
+ *  - fetch / XMLHttpRequest / WebSocket / net / http / https / dns / tls;
+ *  - fs / path / os / child_process / worker_threads / vm;
+ *  - prototype mutation, constructor-chain escape, `__proto__`;
+ *  - string/code generation intended for execution.
+ */
+const ts = __importStar(require("typescript"));
+/** Forbidden global identifiers (property access or free variable). */
+const FORBIDDEN_GLOBALS = new Set([
+    'process',
+    'global',
+    'globalThis',
+    'module',
+    'exports',
+    'require',
+    '__dirname',
+    '__filename',
+    'Buffer',
+    'fetch',
+    'XMLHttpRequest',
+    'WebSocket',
+    'setTimeout',
+    'setInterval',
+    'setImmediate',
+]);
+/** Forbidden property names accessed on any object. */
+const FORBIDDEN_PROPERTIES = new Set([
+    '__proto__',
+    'constructor',
+    'prototype',
+]);
+/** Forbidden module specifiers in import/require. */
+const FORBIDDEN_MODULES = new Set([
+    'fs',
+    'path',
+    'os',
+    'child_process',
+    'worker_threads',
+    'vm',
+    'net',
+    'http',
+    'https',
+    'dns',
+    'tls',
+    'crypto',
+    'url',
+    'querystring',
+    'stream',
+    'zlib',
+    'util',
+]);
+/** Forbidden global constructors (called as `new X(...)` or `X(...)`). */
+const FORBIDDEN_CALLEES = new Set([
+    'Function',
+    'AsyncFunction',
+    'GeneratorFunction',
+    'WebAssembly',
+    'eval',
+]);
+/** Convert a TS node to file/line/column. */
+function nodeLocation(sourceFile, node) {
+    const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+    return { line: line + 1, column: character + 1 };
+}
+/**
+ * Analyze an ACTION source for forbidden constructs (design §7.3).
+ * Returns diagnostics for every violation found.
+ */
+function analyzeDeniedConstructs(source) {
+    const sourceFile = ts.createSourceFile('action.ts', source, ts.ScriptTarget.ES2022, true);
+    const diagnostics = [];
+    function report(node, code, message) {
+        const loc = nodeLocation(sourceFile, node);
+        diagnostics.push({
+            code,
+            severity: 'error',
+            file: 'action.ts',
+            line: loc.line,
+            column: loc.column,
+            message,
+        });
+    }
+    function visit(node) {
+        // --- Import / require / dynamic import ---
+        if (ts.isImportDeclaration(node)) {
+            const isTypeOnly = node.importClause?.isTypeOnly ?? false;
+            if (!isTypeOnly) {
+                report(node, 'CODE_IMPORT_FORBIDDEN', 'non-type import is forbidden (only `import type` from the SDK is allowed)');
+            }
+            else {
+                // Even type-only imports: check the module specifier.
+                const moduleText = ts.isStringLiteral(node.moduleSpecifier) ? node.moduleSpecifier.text : '';
+                if (moduleText && isForbiddenModule(moduleText)) {
+                    report(node, 'CODE_IMPORT_FORBIDDEN', `import from forbidden module '${moduleText}'`);
+                }
+            }
+        }
+        if (ts.isCallExpression(node) && node.expression.getText() === 'require') {
+            report(node, 'CODE_IMPORT_FORBIDDEN', 'require() is forbidden');
+        }
+        if (ts.isCallExpression(node) && node.expression.kind === ts.SyntaxKind.ImportKeyword) {
+            report(node, 'CODE_IMPORT_FORBIDDEN', 'dynamic import() is forbidden');
+        }
+        // --- eval / Function constructor / WebAssembly ---
+        if (ts.isCallExpression(node) || ts.isNewExpression(node)) {
+            const calleeText = node.expression.getText();
+            if (FORBIDDEN_CALLEES.has(calleeText)) {
+                report(node, 'CODE_STATIC_ANALYSIS_FAILED', `'${calleeText}' constructor/eval is forbidden (code generation)`);
+            }
+        }
+        // --- Date.now / new Date() / Math.random ---
+        if (ts.isCallExpression(node)) {
+            const expr = node.expression;
+            if (ts.isPropertyAccessExpression(expr)) {
+                const fullText = `${expr.expression.getText()}.${expr.name.text}`;
+                if (fullText === 'Date.now') {
+                    report(node, 'CODE_STATIC_ANALYSIS_FAILED', 'Date.now() is forbidden (use ctx.clock.executionStartedAt)');
+                }
+                if (fullText === 'Math.random') {
+                    report(node, 'CODE_STATIC_ANALYSIS_FAILED', 'Math.random() is forbidden (no host randomness)');
+                }
+                if (fullText === 'crypto.getRandomValues' || fullText === 'crypto.randomBytes') {
+                    report(node, 'CODE_STATIC_ANALYSIS_FAILED', 'crypto randomness is forbidden');
+                }
+            }
+        }
+        if (ts.isNewExpression(node) && node.expression.getText() === 'Date') {
+            report(node, 'CODE_STATIC_ANALYSIS_FAILED', 'new Date() is forbidden (use ctx.clock.executionStartedAt)');
+        }
+        // --- Forbidden globals (free identifiers) ---
+        if (ts.isIdentifier(node) && FORBIDDEN_GLOBALS.has(node.text)) {
+            // Only flag when it's used as a free variable, not a property name.
+            const parent = node.parent;
+            if (parent && !ts.isPropertyAccessExpression(parent) && !ts.isPropertyAssignment(parent) && !ts.isPropertySignature(parent)) {
+                // Don't flag if it's a function/method parameter shadowing the global.
+                if (!isParameterName(node)) {
+                    report(node, 'CODE_STATIC_ANALYSIS_FAILED', `'${node.text}' global is forbidden`);
+                }
+            }
+        }
+        // --- __proto__ / constructor / prototype property access ---
+        if (ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node)) {
+            const propName = ts.isPropertyAccessExpression(node) ? node.name.text : (ts.isStringLiteral(node.argumentExpression) ? node.argumentExpression.text : '');
+            if (FORBIDDEN_PROPERTIES.has(propName)) {
+                report(node, 'CODE_STATIC_ANALYSIS_FAILED', `'${propName}' property access is forbidden (prototype escape)`);
+            }
+        }
+        // --- Promise.all / race / any / allSettled (capability combinators) ---
+        if (ts.isCallExpression(node) && ts.isPropertyAccessExpression(node.expression)) {
+            const method = node.expression.name.text;
+            if (['all', 'race', 'any', 'allSettled'].includes(method) && node.expression.expression.getText() === 'Promise') {
+                report(node, 'CODE_STATIC_ANALYSIS_FAILED', `Promise.${method} is forbidden (capability calls must be directly awaited)`);
+            }
+        }
+        ts.forEachChild(node, visit);
+    }
+    visit(sourceFile);
+    return diagnostics;
+}
+function isForbiddenModule(specifier) {
+    // Node built-in or node: prefix.
+    if (specifier.startsWith('node:'))
+        return true;
+    return FORBIDDEN_MODULES.has(specifier);
+}
+function isParameterName(node) {
+    let current = node.parent;
+    while (current) {
+        if ((ts.isParameter(current) || ts.isVariableDeclaration(current) || ts.isBindingElement(current)) &&
+            (current.name === node || (ts.isArrayBindingPattern(current.name) || ts.isObjectBindingPattern(current.name)))) {
+            return true;
+        }
+        current = current.parent;
+    }
+    return false;
+}
+//# sourceMappingURL=code-static-analysis.js.map