@relayflows/sdk 2.0.8 → 2.0.10

package/dist/budget.js

@@ -0,0 +1,52 @@
+export class BudgetSyntaxError extends Error {
+    constructor() { super('budget_syntax_invalid: expected $<amount>/run, $<amount>/day, or { tokens, dollars, wallclock }'); }
+}
+/** Normalize surface sugar; existing explicit envelopes remain supported. */
+export function parseBudget(value) {
+    if (typeof value === 'string') {
+        const match = /^\$(\d+(?:\.\d{1,6})?)\/(run|day)$/.exec(value);
+        if (!match)
+            throw new BudgetSyntaxError();
+        return { pricing: 'frozen', maxDollars: match[1], ...(match[2] === 'day' ? { window: 'day' } : {}) };
+    }
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        throw new BudgetSyntaxError();
+    const b = value;
+    const legacy = ['maxTokensIn', 'maxTokensOut', 'maxTokens', 'maxDollars', 'maxWallclockMs', 'window', 'pricing'];
+    if (Object.keys(b).some(k => legacy.includes(k))) {
+        if (Object.keys(b).some(k => !legacy.includes(k)))
+            throw new BudgetSyntaxError();
+        return b;
+    }
+    if (Object.keys(b).some(k => !['tokens', 'dollars', 'wallclock'].includes(k)))
+        throw new BudgetSyntaxError();
+    if (b.tokens !== undefined && (!Number.isSafeInteger(b.tokens) || b.tokens < 0))
+        throw new BudgetSyntaxError();
+    if (b.dollars !== undefined && (typeof b.dollars !== 'number' || !Number.isFinite(b.dollars) || b.dollars < 0 || !/^\d+(?:\.\d{1,6})?$/.test(String(b.dollars))))
+        throw new BudgetSyntaxError();
+    let ms;
+    if (b.wallclock !== undefined) {
+        const match = typeof b.wallclock === 'string' && /^(\d+)(ms|s|m|h|d)$/.exec(b.wallclock);
+        if (!match)
+            throw new BudgetSyntaxError();
+        ms = Number(match[1]) * ({ ms: 1, s: 1000, m: 60000, h: 3600000, d: 86400000 }[match[2]]);
+        if (!Number.isSafeInteger(ms))
+            throw new BudgetSyntaxError();
+    }
+    return { pricing: 'frozen', ...(b.tokens === undefined ? {} : { maxTokens: b.tokens }),
+        ...(b.dollars === undefined ? {} : { maxDollars: String(b.dollars) }),
+        ...(ms === undefined ? {} : { maxWallclockMs: ms }) };
+}
+/** Lower a normalized envelope to the existing kernel protocol. */
+export function toKernelBudget(budget) {
+    return {
+        ...(budget.pricing !== undefined ? { pricing: budget.pricing } : {}),
+        ...(budget.maxTokens !== undefined ? { max_tokens: budget.maxTokens } : {}),
+        ...(budget.maxWallclockMs !== undefined ? { max_wallclock_ms: budget.maxWallclockMs } : {}),
+        ...(budget.window !== undefined ? { window: budget.window } : {}),
+        ...(budget.maxTokensIn !== undefined ? { max_tokens_in: budget.maxTokensIn } : {}),
+        ...(budget.maxTokensOut !== undefined ? { max_tokens_out: budget.maxTokensOut } : {}),
+        ...(budget.maxDollars !== undefined ? { max_dollars: budget.maxDollars } : {}),
+    };
+}
+//# sourceMappingURL=budget.js.map

package/dist/budget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"budget.js","sourceRoot":"","sources":["../src/budget.ts"],"names":[],"mappings":"AAIA,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,gBAAgB,KAAK,CAAC,iGAAiG,CAAC,CAAC,CAAC,CAAC;CAC5H;AAED,6EAA6E;AAC7E,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,iBAAiB,EAAE,CAAC;QAC1C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACjH,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,iBAAiB,EAAE,CAAC;IACvG,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,MAAM,MAAM,GAAG,CAAC,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IACjH,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,iBAAiB,EAAE,CAAC;QACjF,OAAO,CAAe,CAAC;IACzB,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,iBAAiB,EAAE,CAAC;IAC7G,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAK,CAAC,CAAC,MAAiB,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,iBAAiB,EAAE,CAAC;IAC3H,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,iBAAiB,EAAE,CAAC;IAChM,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACzF,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,iBAAiB,EAAE,CAAC;QAC1C,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAC,EAAE,EAAC,CAAC,EAAC,CAAC,EAAC,IAAI,EAAC,CAAC,EAAC,KAAK,EAAC,CAAC,EAAC,OAAO,EAAC,CAAC,EAAC,QAAQ,EAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAE,CAAC,CAAC;QACjF,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,iBAAiB,EAAE,CAAC;IAC/D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAC,SAAS,EAAE,CAAC,CAAC,MAAgB,EAAC,CAAC;QAC5F,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAC,CAAC;QACnE,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAC,cAAc,EAAE,EAAE,EAAC,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,cAAc,CAAC,MAAkB;IAC/C,OAAO;QACL,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/E,CAAC;AACJ,CAAC"}

package/dist/bundle-transport.d.ts

@@ -0,0 +1,18 @@
+export type BundleFailureKind = 'bucket_unconfigured' | 'bucket_unreachable' | 'bundle_missing_locally' | 'bundle_signature_invalid' | 'bundle_unsupported' | 'deploy_partial';
+export declare class BundleFailure extends Error {
+    readonly kind: BundleFailureKind;
+    constructor(kind: BundleFailureKind, message: string);
+}
+export interface DigestReference {
+    name: string;
+    digest: string;
+}
+export declare function parseDigestReference(value: string): DigestReference | undefined;
+export declare function bucketDirectory(uri: string, ref: DigestReference): string;
+export declare function exists(path: string): Promise<boolean>;
+export declare function verifyDigest(directory: string, digest: string): Promise<void>;
+/** Publish only a complete, verified directory. Concurrent identical writers converge. */
+export declare function copyBundle(source: string, target: string, digest: string): Promise<boolean>;
+export declare function writableBucket(target: string): Promise<void>;
+export declare function fetchBundle(ref: DigestReference, bucket: string): Promise<string>;
+//# sourceMappingURL=bundle-transport.d.ts.map

package/dist/bundle-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-transport.d.ts","sourceRoot":"","sources":["../src/bundle-transport.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,iBAAiB,GAAG,qBAAqB,GAAG,oBAAoB,GACxE,wBAAwB,GAAG,0BAA0B,GAAG,oBAAoB,GAAG,gBAAgB,CAAC;AACpG,qBAAa,aAAc,SAAQ,KAAK;IAC1B,QAAQ,CAAC,IAAI,EAAE,iBAAiB;gBAAvB,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM;CAC9D;AACD,MAAM,WAAW,eAAe;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AACjE,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAI/E;AACD,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,GAAG,MAAM,CAUzE;AACD,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAG3D;AACD,wBAAsB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGnF;AACD,0FAA0F;AAC1F,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAejG;AACD,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOlE;AACD,wBAAsB,WAAW,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBvF"}

package/dist/bundle-transport.js

@@ -0,0 +1,111 @@
+import { constants } from 'node:fs';
+import { access, cp, lstat, mkdir, mkdtemp, rename, rm } from 'node:fs/promises';
+import { dirname, isAbsolute, join } from 'node:path';
+import { homedir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+import { verifyBundle } from './bundle.js';
+export class BundleFailure extends Error {
+    kind;
+    constructor(kind, message) {
+        super(message);
+        this.kind = kind;
+    }
+}
+export function parseDigestReference(value) {
+    // Match the safe single-component name grammar used by sealBundle.
+    const match = /^([A-Za-z0-9][A-Za-z0-9._-]*)@sha256:([0-9a-f]{64})$/.exec(value);
+    return match ? { name: match[1], digest: match[2] } : undefined;
+}
+export function bucketDirectory(uri, ref) {
+    try {
+        const url = new URL(uri);
+        if (url.protocol !== 'file:' || url.search || url.hash)
+            throw new Error('expected file:// URI');
+        const path = fileURLToPath(url);
+        if (!isAbsolute(path))
+            throw new Error('expected absolute bucket path');
+        return join(path, ref.name, 'sha256', ref.digest);
+    }
+    catch {
+        throw new BundleFailure('bucket_unreachable', 'This slice requires an absolute file:// bucket URI.');
+    }
+}
+export async function exists(path) {
+    try {
+        await lstat(path);
+        return true;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+}
+export async function verifyDigest(directory, digest) {
+    try {
+        await verifyBundle(directory, digest);
+    }
+    catch (error) {
+        throw new BundleFailure('bundle_signature_invalid', String(error));
+    }
+}
+/** Publish only a complete, verified directory. Concurrent identical writers converge. */
+export async function copyBundle(source, target, digest) {
+    if (await exists(target)) {
+        await verifyDigest(target, digest);
+        return false;
+    }
+    await mkdir(dirname(target), { recursive: true });
+    const staging = await mkdtemp(join(dirname(target), '.bundle-'));
+    try {
+        await cp(source, staging, { recursive: true, dereference: false, verbatimSymlinks: true });
+        await verifyDigest(staging, digest);
+        try {
+            await rename(staging, target);
+        }
+        catch (error) {
+            if (!['EEXIST', 'ENOTEMPTY'].includes(error.code ?? ''))
+                throw error;
+            await verifyDigest(target, digest);
+            return false;
+        }
+        return true;
+    }
+    finally {
+        await rm(staging, { recursive: true, force: true });
+    }
+}
+export async function writableBucket(target) {
+    try {
+        await mkdir(dirname(target), { recursive: true });
+        await access(dirname(target), constants.W_OK);
+        const probe = await mkdtemp(join(dirname(target), '.probe-'));
+        await rm(probe, { recursive: true });
+    }
+    catch (error) {
+        throw new BundleFailure('bucket_unreachable', String(error));
+    }
+}
+export async function fetchBundle(ref, bucket) {
+    const cacheRoot = process.env['XDG_CACHE_HOME'];
+    const cache = join(cacheRoot && isAbsolute(cacheRoot) ? cacheRoot : join(homedir(), '.cache'), 'flows', 'bundles', ref.digest);
+    // Verify every hit; a corrupt cache never executes or silently falls back.
+    if (await exists(cache)) {
+        await verifyDigest(cache, ref.digest);
+        return cache;
+    }
+    const source = bucketDirectory(bucket, ref);
+    try {
+        if (!await exists(source))
+            throw new BundleFailure('bucket_unreachable', `Bundle is absent at ${bucket}.`);
+        await verifyDigest(source, ref.digest);
+        await copyBundle(source, cache, ref.digest);
+        return cache;
+    }
+    catch (error) {
+        if (error instanceof BundleFailure)
+            throw error;
+        throw new BundleFailure('bucket_unreachable', String(error));
+    }
+}
+//# sourceMappingURL=bundle-transport.js.map

package/dist/bundle-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-transport.js","sourceRoot":"","sources":["../src/bundle-transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAI3C,MAAM,OAAO,aAAc,SAAQ,KAAK;IACjB;IAArB,YAAqB,IAAuB,EAAE,OAAe;QAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAA3D,SAAI,GAAJ,IAAI,CAAmB;IAAqC,CAAC;CACnF;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,mEAAmE;IACnE,MAAM,KAAK,GAAG,sDAAsD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjF,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACpE,CAAC;AACD,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,GAAoB;IAC/D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAChG,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,qDAAqD,CAAC,CAAC;IACvG,CAAC;AACH,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAY;IACvC,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACvC,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;AACtG,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAAiB,EAAE,MAAc;IAClE,IAAI,CAAC;QAAC,MAAM,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAC9C,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,IAAI,aAAa,CAAC,0BAA0B,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAAC,CAAC;AACvF,CAAC;AACD,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,MAAc,EAAE,MAAc;IAC7E,IAAI,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAAC,MAAM,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;IAC/E,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAAC,CAAC;QACtC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAE,KAA+B,CAAC,IAAI,IAAI,EAAE,CAAC;gBAAE,MAAM,KAAK,CAAC;YAChG,MAAM,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACnC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;AACpE,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc;IACjD,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;QAC9D,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAAC,CAAC;AACnF,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAoB,EAAE,MAAc;IACpE,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,EAC3F,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,2EAA2E;IAC3E,IAAI,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAAC,MAAM,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;IACjF,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,uBAAuB,MAAM,GAAG,CAAC,CAAC;QAC3G,MAAM,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,aAAa;YAAE,MAAM,KAAK,CAAC;QAChD,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC"}

package/dist/bundle-typescript.d.ts

@@ -0,0 +1,8 @@
+import type { BundleFile } from './bundle.js';
+export declare function buildTypescript(input: string): Promise<{
+    spec: import("./compile.js").CompiledFlowSpec;
+    authored: boolean;
+    compiler: string;
+    files: BundleFile[];
+}>;
+//# sourceMappingURL=bundle-typescript.d.ts.map

package/dist/bundle-typescript.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-typescript.d.ts","sourceRoot":"","sources":["../src/bundle-typescript.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAc9C,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM;;;;;GA6ClD"}

package/dist/bundle-typescript.js

@@ -0,0 +1,108 @@
+import { spawnSync } from 'node:child_process';
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { canonicalize } from './canonical.js';
+import { compileSpec } from './compile.js';
+/** Bun is an explicit build dependency, never an implicit install. */
+function bun(args, cwd) {
+    const result = spawnSync('bun', ['--no-env-file', ...args], {
+        cwd, encoding: 'utf8', timeout: 120_000, maxBuffer: 16 * 1024 * 1024,
+        env: { PATH: process.env['PATH'], NODE_ENV: 'production', TZ: 'UTC' },
+    });
+    if (result.error || result.status !== 0) {
+        throw new Error(`TypeScript build requires Bun: ${result.error?.message ?? result.stderr}`);
+    }
+    return result.stdout.trim();
+}
+export async function buildTypescript(input) {
+    const directory = dirname(input);
+    const lockPath = await findLock(directory);
+    const lock = JSON.parse(await readFile(lockPath, 'utf8'));
+    if (![2, 3].includes(lock.lockfileVersion) || !lock.packages) {
+        throw new Error('package-lock.json: expected npm lockfile version 2 or 3 with pinned packages');
+    }
+    await checkInstalledVersions(dirname(lockPath), lock.packages);
+    const compiler = `bun@${bun(['--version'], directory)}`;
+    const staging = await mkdtemp(join(tmpdir(), 'flows-ts-'));
+    try {
+        // Evaluate module declarations, never the authored body. Resolve the runtime
+        // beside the input, keeping flow()'s WeakMap identity in the same module.
+        const probe = `
+import { createRequire } from 'node:module';
+import { pathToFileURL } from 'node:url';
+const module = await import(${JSON.stringify(pathToFileURL(input).href)});
+let spec = module.default;
+let authored = false;
+if (!spec || !Array.isArray(spec.steps)) {
+  const require = createRequire(${JSON.stringify(pathToFileURL(input).href)});
+  const { getFlowDefinition } = await import(pathToFileURL(require.resolve('@relayflows/surface/runtime')).href);
+  const definition = getFlowDefinition(spec);
+  if (Object.keys(definition.header).length) throw new Error('unsupported authored flow header');
+  if (!module.spec) throw new Error('authored flow() requires an exported spec declaration for build-time preflight; the body is not executed during build');
+  spec = module.spec;
+  if (spec.name !== definition.name) throw new Error('exported spec name must match flow() name');
+  authored = true;
+}
+
+process.stdout.write(JSON.stringify({ spec, authored }));
+`;
+        const probePath = join(staging, 'inspect.ts');
+        await writeFile(probePath, probe);
+        const inspected = JSON.parse(bun([probePath], directory));
+        const spec = compileSpec(inspected.spec);
+        const executable = join(staging, 'flow');
+        bun(['build', '--compile', '--env=disable', '--no-compile-autoload-dotenv',
+            '--no-compile-autoload-bunfig', '--outfile', executable, input], directory);
+        const files = [
+            { path: 'flow', data: await readFile(executable) },
+            { path: 'lockfile.json', data: canonicalize(lock) },
+        ];
+        return { spec, authored: inspected.authored === true, compiler, files };
+    }
+    finally {
+        await rm(staging, { recursive: true, force: true });
+    }
+}
+/** Do not label a stale node_modules tree with a newer lockfile's pins. */
+async function checkInstalledVersions(root, packages) {
+    for (const [path, entry] of Object.entries(packages)) {
+        if (path === '')
+            continue;
+        if (path.startsWith('/') || path.includes('\\') || path.split('/').includes('..')
+            || (entry.resolved !== undefined && /^(?:file:|\/|[A-Za-z]:)/.test(entry.resolved))) {
+            throw new Error(`package-lock.json: ${path} must use portable, pinned dependency locations`);
+        }
+        if (entry.link)
+            continue; // Workspace source is captured by the compiler.
+        let installed;
+        try {
+            installed = JSON.parse(await readFile(join(root, path, 'package.json'), 'utf8'));
+        }
+        catch (error) {
+            if (error.code === 'ENOENT' && (entry.optional || entry.dev))
+                continue;
+            throw new Error(`package-lock.json: ${path} is missing; run npm ci before building`);
+        }
+        if (typeof entry.version !== 'string' || installed.version !== entry.version) {
+            throw new Error(`package-lock.json: ${path} does not match its pinned version; run npm ci before building`);
+        }
+    }
+}
+async function findLock(start) {
+    for (let directory = start;; directory = dirname(directory)) {
+        const candidate = join(directory, 'package-lock.json');
+        try {
+            await readFile(candidate);
+            return candidate;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        if (dirname(directory) === directory)
+            throw new Error('package-lock.json: no workspace lockfile found for TS flow');
+    }
+}
+//# sourceMappingURL=bundle-typescript.js.map

package/dist/bundle-typescript.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-typescript.js","sourceRoot":"","sources":["../src/bundle-typescript.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAG3C,sEAAsE;AACtE,SAAS,GAAG,CAAC,IAAc,EAAE,GAAW;IACtC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,eAAe,EAAE,GAAG,IAAI,CAAC,EAAE;QAC1D,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;QACpE,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE;KACtE,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa;IACjD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,sBAAsB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;IACxD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,6EAA6E;QAC7E,0EAA0E;QAC1E,MAAM,KAAK,GAAG;;;8BAGY,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;;;;kCAIrC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;;;;;;;;;;;CAW1E,CAAC;QACE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC9C,MAAM,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,GAAG,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,8BAA8B;YACxE,8BAA8B,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAiB;YAC1B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,UAAU,CAAC,EAAE;YAClD,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE;SACpD,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,KAAK,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC1E,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;AACpE,CAAC;AAED,2EAA2E;AAC3E,KAAK,UAAU,sBAAsB,CAAC,IAAY,EAAE,QAElD;IACA,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QAC1B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;eAC5E,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YACtF,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,iDAAiD,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,KAAK,CAAC,IAAI;YAAE,SAAS,CAAC,gDAAgD;QAC1E,IAAI,SAAS,CAAC;QACd,IAAI,CAAC;YAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAAC,CAAC;QACzF,OAAO,KAAK,EAAE,CAAC;YACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC;gBAAE,SAAS;YAClG,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,yCAAyC,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,SAAS,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;YAC7E,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,gEAAgE,CAAC,CAAC;QAC9G,CAAC;IACH,CAAC;AACH,CAAC;AACD,KAAK,UAAU,QAAQ,CAAC,KAAa;IACnC,KAAK,IAAI,SAAS,GAAG,KAAK,GAAI,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;QACvD,IAAI,CAAC;YAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;YAAC,OAAO,SAAS,CAAC;QAAC,CAAC;QACpD,OAAO,KAAK,EAAE,CAAC;YAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QAAC,CAAC;QACtF,IAAI,OAAO,CAAC,SAAS,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IACtH,CAAC;AACH,CAAC"}

package/dist/bundle.d.ts

@@ -0,0 +1,25 @@
+export interface BundleEntry {
+    path: string;
+    sha256: string;
+    bytes: number;
+}
+export interface BundleFile {
+    path: string;
+    data: Uint8Array | string;
+    executable?: boolean;
+}
+export interface BundleOptions {
+    name: string;
+    out: string;
+    repo: string;
+    files: BundleFile[];
+    env?: NodeJS.ProcessEnv;
+    warn(message: string): void;
+}
+export declare function sha256(data: Uint8Array | string): string;
+/** Manifest and identity are envelopes, excluded to avoid circular hashing. */
+export declare function sealBundle(options: BundleOptions): Promise<string>;
+/** Verify an untrusted directory without following symlinks or manifest traversal.
+ * Bucket/cache readers supply the requested digest; local builds bind it to the directory name. */
+export declare function verifyBundle(directory: string, expectedDigest?: string): Promise<string>;
+//# sourceMappingURL=bundle.d.ts.map

package/dist/bundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,WAAW;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AAC5E,MAAM,WAAW,UAAU;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE;AAC7F,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,wBAAgB,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,CAExD;AAQD,+EAA+E;AAC/E,wBAAsB,UAAU,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CA2CxE;AA4CD;mGACmG;AACnG,wBAAsB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAsD9F"}

package/dist/bundle.js

@@ -0,0 +1,199 @@
+import { createHash, createPrivateKey, createPublicKey, randomBytes, sign, verify } from 'node:crypto';
+import { lstat, mkdir, mkdtemp, readFile, readdir, rename, rm, writeFile } from 'node:fs/promises';
+import { basename, dirname, join, resolve } from 'node:path';
+import { canonicalize } from './canonical.js';
+export function sha256(data) {
+    return createHash('sha256').update(data).digest('hex');
+}
+function safePath(path) {
+    return path.length > 0 && !path.includes('\\') && !path.includes('\0')
+        && path.split('/').every(part => part !== '' && part !== '.' && part !== '..')
+        && !path.includes(':');
+}
+/** Manifest and identity are envelopes, excluded to avoid circular hashing. */
+export async function sealBundle(options) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(options.name)) {
+        throw new Error('spec.canonical.json: name must be a safe single directory component');
+    }
+    const files = options.files.map(file => ({ ...file, data: Buffer.from(file.data) }))
+        .sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+    const paths = new Set();
+    for (const file of files) {
+        if (!safePath(file.path) || ['manifest.json', 'identity.json'].includes(file.path) || paths.has(file.path)) {
+            throw new Error(`${file.path}: invalid or duplicate bundle path`);
+        }
+        paths.add(file.path);
+    }
+    for (const required of ['spec.canonical.json', 'preflight.json', 'lockfile.json']) {
+        if (!paths.has(required))
+            throw new Error(`${required}: missing bundle file`);
+    }
+    const manifest = canonicalize(files.map(file => ({
+        path: file.path, sha256: sha256(file.data), bytes: file.data.length,
+    })));
+    const digest = sha256(manifest);
+    const out = resolve(options.out);
+    const target = join(out, `${options.name}@sha256:${digest}`);
+    let exists = false;
+    try {
+        await lstat(target);
+        exists = true;
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    if (exists) {
+        await verifyBundle(target);
+        return target;
+    }
+    const identity = await signDigest(digest, options);
+    await mkdir(out, { recursive: true });
+    const staging = await mkdtemp(join(out, '.build-'));
+    try {
+        for (const file of files) {
+            await mkdir(dirname(join(staging, file.path)), { recursive: true });
+            await writeFile(join(staging, file.path), file.data, { mode: file.path === 'flow' || file.executable ? 0o755 : 0o644 });
+        }
+        await writeFile(join(staging, 'manifest.json'), manifest);
+        await writeFile(join(staging, 'identity.json'), canonicalize(identity));
+        try {
+            await rename(staging, target);
+        }
+        catch (error) {
+            if (!['EEXIST', 'ENOTEMPTY'].includes(error.code ?? ''))
+                throw error;
+            await verifyBundle(target);
+        }
+        return target;
+    }
+    finally {
+        await rm(staging, { recursive: true, force: true });
+    }
+}
+async function signDigest(digest, options) {
+    let seedText = (options.env ?? process.env)['FLOWS_BUILD_KEY'];
+    if (seedText === undefined) {
+        try {
+            seedText = (await readFile(join(options.repo, '.flows/build.key'), 'utf8')).trim();
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+    }
+    let seed;
+    if (seedText === undefined) {
+        options.warn('identity_ephemeral: bundle can be verified but not attributed');
+        seed = randomBytes(32);
+    }
+    else {
+        seed = Buffer.from(seedText, 'base64');
+        if (seed.length !== 32 || seed.toString('base64') !== seedText) {
+            throw new Error('build key: expected a base64-encoded 32-byte seed');
+        }
+    }
+    const privateKey = createPrivateKey({
+        key: Buffer.concat([Buffer.from('302e020100300506032b657004220420', 'hex'), seed]),
+        format: 'der', type: 'pkcs8',
+    });
+    const publicKey = createPublicKey(privateKey).export({ format: 'der', type: 'spki' }).subarray(-32);
+    return {
+        algorithm: 'ed25519', keyid: sha256(publicKey).slice(0, 16), pubkey_b64: publicKey.toString('base64'),
+        signature_hex: sign(null, Buffer.from(digest, 'hex'), privateKey).toString('hex'),
+    };
+}
+async function regularFile(root, path) {
+    try {
+        const parts = path.split('/');
+        for (let i = 1; i <= parts.length; i++) {
+            const stat = await lstat(join(root, ...parts.slice(0, i)));
+            if (i === parts.length ? !stat.isFile() : !stat.isDirectory()) {
+                throw new Error('expected a regular file, without symlinks');
+            }
+        }
+        return await readFile(join(root, path));
+    }
+    catch (error) {
+        throw new Error(`${path}: ${error instanceof Error ? error.message : 'unreadable'}`);
+    }
+}
+/** Verify an untrusted directory without following symlinks or manifest traversal.
+ * Bucket/cache readers supply the requested digest; local builds bind it to the directory name. */
+export async function verifyBundle(directory, expectedDigest) {
+    const root = resolve(directory);
+    if (!(await lstat(root)).isDirectory())
+        throw new Error('manifest.json: bundle must be a directory, not a symlink');
+    const raw = (await regularFile(root, 'manifest.json')).toString('utf8');
+    let manifest;
+    try {
+        const parsed = JSON.parse(raw);
+        if (!Array.isArray(parsed))
+            throw new Error('expected an array');
+        manifest = parsed;
+    }
+    catch {
+        throw new Error('manifest.json: invalid manifest');
+    }
+    const paths = new Set();
+    let previous = '';
+    for (const entry of manifest) {
+        if (entry === null || typeof entry !== 'object' || typeof entry.path !== 'string'
+            || !safePath(entry.path) || entry.path <= previous
+            || ['manifest.json', 'identity.json'].includes(entry.path)
+            || Object.keys(entry).sort().join(',') !== 'bytes,path,sha256'
+            || !/^[a-f0-9]{64}$/.test(entry.sha256) || !Number.isSafeInteger(entry.bytes) || entry.bytes < 0) {
+            throw new Error('manifest.json: invalid, duplicate, or unsorted entry');
+        }
+        previous = entry.path;
+        paths.add(entry.path);
+        const bytes = await regularFile(root, entry.path);
+        if (bytes.length !== entry.bytes || sha256(bytes) !== entry.sha256) {
+            throw new Error(`${entry.path}: sha256 or byte count mismatch`);
+        }
+    }
+    for (const required of ['spec.canonical.json', 'preflight.json', 'lockfile.json']) {
+        if (!paths.has(required))
+            throw new Error(`${required}: missing manifest entry`);
+    }
+    const canonical = canonicalize(manifest);
+    if (raw !== canonical)
+        throw new Error('manifest.json: noncanonical bytes');
+    const digest = sha256(canonical);
+    const matchesDigest = expectedDigest === undefined
+        ? basename(root).endsWith(`@sha256:${digest}`) : digest === expectedDigest;
+    if (!matchesDigest)
+        throw new Error('manifest.json: directory digest mismatch');
+    await rejectExtras(root, '', new Set([...paths, 'manifest.json', 'identity.json']));
+    try {
+        const identity = JSON.parse((await regularFile(root, 'identity.json')).toString('utf8'));
+        const publicKey = Buffer.from(identity.pubkey_b64, 'base64');
+        if (identity.algorithm !== 'ed25519' || publicKey.length !== 32
+            || publicKey.toString('base64') !== identity.pubkey_b64
+            || identity.keyid !== sha256(publicKey).slice(0, 16)
+            || !/^[a-f0-9]{128}$/.test(identity.signature_hex))
+            throw new Error('invalid identity');
+        const key = createPublicKey({
+            key: Buffer.concat([Buffer.from('302a300506032b6570032100', 'hex'), publicKey]), format: 'der', type: 'spki',
+        });
+        if (!verify(null, Buffer.from(digest, 'hex'), key, Buffer.from(identity.signature_hex, 'hex'))) {
+            throw new Error('signature mismatch');
+        }
+    }
+    catch (error) {
+        throw new Error(`identity.json: ${error instanceof Error ? error.message : 'signature verification failed'}`);
+    }
+    return digest;
+}
+async function rejectExtras(root, prefix, paths) {
+    for (const entry of await readdir(join(root, prefix), { withFileTypes: true })) {
+        const path = prefix + entry.name;
+        if (entry.isDirectory() && [...paths].some(file => file.startsWith(`${path}/`))) {
+            await rejectExtras(root, `${path}/`, paths);
+        }
+        else if (!entry.isFile() || !paths.has(path)) {
+            throw new Error(`${path}: unlisted file or unsupported file type`);
+        }
+    }
+}
+//# sourceMappingURL=bundle.js.map

package/dist/bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACvG,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACnG,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAa9C,MAAM,UAAU,MAAM,CAAC,IAAyB;IAC9C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;WACjE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;WAC3E,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAsB;IACrD,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;SACjF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3G,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,oCAAoC,CAAC,CAAC;QACpE,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,CAAC,qBAAqB,EAAE,gBAAgB,EAAE,eAAe,CAAC,EAAE,CAAC;QAClF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,uBAAuB,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/C,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;KACpE,CAAC,CAAC,CAAC,CAAC;IACL,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,WAAW,MAAM,EAAE,CAAC,CAAC;IAC7D,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC;IAAC,CAAC;IAC3C,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;IAAC,CAAC;IACtF,IAAI,MAAM,EAAE,CAAC;QAAC,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;QAAC,OAAO,MAAM,CAAC;IAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1H,CAAC;QACD,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC1D,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAAC,CAAC;QACtC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAE,KAA+B,CAAC,IAAI,IAAI,EAAE,CAAC;gBAAE,MAAM,KAAK,CAAC;YAChG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;AACpE,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,OAAsB;IAC9D,IAAI,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC/D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC;YAAC,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAAC,CAAC;QAC3F,OAAO,KAAK,EAAE,CAAC;YAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QAAC,CAAC;IACxF,CAAC;IACD,IAAI,IAAY,CAAC;IACjB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;QAC9E,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IACzB,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,gBAAgB,CAAC;QAClC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;QAClF,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO;KAC7B,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;IACpG,OAAO;QACL,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACrG,aAAa,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;KAClF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,IAAY;IACnD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3D,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC9D,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QACD,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED;mGACmG;AACnG,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAAiB,EAAE,cAAuB;IAC3E,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IACpH,MAAM,GAAG,GAAG,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxE,IAAI,QAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACjE,QAAQ,GAAG,MAAM,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;eAC5E,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,QAAQ;eAC/C,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;eACvD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,mBAAmB;eAC3D,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YACnG,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC;QACtB,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,iCAAiC,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,CAAC,qBAAqB,EAAE,gBAAgB,EAAE,eAAe,CAAC,EAAE,CAAC;QAClF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,0BAA0B,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,GAAG,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,aAAa,GAAG,cAAc,KAAK,SAAS;QAChD,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc,CAAC;IAC7E,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAChF,MAAM,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;IACpF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACzF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC7D,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE;eAC1D,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,UAAU;eACpD,QAAQ,CAAC,KAAK,KAAK,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;eACjD,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC1F,MAAM,GAAG,GAAG,eAAe,CAAC;YAC1B,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM;SAC7G,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YAC/F,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,+BAA+B,EAAE,CAAC,CAAC;IAChH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,MAAc,EAAE,KAAkB;IAC1E,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,GAAG,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC;QACjC,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;YAChF,MAAM,YAAY,CAAC,IAAI,EAAE,GAAG,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9C,CAAC;aAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,0CAA0C,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/child-stop.d.ts

@@ -0,0 +1,59 @@
+import type { ChildProcess } from 'node:child_process';
+/**
+ * Grace between the graceful signal and the force kill. A tree that ignores
+ * `SIGTERM` still has to go: it is holding the inherited stdio pipes that keep
+ * the `flows run` event loop alive long after the step itself has settled.
+ */
+export declare const FORCE_KILL_DELAY_MS = 1000;
+/**
+ * The one stop path for a spawned agent process.
+ *
+ * There are three stops — lease abort, execution timeout, and protocol
+ * `terminate` — and the decision they share is whether a signal must address
+ * the process GROUP or the direct child. That decision used to be made at each
+ * call site, which meant it was made once and omitted twice: only abort killed
+ * the group, so a timeout or a protocol violation left the grandchildren alive
+ * holding the pipes they inherited. The step Promise settled; `flows run` never
+ * exited, because those pipe handles stay open and referenced.
+ *
+ * So the decision lives here instead, bound once at the spawn site. A call site
+ * chooses only the FORCE of the stop, never its REACH — and, per
+ * {@link ChildStop.maySettleOnChildExit}, never gets to decide on its own that
+ * a stop is finished.
+ */
+export interface ChildStop {
+    /** Stop the tree now, unconditionally. */
+    kill(): void;
+    /** Ask the tree to stop, then force whatever is still alive. */
+    terminate(): void;
+    /**
+     * Answer the only question a child-level event can raise: the direct child is
+     * gone — may the session settle?
+     *
+     * INVARIANT: a session may not settle until either the process group is
+     * confirmed dead or the escalation has actually run.
+     *
+     * `'close'` and `'error'` are evidence about the CHILD, never about the
+     * group. A descendant that ignores `SIGTERM` and inherited none of the
+     * wrapper's stdio emits exactly those events while it is still running, so no
+     * call site may read one as a dead tree. This is therefore the only place a
+     * pending escalation may be dropped for any reason other than a forced kill,
+     * and it drops one only after asking the group whether it is empty.
+     *
+     * Returns true when settling is safe: no escalation is armed, or the group is
+     * confirmed gone and the now-pointless escalation has been dropped here.
+     * Returns false when an escalation is armed over a group that still answers —
+     * the caller must then leave the settle to that escalation's own deadline.
+     */
+    maySettleOnChildExit(): boolean;
+}
+/**
+ * Whether a stop can reach descendants at all. It can only when the spawn asked
+ * for a process group of its own, which needs POSIX and is only worth the
+ * detach on the lease-bound path. Callers pass this same value to `spawn`'s
+ * `detached` and to {@link childStop}, so the spawn flag and the stop strategy
+ * cannot drift apart.
+ */
+export declare function ownsProcessGroup(signal: AbortSignal | undefined): boolean;
+export declare function childStop(child: ChildProcess, ownsGroup: boolean, forceKillDelayMs?: number): ChildStop;
+//# sourceMappingURL=child-stop.d.ts.map