@relayflows/sdk 2.0.9 → 2.0.10

package/dist/bundle.js

@@ -0,0 +1,199 @@
+import { createHash, createPrivateKey, createPublicKey, randomBytes, sign, verify } from 'node:crypto';
+import { lstat, mkdir, mkdtemp, readFile, readdir, rename, rm, writeFile } from 'node:fs/promises';
+import { basename, dirname, join, resolve } from 'node:path';
+import { canonicalize } from './canonical.js';
+export function sha256(data) {
+    return createHash('sha256').update(data).digest('hex');
+}
+function safePath(path) {
+    return path.length > 0 && !path.includes('\\') && !path.includes('\0')
+        && path.split('/').every(part => part !== '' && part !== '.' && part !== '..')
+        && !path.includes(':');
+}
+/** Manifest and identity are envelopes, excluded to avoid circular hashing. */
+export async function sealBundle(options) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(options.name)) {
+        throw new Error('spec.canonical.json: name must be a safe single directory component');
+    }
+    const files = options.files.map(file => ({ ...file, data: Buffer.from(file.data) }))
+        .sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+    const paths = new Set();
+    for (const file of files) {
+        if (!safePath(file.path) || ['manifest.json', 'identity.json'].includes(file.path) || paths.has(file.path)) {
+            throw new Error(`${file.path}: invalid or duplicate bundle path`);
+        }
+        paths.add(file.path);
+    }
+    for (const required of ['spec.canonical.json', 'preflight.json', 'lockfile.json']) {
+        if (!paths.has(required))
+            throw new Error(`${required}: missing bundle file`);
+    }
+    const manifest = canonicalize(files.map(file => ({
+        path: file.path, sha256: sha256(file.data), bytes: file.data.length,
+    })));
+    const digest = sha256(manifest);
+    const out = resolve(options.out);
+    const target = join(out, `${options.name}@sha256:${digest}`);
+    let exists = false;
+    try {
+        await lstat(target);
+        exists = true;
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    if (exists) {
+        await verifyBundle(target);
+        return target;
+    }
+    const identity = await signDigest(digest, options);
+    await mkdir(out, { recursive: true });
+    const staging = await mkdtemp(join(out, '.build-'));
+    try {
+        for (const file of files) {
+            await mkdir(dirname(join(staging, file.path)), { recursive: true });
+            await writeFile(join(staging, file.path), file.data, { mode: file.path === 'flow' || file.executable ? 0o755 : 0o644 });
+        }
+        await writeFile(join(staging, 'manifest.json'), manifest);
+        await writeFile(join(staging, 'identity.json'), canonicalize(identity));
+        try {
+            await rename(staging, target);
+        }
+        catch (error) {
+            if (!['EEXIST', 'ENOTEMPTY'].includes(error.code ?? ''))
+                throw error;
+            await verifyBundle(target);
+        }
+        return target;
+    }
+    finally {
+        await rm(staging, { recursive: true, force: true });
+    }
+}
+async function signDigest(digest, options) {
+    let seedText = (options.env ?? process.env)['FLOWS_BUILD_KEY'];
+    if (seedText === undefined) {
+        try {
+            seedText = (await readFile(join(options.repo, '.flows/build.key'), 'utf8')).trim();
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+    }
+    let seed;
+    if (seedText === undefined) {
+        options.warn('identity_ephemeral: bundle can be verified but not attributed');
+        seed = randomBytes(32);
+    }
+    else {
+        seed = Buffer.from(seedText, 'base64');
+        if (seed.length !== 32 || seed.toString('base64') !== seedText) {
+            throw new Error('build key: expected a base64-encoded 32-byte seed');
+        }
+    }
+    const privateKey = createPrivateKey({
+        key: Buffer.concat([Buffer.from('302e020100300506032b657004220420', 'hex'), seed]),
+        format: 'der', type: 'pkcs8',
+    });
+    const publicKey = createPublicKey(privateKey).export({ format: 'der', type: 'spki' }).subarray(-32);
+    return {
+        algorithm: 'ed25519', keyid: sha256(publicKey).slice(0, 16), pubkey_b64: publicKey.toString('base64'),
+        signature_hex: sign(null, Buffer.from(digest, 'hex'), privateKey).toString('hex'),
+    };
+}
+async function regularFile(root, path) {
+    try {
+        const parts = path.split('/');
+        for (let i = 1; i <= parts.length; i++) {
+            const stat = await lstat(join(root, ...parts.slice(0, i)));
+            if (i === parts.length ? !stat.isFile() : !stat.isDirectory()) {
+                throw new Error('expected a regular file, without symlinks');
+            }
+        }
+        return await readFile(join(root, path));
+    }
+    catch (error) {
+        throw new Error(`${path}: ${error instanceof Error ? error.message : 'unreadable'}`);
+    }
+}
+/** Verify an untrusted directory without following symlinks or manifest traversal.
+ * Bucket/cache readers supply the requested digest; local builds bind it to the directory name. */
+export async function verifyBundle(directory, expectedDigest) {
+    const root = resolve(directory);
+    if (!(await lstat(root)).isDirectory())
+        throw new Error('manifest.json: bundle must be a directory, not a symlink');
+    const raw = (await regularFile(root, 'manifest.json')).toString('utf8');
+    let manifest;
+    try {
+        const parsed = JSON.parse(raw);
+        if (!Array.isArray(parsed))
+            throw new Error('expected an array');
+        manifest = parsed;
+    }
+    catch {
+        throw new Error('manifest.json: invalid manifest');
+    }
+    const paths = new Set();
+    let previous = '';
+    for (const entry of manifest) {
+        if (entry === null || typeof entry !== 'object' || typeof entry.path !== 'string'
+            || !safePath(entry.path) || entry.path <= previous
+            || ['manifest.json', 'identity.json'].includes(entry.path)
+            || Object.keys(entry).sort().join(',') !== 'bytes,path,sha256'
+            || !/^[a-f0-9]{64}$/.test(entry.sha256) || !Number.isSafeInteger(entry.bytes) || entry.bytes < 0) {
+            throw new Error('manifest.json: invalid, duplicate, or unsorted entry');
+        }
+        previous = entry.path;
+        paths.add(entry.path);
+        const bytes = await regularFile(root, entry.path);
+        if (bytes.length !== entry.bytes || sha256(bytes) !== entry.sha256) {
+            throw new Error(`${entry.path}: sha256 or byte count mismatch`);
+        }
+    }
+    for (const required of ['spec.canonical.json', 'preflight.json', 'lockfile.json']) {
+        if (!paths.has(required))
+            throw new Error(`${required}: missing manifest entry`);
+    }
+    const canonical = canonicalize(manifest);
+    if (raw !== canonical)
+        throw new Error('manifest.json: noncanonical bytes');
+    const digest = sha256(canonical);
+    const matchesDigest = expectedDigest === undefined
+        ? basename(root).endsWith(`@sha256:${digest}`) : digest === expectedDigest;
+    if (!matchesDigest)
+        throw new Error('manifest.json: directory digest mismatch');
+    await rejectExtras(root, '', new Set([...paths, 'manifest.json', 'identity.json']));
+    try {
+        const identity = JSON.parse((await regularFile(root, 'identity.json')).toString('utf8'));
+        const publicKey = Buffer.from(identity.pubkey_b64, 'base64');
+        if (identity.algorithm !== 'ed25519' || publicKey.length !== 32
+            || publicKey.toString('base64') !== identity.pubkey_b64
+            || identity.keyid !== sha256(publicKey).slice(0, 16)
+            || !/^[a-f0-9]{128}$/.test(identity.signature_hex))
+            throw new Error('invalid identity');
+        const key = createPublicKey({
+            key: Buffer.concat([Buffer.from('302a300506032b6570032100', 'hex'), publicKey]), format: 'der', type: 'spki',
+        });
+        if (!verify(null, Buffer.from(digest, 'hex'), key, Buffer.from(identity.signature_hex, 'hex'))) {
+            throw new Error('signature mismatch');
+        }
+    }
+    catch (error) {
+        throw new Error(`identity.json: ${error instanceof Error ? error.message : 'signature verification failed'}`);
+    }
+    return digest;
+}
+async function rejectExtras(root, prefix, paths) {
+    for (const entry of await readdir(join(root, prefix), { withFileTypes: true })) {
+        const path = prefix + entry.name;
+        if (entry.isDirectory() && [...paths].some(file => file.startsWith(`${path}/`))) {
+            await rejectExtras(root, `${path}/`, paths);
+        }
+        else if (!entry.isFile() || !paths.has(path)) {
+            throw new Error(`${path}: unlisted file or unsupported file type`);
+        }
+    }
+}
+//# sourceMappingURL=bundle.js.map

package/dist/bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACvG,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACnG,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAa9C,MAAM,UAAU,MAAM,CAAC,IAAyB;IAC9C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;WACjE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;WAC3E,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAsB;IACrD,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;SACjF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3G,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,oCAAoC,CAAC,CAAC;QACpE,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,CAAC,qBAAqB,EAAE,gBAAgB,EAAE,eAAe,CAAC,EAAE,CAAC;QAClF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,uBAAuB,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/C,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;KACpE,CAAC,CAAC,CAAC,CAAC;IACL,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,WAAW,MAAM,EAAE,CAAC,CAAC;IAC7D,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC;IAAC,CAAC;IAC3C,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;IAAC,CAAC;IACtF,IAAI,MAAM,EAAE,CAAC;QAAC,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;QAAC,OAAO,MAAM,CAAC;IAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1H,CAAC;QACD,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC1D,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAAC,CAAC;QACtC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAE,KAA+B,CAAC,IAAI,IAAI,EAAE,CAAC;gBAAE,MAAM,KAAK,CAAC;YAChG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;AACpE,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,OAAsB;IAC9D,IAAI,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC/D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC;YAAC,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAAC,CAAC;QAC3F,OAAO,KAAK,EAAE,CAAC;YAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QAAC,CAAC;IACxF,CAAC;IACD,IAAI,IAAY,CAAC;IACjB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;QAC9E,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IACzB,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,gBAAgB,CAAC;QAClC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;QAClF,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO;KAC7B,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;IACpG,OAAO;QACL,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACrG,aAAa,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;KAClF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,IAAY;IACnD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3D,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC9D,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QACD,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED;mGACmG;AACnG,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAAiB,EAAE,cAAuB;IAC3E,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IACpH,MAAM,GAAG,GAAG,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxE,IAAI,QAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACjE,QAAQ,GAAG,MAAM,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;eAC5E,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,QAAQ;eAC/C,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;eACvD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,mBAAmB;eAC3D,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YACnG,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC;QACtB,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,iCAAiC,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,CAAC,qBAAqB,EAAE,gBAAgB,EAAE,eAAe,CAAC,EAAE,CAAC;QAClF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,0BAA0B,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,GAAG,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,aAAa,GAAG,cAAc,KAAK,SAAS;QAChD,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc,CAAC;IAC7E,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAChF,MAAM,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;IACpF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACzF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC7D,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE;eAC1D,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,UAAU;eACpD,QAAQ,CAAC,KAAK,KAAK,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;eACjD,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC1F,MAAM,GAAG,GAAG,eAAe,CAAC;YAC1B,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM;SAC7G,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YAC/F,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,+BAA+B,EAAE,CAAC,CAAC;IAChH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,MAAc,EAAE,KAAkB;IAC1E,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,GAAG,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC;QACjC,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;YAChF,MAAM,YAAY,CAAC,IAAI,EAAE,GAAG,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9C,CAAC;aAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,0CAA0C,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/child-stop.d.ts

@@ -0,0 +1,59 @@
+import type { ChildProcess } from 'node:child_process';
+/**
+ * Grace between the graceful signal and the force kill. A tree that ignores
+ * `SIGTERM` still has to go: it is holding the inherited stdio pipes that keep
+ * the `flows run` event loop alive long after the step itself has settled.
+ */
+export declare const FORCE_KILL_DELAY_MS = 1000;
+/**
+ * The one stop path for a spawned agent process.
+ *
+ * There are three stops — lease abort, execution timeout, and protocol
+ * `terminate` — and the decision they share is whether a signal must address
+ * the process GROUP or the direct child. That decision used to be made at each
+ * call site, which meant it was made once and omitted twice: only abort killed
+ * the group, so a timeout or a protocol violation left the grandchildren alive
+ * holding the pipes they inherited. The step Promise settled; `flows run` never
+ * exited, because those pipe handles stay open and referenced.
+ *
+ * So the decision lives here instead, bound once at the spawn site. A call site
+ * chooses only the FORCE of the stop, never its REACH — and, per
+ * {@link ChildStop.maySettleOnChildExit}, never gets to decide on its own that
+ * a stop is finished.
+ */
+export interface ChildStop {
+    /** Stop the tree now, unconditionally. */
+    kill(): void;
+    /** Ask the tree to stop, then force whatever is still alive. */
+    terminate(): void;
+    /**
+     * Answer the only question a child-level event can raise: the direct child is
+     * gone — may the session settle?
+     *
+     * INVARIANT: a session may not settle until either the process group is
+     * confirmed dead or the escalation has actually run.
+     *
+     * `'close'` and `'error'` are evidence about the CHILD, never about the
+     * group. A descendant that ignores `SIGTERM` and inherited none of the
+     * wrapper's stdio emits exactly those events while it is still running, so no
+     * call site may read one as a dead tree. This is therefore the only place a
+     * pending escalation may be dropped for any reason other than a forced kill,
+     * and it drops one only after asking the group whether it is empty.
+     *
+     * Returns true when settling is safe: no escalation is armed, or the group is
+     * confirmed gone and the now-pointless escalation has been dropped here.
+     * Returns false when an escalation is armed over a group that still answers —
+     * the caller must then leave the settle to that escalation's own deadline.
+     */
+    maySettleOnChildExit(): boolean;
+}
+/**
+ * Whether a stop can reach descendants at all. It can only when the spawn asked
+ * for a process group of its own, which needs POSIX and is only worth the
+ * detach on the lease-bound path. Callers pass this same value to `spawn`'s
+ * `detached` and to {@link childStop}, so the spawn flag and the stop strategy
+ * cannot drift apart.
+ */
+export declare function ownsProcessGroup(signal: AbortSignal | undefined): boolean;
+export declare function childStop(child: ChildProcess, ownsGroup: boolean, forceKillDelayMs?: number): ChildStop;
+//# sourceMappingURL=child-stop.d.ts.map

package/dist/child-stop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"child-stop.d.ts","sourceRoot":"","sources":["../src/child-stop.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,OAAQ,CAAC;AAEzC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,SAAS;IACxB,0CAA0C;IAC1C,IAAI,IAAI,IAAI,CAAC;IACb,gEAAgE;IAChE,SAAS,IAAI,IAAI,CAAC;IAClB;;;;;;;;;;;;;;;;;;OAkBG;IACH,oBAAoB,IAAI,OAAO,CAAC;CACjC;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,OAAO,CAEzE;AAED,wBAAgB,SAAS,CACvB,KAAK,EAAE,YAAY,EACnB,SAAS,EAAE,OAAO,EAClB,gBAAgB,GAAE,MAA4B,GAC7C,SAAS,CAsEX"}

package/dist/child-stop.js

@@ -0,0 +1,94 @@
+/**
+ * Grace between the graceful signal and the force kill. A tree that ignores
+ * `SIGTERM` still has to go: it is holding the inherited stdio pipes that keep
+ * the `flows run` event loop alive long after the step itself has settled.
+ */
+export const FORCE_KILL_DELAY_MS = 1_000;
+/**
+ * Whether a stop can reach descendants at all. It can only when the spawn asked
+ * for a process group of its own, which needs POSIX and is only worth the
+ * detach on the lease-bound path. Callers pass this same value to `spawn`'s
+ * `detached` and to {@link childStop}, so the spawn flag and the stop strategy
+ * cannot drift apart.
+ */
+export function ownsProcessGroup(signal) {
+    return signal !== undefined && process.platform !== 'win32';
+}
+export function childStop(child, ownsGroup, forceKillDelayMs = FORCE_KILL_DELAY_MS) {
+    // Pinned at the spawn rather than read per signal. Every interesting use of
+    // this id happens AFTER the direct child has been reaped — the escalation
+    // fires a second later, and the group probe runs on `'close'` — so reading
+    // `child.pid` there would be reading a field the runtime owns and is free to
+    // clear. The group keeps this id for as long as any member of it is alive,
+    // which is exactly the window both of those need to address.
+    const pid = child.pid;
+    let forceTimer;
+    const cancel = () => {
+        if (forceTimer !== undefined)
+            clearTimeout(forceTimer);
+        forceTimer = undefined;
+    };
+    /** Whether anything is still in the group. See `maySettleOnChildExit`. */
+    const groupAnswers = () => {
+        // With no group of our own a stop never reached past the direct child, so
+        // that child's exit IS the whole of our reach and there is nothing left to
+        // ask about.
+        if (!ownsGroup || pid === undefined)
+            return false;
+        try {
+            process.kill(-pid, 0);
+            return true;
+        }
+        catch (error) {
+            // Only `ESRCH` proves the group is empty. `EPERM` proves the opposite —
+            // something is in there that we may not signal — and any other errno
+            // proves nothing at all, so both must read as alive: an unproven group is
+            // not a reason to spare a survivor.
+            return error.code !== 'ESRCH';
+        }
+    };
+    const signalTree = (name) => {
+        if (ownsGroup && pid !== undefined) {
+            // `-pid` addresses the group this detached child leads, which is every
+            // descendant that has not left it. It throws only once the whole group
+            // is gone — the outcome we were asking for — so fall through and let the
+            // direct-child signal report on a child that never became a leader.
+            try {
+                process.kill(-pid, name);
+                return;
+            }
+            catch { /* the group is gone, or we never led one */ }
+        }
+        child.kill(name);
+    };
+    return {
+        kill: () => {
+            cancel();
+            signalTree('SIGKILL');
+        },
+        terminate: () => {
+            cancel();
+            signalTree('SIGTERM');
+            forceTimer = setTimeout(() => {
+                forceTimer = undefined;
+                signalTree('SIGKILL');
+            }, forceKillDelayMs);
+            // Deliberately REFERENCED, unlike every other timer we arm. The survivor
+            // this escalation exists for is the one that ignored `SIGTERM` and holds
+            // none of our stdio: nothing it does keeps our loop alive, so an unref'd
+            // escalation would be dropped by the drain in precisely the case it was
+            // armed for. The cost is bounded by `forceKillDelayMs`, is paid only
+            // after a stop was actually issued, and is refunded the moment
+            // `maySettleOnChildExit` confirms the group is empty.
+        },
+        maySettleOnChildExit: () => {
+            if (forceTimer === undefined)
+                return true;
+            if (groupAnswers())
+                return false;
+            cancel();
+            return true;
+        },
+    };
+}
+//# sourceMappingURL=child-stop.js.map

package/dist/child-stop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"child-stop.js","sourceRoot":"","sources":["../src/child-stop.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AA6CzC;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAA+B;IAC9D,OAAO,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,KAAmB,EACnB,SAAkB,EAClB,mBAA2B,mBAAmB;IAE9C,4EAA4E;IAC5E,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,IAAI,UAAsC,CAAC;IAC3C,MAAM,MAAM,GAAG,GAAS,EAAE;QACxB,IAAI,UAAU,KAAK,SAAS;YAAE,YAAY,CAAC,UAAU,CAAC,CAAC;QACvD,UAAU,GAAG,SAAS,CAAC;IACzB,CAAC,CAAC;IACF,0EAA0E;IAC1E,MAAM,YAAY,GAAG,GAAY,EAAE;QACjC,0EAA0E;QAC1E,2EAA2E;QAC3E,aAAa;QACb,IAAI,CAAC,SAAS,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAClD,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,qEAAqE;YACrE,0EAA0E;YAC1E,oCAAoC;YACpC,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,CAAC,IAAoB,EAAQ,EAAE;QAChD,IAAI,SAAS,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACnC,uEAAuE;YACvE,uEAAuE;YACvE,yEAAyE;YACzE,oEAAoE;YACpE,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACzB,OAAO;YACT,CAAC;YAAC,MAAM,CAAC,CAAC,4CAA4C,CAAC,CAAC;QAC1D,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC;IACF,OAAO;QACL,IAAI,EAAE,GAAS,EAAE;YACf,MAAM,EAAE,CAAC;YACT,UAAU,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC;QACD,SAAS,EAAE,GAAS,EAAE;YACpB,MAAM,EAAE,CAAC;YACT,UAAU,CAAC,SAAS,CAAC,CAAC;YACtB,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC3B,UAAU,GAAG,SAAS,CAAC;gBACvB,UAAU,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC,EAAE,gBAAgB,CAAC,CAAC;YACrB,yEAAyE;YACzE,yEAAyE;YACzE,yEAAyE;YACzE,wEAAwE;YACxE,qEAAqE;YACrE,+DAA+D;YAC/D,sDAAsD;QACxD,CAAC;QACD,oBAAoB,EAAE,GAAY,EAAE;YAClC,IAAI,UAAU,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YAC1C,IAAI,YAAY,EAAE;gBAAE,OAAO,KAAK,CAAC;YACjC,MAAM,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/cli/add.d.ts

@@ -0,0 +1,6 @@
+import type { CliIo } from '../cli.js';
+export declare function addPlugin(name: string, io: CliIo, options?: {
+    cwd?: string;
+    install?: (packageName: string, root: string) => void;
+}): Promise<0 | 2>;
+//# sourceMappingURL=add.d.ts.map

package/dist/cli/add.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"add.d.ts","sourceRoot":"","sources":["../../src/cli/add.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAIvC,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,GAAE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAClD,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAkCtB"}

package/dist/cli/add.js

@@ -0,0 +1,47 @@
+import { execFileSync } from 'node:child_process';
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { findPluginProject, probePlugin, readPlugin } from '../plugin-loader.js';
+import { PluginError, pluginPackageName } from '../plugin-manifest.js';
+export async function addPlugin(name, io, options = {}) {
+    try {
+        const packageName = pluginPackageName(name);
+        const root = findPluginProject(options.cwd ?? process.cwd());
+        if (!root)
+            throw new PluginError('plugin_manifest_invalid', 'flows add requires a project with flows.json.');
+        const configPath = join(root, 'flows.json');
+        const config = JSON.parse(readFileSync(configPath, 'utf8'));
+        if (!config || Array.isArray(config) || typeof config !== 'object' || (config.plugins !== undefined && (!Array.isArray(config.plugins) || !config.plugins.every((p) => typeof p === 'string'))))
+            throw new PluginError('plugin_manifest_invalid', 'Invalid flows.json plugins list.');
+        const tsPath = join(root, 'tsconfig.json');
+        const tsconfig = existsSync(tsPath) ? { config: JSON.parse(readFileSync(tsPath, 'utf8')) } : { config: {} };
+        if (!tsconfig.config || typeof tsconfig.config !== 'object' || Array.isArray(tsconfig.config) || (tsconfig.config.include !== undefined && (!Array.isArray(tsconfig.config.include) || !tsconfig.config.include.every((p) => typeof p === 'string'))))
+            throw new PluginError('plugin_manifest_invalid', 'Invalid tsconfig.json include list.');
+        try {
+            (options.install ?? ((pkg, cwd) => { execFileSync('npm', ['install', '--save', pkg], { cwd, encoding: 'utf8', stdio: 'pipe' }); }))(packageName, root);
+        }
+        catch (error) {
+            const message = String(error.stderr ?? error);
+            throw new PluginError(/E404|404 Not Found/.test(message) ? 'plugin_unknown' : 'plugin_install_failed', `Could not install ${packageName}.`);
+        }
+        const plugin = readPlugin(join(root, 'node_modules', packageName), packageName);
+        await probePlugin(plugin);
+        if (!existsSync(join(plugin.directory, 'src/index.js')))
+            throw new PluginError('plugin_manifest_invalid', 'Plugin requires src/index.js.');
+        const declaration = `node_modules/${packageName}/flows-plugin.d.ts`;
+        if (existsSync(join(root, declaration))) {
+            tsconfig.config.include = [...new Set([...(tsconfig.config.include ?? ['**/*']), declaration])];
+            writeFileSync(tsPath, `${JSON.stringify(tsconfig.config, null, 2)}\n`);
+        }
+        config.plugins = [...new Set([...(config.plugins ?? []), packageName])];
+        writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`);
+        io.stdout(`Added ${packageName}`);
+        return 0;
+    }
+    catch (error) {
+        const refusal = error instanceof PluginError ? error : new PluginError('plugin_manifest_invalid', error.message);
+        io.stderr(`REFUSED [${refusal.code}] ${refusal.message}`);
+        return 2;
+    }
+}
+//# sourceMappingURL=add.js.map

package/dist/cli/add.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"add.js","sourceRoot":"","sources":["../../src/cli/add.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAEvE,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,EAAS,EAAE,UAGrD,EAAE;IACJ,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,WAAW,CAAC,yBAAyB,EAAE,+CAA+C,CAAC,CAAC;QAC7G,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,yBAAyB,EAAE,kCAAkC,CAAC,CAAC;QAC/R,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAC5G,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,yBAAyB,EAAE,qCAAqC,CAAC,CAAC;QACxV,IAAI,CAAC;YACH,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACzJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,MAAM,CAAE,KAA8B,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;YACxE,MAAM,IAAI,WAAW,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,uBAAuB,EAAE,qBAAqB,WAAW,GAAG,CAAC,CAAC;QAC9I,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC;QAChF,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,yBAAyB,EAAE,+BAA+B,CAAC,CAAC;QAC3I,MAAM,WAAW,GAAG,gBAAgB,WAAW,oBAAoB,CAAC;QACpE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;YACxC,QAAQ,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;YAChG,aAAa,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,CAAC,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;QACxE,aAAa,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAClE,EAAE,CAAC,MAAM,CAAC,SAAS,WAAW,EAAE,CAAC,CAAC;QAClC,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,yBAAyB,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC;QAC5H,EAAE,CAAC,MAAM,CAAC,YAAY,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1D,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}

package/dist/cli/build.d.ts

@@ -0,0 +1,13 @@
+import type { CliIo } from '../cli.js';
+export interface BuildArgs {
+    command: 'build';
+    value: string;
+    out?: string;
+    verify: boolean;
+    json: boolean;
+}
+export declare function parseBuildArgs(args: readonly string[]): BuildArgs | undefined;
+export declare function runBuild(args: BuildArgs, io: CliIo): Promise<0 | 2>;
+/** Build checks never probe credentials, workers, or the author's PATH. */
+export declare function buildFlow(path: string, out: string, warn: (line: string) => void): Promise<string>;
+//# sourceMappingURL=build.d.ts.map

package/dist/cli/build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../src/cli/build.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAGvC,MAAM,WAAW,SAAS;IAAG,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE;AAE5G,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,SAAS,CAoB7E;AAcD,wBAAsB,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAsBzE;AAED,2EAA2E;AAC3E,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CA0DxG"}