@relayflows/sdk 2.0.9 → 2.0.10

package/dist/cli/build.js

@@ -0,0 +1,224 @@
+import { readFile, lstat } from 'node:fs/promises';
+import { dirname, extname, join, resolve } from 'node:path';
+import { parse } from 'yaml';
+import { sealBundle, verifyBundle } from '../bundle.js';
+import { canonicalize } from '../canonical.js';
+import { compileSpec, toKernelSpec } from '../compile.js';
+import { preflight } from '../preflight.js';
+import { buildTypescript } from '../bundle-typescript.js';
+import { checkBuildableFlow, readProjectConfig } from './check.js';
+export function parseBuildArgs(args) {
+    if (args[0] === '--verify') {
+        return args.length === 2 && !args[1].startsWith('-')
+            ? { command: 'build', value: args[1], verify: true, json: false } : undefined;
+    }
+    let out;
+    let value;
+    let json = false;
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === '--out') {
+            if (out !== undefined || args[i + 1] === undefined || args[i + 1].startsWith('-'))
+                return undefined;
+            out = args[++i];
+        }
+        else if (arg === '--json') {
+            if (json)
+                return undefined;
+            json = true;
+        }
+        else if (arg.startsWith('-') || value !== undefined)
+            return undefined;
+        else
+            value = arg;
+    }
+    return value === undefined ? undefined : { command: 'build', value, out, verify: false, json };
+}
+/**
+ * Emit a check report in the same shape `flows check` uses so build-time
+ * refusals are consumable by the same tooling.
+ */
+function emitBuildCheckReport(report, json, io) {
+    for (const diagnostic of report.diagnostics) {
+        if (diagnostic.severity !== 'refusal')
+            continue;
+        io.stderr(`REFUSED [${diagnostic.kind}] ${diagnostic.message}`);
+    }
+    if (json)
+        io.stdout(JSON.stringify(report));
+}
+export async function runBuild(args, io) {
+    try {
+        if (args.verify) {
+            io.stdout(`VERIFIED sha256:${await verifyBundle(args.value)}`);
+            return 0;
+        }
+        // Gate the build on the same preflight pipeline `flows check` uses.
+        // Refusals never leave partial artifacts — no file capture, no canonical
+        // spec write, no digest computation, no bundle directory creation. A
+        // previous `dist/flows/<name>@sha256:<hex>/` directory from an earlier
+        // successful build is not touched (buildFlow is never called).
+        const gate = await checkBuildableFlow(args.value);
+        if (!gate.report.ok) {
+            emitBuildCheckReport(gate.report, args.json, io);
+            return 2;
+        }
+        io.stdout(await buildFlow(args.value, args.out ?? 'dist/flows', io.stderr));
+        return 0;
+    }
+    catch (error) {
+        io.stderr(`REFUSED [bundle_invalid] ${error instanceof Error ? error.message : String(error)}`);
+        return 2;
+    }
+}
+/** Build checks never probe credentials, workers, or the author's PATH. */
+export async function buildFlow(path, out, warn) {
+    const input = resolve(path);
+    const directory = dirname(input);
+    const files = [];
+    let authoring;
+    let authored = false;
+    let compiler;
+    if (extname(input) === '.ts') {
+        const result = await buildTypescript(input);
+        authoring = result.spec;
+        authored = result.authored;
+        compiler = result.compiler;
+        files.push(...result.files);
+    }
+    else if (['.yaml', '.yml'].includes(extname(input))) {
+        authoring = compileSpec(parse(await readFile(input, 'utf8')));
+        files.push({ path: 'lockfile.json', data: canonicalize({ version: 1, adapters: [] }) });
+    }
+    else
+        throw new Error('build expects a .yaml, .yml, or .ts flow');
+    // The current preflight API reports uncollected environment facts as
+    // probe_failed. Preserve that truthful report verbatim and separately declare
+    // the deployment obligations; never manufacture successful auth probes.
+    //
+    // Load the nearest flows.json so declared model allowlists and the project
+    // CLI participate in build-time preflight. Without them a declared `model:`
+    // that appears in flows.json/models refuses the whole build as
+    // `model_unknown`, because preflight defaults treat "no registry" as "no
+    // model is known" and only environment probes (deferred here) would rescue
+    // it. Model existence is a build-provable fact; only the live probe is not.
+    const config = readProjectConfig(directory);
+    const report = preflight(authoring, {
+        ...(config.cli !== undefined ? { projectCli: config.cli } : {}),
+        ...(config.path !== undefined ? { projectConfigPath: config.path } : {}),
+        projectSearchStart: directory,
+        models: config.models,
+        ...(config.path !== undefined ? { modelRegistryPath: config.path } : {}),
+        probes: {
+            cli: () => { throw new Error('deferred to deployment'); },
+            executor: () => { throw new Error('deferred to deployment'); },
+            command: () => { throw new Error('deferred to deployment'); },
+        },
+    });
+    const refusals = report.diagnostics.filter(d => d.severity === 'refusal' && d.kind !== 'probe_failed');
+    if (refusals.length > 0)
+        throw new Error(refusals.map(d => `[${d.kind}] ${d.message}`).join('\n'));
+    authoring = await captureFiles(authoring, directory, files);
+    files.push({ path: 'spec.canonical.json', data: canonicalize(toKernelSpec(authoring)) }, { path: 'preflight.json', data: canonicalize(report) }, { path: 'metadata.json', data: canonicalize({
+            version: 1, platform: { os: process.platform, arch: process.arch },
+            executables: files.filter(file => file.path === 'flow' || file.executable).map(file => file.path).sort(),
+            kind: authored ? 'authored-typescript' : 'declarative',
+            ...(compiler === undefined ? {} : { compiler }),
+            preflight: { buildPassed: true, deferred: ['commands', 'credentials', 'workers', 'mcp_servers'],
+                ...(authored ? { dynamicSteps: 'exported spec declaration checked; body was not executed during build' } : {}) },
+        }) });
+    return sealBundle({ name: authoring.name ?? 'flow', out, files,
+        repo: await repositoryRoot(directory), warn });
+}
+async function repositoryRoot(start) {
+    for (let dir = start;; dir = dirname(dir)) {
+        try {
+            await lstat(join(dir, '.git'));
+            return dir;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        if (dirname(dir) === dir)
+            return start;
+    }
+}
+/** Relative CLI executables are the file references in the current spec schema.
+ * Shell commands are opaque; explicit ./file words are captured without
+ * interpreting substitutions or running a shell at build time. */
+async function captureFiles(flow, directory, files) {
+    // Cache the in-flight *promise*, not the resolved string. Two concurrent
+    // captures of the same path (Promise.all over named agents that share a CLI)
+    // both pass a `captured.has(path)` guard before either has finished awaiting
+    // its lstat/readFile, so both would push the same `assets/...` entry -- and
+    // sealBundle then refuses the whole flow as a duplicate. Storing the promise
+    // dedups on the first synchronous look-up.
+    const captured = new Map();
+    function capture(path) {
+        if (!path.includes('/'))
+            return Promise.resolve(path);
+        if (!path.startsWith('./') || path.split('/').includes('..') || path.includes('\\')) {
+            return Promise.reject(new Error(`${path}: bundle file references must start with ./ and stay inside the flow directory`));
+        }
+        const existing = captured.get(path);
+        if (existing !== undefined)
+            return existing;
+        const pending = (async () => {
+            const parts = path.slice(2).split('/');
+            if (parts.some(p => p === '' || p === '.'))
+                throw new Error(`${path}: invalid file reference`);
+            let executable = false;
+            for (let i = 1; i <= parts.length; i++) {
+                const stat = await lstat(join(directory, ...parts.slice(0, i)));
+                if (i === parts.length ? !stat.isFile() : !stat.isDirectory())
+                    throw new Error(`${path}: expected regular file without symlinks`);
+                if (i === parts.length)
+                    executable = (stat.mode & 0o111) !== 0;
+            }
+            const target = `assets/${parts.join('/')}`;
+            files.push({ path: target, data: await readFile(join(directory, ...parts)), executable });
+            return `./${target}`;
+        })();
+        captured.set(path, pending);
+        return pending;
+    }
+    // Capture the flow-level `cli` default and every named-agent `cli` BEFORE
+    // walking steps. Otherwise a step that inherits its CLI from the flow header
+    // or an agents-map entry never emits its own `cli`, so the step-level walk
+    // below misses it, the executable never enters the bundle, and the sealed
+    // spec still points at the author's absolute path outside the bundle.
+    const flowCli = flow.cli !== undefined ? await capture(flow.cli) : undefined;
+    const agents = flow.agents === undefined ? undefined
+        : Object.fromEntries(await Promise.all(Object.entries(flow.agents).map(async ([name, agent]) => [name, { ...agent, cli: await capture(agent.cli) }])));
+    const compiled = toKernelSpec(flow);
+    // Lower named/flow CLI resolution first so every runtime reference is bound.
+    const steps = [];
+    for (const [index, step] of flow.steps.entries()) {
+        if (step.type !== 'deterministic') {
+            const lowered = compiled.steps[index];
+            const cli = lowered && lowered.type !== 'deterministic' ? lowered.cli : undefined;
+            steps.push(cli === undefined ? step : { ...step, cli: await capture(cli) });
+            continue;
+        }
+        let command = step.command;
+        const references = [...command.matchAll(/(?:^|[\s;|&<>])(?:"(\.\/[^"$`]+)"|'(\.\/[^']+)'|(\.\/[^\s;|&<>"'$`]+))/g)];
+        // Replace only each complete matched word, from right to left so offsets
+        // stay valid and similarly prefixed filenames cannot rewrite one another.
+        for (const match of references.reverse()) {
+            const ref = (match[1] ?? match[2] ?? match[3]);
+            const start = match.index + match[0].indexOf(ref);
+            command = command.slice(0, start) + await capture(ref) + command.slice(start + ref.length);
+        }
+        if (/^\s*["']?\//.test(command))
+            throw new Error(`${step.id}: absolute command paths cannot be bundled`);
+        steps.push({ ...step, command });
+    }
+    return {
+        ...flow,
+        ...(flowCli !== undefined ? { cli: flowCli } : {}),
+        ...(agents !== undefined ? { agents } : {}),
+        steps,
+    };
+}
+//# sourceMappingURL=build.js.map

package/dist/cli/build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.js","sourceRoot":"","sources":["../../src/cli/build.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,YAAY,EAAmB,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAoB,MAAM,YAAY,CAAC;AAMrF,MAAM,UAAU,cAAc,CAAC,IAAuB;IACpD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YACnD,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACnF,CAAC;IACD,IAAI,GAAuB,CAAC;IAC5B,IAAI,KAAyB,CAAC;IAC9B,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACrB,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YACrG,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAClB,CAAC;aAAM,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,IAAI;gBAAE,OAAO,SAAS,CAAC;YAC3B,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;;YACnE,KAAK,GAAG,GAAG,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACjG,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAAC,MAAmB,EAAE,IAAa,EAAE,EAAS;IACzE,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QAC5C,IAAI,UAAU,CAAC,QAAQ,KAAK,SAAS;YAAE,SAAS;QAChD,EAAE,CAAC,MAAM,CAAC,YAAY,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,IAAI;QAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAe,EAAE,EAAS;IACvD,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,EAAE,CAAC,MAAM,CAAC,mBAAmB,MAAM,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC/D,OAAO,CAAC,CAAC;QACX,CAAC;QACD,oEAAoE;QACpE,yEAAyE;QACzE,qEAAqE;QACrE,uEAAuE;QACvE,+DAA+D;QAC/D,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACpB,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACjD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,EAAE,CAAC,MAAM,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,IAAI,YAAY,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5E,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,EAAE,CAAC,MAAM,CAAC,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChG,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,GAAW,EAAE,IAA4B;IACrF,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,IAAI,SAAmB,CAAC;IACxB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,QAA4B,CAAC;IACjC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;QAC5C,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC3B,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;SAAM,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACtD,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAC9D,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;;QAAM,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAEnE,qEAAqE;IACrE,8EAA8E;IAC9E,wEAAwE;IACxE,EAAE;IACF,2EAA2E;IAC3E,4EAA4E;IAC5E,+DAA+D;IAC/D,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,EAAE;QAClC,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,kBAAkB,EAAE,SAAS;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,MAAM,EAAE;YACN,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC;YACzD,QAAQ,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC;YAC9D,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC;SAC9D;KACF,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;IACvG,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACnG,SAAS,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5D,KAAK,CAAC,IAAI,CACR,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,YAAY,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,EAC5E,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,EACtD,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,CAAC;YAC1C,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;YAClE,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE;YACxG,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,aAAa;YACtD,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC/C,SAAS,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,CAAC;gBAC7F,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,uEAAuE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACnH,CAAC,EAAE,CACL,CAAC;IACF,OAAO,UAAU,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,MAAM,EAAE,GAAG,EAAE,KAAK;QAC5D,IAAI,EAAE,MAAM,cAAc,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAAa;IACzC,KAAK,IAAI,GAAG,GAAG,KAAK,GAAI,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC;YAAC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;YAAC,OAAO,GAAG,CAAC;QAAC,CAAC;QACnD,OAAO,KAAK,EAAE,CAAC;YAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QAAC,CAAC;QACtF,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;IACzC,CAAC;AACH,CAAC;AAED;;kEAEkE;AAClE,KAAK,UAAU,YAAY,CAAC,IAAc,EAAE,SAAiB,EAAE,KAAmB;IAChF,yEAAyE;IACzE,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,2CAA2C;IAC3C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;IACpD,SAAS,OAAO,CAAC,IAAY;QAC3B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACpF,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,IAAI,gFAAgF,CAAC,CAAC,CAAC;QAC5H,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QAC5C,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,0BAA0B,CAAC,CAAC;YAC/F,IAAI,UAAU,GAAG,KAAK,CAAC;YACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACvC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBAChE,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,0CAA0C,CAAC,CAAC;gBAClI,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM;oBAAE,UAAU,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YACjE,CAAC;YACD,MAAM,MAAM,GAAG,UAAU,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;YAC1F,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,CAAC,CAAC,EAAE,CAAC;QACL,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,0EAA0E;IAC1E,6EAA6E;IAC7E,2EAA2E;IAC3E,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,MAAM,MAAM,GAAuB,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS;QACtE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAClE,KAAK,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAU,CACtF,CAAC,CAAC,CAAC;IACR,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACpC,6EAA6E;IAC7E,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QACjD,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACtC,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;YAClF,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5E,SAAS;QACX,CAAC;QACD,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC3B,MAAM,UAAU,GAAG,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,yEAAyE,CAAC,CAAC,CAAC;QACpH,yEAAyE;QACzE,0EAA0E;QAC1E,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAE,CAAC;YAChD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACnD,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,EAAE,4CAA4C,CAAC,CAAC;QACzG,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,OAAO;QACL,GAAG,IAAI;QACP,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,KAAK;KACN,CAAC;AACJ,CAAC"}

package/dist/cli/bundle-preflight.d.ts

@@ -0,0 +1,5 @@
+import { type CheckExecution } from './check.js';
+/** Refuse unsupported execution: a TS declaration is not its body, and
+ * daemon-relative assets must never resolve in an unrelated checkout. */
+export declare function checkRunnableBundle(directory: string, name: string): Promise<CheckExecution>;
+//# sourceMappingURL=bundle-preflight.d.ts.map

package/dist/cli/bundle-preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-preflight.d.ts","sourceRoot":"","sources":["../../src/cli/bundle-preflight.ts"],"names":[],"mappings":"AAIA,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAEpE;yEACyE;AACzE,wBAAsB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAmBlG"}

package/dist/cli/bundle-preflight.js

@@ -0,0 +1,28 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { BundleFailure } from '../bundle-transport.js';
+import { compileSpec, kernelToAuthoring } from '../compile.js';
+import { checkAuthoredFlow } from './check.js';
+/** Refuse unsupported execution: a TS declaration is not its body, and
+ * daemon-relative assets must never resolve in an unrelated checkout. */
+export async function checkRunnableBundle(directory, name) {
+    const metadata = JSON.parse(await readFile(join(directory, 'metadata.json'), 'utf8'));
+    const manifest = JSON.parse(await readFile(join(directory, 'manifest.json'), 'utf8'));
+    const flow = compileSpec(kernelToAuthoring(JSON.parse(await readFile(join(directory, 'spec.canonical.json'), 'utf8'))));
+    if (flow.name !== undefined && flow.name !== name)
+        throw new BundleFailure('bundle_signature_invalid', 'Bundle name does not match the requested flow.');
+    flow.name ??= name;
+    if (metadata.kind !== 'declarative' || flow.steps.some(step => step.type !== 'deterministic'
+        || step.requirements !== undefined) || (flow.triggers?.length ?? 0) > 0
+        || manifest.some(entry => entry.path.startsWith('assets/'))) {
+        throw new BundleFailure('bundle_unsupported', 'This slice runs declarative deterministic bundles without assets, placement requirements, or triggers.');
+    }
+    // Keep existing fail-closed environment checks before transport/journal.
+    // Splitting static and environment checks is follow-up.
+    // This deterministic-only slice declares no project models or executors.
+    // Never discover flows.json in the deployment/cache tree or its ancestors.
+    return checkAuthoredFlow(flow, join(directory, 'spec.canonical.json'), {
+        directory, models: [], executors: [],
+    });
+}
+//# sourceMappingURL=bundle-preflight.js.map

package/dist/cli/bundle-preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-preflight.js","sourceRoot":"","sources":["../../src/cli/bundle-preflight.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAuB,MAAM,YAAY,CAAC;AAEpE;yEACyE;AACzE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,SAAiB,EAAE,IAAY;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACtF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAuB,CAAC;IAC5G,MAAM,IAAI,GAAG,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACxH,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,0BAA0B,EAAE,gDAAgD,CAAC,CAAC;IACzJ,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC;IACnB,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,eAAe;WACrF,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;WACpE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAC1C,wGAAwG,CAAC,CAAC;IAC9G,CAAC;IACD,yEAAyE;IACzE,wDAAwD;IACxD,yEAAyE;IACzE,2EAA2E;IAC3E,OAAO,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,qBAAqB,CAAC,EAAE;QACrE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE;KACrC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/check-helper-body.d.ts

@@ -0,0 +1,4 @@
+import { type CheckExecution } from './check.js';
+/** Imports the definition, but never executes arbitrary authored body code. */
+export declare function checkHelperBody(path: string): Promise<CheckExecution>;
+//# sourceMappingURL=check-helper-body.d.ts.map

package/dist/cli/check-helper-body.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-helper-body.d.ts","sourceRoot":"","sources":["../../src/cli/check-helper-body.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAErE,+EAA+E;AAC/E,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAQ3E"}

package/dist/cli/check-helper-body.js

@@ -0,0 +1,15 @@
+import { loadAuthoredFlow } from '../authored-flow-loader.js';
+import { checkSlackHelpers } from '../slack-preflight.js';
+import { inputFailureReport } from './check.js';
+/** Imports the definition, but never executes arbitrary authored body code. */
+export async function checkHelperBody(path) {
+    try {
+        const { handle, getDefinition } = await loadAuthoredFlow(path);
+        return { report: { ...checkSlackHelpers(getDefinition(handle)), path } };
+    }
+    catch (error) {
+        return { report: inputFailureReport({ kind: 'invalid_spec',
+                message: error instanceof Error ? error.message : 'Could not import authored flow.' }, path) };
+    }
+}
+//# sourceMappingURL=check-helper-body.js.map

package/dist/cli/check-helper-body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-helper-body.js","sourceRoot":"","sources":["../../src/cli/check-helper-body.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAuB,MAAM,YAAY,CAAC;AAErE,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY;IAChD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC/D,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,iBAAiB,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,kBAAkB,CAAC,EAAE,IAAI,EAAE,cAAc;gBACxD,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,iCAAiC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC;IACnG,CAAC;AACH,CAAC"}

package/dist/cli/check-triggers.d.ts

@@ -0,0 +1,14 @@
+import { type LoadedAuthoredFlow } from '../authored-flow-loader.js';
+import { type CheckReport } from './check.js';
+/**
+ * Inspect an authored flow without running a handler or contacting the daemon.
+ * Combines the two authored-only preflight paths that share a loaded flow: the
+ * webhook-trigger check (E) and the f.slack helper check (B). Skipping either
+ * turned this into a silent trapdoor -- a `.flow.ts` using `f.slack.post`
+ * without a token would pass `flows check` and only crash at run.
+ */
+export declare function checkAuthoredTriggers(path: string): Promise<{
+    report: CheckReport;
+    loaded?: LoadedAuthoredFlow;
+}>;
+//# sourceMappingURL=check-triggers.d.ts.map

package/dist/cli/check-triggers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-triggers.d.ts","sourceRoot":"","sources":["../../src/cli/check-triggers.ts"],"names":[],"mappings":"AACA,OAAO,EAAoB,KAAK,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAGvF,OAAO,EAAyC,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAErF;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACjE,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,CAAC,EAAE,kBAAkB,CAAC;CAC7B,CAAC,CAwBD"}

package/dist/cli/check-triggers.js

@@ -0,0 +1,37 @@
+import { dirname, resolve } from 'node:path';
+import { loadAuthoredFlow } from '../authored-flow-loader.js';
+import { preflightWebhookTriggers } from '../preflight.js';
+import { checkSlackHelpers } from '../slack-preflight.js';
+import { inputFailureReport, readProjectConfig } from './check.js';
+/**
+ * Inspect an authored flow without running a handler or contacting the daemon.
+ * Combines the two authored-only preflight paths that share a loaded flow: the
+ * webhook-trigger check (E) and the f.slack helper check (B). Skipping either
+ * turned this into a silent trapdoor -- a `.flow.ts` using `f.slack.post`
+ * without a token would pass `flows check` and only crash at run.
+ */
+export async function checkAuthoredTriggers(path) {
+    try {
+        const loaded = await loadAuthoredFlow(path);
+        const definition = loaded.getDefinition(loaded.handle);
+        const config = readProjectConfig(dirname(resolve(path)));
+        const triggerDiagnostics = preflightWebhookTriggers((definition.handlers ?? []).map(handler => handler.trigger), config.executors);
+        const helperReport = checkSlackHelpers(definition);
+        const diagnostics = [...triggerDiagnostics, ...helperReport.diagnostics];
+        return {
+            loaded,
+            report: {
+                ok: diagnostics.length === 0, path, gates: [], resolutions: [], diagnostics,
+                ...(config.path === undefined ? {} : { projectConfigPath: config.path }),
+            },
+        };
+    }
+    catch (error) {
+        return { report: inputFailureReport({
+                kind: typeof error === 'object' && error !== null && 'kind' in error && error.kind === 'config_invalid'
+                    ? 'config_invalid' : 'invalid_spec',
+                message: error instanceof Error ? error.message : 'Cannot inspect authored triggers',
+            }, path) };
+    }
+}
+//# sourceMappingURL=check-triggers.js.map

package/dist/cli/check-triggers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-triggers.js","sourceRoot":"","sources":["../../src/cli/check-triggers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAA2B,MAAM,4BAA4B,CAAC;AACvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAoB,MAAM,YAAY,CAAC;AAErF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAY;IAItD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzD,MAAM,kBAAkB,GAAG,wBAAwB,CACjD,CAAC,UAAU,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,SAAS,CAC9E,CAAC;QACF,MAAM,YAAY,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,CAAC,GAAG,kBAAkB,EAAE,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;QACzE,OAAO;YACL,MAAM;YACN,MAAM,EAAE;gBACN,EAAE,EAAE,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,WAAW;gBAC3E,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;aACzE;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,kBAAkB,CAAC;gBAClC,IAAI,EAAE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB;oBACrG,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,cAAc;gBACrC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,kCAAkC;aACrF,EAAE,IAAI,CAAC,EAAE,CAAC;IACb,CAAC;AACH,CAAC"}

package/dist/cli/check-typescript.d.ts

@@ -0,0 +1,20 @@
+import type { LoadedPlugin } from '../plugin-loader.js';
+import type { AuthoredFlowDefinition } from '../authored-flow.js';
+import { type McpServerConfig } from '../spec.js';
+import { type CheckReport } from './check.js';
+export interface CheckedMcp {
+    plugins?: readonly LoadedPlugin[];
+    report: CheckReport;
+    servers: Readonly<Record<string, McpServerConfig>>;
+    inventory: Readonly<Record<string, readonly string[]>>;
+}
+export declare function checkTypeScriptFlow(path: string): Promise<{
+    report: CheckReport;
+}>;
+/** Check declarations without executing the authored body. */
+export declare function checkMcpHeader(definition: Pick<AuthoredFlowDefinition, 'name' | 'header'>, path: string): Promise<CheckedMcp>;
+export declare class McpPreflightError extends Error {
+    readonly report: CheckReport;
+    constructor(report: CheckReport);
+}
+//# sourceMappingURL=check-typescript.d.ts.map

package/dist/cli/check-typescript.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-typescript.d.ts","sourceRoot":"","sources":["../../src/cli/check-typescript.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAGlE,OAAO,EAAuB,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EAAyC,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAErF,MAAM,WAAW,UAAU;IACzB,OAAO,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAClC,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IACnD,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;CACxD;AAED,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC,CAOxF;AAED,8DAA8D;AAC9D,wBAAsB,cAAc,CAClC,UAAU,EAAE,IAAI,CAAC,sBAAsB,EAAE,MAAM,GAAG,QAAQ,CAAC,EAC3D,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,UAAU,CAAC,CA4BrB;AAED,qBAAa,iBAAkB,SAAQ,KAAK;IAC9B,QAAQ,CAAC,MAAM,EAAE,WAAW;gBAAnB,MAAM,EAAE,WAAW;CAGzC"}

package/dist/cli/check-typescript.js

@@ -0,0 +1,54 @@
+import { dirname, resolve } from 'node:path';
+import { loadAuthoredFlow } from '../authored-flow-loader.js';
+import { preflight } from '../preflight.js';
+import { SPEC_SCHEMA_VERSION } from '../spec.js';
+import { inputFailureReport, readProjectConfig } from './check.js';
+export async function checkTypeScriptFlow(path) {
+    try {
+        const { handle, getDefinition } = await loadAuthoredFlow(path);
+        return await checkMcpHeader(getDefinition(handle), path);
+    }
+    catch (error) {
+        return { report: inputFailureReport({ kind: 'invalid_spec', message: error.message }, path) };
+    }
+}
+/** Check declarations without executing the authored body. */
+export async function checkMcpHeader(definition, path) {
+    const empty = { servers: Object.freeze({}), inventory: Object.freeze({}) };
+    const KNOWN_HEADER_FIELDS = new Set(['tools', 'budget', 'identity', 'memory', 'workspace', 'use']);
+    const header = definition.header ?? {};
+    const unsupported = Object.keys(header).filter(key => !KNOWN_HEADER_FIELDS.has(key));
+    if (header.tools?.relayfile !== undefined)
+        unsupported.push('tools.relayfile');
+    if (unsupported.length) {
+        return { ...empty, report: inputFailureReport({ kind: 'invalid_spec',
+                message: `flow "${definition.name}" uses unsupported header fields: ${unsupported.join(', ')}` }, path) };
+    }
+    try {
+        const config = readProjectConfig(dirname(resolve(path)));
+        const result = await preflight({ version: SPEC_SCHEMA_VERSION, name: definition.name,
+            steps: [{ id: 'header', type: 'deterministic', command: ':' }] }, {
+            pluginSearchStart: dirname(resolve(path)),
+            mcpServers: header.tools?.mcp ?? [], mcp: config.mcp,
+            probes: { command: () => true, cli: () => { throw new Error('no CLI declared'); }, executor: () => false },
+        });
+        return {
+            plugins: result.plugins,
+            servers: config.mcp ?? empty.servers,
+            inventory: result.mcpTools ?? empty.inventory,
+            report: { ...result, path, projectConfigPath: config.path, gates: [],
+                diagnostics: result.diagnostics.filter(d => d.stepId !== 'header') },
+        };
+    }
+    catch (error) {
+        return { ...empty, report: inputFailureReport({ kind: 'config_invalid', message: error.message }, path) };
+    }
+}
+export class McpPreflightError extends Error {
+    report;
+    constructor(report) {
+        super(report.diagnostics.map(d => d.message).join('; '));
+        this.report = report;
+    }
+}
+//# sourceMappingURL=check-typescript.js.map

package/dist/cli/check-typescript.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-typescript.js","sourceRoot":"","sources":["../../src/cli/check-typescript.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAwB,MAAM,YAAY,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAoB,MAAM,YAAY,CAAC;AASrF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY;IACpD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC/D,OAAO,MAAM,cAAc,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,kBAAkB,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAG,KAAe,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC;IAC3G,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAA2D,EAC3D,IAAY;IAEZ,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;IAC3E,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;IACnG,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC;IACvC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACrF,IAAI,MAAM,CAAC,KAAK,EAAE,SAAS,KAAK,SAAS;QAAE,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC/E,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;QACvB,OAAO,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,kBAAkB,CAAC,EAAE,IAAI,EAAE,cAAc;gBAClE,OAAO,EAAE,SAAS,UAAU,CAAC,IAAI,qCAAqC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC;IAC9G,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI;YAClF,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;YAClE,iBAAiB,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACzC,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG;YACpD,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE;SAC3G,CAAC,CAAC;QACH,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,OAAO;YACpC,SAAS,EAAE,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS;YAC7C,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;gBAClE,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,EAAE;SACvE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,kBAAkB,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAG,KAAe,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC;IACvH,CAAC;AACH,CAAC;AAED,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACrB;IAArB,YAAqB,MAAmB;QACtC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QADtC,WAAM,GAAN,MAAM,CAAa;IAExC,CAAC;CACF"}

package/dist/cli/check.d.ts

@@ -1,14 +1,32 @@
 import type { FlowSpec } from '../spec.js';
+import type { McpServerConfig } from '../spec.js';
 import type { StepGateInspection } from '../gate-contract.js';
-import type { CheckFailureKind } from '../failure-kinds.js';
+import type { CheckFailureKind, CheckWarningKind } from '../failure-kinds.js';
 import { type CliResolution, type PreflightDiagnostic } from '../preflight.js';
+export interface ProjectConfig {
+    deploy?: {
+        bucket: string;
+    };
+    mcp?: Record<string, McpServerConfig>;
+    cli?: string;
+    executors: string[];
+    models: string[];
+    directory: string;
+    path?: string;
+}
 export interface CheckReport {
+    mcpTools?: Readonly<Record<string, readonly string[]>>;
     ok: boolean;
     path?: string;
     projectConfigPath?: string;
     gates: StepGateInspection[];
     resolutions: CliResolution[];
-    diagnostics: Array<PreflightDiagnostic | CheckInputDiagnostic>;
+    diagnostics: Array<PreflightDiagnostic | CheckInputDiagnostic | CheckWarningDiagnostic>;
+}
+export interface CheckWarningDiagnostic {
+    severity: 'warning';
+    kind: CheckWarningKind;
+    message: string;
 }
 export interface CheckInputDiagnostic {
     severity: 'refusal';
@@ -19,12 +37,27 @@ export interface CheckExecution {
     report: CheckReport;
     flow?: FlowSpec;
 }
+export declare class CheckFailure extends Error {
+    readonly kind: CheckFailureKind;
+    constructor(kind: CheckFailureKind, message: string);
+}
 /** Validate and preflight one working-tree spec without starting a run. */
 export declare function checkFlow(path: string): CheckExecution;
 /** Preflight a validated authored flow through the same path as YAML/JSON. */
-export declare function checkAuthoredFlow(authoring: FlowSpec, path: string): CheckExecution;
+export declare function checkAuthoredFlow(authoring: FlowSpec, path: string, projectConfig?: ProjectConfig): CheckExecution;
+/**
+ * Build-time gate that runs the same preflight pipeline as `checkFlow`
+ * but with deferred probes — a build machine is not the deployment target,
+ * so `cli`/`command`/`executor` existence is checked at run-time, not here.
+ *
+ * "Build-provable" refusals (unknown model, `use:` unresolved, invalid
+ * verification, missing bundle assets, budget syntax, etc.) still surface,
+ * because they are properties of the flow spec, not of the build host.
+ */
+export declare function checkBuildableFlow(path: string): Promise<CheckExecution>;
 export declare function inputFailureReport(failure: {
     kind: CheckFailureKind;
     message: string;
 }, path?: string): CheckReport;
+export declare function readProjectConfig(start: string): ProjectConfig;
 //# sourceMappingURL=check.d.ts.map

package/dist/cli/check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/cli/check.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAGL,KAAK,aAAa,EAElB,KAAK,mBAAmB,EAEzB,MAAM,iBAAiB,CAAC;AAUzB,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,WAAW,EAAE,KAAK,CAAC,mBAAmB,GAAG,oBAAoB,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,SAAS,CAAC;IACpB,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB;AAQD,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAWtD;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,CAsCnF;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EACpD,IAAI,CAAC,EAAE,MAAM,GACZ,WAAW,CAQb"}
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/cli/check.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAGL,KAAK,aAAa,EAElB,KAAK,mBAAmB,EAEzB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IACvD,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,WAAW,EAAE,KAAK,CAAC,mBAAmB,GAAG,oBAAoB,GAAG,sBAAsB,CAAC,CAAC;CACzF;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,SAAS,CAAC;IACpB,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,SAAS,CAAC;IACpB,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB;AAED,qBAAa,YAAa,SAAQ,KAAK;IACzB,QAAQ,CAAC,IAAI,EAAE,gBAAgB;gBAAtB,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM;CAG7D;AAED,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CA4BtD;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,aAAa,GAAG,cAAc,CAsClH;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAuD9E;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EACpD,IAAI,CAAC,EAAE,MAAM,GACZ,WAAW,CAQb;AAqCD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,CA4D9D"}