@relayflows/sdk 2.0.9 → 2.0.11

package/dist/child-stop.js

@@ -0,0 +1,94 @@
+/**
+ * Grace between the graceful signal and the force kill. A tree that ignores
+ * `SIGTERM` still has to go: it is holding the inherited stdio pipes that keep
+ * the `flows run` event loop alive long after the step itself has settled.
+ */
+export const FORCE_KILL_DELAY_MS = 1_000;
+/**
+ * Whether a stop can reach descendants at all. It can only when the spawn asked
+ * for a process group of its own, which needs POSIX and is only worth the
+ * detach on the lease-bound path. Callers pass this same value to `spawn`'s
+ * `detached` and to {@link childStop}, so the spawn flag and the stop strategy
+ * cannot drift apart.
+ */
+export function ownsProcessGroup(signal) {
+    return signal !== undefined && process.platform !== 'win32';
+}
+export function childStop(child, ownsGroup, forceKillDelayMs = FORCE_KILL_DELAY_MS) {
+    // Pinned at the spawn rather than read per signal. Every interesting use of
+    // this id happens AFTER the direct child has been reaped — the escalation
+    // fires a second later, and the group probe runs on `'close'` — so reading
+    // `child.pid` there would be reading a field the runtime owns and is free to
+    // clear. The group keeps this id for as long as any member of it is alive,
+    // which is exactly the window both of those need to address.
+    const pid = child.pid;
+    let forceTimer;
+    const cancel = () => {
+        if (forceTimer !== undefined)
+            clearTimeout(forceTimer);
+        forceTimer = undefined;
+    };
+    /** Whether anything is still in the group. See `maySettleOnChildExit`. */
+    const groupAnswers = () => {
+        // With no group of our own a stop never reached past the direct child, so
+        // that child's exit IS the whole of our reach and there is nothing left to
+        // ask about.
+        if (!ownsGroup || pid === undefined)
+            return false;
+        try {
+            process.kill(-pid, 0);
+            return true;
+        }
+        catch (error) {
+            // Only `ESRCH` proves the group is empty. `EPERM` proves the opposite —
+            // something is in there that we may not signal — and any other errno
+            // proves nothing at all, so both must read as alive: an unproven group is
+            // not a reason to spare a survivor.
+            return error.code !== 'ESRCH';
+        }
+    };
+    const signalTree = (name) => {
+        if (ownsGroup && pid !== undefined) {
+            // `-pid` addresses the group this detached child leads, which is every
+            // descendant that has not left it. It throws only once the whole group
+            // is gone — the outcome we were asking for — so fall through and let the
+            // direct-child signal report on a child that never became a leader.
+            try {
+                process.kill(-pid, name);
+                return;
+            }
+            catch { /* the group is gone, or we never led one */ }
+        }
+        child.kill(name);
+    };
+    return {
+        kill: () => {
+            cancel();
+            signalTree('SIGKILL');
+        },
+        terminate: () => {
+            cancel();
+            signalTree('SIGTERM');
+            forceTimer = setTimeout(() => {
+                forceTimer = undefined;
+                signalTree('SIGKILL');
+            }, forceKillDelayMs);
+            // Deliberately REFERENCED, unlike every other timer we arm. The survivor
+            // this escalation exists for is the one that ignored `SIGTERM` and holds
+            // none of our stdio: nothing it does keeps our loop alive, so an unref'd
+            // escalation would be dropped by the drain in precisely the case it was
+            // armed for. The cost is bounded by `forceKillDelayMs`, is paid only
+            // after a stop was actually issued, and is refunded the moment
+            // `maySettleOnChildExit` confirms the group is empty.
+        },
+        maySettleOnChildExit: () => {
+            if (forceTimer === undefined)
+                return true;
+            if (groupAnswers())
+                return false;
+            cancel();
+            return true;
+        },
+    };
+}
+//# sourceMappingURL=child-stop.js.map

package/dist/child-stop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"child-stop.js","sourceRoot":"","sources":["../src/child-stop.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AA6CzC;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAA+B;IAC9D,OAAO,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,KAAmB,EACnB,SAAkB,EAClB,mBAA2B,mBAAmB;IAE9C,4EAA4E;IAC5E,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,IAAI,UAAsC,CAAC;IAC3C,MAAM,MAAM,GAAG,GAAS,EAAE;QACxB,IAAI,UAAU,KAAK,SAAS;YAAE,YAAY,CAAC,UAAU,CAAC,CAAC;QACvD,UAAU,GAAG,SAAS,CAAC;IACzB,CAAC,CAAC;IACF,0EAA0E;IAC1E,MAAM,YAAY,GAAG,GAAY,EAAE;QACjC,0EAA0E;QAC1E,2EAA2E;QAC3E,aAAa;QACb,IAAI,CAAC,SAAS,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAClD,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,qEAAqE;YACrE,0EAA0E;YAC1E,oCAAoC;YACpC,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,CAAC,IAAoB,EAAQ,EAAE;QAChD,IAAI,SAAS,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACnC,uEAAuE;YACvE,uEAAuE;YACvE,yEAAyE;YACzE,oEAAoE;YACpE,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACzB,OAAO;YACT,CAAC;YAAC,MAAM,CAAC,CAAC,4CAA4C,CAAC,CAAC;QAC1D,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC;IACF,OAAO;QACL,IAAI,EAAE,GAAS,EAAE;YACf,MAAM,EAAE,CAAC;YACT,UAAU,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC;QACD,SAAS,EAAE,GAAS,EAAE;YACpB,MAAM,EAAE,CAAC;YACT,UAAU,CAAC,SAAS,CAAC,CAAC;YACtB,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC3B,UAAU,GAAG,SAAS,CAAC;gBACvB,UAAU,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC,EAAE,gBAAgB,CAAC,CAAC;YACrB,yEAAyE;YACzE,yEAAyE;YACzE,yEAAyE;YACzE,wEAAwE;YACxE,qEAAqE;YACrE,+DAA+D;YAC/D,sDAAsD;QACxD,CAAC;QACD,oBAAoB,EAAE,GAAY,EAAE;YAClC,IAAI,UAAU,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YAC1C,IAAI,YAAY,EAAE;gBAAE,OAAO,KAAK,CAAC;YACjC,MAAM,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/cli/add.d.ts

@@ -0,0 +1,6 @@
+import type { CliIo } from '../cli.js';
+export declare function addPlugin(name: string, io: CliIo, options?: {
+    cwd?: string;
+    install?: (packageName: string, root: string) => void;
+}): Promise<0 | 2>;
+//# sourceMappingURL=add.d.ts.map

package/dist/cli/add.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"add.d.ts","sourceRoot":"","sources":["../../src/cli/add.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAIvC,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,GAAE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAClD,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAkCtB"}

package/dist/cli/add.js

@@ -0,0 +1,47 @@
+import { execFileSync } from 'node:child_process';
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { findPluginProject, probePlugin, readPlugin } from '../plugin-loader.js';
+import { PluginError, pluginPackageName } from '../plugin-manifest.js';
+export async function addPlugin(name, io, options = {}) {
+    try {
+        const packageName = pluginPackageName(name);
+        const root = findPluginProject(options.cwd ?? process.cwd());
+        if (!root)
+            throw new PluginError('plugin_manifest_invalid', 'flows add requires a project with flows.json.');
+        const configPath = join(root, 'flows.json');
+        const config = JSON.parse(readFileSync(configPath, 'utf8'));
+        if (!config || Array.isArray(config) || typeof config !== 'object' || (config.plugins !== undefined && (!Array.isArray(config.plugins) || !config.plugins.every((p) => typeof p === 'string'))))
+            throw new PluginError('plugin_manifest_invalid', 'Invalid flows.json plugins list.');
+        const tsPath = join(root, 'tsconfig.json');
+        const tsconfig = existsSync(tsPath) ? { config: JSON.parse(readFileSync(tsPath, 'utf8')) } : { config: {} };
+        if (!tsconfig.config || typeof tsconfig.config !== 'object' || Array.isArray(tsconfig.config) || (tsconfig.config.include !== undefined && (!Array.isArray(tsconfig.config.include) || !tsconfig.config.include.every((p) => typeof p === 'string'))))
+            throw new PluginError('plugin_manifest_invalid', 'Invalid tsconfig.json include list.');
+        try {
+            (options.install ?? ((pkg, cwd) => { execFileSync('npm', ['install', '--save', pkg], { cwd, encoding: 'utf8', stdio: 'pipe' }); }))(packageName, root);
+        }
+        catch (error) {
+            const message = String(error.stderr ?? error);
+            throw new PluginError(/E404|404 Not Found/.test(message) ? 'plugin_unknown' : 'plugin_install_failed', `Could not install ${packageName}.`);
+        }
+        const plugin = readPlugin(join(root, 'node_modules', packageName), packageName);
+        await probePlugin(plugin);
+        if (!existsSync(join(plugin.directory, 'src/index.js')))
+            throw new PluginError('plugin_manifest_invalid', 'Plugin requires src/index.js.');
+        const declaration = `node_modules/${packageName}/flows-plugin.d.ts`;
+        if (existsSync(join(root, declaration))) {
+            tsconfig.config.include = [...new Set([...(tsconfig.config.include ?? ['**/*']), declaration])];
+            writeFileSync(tsPath, `${JSON.stringify(tsconfig.config, null, 2)}\n`);
+        }
+        config.plugins = [...new Set([...(config.plugins ?? []), packageName])];
+        writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`);
+        io.stdout(`Added ${packageName}`);
+        return 0;
+    }
+    catch (error) {
+        const refusal = error instanceof PluginError ? error : new PluginError('plugin_manifest_invalid', error.message);
+        io.stderr(`REFUSED [${refusal.code}] ${refusal.message}`);
+        return 2;
+    }
+}
+//# sourceMappingURL=add.js.map

package/dist/cli/add.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"add.js","sourceRoot":"","sources":["../../src/cli/add.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAEvE,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,EAAS,EAAE,UAGrD,EAAE;IACJ,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,WAAW,CAAC,yBAAyB,EAAE,+CAA+C,CAAC,CAAC;QAC7G,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,yBAAyB,EAAE,kCAAkC,CAAC,CAAC;QAC/R,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAC5G,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,yBAAyB,EAAE,qCAAqC,CAAC,CAAC;QACxV,IAAI,CAAC;YACH,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACzJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,MAAM,CAAE,KAA8B,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;YACxE,MAAM,IAAI,WAAW,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,uBAAuB,EAAE,qBAAqB,WAAW,GAAG,CAAC,CAAC;QAC9I,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC;QAChF,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,yBAAyB,EAAE,+BAA+B,CAAC,CAAC;QAC3I,MAAM,WAAW,GAAG,gBAAgB,WAAW,oBAAoB,CAAC;QACpE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;YACxC,QAAQ,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;YAChG,aAAa,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,CAAC,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;QACxE,aAAa,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAClE,EAAE,CAAC,MAAM,CAAC,SAAS,WAAW,EAAE,CAAC,CAAC;QAClC,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,yBAAyB,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC;QAC5H,EAAE,CAAC,MAAM,CAAC,YAAY,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1D,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}

package/dist/cli/build.d.ts

@@ -0,0 +1,13 @@
+import type { CliIo } from '../cli.js';
+export interface BuildArgs {
+    command: 'build';
+    value: string;
+    out?: string;
+    verify: boolean;
+    json: boolean;
+}
+export declare function parseBuildArgs(args: readonly string[]): BuildArgs | undefined;
+export declare function runBuild(args: BuildArgs, io: CliIo): Promise<0 | 2>;
+/** Build checks never probe credentials, workers, or the author's PATH. */
+export declare function buildFlow(path: string, out: string, warn: (line: string) => void): Promise<string>;
+//# sourceMappingURL=build.d.ts.map

package/dist/cli/build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../src/cli/build.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAGvC,MAAM,WAAW,SAAS;IAAG,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE;AAE5G,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,SAAS,CAoB7E;AAcD,wBAAsB,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAsBzE;AAED,2EAA2E;AAC3E,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CA0DxG"}

package/dist/cli/build.js

@@ -0,0 +1,224 @@
+import { readFile, lstat } from 'node:fs/promises';
+import { dirname, extname, join, resolve } from 'node:path';
+import { parse } from 'yaml';
+import { sealBundle, verifyBundle } from '../bundle.js';
+import { canonicalize } from '../canonical.js';
+import { compileSpec, toKernelSpec } from '../compile.js';
+import { preflight } from '../preflight.js';
+import { buildTypescript } from '../bundle-typescript.js';
+import { checkBuildableFlow, readProjectConfig } from './check.js';
+export function parseBuildArgs(args) {
+    if (args[0] === '--verify') {
+        return args.length === 2 && !args[1].startsWith('-')
+            ? { command: 'build', value: args[1], verify: true, json: false } : undefined;
+    }
+    let out;
+    let value;
+    let json = false;
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === '--out') {
+            if (out !== undefined || args[i + 1] === undefined || args[i + 1].startsWith('-'))
+                return undefined;
+            out = args[++i];
+        }
+        else if (arg === '--json') {
+            if (json)
+                return undefined;
+            json = true;
+        }
+        else if (arg.startsWith('-') || value !== undefined)
+            return undefined;
+        else
+            value = arg;
+    }
+    return value === undefined ? undefined : { command: 'build', value, out, verify: false, json };
+}
+/**
+ * Emit a check report in the same shape `flows check` uses so build-time
+ * refusals are consumable by the same tooling.
+ */
+function emitBuildCheckReport(report, json, io) {
+    for (const diagnostic of report.diagnostics) {
+        if (diagnostic.severity !== 'refusal')
+            continue;
+        io.stderr(`REFUSED [${diagnostic.kind}] ${diagnostic.message}`);
+    }
+    if (json)
+        io.stdout(JSON.stringify(report));
+}
+export async function runBuild(args, io) {
+    try {
+        if (args.verify) {
+            io.stdout(`VERIFIED sha256:${await verifyBundle(args.value)}`);
+            return 0;
+        }
+        // Gate the build on the same preflight pipeline `flows check` uses.
+        // Refusals never leave partial artifacts — no file capture, no canonical
+        // spec write, no digest computation, no bundle directory creation. A
+        // previous `dist/flows/<name>@sha256:<hex>/` directory from an earlier
+        // successful build is not touched (buildFlow is never called).
+        const gate = await checkBuildableFlow(args.value);
+        if (!gate.report.ok) {
+            emitBuildCheckReport(gate.report, args.json, io);
+            return 2;
+        }
+        io.stdout(await buildFlow(args.value, args.out ?? 'dist/flows', io.stderr));
+        return 0;
+    }
+    catch (error) {
+        io.stderr(`REFUSED [bundle_invalid] ${error instanceof Error ? error.message : String(error)}`);
+        return 2;
+    }
+}
+/** Build checks never probe credentials, workers, or the author's PATH. */
+export async function buildFlow(path, out, warn) {
+    const input = resolve(path);
+    const directory = dirname(input);
+    const files = [];
+    let authoring;
+    let authored = false;
+    let compiler;
+    if (extname(input) === '.ts') {
+        const result = await buildTypescript(input);
+        authoring = result.spec;
+        authored = result.authored;
+        compiler = result.compiler;
+        files.push(...result.files);
+    }
+    else if (['.yaml', '.yml'].includes(extname(input))) {
+        authoring = compileSpec(parse(await readFile(input, 'utf8')));
+        files.push({ path: 'lockfile.json', data: canonicalize({ version: 1, adapters: [] }) });
+    }
+    else
+        throw new Error('build expects a .yaml, .yml, or .ts flow');
+    // The current preflight API reports uncollected environment facts as
+    // probe_failed. Preserve that truthful report verbatim and separately declare
+    // the deployment obligations; never manufacture successful auth probes.
+    //
+    // Load the nearest flows.json so declared model allowlists and the project
+    // CLI participate in build-time preflight. Without them a declared `model:`
+    // that appears in flows.json/models refuses the whole build as
+    // `model_unknown`, because preflight defaults treat "no registry" as "no
+    // model is known" and only environment probes (deferred here) would rescue
+    // it. Model existence is a build-provable fact; only the live probe is not.
+    const config = readProjectConfig(directory);
+    const report = preflight(authoring, {
+        ...(config.cli !== undefined ? { projectCli: config.cli } : {}),
+        ...(config.path !== undefined ? { projectConfigPath: config.path } : {}),
+        projectSearchStart: directory,
+        models: config.models,
+        ...(config.path !== undefined ? { modelRegistryPath: config.path } : {}),
+        probes: {
+            cli: () => { throw new Error('deferred to deployment'); },
+            executor: () => { throw new Error('deferred to deployment'); },
+            command: () => { throw new Error('deferred to deployment'); },
+        },
+    });
+    const refusals = report.diagnostics.filter(d => d.severity === 'refusal' && d.kind !== 'probe_failed');
+    if (refusals.length > 0)
+        throw new Error(refusals.map(d => `[${d.kind}] ${d.message}`).join('\n'));
+    authoring = await captureFiles(authoring, directory, files);
+    files.push({ path: 'spec.canonical.json', data: canonicalize(toKernelSpec(authoring)) }, { path: 'preflight.json', data: canonicalize(report) }, { path: 'metadata.json', data: canonicalize({
+            version: 1, platform: { os: process.platform, arch: process.arch },
+            executables: files.filter(file => file.path === 'flow' || file.executable).map(file => file.path).sort(),
+            kind: authored ? 'authored-typescript' : 'declarative',
+            ...(compiler === undefined ? {} : { compiler }),
+            preflight: { buildPassed: true, deferred: ['commands', 'credentials', 'workers', 'mcp_servers'],
+                ...(authored ? { dynamicSteps: 'exported spec declaration checked; body was not executed during build' } : {}) },
+        }) });
+    return sealBundle({ name: authoring.name ?? 'flow', out, files,
+        repo: await repositoryRoot(directory), warn });
+}
+async function repositoryRoot(start) {
+    for (let dir = start;; dir = dirname(dir)) {
+        try {
+            await lstat(join(dir, '.git'));
+            return dir;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        if (dirname(dir) === dir)
+            return start;
+    }
+}
+/** Relative CLI executables are the file references in the current spec schema.
+ * Shell commands are opaque; explicit ./file words are captured without
+ * interpreting substitutions or running a shell at build time. */
+async function captureFiles(flow, directory, files) {
+    // Cache the in-flight *promise*, not the resolved string. Two concurrent
+    // captures of the same path (Promise.all over named agents that share a CLI)
+    // both pass a `captured.has(path)` guard before either has finished awaiting
+    // its lstat/readFile, so both would push the same `assets/...` entry -- and
+    // sealBundle then refuses the whole flow as a duplicate. Storing the promise
+    // dedups on the first synchronous look-up.
+    const captured = new Map();
+    function capture(path) {
+        if (!path.includes('/'))
+            return Promise.resolve(path);
+        if (!path.startsWith('./') || path.split('/').includes('..') || path.includes('\\')) {
+            return Promise.reject(new Error(`${path}: bundle file references must start with ./ and stay inside the flow directory`));
+        }
+        const existing = captured.get(path);
+        if (existing !== undefined)
+            return existing;
+        const pending = (async () => {
+            const parts = path.slice(2).split('/');
+            if (parts.some(p => p === '' || p === '.'))
+                throw new Error(`${path}: invalid file reference`);
+            let executable = false;
+            for (let i = 1; i <= parts.length; i++) {
+                const stat = await lstat(join(directory, ...parts.slice(0, i)));
+                if (i === parts.length ? !stat.isFile() : !stat.isDirectory())
+                    throw new Error(`${path}: expected regular file without symlinks`);
+                if (i === parts.length)
+                    executable = (stat.mode & 0o111) !== 0;
+            }
+            const target = `assets/${parts.join('/')}`;
+            files.push({ path: target, data: await readFile(join(directory, ...parts)), executable });
+            return `./${target}`;
+        })();
+        captured.set(path, pending);
+        return pending;
+    }
+    // Capture the flow-level `cli` default and every named-agent `cli` BEFORE
+    // walking steps. Otherwise a step that inherits its CLI from the flow header
+    // or an agents-map entry never emits its own `cli`, so the step-level walk
+    // below misses it, the executable never enters the bundle, and the sealed
+    // spec still points at the author's absolute path outside the bundle.
+    const flowCli = flow.cli !== undefined ? await capture(flow.cli) : undefined;
+    const agents = flow.agents === undefined ? undefined
+        : Object.fromEntries(await Promise.all(Object.entries(flow.agents).map(async ([name, agent]) => [name, { ...agent, cli: await capture(agent.cli) }])));
+    const compiled = toKernelSpec(flow);
+    // Lower named/flow CLI resolution first so every runtime reference is bound.
+    const steps = [];
+    for (const [index, step] of flow.steps.entries()) {
+        if (step.type !== 'deterministic') {
+            const lowered = compiled.steps[index];
+            const cli = lowered && lowered.type !== 'deterministic' ? lowered.cli : undefined;
+            steps.push(cli === undefined ? step : { ...step, cli: await capture(cli) });
+            continue;
+        }
+        let command = step.command;
+        const references = [...command.matchAll(/(?:^|[\s;|&<>])(?:"(\.\/[^"$`]+)"|'(\.\/[^']+)'|(\.\/[^\s;|&<>"'$`]+))/g)];
+        // Replace only each complete matched word, from right to left so offsets
+        // stay valid and similarly prefixed filenames cannot rewrite one another.
+        for (const match of references.reverse()) {
+            const ref = (match[1] ?? match[2] ?? match[3]);
+            const start = match.index + match[0].indexOf(ref);
+            command = command.slice(0, start) + await capture(ref) + command.slice(start + ref.length);
+        }
+        if (/^\s*["']?\//.test(command))
+            throw new Error(`${step.id}: absolute command paths cannot be bundled`);
+        steps.push({ ...step, command });
+    }
+    return {
+        ...flow,
+        ...(flowCli !== undefined ? { cli: flowCli } : {}),
+        ...(agents !== undefined ? { agents } : {}),
+        steps,
+    };
+}
+//# sourceMappingURL=build.js.map

package/dist/cli/build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.js","sourceRoot":"","sources":["../../src/cli/build.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,YAAY,EAAmB,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAoB,MAAM,YAAY,CAAC;AAMrF,MAAM,UAAU,cAAc,CAAC,IAAuB;IACpD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YACnD,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACnF,CAAC;IACD,IAAI,GAAuB,CAAC;IAC5B,IAAI,KAAyB,CAAC;IAC9B,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACrB,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YACrG,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAClB,CAAC;aAAM,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,IAAI;gBAAE,OAAO,SAAS,CAAC;YAC3B,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;;YACnE,KAAK,GAAG,GAAG,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACjG,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAAC,MAAmB,EAAE,IAAa,EAAE,EAAS;IACzE,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QAC5C,IAAI,UAAU,CAAC,QAAQ,KAAK,SAAS;YAAE,SAAS;QAChD,EAAE,CAAC,MAAM,CAAC,YAAY,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,IAAI;QAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAe,EAAE,EAAS;IACvD,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,EAAE,CAAC,MAAM,CAAC,mBAAmB,MAAM,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC/D,OAAO,CAAC,CAAC;QACX,CAAC;QACD,oEAAoE;QACpE,yEAAyE;QACzE,qEAAqE;QACrE,uEAAuE;QACvE,+DAA+D;QAC/D,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACpB,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACjD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,EAAE,CAAC,MAAM,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,IAAI,YAAY,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5E,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,EAAE,CAAC,MAAM,CAAC,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChG,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,GAAW,EAAE,IAA4B;IACrF,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,IAAI,SAAmB,CAAC;IACxB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,QAA4B,CAAC;IACjC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;QAC5C,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC3B,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;SAAM,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACtD,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAC9D,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;;QAAM,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAEnE,qEAAqE;IACrE,8EAA8E;IAC9E,wEAAwE;IACxE,EAAE;IACF,2EAA2E;IAC3E,4EAA4E;IAC5E,+DAA+D;IAC/D,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,EAAE;QAClC,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,kBAAkB,EAAE,SAAS;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,MAAM,EAAE;YACN,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC;YACzD,QAAQ,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC;YAC9D,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC;SAC9D;KACF,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;IACvG,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACnG,SAAS,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5D,KAAK,CAAC,IAAI,CACR,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,YAAY,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,EAC5E,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,EACtD,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,CAAC;YAC1C,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;YAClE,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE;YACxG,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,aAAa;YACtD,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC/C,SAAS,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,CAAC;gBAC7F,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,uEAAuE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACnH,CAAC,EAAE,CACL,CAAC;IACF,OAAO,UAAU,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,MAAM,EAAE,GAAG,EAAE,KAAK;QAC5D,IAAI,EAAE,MAAM,cAAc,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAAa;IACzC,KAAK,IAAI,GAAG,GAAG,KAAK,GAAI,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC;YAAC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;YAAC,OAAO,GAAG,CAAC;QAAC,CAAC;QACnD,OAAO,KAAK,EAAE,CAAC;YAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QAAC,CAAC;QACtF,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;IACzC,CAAC;AACH,CAAC;AAED;;kEAEkE;AAClE,KAAK,UAAU,YAAY,CAAC,IAAc,EAAE,SAAiB,EAAE,KAAmB;IAChF,yEAAyE;IACzE,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,2CAA2C;IAC3C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;IACpD,SAAS,OAAO,CAAC,IAAY;QAC3B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACpF,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,IAAI,gFAAgF,CAAC,CAAC,CAAC;QAC5H,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QAC5C,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,0BAA0B,CAAC,CAAC;YAC/F,IAAI,UAAU,GAAG,KAAK,CAAC;YACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACvC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBAChE,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,0CAA0C,CAAC,CAAC;gBAClI,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM;oBAAE,UAAU,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YACjE,CAAC;YACD,MAAM,MAAM,GAAG,UAAU,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;YAC1F,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,CAAC,CAAC,EAAE,CAAC;QACL,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,0EAA0E;IAC1E,6EAA6E;IAC7E,2EAA2E;IAC3E,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,MAAM,MAAM,GAAuB,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS;QACtE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAClE,KAAK,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAU,CACtF,CAAC,CAAC,CAAC;IACR,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACpC,6EAA6E;IAC7E,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QACjD,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACtC,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;YAClF,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5E,SAAS;QACX,CAAC;QACD,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC3B,MAAM,UAAU,GAAG,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,yEAAyE,CAAC,CAAC,CAAC;QACpH,yEAAyE;QACzE,0EAA0E;QAC1E,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAE,CAAC;YAChD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACnD,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,EAAE,4CAA4C,CAAC,CAAC;QACzG,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,OAAO;QACL,GAAG,IAAI;QACP,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,KAAK;KACN,CAAC;AACJ,CAAC"}

package/dist/cli/bundle-preflight.d.ts

@@ -0,0 +1,5 @@
+import { type CheckExecution } from './check.js';
+/** Refuse unsupported execution: a TS declaration is not its body, and
+ * daemon-relative assets must never resolve in an unrelated checkout. */
+export declare function checkRunnableBundle(directory: string, name: string): Promise<CheckExecution>;
+//# sourceMappingURL=bundle-preflight.d.ts.map

package/dist/cli/bundle-preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-preflight.d.ts","sourceRoot":"","sources":["../../src/cli/bundle-preflight.ts"],"names":[],"mappings":"AAIA,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAEpE;yEACyE;AACzE,wBAAsB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAmBlG"}

package/dist/cli/bundle-preflight.js

@@ -0,0 +1,28 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { BundleFailure } from '../bundle-transport.js';
+import { compileSpec, kernelToAuthoring } from '../compile.js';
+import { checkAuthoredFlow } from './check.js';
+/** Refuse unsupported execution: a TS declaration is not its body, and
+ * daemon-relative assets must never resolve in an unrelated checkout. */
+export async function checkRunnableBundle(directory, name) {
+    const metadata = JSON.parse(await readFile(join(directory, 'metadata.json'), 'utf8'));
+    const manifest = JSON.parse(await readFile(join(directory, 'manifest.json'), 'utf8'));
+    const flow = compileSpec(kernelToAuthoring(JSON.parse(await readFile(join(directory, 'spec.canonical.json'), 'utf8'))));
+    if (flow.name !== undefined && flow.name !== name)
+        throw new BundleFailure('bundle_signature_invalid', 'Bundle name does not match the requested flow.');
+    flow.name ??= name;
+    if (metadata.kind !== 'declarative' || flow.steps.some(step => step.type !== 'deterministic'
+        || step.requirements !== undefined) || (flow.triggers?.length ?? 0) > 0
+        || manifest.some(entry => entry.path.startsWith('assets/'))) {
+        throw new BundleFailure('bundle_unsupported', 'This slice runs declarative deterministic bundles without assets, placement requirements, or triggers.');
+    }
+    // Keep existing fail-closed environment checks before transport/journal.
+    // Splitting static and environment checks is follow-up.
+    // This deterministic-only slice declares no project models or executors.
+    // Never discover flows.json in the deployment/cache tree or its ancestors.
+    return checkAuthoredFlow(flow, join(directory, 'spec.canonical.json'), {
+        directory, models: [], executors: [],
+    });
+}
+//# sourceMappingURL=bundle-preflight.js.map

package/dist/cli/bundle-preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-preflight.js","sourceRoot":"","sources":["../../src/cli/bundle-preflight.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAuB,MAAM,YAAY,CAAC;AAEpE;yEACyE;AACzE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,SAAiB,EAAE,IAAY;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACtF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAuB,CAAC;IAC5G,MAAM,IAAI,GAAG,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACxH,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,0BAA0B,EAAE,gDAAgD,CAAC,CAAC;IACzJ,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC;IACnB,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,eAAe;WACrF,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;WACpE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAC1C,wGAAwG,CAAC,CAAC;IAC9G,CAAC;IACD,yEAAyE;IACzE,wDAAwD;IACxD,yEAAyE;IACzE,2EAA2E;IAC3E,OAAO,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,qBAAqB,CAAC,EAAE;QACrE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE;KACrC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/check-helper-body.d.ts

@@ -0,0 +1,4 @@
+import { type CheckExecution } from './check.js';
+/** Imports the definition, but never executes arbitrary authored body code. */
+export declare function checkHelperBody(path: string): Promise<CheckExecution>;
+//# sourceMappingURL=check-helper-body.d.ts.map

package/dist/cli/check-helper-body.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-helper-body.d.ts","sourceRoot":"","sources":["../../src/cli/check-helper-body.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAErE,+EAA+E;AAC/E,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAQ3E"}

package/dist/cli/check-helper-body.js

@@ -0,0 +1,15 @@
+import { loadAuthoredFlow } from '../authored-flow-loader.js';
+import { checkSlackHelpers } from '../slack-preflight.js';
+import { inputFailureReport } from './check.js';
+/** Imports the definition, but never executes arbitrary authored body code. */
+export async function checkHelperBody(path) {
+    try {
+        const { handle, getDefinition } = await loadAuthoredFlow(path);
+        return { report: { ...checkSlackHelpers(getDefinition(handle)), path } };
+    }
+    catch (error) {
+        return { report: inputFailureReport({ kind: 'invalid_spec',
+                message: error instanceof Error ? error.message : 'Could not import authored flow.' }, path) };
+    }
+}
+//# sourceMappingURL=check-helper-body.js.map

package/dist/cli/check-helper-body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-helper-body.js","sourceRoot":"","sources":["../../src/cli/check-helper-body.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAuB,MAAM,YAAY,CAAC;AAErE,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY;IAChD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC/D,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,iBAAiB,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,kBAAkB,CAAC,EAAE,IAAI,EAAE,cAAc;gBACxD,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,iCAAiC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC;IACnG,CAAC;AACH,CAAC"}

package/dist/cli/check-triggers.d.ts

@@ -0,0 +1,14 @@
+import { type LoadedAuthoredFlow } from '../authored-flow-loader.js';
+import { type CheckReport } from './check.js';
+/**
+ * Inspect an authored flow without running a handler or contacting the daemon.
+ * Combines the two authored-only preflight paths that share a loaded flow: the
+ * webhook-trigger check (E) and the f.slack helper check (B). Skipping either
+ * turned this into a silent trapdoor -- a `.flow.ts` using `f.slack.post`
+ * without a token would pass `flows check` and only crash at run.
+ */
+export declare function checkAuthoredTriggers(path: string): Promise<{
+    report: CheckReport;
+    loaded?: LoadedAuthoredFlow;
+}>;
+//# sourceMappingURL=check-triggers.d.ts.map

package/dist/cli/check-triggers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-triggers.d.ts","sourceRoot":"","sources":["../../src/cli/check-triggers.ts"],"names":[],"mappings":"AACA,OAAO,EAAoB,KAAK,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAGvF,OAAO,EAAyC,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAErF;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACjE,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,CAAC,EAAE,kBAAkB,CAAC;CAC7B,CAAC,CAwBD"}

package/dist/cli/check-triggers.js

@@ -0,0 +1,37 @@
+import { dirname, resolve } from 'node:path';
+import { loadAuthoredFlow } from '../authored-flow-loader.js';
+import { preflightWebhookTriggers } from '../preflight.js';
+import { checkSlackHelpers } from '../slack-preflight.js';
+import { inputFailureReport, readProjectConfig } from './check.js';
+/**
+ * Inspect an authored flow without running a handler or contacting the daemon.
+ * Combines the two authored-only preflight paths that share a loaded flow: the
+ * webhook-trigger check (E) and the f.slack helper check (B). Skipping either
+ * turned this into a silent trapdoor -- a `.flow.ts` using `f.slack.post`
+ * without a token would pass `flows check` and only crash at run.
+ */
+export async function checkAuthoredTriggers(path) {
+    try {
+        const loaded = await loadAuthoredFlow(path);
+        const definition = loaded.getDefinition(loaded.handle);
+        const config = readProjectConfig(dirname(resolve(path)));
+        const triggerDiagnostics = preflightWebhookTriggers((definition.handlers ?? []).map(handler => handler.trigger), config.executors);
+        const helperReport = checkSlackHelpers(definition);
+        const diagnostics = [...triggerDiagnostics, ...helperReport.diagnostics];
+        return {
+            loaded,
+            report: {
+                ok: diagnostics.length === 0, path, gates: [], resolutions: [], diagnostics,
+                ...(config.path === undefined ? {} : { projectConfigPath: config.path }),
+            },
+        };
+    }
+    catch (error) {
+        return { report: inputFailureReport({
+                kind: typeof error === 'object' && error !== null && 'kind' in error && error.kind === 'config_invalid'
+                    ? 'config_invalid' : 'invalid_spec',
+                message: error instanceof Error ? error.message : 'Cannot inspect authored triggers',
+            }, path) };
+    }
+}
+//# sourceMappingURL=check-triggers.js.map

package/dist/cli/check-triggers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-triggers.js","sourceRoot":"","sources":["../../src/cli/check-triggers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAA2B,MAAM,4BAA4B,CAAC;AACvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAoB,MAAM,YAAY,CAAC;AAErF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAY;IAItD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzD,MAAM,kBAAkB,GAAG,wBAAwB,CACjD,CAAC,UAAU,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,SAAS,CAC9E,CAAC;QACF,MAAM,YAAY,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,CAAC,GAAG,kBAAkB,EAAE,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;QACzE,OAAO;YACL,MAAM;YACN,MAAM,EAAE;gBACN,EAAE,EAAE,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,WAAW;gBAC3E,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;aACzE;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,kBAAkB,CAAC;gBAClC,IAAI,EAAE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB;oBACrG,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,cAAc;gBACrC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,kCAAkC;aACrF,EAAE,IAAI,CAAC,EAAE,CAAC;IACb,CAAC;AACH,CAAC"}

package/dist/cli/check-typescript.d.ts

@@ -0,0 +1,20 @@
+import type { LoadedPlugin } from '../plugin-loader.js';
+import type { AuthoredFlowDefinition } from '../authored-flow.js';
+import { type McpServerConfig } from '../spec.js';
+import { type CheckReport } from './check.js';
+export interface CheckedMcp {
+    plugins?: readonly LoadedPlugin[];
+    report: CheckReport;
+    servers: Readonly<Record<string, McpServerConfig>>;
+    inventory: Readonly<Record<string, readonly string[]>>;
+}
+export declare function checkTypeScriptFlow(path: string): Promise<{
+    report: CheckReport;
+}>;
+/** Check declarations without executing the authored body. */
+export declare function checkMcpHeader(definition: Pick<AuthoredFlowDefinition, 'name' | 'header'>, path: string): Promise<CheckedMcp>;
+export declare class McpPreflightError extends Error {
+    readonly report: CheckReport;
+    constructor(report: CheckReport);
+}
+//# sourceMappingURL=check-typescript.d.ts.map

package/dist/cli/check-typescript.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-typescript.d.ts","sourceRoot":"","sources":["../../src/cli/check-typescript.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAGlE,OAAO,EAAuB,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EAAyC,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAErF,MAAM,WAAW,UAAU;IACzB,OAAO,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAClC,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IACnD,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;CACxD;AAED,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC,CAOxF;AAED,8DAA8D;AAC9D,wBAAsB,cAAc,CAClC,UAAU,EAAE,IAAI,CAAC,sBAAsB,EAAE,MAAM,GAAG,QAAQ,CAAC,EAC3D,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,UAAU,CAAC,CA4BrB;AAED,qBAAa,iBAAkB,SAAQ,KAAK;IAC9B,QAAQ,CAAC,MAAM,EAAE,WAAW;gBAAnB,MAAM,EAAE,WAAW;CAGzC"}