@rex0220/ksql-flownet 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 rex0220
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.ja.md

@@ -0,0 +1,81 @@
+# kSQL-FlowNet
+
+[English](./README.md) | 日本語
+
+kSQL-FlowNetは、複数の[kSQL-Flow](https://www.npmjs.com/package/@rex0220/ksql-flow)ジョブをnetwork(DAG)として管理するControl Plane CLIです。network定義の検証、業務キー単位のRun一意性、依存関係に基づく直列実行、再開(resume)、Networkロック、状態保存、監査を担当します。分岐・合流を持つDAGを定義できますが、ノードは安定したトポロジカル順で1件ずつ直列実行します。
+
+kintone上の「Run状況」ボードプラグインと操作要求アプリを組み合わせることで、リラン・停止・解除・新規実行(START)を画面から指示できます。
+
+- **導入手順書**: [docs/installation.md](./docs/installation.md)(kintoneアプリ・トークン・プラグイン・サーバー・cronを0から本番運用まで)
+- **仕様・運用文書**: [docs/README.md](./docs/README.md)(統合仕様書・一次対応1ページ・復旧runbook)
+- **kintoneアプリの作成**: [templates/README.md](./templates/README.md)
+- **ボードプラグイン**: [plugin/README.md](./plugin/README.md)
+
+## 動作環境
+
+- kintone(APIトークン・プラグイン・関連レコード・アプリテンプレートを使用)
+- 実行サーバー: Node.js 22以上。通信は実行サーバーからkintoneへのHTTPS発信のみで、kintoneから実行サーバーへの接続はない(受信ポート・固定IP・ドメイン不要)
+- 詳細は[統合仕様書 §2 動作環境](./docs/specification.md)を参照
+
+## インストール
+
+```sh
+npm install --global @rex0220/ksql-flownet
+ksql-flownet --version
+```
+
+kintoneアプリ(同梱テンプレート)・APIトークン・ボードプラグイン・サーバー環境・cronまでの導入手順は[docs/installation.md](./docs/installation.md)にあります。
+
+## 開発
+
+```sh
+npm install
+npm run build
+npm run format:check
+npm run lint
+npm run typecheck
+npm test
+```
+
+## CLIの使い方
+
+```sh
+ksql-flownet --help
+ksql-flownet --version
+ksql-flownet validate path/to/network.yaml
+ksql-flownet poll-requests --check
+```
+
+`validate`は、YAMLスキーマ・DAG規則・参照SQLファイルを、外部状態を変更せずに検証します。
+
+`poll-requests`はkintone操作要求アプリのワンショットポーラーです。`REQUESTED`レコードをclaimし、`RERUN`・`STOP`・`RELEASE`・`START`を実行します。cron等のスケジューラから定期起動してください。設定は[`.env.example`](./.env.example)の`KSQL_FLOWNET_REQUEST_*`と、絶対パスのallowlistで行います:
+
+```yaml
+networks:
+  - network_id: monthly_jobs
+    definition_path: C:/srv/my-ksql-jobs/networks/monthly.yaml
+    app_start: false
+```
+
+`app_start`はfail-closedです。省略は`false`と同じで、明示的なboolean `true`を設定したnetworkだけがSTART要求(アプリからの新規Run起動)の対象になります。このフラグは`RERUN`・`STOP`・`RELEASE`のRun検索対象からnetworkを外しません。
+
+本番スケジュールを有効化する前に`poll-requests --check`を実行してください。これは読み取り専用の事前検査で、allowlistの全network定義と`network_id`を検証し、要求アプリへのGETアクセスを確認します。要求のclaim・更新や子プロセス(`status`・`run-network`・`cancel-run`)の起動は行いません。終了コードが0以外の場合はスケジュールを有効化しないでください。
+
+各ノードは`KSQL_FLOWNET_PROFILE + ":" + nodes[].job_id`が64 UTF-16単位以内である必要があります。これはkSQL-Flowのジョブロックキーの実測上限です。現行の`validate`は超過を検出せず、実行時に`VALIDATION_ERROR`で失敗します。
+
+WindowsでkSQL-Flowのソースビルドに対して`run-network`を実行する場合は、実行ファイルと先頭のCLIスクリプト引数を分けて設定します。引数に空白が含まれる場合はJSON配列形式を使ってください:
+
+```powershell
+$env:KSQL_FLOW_BIN = 'node.exe'
+$env:KSQL_FLOW_BIN_ARGS = '["C:\\path\\to\\ksql-flow\\dist\\cli.js"]'
+```
+
+`KSQL_FLOW_BIN_ARGS`は空白区切りの引数も受け付けます。スタンドアロン実行ファイルを使う場合は、`KSQL_FLOW_BIN`へ実行ファイルを指定し、`KSQL_FLOW_BIN_ARGS`は未設定にできます。
+
+## 実機E2E
+
+[`tests/e2e/README.md`](./tests/e2e/README.md)に記載の実機環境を設定したうえで、各シナリオをPowerShellから直列に実行します。これらは設定済みのkintoneとkSQL-Flow環境へアクセスするため、CIでは実行しないでください。各シナリオは`tests/e2e/results/`へサニタイズ済みの結果JSONを書き出し、自分のスコープの状態を清掃します。
+
+## ライセンス
+
+MIT。[LICENSE](./LICENSE)を参照してください。

package/README.md

@@ -0,0 +1,117 @@
+# kSQL-FlowNet
+
+English | [日本語](./README.ja.md)
+
+kSQL-FlowNet is a Control Plane CLI that manages multiple
+[kSQL-Flow](https://www.npmjs.com/package/@rex0220/ksql-flow) jobs as a network
+(DAG). It handles network-definition validation, Run uniqueness per business
+key, dependency-ordered serial execution, resume, network locks, state
+persistence, and audit trails. Networks may declare branching and joining DAGs,
+but nodes execute one at a time in a stable topological order.
+
+Combined with the "Run status" board plugin and the operation-request app on
+kintone, operators can trigger rerun, stop, release, and new-run (START)
+requests from the UI.
+
+- **Installation guide**: [docs/installation.md](./docs/installation.md)
+  (kintone apps, tokens, plugin, server, cron — from zero to production)
+- **Specification and operations docs**: [docs/README.md](./docs/README.md)
+  (integrated specification, first-response one-pager, recovery runbook)
+- **Creating the kintone apps**: [templates/README.md](./templates/README.md)
+- **Board plugin**: [plugin/README.md](./plugin/README.md)
+
+## Requirements
+
+- kintone (uses API tokens, a plugin, related records, and app templates)
+- An execution server with Node.js 22 or later. All traffic is outbound HTTPS
+  from the server to kintone; kintone never connects to the server (no inbound
+  port, static IP, or domain required)
+- See [Specification §2 (environment)](./docs/specification.md) for details
+
+## Installation
+
+```sh
+npm install --global @rex0220/ksql-flownet
+ksql-flownet --version
+```
+
+The full setup (kintone apps from the bundled app template, API tokens,
+the board plugin, server environment, cron) is in
+[docs/installation.md](./docs/installation.md).
+
+## Development
+
+```sh
+npm install
+npm run build
+npm run format:check
+npm run lint
+npm run typecheck
+npm test
+```
+
+## CLI usage
+
+```sh
+ksql-flownet --help
+ksql-flownet --version
+ksql-flownet validate path/to/network.yaml
+ksql-flownet poll-requests --check
+```
+
+`validate` checks the YAML schema, DAG rules, and referenced SQL files without
+changing external state.
+
+`poll-requests` is a one-shot poller for the kintone operation-request app. It
+claims `REQUESTED` records and performs `RERUN`, `STOP`, `RELEASE`, or `START`;
+start it periodically from a scheduler such as cron. Configure it through the
+`KSQL_FLOWNET_REQUEST_*` entries in [`.env.example`](./.env.example) and an
+absolute-path allowlist such as:
+
+```yaml
+networks:
+  - network_id: monthly_jobs
+    definition_path: C:/srv/my-ksql-jobs/networks/monthly.yaml
+    app_start: false
+```
+
+`app_start` is fail-closed: omitting it is equivalent to `false`, and only an
+explicit boolean `true` enables START requests (launching a new Run from the
+app) for that network. This flag does not remove the network from run lookup
+for `RERUN`, `STOP`, or `RELEASE`.
+
+Before enabling a production schedule, run `poll-requests --check`. This is a
+read-only preflight: it validates every allowlisted network definition and its
+`network_id`, then confirms GET access to the request app. It does not claim or
+update requests and does not start `status`, `run-network`, or `cancel-run`
+children. A nonzero exit must block schedule activation.
+
+Each network node must also satisfy
+`KSQL_FLOWNET_PROFILE + ":" + nodes[].job_id` <= 64 UTF-16 code units. This is
+the measured kSQL-Flow job-lock-key limit. The current `validate` command does
+not detect an overrun; execution fails later with `VALIDATION_ERROR`.
+
+To run `run-network` against a source build of kSQL-Flow on Windows, set the
+executable and its leading CLI-script argument separately. Use the JSON array
+form when an argument contains spaces:
+
+```powershell
+$env:KSQL_FLOW_BIN = 'node.exe'
+$env:KSQL_FLOW_BIN_ARGS = '["C:\\path\\to\\ksql-flow\\dist\\cli.js"]'
+```
+
+`KSQL_FLOW_BIN_ARGS` also accepts whitespace-separated arguments. When using
+the standalone executable, point `KSQL_FLOW_BIN` at it and leave
+`KSQL_FLOW_BIN_ARGS` unset.
+
+## Real-device E2E
+
+After configuring the real-device environment described in
+[`tests/e2e/README.md`](./tests/e2e/README.md), run the scenarios serially from
+PowerShell. They access the configured kintone and kSQL-Flow environment and
+must not run in CI. Each scenario writes a sanitized result JSON under
+`tests/e2e/results/` and cleans up its own scoped state.
+
+## License
+
+MIT. See [LICENSE](./LICENSE).

package/dist/bundle/bundle-builder.d.ts

@@ -0,0 +1,49 @@
+import type { ApprovedInspectionException, InspectedNode } from "../executor/preflight.js";
+export interface BundleJobInput {
+    readonly path: string;
+    readonly sqlBytes: Uint8Array;
+    /** Validated result returned by validateJobInspections. */
+    readonly inspectedNode: InspectedNode;
+}
+export interface BundleFileManifest {
+    readonly path: string;
+    readonly byteLength: number;
+    readonly sha256: string;
+    readonly nodeId?: string;
+    readonly jobId?: string;
+    readonly nondeterministicCodes?: readonly string[];
+    readonly approvedExceptions?: readonly ApprovedInspectionException[];
+}
+export interface BundleManifest {
+    readonly formatVersion: 1;
+    readonly kind: "EXECUTION_BUNDLE_MANIFEST";
+    readonly files: readonly BundleFileManifest[];
+}
+export interface BuildBundleInput {
+    readonly networkYamlBytes: Uint8Array;
+    readonly jobs: readonly BundleJobInput[];
+}
+export interface BuildBundleResult {
+    readonly zipBytes: Buffer;
+    readonly zipSha256: string;
+    readonly manifest: BundleManifest;
+    readonly manifestSha256: string;
+}
+export interface VerifyBundleExpectations {
+    readonly zipSha256?: string;
+    readonly manifestSha256?: string;
+    readonly manifest?: BundleManifest;
+}
+export interface VerifyBundleResult {
+    readonly zipSha256: string;
+    readonly manifestSha256: string;
+    readonly manifest: BundleManifest;
+}
+export type BundleErrorCode = "BUNDLE_INPUT_INVALID" | "BUNDLE_ZIP_INVALID" | "BUNDLE_HASH_MISMATCH" | "BUNDLE_MANIFEST_INVALID" | "BUNDLE_FILE_MISMATCH";
+export declare class BundleError extends Error {
+    readonly code: BundleErrorCode;
+    constructor(code: BundleErrorCode, message: string, options?: ErrorOptions);
+}
+export declare function buildBundle(input: BuildBundleInput): BuildBundleResult;
+export declare function verifyBundle(zipInput: Uint8Array, expected?: VerifyBundleExpectations): VerifyBundleResult;
+//# sourceMappingURL=bundle-builder.d.ts.map

package/dist/bundle/bundle-builder.js

@@ -0,0 +1,208 @@
+import { canonicalJson, sha256Hex } from "../executor/preflight.js";
+import { createStoreZip, readStoreZip } from "./zip-store.js";
+export class BundleError extends Error {
+    code;
+    constructor(code, message, options) {
+        super(message, options);
+        this.code = code;
+        this.name = "BundleError";
+    }
+}
+export function buildBundle(input) {
+    if (input.jobs.length === 0) {
+        throw new BundleError("BUNDLE_INPUT_INVALID", "execution bundle requires at least one SQL job");
+    }
+    const sortedJobs = [...input.jobs].sort((left, right) => compareText(left.path, right.path));
+    const seenPaths = new Set();
+    const files = [
+        fileManifest("network.yaml", input.networkYamlBytes),
+    ];
+    const zipEntries = [
+        { name: "network.yaml", data: input.networkYamlBytes },
+    ];
+    for (const job of sortedJobs) {
+        validateJobInput(job, seenPaths);
+        const approvedExceptions = [...job.inspectedNode.approvedExceptions].sort((left, right) => compareText(exceptionSortKey(left), exceptionSortKey(right)));
+        files.push({
+            ...fileManifest(job.path, job.sqlBytes),
+            nodeId: job.inspectedNode.nodeId,
+            jobId: job.inspectedNode.jobId,
+            nondeterministicCodes: [
+                ...new Set(job.inspectedNode.nondeterministicCodes),
+            ].sort(),
+            approvedExceptions,
+        });
+        zipEntries.push({ name: job.path, data: job.sqlBytes });
+    }
+    const manifest = {
+        formatVersion: 1,
+        kind: "EXECUTION_BUNDLE_MANIFEST",
+        files,
+    };
+    const manifestBytes = Buffer.from(canonicalJson(manifest), "utf8");
+    const zipBytes = createStoreZip([
+        ...zipEntries,
+        { name: "manifest.json", data: manifestBytes },
+    ]);
+    return {
+        zipBytes,
+        zipSha256: sha256Hex(zipBytes),
+        manifest,
+        manifestSha256: sha256Hex(manifestBytes),
+    };
+}
+export function verifyBundle(zipInput, expected = {}) {
+    const zipBytes = Buffer.from(zipInput);
+    const zipSha256 = sha256Hex(zipBytes);
+    if (expected.zipSha256 !== undefined && zipSha256 !== expected.zipSha256) {
+        throw new BundleError("BUNDLE_HASH_MISMATCH", "execution bundle ZIP SHA-256 does not match");
+    }
+    let entries;
+    try {
+        entries = readStoreZip(zipBytes);
+    }
+    catch (error) {
+        throw new BundleError("BUNDLE_ZIP_INVALID", "execution bundle ZIP is invalid", {
+            cause: error,
+        });
+    }
+    const entryMap = new Map(entries.map((entry) => [entry.name, entry.data]));
+    const manifestBytes = entryMap.get("manifest.json");
+    if (manifestBytes === undefined) {
+        throw new BundleError("BUNDLE_MANIFEST_INVALID", "execution bundle has no manifest.json");
+    }
+    const manifestSha256 = sha256Hex(manifestBytes);
+    if (expected.manifestSha256 !== undefined &&
+        manifestSha256 !== expected.manifestSha256) {
+        throw new BundleError("BUNDLE_HASH_MISMATCH", "execution bundle manifest SHA-256 does not match");
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(manifestBytes.toString("utf8"));
+    }
+    catch (error) {
+        throw new BundleError("BUNDLE_MANIFEST_INVALID", "execution bundle manifest is not valid JSON", { cause: error });
+    }
+    if (!isBundleManifest(parsed)) {
+        throw new BundleError("BUNDLE_MANIFEST_INVALID", "execution bundle manifest shape is invalid");
+    }
+    if (canonicalJson(parsed) !== manifestBytes.toString("utf8")) {
+        throw new BundleError("BUNDLE_MANIFEST_INVALID", "execution bundle manifest is not canonical JSON");
+    }
+    if (expected.manifest !== undefined &&
+        canonicalJson(parsed) !== canonicalJson(expected.manifest)) {
+        throw new BundleError("BUNDLE_MANIFEST_INVALID", "execution bundle manifest content does not match expected manifest");
+    }
+    const manifestPaths = new Set();
+    for (const file of parsed.files) {
+        if (manifestPaths.has(file.path)) {
+            throw new BundleError("BUNDLE_MANIFEST_INVALID", `manifest contains duplicate path '${file.path}'`);
+        }
+        manifestPaths.add(file.path);
+        const bytes = entryMap.get(file.path);
+        if (bytes === undefined ||
+            bytes.length !== file.byteLength ||
+            sha256Hex(bytes) !== file.sha256) {
+            throw new BundleError("BUNDLE_FILE_MISMATCH", `bundle file '${file.path}' does not match its manifest`);
+        }
+    }
+    if (!manifestPaths.has("network.yaml")) {
+        throw new BundleError("BUNDLE_MANIFEST_INVALID", "manifest does not contain network.yaml");
+    }
+    const unexpectedEntries = entries
+        .map((entry) => entry.name)
+        .filter((name) => name !== "manifest.json" && !manifestPaths.has(name));
+    if (unexpectedEntries.length > 0 ||
+        entries.length !== parsed.files.length + 1) {
+        throw new BundleError("BUNDLE_FILE_MISMATCH", `bundle has entries not represented by the manifest: ${unexpectedEntries.join(", ")}`);
+    }
+    return { zipSha256, manifestSha256, manifest: parsed };
+}
+function fileManifest(path, bytes) {
+    return { path, byteLength: bytes.byteLength, sha256: sha256Hex(bytes) };
+}
+function validateJobInput(job, seenPaths) {
+    if (!/^jobs\/[A-Za-z0-9._-]+\.sql$/u.test(job.path) ||
+        job.path.includes("..") ||
+        job.inspectedNode.nodeId.trim() === "" ||
+        job.inspectedNode.jobId.trim() === "") {
+        throw new BundleError("BUNDLE_INPUT_INVALID", `bundle job input is invalid for '${job.path}'`);
+    }
+    if (seenPaths.has(job.path)) {
+        throw new BundleError("BUNDLE_INPUT_INVALID", `bundle job path is duplicated: '${job.path}'`);
+    }
+    seenPaths.add(job.path);
+    if (job.inspectedNode.inspection.jobId !== job.inspectedNode.jobId) {
+        throw new BundleError("BUNDLE_INPUT_INVALID", `inspected job ID does not match preflight result for '${job.inspectedNode.nodeId}'`);
+    }
+    for (const exception of job.inspectedNode.approvedExceptions) {
+        if (exception.node_id !== job.inspectedNode.nodeId ||
+            !job.inspectedNode.nondeterministicCodes.includes(exception.code)) {
+            throw new BundleError("BUNDLE_INPUT_INVALID", `approved exception does not match inspected job '${job.inspectedNode.nodeId}'`);
+        }
+    }
+}
+function exceptionSortKey(exception) {
+    return [
+        exception.node_id,
+        exception.code,
+        exception.approved_by,
+        exception.approved_at,
+        exception.reason,
+    ].join("\0");
+}
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isBundleManifest(value) {
+    return (isRecord(value) &&
+        value.formatVersion === 1 &&
+        value.kind === "EXECUTION_BUNDLE_MANIFEST" &&
+        Array.isArray(value.files) &&
+        value.files.length > 0 &&
+        value.files.every(isBundleFileManifest));
+}
+function isBundleFileManifest(value) {
+    if (!isRecord(value) ||
+        typeof value.path !== "string" ||
+        !Number.isSafeInteger(value.byteLength) ||
+        value.byteLength < 0 ||
+        typeof value.sha256 !== "string" ||
+        !/^[a-f0-9]{64}$/u.test(value.sha256)) {
+        return false;
+    }
+    if (value.path === "network.yaml") {
+        return (value.nodeId === undefined &&
+            value.jobId === undefined &&
+            value.nondeterministicCodes === undefined &&
+            value.approvedExceptions === undefined);
+    }
+    if (!/^jobs\/[A-Za-z0-9._-]+\.sql$/u.test(value.path) ||
+        typeof value.nodeId !== "string" ||
+        typeof value.jobId !== "string" ||
+        !Array.isArray(value.nondeterministicCodes) ||
+        !value.nondeterministicCodes.every((code) => typeof code === "string") ||
+        !Array.isArray(value.approvedExceptions) ||
+        !value.approvedExceptions.every(isApprovedException)) {
+        return false;
+    }
+    const codes = value.nondeterministicCodes;
+    const exceptions = value.approvedExceptions;
+    return exceptions.every((exception) => exception.node_id === value.nodeId && codes.includes(exception.code));
+}
+function isApprovedException(value) {
+    return (isRecord(value) &&
+        typeof value.node_id === "string" &&
+        value.code === "KSQL1306" &&
+        typeof value.approved_by === "string" &&
+        typeof value.reason === "string" &&
+        typeof value.approved_at === "string");
+}
+function compareText(left, right) {
+    if (left < right)
+        return -1;
+    if (left > right)
+        return 1;
+    return 0;
+}
+//# sourceMappingURL=bundle-builder.js.map

package/dist/bundle/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./bundle-builder.js";
+export * from "./upload.js";
+export * from "./zip-store.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/bundle/index.js

@@ -0,0 +1,4 @@
+export * from "./bundle-builder.js";
+export * from "./upload.js";
+export * from "./zip-store.js";
+//# sourceMappingURL=index.js.map

package/dist/bundle/upload.d.ts

@@ -0,0 +1,28 @@
+export type BundleFetch = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+export interface UploadBundleOptions {
+    readonly endpoint: string;
+    readonly zipBytes: Uint8Array;
+    readonly fetch: BundleFetch;
+    readonly filename?: string;
+    readonly headers?: Readonly<Record<string, string>>;
+}
+export interface DownloadBundleOptions {
+    readonly endpoint: string;
+    readonly fileKey: string;
+    readonly fetch: BundleFetch;
+    readonly headers?: Readonly<Record<string, string>>;
+}
+export declare class BundleUploadError extends Error {
+    readonly code = "BUNDLE_UPLOAD_FAILED";
+    constructor(message: string, options?: ErrorOptions);
+}
+/**
+ * Uploads one bundle and returns the newly issued attachment fileKey.
+ *
+ * kintone upload fileKey values are single-use for attachment. Every attach or
+ * re-attach must call this helper again; callers must never cache or reuse a
+ * previously consumed fileKey (D-12).
+ */
+export declare function uploadBundle(options: UploadBundleOptions): Promise<string>;
+export declare function downloadBundle(options: DownloadBundleOptions): Promise<Buffer>;
+//# sourceMappingURL=upload.d.ts.map

package/dist/bundle/upload.js

@@ -0,0 +1,72 @@
+export class BundleUploadError extends Error {
+    code = "BUNDLE_UPLOAD_FAILED";
+    constructor(message, options) {
+        super(message, options);
+        this.name = "BundleUploadError";
+    }
+}
+/**
+ * Uploads one bundle and returns the newly issued attachment fileKey.
+ *
+ * kintone upload fileKey values are single-use for attachment. Every attach or
+ * re-attach must call this helper again; callers must never cache or reuse a
+ * previously consumed fileKey (D-12).
+ */
+export async function uploadBundle(options) {
+    const body = new FormData();
+    body.append("file", new Blob([Buffer.from(options.zipBytes)], { type: "application/zip" }), options.filename ?? "execution-bundle.zip");
+    let response;
+    try {
+        response = await options.fetch(options.endpoint, {
+            method: "POST",
+            ...(options.headers === undefined ? {} : { headers: options.headers }),
+            body,
+        });
+    }
+    catch (error) {
+        throw new BundleUploadError("bundle upload request failed", {
+            cause: error,
+        });
+    }
+    if (!response.ok) {
+        throw new BundleUploadError(`bundle upload returned HTTP ${response.status}`);
+    }
+    let value;
+    try {
+        value = await response.json();
+    }
+    catch (error) {
+        throw new BundleUploadError("bundle upload returned invalid JSON", {
+            cause: error,
+        });
+    }
+    if (value === null ||
+        typeof value !== "object" ||
+        !("fileKey" in value) ||
+        typeof value.fileKey !== "string" ||
+        value.fileKey === "") {
+        throw new BundleUploadError("bundle upload response has no fileKey");
+    }
+    return value.fileKey;
+}
+export async function downloadBundle(options) {
+    const url = new URL(options.endpoint);
+    url.searchParams.set("fileKey", options.fileKey);
+    let response;
+    try {
+        response = await options.fetch(url, {
+            method: "GET",
+            ...(options.headers === undefined ? {} : { headers: options.headers }),
+        });
+    }
+    catch (error) {
+        throw new BundleUploadError("bundle download request failed", {
+            cause: error,
+        });
+    }
+    if (!response.ok) {
+        throw new BundleUploadError(`bundle download returned HTTP ${response.status}`);
+    }
+    return Buffer.from(await response.arrayBuffer());
+}
+//# sourceMappingURL=upload.js.map

package/dist/bundle/zip-store.d.ts

@@ -0,0 +1,17 @@
+export interface StoreZipEntry {
+    readonly name: string;
+    readonly data: Uint8Array;
+}
+export interface ReadStoreZipEntry {
+    readonly name: string;
+    readonly data: Buffer;
+    readonly crc32: number;
+}
+export declare class StoreZipError extends Error {
+    constructor(message: string);
+}
+/** Store-only ZIP with fixed zero DOS timestamps and caller-defined entry order. */
+export declare function createStoreZip(entries: readonly StoreZipEntry[]): Buffer;
+export declare function readStoreZip(input: Uint8Array): readonly ReadStoreZipEntry[];
+export declare function crc32(input: Uint8Array): number;
+//# sourceMappingURL=zip-store.d.ts.map