@sverka/sdk 0.0.0 → 0.1.2

package/dist/index.mjs

@@ -0,0 +1,2216 @@
+import { existsSync, mkdtempSync, readFileSync, realpathSync } from "node:fs";
+import path, { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { createHash } from "node:crypto";
+import { spawn } from "node:child_process";
+import { AgentStep, ComponentStep, CompositionError, CoreError, Pipeline, PipelineCallStep, PlanningError, ShellStep, canonicalStringify, computeGraphId, computePlanId, computePlanId as computePlanId$1, computeRunPlanId, expandPipelineCalls, matrix, parallel, pipeline, run, validateGraph, validatePlan, validatePlan as validatePlan$1, when, workflow, workflow as workflow$1 } from "@sverka/workflow";
+import { CheckError, DEFAULT_POLICY, DEFAULT_POLICY as DEFAULT_POLICY$1, computeFingerprint, createBaseline, createBuiltinResolver, createBuiltinResolver as createBuiltinResolver$1, createPolicy, createPolicy as createPolicy$1, evaluatePolicy, evaluatePolicy as evaluatePolicy$1, extractFindings, extractFindings as extractFindings$1, filterOnlyNew, filterOnlyNew as filterOnlyNew$1, loadBaseline, loadBaseline as loadBaseline$1, normalizeSarif, saveBaseline, updateBaseline } from "@sverka/verification";
+import { pathToFileURL } from "node:url";
+import { rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+//#region src/planner/internal/git-cli.ts
+/**
+* Resolve the absolute path to the `git` executable by searching `PATH`
+* at this trusted parent level. The spawned child receives a minimal
+* environment without `PATH`, mitigating PATH-injection hotspots.
+*/
+function resolveGitBinary() {
+	const pathEnv = process.env.PATH ?? "";
+	for (const dir of pathEnv.split(path.delimiter)) {
+		if (!dir) continue;
+		const candidate = path.join(dir, "git");
+		if (existsSync(candidate)) return candidate;
+	}
+	return "git";
+}
+const GIT_BINARY = resolveGitBinary();
+/**
+* Default `GitCli` implementation backed by `node:child_process.spawn`.
+*/
+function createGitCli() {
+	return { run(args, cwd) {
+		return new Promise((resolvePromise, reject) => {
+			const env = {
+				HOME: process.env.HOME,
+				GIT_TERMINAL_PROMPT: "0"
+			};
+			const child = spawn(GIT_BINARY, [...args], {
+				cwd,
+				env,
+				stdio: [
+					"ignore",
+					"pipe",
+					"pipe"
+				]
+			});
+			let stdout = "";
+			let stderr = "";
+			child.stdout?.on("data", (data) => {
+				stdout += data.toString();
+			});
+			child.stderr?.on("data", (data) => {
+				stderr += data.toString();
+			});
+			child.on("error", (err) => {
+				reject(err);
+			});
+			child.on("close", (code) => {
+				if (code === 0) resolvePromise(stdout);
+				else reject(new Error(`git ${args.join(" ")} exited ${code ?? -1}`, stderr.trim() ? { cause: stderr.trim() } : void 0));
+			});
+		});
+	} };
+}
+//#endregion
+//#region src/planner/detect.ts
+const MANIFEST_FILES = /* @__PURE__ */ new Set([
+	"package.json",
+	"pyproject.toml",
+	"Cargo.toml",
+	"go.mod",
+	"pom.xml",
+	"build.gradle",
+	"composer.json"
+]);
+const LOCKFILE_MAP = {
+	"bun.lock": "bun",
+	"bun.lockb": "bun",
+	"package-lock.json": "npm",
+	"yarn.lock": "yarn",
+	"pnpm-lock.yaml": "pnpm",
+	"poetry.lock": "poetry",
+	"Cargo.lock": "cargo",
+	"go.sum": "go"
+};
+const MONOREPO_MARKER_FILES = {
+	"nx.json": "nx",
+	"turbo.json": "turborepo",
+	"lerna.json": "lerna",
+	"pnpm-workspace.yaml": "pnpm-workspace"
+};
+/**
+* Detect local signals from a file list. Pure: no I/O.
+*/
+function detectSignals(files) {
+	const signals = [];
+	for (const file of files) {
+		const base = basename$1(file);
+		if (MANIFEST_FILES.has(base)) {
+			signals.push({
+				type: "manifest",
+				path: file,
+				detail: null,
+				confidence: 1
+			});
+			continue;
+		}
+		if (Object.hasOwn(LOCKFILE_MAP, base)) {
+			signals.push({
+				type: "lockfile",
+				path: file,
+				detail: null,
+				confidence: 1
+			});
+			continue;
+		}
+		if (base === "Dockerfile" || base.endsWith(".Dockerfile")) {
+			signals.push({
+				type: "dockerfile",
+				path: file,
+				detail: null,
+				confidence: 1
+			});
+			continue;
+		}
+		if (base === "docker-compose.yml" || base === "docker-compose.yaml") {
+			signals.push({
+				type: "docker-compose",
+				path: file,
+				detail: null,
+				confidence: 1
+			});
+			continue;
+		}
+		if (isCiDefinition(file, base)) {
+			signals.push({
+				type: "ci-definition",
+				path: file,
+				detail: null,
+				confidence: 1
+			});
+			continue;
+		}
+		if (Object.hasOwn(MONOREPO_MARKER_FILES, base)) signals.push({
+			type: "monorepo-marker",
+			path: file,
+			detail: null,
+			confidence: 1
+		});
+	}
+	return signals;
+}
+function isCiDefinition(file, base) {
+	if (base === ".gitlab-ci.yml" || base === "azure-pipelines.yml" || base === "Jenkinsfile") return true;
+	if (file.startsWith(".github/workflows/") && (base.endsWith(".yml") || base.endsWith(".yaml"))) return true;
+	if (file.startsWith(".circleci/")) return true;
+	return false;
+}
+const EXTENSION_MAP = {
+	".ts": "TypeScript",
+	".tsx": "TypeScript",
+	".js": "JavaScript",
+	".jsx": "JavaScript",
+	".mjs": "JavaScript",
+	".cjs": "JavaScript",
+	".py": "Python",
+	".rs": "Rust",
+	".go": "Go",
+	".java": "Java",
+	".kt": "Kotlin",
+	".rb": "Ruby",
+	".php": "PHP",
+	".cs": "C#",
+	".cpp": "C++",
+	".cc": "C++",
+	".cxx": "C++",
+	".c": "C",
+	".h": "C",
+	".hpp": "C++",
+	".swift": "Swift",
+	".scala": "Scala",
+	".sh": "Shell",
+	".bash": "Shell"
+};
+function detectLanguages(files) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const file of files) {
+		const ext = extname(file);
+		const lang = EXTENSION_MAP[ext];
+		if (!lang) continue;
+		const entry = counts.get(lang);
+		if (entry) entry.push(ext);
+		else counts.set(lang, [ext]);
+	}
+	const out = [];
+	for (const [name, exts] of counts) {
+		const fileCount = exts.length;
+		const confidence = Math.min(1, fileCount / 10);
+		out.push({
+			name,
+			confidence,
+			evidence: [...new Set(exts)],
+			fileCount
+		});
+	}
+	out.sort((a, b) => b.fileCount - a.fileCount || a.name.localeCompare(b.name));
+	return out;
+}
+const MANIFEST_PACKAGE_MANAGER = {
+	"go.mod": "go",
+	"Cargo.toml": "cargo"
+};
+function detectPackageManagers(signals, rootPkgJson) {
+	const byName = /* @__PURE__ */ new Map();
+	collectLockfilePackageManagers(signals, byName);
+	collectManifestPackageManagers(signals, byName);
+	applyPackageManagerField(rootPkgJson, byName);
+	return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+/** Populate `byName` from lockfile signals. */
+function collectLockfilePackageManagers(signals, byName) {
+	for (const sig of signals) {
+		if (sig.type !== "lockfile") continue;
+		const base = basename$1(sig.path);
+		const name = LOCKFILE_MAP[base];
+		if (!name) {
+			const other = byName.get("other");
+			if (other) other.evidence.push(sig.path);
+			else byName.set("other", {
+				name: "other",
+				version: null,
+				lockfile: sig.path,
+				evidence: [sig.path]
+			});
+			continue;
+		}
+		const existing = byName.get(name);
+		if (existing) {
+			if (!existing.evidence.includes(sig.path)) existing.evidence.push(sig.path);
+		} else byName.set(name, {
+			name,
+			version: null,
+			lockfile: sig.path,
+			evidence: [sig.path]
+		});
+	}
+}
+/** Populate `byName` from manifest signals for ecosystems without a lockfile or when the manifest is the primary signal. */
+function collectManifestPackageManagers(signals, byName) {
+	for (const sig of signals) {
+		if (sig.type !== "manifest") continue;
+		const base = basename$1(sig.path);
+		const name = MANIFEST_PACKAGE_MANAGER[base];
+		if (!name || byName.has(name)) continue;
+		byName.set(name, {
+			name,
+			version: null,
+			lockfile: null,
+			evidence: [sig.path]
+		});
+	}
+}
+/** Apply the `packageManager` field override from the root package.json. */
+function applyPackageManagerField(rootPkgJson, byName) {
+	if (!rootPkgJson) return;
+	const pm = rootPkgJson["packageManager"];
+	if (typeof pm !== "string") return;
+	const { tool, version } = parsePackageManager(pm);
+	if (!tool) return;
+	const existing = byName.get(tool);
+	if (existing) {
+		existing.version = version;
+		if (!existing.evidence.includes("package.json#packageManager")) existing.evidence.push("package.json#packageManager");
+	} else byName.set(tool, {
+		name: tool,
+		version,
+		lockfile: null,
+		evidence: ["package.json#packageManager"]
+	});
+}
+function parsePackageManager(pm) {
+	const atIdx = pm.indexOf("@");
+	if (atIdx <= 0) return {
+		tool: null,
+		version: null
+	};
+	const toolName = pm.slice(0, atIdx);
+	const version = pm.slice(atIdx + 1) || null;
+	if (![
+		"npm",
+		"yarn",
+		"pnpm",
+		"bun",
+		"pip",
+		"poetry",
+		"uv",
+		"pipenv",
+		"cargo",
+		"go",
+		"maven",
+		"gradle",
+		"composer",
+		"other"
+	].includes(toolName)) return {
+		tool: null,
+		version
+	};
+	return {
+		tool: toolName,
+		version
+	};
+}
+function detectMonorepo(signals, rootPkgJson) {
+	const globs = rootPkgJson ? extractWorkspaceGlobs(rootPkgJson["workspaces"]) : [];
+	const workspaces = resolveWorkspaceDirs(signals, globs);
+	for (const sig of signals) {
+		if (sig.type !== "monorepo-marker") continue;
+		const base = basename$1(sig.path);
+		const tool = MONOREPO_MARKER_FILES[base];
+		if (tool) return {
+			tool,
+			workspaces,
+			evidence: globs.length > 0 ? [sig.path, "package.json#workspaces"] : [sig.path]
+		};
+	}
+	if (globs.length > 0 && rootPkgJson) return {
+		tool: isBunWorkspace(rootPkgJson) ? "bun-workspace" : "custom",
+		workspaces,
+		evidence: ["package.json#workspaces"]
+	};
+	return null;
+}
+/**
+* Resolve workspace globs to concrete workspace dirs using manifest signals.
+* A dir is a workspace when `<dir>/package.json` appears as a manifest and
+* `<dir>` matches a workspace glob (`*` = one path segment, `**` = any depth).
+*/
+function resolveWorkspaceDirs(signals, globs) {
+	const positive = globs.filter((g) => !g.startsWith("!"));
+	const negative = globs.filter((g) => g.startsWith("!")).map((g) => g.slice(1));
+	const dirs = /* @__PURE__ */ new Set();
+	for (const sig of signals) {
+		if (sig.type !== "manifest" || !sig.path.endsWith("/package.json")) continue;
+		const dir = sig.path.slice(0, sig.path.length - 13);
+		if (positive.some((g) => matchesWorkspaceGlob(dir, g)) && !negative.some((g) => matchesWorkspaceGlob(dir, g))) dirs.add(dir);
+	}
+	return [...dirs].sort((a, b) => a.localeCompare(b));
+}
+function matchesWorkspaceGlob(dir, glob) {
+	const d = dir.split("/");
+	const g = glob.split("/");
+	const memo = /* @__PURE__ */ new Map();
+	const match = (di, gi) => {
+		const key = `${di}:${gi}`;
+		const cached = memo.get(key);
+		if (cached !== void 0) return cached;
+		let result;
+		if (gi === g.length) result = di === d.length;
+		else if (g[gi] === "**") {
+			result = false;
+			for (let k = di; k <= d.length && !result; k++) result = match(k, gi + 1);
+		} else result = di < d.length && matchesGlobSegment(d[di], g[gi]) && match(di + 1, gi + 1);
+		memo.set(key, result);
+		return result;
+	};
+	return match(0, 0);
+}
+function matchesGlobSegment(segment, pattern) {
+	let s = 0;
+	let p = 0;
+	let starP = -1;
+	let starS = -1;
+	while (s < segment.length) if (p < pattern.length && (pattern[p] === "?" || pattern[p] === segment[s])) {
+		s++;
+		p++;
+	} else if (p < pattern.length && pattern[p] === "*") {
+		starP = p++;
+		starS = s;
+	} else if (starP !== -1) {
+		p = starP + 1;
+		s = ++starS;
+	} else return false;
+	while (p < pattern.length && pattern[p] === "*") p++;
+	return p === pattern.length;
+}
+function extractWorkspaceGlobs(ws) {
+	if (Array.isArray(ws)) return ws.filter((g) => typeof g === "string");
+	if (typeof ws === "object" && ws !== null) {
+		const packages = ws["packages"];
+		if (Array.isArray(packages)) return packages.filter((g) => typeof g === "string");
+	}
+	return [];
+}
+function isBunWorkspace(pkgJson) {
+	const pm = pkgJson["packageManager"];
+	return typeof pm === "string" && pm.startsWith("bun");
+}
+function basename$1(path) {
+	const idx = path.lastIndexOf("/");
+	return idx >= 0 ? path.slice(idx + 1) : path;
+}
+function extname(path) {
+	const base = basename$1(path);
+	const idx = base.lastIndexOf(".");
+	return idx >= 0 ? base.slice(idx) : "";
+}
+//#endregion
+//#region src/planner/explain.ts
+const SIGNAL_TYPES = [
+	"manifest",
+	"lockfile",
+	"dockerfile",
+	"docker-compose",
+	"ci-definition",
+	"monorepo-marker",
+	"git-metadata"
+];
+/**
+* Build a `DiscoveryExplanation` from the collected signals. Pure.
+*/
+function buildExplanation(signals, opts) {
+	const counts = {};
+	for (const t of SIGNAL_TYPES) counts[t] = 0;
+	for (const sig of signals) counts[sig.type] = (counts[sig.type] ?? 0) + 1;
+	const parts = [];
+	const total = signals.length;
+	parts.push(`${total} signal${total === 1 ? "" : "s"}`);
+	const nonzero = SIGNAL_TYPES.filter((t) => counts[t] > 0);
+	if (nonzero.length) parts.push(`(${formatSignalCounts(nonzero, counts)})`);
+	if (opts.dirty) parts.push("working tree dirty");
+	else parts.push("working tree clean");
+	if (!opts.hasBaseRef) parts.push("no baseRef provided");
+	return {
+		summary: parts.join(" "),
+		signalCounts: counts
+	};
+}
+/** Format non-zero signal counts as "type=count, type=count". */
+function formatSignalCounts(types, counts) {
+	return types.map((t) => t + "=" + counts[t]).join(", ");
+}
+//#endregion
+//#region src/planner/errors.ts
+/**
+* Base error class for the planner package. All discovery failures throw a
+* `DiscoveryError` with one of the four `DiscoveryErrorCode` values.
+*/
+var DiscoveryError = class extends Error {
+	code;
+	cause;
+	constructor(message, code, cause) {
+		super(message);
+		this.name = "DiscoveryError";
+		this.code = code;
+		this.cause = cause;
+	}
+};
+/**
+* Planner error for Run Plan binding failures. Spec 13 — Error handling.
+*/
+var PlannerError = class extends Error {
+	code;
+	cause;
+	constructor(message, code, cause) {
+		super(message);
+		this.name = "PlannerError";
+		this.code = code;
+		this.cause = cause;
+	}
+};
+//#endregion
+//#region src/planner/bind.ts
+const INPUT_TYPES = /* @__PURE__ */ new Set([
+	"string",
+	"number",
+	"boolean"
+]);
+/**
+* Bind a Definition Graph's Entry + user inputs into a concrete RunPlan
+* that the native engine can execute.
+*/
+function bindRunPlan(options) {
+	const { graph, entryId, inputs } = options;
+	validateGraphShape(graph);
+	if (graph.project.pipelines.length === 0) throw new PlannerError("graph has no pipelines", "INVALID_GRAPH");
+	const { pipeline, entry } = findEntry(graph, entryId);
+	validateRoots(pipeline, entry);
+	validatePipeline(graph, pipeline);
+	const reachableSteps = computeReachableSteps(pipeline.steps, entry.roots);
+	const expandedSteps = expandPipelineCalls(graph, reachableSteps);
+	const boundInputs = bindInputs(pipeline.inputs, inputs);
+	const graphId = computeGraphId(graph);
+	const boundEntry = {
+		id: entry.id,
+		trigger: entry.trigger
+	};
+	return {
+		apiVersion: "sverka.dev/v1run",
+		id: computeRunPlanId({
+			apiVersion: "sverka.dev/v1run",
+			graphId,
+			entry: boundEntry,
+			inputs: boundInputs,
+			steps: expandedSteps
+		}),
+		graphId,
+		entry: boundEntry,
+		inputs: boundInputs,
+		steps: expandedSteps,
+		createdAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+}
+/**
+* Validate that the runtime value has the shape of a DefinitionGraph before
+* any field is dereferenced. Malformed values become PlannerError(INVALID_GRAPH)
+* instead of TypeError.
+*/
+function validateGraphShape(value) {
+	const graph = value;
+	if (typeof graph !== "object" || graph === null) throw new PlannerError("graph must be an object", "INVALID_GRAPH");
+	const project = graph.project;
+	if (typeof project !== "object" || project === null) throw new PlannerError("graph.project must be an object", "INVALID_GRAPH");
+	const pipelines = project.pipelines;
+	if (!Array.isArray(pipelines)) throw new PlannerError("graph.project.pipelines must be an array", "INVALID_GRAPH");
+	for (let i = 0; i < pipelines.length; i++) {
+		const pipeline = pipelines[i];
+		validatePipelineShape(pipeline, i);
+	}
+}
+function validatePipelineShape(value, index) {
+	const pipeline = value;
+	if (typeof pipeline !== "object" || pipeline === null) throw new PlannerError(`graph.project.pipelines[${index}] must be an object`, "INVALID_GRAPH");
+	validatePipelineFields(pipeline, index);
+	validatePipelineChildren(pipeline, index);
+}
+function validatePipelineFields(pipeline, index) {
+	if (typeof pipeline.id !== "string") throw new PlannerError(`graph.project.pipelines[${index}].id must be a string`, "INVALID_GRAPH");
+	if (!Array.isArray(pipeline.entries)) throw new PlannerError(`graph.project.pipelines[${index}].entries must be an array`, "INVALID_GRAPH");
+	if (!Array.isArray(pipeline.steps)) throw new PlannerError(`graph.project.pipelines[${index}].steps must be an array`, "INVALID_GRAPH");
+	if (typeof pipeline.inputs !== "object" || pipeline.inputs === null || Array.isArray(pipeline.inputs)) throw new PlannerError(`graph.project.pipelines[${index}].inputs must be an object`, "INVALID_GRAPH");
+}
+function validatePipelineChildren(pipeline, index) {
+	const inputs = pipeline.inputs;
+	for (const [name, descriptor] of Object.entries(inputs)) validateInputDescriptor(descriptor, index, name);
+	const entries = pipeline.entries;
+	if (!Array.isArray(entries)) return;
+	const steps = pipeline.steps;
+	if (!Array.isArray(steps)) return;
+	for (let j = 0; j < entries.length; j++) validateEntryShape(entries[j], index, j);
+	for (let j = 0; j < steps.length; j++) validateStepShape(steps[j], index, j);
+}
+function validateInputDescriptor(value, pipelineIndex, name) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new PlannerError(`graph.project.pipelines[${pipelineIndex}].inputs.${name} must be an object`, "INVALID_GRAPH");
+	const type = value.type;
+	if (type !== void 0 && !INPUT_TYPES.has(type)) throw new PlannerError(`graph.project.pipelines[${pipelineIndex}].inputs.${name} has invalid type`, "INVALID_GRAPH");
+}
+function validateEntryShape(value, pipelineIndex, index) {
+	const entry = value;
+	if (typeof entry !== "object" || entry === null) throw new PlannerError(`graph.project.pipelines[${pipelineIndex}].entries[${index}] must be an object`, "INVALID_GRAPH");
+	if (typeof entry.id !== "string") throw new PlannerError(`graph.project.pipelines[${pipelineIndex}].entries[${index}].id must be a string`, "INVALID_GRAPH");
+	if (!Array.isArray(entry.roots)) throw new PlannerError(`graph.project.pipelines[${pipelineIndex}].entries[${index}].roots must be an array`, "INVALID_GRAPH");
+}
+function validateStepShape(value, pipelineIndex, index) {
+	const step = value;
+	if (typeof step !== "object" || step === null) throw new PlannerError(`graph.project.pipelines[${pipelineIndex}].steps[${index}] must be an object`, "INVALID_GRAPH");
+	if (typeof step.id !== "string") throw new PlannerError(`graph.project.pipelines[${pipelineIndex}].steps[${index}].id must be a string`, "INVALID_GRAPH");
+	if (!Array.isArray(step.dependencies)) throw new PlannerError(`graph.project.pipelines[${pipelineIndex}].steps[${index}].dependencies must be an array`, "INVALID_GRAPH");
+}
+/**
+* Compute the transitive closure of reachable steps from the given roots.
+* A step is reachable if it is connected to a root by following
+* `dependencies[].producer` edges backward (i.e. the root's prerequisites).
+* Returns steps in the original graph order, filtered to reachable steps.
+*/
+function computeReachableSteps(steps, roots) {
+	const producerMap = buildProducerMap(steps);
+	const reachable = /* @__PURE__ */ new Set();
+	const queue = [];
+	for (const id of roots) if (!reachable.has(id)) {
+		reachable.add(id);
+		queue.push(id);
+	}
+	let head = 0;
+	while (head < queue.length) {
+		const id = queue[head];
+		head++;
+		for (const producer of producerMap.get(id) ?? []) if (!reachable.has(producer)) {
+			reachable.add(producer);
+			queue.push(producer);
+		}
+	}
+	return steps.filter((s) => reachable.has(s.id));
+}
+/**
+* Build a map from each step id to the list of producer step ids it depends on.
+*/
+function buildProducerMap(steps) {
+	const map = /* @__PURE__ */ new Map();
+	for (const step of steps) {
+		const producers = [];
+		map.set(step.id, producers);
+		for (const dep of step.dependencies) producers.push(dep.producer);
+	}
+	return map;
+}
+function findEntry(graph, entryId) {
+	for (const pipeline of graph.project.pipelines) {
+		const entry = pipeline.entries.find((e) => e.id === entryId);
+		if (entry) return {
+			pipeline,
+			entry
+		};
+	}
+	throw new PlannerError(`entry "${entryId}" not found`, "ENTRY_NOT_FOUND");
+}
+function validateRoots(pipeline, entry) {
+	const stepIds = new Set(pipeline.steps.map((s) => s.id));
+	for (const root of entry.roots) if (!stepIds.has(root)) throw new PlannerError(`entry root "${root}" not found in pipeline steps`, "ROOT_NOT_FOUND");
+}
+function validatePipeline(graph, pipeline) {
+	try {
+		validateGraph({ project: {
+			id: graph.project.id,
+			pipelines: [pipeline]
+		} });
+	} catch (err) {
+		throw new PlannerError(err instanceof Error ? err.message : String(err), "INVALID_GRAPH", err);
+	}
+}
+function bindInputs(pipelineInputs, userInputs) {
+	const result = {};
+	for (const [name, input] of Object.entries(pipelineInputs)) {
+		const type = input.type;
+		validateInputType(name, type);
+		if (input.secret) continue;
+		const userValue = userInputs?.[name];
+		if (userValue !== void 0) {
+			assertInputValue(userValue, type, name);
+			result[name] = userValue;
+			continue;
+		}
+		if (input.default !== void 0) {
+			assertInputValue(input.default, type, name);
+			result[name] = input.default;
+			continue;
+		}
+		if (input.required ?? true) throw new PlannerError(`required input "${name}" has no value and no default`, "MISSING_INPUT");
+	}
+	return result;
+}
+function validateInputType(name, type) {
+	if (type === void 0 || !INPUT_TYPES.has(type)) throw new PlannerError(`input "${name}" has no valid declared type`, "INVALID_GRAPH");
+}
+function assertInputValue(value, type, name) {
+	if (type === "array") {
+		if (!Array.isArray(value) || !value.every((item) => typeof item === "string")) throw new PlannerError(`input "${name}" value ${JSON.stringify(value)} does not match declared type "array" (expected string array)`, "INVALID_INPUT");
+		return;
+	}
+	if (typeof value !== (type === "choice" ? "string" : type)) throw new PlannerError(`input "${name}" value ${JSON.stringify(value)} does not match declared type "${type}"`, "INVALID_INPUT");
+}
+//#endregion
+//#region src/planner/planner.ts
+function createPlanner() {
+	return new PlannerImpl();
+}
+const DEFAULT_MAX_DEPTH = 10;
+var PlannerImpl = class {
+	git;
+	constructor() {
+		this.git = createGitCli();
+	}
+	async discover(options) {
+		const root = options.root;
+		if (!existsSync(root)) throw new DiscoveryError(`root directory not found: ${root}`, "ROOT_NOT_FOUND");
+		await assertGitAvailable(this.git, root);
+		const toplevel = await resolveToplevel(this.git, root);
+		const { tracked, untracked, porcelain } = await collectGitFiles(this.git, toplevel);
+		const allFiles = [.../* @__PURE__ */ new Set([...tracked, ...untracked])];
+		const scoped = options.scopeToRoot === true ? scopeFilesToRoot(allFiles, toplevel, root) : null;
+		const projectRoot = scoped?.dir ?? toplevel;
+		const maxDepth = options.maxDepth ?? DEFAULT_MAX_DEPTH;
+		const filtered = applyMaxDepth(scoped?.files ?? allFiles, maxDepth);
+		const signals = detectSignals(filtered);
+		const languages = detectLanguages(filtered);
+		const rootPkgJson = readRootPackageJson(projectRoot);
+		const packageManagers = detectPackageManagers(signals, rootPkgJson);
+		const monorepo = detectMonorepo(signals, rootPkgJson);
+		const hasContainerBuild = signals.some((s) => s.type === "dockerfile" || s.type === "docker-compose");
+		const hasCiDefinition = signals.some((s) => s.type === "ci-definition");
+		const commit = await resolveHeadCommit(this.git, toplevel);
+		const dirty = porcelain.length > 0;
+		const changedFiles = await collectChangedFiles(this.git, toplevel, options.baseRef);
+		const gitSignal = {
+			type: "git-metadata",
+			path: ".git",
+			detail: commit ? `HEAD=${commit.slice(0, 12)}` : "no commits",
+			confidence: 1
+		};
+		const allSignals = [...signals, gitSignal];
+		return {
+			root: projectRoot,
+			commit,
+			dirty,
+			changedFiles,
+			languages,
+			packageManagers,
+			hasContainerBuild,
+			hasCiDefinition,
+			monorepo,
+			localSignals: allSignals,
+			explanation: buildExplanation(allSignals, {
+				hasBaseRef: Boolean(options.baseRef),
+				dirty
+			})
+		};
+	}
+	async plan(context) {
+		return synthesizePlan(context);
+	}
+	bindRunPlan(options) {
+		return bindRunPlan(options);
+	}
+};
+function applyMaxDepth(files, maxDepth) {
+	return files.filter((f) => f.split("/").length <= maxDepth);
+}
+/**
+* Restrict repo-relative `files` to the subtree under `root`, re-rooting
+* paths relative to `root`. Returns null when `root` is not inside the
+* repository (should not happen — toplevel is resolved from `root`).
+*/
+function scopeFilesToRoot(files, toplevel, root) {
+	const dir = realpathSync(resolve(root));
+	const prefix = relative(toplevel, dir).split(sep).join("/");
+	if (prefix.startsWith("..") || isAbsolute(prefix)) return null;
+	if (prefix === "") return {
+		dir,
+		files: [...files]
+	};
+	return {
+		dir,
+		files: files.filter((f) => f.startsWith(prefix + "/")).map((f) => f.slice(prefix.length + 1))
+	};
+}
+/** Throw `GIT_UNAVAILABLE` if git is not on PATH. */
+async function assertGitAvailable(git, root) {
+	try {
+		await git.run(["--version"], root);
+	} catch (err) {
+		throw new DiscoveryError("git is not installed or not on PATH", "GIT_UNAVAILABLE", err);
+	}
+}
+/** Resolve the repository toplevel, throwing `GIT_NOT_A_REPO` on failure. */
+async function resolveToplevel(git, root) {
+	try {
+		return (await git.run(["rev-parse", "--show-toplevel"], root)).trim();
+	} catch (err) {
+		throw new DiscoveryError(`not a git repository: ${root}`, "GIT_NOT_A_REPO", err);
+	}
+}
+/** Collect tracked files, untracked files, and porcelain lines from git. */
+async function collectGitFiles(git, toplevel) {
+	let trackedRaw;
+	let porcelainRaw;
+	try {
+		trackedRaw = await git.run(["ls-files"], toplevel);
+		porcelainRaw = await git.run([
+			"status",
+			"--porcelain",
+			"-uall"
+		], toplevel);
+	} catch (err) {
+		throw new DiscoveryError("filesystem traversal failed", "TRAVERSAL_FAILED", err);
+	}
+	const tracked = trackedRaw.split("\n").filter(Boolean);
+	const porcelain = porcelainRaw.split("\n").filter(Boolean);
+	return {
+		tracked,
+		untracked: extractUntracked(porcelain),
+		porcelain
+	};
+}
+/** Extract untracked file paths from porcelain status lines. */
+function extractUntracked(porcelain) {
+	const untracked = [];
+	for (const line of porcelain) {
+		const status = line.slice(0, 2);
+		const path = line.slice(3).trim();
+		if (status.includes("??")) untracked.push(path);
+	}
+	return untracked;
+}
+/** Resolve the HEAD commit SHA, returning "" on failure. */
+async function resolveHeadCommit(git, toplevel) {
+	try {
+		return (await git.run(["rev-parse", "HEAD"], toplevel)).trim();
+	} catch {
+		return "";
+	}
+}
+const REF_RE = /^[A-Za-z0-9_./~^\-@{}]+$/;
+function validateBaseRef(baseRef) {
+	if (baseRef.startsWith("-") || !REF_RE.test(baseRef)) throw new DiscoveryError(`invalid baseRef: ${baseRef}`, "INVALID_BASE_REF");
+}
+/** Collect changed files against `baseRef` when provided. */
+async function collectChangedFiles(git, toplevel, baseRef) {
+	if (!baseRef) return [];
+	validateBaseRef(baseRef);
+	try {
+		return parseDiffNameStatus(await git.run([
+			"diff",
+			"--name-status",
+			`${baseRef}...HEAD`,
+			"--"
+		], toplevel));
+	} catch (err) {
+		throw new DiscoveryError(`failed to diff against baseRef "${baseRef}"`, "TRAVERSAL_FAILED", err);
+	}
+}
+function readRootPackageJson(root) {
+	try {
+		const raw = readFileSync(`${root}/package.json`, "utf8");
+		return JSON.parse(raw);
+	} catch {
+		return null;
+	}
+}
+function parseDiffNameStatus(diff) {
+	const out = [];
+	for (const line of diff.split("\n").filter(Boolean)) {
+		const parts = line.split("	");
+		const code = parts[0] ?? "";
+		const path = code.startsWith("R") ? parts[2] ?? "" : parts[1] ?? "";
+		if (!path) continue;
+		out.push({
+			path,
+			status: diffStatusCode(code)
+		});
+	}
+	return out;
+}
+/** Map a git diff --name-status code to a `ChangedFile` status. */
+function diffStatusCode(code) {
+	if (code.startsWith("A")) return "added";
+	if (code.startsWith("M")) return "modified";
+	if (code.startsWith("D")) return "deleted";
+	if (code.startsWith("R")) return "renamed";
+	return "modified";
+}
+const PLAN_DRIVERS = [
+	{
+		checkId: "typecheck",
+		reason: "Node project defaults",
+		languages: ["TypeScript", "JavaScript"],
+		packageManagers: [
+			"npm",
+			"yarn",
+			"pnpm",
+			"bun"
+		]
+	},
+	{
+		checkId: "lint",
+		reason: "Node project defaults",
+		languages: ["TypeScript", "JavaScript"],
+		packageManagers: [
+			"npm",
+			"yarn",
+			"pnpm",
+			"bun"
+		]
+	},
+	{
+		checkId: "test",
+		reason: "Node project defaults",
+		languages: ["TypeScript", "JavaScript"],
+		packageManagers: [
+			"npm",
+			"yarn",
+			"pnpm",
+			"bun"
+		]
+	},
+	{
+		checkId: "lint",
+		reason: "Python project defaults",
+		languages: ["Python"],
+		packageManagers: [
+			"pip",
+			"poetry",
+			"uv",
+			"pipenv"
+		]
+	},
+	{
+		checkId: "test",
+		reason: "Python project defaults",
+		languages: ["Python"],
+		packageManagers: [
+			"pip",
+			"poetry",
+			"uv",
+			"pipenv"
+		]
+	},
+	{
+		checkId: "fmt-check",
+		reason: "Rust project defaults",
+		languages: ["Rust"],
+		packageManagers: ["cargo"]
+	},
+	{
+		checkId: "clippy",
+		reason: "Rust project defaults",
+		languages: ["Rust"],
+		packageManagers: ["cargo"]
+	},
+	{
+		checkId: "test",
+		reason: "Rust project defaults",
+		languages: ["Rust"],
+		packageManagers: ["cargo"]
+	},
+	{
+		checkId: "vet",
+		reason: "Go project defaults",
+		languages: ["Go"],
+		packageManagers: ["go"]
+	},
+	{
+		checkId: "test",
+		reason: "Go project defaults",
+		languages: ["Go"],
+		packageManagers: ["go"]
+	}
+];
+function synthesizePlan(context) {
+	const langNames = context.languages.map((l) => l.name);
+	const pmNames = context.packageManagers.map((p) => p.name);
+	const signalRef = resolveSignalRef(context.localSignals);
+	const checks = collectDefaultChecks(PLAN_DRIVERS, langNames, pmNames, signalRef);
+	return {
+		context,
+		checks,
+		workflowPath: null,
+		notes: buildPlanNotes(checks, langNames, pmNames)
+	};
+}
+/** Resolve the signal reference for the first manifest/lockfile signal. */
+function resolveSignalRef(signals) {
+	const manifestSignal = signals.find((s) => s.type === "manifest" || s.type === "lockfile") ?? null;
+	return manifestSignal ? `${manifestSignal.type}:${manifestSignal.path}` : null;
+}
+/** Collect deduplicated default checks that match the detected languages/package managers. */
+function collectDefaultChecks(drivers, langNames, pmNames, signalRef) {
+	const checks = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const driver of drivers) {
+		const langMatch = driver.languages.some((l) => langNames.includes(l));
+		const pmMatch = driver.packageManagers.some((p) => pmNames.includes(p));
+		if (!langMatch || !pmMatch) continue;
+		const key = `${driver.checkId}:${driver.reason}`;
+		if (seen.has(key)) continue;
+		seen.add(key);
+		const id = makeCheckId(driver.checkId, driver.reason);
+		checks.push({
+			id,
+			checkId: driver.checkId,
+			reason: driver.reason,
+			signalRef,
+			priority: 2
+		});
+	}
+	return checks;
+}
+/** Build a stable proposed-check id from its checkId and reason. */
+function makeCheckId(checkId, reason) {
+	return "prop-" + createHash("sha256").update(checkId + reason).digest("hex").slice(0, 16);
+}
+/** Build human-readable notes describing the selected checks. */
+function buildPlanNotes(checks, langNames, pmNames) {
+	if (checks.length === 0) return ["No default checks applied: no recognized languages or package managers detected."];
+	const drivers = [];
+	if (langNames.length) drivers.push(`languages=[${langNames.join(",")}]`);
+	if (pmNames.length) drivers.push(`packageManagers=[${pmNames.join(",")}]`);
+	return [`Selected ${checks.length} default checks from ${drivers.join(" ")}.`];
+}
+//#endregion
+//#region src/planner/matrix.ts
+/**
+* Expand all matrix steps in a step list into concrete step instances.
+* Non-matrix steps pass through unchanged.
+*
+* - Each matrix step becomes N steps, one per combination (cross-product of
+*   dimensions, minus exclude, plus include).
+* - Each expanded step gets `matrixValues` (the concrete bindings) and
+*   `matrix: undefined` (the spec is consumed).
+* - Expanded step IDs: `<originalId>[key=val,key=val]` (keys sorted alphabetically).
+* - Dependencies are rewired: a dependency on a matrix step maps to ALL
+*   expanded instances (all-to-all, no correlation matching in M1).
+*/
+function expandMatrixSteps(steps) {
+	const expansionMap = /* @__PURE__ */ new Map();
+	let hasMatrix = false;
+	for (const step of steps) if (step.matrix) {
+		hasMatrix = true;
+		expansionMap.set(step.id, expandStep(step));
+	} else expansionMap.set(step.id, [step]);
+	if (!hasMatrix) return steps;
+	const result = [];
+	for (const step of steps) {
+		const expanded = expansionMap.get(step.id);
+		for (const expStep of expanded) result.push(rewireDependencies(expStep, expansionMap));
+	}
+	return result;
+}
+function expandStep(step) {
+	const spec = step.matrix;
+	if (spec.maxParallel !== void 0) {
+		if (!Number.isInteger(spec.maxParallel) || spec.maxParallel < 1) throw new PlannerError(`matrix on step '${step.id}' has invalid maxParallel: must be a positive integer (got ${spec.maxParallel})`, "INVALID_MATRIX");
+	}
+	const combinations = computeCombinations(spec);
+	if (combinations.length === 0) throw new PlannerError(`matrix on step '${step.id}' produced no combinations (check exclude rules)`, "INVALID_MATRIX");
+	return combinations.map((combo) => {
+		const { matrix: _consumed, ...rest } = step;
+		return {
+			...rest,
+			id: formatExpandedId(step.id, combo),
+			matrixValues: combo,
+			dependencies: step.dependencies,
+			...spec.failFast !== void 0 ? { matrixFailFast: spec.failFast } : {},
+			...spec.maxParallel !== void 0 ? { matrixMaxParallel: spec.maxParallel } : {}
+		};
+	});
+}
+function computeCombinations(spec) {
+	const keys = Object.keys(spec.dimensions);
+	if (keys.length === 0) return (spec.include ?? []).map((e) => ({ ...e }));
+	return mergeIncludes(applyExcludes(crossProduct(spec.dimensions, keys), spec.exclude ?? []), spec.include ?? []);
+}
+/**
+* Compute the cross-product of all matrix dimensions.
+* Throws INVALID_MATRIX if any dimension has no values.
+*/
+function crossProduct(dimensions, keys) {
+	let combinations = [{}];
+	for (const key of keys) {
+		const values = dimensions[key];
+		if (!values || values.length === 0) throw new PlannerError(`matrix dimension '${key}' has no values`, "INVALID_MATRIX");
+		const next = [];
+		for (const combo of combinations) for (const v of values) next.push({
+			...combo,
+			[key]: v
+		});
+		combinations = next;
+	}
+	return combinations;
+}
+/** Filter out combinations matching any exclude rule (partial match). */
+function applyExcludes(combinations, exclude) {
+	if (exclude.length === 0) return [...combinations];
+	return combinations.filter((c) => !matchesAnyRule(c, exclude));
+}
+/** Merge include entries, deduplicating against existing combinations. */
+function mergeIncludes(combinations, include) {
+	const includeEntries = include.map((e) => ({ ...e }));
+	const existingKeys = new Set(combinations.map(comboKey));
+	const uniqueIncludes = includeEntries.filter((e) => !existingKeys.has(comboKey(e)));
+	return [...combinations, ...uniqueIncludes];
+}
+function matchesAnyRule(combo, rules) {
+	for (const rule of rules) {
+		const entries = Object.entries(rule);
+		if (entries.length === 0) continue;
+		if (entries.every(([k, v]) => combo[k] === v)) return true;
+	}
+	return false;
+}
+/** Produce a deterministic string key for a combination (sorted key=value pairs). */
+function comboKey(combo) {
+	return Object.keys(combo).sort((a, b) => a.localeCompare(b)).map((k) => `${k}=${String(combo[k])}`).join(",");
+}
+function formatExpandedId(id, combo) {
+	return `${id}[${Object.keys(combo).sort((a, b) => a.localeCompare(b)).map((k) => `${k}=${combo[k]}`).join(",")}]`;
+}
+function rewireDependencies(step, expansionMap) {
+	const hasDeps = step.dependencies.length > 0;
+	const hasInputs = step.inputs.length > 0;
+	if (!hasDeps && !hasInputs) return step;
+	const newDeps = hasDeps ? rewireDeps(step.dependencies, expansionMap) : step.dependencies;
+	const newInputs = hasInputs ? rewireInputs(step.inputs, expansionMap) : step.inputs;
+	return {
+		...step,
+		dependencies: newDeps,
+		inputs: newInputs
+	};
+}
+function rewireDeps(deps, expansionMap) {
+	const newDeps = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const dep of deps) {
+		const expanded = expansionMap.get(dep.producer);
+		if (!expanded) {
+			addDep(newDeps, seen, dep);
+			continue;
+		}
+		for (const expStep of expanded) addDep(newDeps, seen, {
+			...dep,
+			producer: expStep.id
+		});
+	}
+	return newDeps;
+}
+function rewireInputs(inputs, expansionMap) {
+	const newInputs = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const ref of inputs) {
+		if (ref.kind !== "step") {
+			newInputs.push(ref);
+			continue;
+		}
+		const expanded = expansionMap.get(ref.step);
+		if (!expanded) {
+			newInputs.push(ref);
+			continue;
+		}
+		for (const expStep of expanded) {
+			const rewired = {
+				...ref,
+				step: expStep.id
+			};
+			const key = `${rewired.step}:${rewired.output}`;
+			if (seen.has(key)) continue;
+			seen.add(key);
+			newInputs.push(rewired);
+		}
+	}
+	return newInputs;
+}
+function addDep(deps, seen, dep) {
+	const key = dep.kind === "control" ? `control:${dep.producer}` : `${dep.kind}:${dep.producer}:${dep.output}`;
+	if (seen.has(key)) return;
+	seen.add(key);
+	deps.push(dep);
+}
+//#endregion
+//#region src/errors.ts
+var SdkError = class extends Error {
+	cause;
+	code;
+	constructor(message, code, cause) {
+		super(message);
+		this.name = "SdkError";
+		this.code = code;
+		if (cause !== void 0) this.cause = cause;
+	}
+};
+//#endregion
+//#region src/compat/config.ts
+const CONFIG_NAMES = ["sverka.config.ts", "sverka.config.js"];
+const MAX_PARENTS = 5;
+/**
+* Search upward from `root` for sverka.config.ts (then .js). Returns the
+* path or null. Searches up to 5 parent directories.
+*/
+async function findConfig(root) {
+	let dir = resolve(root);
+	for (let i = 0; i <= MAX_PARENTS; i++) {
+		for (const name of CONFIG_NAMES) {
+			const candidate = resolve(dir, name);
+			if (existsSync(candidate)) return candidate;
+		}
+		const parent = dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	return null;
+}
+/**
+* Dynamically import a sverka.config.ts file and return its default
+* export as a WorkflowDefinition. Validates the shape.
+*
+* Under Bun, .ts files import natively. Under Node, use the .js fallback
+* (findConfig searches .ts first, then .js).
+*/
+async function loadWorkflow(configPath, root) {
+	const resolved = isAbsolute(configPath) ? resolve(configPath) : resolve(root ?? process.cwd(), configPath);
+	if (!existsSync(resolved)) throw new SdkError(`config file not found: ${configPath}`, "CONFIG_NOT_FOUND");
+	if (root !== void 0) {
+		const rel = relative(resolve(root), resolved);
+		if (rel === "" || rel.startsWith("..") || isAbsolute(rel)) throw new SdkError(`config path escapes root: ${configPath}`, "CONFIG_PATH_ESCAPE");
+	}
+	let mod;
+	try {
+		mod = await import(pathToFileURL(resolved).href);
+	} catch (e) {
+		throw new SdkError(`failed to load config: ${basename(configPath)}`, "CONFIG_LOAD_FAILED", e);
+	}
+	const def = mod.default;
+	validateDefaultExport(def);
+	validateWorkflowShape(def.workflow);
+	return def;
+}
+function validateDefaultExport(def) {
+	if (!isPlainObject(def)) throw new SdkError("config default export must be an object", "CONFIG_INVALID");
+	if (typeof def.name !== "string" || def.name.length === 0) throw new SdkError("config default export must have a non-empty 'name' string", "CONFIG_INVALID");
+	if (!isPlainObject(def.workflow)) throw new SdkError("config default export must have a 'workflow' object", "CONFIG_INVALID");
+}
+function validateWorkflowShape(wf) {
+	const isWorkflow = Array.isArray(wf.roots) && typeof wf.plan === "function";
+	const isOperation = typeof wf.kind === "string" && isPlainObject(wf.spec);
+	if (!isWorkflow && !isOperation) throw new SdkError("config 'workflow' must be a Workflow (with 'roots' and 'plan') or an Operation (with 'kind' and 'spec')", "CONFIG_INVALID");
+}
+function isPlainObject(v) {
+	return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+//#endregion
+//#region src/compat/convert.ts
+const SVERKA_VERSION = (() => {
+	let raw = "";
+	try {
+		raw = readFileSync(new URL("../package.json", import.meta.url), "utf-8");
+	} catch {
+		try {
+			raw = readFileSync(new URL("../../package.json", import.meta.url), "utf-8");
+		} catch {
+			return "0.0.0";
+		}
+	}
+	const parsed = JSON.parse(raw);
+	if (typeof parsed === "object" && parsed !== null && "version" in parsed && typeof parsed.version === "string") return parsed.version;
+	return "0.0.0";
+})();
+/**
+* Convert an array of OperationSpecs into a validated IR Plan with all
+* defaults filled per the spec's conversion table.
+*/
+function convertToPlan(operations, opts) {
+	const planOps = operations.map((spec) => convertOperation(spec, opts));
+	const sourceContextHash = computeSourceContextHash(opts.context);
+	const metadata = {
+		sverkaVersion: SVERKA_VERSION,
+		generatedBy: "manual"
+	};
+	const body = {
+		apiVersion: "sverka.dev/v1",
+		name: opts.name,
+		sourceContextHash,
+		operations: planOps,
+		metadata
+	};
+	const id = computePlanId$1(body);
+	const createdAt = (/* @__PURE__ */ new Date()).toISOString();
+	return {
+		...body,
+		id,
+		createdAt
+	};
+}
+function convertOperation(spec, opts) {
+	if (!spec.id || spec.id.length === 0) throw new SdkError(`operation has empty id (kind=${spec.kind}, name=${spec.name})`, "EXECUTION_FAILED");
+	return buildPlanOperation(spec, buildExecutor(spec, opts), buildResources(spec), buildRetry(spec), (spec.artifacts ?? []).map(convertArtifact), spec.cache ? convertCache(spec.cache) : void 0);
+}
+function buildExecutor(spec, opts) {
+	return {
+		type: opts.executor,
+		...spec.image !== void 0 ? { image: spec.image } : {},
+		...spec.imageDigest !== void 0 ? { imageDigest: spec.imageDigest } : {}
+	};
+}
+function buildResources(spec) {
+	return {
+		cpu: spec.cpuLimit ?? "1",
+		memory: spec.memoryLimit ?? "512Mi"
+	};
+}
+function buildRetry(spec) {
+	const retries = spec.retries ?? 0;
+	return {
+		maxAttempts: Math.max(1, retries + 1),
+		backoffSeconds: 0,
+		retryOn: ["failure", "timeout"]
+	};
+}
+function buildPlanOperation(spec, executor, resources, retry, artifacts, cache) {
+	return {
+		id: spec.id,
+		kind: spec.kind,
+		name: spec.name,
+		...optionalFields(spec),
+		...resolveDefaults(spec),
+		executor,
+		resources,
+		...cache !== void 0 ? { cache } : {},
+		artifacts,
+		retry
+	};
+}
+function valueOrDefault(value, defaultValue) {
+	return value === void 0 ? defaultValue : value;
+}
+/** Resolve fields with default values to reduce buildPlanOperation complexity. */
+function resolveDefaults(spec) {
+	return {
+		dependsOn: valueOrDefault(spec.dependsOn, []),
+		network: valueOrDefault(spec.network, "deny"),
+		credentials: valueOrDefault(spec.credentials, []),
+		timeoutSeconds: valueOrDefault(spec.timeoutSeconds, 300),
+		continueOnError: valueOrDefault(spec.continueOnError, false)
+	};
+}
+function optionalFields(spec) {
+	return {
+		...spec.description !== void 0 ? { description: spec.description } : {},
+		...spec.command !== void 0 ? { command: spec.command } : {},
+		...spec.args !== void 0 ? { args: spec.args } : {},
+		...spec.env !== void 0 ? { env: spec.env } : {},
+		...spec.workingDir !== void 0 ? { workingDir: spec.workingDir } : {},
+		...spec.condition !== void 0 ? { condition: spec.condition } : {}
+	};
+}
+function convertArtifact(a) {
+	return {
+		path: a.path,
+		...a.name !== void 0 ? { name: a.name } : {},
+		retain: a.retain ?? false
+	};
+}
+function convertCache(c) {
+	return {
+		inputs: c.inputs,
+		outputs: c.outputs ?? [],
+		key: c.key ?? computeCacheKey(c.inputs)
+	};
+}
+function computeCacheKey(inputs) {
+	return createHash("sha256").update(inputs.join(",")).digest("hex").slice(0, 32);
+}
+function computeSourceContextHash(context) {
+	const changedFiles = context ? [...context.changedFiles.map((f) => f.path)].sort((a, b) => a.localeCompare(b)) : [];
+	const value = {
+		commit: context?.commit ?? "",
+		dirty: context?.dirty ?? false,
+		changedFiles
+	};
+	return createHash("sha256").update(canonicalStringify(value)).digest("hex");
+}
+//#endregion
+//#region src/compat/internal/plan-runtime.ts
+/**
+* A plan-mode Runtime that records operations without side effects.
+* Used by the SDK to evaluate a workflow graph into an OperationSpec[]
+* without executing any commands.
+*/
+var PlanRuntime = class {
+	mode = "plan";
+	recorded = [];
+	start;
+	constructor() {
+		this.start = Date.now();
+	}
+	async evaluate(operation) {
+		this.recorded.push(operation);
+		return {
+			operationId: operation.id,
+			status: "planned",
+			durationMs: 0
+		};
+	}
+	async finalize() {
+		return {
+			mode: "plan",
+			operations: this.recorded,
+			outcomes: [],
+			durationMs: Date.now() - this.start
+		};
+	}
+};
+//#endregion
+//#region src/sverka.ts
+/**
+* Create a Sverka instance with default options pre-applied. Per-call
+* options override defaults.
+*/
+function createSverka(defaultOptions) {
+	return {
+		async plan(options) {
+			return doPlan(mergeOptions(defaultOptions, options));
+		},
+		async toPlan(options) {
+			return buildPlan(mergeOptions(defaultOptions, options));
+		},
+		async execute(options) {
+			return doExecute(mergeOptions(defaultOptions, options));
+		}
+	};
+}
+/** Top-level plan convenience function. */
+async function plan(options) {
+	return doPlan(options ?? {});
+}
+/** Top-level toPlan convenience function. Returns the canonical Plan IR. */
+async function toPlan(options) {
+	return buildPlan(options ?? {});
+}
+/** Top-level execute convenience function. */
+async function execute(options) {
+	return doExecute(options ?? {});
+}
+async function doPlan(options) {
+	const root = options.root ?? process.cwd();
+	const planner = createPlanner();
+	const context = await planner.discover({
+		root,
+		...options.baseRef !== void 0 ? { baseRef: options.baseRef } : {}
+	});
+	const configPath = await resolveConfigPath(options, root);
+	if (configPath !== null) {
+		const def = await loadWorkflow(configPath, root);
+		const operations = await evaluateWorkflow(def);
+		return {
+			context,
+			operations,
+			proposal: null,
+			plan: buildPlanFromOps(operations, def.name, context)
+		};
+	}
+	const proposal = await planner.plan(context);
+	const resolver = options.resolver ?? createBuiltinResolver$1();
+	const operations = [];
+	for (const check of proposal.checks) try {
+		const r = resolver.resolve(check, context);
+		if (r !== null) operations.push(r.operation);
+	} catch {}
+	return {
+		context,
+		operations,
+		proposal,
+		plan: buildPlanFromOps(operations, "sverka-plan", context)
+	};
+}
+/** Build a canonical Plan IR from resolved operations. */
+async function buildPlan(options) {
+	return (await doPlan(options)).plan;
+}
+/** Convert operations into a validated Plan with host executor defaults. */
+function buildPlanFromOps(operations, name, context) {
+	const plan = convertToPlan(operations, {
+		name,
+		executor: "host",
+		context
+	});
+	if (operations.length > 0) {
+		const validation = validatePlan$1(plan);
+		if (!validation.valid) throw new SdkError(`plan validation failed: ${validation.errors.map((e) => e.message).join("; ")}`, "EXECUTION_FAILED");
+	}
+	return plan;
+}
+async function doExecute(options) {
+	const root = options.root ?? process.cwd();
+	const executorType = options.executor ?? "host";
+	const context = await createPlanner().discover({
+		root,
+		...options.baseRef !== void 0 ? { baseRef: options.baseRef } : {}
+	});
+	const { def, operations, resolvedChecks, planName } = await resolveOperations(options, root, context, executorType);
+	const { runtimeResult, findings } = await runPlan(buildAndValidatePlan(operations, planName, executorType, context), resolvedChecks, root, executorType);
+	return buildExecutionResult(runtimeResult, findings, options, def);
+}
+/** Load or auto-discover the operations to execute. */
+async function resolveOperations(options, root, context, executorType) {
+	const configPath = await resolveConfigPath(options, root);
+	if (configPath !== null) {
+		const def = await loadWorkflow(configPath, root);
+		return {
+			def,
+			operations: await evaluateWorkflow(def),
+			resolvedChecks: [],
+			planName: def.name
+		};
+	}
+	const proposal = await createPlanner().plan(context);
+	const resolver = options.resolver ?? createBuiltinResolver$1();
+	const tmpChecks = [];
+	for (const check of proposal.checks) try {
+		const r = resolver.resolve(check, context);
+		if (r !== null) tmpChecks.push(r);
+	} catch {}
+	if (executorType === "docker" && tmpChecks.some((r) => r.operation.image === void 0)) throw new SdkError("docker executor requires container images; every operation must declare an image", "EXECUTION_FAILED");
+	const operations = tmpChecks.map((r) => buildOperationWithOutputs(r));
+	if (operations.length === 0) throw new SdkError("no config found and auto-discovery produced no resolvable checks", "CONFIG_NOT_FOUND");
+	return {
+		def: null,
+		operations,
+		resolvedChecks: tmpChecks,
+		planName: "sverka-plan"
+	};
+}
+/** Convert operations into a Plan and validate it. */
+function buildAndValidatePlan(operations, planName, executorType, context) {
+	const plan = convertToPlan(operations, {
+		name: planName,
+		executor: executorType,
+		context
+	});
+	if (operations.length > 0) {
+		const validation = validatePlan$1(plan);
+		if (!validation.valid) throw new SdkError(`plan validation failed: ${validation.errors.map((e) => e.message).join("; ")}`, "EXECUTION_FAILED");
+	}
+	return plan;
+}
+/** Execute a Plan and extract findings from resolved checks. */
+async function runPlan(plan, resolvedChecks, root, executorType) {
+	const artifactDir = mkdtempSync(join(tmpdir(), "sverka-artifacts-"));
+	const cacheDir = mkdtempSync(join(tmpdir(), "sverka-cache-"));
+	try {
+		const { Scheduler } = await import("@sverka/runtime");
+		const scheduler = new Scheduler({
+			executors: [await createExecutor(executorType, cacheDir, plan.operations)],
+			maxConcurrent: 4,
+			workspace: root,
+			artifactDir,
+			cacheDir,
+			credentials: {},
+			resume: false
+		});
+		try {
+			return {
+				runtimeResult: await scheduler.execute(plan),
+				findings: await extractResolvedFindings(resolvedChecks, artifactDir)
+			};
+		} catch (e) {
+			throw new SdkError(`execution failed: ${e instanceof Error ? e.message : String(e)}`, "EXECUTION_FAILED", e);
+		} finally {
+			await scheduler.dispose().catch(() => {});
+		}
+	} finally {
+		await Promise.all([rm(artifactDir, {
+			recursive: true,
+			force: true
+		}).catch(() => {}), rm(cacheDir, {
+			recursive: true,
+			force: true
+		}).catch(() => {})]);
+	}
+}
+/** Extract findings from resolved checks' SARIF output artifacts. */
+async function extractResolvedFindings(resolvedChecks, artifactDir) {
+	const all = [];
+	for (const r of resolvedChecks) {
+		if (r.outputs.length === 0) continue;
+		const extracted = await extractFindings$1(r.outputs, artifactDir, r.checkId);
+		all.push(...extracted);
+	}
+	return all;
+}
+/** Build the final ExecutionResult from runtime output and user options. */
+async function buildExecutionResult(runtimeResult, findings, options, def) {
+	let baselineFingerprints = [];
+	let filteredFindings = findings;
+	if (options.baselinePath) {
+		const baseline = await loadBaseline$1(options.baselinePath);
+		baselineFingerprints = baseline.fingerprints;
+		filteredFindings = options.onlyNew ? filterOnlyNew$1(findings, baseline) : findings;
+	}
+	const policy = def?.policy ? createPolicy$1(def.policy) : DEFAULT_POLICY$1;
+	const policyResult = evaluatePolicy$1(filteredFindings, policy, baselineFingerprints);
+	const verdict = runtimeResult.status === "success" ? policyResult.verdict : "fail";
+	return {
+		findings: filteredFindings,
+		policyResult,
+		verdict,
+		status: runtimeResult.status,
+		...runtimeResult.runtimeFailure ? { runtimeFailure: runtimeResult.runtimeFailure } : {},
+		outcomes: runtimeResult.outcomes,
+		durationMs: runtimeResult.durationMs
+	};
+}
+function mergeOptions(defaults, callOpts) {
+	return {
+		...defaults,
+		...callOpts
+	};
+}
+async function resolveConfigPath(options, root) {
+	if (options.configPath) return options.configPath;
+	return findConfig(root);
+}
+async function evaluateWorkflow(def) {
+	const wf = normalizeWorkflow(def.name, def.workflow);
+	const runtime = new PlanRuntime();
+	return (await wf.plan(runtime)).operations;
+}
+/**
+* Normalize a WorkflowDefinition's workflow field to a Workflow.
+* If it's already a Workflow (has `roots` and `plan`), return as-is.
+* If it's a bare Operation, wrap it with `workflow(name, op)`.
+*/
+function normalizeWorkflow(name, wf) {
+	if (isWorkflow(wf)) return wf;
+	return workflow$1(name, wf);
+}
+function isWorkflow(wf) {
+	return "roots" in wf && "plan" in wf;
+}
+async function createExecutor(type, cacheDir, operations) {
+	if (type === "docker") {
+		const { DockerExecutor } = await import("@sverka/runtime");
+		return new DockerExecutor({
+			runAs: `${process.getuid?.() ?? 1e3}:${process.getgid?.() ?? 1e3}`,
+			cacheDir
+		});
+	}
+	const { HostExecutor, createAllowlist } = await import("@sverka/runtime");
+	return new HostExecutor({
+		enabled: true,
+		allowlist: createAllowlist(operations.map((op) => op.command).filter((c) => typeof c === "string" && c.length > 0)),
+		envAllowlist: ["PATH"]
+	});
+}
+/** Merge resolved-check outputs into the operation's artifact declarations. */
+function buildOperationWithOutputs(r) {
+	if (r.outputs.length === 0) return r.operation;
+	const artifacts = [...r.operation.artifacts ?? [], ...r.outputs.map((o) => ({
+		path: o.path,
+		retain: false
+	}))];
+	return {
+		...r.operation,
+		artifacts
+	};
+}
+//#endregion
+//#region src/compat/helpers.ts
+/** Name an operation. Sugar for `op.named(name)`. */
+function task(name, op) {
+	return op.named(name);
+}
+/** Type-safe helper for sverka.config.ts. Identity function. */
+function defineWorkflow(definition) {
+	return definition;
+}
+//#endregion
+//#region src/internal/is-reference.ts
+const OUTPUT_TYPES = /* @__PURE__ */ new Set([
+	"string",
+	"number",
+	"boolean",
+	"artifact"
+]);
+const CONTEXT_NAMESPACES = /* @__PURE__ */ new Set([
+	"env",
+	"secrets",
+	"git",
+	"change",
+	"event",
+	"run",
+	"inputs",
+	"matrix"
+]);
+/**
+* Type guard for Reference values.
+* Shared between expr.ts and sh.ts to avoid duplication.
+* Validates that type and namespace values are within their finite unions.
+*/
+function isReference(value) {
+	if (typeof value !== "object" || value === null || !("kind" in value)) return false;
+	const ref = value;
+	if (ref.kind === "step") return isStepRef(value);
+	if (ref.kind === "context") return isContextRef(value);
+	return false;
+}
+function isStepRef(value) {
+	const s = value;
+	return typeof s.step === "string" && typeof s.output === "string" && typeof s.type === "string" && OUTPUT_TYPES.has(s.type);
+}
+function isContextRef(value) {
+	const c = value;
+	return typeof c.namespace === "string" && typeof c.field === "string" && CONTEXT_NAMESPACES.has(c.namespace);
+}
+//#endregion
+//#region src/dollar.ts
+function createBuilder(state) {
+	const builder = {
+		outputs(outputs) {
+			state.outputs = outputs;
+			return builder;
+		},
+		inputs(inputs) {
+			state.inputs = inputs;
+			return builder;
+		},
+		dependsOn(steps) {
+			state.dependsOn = steps;
+			return builder;
+		},
+		runtime(runtime) {
+			state.runtime = runtime;
+			return builder;
+		},
+		timeout(ms) {
+			state.timeout = ms;
+			return builder;
+		},
+		condition(ref) {
+			state.condition = ref;
+			return builder;
+		},
+		matrix(spec) {
+			state.matrix = spec;
+			return builder;
+		},
+		interruptible(value) {
+			state.interruptible = value ?? true;
+			return builder;
+		},
+		compensate(command) {
+			state.compensation = {
+				kind: "shell",
+				command
+			};
+			return builder;
+		},
+		build(pipeline, id) {
+			const allInputs = [...state.inputs ? [...state.inputs] : [], ...state.collectedInputs];
+			return new ShellStep(pipeline, id, {
+				command: state.command,
+				...state.outputs ? { outputs: state.outputs } : {},
+				...allInputs.length > 0 ? { inputs: allInputs } : {},
+				...state.dependsOn ? { dependsOn: state.dependsOn } : {},
+				...state.runtime ? { runtime: state.runtime } : {},
+				...state.timeout !== void 0 ? { timeout: state.timeout } : {},
+				...state.condition !== void 0 ? { condition: state.condition } : {},
+				...state.matrix !== void 0 ? { matrix: state.matrix } : {},
+				...state.interruptible !== void 0 ? { interruptible: state.interruptible } : {},
+				...state.compensation !== void 0 ? { compensation: state.compensation } : {}
+			});
+		}
+	};
+	return builder;
+}
+/**
+* Create a shell command step builder from a tagged template.
+* References interpolated in the template are collected and added to the
+* step's inputs automatically.
+*/
+function $(strings, ...values) {
+	let command = "";
+	const collectedInputs = [];
+	for (let i = 0; i < strings.length; i++) {
+		command += strings[i];
+		if (i < values.length) {
+			const v = values[i];
+			if (typeof v === "string") command += v;
+			else if (isReference(v)) {
+				const ref = v;
+				collectedInputs.push(ref);
+				if (ref.kind === "step") command += `\${${ref.step}.${ref.output}}`;
+				else command += `\${${ref.namespace}.${ref.field}}`;
+			} else throw new SdkError(`invalid interpolation value at position ${i}: expected string or Reference`, "INVALID_INTERPOLATION");
+		}
+	}
+	return createBuilder({
+		command,
+		collectedInputs
+	});
+}
+//#endregion
+//#region src/shell.ts
+/**
+* Create a ShellProxy bound to an optional command prefix and shell interpreter.
+* - prefix: accumulated property-access chain (e.g. "git" for shell.git)
+* - shellOpt: interpreter string from shell("bash"), applied as runtime.shell
+*/
+function createShellProxy(prefix, shellOpt) {
+	const proxy = function(stringsOrInterpreter, ...values) {
+		if (typeof stringsOrInterpreter === "string") return createShellProxy(prefix, stringsOrInterpreter);
+		const builder = $(stringsOrInterpreter, ...values);
+		if (prefix) return wrapBuilder(builder, (step) => applyPrefixAndShell(step, prefix, shellOpt));
+		if (shellOpt) return wrapBuilder(builder, (step) => applyShell(step, shellOpt));
+		return builder;
+	};
+	return new Proxy(proxy, { get(_target, prop) {
+		if (typeof prop !== "string") return void 0;
+		if (prop === "then" || prop === "toJSON" || prop === "toString") return void 0;
+		return createShellProxy(prefix ? `${prefix} ${prop}` : prop, shellOpt);
+	} });
+}
+/**
+* Apply a command prefix and optional shell interpreter to a built step.
+* Mutates the step in-place to preserve pipeline registration.
+*/
+function applyPrefixAndShell(step, prefix, shellOpt) {
+	const runtime = shellOpt ? {
+		...step.runtime,
+		shell: shellOpt
+	} : step.runtime;
+	Object.assign(step, {
+		command: `${prefix} ${step.command}`,
+		runtime
+	});
+	return step;
+}
+/**
+* Apply a shell interpreter to a built step (no prefix).
+* Mutates the step in-place to preserve pipeline registration.
+*/
+function applyShell(step, interpreter) {
+	const runtime = {
+		...step.runtime,
+		shell: interpreter
+	};
+	Object.assign(step, { runtime });
+	return step;
+}
+/**
+* Wrap a StepBuilder so `build()` applies a transform to the final step.
+* Chain methods delegate to the original builder and return the wrapper.
+*/
+function wrapBuilder(builder, transform) {
+	const origBuild = builder.build.bind(builder);
+	const wrapped = {
+		outputs(o) {
+			builder.outputs(o);
+			return wrapped;
+		},
+		inputs(i) {
+			builder.inputs(i);
+			return wrapped;
+		},
+		dependsOn(s) {
+			builder.dependsOn(s);
+			return wrapped;
+		},
+		runtime(r) {
+			builder.runtime(r);
+			return wrapped;
+		},
+		timeout(ms) {
+			builder.timeout(ms);
+			return wrapped;
+		},
+		condition(ref) {
+			builder.condition(ref);
+			return wrapped;
+		},
+		matrix(spec) {
+			builder.matrix(spec);
+			return wrapped;
+		},
+		interruptible(value) {
+			builder.interruptible(value);
+			return wrapped;
+		},
+		compensate(command) {
+			builder.compensate(command);
+			return wrapped;
+		},
+		build(pipeline, id) {
+			return transform(origBuild(pipeline, id));
+		}
+	};
+	return wrapped;
+}
+/**
+* Shell proxy export. Provides command-prefix and shell-selector DX.
+*
+* @example
+* const { git, npm, bun, make, docker } = shell;
+* git`push origin main`.build(p, "push")  // → "git push origin main"
+* bun`run build`.build(p, "build")        // → "bun run build"
+*
+* @example
+* const bash = shell("bash");
+* bash.git`push`.build(p, "push")         // → "git push" + runtime.shell="bash"
+* shell("pwsh")`Write-Host hello`.build(p, "greet")  // → "Write-Host hello" + runtime.shell="pwsh"
+*/
+const shell = createShellProxy("");
+//#endregion
+//#region src/artifact.ts
+/** Create an artifact output declaration with the given path. */
+function artifact(path) {
+	return {
+		type: "artifact",
+		path
+	};
+}
+//#endregion
+//#region src/pipeline.ts
+/** Create a Pipeline, run step functions, then entry functions. */
+function pipeline$1(project, id, config) {
+	const p = new Pipeline(project, id, { ...config.inputs ? { inputs: config.inputs } : {} });
+	if (config.steps) for (const stepFn of config.steps) stepFn(p);
+	if (config.entries) for (const entryFn of config.entries) entryFn(p);
+	return p;
+}
+//#endregion
+//#region src/call-pipeline.ts
+function createCallBuilder(state) {
+	const builder = {
+		outputs(outputs) {
+			state.outputs = outputs;
+			return builder;
+		},
+		dependsOn(steps) {
+			state.dependsOn = steps;
+			return builder;
+		},
+		runtime(runtime) {
+			state.runtime = runtime;
+			return builder;
+		},
+		timeout(ms) {
+			state.timeout = ms;
+			return builder;
+		},
+		condition(ref) {
+			state.condition = ref;
+			return builder;
+		},
+		interruptible(value) {
+			state.interruptible = value;
+			return builder;
+		},
+		build(pipeline, id) {
+			return new PipelineCallStep(pipeline, id, {
+				callee: state.callee,
+				callInputs: state.callInputs,
+				...state.outputs ? { outputs: state.outputs } : {},
+				...state.dependsOn ? { dependsOn: state.dependsOn } : {},
+				...state.runtime ? { runtime: state.runtime } : {},
+				...state.timeout !== void 0 ? { timeout: state.timeout } : {},
+				...state.condition !== void 0 ? { condition: state.condition } : {},
+				...state.interruptible !== void 0 ? { interruptible: state.interruptible } : {}
+			});
+		}
+	};
+	return builder;
+}
+/**
+* Create a pipeline-call step builder.
+* @param callee The callee pipeline id (within the same Project).
+* @param callInputs Bound inputs for the callee pipeline.
+*/
+function callPipeline(callee, callInputs) {
+	return createCallBuilder({
+		callee,
+		callInputs: callInputs ? { ...callInputs } : {}
+	});
+}
+//#endregion
+//#region src/component.ts
+function createComponentBuilder(state) {
+	const builder = {
+		outputs(outputs) {
+			state.outputs = outputs;
+			return builder;
+		},
+		dependsOn(steps) {
+			state.dependsOn = steps;
+			return builder;
+		},
+		runtime(runtime) {
+			state.runtime = runtime;
+			return builder;
+		},
+		timeout(ms) {
+			state.timeout = ms;
+			return builder;
+		},
+		condition(ref) {
+			state.condition = ref;
+			return builder;
+		},
+		interruptible(value) {
+			state.interruptible = value;
+			return builder;
+		},
+		build(pipeline, id) {
+			return new ComponentStep(pipeline, id, {
+				component: state.component,
+				...state.outputs ? { outputs: state.outputs } : {},
+				...state.dependsOn ? { dependsOn: state.dependsOn } : {},
+				...state.runtime ? { runtime: state.runtime } : {},
+				...state.timeout !== void 0 ? { timeout: state.timeout } : {},
+				...state.condition !== void 0 ? { condition: state.condition } : {},
+				...state.interruptible !== void 0 ? { interruptible: state.interruptible } : {}
+			});
+		}
+	};
+	return builder;
+}
+/**
+* Create a component step builder.
+* @param name The component name (e.g. "deploy").
+* @param version The component version (e.g. "1.0.0").
+* @param inputs Bound inputs for the component.
+*/
+function component(name, version, inputs) {
+	return createComponentBuilder({ component: {
+		name,
+		version,
+		inputs: inputs ? { ...inputs } : {}
+	} });
+}
+//#endregion
+//#region src/when.ts
+/** Mark a reference, expression, or status condition as a step condition. Returns it unchanged. */
+function when$1(cond) {
+	return cond;
+}
+//#endregion
+//#region src/expr.ts
+/**
+* Create a symbolic expression from a tagged template.
+* Context references produce `${namespace.field}` placeholders while step
+* references produce `${step.output}` placeholders; both are collected into
+* `refs` for dependency inference.
+* String, number, and boolean values are inlined into the template.
+*/
+function expr(strings, ...values) {
+	let template = "";
+	const refs = [];
+	for (let i = 0; i < strings.length; i++) {
+		template += strings[i];
+		if (i < values.length) {
+			const v = values[i];
+			if (typeof v === "string" || typeof v === "number" || typeof v === "boolean") template += String(v);
+			else if (isReference(v)) {
+				refs.push(v);
+				if (v.kind === "step") template += `\${${v.step}.${v.output}}`;
+				else template += `\${${v.namespace}.${v.field}}`;
+			} else throw new SdkError(`invalid interpolation value at position ${i}: expected string, number, boolean, or Reference`, "INVALID_INTERPOLATION");
+		}
+	}
+	return {
+		kind: "expression",
+		template,
+		refs
+	};
+}
+//#endregion
+//#region src/status.ts
+/**
+* Create a status-based condition.
+* @example
+* sh`notify-slack`.condition(status("failure"))
+*/
+function status(s) {
+	return {
+		kind: "status",
+		status: s
+	};
+}
+//#endregion
+//#region src/internal/proxy-props.ts
+const PROTECTED_PROXY_PROPS = /* @__PURE__ */ new Set([
+	"then",
+	"toJSON",
+	"inspect",
+	"constructor",
+	"valueOf",
+	Symbol.toPrimitive,
+	Symbol.iterator,
+	Symbol.toStringTag
+]);
+/**
+* Create a dynamic Proxy that delegates protected/symbol properties to
+* Reflect.get and calls `resolve(prop)` for everything else.
+*
+* This shared factory eliminates duplication between context namespace
+* proxies and image reference proxies.
+*/
+function createDynamicProxy(resolve) {
+	return new Proxy({}, { get(target, prop) {
+		if (typeof prop === "symbol" || PROTECTED_PROXY_PROPS.has(prop)) return Reflect.get(target, prop);
+		return resolve(prop);
+	} });
+}
+//#endregion
+//#region src/images.ts
+/** Create an ImageRef from a raw OCI reference string. */
+function image(ref) {
+	if (typeof ref !== "string") throw new SdkError("image reference must be a string", "INVALID_IMAGE");
+	if (ref.length === 0) throw new SdkError("image reference must be a non-empty string", "INVALID_IMAGE");
+	return { ref };
+}
+/** Create a Proxy that maps property access to `image(prefix:prop)`. */
+function createImageProxy(prefix) {
+	return createDynamicProxy((prop) => image(`${prefix}:${prop}`));
+}
+const images = {
+	node: createImageProxy("node"),
+	ubuntu: createImageProxy("ubuntu")
+};
+//#endregion
+//#region src/context.ts
+/** Create a ContextRef for a namespace + field. */
+function ctx(namespace, field) {
+	return {
+		kind: "context",
+		namespace,
+		field
+	};
+}
+/** Dynamic namespace proxy — any property access returns a ContextRef. */
+function dynamicNamespace(namespace) {
+	return createDynamicProxy((prop) => ctx(namespace, prop));
+}
+/** Environment variable references: env.CI_TRACE, env.MY_VAR. */
+const env = dynamicNamespace("env");
+/** Secret references: secrets.NPM_TOKEN. */
+const secrets = dynamicNamespace("secrets");
+/** Git metadata references: git.sha, git.branch, git.tag. */
+const git = {
+	sha: ctx("git", "sha"),
+	branch: ctx("git", "branch"),
+	tag: ctx("git", "tag")
+};
+/** Change request metadata: change.id, change.source, change.target, change.draft. */
+const change = {
+	id: ctx("change", "id"),
+	source: ctx("change", "source"),
+	target: ctx("change", "target"),
+	draft: ctx("change", "draft")
+};
+/** Event metadata: event.type. */
+const event = { type: ctx("event", "type") };
+/** Run metadata: run.id, run.attempt. */
+const run$1 = {
+	id: ctx("run", "id"),
+	attempt: ctx("run", "attempt")
+};
+/** Pipeline input references: inputs.environment. */
+const inputs = dynamicNamespace("inputs");
+/** Matrix variable references: matrix.node, matrix.os. */
+const matrix$1 = dynamicNamespace("matrix");
+//#endregion
+//#region src/agent.ts
+function createAgentBuilder(state) {
+	const builder = {
+		outputs(outputs) {
+			state.outputs = outputs;
+			return builder;
+		},
+		inputs(inputs) {
+			state.inputs = inputs;
+			return builder;
+		},
+		dependsOn(steps) {
+			state.dependsOn = steps;
+			return builder;
+		},
+		tools(...tools) {
+			state.tools = [...state.tools, ...tools];
+			return builder;
+		},
+		engine(engine) {
+			state.engine = engine;
+			return builder;
+		},
+		model(model) {
+			state.model = model;
+			return builder;
+		},
+		maxTokens(n) {
+			state.maxTokens = n;
+			return builder;
+		},
+		build(pipeline, id) {
+			const allInputs = [...state.inputs ? [...state.inputs] : [], ...state.collectedInputs];
+			return new AgentStep(pipeline, id, {
+				engine: state.engine,
+				prompt: state.prompt,
+				...state.model !== void 0 ? { model: state.model } : {},
+				...state.tools.length > 0 ? { tools: state.tools } : {},
+				...state.maxTokens !== void 0 ? { maxTokens: state.maxTokens } : {},
+				...state.outputs ? { outputs: state.outputs } : {},
+				...allInputs.length > 0 ? { inputs: allInputs } : {},
+				...state.dependsOn ? { dependsOn: state.dependsOn } : {}
+			});
+		}
+	};
+	return builder;
+}
+/**
+* Create an AI agent step builder from a tagged template.
+* `agent\`Build and test\`` creates a builder with `engine: "default"`.
+* References interpolated in the template are collected and added to the
+* step's inputs automatically (same as `$`).
+*/
+function agent(strings, ...values) {
+	let prompt = "";
+	const collectedInputs = [];
+	for (let i = 0; i < strings.length; i++) {
+		prompt += strings[i];
+		if (i < values.length) {
+			const v = values[i];
+			if (typeof v === "string") prompt += v;
+			else if (isReference(v)) {
+				const ref = v;
+				collectedInputs.push(ref);
+				if (ref.kind === "step") prompt += `\${${ref.step}.${ref.output}}`;
+				else prompt += `\${${ref.namespace}.${ref.field}}`;
+			} else throw new SdkError(`invalid interpolation value at position ${i}: expected string or Reference`, "INVALID_INTERPOLATION");
+		}
+	}
+	return createAgentBuilder({
+		prompt,
+		engine: "default",
+		tools: [],
+		collectedInputs
+	});
+}
+//#endregion
+export { $, CheckError, CompositionError, CoreError, DEFAULT_POLICY, DiscoveryError, PlannerError, PlanningError, SdkError, agent, artifact, bindRunPlan, callPipeline, change, component, computeFingerprint, computePlanId, computeReachableSteps, createBaseline, createBuiltinResolver, createPlanner, createPolicy, createSverka, defineWorkflow, env, evaluatePolicy, event, execute, expandMatrixSteps, expr, extractFindings, filterOnlyNew, findConfig, git, image, images, inputs, loadBaseline, loadWorkflow, matrix, matrix$1 as matrixContext, normalizeSarif, parallel, pipeline, pipeline$1 as pipelineV0, plan, run, run$1 as runContext, saveBaseline, secrets, shell, status, task, toPlan, updateBaseline, validatePlan, when, when$1 as whenV0, workflow };
+
+//# sourceMappingURL=index.mjs.map