@synergenius/flow-weaver 0.17.0 → 0.17.2

package/docs/reference/deployment.md

@@ -105,6 +105,26 @@ Generates:
 
 ---
 
+## CI/CD Pipeline Export
+
+CI/CD export works differently from serverless export. Instead of generating a handler that runs your workflow at request time, it reads the workflow graph and produces native pipeline YAML. The generated file has no runtime dependency on Flow Weaver.
+
+Use CI/CD-specific annotations (`@secret`, `@runner`, `@cache`, `@artifact`, `@environment`, `@matrix`, `@service`, `@concurrency`) alongside `@node` and `@connect` to define pipeline structure. The `[job: "name"]` attribute on `@node` groups nodes into jobs. Triggers use `@trigger push`, `@trigger pull_request`, etc.
+
+Secrets are wired as pseudo-node connections: `@connect secret:TOKEN -> node.port`. The export target renders these as platform-native secret references (`${{ secrets.TOKEN }}` for GitHub, `$NPM_TOKEN` for GitLab).
+
+```bash
+# GitHub Actions
+flow-weaver export pipeline.ts --target github-actions --output .github/workflows/
+
+# GitLab CI
+flow-weaver export pipeline.ts --target gitlab-ci --output .
+```
+
+See the [CI/CD Pipelines](cicd) topic for the complete annotation reference, validation rules, and full examples.
+
+---
+
 ## Multi-Workflow Export
 
 Export all workflows in a file as a **unified service** with routing, function registry, and optional API documentation:
@@ -241,6 +261,7 @@ This:
 
 ## Related Topics
 
+- [CI/CD Pipelines](cicd) — CI/CD annotation reference, secret wiring, job grouping, validation rules
 - [CLI Reference](cli-reference) — Full command flags for export, serve, openapi
 - [Compilation](compilation) — Inngest target details and serve handlers
 - [Built-in Nodes](built-in-nodes) — Mock system for local testing

package/docs/reference/jsdoc-grammar.md

@@ -213,6 +213,7 @@ attributeBracket ::= "[" nodeAttr { "," nodeAttr } "]"
 nodeAttr       ::= labelAttr | exprAttr | portOrderAttr | portLabelAttr
                  | minimizedAttr | pullExecutionAttr | sizeAttr
                  | colorAttr | iconAttr | tagsAttr | positionAttr
+                 | jobAttr | environmentAttr
 
 labelAttr      ::= "label:" STRING
 exprAttr       ::= "expr:" IDENTIFIER "=" STRING { "," IDENTIFIER "=" STRING }
@@ -226,6 +227,8 @@ iconAttr       ::= "icon:" STRING
 tagsAttr       ::= "tags:" tagEntry { "," tagEntry }
 tagEntry       ::= STRING [ STRING ]
 positionAttr   ::= "position:" INTEGER INTEGER
+jobAttr        ::= "job:" STRING
+environmentAttr ::= "environment:" STRING
 ```
 
 Multiple attribute brackets are allowed (zero or more). Attributes can be split across brackets or combined in one.
@@ -245,6 +248,8 @@ Multiple attribute brackets are allowed (zero or more). Attributes can be split
 @node myAdd Add [tags: "math" "Math operation", "transform"]
 @node myAdd Add [position: 180 0]
 @node myAdd Add [label: "hi"] [color: "#f00"] [position: 360 0]
+@node build npmBuild [job: "build"]
+@node deploy deploySsh [job: "deploy"] [environment: "production"]
 ```
 
 ## @connect
@@ -253,15 +258,17 @@ Multiple attribute brackets are allowed (zero or more). Attributes can be split
 connectTag     ::= "@connect" portRef "->" portRef
 
 portRef        ::= IDENTIFIER "." IDENTIFIER [ ":" IDENTIFIER ]
+                 | IDENTIFIER ":" IDENTIFIER
 ```
 
-The optional `:IDENTIFIER` suffix is a scope qualifier.
+The first form is the standard `node.port` reference with optional `:scope` suffix. The second form is a pseudo-node reference for CI/CD secrets: `secret:NAME` resolves to `{ nodeId: "secret:NAME", portName: "value" }`.
 
 **Examples:**
 
 ```
 @connect myAdd.result -> myLog.message
 @connect loop.item -> process.input:loopScope
+@connect secret:NPM_TOKEN -> publish.token
 ```
 
 ## @path
@@ -425,6 +432,239 @@ Limits concurrent executions of an Inngest function.
 
 ---
 
+# CI/CD Workflow Annotations
+
+These tags configure CI/CD pipeline behavior when exporting to GitHub Actions or GitLab CI. They are placed inside `@flowWeaver workflow` blocks alongside standard workflow tags.
+
+## @trigger (CI/CD mode)
+
+When the trigger value is one of `push`, `pull_request`, `dispatch`, `tag`, or `schedule`, the parser treats it as a CI/CD trigger rather than an Inngest event trigger.
+
+```
+cicdTriggerTag ::= "@trigger" ( "push" | "pull_request" | "dispatch" | "tag" | "schedule" )
+                   { IDENTIFIER "=" STRING }
+```
+
+Recognized attributes: `branches`, `paths`, `paths-ignore`, `types`, `pattern`, `cron`.
+
+**Examples:**
+
+```
+@trigger push branches="main,develop"
+@trigger pull_request branches="main" types="opened,synchronize"
+@trigger tag pattern="v*"
+@trigger dispatch
+@trigger schedule cron="0 9 * * 1"
+```
+
+## @secret
+
+```
+secretTag      ::= "@secret" IDENTIFIER { IDENTIFIER "=" STRING } [ "-" TEXT ]
+```
+
+**Examples:**
+
+```
+@secret NPM_TOKEN - NPM authentication token
+@secret DEPLOY_KEY scope="deploy" platform="github" - SSH deploy key
+```
+
+## @runner
+
+```
+runnerTag      ::= "@runner" TEXT
+```
+
+**Examples:**
+
+```
+@runner ubuntu-latest
+@runner self-hosted
+```
+
+## @cache
+
+```
+cacheTag       ::= "@cache" IDENTIFIER { IDENTIFIER "=" STRING }
+```
+
+**Examples:**
+
+```
+@cache npm key="package-lock.json"
+@cache npm key="package-lock.json" path="~/.npm"
+```
+
+## @artifact
+
+```
+artifactTag    ::= "@artifact" IDENTIFIER { IDENTIFIER "=" ( STRING | INTEGER ) }
+```
+
+**Examples:**
+
+```
+@artifact dist path="dist/" retention=5
+@artifact coverage path="coverage/"
+```
+
+## @environment
+
+```
+environmentTag ::= "@environment" IDENTIFIER { IDENTIFIER "=" ( STRING | INTEGER ) }
+```
+
+**Examples:**
+
+```
+@environment production url="https://app.example.com" reviewers=2
+@environment staging
+```
+
+## @matrix
+
+```
+matrixTag      ::= "@matrix" [ "include" | "exclude" ] { IDENTIFIER "=" STRING }
+```
+
+Without a prefix, each key-value pair declares a dimension with comma-separated values. With `include` or `exclude`, it adds or removes a specific combination.
+
+**Examples:**
+
+```
+@matrix node="18,20,22" os="ubuntu-latest,macos-latest"
+@matrix include node="22" os="windows-latest"
+@matrix exclude node="18" os="macos-latest"
+```
+
+## @service
+
+```
+serviceTag     ::= "@service" IDENTIFIER { IDENTIFIER "=" STRING }
+```
+
+**Examples:**
+
+```
+@service postgres image="postgres:16" env="POSTGRES_PASSWORD=test" ports="5432:5432"
+@service redis image="redis:7" ports="6379:6379"
+```
+
+## @concurrency
+
+```
+concurrencyTag ::= "@concurrency" IDENTIFIER [ "cancel-in-progress=" ( "true" | "false" ) ]
+```
+
+**Examples:**
+
+```
+@concurrency deploy cancel-in-progress=true
+@concurrency ci-main
+```
+
+## @job
+
+Configures per-job settings. The name must match a `[job: "name"]` attribute used on `@node` declarations.
+
+```
+jobTag         ::= "@job" IDENTIFIER { IDENTIFIER "=" ( STRING | IDENTIFIER | INTEGER ) }
+```
+
+Recognized keys: `retry` (number), `allow_failure` (boolean), `timeout` (string), `runner` (string), `tags` (comma-list), `coverage` (string), `reports` (comma-list of type=path), `rules` (string), `extends` (string), `before_script` (comma-list), `variables` (comma-list of KEY=VALUE).
+
+**Examples:**
+
+```
+@job build retry=2 timeout="10m"
+@job test-unit coverage='/Coverage: (\d+)%/' reports="junit=test-results.xml"
+@job deploy allow_failure=true rules="$CI_COMMIT_BRANCH == main"
+@job lint tags="docker,linux" extends=".base-lint"
+```
+
+## @stage
+
+Declares a pipeline stage for GitLab CI grouping. Multiple `@stage` annotations define stage ordering.
+
+```
+stageTag       ::= "@stage" IDENTIFIER
+```
+
+**Examples:**
+
+```
+@stage test
+@stage build
+@stage deploy
+```
+
+## @variables
+
+Sets workflow-level environment variables. Applied as defaults to all jobs.
+
+```
+variablesTag   ::= "@variables" { IDENTIFIER "=" ( STRING | IDENTIFIER ) }
+```
+
+**Examples:**
+
+```
+@variables NODE_ENV="production" CI="true"
+```
+
+## @before_script
+
+Sets workflow-level setup commands. Applied as defaults to all jobs.
+
+```
+beforeScriptTag ::= "@before_script" ( STRING | TEXT )
+```
+
+**Examples:**
+
+```
+@before_script "npm ci"
+@before_script npm ci
+```
+
+## @tags
+
+Sets workflow-level runner tags. Applied as defaults to all jobs.
+
+```
+tagsTag        ::= "@tags" { IDENTIFIER }
+```
+
+Tags can be space-separated or comma-separated.
+
+**Examples:**
+
+```
+@tags docker linux
+@tags docker,linux,arm64
+```
+
+## @includes
+
+Declares external configuration files to include (GitLab CI). Ignored for GitHub Actions.
+
+```
+includesTag    ::= "@includes" ( "local" | "template" | "remote" | "project" ) "=" STRING
+                   [ "file=" STRING ] [ "ref=" STRING ]
+```
+
+**Examples:**
+
+```
+@includes local="ci/shared-templates.yml"
+@includes template="Auto-DevOps.gitlab-ci.yml"
+@includes remote="https://example.com/ci.yml"
+@includes project="other-group/other-project" file="ci/shared.yml" ref="main"
+```
+
+---
+
 # Pattern Tags
 
 A `@flowWeaver pattern` block defines a reusable partial workflow with boundary ports:
@@ -471,6 +711,7 @@ IDENTIFIER supports `/` and `-` to accommodate npm package naming conventions (e
 # Related Topics
 
 - `advanced-annotations` — Conceptual explanations and examples for pull execution, execution strategies, merge strategies, auto-connect, strict types, path/map sugar, and node attributes
+- `cicd` — CI/CD pipeline export with annotation examples and validation rules
 - `compilation` — How annotations affect code generation, Inngest target details for @trigger/@cancelOn/@retries/@timeout/@throttle
 - `concepts` — Core workflow fundamentals and quick reference
 - `error-codes` — Validation errors and warnings for annotation issues

package/docs/reference/scaffold.md

@@ -92,12 +92,6 @@ flow-weaver templates [--json]
 | `aggregator` | Combine multiple data sources into one output |
 | `webhook` | HTTP-triggered workflow with request/response handling |
 | `error-handler` | Try/catch/retry pattern with error recovery |
-| `ai-agent-durable` | Linear agent pipeline with durability — classify, tools, approval, respond |
-| `ai-pipeline-durable` | Sequential data pipeline with durability — fetch, extract, validate, save |
-| `cicd-test-deploy` | Standard test-and-deploy pipeline with checkout, setup, test, build, and deploy stages |
-| `cicd-docker` | Build and push Docker images to a container registry |
-| `cicd-multi-env` | Multi-environment deployment pipeline with staging and production stages |
-| `cicd-matrix` | Test across multiple Node.js versions and operating systems |
 <!-- AUTO:END workflow_templates_table -->
 
 ## Node Templates

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synergenius/flow-weaver",
-  "version": "0.17.0",
+  "version": "0.17.2",
   "description": "Deterministic workflow compiler for AI agents. Compiles to standalone TypeScript, no runtime dependencies.",
   "private": false,
   "type": "module",
@@ -70,6 +70,14 @@
     "./testing": {
       "types": "./dist/testing/index.d.ts",
       "default": "./dist/testing/index.js"
+    },
+    "./extensions/inngest": {
+      "types": "./dist/extensions/inngest/index.d.ts",
+      "default": "./dist/extensions/inngest/index.js"
+    },
+    "./extensions/cicd": {
+      "types": "./dist/extensions/cicd/index.d.ts",
+      "default": "./dist/extensions/cicd/index.js"
     }
   },
   "bin": {

package/dist/cli/templates/workflows/ai-agent-durable.d.ts

@@ -1,8 +0,0 @@
-/**
- * Durable AI Agent Template
- * Linear agent pipeline with durability annotations for Inngest compilation.
- * Each node maps to a checkpointed step when compiled with: fw export --target inngest
- */
-import type { WorkflowTemplate } from '../index.js';
-export declare const aiAgentDurableTemplate: WorkflowTemplate;
-//# sourceMappingURL=ai-agent-durable.d.ts.map

package/dist/export/templates.d.ts

@@ -1,24 +0,0 @@
-/**
- * Serverless handler templates for different platforms
- */
-/**
- * AWS Lambda handler template
- */
-export declare const LAMBDA_TEMPLATE = "{{GENERATED_HEADER}}\nimport type { APIGatewayProxyEventV2, APIGatewayProxyResultV2, Context } from 'aws-lambda';\n{{WORKFLOW_IMPORT}}\n\nexport const handler = async (\n  event: APIGatewayProxyEventV2,\n  context: Context\n): Promise<APIGatewayProxyResultV2> => {\n  context.callbackWaitsForEmptyEventLoop = false;\n\n  try {\n    const body = typeof event.body === 'string'\n      ? JSON.parse(event.body || '{}')\n      : event.body || {};\n\n    const startTime = Date.now();\n    const result = await {{FUNCTION_NAME}}(true, body);\n\n    return {\n      statusCode: 200,\n      headers: {\n        'Content-Type': 'application/json',\n        'X-Execution-Time': `${Date.now() - startTime}ms`,\n      },\n      body: JSON.stringify({ success: true, result }),\n    };\n  } catch (error) {\n    return {\n      statusCode: 500,\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        success: false,\n        error: error instanceof Error ? error.message : String(error),\n        requestId: context.awsRequestId,\n      }),\n    };\n  }\n};\n";
-/**
- * Vercel serverless function template
- */
-export declare const VERCEL_TEMPLATE = "{{GENERATED_HEADER}}\nimport type { VercelRequest, VercelResponse } from '@vercel/node';\n{{WORKFLOW_IMPORT}}\n\nexport const config = {\n  runtime: 'nodejs20.x',\n  maxDuration: {{MAX_DURATION}},\n};\n\nexport default async function handler(req: VercelRequest, res: VercelResponse) {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method Not Allowed' });\n  }\n\n  try {\n    const params = req.body || {};\n    const startTime = Date.now();\n\n    const result = await {{FUNCTION_NAME}}(true, params);\n\n    return res.status(200).json({\n      success: true,\n      result,\n      executionTime: Date.now() - startTime,\n    });\n  } catch (error) {\n    return res.status(500).json({\n      success: false,\n      error: error instanceof Error ? error.message : String(error),\n    });\n  }\n}\n";
-/**
- * Cloudflare Workers template
- */
-export declare const CLOUDFLARE_TEMPLATE = "{{GENERATED_HEADER}}\n{{WORKFLOW_IMPORT}}\n\ninterface Env {\n  // Add your bindings here (D1, KV, R2, etc.)\n}\n\nexport default {\n  async fetch(request: Request, env: Env): Promise<Response> {\n    if (request.method !== 'POST') {\n      return new Response(JSON.stringify({ error: 'Method Not Allowed' }), {\n        status: 405,\n        headers: { 'Content-Type': 'application/json' },\n      });\n    }\n\n    try {\n      const body = await request.json() as Record<string, unknown>;\n      const startTime = performance.now();\n\n      const result = await {{FUNCTION_NAME}}(true, body);\n\n      return new Response(JSON.stringify({\n        success: true,\n        result,\n        executionTime: Math.round(performance.now() - startTime),\n      }), {\n        status: 200,\n        headers: { 'Content-Type': 'application/json' },\n      });\n    } catch (error) {\n      return new Response(JSON.stringify({\n        success: false,\n        error: error instanceof Error ? error.message : String(error),\n      }), {\n        status: 500,\n        headers: { 'Content-Type': 'application/json' },\n      });\n    }\n  },\n} satisfies ExportedHandler<Env>;\n";
-/**
- * Inngest durable function template
- */
-export declare const INNGEST_TEMPLATE = "{{GENERATED_HEADER}}\nimport { Inngest } from 'inngest';\nimport { serve } from 'inngest/express';\n{{WORKFLOW_IMPORT}}\n\nconst inngest = new Inngest({ id: 'fw-{{FUNCTION_NAME}}' });\n\nconst workflowFn = inngest.createFunction(\n  { id: '{{FUNCTION_NAME}}', name: '{{FUNCTION_NAME}}' },\n  { event: 'fw/{{FUNCTION_NAME}}.execute' },\n  async ({ event, step }) => {\n    const params = event.data ?? {};\n\n    const result = await step.run('execute-workflow', async () => {\n      return {{FUNCTION_NAME}}(true, params);\n    });\n\n    return { success: true, result };\n  }\n);\n\nexport const handler = serve({ client: inngest, functions: [workflowFn] });\nexport default handler;\n";
-/**
- * SAM (Serverless Application Model) template for AWS Lambda
- */
-export declare const SAM_TEMPLATE = "AWSTemplateFormatVersion: '2010-09-09'\nTransform: AWS::Serverless-2016-10-31\nDescription: Flow Weaver workflow - {{WORKFLOW_NAME}}\n\nGlobals:\n  Function:\n    Timeout: 30\n    Runtime: nodejs20.x\n    MemorySize: 256\n\nResources:\n  WorkflowFunction:\n    Type: AWS::Serverless::Function\n    Properties:\n      Handler: handler.handler\n      CodeUri: .\n      Description: {{WORKFLOW_DESCRIPTION}}\n      Events:\n        ApiEvent:\n          Type: HttpApi\n          Properties:\n            Path: /{{WORKFLOW_PATH}}\n            Method: POST\n\nOutputs:\n  ApiEndpoint:\n    Description: API endpoint URL\n    Value: !Sub \"https://${ServerlessHttpApi}.execute-api.${AWS::Region}.amazonaws.com/{{WORKFLOW_PATH}}\"\n";
-//# sourceMappingURL=templates.d.ts.map

package/dist/export/templates.js

@@ -1,186 +0,0 @@
-/**
- * Serverless handler templates for different platforms
- */
-/**
- * AWS Lambda handler template
- */
-export const LAMBDA_TEMPLATE = `{{GENERATED_HEADER}}
-import type { APIGatewayProxyEventV2, APIGatewayProxyResultV2, Context } from 'aws-lambda';
-{{WORKFLOW_IMPORT}}
-
-export const handler = async (
-  event: APIGatewayProxyEventV2,
-  context: Context
-): Promise<APIGatewayProxyResultV2> => {
-  context.callbackWaitsForEmptyEventLoop = false;
-
-  try {
-    const body = typeof event.body === 'string'
-      ? JSON.parse(event.body || '{}')
-      : event.body || {};
-
-    const startTime = Date.now();
-    const result = await {{FUNCTION_NAME}}(true, body);
-
-    return {
-      statusCode: 200,
-      headers: {
-        'Content-Type': 'application/json',
-        'X-Execution-Time': \`\${Date.now() - startTime}ms\`,
-      },
-      body: JSON.stringify({ success: true, result }),
-    };
-  } catch (error) {
-    return {
-      statusCode: 500,
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({
-        success: false,
-        error: error instanceof Error ? error.message : String(error),
-        requestId: context.awsRequestId,
-      }),
-    };
-  }
-};
-`;
-/**
- * Vercel serverless function template
- */
-export const VERCEL_TEMPLATE = `{{GENERATED_HEADER}}
-import type { VercelRequest, VercelResponse } from '@vercel/node';
-{{WORKFLOW_IMPORT}}
-
-export const config = {
-  runtime: 'nodejs20.x',
-  maxDuration: {{MAX_DURATION}},
-};
-
-export default async function handler(req: VercelRequest, res: VercelResponse) {
-  if (req.method !== 'POST') {
-    return res.status(405).json({ error: 'Method Not Allowed' });
-  }
-
-  try {
-    const params = req.body || {};
-    const startTime = Date.now();
-
-    const result = await {{FUNCTION_NAME}}(true, params);
-
-    return res.status(200).json({
-      success: true,
-      result,
-      executionTime: Date.now() - startTime,
-    });
-  } catch (error) {
-    return res.status(500).json({
-      success: false,
-      error: error instanceof Error ? error.message : String(error),
-    });
-  }
-}
-`;
-/**
- * Cloudflare Workers template
- */
-export const CLOUDFLARE_TEMPLATE = `{{GENERATED_HEADER}}
-{{WORKFLOW_IMPORT}}
-
-interface Env {
-  // Add your bindings here (D1, KV, R2, etc.)
-}
-
-export default {
-  async fetch(request: Request, env: Env): Promise<Response> {
-    if (request.method !== 'POST') {
-      return new Response(JSON.stringify({ error: 'Method Not Allowed' }), {
-        status: 405,
-        headers: { 'Content-Type': 'application/json' },
-      });
-    }
-
-    try {
-      const body = await request.json() as Record<string, unknown>;
-      const startTime = performance.now();
-
-      const result = await {{FUNCTION_NAME}}(true, body);
-
-      return new Response(JSON.stringify({
-        success: true,
-        result,
-        executionTime: Math.round(performance.now() - startTime),
-      }), {
-        status: 200,
-        headers: { 'Content-Type': 'application/json' },
-      });
-    } catch (error) {
-      return new Response(JSON.stringify({
-        success: false,
-        error: error instanceof Error ? error.message : String(error),
-      }), {
-        status: 500,
-        headers: { 'Content-Type': 'application/json' },
-      });
-    }
-  },
-} satisfies ExportedHandler<Env>;
-`;
-/**
- * Inngest durable function template
- */
-export const INNGEST_TEMPLATE = `{{GENERATED_HEADER}}
-import { Inngest } from 'inngest';
-import { serve } from 'inngest/express';
-{{WORKFLOW_IMPORT}}
-
-const inngest = new Inngest({ id: 'fw-{{FUNCTION_NAME}}' });
-
-const workflowFn = inngest.createFunction(
-  { id: '{{FUNCTION_NAME}}', name: '{{FUNCTION_NAME}}' },
-  { event: 'fw/{{FUNCTION_NAME}}.execute' },
-  async ({ event, step }) => {
-    const params = event.data ?? {};
-
-    const result = await step.run('execute-workflow', async () => {
-      return {{FUNCTION_NAME}}(true, params);
-    });
-
-    return { success: true, result };
-  }
-);
-
-export const handler = serve({ client: inngest, functions: [workflowFn] });
-export default handler;
-`;
-/**
- * SAM (Serverless Application Model) template for AWS Lambda
- */
-export const SAM_TEMPLATE = `AWSTemplateFormatVersion: '2010-09-09'
-Transform: AWS::Serverless-2016-10-31
-Description: Flow Weaver workflow - {{WORKFLOW_NAME}}
-
-Globals:
-  Function:
-    Timeout: 30
-    Runtime: nodejs20.x
-    MemorySize: 256
-
-Resources:
-  WorkflowFunction:
-    Type: AWS::Serverless::Function
-    Properties:
-      Handler: handler.handler
-      CodeUri: .
-      Description: {{WORKFLOW_DESCRIPTION}}
-      Events:
-        ApiEvent:
-          Type: HttpApi
-          Properties:
-            Path: /{{WORKFLOW_PATH}}
-            Method: POST
-
-Outputs:
-  ApiEndpoint:
-    Description: API endpoint URL
-    Value: !Sub "https://\${ServerlessHttpApi}.execute-api.\${AWS::Region}.amazonaws.com/{{WORKFLOW_PATH}}"
-`;
-//# sourceMappingURL=templates.js.map

package/dist/validation/cicd-rules.d.ts

@@ -1,62 +0,0 @@
-/**
- * CI/CD-Specific Validation Rules
- *
- * Custom TValidationRule implementations for CI/CD pipeline workflows.
- * These run AFTER the built-in validator via the api/validate.ts custom rules injection.
- *
- * Rules:
- * 1. CICD_SECRET_NOT_DECLARED - secret:X referenced but no @secret X declared
- * 2. CICD_SECRET_UNUSED - @secret X declared but never wired
- * 3. CICD_TRIGGER_MISSING - No trigger annotations — pipeline would never run
- * 4. CICD_JOB_MISSING_RUNNER - Job has no runner (uses workflow default or none)
- * 5. CICD_ARTIFACT_CROSS_JOB - Data flows between jobs without @artifact declaration
- * 6. CICD_CIRCULAR_JOB_DEPS - Job dependency cycle detected
- * 7. CICD_MATRIX_WITH_ENVIRONMENT - Matrix + environment = N approval prompts
- */
-import type { TValidationRule } from '../ast/types.js';
-/**
- * A `secret:X` pseudo-node is referenced in @connect but no `@secret X` is declared.
- * This means the export target won't know about the secret and can't generate
- * proper environment variable references.
- */
-export declare const secretNotDeclaredRule: TValidationRule;
-/**
- * A `@secret X` is declared but never wired via `@connect secret:X -> ...`.
- * The secret might be intentional (used in a shell-command step) or a leftover.
- */
-export declare const secretUnusedRule: TValidationRule;
-/**
- * A CI/CD workflow with no trigger annotations would never run automatically.
- * Needs at least one @trigger (push, pull_request, schedule, dispatch, or tag).
- */
-export declare const triggerMissingRule: TValidationRule;
-/**
- * A job (group of nodes with same [job: "name"]) has no explicit runner
- * and the workflow has no default @runner. The export target will use a
- * platform default, which may not be what the user expects.
- */
-export declare const jobMissingRunnerRule: TValidationRule;
-/**
- * Data flows between nodes in different jobs via connections, but no @artifact
- * is declared. In CI/CD, each job runs in a fresh environment — data must be
- * explicitly passed via artifacts.
- */
-export declare const artifactCrossJobRule: TValidationRule;
-/**
- * Job dependencies (derived from @path connections between jobs) form a cycle.
- * CI/CD platforms reject circular job dependencies.
- */
-export declare const circularJobDepsRule: TValidationRule;
-/**
- * Using @matrix with @environment protection means each matrix combination
- * triggers an approval prompt. For a 3x2 matrix, that's 6 prompts.
- */
-export declare const matrixWithEnvironmentRule: TValidationRule;
-/** All CI/CD validation rules */
-export declare const cicdValidationRules: TValidationRule[];
-/**
- * Get all CI/CD validation rules.
- * Convenience function for passing to validateWorkflow().
- */
-export declare function getCICDValidationRules(): TValidationRule[];
-//# sourceMappingURL=cicd-rules.d.ts.map