create-windy 0.6.14 → 0.6.16

package/dist/cli.js

@@ -33,7 +33,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
 var __require = import.meta.require;
 
-// ../../node_modules/cli-width/index.js
+// ../../node_modules/.bun/cli-width@4.1.0/node_modules/cli-width/index.js
 var require_cli_width = __commonJS((exports, module2) => {
   module2.exports = cliWidth;
   function normalizeOpts(options) {
@@ -73,7 +73,7 @@ var require_cli_width = __commonJS((exports, module2) => {
   }
 });
 
-// ../../node_modules/mute-stream/lib/index.js
+// ../../node_modules/.bun/mute-stream@3.0.0/node_modules/mute-stream/lib/index.js
 var require_lib = __commonJS((exports, module2) => {
   var Stream = __require("stream");
 
@@ -304,6 +304,7 @@ var agentOptionalModule = {
     "apps/server/src/app/ai-screenshot-intake-binding.ts",
     "apps/server/src/app/agent-runtime-composition.ts",
     "apps/server/src/app/client-agent-host-auth-binding.ts",
+    "apps/server/src/app/client-agent-workflow-artifact-binding.ts",
     "apps/server/src/app/document-output-artifact-bindings.ts",
     "apps/server/src/app/speech-output-artifact-bindings.ts",
     "apps/server/src/ai-artifact",
@@ -316,6 +317,10 @@ var agentOptionalModule = {
     "apps/server/src/module-host/ai-operation-port.test.ts",
     "apps/server/src/module-host/agent-session-memory-port.ts",
     "apps/server/src/module-host/agent-source-invalidation-port.ts",
+    "apps/server/src/module-host/workflow-input-artifact-port.ts",
+    "apps/server/src/module-host/workflow-input-artifact-port.test.ts",
+    "apps/server/src/module-host/workflow-input-materialization.ts",
+    "apps/server/src/module-host/workflow-input-materialization.test.ts",
     "apps/server/src/module-host/tool-handlers.ts",
     "apps/server/src/module-host/tool-handlers.test.ts",
     "apps/server/src/module-host/module-secret-tool-boundary.test.ts",
@@ -346,6 +351,12 @@ var agentOptionalModule = {
     "packages/modules/src/system-ai-api-bindings.ts",
     "packages/server-sdk/src/system-agent-supervisor.ts",
     "packages/server-sdk/src/system-agent-supervisor.test.ts",
+    "packages/server-sdk/src/client-agent-workflow-artifact.ts",
+    "packages/server-sdk/src/client-agent-workflow-artifact.contract.test.ts",
+    "packages/server-sdk/src/workflow-input-artifact-port.ts",
+    "packages/server-sdk/src/workflow-input-artifact-validation.ts",
+    "packages/server-sdk/src/workflow-input-artifact-validation.contract.test.ts",
+    "packages/server-sdk/src/workflow-input-materialization-handler.ts",
     "packages/database/src/agent-runtime-schema.test.ts",
     "packages/database/src/ai-output-artifacts.test.ts",
     "packages/shared/src/agent-workflow-definition.ts",
@@ -362,6 +373,7 @@ var agentOptionalModule = {
     "docs/adr/0003-agent-session-event-source.md",
     "docs/architecture/agent-harness.md",
     "docs/architecture/agent-workflow.md",
+    "docs/architecture/durable-jobs.md",
     "docs/architecture/ai-egress.md",
     "docs/architecture/ai-runtime-readiness.md",
     "docs/architecture/ai-runtime.md",
@@ -396,6 +408,7 @@ var agentOptionalModule = {
     "packages/database/src/schema/agent-workflow-effects.ts",
     "packages/database/src/schema/agent-workflow-evaluation.ts",
     "packages/database/src/schema/client-agent.ts",
+    "packages/database/src/schema/client-agent-workflow-artifact.ts",
     "packages/database/src/schema/embedding-runtime.ts",
     "packages/database/src/schema/ai-output-artifacts.ts"
   ],
@@ -410,6 +423,7 @@ var agentOptionalModule = {
     "agent_runtime_report_attempts",
     "client_agent_sessions",
     "client_agent_receipts",
+    "client_agent_workflow_artifacts",
     "embedding_run_bindings",
     "ai_output_artifact_scopes",
     "ai_output_artifacts",
@@ -439,7 +453,8 @@ var agentOptionalModule = {
     "idx_agent_context_sources_origin",
     "idx_agent_memory_sources_origin",
     "uk_agent_source_invalidations_sequence",
-    "agent_workflow_"
+    "agent_workflow_",
+    "client_agent_workflow_"
   ]
 };
 
@@ -4651,7 +4666,7 @@ function isMissing6(error) {
 import { createInterface as createInterface2 } from "readline/promises";
 import { stdin, stdout } from "process";
 
-// ../../node_modules/@inquirer/core/dist/lib/key.js
+// ../../node_modules/.bun/@inquirer+core@11.2.1+7cb241fc07b679d9/node_modules/@inquirer/core/dist/lib/key.js
 var keybindings = ["emacs", "vim"];
 var keybindingLookup = new Set(keybindings);
 function isKeybinding(value) {
@@ -4668,7 +4683,7 @@ var isDownKey = (key, keybindings2 = []) => key.name === "down" || keybindings2.
 var isSpaceKey = (key) => key.name === "space";
 var isNumberKey = (key) => "1234567890".includes(key.name);
 var isEnterKey = (key) => key.name === "enter" || key.name === "return";
-// ../../node_modules/@inquirer/core/dist/lib/errors.js
+// ../../node_modules/.bun/@inquirer+core@11.2.1+7cb241fc07b679d9/node_modules/@inquirer/core/dist/lib/errors.js
 class AbortPromptError extends Error {
   name = "AbortPromptError";
   message = "Prompt was aborted";
@@ -4694,10 +4709,10 @@ class HookError extends Error {
 class ValidationError extends Error {
   name = "ValidationError";
 }
-// ../../node_modules/@inquirer/core/dist/lib/use-state.js
+// ../../node_modules/.bun/@inquirer+core@11.2.1+7cb241fc07b679d9/node_modules/@inquirer/core/dist/lib/use-state.js
 import { AsyncResource as AsyncResource2 } from "async_hooks";
 
-// ../../node_modules/@inquirer/core/dist/lib/hook-engine.js
+// ../../node_modules/.bun/@inquirer+core@11.2.1+7cb241fc07b679d9/node_modules/@inquirer/core/dist/lib/hook-engine.js
 import { AsyncLocalStorage, AsyncResource } from "async_hooks";
 var hookStorage = new AsyncLocalStorage;
 function createStore(rl) {
@@ -4802,7 +4817,7 @@ var effectScheduler = {
   }
 };
 
-// ../../node_modules/@inquirer/core/dist/lib/use-state.js
+// ../../node_modules/.bun/@inquirer+core@11.2.1+7cb241fc07b679d9/node_modules/@inquirer/core/dist/lib/use-state.js
 function isFactory(value) {
   return typeof value === "function";
 }
@@ -4823,7 +4838,7 @@ function useState(defaultValue) {
   });
 }
 
-// ../../node_modules/@inquirer/core/dist/lib/use-effect.js
+// ../../node_modules/.bun/@inquirer+core@11.2.1+7cb241fc07b679d9/node_modules/@inquirer/core/dist/lib/use-effect.js
 function useEffect(cb, depArray) {
   withPointer((pointer) => {
     const oldDeps = pointer.get();
@@ -4835,10 +4850,10 @@ function useEffect(cb, depArray) {
   });
 }
 
-// ../../node_modules/@inquirer/core/dist/lib/theme.js
+// ../../node_modules/.bun/@inquirer+core@11.2.1+7cb241fc07b679d9/node_modules/@inquirer/core/dist/lib/theme.js
 import { styleText } from "util";
 
-// ../../node_modules/@inquirer/figures/dist/index.js
+// ../../node_modules/.bun/@inquirer+figures@2.0.7/node_modules/@inquirer/figures/dist/index.js
 import process2 from "process";
 function isUnicodeSupported() {
   if (!process2.platform.startsWith("win")) {
@@ -5127,7 +5142,7 @@ var figures = shouldUseMain ? mainSymbols : fallbackSymbols;
 var dist_default = figures;
 var replacements = Object.entries(specialMainSymbols);
 
-// ../../node_modules/@inquirer/core/dist/lib/theme.js
+// ../../node_modules/.bun/@inquirer+core@11.2.1+7cb241fc07b679d9/node_modules/@inquirer/core/dist/lib/theme.js
 var defaultTheme = {
   prefix: {
     idle: styleText("blue", "?"),
@@ -5155,7 +5170,7 @@ function getDefaultTheme() {
   };
 }
 
-// ../../node_modules/@inquirer/core/dist/lib/make-theme.js
+// ../../node_modules/.bun/@inquirer+core@11.2.1+7cb241fc07b679d9/node_modules/@inquirer/core/dist/lib/make-theme.js
 function isPlainObject(value) {
   if (typeof value !== "object" || value === null)
     return false;
@@ -5183,7 +5198,7 @@ function makeTheme(...themes) {
   return deepMerge(...themesToMerge);
 }
 
-// ../../node_modules/@inquirer/core/dist/lib/use-prefix.js
+// ../../node_modules/.bun/@inquirer+core@11.2.1+7cb241fc07b679d9/node_modules/@inquirer/core/dist/lib/use-prefix.js
 function usePrefix({ status = "idle", theme }) {
   const [showLoader, setShowLoader] = useState(false);
   const [tick, setTick] = useState(0);
@@ -5213,7 +5228,7 @@ function usePrefix({ status = "idle", theme }) {
   const iconName = status === "loading" ? "idle" : status;
   return typeof prefix === "string" ? prefix : prefix[iconName] ?? prefix["idle"];
 }
-// ../../node_modules/@inquirer/core/dist/lib/use-memo.js
+// ../../node_modules/.bun/@inquirer+core@11.2.1+7cb241fc07b679d9/node_modules/@inquirer/core/dist/lib/use-memo.js
 function useMemo(fn, dependencies) {
   return withPointer((pointer) => {
     const prev = pointer.get();
@@ -5225,12 +5240,12 @@ function useMemo(fn, dependencies) {
     return prev.value;
   });
 }
-// ../../node_modules/@inquirer/core/dist/lib/use-ref.js
+// ../../node_modules/.bun/@inquirer+core@11.2.1+7cb241fc07b679d9/node_modules/@inquirer/core/dist/lib/use-ref.js
 function useRef(val) {
   return useState({ current: val })[0];
 }
 
-// ../../node_modules/@inquirer/core/dist/lib/use-keypress.js
+// ../../node_modules/.bun/@inquirer+core@11.2.1+7cb241fc07b679d9/node_modules/@inquirer/core/dist/lib/use-keypress.js
 function useKeypress(userHandler) {
   const signal = useRef(userHandler);
   signal.current = userHandler;
@@ -5248,10 +5263,10 @@ function useKeypress(userHandler) {
     };
   }, []);
 }
-// ../../node_modules/@inquirer/core/dist/lib/utils.js
+// ../../node_modules/.bun/@inquirer+core@11.2.1+7cb241fc07b679d9/node_modules/@inquirer/core/dist/lib/utils.js
 var import_cli_width = __toESM(require_cli_width(), 1);
 
-// ../../node_modules/fast-string-truncated-width/dist/utils.js
+// ../../node_modules/.bun/fast-string-truncated-width@3.0.3/node_modules/fast-string-truncated-width/dist/utils.js
 var getCodePointsLength = (() => {
   const SURROGATE_PAIR_RE = /[\uD800-\uDBFF][\uDC00-\uDFFF]/g;
   return (input) => {
@@ -5270,7 +5285,7 @@ var isWideNotCJKTNotEmoji = (x) => {
   return x === 8987 || x === 9001 || x >= 12272 && x <= 12287 || x >= 12289 && x <= 12350 || x >= 12441 && x <= 12543 || x >= 12549 && x <= 12591 || x >= 12593 && x <= 12686 || x >= 12688 && x <= 12771 || x >= 12783 && x <= 12830 || x >= 12832 && x <= 12871 || x >= 12880 && x <= 19903 || x >= 65040 && x <= 65049 || x >= 65072 && x <= 65106 || x >= 65108 && x <= 65126 || x >= 65128 && x <= 65131 || x >= 127488 && x <= 127490 || x >= 127504 && x <= 127547 || x >= 127552 && x <= 127560 || x >= 131072 && x <= 196605 || x >= 196608 && x <= 262141;
 };
 
-// ../../node_modules/fast-string-truncated-width/dist/index.js
+// ../../node_modules/.bun/fast-string-truncated-width@3.0.3/node_modules/fast-string-truncated-width/dist/index.js
 var ANSI_RE = /[\u001b\u009b][[()#;?]*(?:[0-9]{1,4}(?:;[0-9]{0,4})*)?[0-9A-ORZcf-nqry=><]|\u001b\]8;[^;]*;.*?(?:\u0007|\u001b\u005c)/y;
 var CONTROL_RE = /[\x00-\x08\x0A-\x1F\x7F-\x9F]{1,1000}/y;
 var CJKT_WIDE_RE = /(?:(?![\uFF61-\uFF9F\uFF00-\uFFEF])[\p{Script=Han}\p{Script=Hiragana}\p{Script=Katakana}\p{Script=Hangul}\p{Script=Tangut}]){1,1000}/yu;
@@ -5369,7 +5384,7 @@ var getStringTruncatedWidth = (input, truncationOptions = {}, widthOptions = {})
 };
 var dist_default2 = getStringTruncatedWidth;
 
-// ../../node_modules/fast-string-width/dist/index.js
+// ../../node_modules/.bun/fast-string-width@3.0.2/node_modules/fast-string-width/dist/index.js
 var NO_TRUNCATION2 = {
   limit: Infinity,
   ellipsis: "",
@@ -5380,7 +5395,7 @@ var fastStringWidth = (input, options = {}) => {
 };
 var dist_default3 = fastStringWidth;
 
-// ../../node_modules/fast-wrap-ansi/lib/main.js
+// ../../node_modules/.bun/fast-wrap-ansi@0.2.2/node_modules/fast-wrap-ansi/lib/main.js
 var ESC = "\x1B";
 var CSI = "\x9B";
 var END_CODE = 39;
@@ -5592,7 +5607,7 @@ function wrapAnsi(string, columns, options) {
 `);
 }
 
-// ../../node_modules/@inquirer/core/dist/lib/utils.js
+// ../../node_modules/.bun/@inquirer+core@11.2.1+7cb241fc07b679d9/node_modules/@inquirer/core/dist/lib/utils.js
 function breakLines(content, width) {
   return content.split(`
 `).flatMap((line) => wrapAnsi(line, width, { trim: false, wordWrap: false }).split(`
@@ -5603,7 +5618,7 @@ function readlineWidth() {
   return import_cli_width.default({ defaultWidth: 80, output: readline().output });
 }
 
-// ../../node_modules/@inquirer/core/dist/lib/pagination/use-pagination.js
+// ../../node_modules/.bun/@inquirer+core@11.2.1+7cb241fc07b679d9/node_modules/@inquirer/core/dist/lib/pagination/use-pagination.js
 function usePointerPosition({ active, renderedItems, pageSize, loop }) {
   const state = useRef({
     lastPointer: active,
@@ -5669,12 +5684,12 @@ function usePagination({ items, active, renderItem, pageSize, loop = true }) {
   return pageBuffer.filter((line) => typeof line === "string").join(`
 `);
 }
-// ../../node_modules/@inquirer/core/dist/lib/create-prompt.js
+// ../../node_modules/.bun/@inquirer+core@11.2.1+7cb241fc07b679d9/node_modules/@inquirer/core/dist/lib/create-prompt.js
 var import_mute_stream = __toESM(require_lib(), 1);
 import * as readline2 from "readline";
 import { AsyncResource as AsyncResource3 } from "async_hooks";
 
-// ../../node_modules/signal-exit/dist/mjs/signals.js
+// ../../node_modules/.bun/signal-exit@4.1.0/node_modules/signal-exit/dist/mjs/signals.js
 var signals = [];
 signals.push("SIGHUP", "SIGINT", "SIGTERM");
 if (process.platform !== "win32") {
@@ -5684,7 +5699,7 @@ if (process.platform === "linux") {
   signals.push("SIGIO", "SIGPOLL", "SIGPWR", "SIGSTKFLT");
 }
 
-// ../../node_modules/signal-exit/dist/mjs/index.js
+// ../../node_modules/.bun/signal-exit@4.1.0/node_modules/signal-exit/dist/mjs/index.js
 var processOk = (process3) => !!process3 && typeof process3 === "object" && typeof process3.removeListener === "function" && typeof process3.emit === "function" && typeof process3.reallyExit === "function" && typeof process3.listeners === "function" && typeof process3.kill === "function" && typeof process3.pid === "number" && typeof process3.on === "function";
 var kExitEmitter = Symbol.for("signal-exit emitter");
 var global = globalThis;
@@ -5882,10 +5897,10 @@ var {
   unload
 } = signalExitWrap(processOk(process3) ? new SignalExit(process3) : new SignalExitFallback);
 
-// ../../node_modules/@inquirer/core/dist/lib/screen-manager.js
+// ../../node_modules/.bun/@inquirer+core@11.2.1+7cb241fc07b679d9/node_modules/@inquirer/core/dist/lib/screen-manager.js
 import { stripVTControlCharacters } from "util";
 
-// ../../node_modules/@inquirer/ansi/dist/index.js
+// ../../node_modules/.bun/@inquirer+ansi@2.0.7/node_modules/@inquirer/ansi/dist/index.js
 var ESC2 = "\x1B[";
 var cursorLeft = ESC2 + "G";
 var cursorHide = ESC2 + "?25l";
@@ -5901,7 +5916,7 @@ var cursorTo = (x, y) => {
 var eraseLine = ESC2 + "2K";
 var eraseLines = (lines) => lines > 0 ? (eraseLine + cursorUp(1)).repeat(lines - 1) + eraseLine + cursorLeft : "";
 
-// ../../node_modules/@inquirer/core/dist/lib/screen-manager.js
+// ../../node_modules/.bun/@inquirer+core@11.2.1+7cb241fc07b679d9/node_modules/@inquirer/core/dist/lib/screen-manager.js
 var height = (content) => content.split(`
 `).length;
 var lastLine = (content) => content.split(`
@@ -5967,7 +5982,7 @@ class ScreenManager {
   }
 }
 
-// ../../node_modules/@inquirer/core/dist/lib/promise-polyfill.js
+// ../../node_modules/.bun/@inquirer+core@11.2.1+7cb241fc07b679d9/node_modules/@inquirer/core/dist/lib/promise-polyfill.js
 class PromisePolyfill extends Promise {
   static withResolver() {
     let resolve6;
@@ -5980,7 +5995,7 @@ class PromisePolyfill extends Promise {
   }
 }
 
-// ../../node_modules/@inquirer/core/dist/lib/create-prompt.js
+// ../../node_modules/.bun/@inquirer+core@11.2.1+7cb241fc07b679d9/node_modules/@inquirer/core/dist/lib/create-prompt.js
 import path from "path";
 var nativeSetImmediate = globalThis.setImmediate;
 function getCallSites() {
@@ -6091,7 +6106,7 @@ function createPrompt(view) {
   };
   return prompt;
 }
-// ../../node_modules/@inquirer/core/dist/lib/Separator.js
+// ../../node_modules/.bun/@inquirer+core@11.2.1+7cb241fc07b679d9/node_modules/@inquirer/core/dist/lib/Separator.js
 import { styleText as styleText2 } from "util";
 class Separator {
   separator = styleText2("dim", Array.from({ length: 15 }).join(dist_default.line));
@@ -6105,7 +6120,7 @@ class Separator {
     return Boolean(choice && typeof choice === "object" && "type" in choice && choice.type === "separator");
   }
 }
-// ../../node_modules/@inquirer/checkbox/dist/index.js
+// ../../node_modules/.bun/@inquirer+checkbox@5.2.1+7cb241fc07b679d9/node_modules/@inquirer/checkbox/dist/index.js
 import { styleText as styleText3 } from "util";
 var checkboxTheme = {
   icon: {
@@ -7458,11 +7473,14 @@ async function retainTransactionConflicts(root, paths, conflictArtifacts = []) {
   const current = await readTransactionState(root);
   if (!current)
     throw new Error("\u7F3A\u5C11\u53EF\u4FDD\u7559\u7684\u66F4\u65B0\u4E8B\u52A1\u72B6\u6001");
+  const preservePaths = [
+    ...new Set([...current.preservePaths ?? [], ...paths])
+  ].filter((path2) => path2 !== updateStatePath);
   const next = {
     ...current,
-    preservePaths: [...new Set([...current.preservePaths ?? [], ...paths])],
+    preservePaths: preservePaths.length ? preservePaths : undefined,
     conflictArtifacts: [
-      ...new Map([...current.conflictArtifacts ?? [], ...conflictArtifacts].map((artifact) => [artifact.artifactPath, artifact])).values()
+      ...new Map([...current.conflictArtifacts ?? [], ...conflictArtifacts].filter((artifact) => artifact.path !== updateStatePath).map((artifact) => [artifact.artifactPath, artifact])).values()
     ]
   };
   await publishTransactionState(root, current, next);
@@ -7714,6 +7732,8 @@ async function assertRestoredEntries(root, state, backups) {
 async function unresolvedPreservePaths(root, backupPath, state) {
   const unresolved = [];
   for (const path2 of state.preservePaths ?? []) {
+    if (path2 === updateStatePath)
+      continue;
     const entry = state.entries.find((candidate) => candidate.path === path2);
     if (!entry) {
       unresolved.push(path2);
@@ -8452,6 +8472,16 @@ var recipes = [
     id: "starter-0.6.13-to-0.6.14",
     from: "0.6.13",
     to: "0.6.14"
+  },
+  {
+    id: "starter-0.6.14-to-0.6.15",
+    from: "0.6.14",
+    to: "0.6.15"
+  },
+  {
+    id: "starter-0.6.15-to-0.6.16",
+    from: "0.6.15",
+    to: "0.6.16"
   }
 ];
 function resolveRecipeChain(sourceVersion, targetVersion) {
@@ -9813,6 +9843,163 @@ function conflict(path2, reason, expectedProjectContent) {
   };
 }
 
+// src/update/recipe-project-owned-client-workflow.ts
+var clientWorkflowCompositionPath = "apps/server/src/app/agent-runtime-composition.ts";
+var clientWorkflowBindingPath = "apps/server/src/app/client-agent-workflow-artifact-binding.ts";
+var legacyDefaultBinding = `import type { ModuleClientAgentWorkflowArtifactProjectBinding } from "@southwind-ai/server-sdk";
+
+/**
+ * Project-owned Workflow -> PageAgent \u7ED1\u5B9A\u3002Starter \u9ED8\u8BA4\u7A7A\u6570\u7EC4\u5E76 fail closed\uFF1B
+ * \u4EA7\u54C1\u53EA\u4E3A\u5DF2\u5BA1\u6838\u3001\u5DF2\u53D1\u5E03\u7684\u56FA\u5B9A Workflow Job node \u589E\u52A0\u9759\u6001\u7ED1\u5B9A\u3002
+ */
+export const projectClientAgentWorkflowArtifactBindings: readonly ModuleClientAgentWorkflowArtifactProjectBinding[] =
+  [];
+`;
+var immutableReleaseDefaultBinding = `import type { ModuleClientAgentWorkflowArtifactProjectBinding } from "@southwind-ai/server-sdk";
+
+/**
+ * Project-owned Workflow -> PageAgent \u7ED1\u5B9A\u3002Starter \u9ED8\u8BA4\u7A7A\u6570\u7EC4\u5E76 fail closed\uFF1B
+ * \u4EA7\u54C1\u53EA\u4E3A\u5DF2\u5BA1\u6838\u3001\u5DF2\u53D1\u5E03\u7684\u56FA\u5B9A Workflow Job node \u589E\u52A0\u9759\u6001\u7ED1\u5B9A\u3002Operation \u5FC5\u987B\u58F0\u660E
+ * \`clientExecution.launchAuthority="workflow-artifact"\`\uFF1Bbinding \u5FC5\u987B\u767B\u8BB0 Immutable
+ * canonical \`releaseDigest\`\u3001scope containment contract v1\uFF0C\u4EE5\u53CA project launch\u3001client task\u3001terminal
+ * authority version/digest\u3002launch authority \u4ECE Host \u5F53\u524D scope \u663E\u5F0F\u6536\u7A84\uFF1Bterminal authority
+ * \u540C\u65F6\u590D\u9A8C Host \u91CD\u6388\u6743\u5E76\u6253\u5F00\u7684 canonical input artifacts\u3002project preset \u4F7F\u7528
+ * runtime.agentWorkflowProjects\uFF1B\u666E\u901A routes \u6C38\u8FDC\u4E0D\u80FD\u53D1\u5E03/\u542F\u52A8\u53D7\u4FDD\u62A4 Workflow\u3002
+ * \u53D1\u5E03 Release \u6216 authority contract \u540E\u5FC5\u987B\u91CD\u65B0\u5BA1\u6838\u5E76\u663E\u5F0F\u66F4\u65B0\u3002
+ */
+export const projectClientAgentWorkflowArtifactBindings: readonly ModuleClientAgentWorkflowArtifactProjectBinding[] =
+  [];
+`;
+var immutableReleaseCompositionHash = "98c23266799311cf26c160374aad738456888f3c04f40f3667122e28b3e8e188";
+var hostAuthImport = 'import { projectClientAgentHostAuthAdapter } from "./client-agent-host-auth-binding.js";';
+var workflowArtifactImport = 'import { projectClientAgentWorkflowArtifactBindings } from "./client-agent-workflow-artifact-binding.js";';
+var oldOmit = '    "clientAgentHostAuth" | "screenshotPageRegistry"';
+var newOmit = `    | "clientAgentHostAuth"
+    | "clientAgentWorkflowArtifactBindings"
+    | "screenshotPageRegistry"`;
+var hostAuthProperty = "    clientAgentHostAuth: projectClientAgentHostAuthAdapter,";
+var workflowArtifactProperty = `    clientAgentWorkflowArtifactBindings:
+      projectClientAgentWorkflowArtifactBindings,`;
+function planClientWorkflowProjectOwned(input) {
+  return input.path === clientWorkflowBindingPath ? planBinding(input) : planComposition(input);
+}
+function planBinding(input) {
+  if (!input.target)
+    return conflict2(input, "\u76EE\u6807\u7248\u672C\u7F3A\u5C11 Workflow binding seam");
+  const target = decode(input.target);
+  if (target !== immutableReleaseDefaultBinding) {
+    return conflict2(input, "\u76EE\u6807\u7248\u672C Workflow binding seam \u5951\u7EA6\u65E0\u6548");
+  }
+  if (!input.ours) {
+    return ready2(input, "create", "\u65B0\u589E\u9ED8\u8BA4\u5173\u95ED\u7684 Workflow binding seam", input.target);
+  }
+  const source = decode(input.ours);
+  if (source === target) {
+    return ready2(input, "preserve", "\u5DF2\u5305\u542B immutable release binding seam");
+  }
+  if (source !== legacyDefaultBinding) {
+    return conflict2(input, "Workflow binding seam \u4E0D\u662F 0.6.14 \u9ED8\u8BA4\u7A7A\u7248\u672C");
+  }
+  return ready2(input, "update", "\u5347\u7EA7\u9ED8\u8BA4\u7A7A Workflow binding seam", input.target);
+}
+function planComposition(input) {
+  if (!input.target) {
+    return conflict2(input, "\u76EE\u6807\u7248\u672C\u7F3A\u5C11 Agent Runtime Composition");
+  }
+  const target = decode(input.target);
+  if (hashContent(target) !== immutableReleaseCompositionHash) {
+    return conflict2(input, "\u76EE\u6807\u7248\u672C Agent Runtime Composition \u5951\u7EA6\u65E0\u6548");
+  }
+  if (!input.ours) {
+    return ready2(input, "create", "\u65B0\u589E Agent Runtime Composition", input.target);
+  }
+  const source = decode(input.ours);
+  if (source === target) {
+    return ready2(input, "preserve", "\u5DF2\u88C5\u914D Workflow Artifact binding");
+  }
+  if ([workflowArtifactImport, newOmit, workflowArtifactProperty].some((value) => source.includes(value))) {
+    return conflict2(input, "Agent Runtime Composition \u53EA\u5305\u542B\u90E8\u5206\u76EE\u6807\u88C5\u914D");
+  }
+  const runtimeConflict = validateLegacyRuntimeObject(source);
+  if (runtimeConflict)
+    return conflict2(input, runtimeConflict);
+  const replacements2 = [
+    {
+      anchor: hostAuthImport,
+      value: `${hostAuthImport}
+${workflowArtifactImport}`
+    },
+    {
+      anchor: oldOmit,
+      value: newOmit
+    },
+    {
+      anchor: hostAuthProperty,
+      value: `${hostAuthProperty}
+${workflowArtifactProperty}`
+    }
+  ];
+  let content = source;
+  for (const replacement of replacements2) {
+    if (occurrences(content, replacement.anchor) !== 1) {
+      return conflict2(input, `Agent Runtime Composition \u951A\u70B9\u4E0D\u552F\u4E00\uFF1A${replacement.anchor}`);
+    }
+    content = content.replace(replacement.anchor, replacement.value);
+  }
+  return ready2(input, "update", "\u88C5\u914D Workflow Artifact project binding", new TextEncoder().encode(content));
+}
+function ready2(input, action, reason, content) {
+  return {
+    path: input.path,
+    ownership: "project-owned",
+    action,
+    reason,
+    expectedProjectContent: input.expected,
+    content
+  };
+}
+function conflict2(input, message) {
+  return {
+    path: input.path,
+    ownership: "project-owned",
+    action: "preserve",
+    reason: "\u5BA2\u6237\u5DF2\u4FEE\u6539",
+    expectedProjectContent: input.expected,
+    conflict: message
+  };
+}
+function decode(content) {
+  return new TextDecoder().decode(content);
+}
+function occurrences(source, value) {
+  return source.split(value).length - 1;
+}
+function validateLegacyRuntimeObject(source) {
+  const startAnchor = `  const runtime = registerAgentPlatformRuntime({
+    ...input,`;
+  const endAnchor = `
+  });`;
+  if (occurrences(source, startAnchor) !== 1 || occurrences(source, endAnchor) !== 1) {
+    return "Agent Runtime register object \u951A\u70B9\u4E0D\u552F\u4E00";
+  }
+  const start = source.indexOf(startAnchor);
+  const end = source.indexOf(endAnchor, start + startAnchor.length);
+  if (end < 0)
+    return "Agent Runtime register object \u7ED3\u675F\u951A\u70B9\u7F3A\u5931";
+  const object = source.slice(start, end);
+  const host = object.indexOf(hostAuthProperty);
+  if (host < 0)
+    return "Agent Runtime Host Auth property \u951A\u70B9\u7F3A\u5931";
+  const tail = object.slice(host + hostAuthProperty.length);
+  if (/^\s*\.\.\./m.test(tail)) {
+    return "Workflow binding \u63D2\u5165\u70B9\u540E\u5B58\u5728\u53EF\u8986\u76D6\u5B83\u7684 spread";
+  }
+  if (/["']clientAgentWorkflowArtifactBindings["']\s*:/.test(object) || /\[\s*["']clientAgentWorkflowArtifactBindings["']\s*\]/.test(object)) {
+    return "Agent Runtime \u5DF2\u5B58\u5728\u52A8\u6001 Workflow binding property";
+  }
+  return;
+}
+
 // src/update/recipe-project-owned-trajectory-test.ts
 var legacyAnchor = /^(\s*)traceId: "trace_1",\n\1attemptItems: \[$/gm;
 var migratedAnchor = /^(\s*)traceId: "trace_1",\n\1trajectory: \{\n\1 {2}available: true,\n\1 {2}events: \[\],\n\1\},\n\1attemptItems: \[$/gm;
@@ -9854,20 +10041,33 @@ var managedPathsByRecipe = {
     "apps/web/src/router/index.ts",
     "apps/web/src/router/platform-admin-route-bindings.ts",
     "apps/web/src/services/ai-runtime-api.ts"
+  ],
+  "starter-0.6.14-to-0.6.15": [
+    clientWorkflowCompositionPath,
+    clientWorkflowBindingPath
   ]
 };
 function recipeManagedProjectOwnedPaths(recipes2) {
   return new Set(recipes2.flatMap((recipe) => managedPathsByRecipe[recipe] ?? []));
 }
+function recipeCanManageMissingProjectOwnedPath(path2) {
+  return path2 === clientWorkflowCompositionPath || path2 === clientWorkflowBindingPath;
+}
 async function planRecipeProjectOwned(input) {
+  if (input.path === clientWorkflowCompositionPath || input.path === clientWorkflowBindingPath) {
+    if (!input.target) {
+      return conflict3(input, "\u7248\u672C recipe \u6240\u9700\u7684\u76EE\u6807\u6587\u4EF6\u7F3A\u5931");
+    }
+    return planClientWorkflowProjectOwned({ ...input, target: input.target });
+  }
   if (!input.ours) {
-    return conflict2(input, "\u7248\u672C recipe \u6240\u9700\u7684\u9879\u76EE\u951A\u70B9\u7F3A\u5931");
+    return conflict3(input, "\u7248\u672C recipe \u6240\u9700\u7684\u9879\u76EE\u951A\u70B9\u7F3A\u5931");
   }
   const source = new TextDecoder().decode(input.ours);
   const target = input.target ? new TextDecoder().decode(input.target) : undefined;
   const transformed = transformProjectOwnedAnchor(input.path, source, target);
   if ("error" in transformed)
-    return conflict2(input, transformed.error);
+    return conflict3(input, transformed.error);
   if (transformed.content === source) {
     return preserve(input, "\u5DF2\u5305\u542B\u7248\u672C recipe \u76EE\u6807\u5185\u5BB9");
   }
@@ -10053,7 +10253,7 @@ function update(input, content) {
     content
   };
 }
-function conflict2(input, message) {
+function conflict3(input, message) {
   return {
     path: input.path,
     ownership: "project-owned",
@@ -10073,7 +10273,8 @@ async function planFile(path2, baseRoot, targetRoot, source, target, ours, prove
   const ownership = source?.ownership ?? target?.ownership ?? classifyOwnership(path2);
   const expected = expectationForSnapshot(ours);
   if (ownership === "project-owned") {
-    if (manageRecipeProjectOwned && source) {
+    const hasExistingRecipeSource = source !== undefined && source.state !== "missing" && ours !== undefined;
+    if (manageRecipeProjectOwned && target && (hasExistingRecipeSource || recipeCanManageMissingProjectOwnedPath(path2))) {
       return planRecipeProjectOwned({ path: path2, ours, target: theirs, expected });
     }
     if (manageGeneratedProjectOwned) {
@@ -10083,29 +10284,29 @@ async function planFile(path2, baseRoot, targetRoot, source, target, ours, prove
   }
   if (path2.startsWith("packages/database/drizzle/") && path2.endsWith(".sql")) {
     if (source && !target) {
-      return conflict3(path2, ownership, "\u5DF2\u53D1\u5E03 migration \u4E0D\u53EF\u5220\u9664", expected);
+      return conflict4(path2, ownership, "\u5DF2\u53D1\u5E03 migration \u4E0D\u53EF\u5220\u9664", expected);
     }
     if (source && target && source.hash !== target.hash) {
-      return conflict3(path2, ownership, "\u5DF2\u53D1\u5E03 migration \u4E0D\u53EF\u6539\u5199\uFF0C\u53EA\u80FD\u8FFD\u52A0\u65B0\u6587\u4EF6", expected);
+      return conflict4(path2, ownership, "\u5DF2\u53D1\u5E03 migration \u4E0D\u53EF\u6539\u5199\uFF0C\u53EA\u80FD\u8FFD\u52A0\u65B0\u6587\u4EF6", expected);
     }
   }
   if (!source && target) {
     if (!ours) {
       return readyPlannedFile(path2, ownership, "create", "\u76EE\u6807\u7248\u672C\u65B0\u589E", expected, theirs);
     }
-    return theirs && hashContent(ours) === target.hash ? readyPlannedFile(path2, ownership, "preserve", "\u5DF2\u5305\u542B\u76EE\u6807\u5185\u5BB9", expected) : conflict3(path2, ownership, "\u76EE\u6807\u7248\u672C\u65B0\u589E\u8DEF\u5F84\u5DF2\u88AB\u9879\u76EE\u5360\u7528", expected);
+    return theirs && hashContent(ours) === target.hash ? readyPlannedFile(path2, ownership, "preserve", "\u5DF2\u5305\u542B\u76EE\u6807\u5185\u5BB9", expected) : conflict4(path2, ownership, "\u76EE\u6807\u7248\u672C\u65B0\u589E\u8DEF\u5F84\u5DF2\u88AB\u9879\u76EE\u5360\u7528", expected);
   }
   if (source && !target) {
     if (!ours) {
       return readyPlannedFile(path2, ownership, "preserve", "\u9879\u76EE\u5DF2\u5220\u9664", expected);
     }
-    return hashContent(ours) === source.hash ? readyPlannedFile(path2, ownership, "delete", "\u76EE\u6807\u7248\u672C\u5220\u9664", expected) : conflict3(path2, ownership, "\u5BA2\u6237\u4FEE\u6539\u540E Windy \u53C8\u5220\u9664", expected);
+    return hashContent(ours) === source.hash ? readyPlannedFile(path2, ownership, "delete", "\u76EE\u6807\u7248\u672C\u5220\u9664", expected) : conflict4(path2, ownership, "\u5BA2\u6237\u4FEE\u6539\u540E Windy \u53C8\u5220\u9664", expected);
   }
   if (source && target && !ours) {
     return readyPlannedFile(path2, "project-owned", "preserve", "\u9879\u76EE\u5DF2\u5220\u9664", expected);
   }
   if (!source || !target || !ours || !theirs) {
-    return conflict3(path2, ownership, "\u6587\u4EF6\u72B6\u6001\u4E0D\u5B8C\u6574\uFF0C\u4E0D\u80FD\u5B89\u5168\u63A8\u65AD", expected);
+    return conflict4(path2, ownership, "\u6587\u4EF6\u72B6\u6001\u4E0D\u5B8C\u6574\uFF0C\u4E0D\u80FD\u5B89\u5168\u63A8\u65AD", expected);
   }
   const oursChanged = hashContent(ours) !== source.hash;
   const sourceArtifactHash = artifactHashOf(source);
@@ -10119,7 +10320,7 @@ async function planFile(path2, baseRoot, targetRoot, source, target, ours, prove
   });
   if (forceTargetBaseline && path2.endsWith("package.json") && base) {
     const merged = mergePackageJson(base, ours, theirs);
-    return merged.content ? readyPlannedFile(path2, ownership, "update", "package.json \u5B57\u6BB5\u7EA7\u5408\u5E76", expected, merged.content) : conflict3(path2, ownership, `\u5B57\u6BB5\u51B2\u7A81\uFF1A${merged.conflicts.join("\u3001")}`, expected);
+    return merged.content ? readyPlannedFile(path2, ownership, "update", "package.json \u5B57\u6BB5\u7EA7\u5408\u5E76", expected, merged.content) : conflict4(path2, ownership, `\u5B57\u6BB5\u51B2\u7A81\uFF1A${merged.conflicts.join("\u3001")}`, expected);
   }
   if (forceTargetBaseline) {
     return readyPlannedFile(path2, ownership, "update", "\u5F3A\u5236\u91C7\u7528\u76EE\u6807\u5E73\u53F0\u57FA\u7EBF", expected, theirs);
@@ -10129,11 +10330,11 @@ async function planFile(path2, baseRoot, targetRoot, source, target, ours, prove
   }
   if (targetChanged && path2.endsWith("package.json") && base) {
     const merged = mergePackageJson(base, ours, theirs);
-    return merged.content ? readyPlannedFile(path2, ownership, "update", "package.json \u5B57\u6BB5\u7EA7\u5408\u5E76", expected, merged.content) : conflict3(path2, ownership, `\u5B57\u6BB5\u51B2\u7A81\uFF1A${merged.conflicts.join("\u3001")}`, expected);
+    return merged.content ? readyPlannedFile(path2, ownership, "update", "package.json \u5B57\u6BB5\u7EA7\u5408\u5E76", expected, merged.content) : conflict4(path2, ownership, `\u5B57\u6BB5\u51B2\u7A81\uFF1A${merged.conflicts.join("\u3001")}`, expected);
   }
   if (!oursChanged && targetChanged && adoptedProjectDelta && base) {
     const merged = await mergeTextFile(base, ours, theirs);
-    return merged.content ? readyPlannedFile(path2, ownership, "update", "\u4E09\u65B9\u5408\u5E76\u5DF2\u91C7\u7EB3\u9879\u76EE\u589E\u91CF", expected, merged.content) : conflict3(path2, ownership, merged.conflict || "\u4E09\u65B9\u5408\u5E76\u5931\u8D25", expected);
+    return merged.content ? readyPlannedFile(path2, ownership, "update", "\u4E09\u65B9\u5408\u5E76\u5DF2\u91C7\u7EB3\u9879\u76EE\u589E\u91CF", expected, merged.content) : conflict4(path2, ownership, merged.conflict || "\u4E09\u65B9\u5408\u5E76\u5931\u8D25", expected);
   }
   if (!oursChanged) {
     return readyPlannedFile(path2, ownership, "update", "\u4EC5 Windy \u4FEE\u6539", expected, theirs);
@@ -10146,9 +10347,9 @@ async function planFile(path2, baseRoot, targetRoot, source, target, ours, prove
   }
   if (base) {
     const merged = await mergeTextFile(base, ours, theirs);
-    return merged.content ? readyPlannedFile(path2, ownership, "update", "\u4E09\u65B9\u5408\u5E76", expected, merged.content) : conflict3(path2, ownership, merged.conflict || "\u4E09\u65B9\u5408\u5E76\u5931\u8D25", expected);
+    return merged.content ? readyPlannedFile(path2, ownership, "update", "\u4E09\u65B9\u5408\u5E76", expected, merged.content) : conflict4(path2, ownership, merged.conflict || "\u4E09\u65B9\u5408\u5E76\u5931\u8D25", expected);
   }
-  return conflict3(path2, ownership, "\u5BA2\u6237\u548C Windy \u5747\u5DF2\u4FEE\u6539", expected);
+  return conflict4(path2, ownership, "\u5BA2\u6237\u548C Windy \u5747\u5DF2\u4FEE\u6539", expected);
 }
 function shouldForcePlatformBaseline(input) {
   return input.forcePlatformBaseline && !input.oursChanged && input.base !== undefined && hashContent(input.base) !== input.sourceArtifactHash;
@@ -10169,7 +10370,7 @@ function readyPlannedFile(path2, ownership, action, reason, expectedProjectConte
 function expectationForSnapshot(content) {
   return content ? { kind: "hash", value: hashContent(content) } : { kind: "missing" };
 }
-function conflict3(path2, ownership, reason, expectedProjectContent) {
+function conflict4(path2, ownership, reason, expectedProjectContent) {
   return {
     path: path2,
     ownership,
@@ -11000,9 +11201,9 @@ function assertEnabledConflicts(target, catalog) {
   for (const [name, enabled] of target) {
     if (!enabled)
       continue;
-    const conflict4 = catalog.get(name).conflicts.find((candidate) => target.get(candidate));
-    if (conflict4)
-      throw new Error(`\u6A21\u5757\u51B2\u7A81\uFF1A${name} \u4E0E ${conflict4}`);
+    const conflict5 = catalog.get(name).conflicts.find((candidate) => target.get(candidate));
+    if (conflict5)
+      throw new Error(`\u6A21\u5757\u51B2\u7A81\uFF1A${name} \u4E0E ${conflict5}`);
   }
 }
 function assertCompatible(version, range, name) {
@@ -11017,7 +11218,7 @@ function reconcileProjectModuleRegistryPlan(plan, current, lifecycle) {
   if (!registryFile) {
     throw new Error("\u6A21\u5757\u751F\u547D\u5468\u671F\u8BA1\u5212\u7F3A\u5C11 project-owned \u88C5\u914D\u9009\u62E9");
   }
-  plan.conflicts = plan.conflicts.filter((conflict4) => !conflict4.startsWith(`${projectModuleRegistryPath}\uFF1A`));
+  plan.conflicts = plan.conflicts.filter((conflict5) => !conflict5.startsWith(`${projectModuleRegistryPath}\uFF1A`));
   delete registryFile.conflict;
   if (lifecycle.action === "update") {
     registryFile.action = "preserve";
@@ -11270,7 +11471,7 @@ function assertKnownModuleArguments(args) {
 
 // src/module-lifecycle-confirmation.ts
 import { createInterface as createInterface3 } from "readline/promises";
-async function confirmModuleMutation(args, dependencies, log) {
+async function confirmModuleMutation(args, dependencies, log, message = "\u786E\u8BA4\u6267\u884C\u4EE5\u4E0A\u6A21\u5757\u8BA1\u5212\uFF1F") {
   if (args.includes("--yes"))
     return true;
   const isTTY = dependencies.isTTY ?? Boolean(process.stdin.isTTY && process.stdout.isTTY);
@@ -11278,7 +11479,7 @@ async function confirmModuleMutation(args, dependencies, log) {
     throw new Error("\u975E\u4EA4\u4E92\u73AF\u5883\u6B63\u5F0F\u53D8\u66F4\u5FC5\u987B\u4F20\u5165 --yes");
   }
   const confirm = dependencies.confirm ?? promptForConfirmation;
-  const accepted = await confirm("\u786E\u8BA4\u6267\u884C\u4EE5\u4E0A\u6A21\u5757\u8BA1\u5212\uFF1F");
+  const accepted = await confirm(message);
   if (!accepted)
     log("\u5DF2\u53D6\u6D88\uFF1A\u9879\u76EE\u672A\u88AB\u4FEE\u6539");
   return accepted;
@@ -11447,8 +11648,8 @@ function printModulePlan(plan, log) {
   for (const file of changed) {
     log(`  ${file.action.padEnd(6)} ${file.path}\uFF08${file.reason}\uFF09`);
   }
-  for (const conflict4 of plan.conflicts)
-    log(`  conflict ${conflict4}`);
+  for (const conflict5 of plan.conflicts)
+    log(`  conflict ${conflict5}`);
 }
 function hasChanges(lifecycle) {
   return lifecycle.addedModules.length > 0 || lifecycle.updatedModules.length > 0 || lifecycle.removedModules.length > 0;
@@ -11620,8 +11821,8 @@ function printPlan(plan) {
   console.log(`\u8BA1\u5212\u6539\u52A8\uFF1A${changed.length} \u4E2A\u6587\u4EF6\uFF1B\u51B2\u7A81\uFF1A${plan.conflicts.length}`);
   for (const file of changed)
     console.log(`  ${file.action.padEnd(6)} ${file.path}\uFF08${file.reason}\uFF09`);
-  for (const conflict4 of plan.conflicts)
-    console.log(`  conflict ${conflict4}`);
+  for (const conflict5 of plan.conflicts)
+    console.log(`  conflict ${conflict5}`);
   for (const finding of plan.manualCleanup ?? []) {
     console.log(`  manual ${finding.message}`);
   }
@@ -11989,6 +12190,750 @@ function readValue4(args, flag) {
   return index >= 0 ? args[index + 1] : undefined;
 }
 
+// src/package-command.ts
+import { resolve as resolve14 } from "path";
+
+// src/package-configuration.ts
+import { createHash as createHash5 } from "crypto";
+import { readFile as readFile27 } from "fs/promises";
+import { isAbsolute as isAbsolute3, normalize, relative as relative8, resolve as resolve11, sep as sep6 } from "path";
+
+// src/package-types.ts
+var packagePlatforms = ["linux/amd64", "linux/arm64"];
+
+// src/package-configuration.ts
+var configurationFile = "windy.build.json";
+var shellCharacters = /[;&|`><\r\n$()'"]/u;
+var placeholder = /\$\{(platform|output\.directory|input\.([a-z][a-z0-9-]*))\}/gu;
+var secretName = /secret|token|password|credential|private[-_]?key|api[-_]?key/iu;
+var shellExecutables = new Set([
+  "sh",
+  "bash",
+  "zsh",
+  "fish",
+  "cmd",
+  "powershell",
+  "pwsh"
+]);
+async function readPackageConfiguration(projectDirectory) {
+  const path2 = resolve11(projectDirectory, configurationFile);
+  let source;
+  try {
+    source = await readFile27(path2, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      throw new Error("\u672A\u58F0\u660E\u6253\u5305\u9002\u914D\u5668\uFF1A\u9879\u76EE\u6839\u76EE\u5F55\u7F3A\u5C11 windy.build.json", {
+        cause: error
+      });
+    }
+    throw error;
+  }
+  try {
+    const configuration = parsePackageConfiguration(JSON.parse(source));
+    return { configuration, digest: sha256(canonicalJson(configuration)) };
+  } catch (error) {
+    if (error instanceof SyntaxError)
+      throw new Error("windy.build.json \u4E0D\u662F\u6709\u6548 JSON", { cause: error });
+    throw error;
+  }
+}
+function parsePackageConfiguration(value) {
+  const root = object(value, "windy.build.json");
+  rejectUnknown(root, ["schemaVersion", "product", "platforms", "profiles"], "windy.build.json");
+  if (root.schemaVersion !== 1)
+    throw new Error("windy.build.json \u53EA\u652F\u6301 schemaVersion: 1");
+  const platforms = array(root.platforms, "platforms").map((item) => {
+    const platform = string(item, "platforms[]");
+    if (!packagePlatforms.includes(platform)) {
+      throw new Error(`\u4E0D\u652F\u6301\u7684\u76EE\u6807\u5E73\u53F0\uFF1A${platform}`);
+    }
+    return platform;
+  });
+  unique2(platforms, "platforms");
+  if (!platforms.length)
+    throw new Error("platforms \u4E0D\u80FD\u4E3A\u7A7A");
+  const profiles = array(root.profiles, "profiles").map(parseProfile);
+  unique2(profiles.map(({ key }) => key), "profile key");
+  if (!profiles.length)
+    throw new Error("profiles \u4E0D\u80FD\u4E3A\u7A7A");
+  return {
+    schemaVersion: 1,
+    product: string(root.product, "product"),
+    platforms,
+    profiles
+  };
+}
+function parseProfile(value) {
+  const profile = object(value, "profile");
+  rejectUnknown(profile, [
+    "key",
+    "label",
+    "description",
+    "inputs",
+    "command",
+    "output",
+    "requirements"
+  ], "profile");
+  const key = identifier(profile.key, "profile key");
+  const inputs = array(profile.inputs, `profile ${key}.inputs`).map((item) => parseInput(item, key));
+  unique2(inputs.map(({ key: inputKey }) => inputKey), `profile ${key} input key`);
+  const command = object(profile.command, `profile ${key}.command`);
+  rejectUnknown(command, ["executable", "arguments"], `profile ${key}.command`);
+  const executable = string(command.executable, `profile ${key}.command.executable`);
+  if (shellExecutables.has(executable.toLowerCase()) || shellCharacters.test(executable) || !/^[a-zA-Z0-9._-]+$/u.test(executable)) {
+    throw new Error(`profile ${key} \u7684 command.executable \u5FC5\u987B\u662F PATH \u4E2D\u7684\u5B89\u5168\u7A0B\u5E8F\u540D`);
+  }
+  const commandArguments = array(command.arguments, `profile ${key}.command.arguments`).map((item) => {
+    const argument = string(item, `profile ${key}.command.arguments[]`);
+    validatePlaceholders(argument, inputs, key);
+    if (shellCharacters.test(argument.replace(placeholder, ""))) {
+      throw new Error(`profile ${key} \u7684 command.arguments \u4E0D\u5141\u8BB8 Shell \u5B57\u7B26\u4E32`);
+    }
+    return argument;
+  });
+  const output = object(profile.output, `profile ${key}.output`);
+  rejectUnknown(output, ["directory", "artifactSuffix"], `profile ${key}.output`);
+  const directory = string(output.directory, `profile ${key}.output.directory`);
+  if (!isSafeRelativePath(directory) || !/^[a-zA-Z0-9._/-]+$/u.test(directory))
+    throw new Error(`profile ${key} \u7684 output.directory \u8D8A\u51FA\u9879\u76EE\u8FB9\u754C`);
+  const artifactSuffix = string(output.artifactSuffix, `profile ${key}.output.artifactSuffix`);
+  if (!artifactSuffix.startsWith(".") || shellCharacters.test(artifactSuffix) || !/^\.[a-zA-Z0-9._-]+$/u.test(artifactSuffix)) {
+    throw new Error(`profile ${key} \u7684 output.artifactSuffix \u975E\u6CD5`);
+  }
+  const requirements = object(profile.requirements, `profile ${key}.requirements`);
+  rejectUnknown(requirements, ["docker", "buildx"], `profile ${key}.requirements`);
+  const docker = boolean(requirements.docker, `profile ${key}.requirements.docker`);
+  const buildx = boolean(requirements.buildx, `profile ${key}.requirements.buildx`);
+  if (buildx && !docker)
+    throw new Error(`profile ${key} \u7684 buildx \u9700\u8981 docker`);
+  return {
+    key,
+    label: string(profile.label, `profile ${key}.label`),
+    description: string(profile.description, `profile ${key}.description`),
+    inputs,
+    command: { executable, arguments: commandArguments },
+    output: { directory, artifactSuffix },
+    requirements: { docker, buildx }
+  };
+}
+function parseInput(value, profile) {
+  const input = object(value, `profile ${profile}.input`);
+  rejectUnknown(input, ["key", "label", "required", "pattern"], `profile ${profile}.input`);
+  const key = identifier(input.key, `profile ${profile}.input.key`);
+  if (secretName.test(key))
+    throw new Error(`profile ${profile} \u4E0D\u5141\u8BB8 secret \u8F93\u5165\uFF1A${key}`);
+  const pattern = input.pattern === undefined ? undefined : string(input.pattern, `profile ${profile}.input.pattern`);
+  if (pattern) {
+    try {
+      new RegExp(pattern, "u");
+    } catch {
+      throw new Error(`profile ${profile} \u7684\u8F93\u5165 pattern \u975E\u6CD5`);
+    }
+  }
+  return {
+    key,
+    label: string(input.label, `profile ${profile}.input.label`),
+    required: boolean(input.required, `profile ${profile}.input.required`),
+    pattern
+  };
+}
+function validatePlaceholders(value, inputs, profile) {
+  const tokens = [...value.matchAll(placeholder)];
+  for (const token of tokens) {
+    const inputKey = token[2];
+    if (inputKey && !inputs.some(({ key }) => key === inputKey)) {
+      throw new Error(`profile ${profile} \u4F7F\u7528\u672A\u58F0\u660E\u5360\u4F4D\u7B26\uFF1Ainput.${inputKey}`);
+    }
+  }
+  if (value.replace(placeholder, "").includes("${"))
+    throw new Error(`profile ${profile} \u5305\u542B\u672A\u58F0\u660E\u5360\u4F4D\u7B26`);
+}
+function object(value, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error(`${label} \u5FC5\u987B\u662F\u5BF9\u8C61`);
+  return value;
+}
+function array(value, label) {
+  if (!Array.isArray(value))
+    throw new Error(`${label} \u5FC5\u987B\u662F\u6570\u7EC4`);
+  return value;
+}
+function string(value, label) {
+  if (typeof value !== "string" || !value.trim())
+    throw new Error(`${label} \u5FC5\u987B\u662F\u975E\u7A7A\u5B57\u7B26\u4E32`);
+  return value;
+}
+function boolean(value, label) {
+  if (typeof value !== "boolean")
+    throw new Error(`${label} \u5FC5\u987B\u662F\u5E03\u5C14\u503C`);
+  return value;
+}
+function identifier(value, label) {
+  const result2 = string(value, label);
+  if (!/^[a-z][a-z0-9-]*$/u.test(result2))
+    throw new Error(`${label} \u5FC5\u987B\u662F\u5C0F\u5199 kebab-case`);
+  return result2;
+}
+function unique2(values, label) {
+  if (new Set(values).size !== values.length)
+    throw new Error(`${label} \u4E0D\u80FD\u91CD\u590D`);
+}
+function rejectUnknown(source, allowed, label) {
+  for (const key of Object.keys(source))
+    if (!allowed.includes(key))
+      throw new Error(`${label} \u5305\u542B\u672A\u77E5\u5B57\u6BB5\uFF1A${key}`);
+}
+function isSafeRelativePath(value) {
+  return Boolean(value) && normalize(value) !== "." && !isAbsolute3(value) && !value.includes("\\") && !relative8(".", resolve11(".", value)).split(sep6).includes("..") && !normalize(value).startsWith("..");
+}
+function canonicalJson(value) {
+  if (Array.isArray(value))
+    return `[${value.map(canonicalJson).join(",")}]`;
+  if (value && typeof value === "object")
+    return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
+  return JSON.stringify(value);
+}
+function sha256(value) {
+  return createHash5("sha256").update(value).digest("hex");
+}
+
+// src/package-execution.ts
+import { createHash as createHash6 } from "crypto";
+import { readdir as readdir10, realpath as realpath2, stat as stat3 } from "fs/promises";
+import { relative as relative9, resolve as resolve12 } from "path";
+var bunPackageProcess = {
+  async run(command, args, cwd) {
+    const child = Bun.spawn([command, ...args], {
+      cwd,
+      env: withoutParentGitRepository(process.env),
+      stdin: "inherit",
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const [stdout2, stderr, code] = await Promise.all([
+      new Response(child.stdout).text(),
+      new Response(child.stderr).text(),
+      child.exited
+    ]);
+    return { code, stdout: stdout2, stderr };
+  }
+};
+async function readPackageSource(projectDirectory, process4 = bunPackageProcess, ignoredPaths = []) {
+  const revision = await currentGitRevision(projectDirectory, process4);
+  const status = await assertCommand(process4, "git", ["status", "--porcelain"], projectDirectory, "\u65E0\u6CD5\u8BFB\u53D6 Git \u5DE5\u4F5C\u533A\u72B6\u6001");
+  const root = await realpath2(projectDirectory);
+  const ignored = new Set(ignoredPaths.map((path2) => relative9(root, path2)));
+  const dirty = status.stdout.trim().split(`
+`).filter(Boolean).filter((line) => !ignored.has(line.slice(3)));
+  if (dirty.length)
+    throw new Error("Git \u5DE5\u4F5C\u533A\u5FC5\u987B\u5E72\u51C0\u624D\u80FD\u51BB\u7ED3\u6216\u6267\u884C\u6253\u5305\u8BA1\u5212");
+  return revision;
+}
+async function currentGitRevision(projectDirectory, process4 = bunPackageProcess) {
+  const revision = await assertCommand(process4, "git", ["rev-parse", "HEAD"], projectDirectory, "\u65E0\u6CD5\u8BFB\u53D6 Git SHA");
+  return revision.stdout.trim();
+}
+async function preflightPackage(plan, projectDirectory, process4 = bunPackageProcess, ignoredPaths = []) {
+  const sourceRevision = await readPackageSource(projectDirectory, process4, ignoredPaths);
+  if (sourceRevision !== plan.source.revision)
+    throw new Error("\u6267\u884C\u524D\u6E90\u7801 SHA \u5DF2\u6F02\u79FB\uFF0C\u62D2\u7EDD\u6267\u884C");
+  await assertCommand(process4, "bun", ["--version"], projectDirectory, "\u672A\u68C0\u6D4B\u5230\u53EF\u7528\u7684 Bun");
+  if (!plan.requirements.docker)
+    return;
+  await assertCommand(process4, "docker", ["version", "--format", "{{.Server.Version}}"], projectDirectory, "\u672A\u68C0\u6D4B\u5230\u53EF\u7528\u7684 Docker Server");
+  if (!plan.requirements.buildx)
+    return;
+  const buildx = await assertCommand(process4, "docker", ["buildx", "inspect"], projectDirectory, "\u672A\u68C0\u6D4B\u5230\u53EF\u7528\u7684 Docker Buildx builder");
+  if (!buildx.stdout.includes(plan.platform) && !buildx.stderr.includes(plan.platform)) {
+    throw new Error(`\u5F53\u524D Buildx builder \u4E0D\u652F\u6301 ${plan.platform}`);
+  }
+}
+async function executePackagePlan(plan, projectDirectory, process4 = bunPackageProcess, ignoredPaths = []) {
+  const beforeRevision = await readPackageSource(projectDirectory, process4, ignoredPaths);
+  if (beforeRevision !== plan.source.revision)
+    throw new Error("\u6267\u884C\u524D\u6E90\u7801 SHA \u5DF2\u6F02\u79FB\uFF0C\u62D2\u7EDD\u6267\u884C");
+  const projectRoot = await realpath2(projectDirectory);
+  const outputDirectory = await guardedOutputDirectory(projectDirectory, plan.output.directory, false);
+  const before = new Map((await artifacts(outputDirectory, plan.output.artifactSuffix, projectRoot)).map(({ path: path2, sha256: sha2562 }) => [path2, sha2562]));
+  const command = await process4.run(plan.command.executable, plan.command.arguments, projectDirectory);
+  if (command.code !== 0)
+    return failed(beforeRevision, `\u6784\u5EFA\u547D\u4EE4\u9000\u51FA\u7801 ${command.code}\uFF1A${details(command)}`);
+  const afterRevision = await currentGitRevision(projectDirectory, process4);
+  if (afterRevision !== beforeRevision)
+    return failed(afterRevision, "\u6784\u5EFA\u671F\u95F4\u6E90\u7801 SHA \u53D1\u751F\u6F02\u79FB");
+  const finalOutput = await guardedOutputDirectory(projectDirectory, plan.output.directory, true);
+  const after = await artifacts(finalOutput, plan.output.artifactSuffix, projectRoot);
+  const changed = after.filter((artifact) => before.get(artifact.path) !== artifact.sha256);
+  const sourceDrift = await sourceDriftAfterBuild(process4, projectDirectory, ignoredPaths, changed.map(({ path: path2 }) => path2));
+  if (sourceDrift)
+    return failed(afterRevision, sourceDrift, changed);
+  if (changed.length !== 1)
+    return failed(afterRevision, `\u9884\u671F\u6070\u597D\u4E00\u4E2A\u65B0\u589E\u6216\u53D8\u66F4\u4EA7\u7269\uFF0C\u5B9E\u9645\u53D1\u73B0 ${changed.length} \u4E2A`, changed);
+  return {
+    status: "succeeded",
+    completedAt: new Date().toISOString(),
+    sourceRevision: afterRevision,
+    artifacts: changed
+  };
+}
+async function assertCommand(process4, command, args, cwd, message) {
+  const result2 = await process4.run(command, args, cwd);
+  if (result2.code !== 0)
+    throw new Error(`${message}\uFF1A${details(result2)}`);
+  return result2;
+}
+async function guardedOutputDirectory(projectDirectory, directory, mustExist) {
+  const root = await realpath2(projectDirectory);
+  const output = resolve12(root, directory);
+  if (!within(root, output))
+    throw new Error("\u8F93\u51FA\u76EE\u5F55\u8D8A\u51FA\u9879\u76EE\u8FB9\u754C");
+  try {
+    const actual = await realpath2(output);
+    if (!within(root, actual))
+      throw new Error("\u8F93\u51FA\u76EE\u5F55\u8D8A\u51FA\u9879\u76EE\u8FB9\u754C");
+    return actual;
+  } catch (error) {
+    if (error instanceof Error && error.message === "\u8F93\u51FA\u76EE\u5F55\u8D8A\u51FA\u9879\u76EE\u8FB9\u754C")
+      throw error;
+    if (mustExist)
+      throw new Error("\u6784\u5EFA\u6CA1\u6709\u4EA7\u751F\u58F0\u660E\u7684\u8F93\u51FA\u76EE\u5F55", { cause: error });
+    return output;
+  }
+}
+async function artifacts(directory, suffix, projectDirectory) {
+  try {
+    await stat3(directory);
+  } catch {
+    return [];
+  }
+  const entries = await readdir10(directory, {
+    recursive: true,
+    withFileTypes: true
+  });
+  return await Promise.all(entries.filter((entry) => entry.isFile() && entry.name.endsWith(suffix)).map(async (entry) => {
+    const path2 = resolve12(directory, entry.parentPath, entry.name);
+    return {
+      path: relative9(projectDirectory, path2),
+      sha256: createHash6("sha256").update(Buffer.from(await Bun.file(path2).arrayBuffer())).digest("hex")
+    };
+  }));
+}
+async function sourceDriftAfterBuild(process4, projectDirectory, ignoredPaths, generatedArtifacts) {
+  const status = await process4.run("git", ["status", "--porcelain"], projectDirectory);
+  if (status.code !== 0)
+    return `\u65E0\u6CD5\u68C0\u67E5\u6784\u5EFA\u540E\u7684\u6E90\u7801\u6F02\u79FB\uFF1A${details(status)}`;
+  const root = await realpath2(projectDirectory);
+  const ignored = new Set(ignoredPaths.map((path2) => relative9(root, path2)));
+  const generated = new Set(generatedArtifacts);
+  const drift = status.stdout.trim().split(`
+`).filter(Boolean).filter((line) => {
+    const path2 = line.slice(3);
+    return !ignored.has(path2) && !(line.startsWith("?? ") && generated.has(path2));
+  });
+  return drift.length ? "\u6784\u5EFA\u671F\u95F4\u6E90\u7801\u5DE5\u4F5C\u533A\u53D1\u751F\u6F02\u79FB" : undefined;
+}
+function within(root, path2) {
+  const result2 = relative9(root, path2);
+  return Boolean(result2) && !result2.startsWith("..") && result2 !== "..";
+}
+function details(result2) {
+  return (result2.stderr || result2.stdout).trim() || "\u672A\u63D0\u4F9B\u8BCA\u65AD\u4FE1\u606F";
+}
+function failed(sourceRevision, diagnostic, artifacts2 = []) {
+  return {
+    status: "failed",
+    completedAt: new Date().toISOString(),
+    sourceRevision,
+    artifacts: artifacts2,
+    diagnostic
+  };
+}
+
+// src/package-plan.ts
+import { readFile as readFile28, realpath as realpath3, writeFile as writeFile15 } from "fs/promises";
+import { dirname as dirname12, relative as relative10, resolve as resolve13 } from "path";
+function resolvePackageProfile(configuration, profileKey) {
+  const profile = configuration.profiles.find(({ key }) => key === profileKey);
+  if (!profile)
+    throw new Error(`\u672A\u58F0\u660E\u7684\u6253\u5305 profile\uFF1A${profileKey}`);
+  return profile;
+}
+function validatePackageInputs(profile, supplied) {
+  for (const key of Object.keys(supplied)) {
+    if (!profile.inputs.some((input) => input.key === key)) {
+      throw new Error(`profile ${profile.key} \u4E0D\u63A5\u53D7\u8F93\u5165\uFF1A${key}`);
+    }
+  }
+  const validated = {};
+  for (const input of profile.inputs) {
+    const value = supplied[input.key];
+    if (input.required && !value)
+      throw new Error(`profile ${profile.key} \u7F3A\u5C11\u5FC5\u586B\u8F93\u5165\uFF1A${input.key}`);
+    if (value === undefined)
+      continue;
+    if (input.pattern && !new RegExp(input.pattern, "u").test(value)) {
+      throw new Error(`\u8F93\u5165 ${input.key} \u4E0D\u7B26\u5408\u58F0\u660E\u7684\u683C\u5F0F`);
+    }
+    validated[input.key] = value;
+  }
+  return validated;
+}
+function createFrozenPackagePlan(input) {
+  const {
+    configuration,
+    configDigest,
+    sourceRevision,
+    profile,
+    platform,
+    inputs
+  } = input;
+  return {
+    schemaVersion: 1,
+    product: configuration.product,
+    configDigest,
+    source: { revision: sourceRevision, clean: true },
+    profile: profile.key,
+    platform,
+    inputs,
+    command: {
+      executable: profile.command.executable,
+      arguments: profile.command.arguments.map((argument) => expand(argument, platform, profile.output.directory, inputs))
+    },
+    output: profile.output,
+    requirements: profile.requirements,
+    createdAt: new Date().toISOString()
+  };
+}
+function assertFrozenPlanCurrent(input) {
+  const { plan, configuration, configDigest, sourceRevision } = input;
+  if (plan.product !== configuration.product)
+    throw new Error("\u51BB\u7ED3\u8BA1\u5212\u7684\u4EA7\u54C1\u6807\u8BC6\u4E0E\u5F53\u524D\u9879\u76EE\u4E0D\u4E00\u81F4");
+  if (plan.configDigest !== configDigest)
+    throw new Error("windy.build.json \u5DF2\u6F02\u79FB\uFF0C\u62D2\u7EDD\u6267\u884C\u51BB\u7ED3\u8BA1\u5212");
+  if (plan.source.revision !== sourceRevision)
+    throw new Error("\u6E90\u7801 SHA \u5DF2\u6F02\u79FB\uFF0C\u62D2\u7EDD\u6267\u884C\u51BB\u7ED3\u8BA1\u5212");
+  if (!configuration.platforms.includes(plan.platform))
+    throw new Error("\u51BB\u7ED3\u8BA1\u5212\u7684\u76EE\u6807\u5E73\u53F0\u5DF2\u4E0D\u88AB\u5F53\u524D\u914D\u7F6E\u652F\u6301");
+  const profile = resolvePackageProfile(configuration, plan.profile);
+  const inputs = validatePackageInputs(profile, plan.inputs);
+  const expected = createFrozenPackagePlan({
+    configuration,
+    configDigest,
+    sourceRevision,
+    profile,
+    platform: plan.platform,
+    inputs
+  });
+  if (canonicalJson(withoutCreatedAt(expected)) !== canonicalJson(withoutCreatedAt(plan))) {
+    throw new Error("\u51BB\u7ED3\u8BA1\u5212\u4E0E\u5F53\u524D\u6784\u5EFA\u914D\u7F6E\u4E0D\u4E00\u81F4\uFF0C\u62D2\u7EDD\u6267\u884C");
+  }
+}
+async function readFrozenPackagePlan(path2) {
+  try {
+    return parseFrozenPackagePlan(JSON.parse(await readFile28(path2, "utf8")));
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("\u51BB\u7ED3\u6253\u5305\u8BA1\u5212"))
+      throw error;
+    throw new Error("\u65E0\u6CD5\u8BFB\u53D6\u6709\u6548\u7684\u51BB\u7ED3\u6253\u5305\u8BA1\u5212", { cause: error });
+  }
+}
+async function writeFrozenPackagePlan(path2, plan) {
+  await writeFile15(path2, `${JSON.stringify(plan, null, 2)}
+`, "utf8");
+}
+async function resolvePackagePlanPath(projectDirectory, requested) {
+  if (!isSafeRelativePath(requested) || !/^[a-zA-Z0-9._/-]+$/u.test(requested))
+    throw new Error("\u8BA1\u5212\u6587\u4EF6\u8DEF\u5F84\u8D8A\u51FA\u9879\u76EE\u8FB9\u754C");
+  const root = await realpath3(projectDirectory);
+  const path2 = resolve13(root, requested);
+  if (relative10(root, path2).startsWith(".."))
+    throw new Error("\u8BA1\u5212\u6587\u4EF6\u8DEF\u5F84\u8D8A\u51FA\u9879\u76EE\u8FB9\u754C");
+  let parent;
+  try {
+    parent = await realpath3(dirname12(path2));
+  } catch {
+    throw new Error("\u8BA1\u5212\u6587\u4EF6\u7236\u76EE\u5F55\u5FC5\u987B\u5DF2\u5B58\u5728\u4E14\u4F4D\u4E8E\u9879\u76EE\u8FB9\u754C\u5185");
+  }
+  if (!withinOrEqual(root, parent))
+    throw new Error("\u8BA1\u5212\u6587\u4EF6\u8DEF\u5F84\u8D8A\u51FA\u9879\u76EE\u8FB9\u754C");
+  try {
+    if (!withinOrEqual(root, await realpath3(path2))) {
+      throw new Error("\u8BA1\u5212\u6587\u4EF6\u8DEF\u5F84\u8D8A\u51FA\u9879\u76EE\u8FB9\u754C");
+    }
+  } catch (error) {
+    if (error instanceof Error && error.message === "\u8BA1\u5212\u6587\u4EF6\u8DEF\u5F84\u8D8A\u51FA\u9879\u76EE\u8FB9\u754C")
+      throw error;
+  }
+  return path2;
+}
+function expand(value, platform, outputDirectory, inputs) {
+  return value.replace(/\$\{(platform|output\.directory|input\.([a-z][a-z0-9-]*))\}/gu, (_, token, inputKey) => {
+    if (token === "platform")
+      return platform;
+    if (token === "output.directory")
+      return outputDirectory;
+    return inputs[inputKey] ?? "";
+  });
+}
+function withoutCreatedAt(plan) {
+  const { createdAt: _createdAt, ...rest } = plan;
+  return rest;
+}
+function withinOrEqual(root, path2) {
+  const result2 = relative10(root, path2);
+  return !result2 || !result2.startsWith("..") && result2 !== "..";
+}
+function parseFrozenPackagePlan(value) {
+  const plan = record(value, "\u51BB\u7ED3\u6253\u5305\u8BA1\u5212");
+  rejectUnknown2(plan, [
+    "schemaVersion",
+    "product",
+    "configDigest",
+    "source",
+    "profile",
+    "platform",
+    "inputs",
+    "command",
+    "output",
+    "requirements",
+    "createdAt",
+    "result"
+  ], "\u51BB\u7ED3\u6253\u5305\u8BA1\u5212");
+  if (plan.result !== undefined)
+    throw new Error("\u5DF2\u5B8C\u6210\u7684\u6253\u5305\u8BA1\u5212\u4E0D\u80FD\u518D\u6B21\u6267\u884C");
+  const source = record(plan.source, "\u51BB\u7ED3\u6253\u5305\u8BA1\u5212 source");
+  rejectUnknown2(source, ["revision", "clean"], "\u51BB\u7ED3\u6253\u5305\u8BA1\u5212 source");
+  const command = record(plan.command, "\u51BB\u7ED3\u6253\u5305\u8BA1\u5212 command");
+  rejectUnknown2(command, ["executable", "arguments"], "\u51BB\u7ED3\u6253\u5305\u8BA1\u5212 command");
+  const output = record(plan.output, "\u51BB\u7ED3\u6253\u5305\u8BA1\u5212 output");
+  rejectUnknown2(output, ["directory", "artifactSuffix"], "\u51BB\u7ED3\u6253\u5305\u8BA1\u5212 output");
+  const requirements = record(plan.requirements, "\u51BB\u7ED3\u6253\u5305\u8BA1\u5212 requirements");
+  rejectUnknown2(requirements, ["docker", "buildx"], "\u51BB\u7ED3\u6253\u5305\u8BA1\u5212 requirements");
+  const inputs = record(plan.inputs, "\u51BB\u7ED3\u6253\u5305\u8BA1\u5212 inputs");
+  for (const [key, input] of Object.entries(inputs)) {
+    if (!/^[a-z][a-z0-9-]*$/u.test(key) || typeof input !== "string") {
+      throw new Error("\u51BB\u7ED3\u6253\u5305\u8BA1\u5212 inputs \u975E\u6CD5");
+    }
+  }
+  const arguments_ = array2(command.arguments, "\u51BB\u7ED3\u6253\u5305\u8BA1\u5212 command.arguments");
+  if (!arguments_.every((argument) => typeof argument === "string")) {
+    throw new Error("\u51BB\u7ED3\u6253\u5305\u8BA1\u5212 command.arguments \u975E\u6CD5");
+  }
+  if (plan.schemaVersion !== 1 || !nonEmptyString(plan.product) || !nonEmptyString(plan.configDigest) || !nonEmptyString(plan.profile) || !nonEmptyString(plan.platform) || !nonEmptyString(plan.createdAt) || !nonEmptyString(source.revision) || source.clean !== true || !nonEmptyString(command.executable) || !nonEmptyString(output.directory) || !nonEmptyString(output.artifactSuffix) || typeof requirements.docker !== "boolean" || typeof requirements.buildx !== "boolean") {
+    throw new Error("\u51BB\u7ED3\u6253\u5305\u8BA1\u5212\u7F3A\u5C11\u5FC5\u8981\u5B57\u6BB5");
+  }
+  return {
+    schemaVersion: 1,
+    product: plan.product,
+    configDigest: plan.configDigest,
+    source: { revision: source.revision, clean: true },
+    profile: plan.profile,
+    platform: plan.platform,
+    inputs,
+    command: { executable: command.executable, arguments: arguments_ },
+    output: {
+      directory: output.directory,
+      artifactSuffix: output.artifactSuffix
+    },
+    requirements: { docker: requirements.docker, buildx: requirements.buildx },
+    createdAt: plan.createdAt
+  };
+}
+function record(value, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error(`${label} \u5FC5\u987B\u662F\u5BF9\u8C61`);
+  return value;
+}
+function array2(value, label) {
+  if (!Array.isArray(value))
+    throw new Error(`${label} \u5FC5\u987B\u662F\u6570\u7EC4`);
+  return value;
+}
+function rejectUnknown2(source, allowed, label) {
+  for (const key of Object.keys(source)) {
+    if (!allowed.includes(key))
+      throw new Error(`${label} \u5305\u542B\u672A\u77E5\u5B57\u6BB5\uFF1A${key}`);
+  }
+}
+function nonEmptyString(value) {
+  return typeof value === "string" && Boolean(value.trim());
+}
+
+// src/package-command.ts
+async function runPackageCommand(args, dependencies = {}) {
+  if (args[0] !== "package")
+    return false;
+  const log = dependencies.log ?? console.log;
+  if (args.includes("--help") || args.includes("-h")) {
+    log(packageHelpText);
+    return true;
+  }
+  const options = await parsePackageArguments(args.slice(1), dependencies.cwd ?? process.cwd());
+  const planPath = options.fromPlan ?? options.plan;
+  const config = await readPackageConfiguration(options.projectDirectory);
+  const sourceRevision = await readPackageSource(options.projectDirectory, dependencies.process, planPath ? [planPath] : []);
+  let plan;
+  if (options.fromPlan) {
+    plan = await readFrozenPackagePlan(options.fromPlan);
+    assertFrozenPlanCurrent({
+      plan,
+      configuration: config.configuration,
+      configDigest: config.digest,
+      sourceRevision
+    });
+  } else {
+    const profile = resolvePackageProfile(config.configuration, options.profile);
+    if (!config.configuration.platforms.includes(options.platform))
+      throw new Error(`profile ${profile.key} \u4E0D\u652F\u6301\u76EE\u6807\u5E73\u53F0\uFF1A${options.platform}`);
+    const inputs = validatePackageInputs(profile, options.inputs);
+    plan = createFrozenPackagePlan({
+      configuration: config.configuration,
+      configDigest: config.digest,
+      sourceRevision,
+      profile,
+      platform: options.platform,
+      inputs
+    });
+    if (options.plan)
+      await writeFrozenPackagePlan(options.plan, plan);
+  }
+  printPlan2(plan, log);
+  if (!options.execute)
+    return true;
+  if (!planPath)
+    throw new Error("\u6267\u884C\u6253\u5305\u5FC5\u987B\u63D0\u4F9B --plan <\u6587\u4EF6> \u6216 --from-plan <\u6587\u4EF6>\uFF0C\u7528\u4E8E\u5199\u56DE\u7ED3\u679C");
+  let persisted = false;
+  try {
+    await preflightPackage(plan, options.projectDirectory, dependencies.process, [planPath]);
+    const current = await readPackageConfiguration(options.projectDirectory);
+    const currentSource = await readPackageSource(options.projectDirectory, dependencies.process, [planPath]);
+    assertFrozenPlanCurrent({
+      plan,
+      configuration: current.configuration,
+      configDigest: current.digest,
+      sourceRevision: currentSource
+    });
+    const accepted = await confirmModuleMutation(args, dependencies, log, "\u786E\u8BA4\u6267\u884C\u4EE5\u4E0A\u51BB\u7ED3\u6253\u5305\u8BA1\u5212\uFF1F");
+    if (!accepted)
+      return true;
+    const result2 = await executePackagePlan(plan, options.projectDirectory, dependencies.process, [planPath]);
+    await persistPackageResult(planPath, plan, result2);
+    persisted = true;
+    logResult(result2, log);
+    if (result2.status === "failed")
+      throw new Error(result2.diagnostic);
+  } catch (error) {
+    if (!persisted) {
+      const result2 = failedResult(plan, error);
+      await persistPackageResult(planPath, plan, result2);
+      logResult(result2, log);
+    }
+    throw error;
+  }
+  return true;
+}
+async function persistPackageResult(planPath, plan, result2) {
+  await writeFrozenPackagePlan(planPath, { ...plan, result: result2 });
+}
+function failedResult(plan, error) {
+  return {
+    status: "failed",
+    completedAt: new Date().toISOString(),
+    sourceRevision: plan.source.revision,
+    artifacts: [],
+    diagnostic: error instanceof Error ? error.message : String(error)
+  };
+}
+function logResult(result2, log) {
+  log(result2.status === "succeeded" ? `\u6253\u5305\u5B8C\u6210\uFF1A${result2.artifacts.map(({ path: path2, sha256: sha2562 }) => `${path2} sha256:${sha2562}`).join("\uFF0C")}` : `\u6253\u5305\u5931\u8D25\uFF1A${result2.diagnostic}`);
+}
+async function parsePackageArguments(args, workingDirectory) {
+  const allowed = new Set([
+    "--profile",
+    "--platform",
+    "--input",
+    "--plan",
+    "--from-plan",
+    "--execute",
+    "--yes",
+    "--cwd"
+  ]);
+  const values = new Map;
+  for (let index = 0;index < args.length; index += 1) {
+    const argument = args[index];
+    if (!allowed.has(argument))
+      throw new Error(`\u672A\u77E5 package \u53C2\u6570\uFF1A${argument}`);
+    if (argument === "--execute" || argument === "--yes")
+      continue;
+    const value = args[index + 1];
+    if (!value || value.startsWith("--"))
+      throw new Error(`${argument} \u9700\u8981\u4E00\u4E2A\u503C`);
+    values.set(argument, [...values.get(argument) ?? [], value]);
+    index += 1;
+  }
+  const single = (name) => {
+    const entries = values.get(name) ?? [];
+    if (entries.length > 1)
+      throw new Error(`${name} \u4E0D\u80FD\u91CD\u590D`);
+    return entries[0];
+  };
+  const plan = single("--plan");
+  const fromPlan = single("--from-plan");
+  if (plan && fromPlan)
+    throw new Error("--plan \u4E0D\u80FD\u4E0E --from-plan \u540C\u65F6\u4F7F\u7528");
+  const projectDirectory = resolve14(workingDirectory, single("--cwd") ?? ".");
+  const inputEntries = values.get("--input") ?? [];
+  const inputs = {};
+  for (const entry of inputEntries) {
+    const match = /^([a-z][a-z0-9-]*)=(.*)$/u.exec(entry);
+    if (!match)
+      throw new Error("--input \u5FC5\u987B\u4E3A key=value\uFF0C\u4E14 key \u4F7F\u7528\u5C0F\u5199 kebab-case");
+    const [, key, value] = match;
+    if (inputs[key] !== undefined)
+      throw new Error(`--input ${key} \u4E0D\u80FD\u91CD\u590D`);
+    inputs[key] = value;
+  }
+  const profile = single("--profile");
+  const platform = single("--platform");
+  if (fromPlan && (profile || platform || inputEntries.length))
+    throw new Error("--from-plan \u4E0D\u63A5\u53D7 --profile\u3001--platform \u6216 --input");
+  if (!fromPlan && (!profile || !platform))
+    throw new Error("\u65B0\u5EFA\u51BB\u7ED3\u8BA1\u5212\u5FC5\u987B\u540C\u65F6\u63D0\u4F9B --profile \u548C --platform");
+  if (platform && !packagePlatforms.includes(platform))
+    throw new Error(`\u4E0D\u652F\u6301\u7684\u76EE\u6807\u5E73\u53F0\uFF1A${platform}`);
+  return {
+    projectDirectory,
+    profile,
+    platform,
+    inputs,
+    plan: plan ? await resolvePackagePlanPath(projectDirectory, plan) : undefined,
+    fromPlan: fromPlan ? await resolvePackagePlanPath(projectDirectory, fromPlan) : undefined,
+    execute: args.includes("--execute")
+  };
+}
+function printPlan2(plan, log) {
+  log("\u51BB\u7ED3\u6253\u5305\u8BA1\u5212\uFF1A");
+  log(`  \u4EA7\u54C1\uFF1A${plan.product}`);
+  log(`  profile\uFF1A${plan.profile}`);
+  log(`  \u5E73\u53F0\uFF1A${plan.platform}`);
+  log(`  \u6E90\u7801\uFF1A${plan.source.revision}`);
+  log(`  \u547D\u4EE4\uFF1A${[plan.command.executable, ...plan.command.arguments].join(" ")}`);
+  log(`  \u8F93\u51FA\uFF1A${plan.output.directory}/*${plan.output.artifactSuffix}`);
+}
+var packageHelpText = `\u7528\u6CD5\uFF1Acreate-windy package [\u9009\u9879]
+
+  --profile <key>              \u58F0\u660E\u7684\u6253\u5305 profile
+  --platform <platform>        linux/amd64 \u6216 linux/arm64
+  --input key=value            \u4E3A\u58F0\u660E\u7684\u975E secret \u8F93\u5165\u8D4B\u503C\uFF0C\u53EF\u91CD\u590D\u4F7F\u7528
+  --plan <\u6587\u4EF6>                \u4FDD\u5B58\u65B0\u5EFA\u51BB\u7ED3\u8BA1\u5212\uFF08\u9879\u76EE\u76EE\u5F55\u5185\uFF09
+  --from-plan <\u6587\u4EF6>           \u8BFB\u53D6\u51BB\u7ED3\u8BA1\u5212\uFF08\u9879\u76EE\u76EE\u5F55\u5185\uFF09
+  --execute                    \u901A\u8FC7\u9884\u68C0\u5E76\u786E\u8BA4\u540E\u6267\u884C
+  --yes                        \u975E\u4EA4\u4E92\u6267\u884C\u65F6\u786E\u8BA4\u8BA1\u5212
+  --cwd <\u76EE\u5F55>                 \u6307\u5B9A\u9879\u76EE\u76EE\u5F55
+
+\u6253\u5305\u9002\u914D\u5668\u5FC5\u987B\u7531\u9879\u76EE\u6839\u76EE\u5F55\u7684 windy.build.json \u660E\u786E\u58F0\u660E\u3002\u6267\u884C\u5FC5\u987B\u4F7F\u7528 --plan \u6216
+--from-plan\uFF0C\u4EE5\u4FBF\u628A\u4EA7\u7269 SHA-256 \u4E0E\u6E90\u7801\u6F02\u79FB\u7ED3\u679C\u5199\u56DE\u51BB\u7ED3\u8BA1\u5212\u3002`;
+
 // src/cli.ts
 async function main() {
   const args = process.argv.slice(2);
@@ -11996,6 +12941,8 @@ async function main() {
     return;
   if (await runLifecycleCommand(args))
     return;
+  if (await runPackageCommand(args))
+    return;
   const options = parseArguments(args);
   if (options === "help") {
     console.log(helpText);