flujo-ai 3.28.0 → 3.30.0

package/.next/types/app/v1/chat/events/route.ts

@@ -1,4 +1,4 @@
-// File: C:\Users\MarioAndreschak\Documents\GitHub\FLUJO\src\app\v1\chat\events\route.ts
+// File: C:\Users\Moe\Documents\GitHub\FLUJO\src\app\v1\chat\events\route.ts
 import * as entry from '../../../../../../src/app/v1/chat/events/route.js'
 import type { NextRequest } from 'next/server.js'
 

package/.next/types/app/v1/models/route.ts

@@ -1,4 +1,4 @@
-// File: C:\Users\MarioAndreschak\Documents\GitHub\FLUJO\src\app\v1\models\route.ts
+// File: C:\Users\Moe\Documents\GitHub\FLUJO\src\app\v1\models\route.ts
 import * as entry from '../../../../../src/app/v1/models/route.js'
 import type { NextRequest } from 'next/server.js'
 

package/.next/types/app/waves/page.ts

@@ -1,4 +1,4 @@
-// File: C:\Users\MarioAndreschak\Documents\GitHub\FLUJO\src\app\waves\page.tsx
+// File: C:\Users\Moe\Documents\GitHub\FLUJO\src\app\waves\page.tsx
 import * as entry from '../../../../src/app/waves/page.js'
 import type { ResolvingMetadata, ResolvingViewport } from 'next/dist/lib/metadata/types/metadata-interface.js'
 

package/.next/types/routes.d.ts

@@ -2,7 +2,7 @@
 // Do not edit this file manually
 
 type AppRoutes = "/" | "/chat" | "/docs" | "/executions" | "/flows" | "/mcp" | "/models" | "/packages" | "/settings" | "/waves"
-type AppRouteHandlerRoutes = "/api/approvals" | "/api/approvals/[id]" | "/api/backup" | "/api/browse" | "/api/bugs/enhance" | "/api/cwd" | "/api/encryption/secure" | "/api/env" | "/api/flow" | "/api/flow/[id]" | "/api/flow/[id]/versions" | "/api/flow/[id]/versions/[versionId]" | "/api/flow/compile" | "/api/flow/generate" | "/api/flow/improve" | "/api/flow/prompt-renderer" | "/api/flow/quick-chat" | "/api/flow/repair" | "/api/git" | "/api/init" | "/api/local-models/capability" | "/api/local-models/pull" | "/api/local-models/suggest" | "/api/mcp-registry" | "/api/mcp-registry/spotlight" | "/api/mcp/app-sandbox" | "/api/mcp/cancel" | "/api/mcp/oauth-capability" | "/api/mcp/servers" | "/api/mcp/servers/[name]" | "/api/mcp/servers/[name]/prompts" | "/api/mcp/servers/[name]/prompts/get" | "/api/mcp/servers/[name]/resources" | "/api/mcp/servers/[name]/resources/read" | "/api/mcp/servers/[name]/status" | "/api/mcp/servers/[name]/tools" | "/api/mcp/servers/[name]/tools/[toolName]" | "/api/mcp/test-connection" | "/api/mcp/test-connection/stream" | "/api/model" | "/api/model/[id]" | "/api/model/provider" | "/api/model/test" | "/api/oauth/callback" | "/api/oauth/initiate" | "/api/oauth/reset" | "/api/packages/build" | "/api/packages/derive-secrets" | "/api/packages/install" | "/api/packages/install/status" | "/api/packages/installed" | "/api/packages/resolve" | "/api/packages/uninstall" | "/api/planned-executions" | "/api/planned-executions/[id]" | "/api/planned-executions/[id]/run" | "/api/planned-executions/[id]/runs" | "/api/planned-executions/preview-schedule" | "/api/planned-executions/reconcile" | "/api/registry/auth" | "/api/registry/auth/resend" | "/api/registry/auth/reset" | "/api/registry/oauth/callback" | "/api/registry/oauth/initiate" | "/api/registry/publish" | "/api/registry/settings" | "/api/restore" | "/api/runs/active" | "/api/storage" | "/api/update" | "/api/waves" | "/api/webhooks/[id]" | "/mcp-flows" | "/mcp-proxy/[server]" | "/v1/chat/completions" | "/v1/chat/conversations" | "/v1/chat/conversations/[conversationId]" | "/v1/chat/conversations/[conversationId]/breakpoints" | "/v1/chat/conversations/[conversationId]/cancel" | "/v1/chat/conversations/[conversationId]/debug/continue" | "/v1/chat/conversations/[conversationId]/debug/step" | "/v1/chat/conversations/[conversationId]/edit-state" | "/v1/chat/conversations/[conversationId]/events" | "/v1/chat/conversations/[conversationId]/resources" | "/v1/chat/conversations/[conversationId]/respond" | "/v1/chat/events" | "/v1/models"
+type AppRouteHandlerRoutes = "/api/approvals" | "/api/approvals/[id]" | "/api/backup" | "/api/browse" | "/api/bugs/enhance" | "/api/cwd" | "/api/encryption/secure" | "/api/env" | "/api/flow" | "/api/flow/[id]" | "/api/flow/[id]/versions" | "/api/flow/[id]/versions/[versionId]" | "/api/flow/compile" | "/api/flow/generate" | "/api/flow/improve" | "/api/flow/prompt-renderer" | "/api/flow/quick-chat" | "/api/flow/repair" | "/api/git" | "/api/init" | "/api/local-models/capability" | "/api/local-models/pull" | "/api/local-models/suggest" | "/api/mcp-registry" | "/api/mcp-registry/spotlight" | "/api/mcp/app-sandbox" | "/api/mcp/cancel" | "/api/mcp/oauth-capability" | "/api/mcp/servers" | "/api/mcp/servers/[name]" | "/api/mcp/servers/[name]/prompts" | "/api/mcp/servers/[name]/prompts/get" | "/api/mcp/servers/[name]/resources" | "/api/mcp/servers/[name]/resources/read" | "/api/mcp/servers/[name]/status" | "/api/mcp/servers/[name]/tools" | "/api/mcp/servers/[name]/tools/[toolName]" | "/api/mcp/test-connection" | "/api/mcp/test-connection/stream" | "/api/model" | "/api/model/[id]" | "/api/model/provider" | "/api/model/test" | "/api/oauth/callback" | "/api/oauth/initiate" | "/api/oauth/reset" | "/api/packages/build" | "/api/packages/derive-secrets" | "/api/packages/install" | "/api/packages/install/status" | "/api/packages/installed" | "/api/packages/resolve" | "/api/packages/scan-targets" | "/api/packages/search" | "/api/packages/uninstall" | "/api/planned-executions" | "/api/planned-executions/[id]" | "/api/planned-executions/[id]/run" | "/api/planned-executions/[id]/runs" | "/api/planned-executions/preview-schedule" | "/api/planned-executions/reconcile" | "/api/registry/auth" | "/api/registry/auth/resend" | "/api/registry/auth/reset" | "/api/registry/oauth/callback" | "/api/registry/oauth/initiate" | "/api/registry/publish" | "/api/registry/settings" | "/api/restore" | "/api/runs/active" | "/api/storage" | "/api/update" | "/api/waves" | "/api/webhooks/[id]" | "/mcp-flows" | "/mcp-proxy/[server]" | "/v1/chat/completions" | "/v1/chat/conversations" | "/v1/chat/conversations/[conversationId]" | "/v1/chat/conversations/[conversationId]/breakpoints" | "/v1/chat/conversations/[conversationId]/cancel" | "/v1/chat/conversations/[conversationId]/debug/continue" | "/v1/chat/conversations/[conversationId]/debug/step" | "/v1/chat/conversations/[conversationId]/edit-state" | "/v1/chat/conversations/[conversationId]/events" | "/v1/chat/conversations/[conversationId]/inject" | "/v1/chat/conversations/[conversationId]/resources" | "/v1/chat/conversations/[conversationId]/respond" | "/v1/chat/events" | "/v1/models"
 type PageRoutes = never
 type LayoutRoutes = "/"
 type RedirectRoutes = never
@@ -64,6 +64,8 @@ interface ParamMap {
   "/api/packages/install/status": {}
   "/api/packages/installed": {}
   "/api/packages/resolve": {}
+  "/api/packages/scan-targets": {}
+  "/api/packages/search": {}
   "/api/packages/uninstall": {}
   "/api/planned-executions": {}
   "/api/planned-executions/[id]": { "id": string; }
@@ -103,6 +105,7 @@ interface ParamMap {
   "/v1/chat/conversations/[conversationId]/debug/step": { "conversationId": string; }
   "/v1/chat/conversations/[conversationId]/edit-state": { "conversationId": string; }
   "/v1/chat/conversations/[conversationId]/events": { "conversationId": string; }
+  "/v1/chat/conversations/[conversationId]/inject": { "conversationId": string; }
   "/v1/chat/conversations/[conversationId]/resources": { "conversationId": string; }
   "/v1/chat/conversations/[conversationId]/respond": { "conversationId": string; }
   "/v1/chat/events": {}

package/.next/types/validator.ts

@@ -605,6 +605,24 @@ type RouteHandlerConfig<Route extends AppRouteHandlerRoutes = AppRouteHandlerRou
   type __Unused = __Check
 }
 
+// Validate ../../src/app/api/packages/scan-targets/route.ts
+{
+  type __IsExpected<Specific extends RouteHandlerConfig<"/api/packages/scan-targets">> = Specific
+  const handler = {} as typeof import("../../src/app/api/packages/scan-targets/route.js")
+  type __Check = __IsExpected<typeof handler>
+  // @ts-ignore
+  type __Unused = __Check
+}
+
+// Validate ../../src/app/api/packages/search/route.ts
+{
+  type __IsExpected<Specific extends RouteHandlerConfig<"/api/packages/search">> = Specific
+  const handler = {} as typeof import("../../src/app/api/packages/search/route.js")
+  type __Check = __IsExpected<typeof handler>
+  // @ts-ignore
+  type __Unused = __Check
+}
+
 // Validate ../../src/app/api/packages/uninstall/route.ts
 {
   type __IsExpected<Specific extends RouteHandlerConfig<"/api/packages/uninstall">> = Specific
@@ -866,6 +884,15 @@ type RouteHandlerConfig<Route extends AppRouteHandlerRoutes = AppRouteHandlerRou
   type __Unused = __Check
 }
 
+// Validate ../../src/app/v1/chat/conversations/[conversationId]/inject/route.ts
+{
+  type __IsExpected<Specific extends RouteHandlerConfig<"/v1/chat/conversations/[conversationId]/inject">> = Specific
+  const handler = {} as typeof import("../../src/app/v1/chat/conversations/[conversationId]/inject/route.js")
+  type __Check = __IsExpected<typeof handler>
+  // @ts-ignore
+  type __Unused = __Check
+}
+
 // Validate ../../src/app/v1/chat/conversations/[conversationId]/resources/route.ts
 {
   type __IsExpected<Specific extends RouteHandlerConfig<"/v1/chat/conversations/[conversationId]/resources">> = Specific

package/README.md

@@ -1,5 +1,10 @@
 <img width="720" height="405" alt="output" src="https://github.com/user-attachments/assets/87ff1b2c-fec2-4652-a049-98e5ee699e00" />
 
+### ▶ FLUJO in 60 seconds
+
+[![Watch: FLUJO in 60 seconds — animated short](githubpages/img/short-poster.jpeg)](https://mario-andreschak.github.io/FLUJO/githubpages/short.html)
+
+*Click to watch*
 
 ## ⚡ Quick Install (recommended)
 
@@ -37,7 +42,7 @@ For *anything* that you struggle with (MCP Installation, Application Issues, Usa
 # FLUJO
 
 [![MIT License](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
-[![Version](https://img.shields.io/badge/version-3.28.0-green.svg)](package.json)
+[![Version](https://img.shields.io/badge/version-3.30.0-green.svg)](package.json)
 
 FLUJO is an open-source, local-first platform for building **MCP-powered AI workflows**. It brings together model management, Model-Context-Protocol (MCP) servers, a visual flow builder, and a chat interface in one app — so you can wire models and tools together, run them headlessly on triggers, and expose the result to other apps, without giving up control of your keys and data.
 

package/bin/flujo.mjs

@@ -1,120 +1,120 @@
-#!/usr/bin/env node
-/**
- * `flujo` / `npx flujo-ai` entry point (issue #59).
- *
- * Runs a *prebuilt* FLUJO out of the installed npm package — no git clone, no
- * local `next build`. It:
- *   1. Puts user data in ~/.flujo by default (FLUJO_DATA_DIR override honored),
- *      so nothing is written into the read-only package install dir.
- *   2. Marks the install mode as 'npm' (FLUJO_NPM=1) so the update route/UI show
- *      "reinstall the package" instead of a broken git-pull button.
- *   3. Applies the exact same TLS/CA env handling as `npm start` by reusing
- *      buildLaunchEnv() from scripts/launch-next.mjs (single source of truth).
- *   4. Starts Next's own `next start` from the package's bundled node_modules,
- *      with cwd = package root so the packaged `.next` build is found.
- *
- * Flags: --port <n> / FLUJO_PORT (default 4200); --no-open to suppress the
- * browser auto-open.
- */
-import process from 'node:process';
-import path from 'node:path';
-import os from 'node:os';
-import fs from 'node:fs';
-import { spawn } from 'node:child_process';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-import { createRequire } from 'node:module';
-
-const require = createRequire(import.meta.url);
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-// Package root is the parent of bin/ — where package.json and the built .next live.
-const packageRoot = path.resolve(__dirname, '..');
-
-// --- args -----------------------------------------------------------------
-const argv = process.argv.slice(2);
-const noOpen = argv.includes('--no-open');
-
-function readPort() {
-  const idx = argv.findIndex((a) => a === '--port' || a === '-p');
-  if (idx !== -1 && argv[idx + 1]) {
-    return argv[idx + 1];
-  }
-  const eq = argv.find((a) => a.startsWith('--port='));
-  if (eq) {
-    return eq.slice('--port='.length);
-  }
-  return process.env.FLUJO_PORT || '4200';
-}
-const port = readPort();
-
-// --- data dir --------------------------------------------------------------
-// Default writable data location for a packaged install. A git checkout keeps
-// data in the repo; the npm package keeps it in the user's home so upgrades
-// (reinstalls) never touch it.
-if (!process.env.FLUJO_DATA_DIR || process.env.FLUJO_DATA_DIR.trim().length === 0) {
-  process.env.FLUJO_DATA_DIR = path.join(os.homedir(), '.flujo');
-}
-try {
-  fs.mkdirSync(process.env.FLUJO_DATA_DIR, { recursive: true });
-} catch (error) {
-  console.error(`[FLUJO] Could not create data directory ${process.env.FLUJO_DATA_DIR}:`, error);
-  process.exit(1);
-}
-
-// Tell the running server it was installed via npm so it reports the right update mode.
-process.env.FLUJO_NPM = '1';
-
-// --- build env (TLS/CA), reusing the launcher's single source of truth ------
-const { buildLaunchEnv } = await import(pathToFileURL(path.join(packageRoot, 'scripts', 'launch-next.mjs')).href);
-const env = buildLaunchEnv(process.env);
-
-// --- resolve Next's own CLI from the package's bundled node_modules ---------
-// Never rely on a `next` on the user's PATH — run the exact version this package
-// was built against.
-let nextBin;
-try {
-  nextBin = require.resolve('next/dist/bin/next');
-} catch (error) {
-  console.error('[FLUJO] Could not locate the bundled Next.js binary. The package install may be corrupt.', error);
-  process.exit(1);
-}
-
-const url = `http://localhost:${port}`;
-console.log(`[FLUJO] Starting on ${url}`);
-console.log(`[FLUJO] Data directory: ${process.env.FLUJO_DATA_DIR}`);
-
-const child = spawn(process.execPath, [nextBin, 'start', '-p', String(port)], {
-  stdio: 'inherit',
-  cwd: packageRoot,
-  env,
-});
-
-child.on('error', (error) => {
-  console.error('[FLUJO] Failed to launch:', error);
-  process.exit(1);
-});
-
-child.on('exit', (code, signal) => {
-  if (signal) {
-    process.kill(process.pid, signal);
-  } else {
-    process.exit(code ?? 0);
-  }
-});
-
-// --- browser auto-open (best-effort) ---------------------------------------
-if (!noOpen) {
-  const openCommand =
-    process.platform === 'win32' ? { cmd: 'cmd', args: ['/c', 'start', '""', url] }
-    : process.platform === 'darwin' ? { cmd: 'open', args: [url] }
-    : { cmd: 'xdg-open', args: [url] };
-  // Give `next start` a moment to bind the port before opening the browser.
-  setTimeout(() => {
-    try {
-      const opener = spawn(openCommand.cmd, openCommand.args, { stdio: 'ignore', detached: true });
-      opener.on('error', () => { /* no browser / headless — ignore */ });
-      opener.unref();
-    } catch {
-      /* best-effort only */
-    }
-  }, 2000);
-}
+#!/usr/bin/env node
+/**
+ * `flujo` / `npx flujo-ai` entry point (issue #59).
+ *
+ * Runs a *prebuilt* FLUJO out of the installed npm package — no git clone, no
+ * local `next build`. It:
+ *   1. Puts user data in ~/.flujo by default (FLUJO_DATA_DIR override honored),
+ *      so nothing is written into the read-only package install dir.
+ *   2. Marks the install mode as 'npm' (FLUJO_NPM=1) so the update route/UI show
+ *      "reinstall the package" instead of a broken git-pull button.
+ *   3. Applies the exact same TLS/CA env handling as `npm start` by reusing
+ *      buildLaunchEnv() from scripts/launch-next.mjs (single source of truth).
+ *   4. Starts Next's own `next start` from the package's bundled node_modules,
+ *      with cwd = package root so the packaged `.next` build is found.
+ *
+ * Flags: --port <n> / FLUJO_PORT (default 4200); --no-open to suppress the
+ * browser auto-open.
+ */
+import process from 'node:process';
+import path from 'node:path';
+import os from 'node:os';
+import fs from 'node:fs';
+import { spawn } from 'node:child_process';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+// Package root is the parent of bin/ — where package.json and the built .next live.
+const packageRoot = path.resolve(__dirname, '..');
+
+// --- args -----------------------------------------------------------------
+const argv = process.argv.slice(2);
+const noOpen = argv.includes('--no-open');
+
+function readPort() {
+  const idx = argv.findIndex((a) => a === '--port' || a === '-p');
+  if (idx !== -1 && argv[idx + 1]) {
+    return argv[idx + 1];
+  }
+  const eq = argv.find((a) => a.startsWith('--port='));
+  if (eq) {
+    return eq.slice('--port='.length);
+  }
+  return process.env.FLUJO_PORT || '4200';
+}
+const port = readPort();
+
+// --- data dir --------------------------------------------------------------
+// Default writable data location for a packaged install. A git checkout keeps
+// data in the repo; the npm package keeps it in the user's home so upgrades
+// (reinstalls) never touch it.
+if (!process.env.FLUJO_DATA_DIR || process.env.FLUJO_DATA_DIR.trim().length === 0) {
+  process.env.FLUJO_DATA_DIR = path.join(os.homedir(), '.flujo');
+}
+try {
+  fs.mkdirSync(process.env.FLUJO_DATA_DIR, { recursive: true });
+} catch (error) {
+  console.error(`[FLUJO] Could not create data directory ${process.env.FLUJO_DATA_DIR}:`, error);
+  process.exit(1);
+}
+
+// Tell the running server it was installed via npm so it reports the right update mode.
+process.env.FLUJO_NPM = '1';
+
+// --- build env (TLS/CA), reusing the launcher's single source of truth ------
+const { buildLaunchEnv } = await import(pathToFileURL(path.join(packageRoot, 'scripts', 'launch-next.mjs')).href);
+const env = buildLaunchEnv(process.env);
+
+// --- resolve Next's own CLI from the package's bundled node_modules ---------
+// Never rely on a `next` on the user's PATH — run the exact version this package
+// was built against.
+let nextBin;
+try {
+  nextBin = require.resolve('next/dist/bin/next');
+} catch (error) {
+  console.error('[FLUJO] Could not locate the bundled Next.js binary. The package install may be corrupt.', error);
+  process.exit(1);
+}
+
+const url = `http://localhost:${port}`;
+console.log(`[FLUJO] Starting on ${url}`);
+console.log(`[FLUJO] Data directory: ${process.env.FLUJO_DATA_DIR}`);
+
+const child = spawn(process.execPath, [nextBin, 'start', '-p', String(port)], {
+  stdio: 'inherit',
+  cwd: packageRoot,
+  env,
+});
+
+child.on('error', (error) => {
+  console.error('[FLUJO] Failed to launch:', error);
+  process.exit(1);
+});
+
+child.on('exit', (code, signal) => {
+  if (signal) {
+    process.kill(process.pid, signal);
+  } else {
+    process.exit(code ?? 0);
+  }
+});
+
+// --- browser auto-open (best-effort) ---------------------------------------
+if (!noOpen) {
+  const openCommand =
+    process.platform === 'win32' ? { cmd: 'cmd', args: ['/c', 'start', '""', url] }
+    : process.platform === 'darwin' ? { cmd: 'open', args: [url] }
+    : { cmd: 'xdg-open', args: [url] };
+  // Give `next start` a moment to bind the port before opening the browser.
+  setTimeout(() => {
+    try {
+      const opener = spawn(openCommand.cmd, openCommand.args, { stdio: 'ignore', detached: true });
+      opener.on('error', () => { /* no browser / headless — ignore */ });
+      opener.unref();
+    } catch {
+      /* best-effort only */
+    }
+  }, 2000);
+}

package/next.config.mjs

@@ -1,139 +1,139 @@
-// Plain-JS config on purpose: the npm package (`npx flujo-ai`) runs `next start`
-// on end-user machines without TypeScript installed, and a next.config.ts would
-// make Next try to npm-install typescript there at runtime (which fails).
-import path from 'path';
-import { fileURLToPath } from 'url';
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-
-/** @type {import('next').NextConfig} */
-const nextConfig = {
-  /* config options here */
-  // Pin the workspace root to this project. Without this, a stray
-  // package-lock.json in a parent dir (e.g. the user's home folder) makes
-  // Next infer the wrong root and install/resolve deps like typescript in the
-  // wrong place, breaking `next build`.
-  outputFileTracingRoot: __dirname,
-  // CORS for `/api/*` is defense-in-depth secondary to the fail-closed origin
-  // guard in `src/middleware.ts` (#142). We do NOT advertise a wildcard
-  // `Access-Control-Allow-Origin: *` for the blanket `/api` surface: even if the
-  // guard were ever bypassed, a cross-origin page must not be told it may read
-  // `/api` responses. The value is narrowed to the local dev origin, consistent
-  // with the `/api/env` override (#141). The public OpenAI-compatible `/v1/*`
-  // API sets its own permissive CORS in-handler and is not matched here.
-  async headers() {
-    return [
-      {
-        source: '/api/:path*',
-        headers: [
-          { key: 'Access-Control-Allow-Origin', value: 'http://localhost:4200' },
-          { key: 'Access-Control-Allow-Methods', value: 'GET, OPTIONS' },
-          { key: 'Access-Control-Allow-Headers', value: '*' },
-          { key: 'Vary', value: 'Origin' },
-        ],
-      },
-      // Defense-in-depth for /api/env (#141): this route can return DECRYPTED
-      // secrets (`?includeSecrets=true`). Even though `assertLocalRequest` already
-      // rejects cross-origin callers, do NOT advertise a wildcard ACAO here so the
-      // response is never cross-origin readable if the guard were ever bypassed.
-      // This block is more specific and comes after the wildcard, so its
-      // Access-Control-Allow-Origin value overrides the '*' above for /api/env.
-      // (In-app calls are same-origin and don't rely on CORS.)
-      {
-        source: '/api/env',
-        headers: [
-          { key: 'Access-Control-Allow-Origin', value: 'http://localhost:4200' },
-          { key: 'Vary', value: 'Origin' },
-        ],
-      },
-    ];
-  },
-  typescript: {
-    // Ignore all TypeScript errors during build
-    ignoreBuildErrors: true,
-  },
-  eslint: {
-    // Ignore all ESLint errors during build
-    ignoreDuringBuilds: true,
-  },
-  transpilePackages: [
-    '@mui/material',
-    '@mui/icons-material',
-    '@mui/system',
-    '@mui/utils',
-    '@emotion/react',
-    '@emotion/styled'
-  ],
-  // Increase the webpack chunk loading timeout and configure other performance settings
-  webpack: (config, { dev, isServer }) => {
-    // Only apply these settings in development mode
-    if (dev && !isServer) {
-      // Increase chunk loading timeout to 60 seconds (60000ms)
-      config.output = {
-        ...config.output,
-        chunkLoadTimeout: 60000,
-      };
-
-      // Optimize for development performance
-      config.optimization = {
-        ...config.optimization,
-        runtimeChunk: 'single',
-        splitChunks: {
-          chunks: 'all',
-          cacheGroups: {
-            vendors: {
-              test: /[\\/]node_modules[\\/](?!.*\.css$)/,  // Exclude CSS files from vendors chunk
-              name: 'vendors',
-              priority: -10,
-              reuseExistingChunk: true,
-            },
-            styles: {
-              name: 'styles',
-              test: /\.css$/,
-              chunks: 'all',
-              enforce: true,
-              priority: 20,
-            },
-          },
-        },
-      };
-
-      // Configure watchOptions for better file watching
-      config.watchOptions = {
-        ...config.watchOptions,
-        poll: 1000, // Check for changes every second
-        aggregateTimeout: 300, // Delay before rebuilding
-      };
-    }
-
-    // Exclude node binary files from being processed by webpack
-    config.externals = [...(config.externals || []),
-      {
-        sharp: 'commonjs sharp',
-        'node-gyp-build': 'commonjs node-gyp-build'
-      }
-    ];
-
-    // Handle binary modules properly
-    config.module = {
-      ...config.module,
-      rules: [
-        ...(config.module?.rules || []),
-        {
-          test: /\.node$/,
-          use: 'node-loader',
-        },
-      ],
-    };
-
-    // Enable WebAssembly
-    config.experiments = {
-      ...config.experiments,
-      asyncWebAssembly: true,
-    };
-
-    return config;
-  },
-};
-
-export default nextConfig;
+// Plain-JS config on purpose: the npm package (`npx flujo-ai`) runs `next start`
+// on end-user machines without TypeScript installed, and a next.config.ts would
+// make Next try to npm-install typescript there at runtime (which fails).
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+/** @type {import('next').NextConfig} */
+const nextConfig = {
+  /* config options here */
+  // Pin the workspace root to this project. Without this, a stray
+  // package-lock.json in a parent dir (e.g. the user's home folder) makes
+  // Next infer the wrong root and install/resolve deps like typescript in the
+  // wrong place, breaking `next build`.
+  outputFileTracingRoot: __dirname,
+  // CORS for `/api/*` is defense-in-depth secondary to the fail-closed origin
+  // guard in `src/middleware.ts` (#142). We do NOT advertise a wildcard
+  // `Access-Control-Allow-Origin: *` for the blanket `/api` surface: even if the
+  // guard were ever bypassed, a cross-origin page must not be told it may read
+  // `/api` responses. The value is narrowed to the local dev origin, consistent
+  // with the `/api/env` override (#141). The public OpenAI-compatible `/v1/*`
+  // API sets its own permissive CORS in-handler and is not matched here.
+  async headers() {
+    return [
+      {
+        source: '/api/:path*',
+        headers: [
+          { key: 'Access-Control-Allow-Origin', value: 'http://localhost:4200' },
+          { key: 'Access-Control-Allow-Methods', value: 'GET, OPTIONS' },
+          { key: 'Access-Control-Allow-Headers', value: '*' },
+          { key: 'Vary', value: 'Origin' },
+        ],
+      },
+      // Defense-in-depth for /api/env (#141): this route can return DECRYPTED
+      // secrets (`?includeSecrets=true`). Even though `assertLocalRequest` already
+      // rejects cross-origin callers, do NOT advertise a wildcard ACAO here so the
+      // response is never cross-origin readable if the guard were ever bypassed.
+      // This block is more specific and comes after the wildcard, so its
+      // Access-Control-Allow-Origin value overrides the '*' above for /api/env.
+      // (In-app calls are same-origin and don't rely on CORS.)
+      {
+        source: '/api/env',
+        headers: [
+          { key: 'Access-Control-Allow-Origin', value: 'http://localhost:4200' },
+          { key: 'Vary', value: 'Origin' },
+        ],
+      },
+    ];
+  },
+  typescript: {
+    // Ignore all TypeScript errors during build
+    ignoreBuildErrors: true,
+  },
+  eslint: {
+    // Ignore all ESLint errors during build
+    ignoreDuringBuilds: true,
+  },
+  transpilePackages: [
+    '@mui/material',
+    '@mui/icons-material',
+    '@mui/system',
+    '@mui/utils',
+    '@emotion/react',
+    '@emotion/styled'
+  ],
+  // Increase the webpack chunk loading timeout and configure other performance settings
+  webpack: (config, { dev, isServer }) => {
+    // Only apply these settings in development mode
+    if (dev && !isServer) {
+      // Increase chunk loading timeout to 60 seconds (60000ms)
+      config.output = {
+        ...config.output,
+        chunkLoadTimeout: 60000,
+      };
+
+      // Optimize for development performance
+      config.optimization = {
+        ...config.optimization,
+        runtimeChunk: 'single',
+        splitChunks: {
+          chunks: 'all',
+          cacheGroups: {
+            vendors: {
+              test: /[\\/]node_modules[\\/](?!.*\.css$)/,  // Exclude CSS files from vendors chunk
+              name: 'vendors',
+              priority: -10,
+              reuseExistingChunk: true,
+            },
+            styles: {
+              name: 'styles',
+              test: /\.css$/,
+              chunks: 'all',
+              enforce: true,
+              priority: 20,
+            },
+          },
+        },
+      };
+
+      // Configure watchOptions for better file watching
+      config.watchOptions = {
+        ...config.watchOptions,
+        poll: 1000, // Check for changes every second
+        aggregateTimeout: 300, // Delay before rebuilding
+      };
+    }
+
+    // Exclude node binary files from being processed by webpack
+    config.externals = [...(config.externals || []),
+      {
+        sharp: 'commonjs sharp',
+        'node-gyp-build': 'commonjs node-gyp-build'
+      }
+    ];
+
+    // Handle binary modules properly
+    config.module = {
+      ...config.module,
+      rules: [
+        ...(config.module?.rules || []),
+        {
+          test: /\.node$/,
+          use: 'node-loader',
+        },
+      ],
+    };
+
+    // Enable WebAssembly
+    config.experiments = {
+      ...config.experiments,
+      asyncWebAssembly: true,
+    };
+
+    return config;
+  },
+};
+
+export default nextConfig;