[rockyshi1993]

Scope — internal-only commercial FlowKit

FlowKit is a proprietary internal engine. Future customer access is planned through hosted MCP, API or a paid workflow-design product; customers will not install FlowKit packages or receive the source. Those hosted services are not claimed as implemented here.

Implementation

• Changed current license from MIT to internal proprietary software terms; explicitly separated hosted-service access and customer-generated workflow output rights from software licensing.
• Scoped internal npm package @devcodex-labs/flowkit for private GitHub Packages only; maintained read-only package identity verification and release byte provenance.
• Implemented capability-graph v2.1.1 Provider declaration and a fail-closed, explicit host action binding adapter, without adding a mandatory second runtime.
• Added E13 (Graph discovery, dependencies, applicability, access denial and host execution) with type tests; retained six core SDK functions, eight DSL node types and 61 diagnostics.
• Migrated docs, examples, fixture paths, scope-sensitive compiler imports and golden snapshots; fixed Windows Node 22 documentation consumer argument pass-through.
• Public documentation approved; pages explain that internal installation is for maintainers only. Public website no longer links to private edit/repository controls.

Verification

Latest commit: ef2e043825ed8d6c915d0dc02410568e355bb123.
CI run 42589317647: 5/5 success (Windows and Ubuntu × Node 22/24, plus documentation website checks).

Deliberate safety boundaries

• No automatic public npm release; FLOWKIT_ENABLE_PACKAGE_PUBLISH=true explicitly required to publish internally to GitHub Packages.
• Public site deployment requires FLOWKIT_ENABLE_PAGES_DEPLOY=true; merging the PR does not deploy the website.
• Neither GitHub Packages private visibility nor real registry download has been exercised before publishing; live production validation remains a separate later action.
• Hosted service terms, commercial service pricing and output rights are not yet implemented and must be specified before opening a paid service.

---

Note

High Risk
Changes distribution, licensing, and release gates for a previously public npm package; incorrect registry auth or publish flags could block releases or expose packages. New capability-graph adapter touches runtime action execution paths.

Overview
Repositions FlowKit as proprietary internal software: the npm identity moves to @devcodex-labs/flowkit, LICENSE and user-facing docs drop MIT in favor of private distribution via GitHub Packages, with .npmrc.example and README install guidance for maintainers only.

Release and CI no longer target public npm/OIDC: publish.yml publishes to npm.pkg.github.com, derives version from the git tag, gates package publish and Pages deploy on FLOWKIT_ENABLE_PACKAGE_PUBLISH / FLOWKIT_ENABLE_PAGES_DEPLOY, and adds a private-consumer job that checks package privacy API metadata and runs registry-backed doc proofs (docs:private-package, updated release scripts and evidence paths).

Adds an optional @devcodex-labs/flowkit/capability-graph export with flowkitProvider and createCapabilityGraphActionAdapter (graph resolves constraints; host executes bindings), plus documentation example E13 and compiler enforcement of the new DSL import path. Examples, tests, fixtures, and golden hashes are swept to the new scope; docs example verification can use FLOWKIT_DOCS_EVIDENCE instead of CLI --evidence.

^{Reviewed by Cursor Bugbot for commit ef2e043. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ef2e043. Configure here.}

[cursor]

Privacy check CLI never runs

High Severity

The CLI guard compares import.meta.url to new URL('file://' + process.argv[1]), which does not match a relative path such as scripts/docs/check-package-privacy.mjs. The publish workflow invokes the script that way, so checkPrivatePackage never runs and the step still exits 0. A public GitHub Package would not be caught.

 

^{Reviewed by Cursor Bugbot for commit ef2e043. Configure here.}