FlowKit: proprietary internal engine, GitHub Packages and capability-graph integration

.github/workflows/ci.yml

@@ -41,7 +41,9 @@ jobs:
           echo "::remove-matcher owner=tsc::"
           npm run verify
       - name: Consume candidate package through all documentation examples
-        run: npm run docs:examples -- --evidence .tmp/docs/candidate.json
+        env:
+          FLOWKIT_DOCS_EVIDENCE: .tmp/docs/candidate.json
+        run: npm run docs:examples
       - name: Keep documentation consumer evidence
         if: always()
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6

.github/workflows/docs.yml

@@ -12,7 +12,7 @@ on:
     inputs:
       packageReleaseCommit: { description: 'Original v1.0.0 package commit (40 hex)', required: true, type: string }
       docsCommit: { description: 'Reviewed documentation commit (40 hex)', required: true, type: string }
-      version: { description: 'Exact public version', default: '1.0.0', required: true, type: string }
+      version: { description: 'Exact private package version', default: '1.0.0', required: true, type: string }
       releaseRunId: { description: 'Original publish workflow run ID', required: true, type: string }
       releaseRunAttempt: { description: 'Original pack/publish attempt', required: true, type: string }
 
@@ -39,6 +39,7 @@ jobs:
     permissions:
       contents: read
       actions: read
+      packages: read
     steps:
       - name: Checkout original package source
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
@@ -57,6 +58,8 @@ jobs:
         with:
           node-version: '24.22.1'
           package-manager-cache: false
+          registry-url: 'https://npm.pkg.github.com'
+          scope: '@devcodex-labs'
       - name: Check exact original checkout
         working-directory: package-source
         run: node --input-type=module -e 'import{execFileSync}from"node:child_process";import assert from"node:assert/strict";assert.match(process.env.PACKAGE_COMMIT,/^[a-f0-9]{40}$/);assert.equal(execFileSync("git",["rev-parse","HEAD"],{encoding:"utf8"}).trim(),process.env.PACKAGE_COMMIT);'
@@ -85,21 +88,25 @@ jobs:
           repository: devcodex-labs/flowkit
           run-id: ${{ inputs.releaseRunId }}
       - name: Verify immutable candidate and allowed docs repair
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         working-directory: package-source
         run: |
           node scripts/docs/release-identity.mjs verify --metadata .tmp/source-metadata.json --record .tmp/identity/release-record.json --release-dir .tmp/release --docs-root ../docs-source --out .tmp/docs/deployment-identity.json
-          node scripts/release.mjs verify --tag v1.0.0
-          npm run docs:public-package -- --version 1.0.0 --manifest .tmp/release/release.json --evidence .tmp/docs/public-package.json
+          node scripts/release.mjs verify --tag "v${RELEASE_VERSION}"
+          npm run docs:private-package -- --version "$RELEASE_VERSION" --manifest .tmp/release/release.json --evidence .tmp/docs/public-package.json
       - run: npm ci --ignore-scripts --no-audit --no-fund
         working-directory: docs-source
       - run: npm --prefix website ci --ignore-scripts --no-audit --no-fund
         working-directory: docs-source
-      - name: Verify repaired tutorials against original public package and build site
+      - name: Verify repaired tutorials against original private package and build site
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         working-directory: docs-source
         run: |
           npm run build
           npm run docs:check
-          npm run docs:examples -- --registry-version 1.0.0 --manifest ../package-source/.tmp/release/release.json --evidence .tmp/docs/public-consumer.json
+          npm run docs:examples -- --registry-version "$RELEASE_VERSION" --manifest ../package-source/.tmp/release/release.json --evidence .tmp/docs/public-consumer.json
           npm run docs:build
           node --input-type=module -e 'import{readFileSync,writeFileSync}from"node:fs";import{createHash}from"node:crypto";const i=JSON.parse(readFileSync("../package-source/.tmp/docs/deployment-identity.json"));i.websiteLockSha256=createHash("sha256").update(readFileSync("website/package-lock.json")).digest("hex");writeFileSync(".tmp/docs/site-build.json",JSON.stringify(i,null,2));'
       - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
@@ -121,6 +128,8 @@ jobs:
           path: docs-source/website/doc_build
 
   deploy:
+    # The site may be public; keep deployment gated by explicit release authorization.
+    if: ${{ vars.FLOWKIT_ENABLE_PAGES_DEPLOY == 'true' }}
     needs: build
     runs-on: ubuntu-24.04
     permissions:

.github/workflows/publish.yml

@@ -1,4 +1,4 @@
-name: Publish npm
+name: Publish GitHub Packages
 
 on:
   push:
@@ -8,7 +8,7 @@ permissions:
   contents: read
 
 concurrency:
-  group: npm-${{ github.ref }}
+  group: github-packages-${{ github.ref }}
   cancel-in-progress: false
 
 jobs:
@@ -35,6 +35,8 @@ jobs:
 
   pack:
     needs: checks
+    outputs:
+      version: ${{ steps.release_meta.outputs.version }}
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
@@ -52,7 +54,9 @@ jobs:
           RELEASE_TAG: ${{ github.ref_name }}
         run: npm run release:pack -- --tag "$RELEASE_TAG"
       - name: Consume the exact candidate bytes
-        run: npm run docs:examples -- --package .tmp/release/devcodex-flowkit-1.0.0.tgz --evidence .tmp/docs/release-candidate.json
+        run: |
+          TARBALL="$(node --input-type=module -e 'import{readFileSync}from"node:fs";console.log(".tmp/release/"+JSON.parse(readFileSync(".tmp/release/release.json","utf8")).filename)')"
+          npm run docs:examples -- --package "$TARBALL" --evidence .tmp/docs/release-candidate.json
       - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         id: npm-artifact
         with:
@@ -64,15 +68,19 @@ jobs:
           include-hidden-files: true
           retention-days: 90
       - name: Record immutable package release identity
+        id: release_meta
         env:
+          RELEASE_TAG: ${{ github.ref_name }}
           PACKAGE_COMMIT: ${{ github.sha }}
           DOCS_COMMIT: ${{ github.sha }}
-          RELEASE_VERSION: '1.0.0'
           RELEASE_RUN_ID: ${{ github.run_id }}
           RELEASE_RUN_ATTEMPT: ${{ github.run_attempt }}
           NPM_ARTIFACT_ID: ${{ steps.npm-artifact.outputs.artifact-id }}
           NPM_ARTIFACT_DIGEST: ${{ steps.npm-artifact.outputs.artifact-digest }}
-        run: node scripts/docs/release-identity.mjs create --release-dir .tmp/release --out .tmp/release-identity/release-record.json
+        run: |
+          export RELEASE_VERSION="${RELEASE_TAG#v}"
+          echo "version=$RELEASE_VERSION" >> "$GITHUB_OUTPUT"
+          node scripts/docs/release-identity.mjs create --release-dir .tmp/release --out .tmp/release-identity/release-record.json
       - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: release-identity-${{ github.run_attempt }}
@@ -82,12 +90,14 @@ jobs:
           retention-days: 90
 
   publish:
+    # Publishing requires explicit owner approval of the proprietary license.
+    if: ${{ vars.FLOWKIT_ENABLE_PACKAGE_PUBLISH == 'true' }}
     needs: pack
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     permissions:
       contents: read
-      id-token: write
+      packages: write
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
@@ -96,9 +106,9 @@ jobs:
         with:
           node-version: '24.22.1'
           package-manager-cache: false
+          registry-url: 'https://npm.pkg.github.com'
+          scope: '@devcodex-labs'
       - run: npm ci --ignore-scripts --no-audit --no-fund
-      - name: Select the documented OIDC-capable npm CLI
-        run: npm install --global npm@11.5.1 --ignore-scripts --no-audit --no-fund
       - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           name: npm-release-${{ github.run_attempt }}
@@ -110,13 +120,19 @@ jobs:
         run: |
           node scripts/release.mjs verify --tag "$RELEASE_TAG"
           node --input-type=module -e 'import {readFileSync,appendFileSync} from "node:fs"; const m=JSON.parse(readFileSync(".tmp/release/release.json","utf8")); appendFileSync(process.env.GITHUB_OUTPUT, `dist_tag=${m.npmTag}\n`);'
-      - name: Publish the verified tarball through npm trusted publishing
+      - name: Publish verified tarball to private GitHub Packages
         env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NPM_DIST_TAG: ${{ steps.artifact.outputs.dist_tag }}
-        run: npm publish .tmp/release/*.tgz --access public --registry=https://registry.npmjs.org/ --tag "$NPM_DIST_TAG"
+        run: npm publish .tmp/release/*.tgz --registry=https://npm.pkg.github.com/ --tag "$NPM_DIST_TAG"
 
-  public-consumer:
+  private-consumer:
     needs: publish
+    permissions:
+      contents: read
+      packages: read
+    env:
+      NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
@@ -127,34 +143,53 @@ jobs:
         with:
           node-version: '24.22.1'
           package-manager-cache: false
+          registry-url: 'https://npm.pkg.github.com'
+          scope: '@devcodex-labs'
       - run: npm ci --ignore-scripts --no-audit --no-fund
       - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           name: npm-release-${{ github.run_attempt }}
           path: .tmp/release
-      - run: node scripts/release.mjs verify --tag v1.0.0
-      - run: npm run docs:public-package -- --version 1.0.0 --manifest .tmp/release/release.json --evidence .tmp/docs/public-package.json
-      - run: npm run docs:examples -- --registry-version 1.0.0 --manifest .tmp/release/release.json --evidence .tmp/docs/public-consumer.json
+      - name: Verify published GitHub Package stays private
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: node scripts/docs/check-package-privacy.mjs
+      - name: Verify original package and private registry
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          VERSION="${RELEASE_TAG#v}"
+          node scripts/release.mjs verify --tag "$RELEASE_TAG"
+          npm run docs:private-package -- --version "$VERSION" --manifest .tmp/release/release.json --evidence .tmp/docs/private-package.json
+      - name: Run consumer examples against the exact private version
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          VERSION="${RELEASE_TAG#v}"
+          npm run docs:examples -- --registry-version "$VERSION" --manifest .tmp/release/release.json --evidence .tmp/docs/private-consumer.json
       - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         if: always()
         with:
-          name: public-package-evidence-${{ github.run_attempt }}
+          name: private-package-evidence-${{ github.run_attempt }}
           path: .tmp/docs/*.json
           include-hidden-files: true
           if-no-files-found: ignore
           retention-days: 90
 
   docs:
-    needs: public-consumer
+    # Public documentation is approved; deploying remains an explicit release action.
+    if: ${{ vars.FLOWKIT_ENABLE_PAGES_DEPLOY == 'true' }}
+    needs: [pack, private-consumer]
     permissions:
       contents: read
       actions: read
+      packages: read
       pages: write
       id-token: write
     uses: ./.github/workflows/docs.yml
     with:
       packageReleaseCommit: ${{ github.sha }}
       docsCommit: ${{ github.sha }}
-      version: '1.0.0'
+      version: ${{ needs.pack.outputs.version }}
       releaseRunId: ${{ github.run_id }}
       releaseRunAttempt: ${{ github.run_attempt }}

.gitignore

@@ -4,3 +4,4 @@ dist/
 *.tgz
 website/doc_build/
 website/.rspress/
+.npmrc

.npmrc.example

@@ -0,0 +1,2 @@
+@devcodex-labs:registry=https://npm.pkg.github.com
+//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}

CHANGELOG.md

@@ -2,14 +2,15 @@
 
 ## 1.0.0
 
-FlowKit 的首个正式版本。
+FlowKit v1.0.0 发布候选（实际发布状态以 GitHub Packages 记录和 Git Tag 为准）。
 
 - 用 JavaScript / TypeScript 字面量 DSL 定义工作流，支持 Agent、业务动作、验证、并行、条件、循环、人工审批和终点。
 - 静态检查流程结构、数据声明、Skill 引用及受限条件表达式，输出可读 JavaScript 和 Mermaid。
 - 提供 run、compile、compileSource、check、evalWhen、isControlSignal，以及 compile/check 命令行。
+- 可选 capability-graph Provider 与宿主动作适配：仅负责能力声明、查询约束及显式动作绑定，不内置第二套 Runtime。
 - 通过宿主 Runtime 执行业务；支持本地和受限制的 HTTPS Skill、结果校验与重试、跟踪、取消信号及 AOT 一致性检查。
-- 提供详细中文文档、完整确定性示例和 MIT 许可证。
+- 提供详细中文文档、完整确定性示例和专有授权。
 
 需要 Node.js 22.13.0 或更高版本。FlowKit 不内置模型服务、Schema 校验器或持久化审批服务；这些能力由宿主提供。并行分支共享状态，any 汇合不会取消其他分支；AOT 部署仍需保留原始源码和对应 Skill。
 
-[文档](https://devcodex-labs.github.io/flowkit/) · [npm](https://www.npmjs.com/package/@devcodex/flowkit) · [许可证](LICENSE)
+[文档](https://devcodex-labs.github.io/flowkit/) · GitHub Packages（私有，需授权） · [许可证](LICENSE)

CONTRIBUTING.md

@@ -1,6 +1,6 @@
 # 参与贡献
 
-感谢你为 FlowKit 提供可复现的问题、文档改进和实现修复。完整流程见[中文贡献文档](https://devcodex-labs.github.io/flowkit/community/contributing.html)。
+FlowKit 为私有专有项目，仅允许经过授权的协作者提交问题、文档改进和实现修复。完整流程见[中文贡献文档](https://devcodex-labs.github.io/flowkit/community/contributing.html)。
 
 SDK 使用 Node >=22.13.0；同时开发文档站使用 Node >=24。在仓库根目录执行：
 
@@ -15,6 +15,6 @@ npm run docs:build
 
 使用 `npm run docs:dev` 编辑站点。示例主源位于 `examples/docs/`；修改后运行 `npm run docs:sync` 同步 README，再验证消费者。页面使用完整可执行文件、准确输出、错误恢复和相关链接；不要复制私有模块或提交临时日志。
 
-PR 说明具体问题、修复后行为、实际验证及未验证范围。公开接口或能力变化先讨论契约和必要性。生成产物使用 `npm run build` 与 `npm run update:goldens` 更新，不手改 header。发布由维护者按[发布说明](https://devcodex-labs.github.io/flowkit/maintainers/releasing.html)执行。
+PR 说明具体问题、修复后行为、实际验证及未验证范围。对外公开接口或能力变化先讨论契约和必要性。生成产物使用 `npm run build` 与 `npm run update:goldens` 更新，不手改 header。发布由维护者按[发布说明](https://devcodex-labs.github.io/flowkit/maintainers/releasing.html)执行。
 
-问题报告请附 Node/npm/系统、FlowKit 版本、最小 workflow/host/Skill、配置、命令与退出码、期望和实际结果。删除密钥、用户数据和不必要业务内容。项目使用 [MIT](LICENSE) 许可证。
+问题报告请附 Node/npm/系统、FlowKit 版本、最小 workflow/host/Skill、配置、命令与退出码、期望和实际结果。删除密钥、用户数据和不必要业务内容。项目使用 [专有授权协议](LICENSE)，访问私有仓库不自动取得再分发权利。

LICENSE

@@ -1,21 +1,48 @@
-MIT License
-
-Copyright (c) 2026 devcodex-labs
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+FlowKit Proprietary Software License
+Copyright (c) 2026 devcodex-labs. All rights reserved.
+
+1. Ownership. FlowKit's source code, software libraries, executable
+distributions, build artifacts, and associated documentation are proprietary
+to devcodex-labs and its licensors. This document grants no open-source
+license and no right to redistribute FlowKit.
+
+2. Internal authorized use. FlowKit is developed for operation by
+devcodex-labs and its expressly authorized internal contributors,
+contractors, and deployment environments. Any access to the private source
+repository or internal GitHub Packages registry is limited to the scope of
+permission expressly granted by the rights holder. Repository or package
+access alone is not a license to redistribute or offer the software.
+
+3. Restrictions. Unless the rights holder has given prior written
+permission or applicable law requires otherwise, you may not redistribute,
+publish, sublicense, sell, lease, transfer, or provide copies of FlowKit to
+third parties, or remove its proprietary notices. Modification and
+derivative distribution outside the permitted internal work are prohibited
+except to the extent these restrictions are unenforceable by law.
+
+4. Hosted services and generated workflows. The rights holder may operate
+FlowKit as the internal engine of a hosted API, MCP service, or paid workflow
+design service without distributing FlowKit to service users. Using such a
+service, reading its public documentation, or receiving a generated workflow
+does not grant any right to install or copy FlowKit. Customer access,
+service fees, and the ownership and usage rights of customer inputs and
+generated workflow definitions, JavaScript, or other outputs are matters
+for separate service terms. This software license does not itself decide
+those output rights or grant access to any hosted service.
+
+5. Third-party components. Dependencies and third-party content remain
+subject to their respective licenses. This document does not supersede
+those licenses.
+
+6. No warranty. To the fullest extent permitted by applicable law,
+FlowKit is provided "AS IS", without warranties of any kind, express or
+implied. The rights holder is not liable for indirect, incidental,
+special, consequential, or punitive damages arising from use of the
+software, to the extent permitted by law.
+
+7. Separate written agreements. Any duly authorized written agreement
+with devcodex-labs expressly governing a recipient's software rights
+takes precedence over this notice where the terms conflict.
+
+For permission to use, develop, or distribute FlowKit outside the
+authorized internal operation, contact the rights holder.