Build and typecheck a project without a run
Runs the project's build and typecheck commands in its sandbox and returns `{ ok, errors[] }` with every failure's output verbatim, so the free layer can check a project before any credits are spent. No agent run is started, no model is called, and nothing is written to the project. The exec timeout is enforced server-side: the body may ask for less than the 300 s `exec` ceiling but not more, and each command's output is capped at 16 KB as head plus tail.
Runs the project's build and typecheck commands in its sandbox and returns { ok, errors[] } with every failure's output verbatim, so the free layer can check a project before any credits are spent. No agent run is started, no model is called, and nothing is written to the project. The exec timeout is enforced server-side: the body may ask for less than the 300 s exec ceiling but not more, and each command's output is capped at 16 KB as head plus tail.
Path Parameters
The project the operation is about.
Request Body
application/json
The exec timeout to allow. Omit for the 120 s default.
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/projects/string/verify" \ -H "Content-Type: application/json" \ -d '{}'{ "ok": true, "build": { "ok": true, "exitCode": 0, "output": "string" }, "typecheck": { "ok": true, "exitCode": 0, "output": "string" }, "timedOut": true, "errors": [ { "step": "build", "exitCode": 0, "output": "string" } ]}Scan a project for drainer and phishing patterns POST
Runs the static drainer / phishing scanner over every readable source file in the project's sandbox and returns every hit with the rule that fired, the file, and the line. This is the same scanner and the same six rules the export gate uses, so `blocked: true` here means the export gate would refuse this project too. The matched text is redacted before it leaves the process; a seed phrase or private key is never returned whole. Read-only: nothing in the project is written or deleted.
Preview a project with a candidate brand kit POST
Renders the project with a candidate brand kit and returns a computed-style preview: the `--brand-*` tokens the kit's seam would declare, plus the kit's name, voice, and WCAG contrast report. The kit is applied to a COPY of the project and nothing is written to the project itself, so previewing a kit never counts as applying it and never breaks the brand-seam gate (zero diff outside `src/brand/` and `public/brand/`). No sandbox is started and no model is called. The kit must be owned by the caller; a foreign kit is not found.