Security boundary

const report = await nika.check(file)

if (!report.clean || report.cost?.has_unbounded) {
  throw new Error('workflow is not admitted here')
}

const plan = await nika.dryRunPlan(file)
authorize(plan.permits, plan.requirements)

await nika.runToEnd(file, {
  maxCostUsd: 0.25,
  signal: request.signal,
})