Security boundary

const report = await nika.check(file)

if (!report.clean) {
  throw new Error('workflow is not admitted here')
}

authorizeEngineReport(report)

const run = await nika.run(file, {
  maxCostUsd: 0.25,
})

// Wire cancellation defensively: an already-aborted signal never fires
// 'abort' again, and a rejected cancel promise must not go unhandled.
if (request.signal.aborted) {
  void run.cancel().catch(() => {})
} else {
  request.signal.addEventListener(
    'abort',
    () => { void run.cancel().catch(() => {}) },
    { once: true },
  )
}
const result = await run.result()