v1.1.0 — Roundtrip fidelity + config-knob enforcement + tool-ID symmetry

Correctness pass. The v0.3.0 schema additions (junction, tab locked/env, group g/info/x/y/w/h, comment w/h) were declared in flows-json.ts but never propagated through the decompile→compile pipeline, so any author tool re-staging a flow silently dropped them. This release closes that gap, wires the previously dead config knobs, and resolves the asymmetry between Node-RED IDs in list_flows output and authoring keys in author-tool inputs.

Fixes — lossy decompile/compile roundtrip

• Junction nodes round-trip via new TabSpec.junctions / SubflowDefSpec.junctions.
• Tab locked + env round-trip via typed TabSpec fields.
• Group x/y/w/h/g/info round-trip as top-level fields (previously dropped or misshaped into style).
• Comment w/h round-trip via CommentSpec.size.
• wire-targets validator now checks junction outgoing wires.
• Analyze structural counters and orphan-detection now include junctions.

Added — config-knob enforcement (previously declared but unenforced)

• MAX_FLOW_SIZE_BYTES, ALLOWED_NODE_TYPES, BLOCKED_NODE_TYPES enforced in author + dangerous flow-mutating paths.
• REQUIRE_SNAPSHOT_BEFORE_DEPLOY=false skips the pre-deploy snapshot and returns snapshot_before: null.
• REQUIRE_DIFF_BEFORE_DEPLOY=true refuses no-op deploys.
• SNAPSHOT_RETENTION auto-prunes per env on every save(); pre-dangerous and forced tags are protected.

Changed — list_flows and resolveTabId accept either form

• list_flows exposes both id (Node-RED tab ID) and authoring_key on each tab entry.
• Every author tool's tab_id parameter accepts either form.

Changed — read-tier annotation overrides

• set_target and export_snapshot declare readOnlyHint: false, idempotentHint: false.

Breaking changes

• deploy_staged_change.snapshot_before output widened from string to string | null (impacts only when REQUIRE_SNAPSHOT_BEFORE_DEPLOY=false).
• Author tools no longer silently drop junctions / tab locked / group geometry on re-stage.

Verification

538 unit + 17 property + 82 integration tests · 60/60 tool coverage · npm audit --omit=dev: 0 vulnerabilities.

Full notes: CHANGELOG.md § 1.1.0