@cat-factory/app 0.6.0

package/app/stores/observability.ts

@@ -0,0 +1,144 @@
+import { defineStore } from 'pinia'
+import { ref } from 'vue'
+import type { LlmCallActivity, LlmCallMetric } from '~/types/execution'
+import { useWorkspaceStore } from '~/stores/workspace'
+
+/**
+ * LLM observability state: the full per-call model activity for a run (prompts,
+ * responses, token usage, output-limit headroom, the transport-vs-execution
+ * latency split). Loaded on demand when the drill-down panel opens, then kept live:
+ * the proxy pushes a compact `llmCall` event per model call over the workspace
+ * stream, which `appendCall` folds in so an open panel updates in real time even
+ * while the durable driver is evicted. Live-appended rows carry no prompt/response
+ * bodies (the event stays small); the panel lazy-loads those for an expanded row
+ * from the persisted metrics endpoint. Per-workspace; nothing persisted.
+ */
+export const useObservabilityStore = defineStore('observability', () => {
+  const api = useApi()
+  const workspace = useWorkspaceStore()
+
+  /** Per-execution-id call list (newest first). */
+  const callsByExecution = ref<Record<string, LlmCallMetric[]>>({})
+  /** Execution ids currently loading. */
+  const loading = ref<Set<string>>(new Set())
+  /** Execution ids currently exporting. */
+  const exporting = ref<Set<string>>(new Set())
+  /** Last load error message per execution id, or null. */
+  const errors = ref<Record<string, string | null>>({})
+
+  function callsFor(executionId: string): LlmCallMetric[] {
+    return callsByExecution.value[executionId] ?? []
+  }
+  function isLoading(executionId: string): boolean {
+    return loading.value.has(executionId)
+  }
+  function isExporting(executionId: string): boolean {
+    return exporting.value.has(executionId)
+  }
+
+  function withFlag(set: typeof loading, key: string, on: boolean) {
+    const next = new Set(set.value)
+    if (on) next.add(key)
+    else next.delete(key)
+    set.value = next
+  }
+
+  /** Load (or refresh) the per-call detail for a run. */
+  async function load(executionId: string) {
+    if (!workspace.workspaceId) return
+    withFlag(loading, executionId, true)
+    errors.value = { ...errors.value, [executionId]: null }
+    // Seed the key up front so this run counts as "opened": `appendCall` only folds
+    // live events into already-opened runs, so seeding here both captures calls that
+    // arrive DURING the fetch and lets the merge below preserve them.
+    if (!callsByExecution.value[executionId]) {
+      callsByExecution.value = { ...callsByExecution.value, [executionId]: [] }
+    }
+    try {
+      const { calls } = await api.getLlmMetrics(workspace.requireId(), executionId)
+      // Preserve live-streamed rows the persisted store hasn't caught up with yet: the
+      // proxy emits the live `llmCall` event and writes the metric on INDEPENDENT paths,
+      // so a just-observed call can reach the panel before its row is queryable here.
+      // Server rows win (they carry the full bodies); the body-less live-only rows stay
+      // newest-first ahead of them so a wholesale replace can't drop them mid-run.
+      const fetchedIds = new Set(calls.map((c) => c.id))
+      const liveOnly = (callsByExecution.value[executionId] ?? []).filter(
+        (c) => !fetchedIds.has(c.id),
+      )
+      callsByExecution.value = {
+        ...callsByExecution.value,
+        [executionId]: [...liveOnly, ...calls],
+      }
+    } catch (err) {
+      errors.value = {
+        ...errors.value,
+        [executionId]: err instanceof Error ? err.message : 'Failed to load metrics',
+      }
+    } finally {
+      withFlag(loading, executionId, false)
+    }
+  }
+
+  /**
+   * Fold a live `llmCall` activity event into the cached call list for its run, so an
+   * open panel updates in real time. The compact event carries no prompt/response
+   * bodies, so we materialise a {@link LlmCallMetric} with empty bodies + zeroed delta
+   * fields; the panel lazy-loads the real bodies (by id) when the row is expanded.
+   * Prepended (newest-first, matching `load`'s order) and deduped by id so a later
+   * `load` that already includes the call, or a duplicate event, can't double it up.
+   *
+   * Gated to runs whose panel has been opened (`load` seeds the key): otherwise EVERY
+   * model call in the workspace would accumulate here for runs the user never opens,
+   * growing this store unbounded for the session's lifetime. An open panel still gets
+   * its live updates because it loaded on open.
+   */
+  function appendCall(activity: LlmCallActivity) {
+    const executionId = activity.executionId
+    if (!executionId) return
+    const existing = callsByExecution.value[executionId]
+    if (!existing) return
+    if (existing.some((c) => c.id === activity.id)) return
+    const row: LlmCallMetric = {
+      ...activity,
+      promptText: '',
+      promptPrefixCount: 0,
+      promptHash: '',
+      responseText: '',
+      reasoningText: '',
+    }
+    callsByExecution.value = { ...callsByExecution.value, [executionId]: [row, ...existing] }
+  }
+
+  /**
+   * Fetch the LLM-friendly export bundle and trigger a client-side download. The
+   * events socket auths via a Bearer header (a plain `<a download>` can't), so we
+   * fetch the JSON through the API client and save it from a Blob.
+   */
+  async function downloadExport(executionId: string) {
+    if (!workspace.workspaceId) return
+    withFlag(exporting, executionId, true)
+    try {
+      const bundle = await api.exportLlmMetrics(workspace.requireId(), executionId)
+      const blob = new Blob([JSON.stringify(bundle, null, 2)], { type: 'application/json' })
+      const url = URL.createObjectURL(blob)
+      const a = document.createElement('a')
+      a.href = url
+      a.download = `llm-metrics-${executionId}.json`
+      a.click()
+      URL.revokeObjectURL(url)
+    } finally {
+      withFlag(exporting, executionId, false)
+    }
+  }
+
+  return {
+    callsByExecution,
+    callsFor,
+    isLoading,
+    isExporting,
+    errors,
+    load,
+    appendCall,
+    downloadExport,
+  }
+})

package/app/stores/personalSubscriptions.ts

@@ -0,0 +1,215 @@
+import { defineStore } from 'pinia'
+import { computed, ref } from 'vue'
+import type {
+  PersonalSubscriptionStatus,
+  StorePersonalSubscriptionInput,
+  SubscriptionVendor,
+} from '~/types/domain'
+
+// The signed-in user's personal (individual-usage) subscriptions — Claude / GLM / Codex,
+// which are licensed per individual and so stored per-user (not pooled) and unlocked with
+// a personal PASSWORD. The token itself is double-encrypted server-side and never returned;
+// this store only carries metadata + the renewal warning.
+//
+// To keep the password mostly transparent, it is cached CLIENT-SIDE in localStorage under a
+// SINGLE key with a TTL: the backend gate applies one password to ALL of a run's
+// individual-usage vendors, so there's no point keying the cache per vendor. A task
+// start/retry (and each interaction with a live run) rides along with the cached password —
+// sent as the `X-Personal-Password` header — and the user is only re-prompted once it
+// expires (or is wrong).
+//
+// Caching here is a DELIBERATE convenience choice, not a security weakness. The password
+// layer exists to prevent ACCIDENTAL misuse (a credential can't be silently pooled); the
+// real at-rest protection is the server's system encryption, which the cache doesn't touch.
+// Re-prompting an engineer on every run would buy nobody anything (it wouldn't change the
+// threat model), so we don't. The server never stores the password, the raw token is never
+// returned to the client, and an external attacker still needs the system key — so the cache
+// only ever helps on the very device the user is already signed in on. (See
+// backend/docs/individual-subscription-usage.md §3.)
+
+/** How long a typed password stays cached before the user is re-prompted (40h). */
+const PASSWORD_TTL_MS = 40 * 60 * 60 * 1000
+const CACHE_KEY = 'cf.personal-pw'
+
+/** A credential prompt the UI must satisfy (set when the server replies 428). */
+export interface PendingCredential {
+  vendor: SubscriptionVendor
+  reason: 'no_subscription' | 'password_required' | 'wrong_password' | 'subscription_expired'
+  /** Re-run the gated action with the supplied password (start/retry). */
+  retry: (password: string) => Promise<void>
+  /** Abandon the prompt (Cancel / connect-instead): the gated action does NOT run. */
+  cancel: () => void
+}
+
+/** Pull `{ vendor, reason }` out of a 428 credential_required error, else null. */
+export function parseCredentialError(
+  error: unknown,
+): { vendor: SubscriptionVendor; reason: PendingCredential['reason'] } | null {
+  const data = (error as { data?: { error?: { code?: string; details?: unknown } } })?.data?.error
+  if (data?.code !== 'credential_required') return null
+  const details = data.details as {
+    vendor?: SubscriptionVendor
+    reason?: PendingCredential['reason']
+  }
+  if (!details?.vendor || !details?.reason) return null
+  return { vendor: details.vendor, reason: details.reason }
+}
+
+export const usePersonalSubscriptionsStore = defineStore('personalSubscriptions', () => {
+  const api = useApi()
+  const subscriptions = ref<PersonalSubscriptionStatus[]>([])
+  const loading = ref(false)
+  /** When set, a credential modal should open to satisfy the pending prompt. */
+  const pending = ref<PendingCredential | null>(null)
+
+  async function load() {
+    loading.value = true
+    try {
+      const { subscriptions: list } = await api.listPersonalSubscriptions()
+      subscriptions.value = list
+    } catch {
+      // Auth disabled / not signed in / feature off → no personal subscriptions surface.
+      subscriptions.value = []
+    } finally {
+      loading.value = false
+    }
+  }
+
+  async function store(input: StorePersonalSubscriptionInput) {
+    const status = await api.storePersonalSubscription(input)
+    subscriptions.value = [...subscriptions.value.filter((s) => s.vendor !== status.vendor), status]
+    // Cache the freshly-entered password so the next run rides along transparently.
+    setCachedPassword(input.password)
+    return status
+  }
+
+  async function remove(vendor: SubscriptionVendor) {
+    await api.removePersonalSubscription(vendor)
+    subscriptions.value = subscriptions.value.filter((s) => s.vendor !== vendor)
+    // Don't clear the shared password cache — other connected vendors may still use it.
+  }
+
+  function has(vendor: SubscriptionVendor): boolean {
+    return subscriptions.value.some((s) => s.vendor === vendor)
+  }
+
+  /** Subscriptions whose expiry is near or past — surfaced as a renewal nudge. */
+  const renewals = computed(() => subscriptions.value.filter((s) => s.renewSoon))
+
+  // --- client-side password cache (single localStorage key + TTL) ------------
+  function getCachedPassword(): string | undefined {
+    if (typeof localStorage === 'undefined') return undefined
+    try {
+      const raw = localStorage.getItem(CACHE_KEY)
+      if (!raw) return undefined
+      const { password, expiresAt } = JSON.parse(raw) as { password: string; expiresAt: number }
+      if (Date.now() > expiresAt) {
+        localStorage.removeItem(CACHE_KEY)
+        return undefined
+      }
+      return password
+    } catch {
+      return undefined
+    }
+  }
+
+  function setCachedPassword(password: string) {
+    if (typeof localStorage === 'undefined') return
+    try {
+      localStorage.setItem(
+        CACHE_KEY,
+        JSON.stringify({ password, expiresAt: Date.now() + PASSWORD_TTL_MS }),
+      )
+    } catch {
+      // best-effort
+    }
+  }
+
+  function clearCachedPassword() {
+    if (typeof localStorage === 'undefined') return
+    try {
+      localStorage.removeItem(CACHE_KEY)
+    } catch {
+      // best-effort
+    }
+  }
+
+  /**
+   * Run a gated action (start/retry) that may require a personal credential. Supplies the
+   * cached password on the first attempt; if the server replies 428, opens the credential
+   * modal and AWAITS the user satisfying or cancelling it (transparently retrying via the
+   * `pending.retry` closure). The caller's `action(password?)` performs the API call.
+   *
+   * Resolves `true` once the action actually ran (first try, or a successful retry), and
+   * `false` when the user cancels the prompt — so a caller showing an optimistic spinner
+   * can revert it instead of spinning forever. Still rejects for non-credential errors.
+   */
+  async function withCredential(action: (password?: string) => Promise<void>): Promise<boolean> {
+    // First attempt may carry no password (non-individual runs) or the single cached one;
+    // the server only consults it when the block needs it.
+    try {
+      await action(getCachedPassword())
+      return true
+    } catch (error) {
+      const credential = parseCredentialError(error)
+      if (!credential) throw error
+      // A stale/wrong cached password — drop it so the modal is the source of truth.
+      if (credential.reason === 'wrong_password') clearCachedPassword()
+      return await new Promise<boolean>((resolve) => {
+        const arm = (c: { vendor: SubscriptionVendor; reason: PendingCredential['reason'] }) => {
+          pending.value = {
+            ...c,
+            retry: async (password: string) => {
+              try {
+                await action(password)
+                setCachedPassword(password)
+                pending.value = null
+                resolve(true)
+              } catch (retryError) {
+                const again = parseCredentialError(retryError)
+                if (again) {
+                  // Still needs a credential (e.g. still-wrong password): keep the modal
+                  // open with the fresh reason and let it surface its own toast.
+                  if (again.reason === 'wrong_password') clearCachedPassword()
+                  arm(again)
+                  throw retryError
+                }
+                // A non-credential failure ends the flow: close the modal, revert the
+                // caller's optimistic state, and surface the error to the modal's toast.
+                pending.value = null
+                resolve(false)
+                throw retryError
+              }
+            },
+            cancel: () => {
+              pending.value = null
+              resolve(false)
+            },
+          }
+        }
+        arm(credential)
+      })
+    }
+  }
+
+  function dismissPending() {
+    // Settle the awaiting `withCredential` (the gated action never ran) before clearing.
+    const current = pending.value
+    pending.value = null
+    current?.cancel()
+  }
+
+  return {
+    subscriptions,
+    loading,
+    pending,
+    renewals,
+    load,
+    store,
+    remove,
+    has,
+    getCachedPassword,
+    withCredential,
+    dismissPending,
+  }
+})

package/app/stores/pipelines.ts

@@ -0,0 +1,327 @@
+import { defineStore } from 'pinia'
+import { computed, ref } from 'vue'
+import type { AgentKind, Pipeline } from '~/types/domain'
+import type { ConsensusStepConfig, StepGating } from '~/types/consensus'
+import { companionForProducer, uid } from '~/utils/catalog'
+import { useWorkspaceStore } from '~/stores/workspace'
+
+/** A sensible default config when a step is first flipped to consensus in the builder. */
+function defaultConsensusConfig(): ConsensusStepConfig {
+  return {
+    enabled: true,
+    strategy: 'specialist-panel',
+    participants: [
+      { id: uid('cp'), role: 'Pragmatist', systemFraming: 'Favour the simplest viable approach.' },
+      {
+        id: uid('cp'),
+        role: 'Skeptic',
+        systemFraming: 'Probe risks, edge cases and failure modes.',
+      },
+    ],
+  }
+}
+
+/**
+ * Saved, reusable pipelines (the pipeline palette) plus the in-progress draft
+ * being assembled in the pipeline builder. Saved pipelines live on the backend;
+ * the draft is transient client state. The draft doubles as the EDIT surface: a
+ * custom pipeline can be loaded into it (`loadForEdit`) and saved back in place,
+ * while a built-in is cloned first (`clonePipeline`) into an editable copy.
+ */
+export const usePipelinesStore = defineStore('pipelines', () => {
+  const api = useApi()
+  const pipelines = ref<Pipeline[]>([])
+
+  /** The chain currently being assembled in the builder. */
+  const draft = ref<AgentKind[]>([])
+  /** Per-step approval gates, kept index-aligned with `draft`. */
+  const draftGates = ref<boolean[]>([])
+  /** Per-step enable flags, kept index-aligned with `draft` (false ⇒ skipped at run). */
+  const draftEnabled = ref<boolean[]>([])
+  /**
+   * Per-step companion thresholds, kept index-aligned with `draft`. Not editable in the
+   * builder UI today, but carried through edits so an existing pipeline's thresholds
+   * survive a save.
+   */
+  const draftThresholds = ref<(number | null)[]>([])
+  /** Per-step consensus configs, kept index-aligned with `draft` (null ⇒ standard agent). */
+  const draftConsensus = ref<(ConsensusStepConfig | null)[]>([])
+  /** Per-step estimate gating, kept index-aligned with `draft` (null ⇒ always run). */
+  const draftGating = ref<(StepGating | null)[]>([])
+  /** Organizational labels for the pipeline being assembled/edited. */
+  const draftLabels = ref<string[]>([])
+  const draftName = ref('New pipeline')
+  /** The id of the pipeline being edited, or null when assembling a brand-new one. */
+  const editingId = ref<string | null>(null)
+
+  /** Replace the cached pipelines with a server snapshot. */
+  function hydrate(next: Pipeline[]) {
+    pipelines.value = next
+  }
+
+  function getPipeline(id: string) {
+    return pipelines.value.find((p) => p.id === id)
+  }
+
+  /** Insert a step (with its default per-step config) at `index`, keeping arrays aligned. */
+  function insertAt(index: number, kind: AgentKind) {
+    draft.value.splice(index, 0, kind)
+    draftGates.value.splice(index, 0, false)
+    draftEnabled.value.splice(index, 0, true)
+    draftThresholds.value.splice(index, 0, null)
+    draftConsensus.value.splice(index, 0, null)
+    draftGating.value.splice(index, 0, null)
+  }
+
+  function addToDraft(kind: AgentKind) {
+    insertAt(draft.value.length, kind)
+  }
+
+  function removeFromDraft(index: number) {
+    draft.value.splice(index, 1)
+    draftGates.value.splice(index, 1)
+    draftEnabled.value.splice(index, 1)
+    draftThresholds.value.splice(index, 1)
+    draftConsensus.value.splice(index, 1)
+    draftGating.value.splice(index, 1)
+  }
+
+  function moveInDraft(from: number, to: number) {
+    if (to < 0 || to >= draft.value.length) return
+    const [item] = draft.value.splice(from, 1)
+    if (item) draft.value.splice(to, 0, item)
+    const [gate] = draftGates.value.splice(from, 1)
+    draftGates.value.splice(to, 0, gate ?? false)
+    const [on] = draftEnabled.value.splice(from, 1)
+    draftEnabled.value.splice(to, 0, on ?? true)
+    const [th] = draftThresholds.value.splice(from, 1)
+    draftThresholds.value.splice(to, 0, th ?? null)
+    const [cons] = draftConsensus.value.splice(from, 1)
+    draftConsensus.value.splice(to, 0, cons ?? null)
+    const [gat] = draftGating.value.splice(from, 1)
+    draftGating.value.splice(to, 0, gat ?? null)
+  }
+
+  /** Whether the producer step at `index` currently has its companion attached after it. */
+  function hasCompanion(index: number): boolean {
+    const companion = companionForProducer(draft.value[index] ?? '')
+    return companion !== undefined && draft.value[index + 1] === companion
+  }
+
+  /**
+   * Toggle the dependent companion on the producer step at `index`: insert it immediately
+   * after (turn on) or remove it (turn off). A no-op for a kind that has no companion.
+   */
+  function toggleCompanion(index: number) {
+    const companion = companionForProducer(draft.value[index] ?? '')
+    if (!companion) return
+    if (draft.value[index + 1] === companion) removeFromDraft(index + 1)
+    else insertAt(index + 1, companion)
+  }
+
+  /** Toggle estimate gating on/off for the (companion) step at `index`. */
+  function toggleDraftGating(index: number) {
+    draftGating.value[index] = draftGating.value[index]?.enabled
+      ? null
+      : { enabled: true, minRisk: 0.5, minImpact: 0.5 }
+  }
+
+  /**
+   * The draft as a list of "units" for rendering: each step is one unit, EXCEPT a companion
+   * that sits immediately after its producer — that companion is folded into the producer's
+   * unit (`companionIndex`) and surfaced as a toggle on it, not a standalone row. The backend
+   * now REJECTS a companion that is not immediately after its producer (strict adjacency in
+   * `validatePipelineShape`), so a saved pipeline never has one — but a stray companion that
+   * still shows up in the draft (e.g. a pre-existing pipeline saved before adjacency was
+   * enforced) is emitted as its own standalone unit so it stays visible and removable/
+   * reorderable into a valid shape rather than being silently dropped — and, crucially, so
+   * every `draft` index belongs to exactly one unit, which is what lets {@link moveUnit}
+   * reorder by unit boundaries without ever dropping a step.
+   * `index`/`companionIndex` are positions in the raw `draft` arrays.
+   */
+  const units = computed(() => {
+    const out: { index: number; kind: AgentKind; companionIndex: number | null }[] = []
+    let folded = -1 // draft index already consumed as the previous unit's adjacent companion
+    for (let i = 0; i < draft.value.length; i++) {
+      const kind = draft.value[i]
+      if (kind === undefined || i === folded) continue
+      const companion = companionForProducer(kind)
+      const companionIndex = companion && draft.value[i + 1] === companion ? i + 1 : null
+      if (companionIndex !== null) folded = companionIndex
+      out.push({ index: i, kind, companionIndex })
+    }
+    return out
+  })
+
+  /**
+   * Move the unit at visible position `from` to `to`, carrying its attached companion. Rebuilds
+   * every parallel array by the SAME unit boundaries so they stay index-aligned.
+   */
+  function moveUnit(from: number, to: number) {
+    const u = units.value
+    if (to < 0 || to >= u.length || from === to) return
+    const reorder = <T>(arr: T[]): T[] => {
+      const chunks = u.map((unit) =>
+        arr.slice(unit.index, unit.index + (unit.companionIndex !== null ? 2 : 1)),
+      )
+      const [moved] = chunks.splice(from, 1)
+      if (moved) chunks.splice(to, 0, moved)
+      return chunks.flat()
+    }
+    draft.value = reorder(draft.value)
+    draftGates.value = reorder(draftGates.value)
+    draftEnabled.value = reorder(draftEnabled.value)
+    draftThresholds.value = reorder(draftThresholds.value)
+    draftConsensus.value = reorder(draftConsensus.value)
+    draftGating.value = reorder(draftGating.value)
+  }
+
+  /** Toggle the consensus mechanism on the draft step at `index` (default config / off). */
+  function toggleDraftConsensus(index: number) {
+    draftConsensus.value[index] = draftConsensus.value[index] ? null : defaultConsensusConfig()
+  }
+
+  /** Replace the consensus config of the draft step at `index` (builder editor edits). */
+  function setDraftConsensus(index: number, config: ConsensusStepConfig | null) {
+    draftConsensus.value[index] = config
+  }
+
+  /** Toggle the approval gate on the draft step at `index`. */
+  function toggleDraftGate(index: number) {
+    draftGates.value[index] = !draftGates.value[index]
+  }
+
+  /** Enable/disable the draft step at `index` without removing it. */
+  function toggleDraftEnabled(index: number) {
+    draftEnabled.value[index] = draftEnabled.value[index] === false
+  }
+
+  function clearDraft() {
+    draft.value = []
+    draftGates.value = []
+    draftEnabled.value = []
+    draftThresholds.value = []
+    draftConsensus.value = []
+    draftGating.value = []
+    draftLabels.value = []
+    draftName.value = 'New pipeline'
+    editingId.value = null
+  }
+
+  /** Load an existing (custom) pipeline into the draft so it can be edited in place. */
+  function loadForEdit(pipeline: Pipeline) {
+    draft.value = [...pipeline.agentKinds]
+    draftGates.value = pipeline.agentKinds.map((_, i) => pipeline.gates?.[i] ?? false)
+    draftEnabled.value = pipeline.agentKinds.map((_, i) => pipeline.enabled?.[i] ?? true)
+    draftThresholds.value = pipeline.agentKinds.map((_, i) => pipeline.thresholds?.[i] ?? null)
+    draftConsensus.value = pipeline.agentKinds.map((_, i) => pipeline.consensus?.[i] ?? null)
+    draftGating.value = pipeline.agentKinds.map((_, i) => pipeline.gating?.[i] ?? null)
+    draftLabels.value = [...(pipeline.labels ?? [])]
+    draftName.value = pipeline.name
+    editingId.value = pipeline.id
+  }
+
+  /** The optional arrays to send, omitting the ones that are at their defaults. */
+  function draftPayload() {
+    return {
+      name: draftName.value.trim() || 'Untitled pipeline',
+      agentKinds: [...draft.value],
+      // Only send gates when at least one step is gated.
+      ...(draftGates.value.some(Boolean) ? { gates: [...draftGates.value] } : {}),
+      // Only send enabled when at least one step is disabled (default is all-on).
+      ...(draftEnabled.value.some((e) => e === false) ? { enabled: [...draftEnabled.value] } : {}),
+      // Only send thresholds when at least one step pins an explicit value.
+      ...(draftThresholds.value.some((t) => t != null)
+        ? { thresholds: [...draftThresholds.value] }
+        : {}),
+      // Only send consensus when at least one step is consensus-enabled.
+      ...(draftConsensus.value.some((c) => c?.enabled)
+        ? { consensus: [...draftConsensus.value] }
+        : {}),
+      // Only send gating when at least one step has gating enabled.
+      ...(draftGating.value.some((g) => g?.enabled) ? { gating: [...draftGating.value] } : {}),
+      // Only send labels when there are any.
+      ...(draftLabels.value.length ? { labels: [...draftLabels.value] } : {}),
+    }
+  }
+
+  /** Persist the draft: update the pipeline being edited, else create a new one. */
+  async function saveDraft(): Promise<Pipeline | null> {
+    if (draft.value.length === 0) return null
+    const wsId = useWorkspaceStore().requireId()
+    const payload = draftPayload()
+    if (editingId.value) {
+      const updated = await api.updatePipeline(wsId, editingId.value, payload)
+      const i = pipelines.value.findIndex((p) => p.id === updated.id)
+      if (i >= 0) pipelines.value[i] = updated
+      clearDraft()
+      return updated
+    }
+    const pipeline = await api.createPipeline(wsId, payload)
+    pipelines.value.push(pipeline)
+    clearDraft()
+    return pipeline
+  }
+
+  /** Clone any pipeline (built-in or custom) into an editable copy, ready to edit. */
+  async function clonePipeline(id: string): Promise<Pipeline> {
+    const clone = await api.clonePipeline(useWorkspaceStore().requireId(), id)
+    pipelines.value.push(clone)
+    loadForEdit(clone)
+    return clone
+  }
+
+  async function removePipeline(id: string) {
+    await api.removePipeline(useWorkspaceStore().requireId(), id)
+    pipelines.value = pipelines.value.filter((p) => p.id !== id)
+    if (editingId.value === id) clearDraft()
+  }
+
+  /** Set a pipeline's organizational metadata (labels / archive). Works on built-ins too. */
+  async function organize(id: string, body: { labels?: string[]; archived?: boolean }) {
+    const updated = await api.organizePipeline(useWorkspaceStore().requireId(), id, body)
+    const i = pipelines.value.findIndex((p) => p.id === updated.id)
+    if (i >= 0) pipelines.value[i] = updated
+    return updated
+  }
+
+  const archive = (id: string) => organize(id, { archived: true })
+  const unarchive = (id: string) => organize(id, { archived: false })
+  const setLabels = (id: string, labels: string[]) => organize(id, { labels })
+
+  return {
+    pipelines,
+    draft,
+    draftGates,
+    draftEnabled,
+    draftThresholds,
+    draftConsensus,
+    draftGating,
+    draftLabels,
+    draftName,
+    editingId,
+    units,
+    hydrate,
+    getPipeline,
+    addToDraft,
+    removeFromDraft,
+    moveInDraft,
+    moveUnit,
+    hasCompanion,
+    toggleCompanion,
+    toggleDraftGating,
+    toggleDraftGate,
+    toggleDraftEnabled,
+    toggleDraftConsensus,
+    setDraftConsensus,
+    clearDraft,
+    loadForEdit,
+    saveDraft,
+    clonePipeline,
+    removePipeline,
+    organize,
+    archive,
+    unarchive,
+    setLabels,
+  }
+})